2009-05-28 13:10:02 +00:00
|
|
|
|
# This module provides configuration for the PAM (Pluggable
|
|
|
|
|
# Authentication Modules) system.
|
|
|
|
|
|
2014-04-14 14:26:48 +00:00
|
|
|
|
{ config, lib, pkgs, ... }:
|
2009-05-28 13:10:02 +00:00
|
|
|
|
|
2014-04-14 14:26:48 +00:00
|
|
|
|
with lib;
|
2009-08-16 14:49:14 +00:00
|
|
|
|
|
2009-05-28 13:10:02 +00:00
|
|
|
|
let
|
2014-05-05 19:18:53 +00:00
|
|
|
|
parentConfig = config;
|
2009-05-28 13:10:02 +00:00
|
|
|
|
|
2014-05-05 19:18:53 +00:00
|
|
|
|
pamOpts = { config, name, ... }: let cfg = config; in let config = parentConfig; in {
|
2013-10-15 12:47:51 +00:00
|
|
|
|
|
|
|
|
|
options = {
|
|
|
|
|
|
|
|
|
|
name = mkOption {
|
|
|
|
|
example = "sshd";
|
2013-10-30 10:02:04 +00:00
|
|
|
|
type = types.str;
|
2013-10-15 12:47:51 +00:00
|
|
|
|
description = lib.mdDoc "Name of the PAM service.";
|
|
|
|
|
};
|
|
|
|
|
|
2013-10-15 13:05:49 +00:00
|
|
|
|
unixAuth = mkOption {
|
|
|
|
|
default = true;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Whether users can log in with passwords defined in
|
|
|
|
|
{file}`/etc/shadow`.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2013-10-15 12:47:51 +00:00
|
|
|
|
rootOK = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
If set, root doesn't need to authenticate (e.g. for the
|
|
|
|
|
{command}`useradd` service).
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2020-05-30 09:03:10 +00:00
|
|
|
|
p11Auth = mkOption {
|
|
|
|
|
default = config.security.pam.p11.enable;
|
|
|
|
|
defaultText = literalExpression "config.security.pam.p11.enable";
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
If set, keys listed in
|
|
|
|
|
{file}`~/.ssh/authorized_keys` and
|
|
|
|
|
{file}`~/.eid/authorized_certificates`
|
|
|
|
|
can be used to log in with the associated PKCS#11 tokens.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2015-05-03 14:29:42 +00:00
|
|
|
|
u2fAuth = mkOption {
|
2019-01-29 16:45:26 +00:00
|
|
|
|
default = config.security.pam.u2f.enable;
|
|
|
|
|
defaultText = literalExpression "config.security.pam.u2f.enable";
|
2015-05-03 14:29:42 +00:00
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
If set, users listed in
|
2019-01-29 16:45:26 +00:00
|
|
|
|
{file}`$XDG_CONFIG_HOME/Yubico/u2f_keys` (or
|
|
|
|
|
{file}`$HOME/.config/Yubico/u2f_keys` if XDG variable is
|
|
|
|
|
not set) are able to log in with the associated U2F key. Path can be
|
|
|
|
|
changed using {option}`security.pam.u2f.authFile` option.
|
2015-05-03 14:29:42 +00:00
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2022-03-13 17:20:23 +00:00
|
|
|
|
usshAuth = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
If set, users with an SSH certificate containing an authorized principal
|
|
|
|
|
in their SSH agent are able to log in. Specific options are controlled
|
|
|
|
|
using the {option}`security.pam.ussh` options.
|
|
|
|
|
|
|
|
|
|
Note that the {option}`security.pam.ussh.enable` must also be
|
|
|
|
|
set for this option to take effect.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2019-03-31 01:07:16 +00:00
|
|
|
|
yubicoAuth = mkOption {
|
|
|
|
|
default = config.security.pam.yubico.enable;
|
|
|
|
|
defaultText = literalExpression "config.security.pam.yubico.enable";
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
If set, users listed in
|
|
|
|
|
{file}`~/.yubico/authorized_yubikeys`
|
2020-05-12 19:51:07 +00:00
|
|
|
|
are able to log in with the associated Yubikey tokens.
|
2019-03-31 01:07:16 +00:00
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2018-02-08 07:18:30 +00:00
|
|
|
|
googleAuthenticator = {
|
|
|
|
|
enable = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
If set, users with enabled Google Authenticator (created
|
|
|
|
|
{file}`~/.google_authenticator`) will be required
|
|
|
|
|
to provide Google Authenticator token to log in.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
2013-10-15 12:47:51 +00:00
|
|
|
|
usbAuth = mkOption {
|
|
|
|
|
default = config.security.pam.usb.enable;
|
|
|
|
|
defaultText = literalExpression "config.security.pam.usb.enable";
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
If set, users listed in
|
|
|
|
|
{file}`/etc/pamusb.conf` are able to log in
|
|
|
|
|
with the associated USB key.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
otpwAuth = mkOption {
|
|
|
|
|
default = config.security.pam.enableOTPW;
|
|
|
|
|
defaultText = literalExpression "config.security.pam.enableOTPW";
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
If set, the OTPW system will be used (if
|
|
|
|
|
{file}`~/.otpw` exists).
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2018-12-12 12:53:51 +00:00
|
|
|
|
googleOsLoginAccountVerification = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
If set, will use the Google OS Login PAM modules
|
|
|
|
|
(`pam_oslogin_login`,
|
|
|
|
|
`pam_oslogin_admin`) to verify possible OS Login
|
|
|
|
|
users and set sudoers configuration accordingly.
|
|
|
|
|
This only makes sense to enable for the `sshd` PAM
|
|
|
|
|
service.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
googleOsLoginAuthentication = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
If set, will use the `pam_oslogin_login`'s user
|
|
|
|
|
authentication methods to authenticate users using 2FA.
|
|
|
|
|
This only makes sense to enable for the `sshd` PAM
|
|
|
|
|
service.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2022-07-29 15:23:44 +00:00
|
|
|
|
mysqlAuth = mkOption {
|
|
|
|
|
default = config.users.mysql.enable;
|
|
|
|
|
defaultText = literalExpression "config.users.mysql.enable";
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
If set, the `pam_mysql` module will be used to
|
|
|
|
|
authenticate users against a MySQL/MariaDB database.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2015-01-03 16:47:38 +00:00
|
|
|
|
fprintAuth = mkOption {
|
|
|
|
|
default = config.services.fprintd.enable;
|
|
|
|
|
defaultText = literalExpression "config.services.fprintd.enable";
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
If set, fingerprint reader will be used (if exists and
|
|
|
|
|
your fingerprints are enrolled).
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2015-02-14 22:52:22 +00:00
|
|
|
|
oathAuth = mkOption {
|
2016-02-24 21:41:02 +00:00
|
|
|
|
default = config.security.pam.oath.enable;
|
|
|
|
|
defaultText = literalExpression "config.security.pam.oath.enable";
|
2015-02-14 22:52:22 +00:00
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
If set, the OATH Toolkit will be used.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2013-10-15 12:47:51 +00:00
|
|
|
|
sshAgentAuth = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
If set, the calling user's SSH agent is used to authenticate
|
|
|
|
|
against the keys in the calling user's
|
|
|
|
|
{file}`~/.ssh/authorized_keys`. This is useful
|
|
|
|
|
for {command}`sudo` on password-less remote systems.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2019-02-13 01:12:51 +00:00
|
|
|
|
duoSecurity = {
|
|
|
|
|
enable = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
If set, use the Duo Security pam module
|
|
|
|
|
`pam_duo` for authentication. Requires
|
|
|
|
|
configuration of {option}`security.duosec` options.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
2013-10-15 12:47:51 +00:00
|
|
|
|
startSession = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
If set, the service will register a new session with
|
|
|
|
|
systemd's login manager. For local sessions, this will give
|
|
|
|
|
the user access to audio devices, CD-ROM drives. In the
|
|
|
|
|
default PolicyKit configuration, it also allows the user to
|
|
|
|
|
reboot the system.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2016-09-06 15:23:27 +00:00
|
|
|
|
setEnvironment = mkOption {
|
|
|
|
|
type = types.bool;
|
|
|
|
|
default = true;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Whether the service should set the environment variables
|
|
|
|
|
listed in {option}`environment.sessionVariables`
|
|
|
|
|
using `pam_env.so`.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2013-10-15 12:47:51 +00:00
|
|
|
|
setLoginUid = mkOption {
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Set the login uid of the process
|
|
|
|
|
({file}`/proc/self/loginuid`) for auditing
|
|
|
|
|
purposes. The login uid is only set by ‘entry points’ like
|
|
|
|
|
{command}`login` and {command}`sshd`, not by
|
|
|
|
|
commands like {command}`sudo`.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2021-09-13 12:43:12 +00:00
|
|
|
|
ttyAudit = {
|
|
|
|
|
enable = mkOption {
|
|
|
|
|
type = types.bool;
|
|
|
|
|
default = false;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Enable or disable TTY auditing for specified users
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
enablePattern = mkOption {
|
|
|
|
|
type = types.nullOr types.str;
|
|
|
|
|
default = null;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
For each user matching one of comma-separated
|
|
|
|
|
glob patterns, enable TTY auditing
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
disablePattern = mkOption {
|
|
|
|
|
type = types.nullOr types.str;
|
|
|
|
|
default = null;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
For each user matching one of comma-separated
|
|
|
|
|
glob patterns, disable TTY auditing
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
openOnly = mkOption {
|
|
|
|
|
type = types.bool;
|
|
|
|
|
default = false;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Set the TTY audit flag when opening the session,
|
|
|
|
|
but do not restore it when closing the session.
|
|
|
|
|
Using this option is necessary for some services
|
|
|
|
|
that don't fork() to run the authenticated session,
|
|
|
|
|
such as sudo.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
2013-10-15 12:47:51 +00:00
|
|
|
|
forwardXAuth = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Whether X authentication keys should be passed from the
|
|
|
|
|
calling user to the target user (e.g. for
|
|
|
|
|
{command}`su`)
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2015-07-02 14:46:56 +00:00
|
|
|
|
pamMount = mkOption {
|
|
|
|
|
default = config.security.pam.mount.enable;
|
|
|
|
|
defaultText = literalExpression "config.security.pam.mount.enable";
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
2022-12-18 00:31:14 +00:00
|
|
|
|
Enable PAM mount (pam_mount) system to mount filesystems on user login.
|
2015-07-02 14:46:56 +00:00
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2013-10-15 12:47:51 +00:00
|
|
|
|
allowNullPassword = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Whether to allow logging into accounts that have no password
|
|
|
|
|
set (i.e., have an empty password field in
|
|
|
|
|
{file}`/etc/passwd` or
|
|
|
|
|
{file}`/etc/group`). This does not enable
|
|
|
|
|
logging into disabled accounts (i.e., that have the password
|
|
|
|
|
field set to `!`). Note that regardless of
|
|
|
|
|
what the pam_unix documentation says, accounts with hashed
|
|
|
|
|
empty passwords are always allowed to log in.
|
|
|
|
|
'';
|
|
|
|
|
};
|
2012-09-16 17:14:19 +00:00
|
|
|
|
|
2020-02-23 13:55:47 +00:00
|
|
|
|
nodelay = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
2022-12-18 00:31:14 +00:00
|
|
|
|
Whether the delay after typing a wrong password should be disabled.
|
2020-02-23 13:55:47 +00:00
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2014-05-16 20:37:44 +00:00
|
|
|
|
requireWheel = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Whether to permit root access only to members of group wheel.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2013-10-15 12:47:51 +00:00
|
|
|
|
limits = mkOption {
|
2021-12-07 17:26:25 +00:00
|
|
|
|
default = [];
|
|
|
|
|
type = limitsType;
|
2013-10-15 12:47:51 +00:00
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Attribute set describing resource limits. Defaults to the
|
|
|
|
|
value of {option}`security.pam.loginLimits`.
|
2022-08-13 09:35:46 +00:00
|
|
|
|
The meaning of the values is explained in {manpage}`limits.conf(5)`.
|
2013-10-15 12:47:51 +00:00
|
|
|
|
'';
|
|
|
|
|
};
|
2009-05-28 13:10:02 +00:00
|
|
|
|
|
2013-10-15 12:47:51 +00:00
|
|
|
|
showMotd = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc "Whether to show the message of the day.";
|
|
|
|
|
};
|
2009-08-16 15:46:24 +00:00
|
|
|
|
|
2014-04-15 14:46:35 +00:00
|
|
|
|
makeHomeDir = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Whether to try to create home directories for users
|
|
|
|
|
with `$HOME`s pointing to nonexistent
|
|
|
|
|
locations on session login.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2013-10-15 12:47:51 +00:00
|
|
|
|
updateWtmp = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc "Whether to update {file}`/var/log/wtmp`.";
|
|
|
|
|
};
|
2010-01-12 11:02:23 +00:00
|
|
|
|
|
2014-05-14 15:53:58 +00:00
|
|
|
|
logFailures = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc "Whether to log authentication failures in {file}`/var/log/faillog`.";
|
|
|
|
|
};
|
|
|
|
|
|
2015-04-18 21:15:35 +00:00
|
|
|
|
enableAppArmor = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Enable support for attaching AppArmor profiles at the
|
|
|
|
|
user/group level, e.g., as part of a role based access
|
|
|
|
|
control scheme.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2017-02-15 00:38:52 +00:00
|
|
|
|
enableKwallet = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
If enabled, pam_wallet will attempt to automatically unlock the
|
|
|
|
|
user's default KDE wallet upon login. If the user has no wallet named
|
|
|
|
|
"kdewallet", or the login password does not match their wallet
|
|
|
|
|
password, KDE will prompt separately after login.
|
|
|
|
|
'';
|
|
|
|
|
};
|
2017-11-22 17:07:04 +00:00
|
|
|
|
sssdStrictAccess = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc "enforce sssd access control";
|
|
|
|
|
};
|
2017-02-15 00:38:52 +00:00
|
|
|
|
|
2017-10-22 12:42:00 +00:00
|
|
|
|
enableGnomeKeyring = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
If enabled, pam_gnome_keyring will attempt to automatically unlock the
|
|
|
|
|
user's default Gnome keyring upon login. If the user login password does
|
|
|
|
|
not match their keyring password, Gnome Keyring will prompt separately
|
|
|
|
|
after login.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2022-11-07 11:16:35 +00:00
|
|
|
|
failDelay = {
|
|
|
|
|
enable = mkOption {
|
|
|
|
|
type = types.bool;
|
|
|
|
|
default = false;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
If enabled, this will replace the `FAIL_DELAY` setting from `login.defs`.
|
|
|
|
|
Change the delay on failure per-application.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
delay = mkOption {
|
|
|
|
|
default = 3000000;
|
|
|
|
|
type = types.int;
|
|
|
|
|
example = 1000000;
|
|
|
|
|
description = lib.mdDoc "The delay time (in microseconds) on failure.";
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
2020-09-11 00:13:53 +00:00
|
|
|
|
gnupg = {
|
|
|
|
|
enable = mkOption {
|
|
|
|
|
type = types.bool;
|
|
|
|
|
default = false;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
If enabled, pam_gnupg will attempt to automatically unlock the
|
|
|
|
|
user's GPG keys with the login password via
|
|
|
|
|
{command}`gpg-agent`. The keygrips of all keys to be
|
|
|
|
|
unlocked should be written to {file}`~/.pam-gnupg`,
|
|
|
|
|
and can be queried with {command}`gpg -K --with-keygrip`.
|
|
|
|
|
Presetting passphrases must be enabled by adding
|
|
|
|
|
`allow-preset-passphrase` in
|
|
|
|
|
{file}`~/.gnupg/gpg-agent.conf`.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
noAutostart = mkOption {
|
|
|
|
|
type = types.bool;
|
|
|
|
|
default = false;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Don't start {command}`gpg-agent` if it is not running.
|
|
|
|
|
Useful in conjunction with starting {command}`gpg-agent` as
|
|
|
|
|
a systemd user service.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
storeOnly = mkOption {
|
|
|
|
|
type = types.bool;
|
|
|
|
|
default = false;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Don't send the password immediately after login, but store for PAM
|
|
|
|
|
`session`.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
2023-04-29 17:35:29 +00:00
|
|
|
|
zfs = mkOption {
|
|
|
|
|
default = config.security.pam.zfs.enable;
|
|
|
|
|
defaultText = literalExpression "config.security.pam.zfs.enable";
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
2023-04-30 09:32:16 +00:00
|
|
|
|
Enable unlocking and mounting of encrypted ZFS home dataset at login.
|
2023-04-29 17:35:29 +00:00
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2013-10-15 12:47:51 +00:00
|
|
|
|
text = mkOption {
|
2013-10-30 16:37:45 +00:00
|
|
|
|
type = types.nullOr types.lines;
|
2013-10-15 12:47:51 +00:00
|
|
|
|
description = lib.mdDoc "Contents of the PAM service file.";
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
};
|
|
|
|
|
|
2021-11-27 08:13:53 +00:00
|
|
|
|
# The resulting /etc/pam.d/* file contents are verified in
|
|
|
|
|
# nixos/tests/pam/pam-file-contents.nix. Please update tests there when
|
|
|
|
|
# changing the derivation.
|
2014-05-05 19:18:53 +00:00
|
|
|
|
config = {
|
|
|
|
|
name = mkDefault name;
|
2013-10-15 12:47:51 +00:00
|
|
|
|
setLoginUid = mkDefault cfg.startSession;
|
|
|
|
|
limits = mkDefault config.security.pam.loginLimits;
|
2012-10-23 13:10:48 +00:00
|
|
|
|
|
2013-10-15 12:47:51 +00:00
|
|
|
|
# !!! TODO: move the LDAP stuff to the LDAP module, and the
|
|
|
|
|
# Samba stuff to the Samba module. This requires that the PAM
|
|
|
|
|
# module provides the right hooks.
|
|
|
|
|
text = mkDefault
|
2021-11-12 01:19:54 +00:00
|
|
|
|
(
|
|
|
|
|
''
|
|
|
|
|
# Account management.
|
|
|
|
|
'' +
|
|
|
|
|
optionalString use_ldap ''
|
|
|
|
|
account sufficient ${pam_ldap}/lib/security/pam_ldap.so
|
|
|
|
|
'' +
|
2022-07-29 15:23:44 +00:00
|
|
|
|
optionalString cfg.mysqlAuth ''
|
|
|
|
|
account sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf
|
|
|
|
|
'' +
|
2023-06-08 20:35:30 +00:00
|
|
|
|
optionalString (config.services.kanidm.enablePam) ''
|
|
|
|
|
account sufficient ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user
|
|
|
|
|
'' +
|
2021-11-12 01:19:54 +00:00
|
|
|
|
optionalString (config.services.sssd.enable && cfg.sssdStrictAccess==false) ''
|
|
|
|
|
account sufficient ${pkgs.sssd}/lib/security/pam_sss.so
|
|
|
|
|
'' +
|
|
|
|
|
optionalString (config.services.sssd.enable && cfg.sssdStrictAccess) ''
|
|
|
|
|
account [default=bad success=ok user_unknown=ignore] ${pkgs.sssd}/lib/security/pam_sss.so
|
|
|
|
|
'' +
|
2022-07-16 05:38:42 +00:00
|
|
|
|
optionalString config.security.pam.krb5.enable ''
|
2021-11-12 01:19:54 +00:00
|
|
|
|
account sufficient ${pam_krb5}/lib/security/pam_krb5.so
|
|
|
|
|
'' +
|
|
|
|
|
optionalString cfg.googleOsLoginAccountVerification ''
|
2021-03-18 17:02:07 +00:00
|
|
|
|
account [success=ok ignore=ignore default=die] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so
|
|
|
|
|
account [success=ok default=ignore] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_admin.so
|
2021-11-12 01:19:54 +00:00
|
|
|
|
'' +
|
2022-12-08 08:49:12 +00:00
|
|
|
|
optionalString config.services.homed.enable ''
|
|
|
|
|
account sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so
|
|
|
|
|
'' +
|
2022-07-31 21:37:33 +00:00
|
|
|
|
# The required pam_unix.so module has to come after all the sufficient modules
|
|
|
|
|
# because otherwise, the account lookup will fail if the user does not exist
|
|
|
|
|
# locally, for example with MySQL- or LDAP-auth.
|
2021-11-12 01:19:54 +00:00
|
|
|
|
''
|
2022-07-31 21:37:33 +00:00
|
|
|
|
account required pam_unix.so
|
2021-11-12 01:19:54 +00:00
|
|
|
|
|
|
|
|
|
# Authentication management.
|
|
|
|
|
'' +
|
|
|
|
|
optionalString cfg.googleOsLoginAuthentication ''
|
2021-03-18 17:02:07 +00:00
|
|
|
|
auth [success=done perm_denied=die default=ignore] ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so
|
2021-11-12 01:19:54 +00:00
|
|
|
|
'' +
|
|
|
|
|
optionalString cfg.rootOK ''
|
|
|
|
|
auth sufficient pam_rootok.so
|
|
|
|
|
'' +
|
|
|
|
|
optionalString cfg.requireWheel ''
|
|
|
|
|
auth required pam_wheel.so use_uid
|
|
|
|
|
'' +
|
|
|
|
|
optionalString cfg.logFailures ''
|
|
|
|
|
auth required pam_faillock.so
|
|
|
|
|
'' +
|
2022-07-29 15:23:44 +00:00
|
|
|
|
optionalString cfg.mysqlAuth ''
|
|
|
|
|
auth sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf
|
|
|
|
|
'' +
|
2021-11-12 01:19:54 +00:00
|
|
|
|
optionalString (config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth) ''
|
|
|
|
|
auth sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=${lib.concatStringsSep ":" config.services.openssh.authorizedKeysFiles}
|
|
|
|
|
'' +
|
|
|
|
|
(let p11 = config.security.pam.p11; in optionalString cfg.p11Auth ''
|
|
|
|
|
auth ${p11.control} ${pkgs.pam_p11}/lib/security/pam_p11.so ${pkgs.opensc}/lib/opensc-pkcs11.so
|
|
|
|
|
'') +
|
2022-07-21 21:05:12 +00:00
|
|
|
|
(let u2f = config.security.pam.u2f; in optionalString cfg.u2fAuth (''
|
2022-04-06 10:23:17 +00:00
|
|
|
|
auth ${u2f.control} ${pkgs.pam_u2f}/lib/security/pam_u2f.so ${optionalString u2f.debug "debug"} ${optionalString (u2f.authFile != null) "authfile=${u2f.authFile}"} ''
|
|
|
|
|
+ ''${optionalString u2f.interactive "interactive"} ${optionalString u2f.cue "cue"} ${optionalString (u2f.appId != null) "appid=${u2f.appId}"} ${optionalString (u2f.origin != null) "origin=${u2f.origin}"}
|
2022-07-21 21:05:12 +00:00
|
|
|
|
'')) +
|
2021-11-12 01:19:54 +00:00
|
|
|
|
optionalString cfg.usbAuth ''
|
|
|
|
|
auth sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so
|
|
|
|
|
'' +
|
2022-03-13 17:20:23 +00:00
|
|
|
|
(let ussh = config.security.pam.ussh; in optionalString (config.security.pam.ussh.enable && cfg.usshAuth) ''
|
|
|
|
|
auth ${ussh.control} ${pkgs.pam_ussh}/lib/security/pam_ussh.so ${optionalString (ussh.caFile != null) "ca_file=${ussh.caFile}"} ${optionalString (ussh.authorizedPrincipals != null) "authorized_principals=${ussh.authorizedPrincipals}"} ${optionalString (ussh.authorizedPrincipalsFile != null) "authorized_principals_file=${ussh.authorizedPrincipalsFile}"} ${optionalString (ussh.group != null) "group=${ussh.group}"}
|
|
|
|
|
'') +
|
2021-11-12 01:19:54 +00:00
|
|
|
|
(let oath = config.security.pam.oath; in optionalString cfg.oathAuth ''
|
2022-04-04 01:08:24 +00:00
|
|
|
|
auth requisite ${pkgs.oath-toolkit}/lib/security/pam_oath.so window=${toString oath.window} usersfile=${toString oath.usersFile} digits=${toString oath.digits}
|
2021-11-12 01:19:54 +00:00
|
|
|
|
'') +
|
|
|
|
|
(let yubi = config.security.pam.yubico; in optionalString cfg.yubicoAuth ''
|
|
|
|
|
auth ${yubi.control} ${pkgs.yubico-pam}/lib/security/pam_yubico.so mode=${toString yubi.mode} ${optionalString (yubi.challengeResponsePath != null) "chalresp_path=${yubi.challengeResponsePath}"} ${optionalString (yubi.mode == "client") "id=${toString yubi.id}"} ${optionalString yubi.debug "debug"}
|
|
|
|
|
'') +
|
2023-07-01 19:48:38 +00:00
|
|
|
|
(let dp9ik = config.security.pam.dp9ik; in optionalString dp9ik.enable ''
|
|
|
|
|
auth ${dp9ik.control} ${pkgs.pam_dp9ik}/lib/security/pam_p9.so ${dp9ik.authserver}
|
|
|
|
|
'') +
|
2021-11-12 01:19:54 +00:00
|
|
|
|
optionalString cfg.fprintAuth ''
|
|
|
|
|
auth sufficient ${pkgs.fprintd}/lib/security/pam_fprintd.so
|
|
|
|
|
'' +
|
2015-11-21 21:04:11 +00:00
|
|
|
|
# Modules in this block require having the password set in PAM_AUTHTOK.
|
|
|
|
|
# pam_unix is marked as 'sufficient' on NixOS which means nothing will run
|
|
|
|
|
# after it succeeds. Certain modules need to run after pam_unix
|
2022-05-18 13:22:46 +00:00
|
|
|
|
# prompts the user for password so we run it once with 'optional' at an
|
2015-11-21 21:04:11 +00:00
|
|
|
|
# earlier point and it will run again with 'sufficient' further down.
|
2022-12-08 08:49:12 +00:00
|
|
|
|
# We use try_first_pass the second time to avoid prompting password twice.
|
|
|
|
|
#
|
|
|
|
|
# The same principle applies to systemd-homed
|
|
|
|
|
(optionalString ((cfg.unixAuth || config.services.homed.enable) &&
|
2021-11-12 01:19:54 +00:00
|
|
|
|
(config.security.pam.enableEcryptfs
|
2022-05-17 18:16:22 +00:00
|
|
|
|
|| config.security.pam.enableFscrypt
|
2021-11-12 01:19:54 +00:00
|
|
|
|
|| cfg.pamMount
|
|
|
|
|
|| cfg.enableKwallet
|
|
|
|
|
|| cfg.enableGnomeKeyring
|
|
|
|
|
|| cfg.googleAuthenticator.enable
|
|
|
|
|
|| cfg.gnupg.enable
|
2022-11-07 11:16:35 +00:00
|
|
|
|
|| cfg.failDelay.enable
|
2023-04-29 17:35:29 +00:00
|
|
|
|
|| cfg.duoSecurity.enable
|
|
|
|
|
|| cfg.zfs))
|
2021-11-12 01:19:54 +00:00
|
|
|
|
(
|
2022-12-08 08:49:12 +00:00
|
|
|
|
optionalString config.services.homed.enable ''
|
|
|
|
|
auth optional ${config.systemd.package}/lib/security/pam_systemd_home.so
|
|
|
|
|
'' +
|
|
|
|
|
optionalString cfg.unixAuth ''
|
2022-05-18 13:22:46 +00:00
|
|
|
|
auth optional pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth
|
2021-11-12 01:19:54 +00:00
|
|
|
|
'' +
|
|
|
|
|
optionalString config.security.pam.enableEcryptfs ''
|
|
|
|
|
auth optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap
|
|
|
|
|
'' +
|
2022-05-17 18:16:22 +00:00
|
|
|
|
optionalString config.security.pam.enableFscrypt ''
|
|
|
|
|
auth optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so
|
|
|
|
|
'' +
|
2023-04-29 17:35:29 +00:00
|
|
|
|
optionalString cfg.zfs ''
|
|
|
|
|
auth optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes}
|
|
|
|
|
'' +
|
2021-11-12 01:19:54 +00:00
|
|
|
|
optionalString cfg.pamMount ''
|
|
|
|
|
auth optional ${pkgs.pam_mount}/lib/security/pam_mount.so disable_interactive
|
|
|
|
|
'' +
|
|
|
|
|
optionalString cfg.enableKwallet ''
|
|
|
|
|
auth optional ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5
|
|
|
|
|
'' +
|
|
|
|
|
optionalString cfg.enableGnomeKeyring ''
|
|
|
|
|
auth optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so
|
|
|
|
|
'' +
|
|
|
|
|
optionalString cfg.gnupg.enable ''
|
|
|
|
|
auth optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.storeOnly " store-only"}
|
|
|
|
|
'' +
|
2022-11-07 11:16:35 +00:00
|
|
|
|
optionalString cfg.failDelay.enable ''
|
|
|
|
|
auth optional ${pkgs.pam}/lib/security/pam_faildelay.so delay=${toString cfg.failDelay.delay}
|
|
|
|
|
'' +
|
2021-11-12 01:19:54 +00:00
|
|
|
|
optionalString cfg.googleAuthenticator.enable ''
|
2022-03-02 15:18:58 +00:00
|
|
|
|
auth required ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so no_increment_hotp
|
2021-11-12 01:19:54 +00:00
|
|
|
|
'' +
|
|
|
|
|
optionalString cfg.duoSecurity.enable ''
|
|
|
|
|
auth required ${pkgs.duo-unix}/lib/security/pam_duo.so
|
|
|
|
|
''
|
|
|
|
|
)) +
|
2022-12-08 08:49:12 +00:00
|
|
|
|
optionalString config.services.homed.enable ''
|
|
|
|
|
auth sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so
|
|
|
|
|
'' +
|
2021-11-12 01:19:54 +00:00
|
|
|
|
optionalString cfg.unixAuth ''
|
|
|
|
|
auth sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} ${optionalString cfg.nodelay "nodelay"} likeauth try_first_pass
|
|
|
|
|
'' +
|
|
|
|
|
optionalString cfg.otpwAuth ''
|
|
|
|
|
auth sufficient ${pkgs.otpw}/lib/security/pam_otpw.so
|
|
|
|
|
'' +
|
|
|
|
|
optionalString use_ldap ''
|
|
|
|
|
auth sufficient ${pam_ldap}/lib/security/pam_ldap.so use_first_pass
|
|
|
|
|
'' +
|
2023-06-08 20:35:30 +00:00
|
|
|
|
optionalString config.services.kanidm.enablePam ''
|
|
|
|
|
auth sufficient ${pkgs.kanidm}/lib/pam_kanidm.so ignore_unknown_user use_first_pass
|
|
|
|
|
'' +
|
2021-11-12 01:19:54 +00:00
|
|
|
|
optionalString config.services.sssd.enable ''
|
|
|
|
|
auth sufficient ${pkgs.sssd}/lib/security/pam_sss.so use_first_pass
|
|
|
|
|
'' +
|
2022-07-16 05:38:42 +00:00
|
|
|
|
optionalString config.security.pam.krb5.enable ''
|
2012-06-11 22:41:07 +00:00
|
|
|
|
auth [default=ignore success=1 service_err=reset] ${pam_krb5}/lib/security/pam_krb5.so use_first_pass
|
|
|
|
|
auth [default=die success=done] ${pam_ccreds}/lib/security/pam_ccreds.so action=validate use_first_pass
|
|
|
|
|
auth sufficient ${pam_ccreds}/lib/security/pam_ccreds.so action=store use_first_pass
|
2021-11-12 01:19:54 +00:00
|
|
|
|
'' +
|
|
|
|
|
''
|
|
|
|
|
auth required pam_deny.so
|
|
|
|
|
|
|
|
|
|
# Password management.
|
2022-12-08 08:49:12 +00:00
|
|
|
|
'' +
|
|
|
|
|
optionalString config.services.homed.enable ''
|
|
|
|
|
password sufficient ${config.systemd.package}/lib/security/pam_systemd_home.so
|
|
|
|
|
'' + ''
|
2023-03-12 16:59:01 +00:00
|
|
|
|
password sufficient pam_unix.so nullok yescrypt
|
2021-11-12 01:19:54 +00:00
|
|
|
|
'' +
|
|
|
|
|
optionalString config.security.pam.enableEcryptfs ''
|
|
|
|
|
password optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so
|
|
|
|
|
'' +
|
2022-05-17 18:16:22 +00:00
|
|
|
|
optionalString config.security.pam.enableFscrypt ''
|
|
|
|
|
password optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so
|
|
|
|
|
'' +
|
2023-04-29 17:35:29 +00:00
|
|
|
|
optionalString cfg.zfs ''
|
|
|
|
|
password optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes}
|
|
|
|
|
'' +
|
2021-11-12 01:19:54 +00:00
|
|
|
|
optionalString cfg.pamMount ''
|
|
|
|
|
password optional ${pkgs.pam_mount}/lib/security/pam_mount.so
|
|
|
|
|
'' +
|
|
|
|
|
optionalString use_ldap ''
|
|
|
|
|
password sufficient ${pam_ldap}/lib/security/pam_ldap.so
|
|
|
|
|
'' +
|
2022-07-29 15:23:44 +00:00
|
|
|
|
optionalString cfg.mysqlAuth ''
|
|
|
|
|
password sufficient ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf
|
|
|
|
|
'' +
|
2023-06-08 20:35:30 +00:00
|
|
|
|
optionalString config.services.kanidm.enablePam ''
|
|
|
|
|
password sufficient ${pkgs.kanidm}/lib/pam_kanidm.so
|
|
|
|
|
'' +
|
2021-11-12 01:19:54 +00:00
|
|
|
|
optionalString config.services.sssd.enable ''
|
2023-05-09 10:45:15 +00:00
|
|
|
|
password sufficient ${pkgs.sssd}/lib/security/pam_sss.so
|
2021-11-12 01:19:54 +00:00
|
|
|
|
'' +
|
2022-07-16 05:38:42 +00:00
|
|
|
|
optionalString config.security.pam.krb5.enable ''
|
2021-11-12 01:19:54 +00:00
|
|
|
|
password sufficient ${pam_krb5}/lib/security/pam_krb5.so use_first_pass
|
|
|
|
|
'' +
|
|
|
|
|
optionalString cfg.enableGnomeKeyring ''
|
|
|
|
|
password optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so use_authtok
|
|
|
|
|
'' +
|
|
|
|
|
''
|
|
|
|
|
|
|
|
|
|
# Session management.
|
|
|
|
|
'' +
|
|
|
|
|
optionalString cfg.setEnvironment ''
|
2021-07-28 04:28:25 +00:00
|
|
|
|
session required pam_env.so conffile=/etc/pam/environment readenv=0
|
2021-11-12 01:19:54 +00:00
|
|
|
|
'' +
|
|
|
|
|
''
|
|
|
|
|
session required pam_unix.so
|
|
|
|
|
'' +
|
|
|
|
|
optionalString cfg.setLoginUid ''
|
|
|
|
|
session ${if config.boot.isContainer then "optional" else "required"} pam_loginuid.so
|
|
|
|
|
'' +
|
2022-10-22 21:20:09 +00:00
|
|
|
|
optionalString cfg.ttyAudit.enable (concatStringsSep " \\\n " ([
|
|
|
|
|
"session required ${pkgs.pam}/lib/security/pam_tty_audit.so"
|
|
|
|
|
] ++ optional cfg.ttyAudit.openOnly "open_only"
|
|
|
|
|
++ optional (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}"
|
|
|
|
|
++ optional (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}"
|
|
|
|
|
)) +
|
2022-12-08 08:49:12 +00:00
|
|
|
|
optionalString config.services.homed.enable ''
|
|
|
|
|
session required ${config.systemd.package}/lib/security/pam_systemd_home.so
|
|
|
|
|
'' +
|
2021-11-12 01:19:54 +00:00
|
|
|
|
optionalString cfg.makeHomeDir ''
|
2023-08-11 00:35:08 +00:00
|
|
|
|
session required ${pkgs.pam}/lib/security/pam_mkhomedir.so silent skel=${config.security.pam.makeHomeDir.skelDirectory} umask=${config.security.pam.makeHomeDir.umask}
|
2021-11-12 01:19:54 +00:00
|
|
|
|
'' +
|
|
|
|
|
optionalString cfg.updateWtmp ''
|
|
|
|
|
session required ${pkgs.pam}/lib/security/pam_lastlog.so silent
|
|
|
|
|
'' +
|
|
|
|
|
optionalString config.security.pam.enableEcryptfs ''
|
|
|
|
|
session optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so
|
|
|
|
|
'' +
|
2022-05-17 18:16:22 +00:00
|
|
|
|
optionalString config.security.pam.enableFscrypt ''
|
|
|
|
|
# Work around https://github.com/systemd/systemd/issues/8598
|
|
|
|
|
# Skips the pam_fscrypt module for systemd-user sessions which do not have a password
|
|
|
|
|
# anyways.
|
|
|
|
|
# See also https://github.com/google/fscrypt/issues/95
|
|
|
|
|
session [success=1 default=ignore] pam_succeed_if.so service = systemd-user
|
|
|
|
|
session optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so
|
|
|
|
|
'' +
|
2023-04-29 17:35:29 +00:00
|
|
|
|
optionalString cfg.zfs ''
|
|
|
|
|
session [success=1 default=ignore] pam_succeed_if.so service = systemd-user
|
|
|
|
|
session optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} ${optionalString config.security.pam.zfs.noUnmount "nounmount"}
|
|
|
|
|
'' +
|
2021-11-12 01:19:54 +00:00
|
|
|
|
optionalString cfg.pamMount ''
|
|
|
|
|
session optional ${pkgs.pam_mount}/lib/security/pam_mount.so disable_interactive
|
|
|
|
|
'' +
|
|
|
|
|
optionalString use_ldap ''
|
|
|
|
|
session optional ${pam_ldap}/lib/security/pam_ldap.so
|
|
|
|
|
'' +
|
2022-07-29 15:23:44 +00:00
|
|
|
|
optionalString cfg.mysqlAuth ''
|
|
|
|
|
session optional ${pkgs.pam_mysql}/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf
|
|
|
|
|
'' +
|
2023-06-08 20:35:30 +00:00
|
|
|
|
optionalString config.services.kanidm.enablePam ''
|
|
|
|
|
session optional ${pkgs.kanidm}/lib/pam_kanidm.so
|
|
|
|
|
'' +
|
2021-11-12 01:19:54 +00:00
|
|
|
|
optionalString config.services.sssd.enable ''
|
|
|
|
|
session optional ${pkgs.sssd}/lib/security/pam_sss.so
|
|
|
|
|
'' +
|
2022-07-16 05:38:42 +00:00
|
|
|
|
optionalString config.security.pam.krb5.enable ''
|
2021-11-12 01:19:54 +00:00
|
|
|
|
session optional ${pam_krb5}/lib/security/pam_krb5.so
|
|
|
|
|
'' +
|
|
|
|
|
optionalString cfg.otpwAuth ''
|
|
|
|
|
session optional ${pkgs.otpw}/lib/security/pam_otpw.so
|
|
|
|
|
'' +
|
|
|
|
|
optionalString cfg.startSession ''
|
2022-05-05 11:23:32 +00:00
|
|
|
|
session optional ${config.systemd.package}/lib/security/pam_systemd.so
|
2021-11-12 01:19:54 +00:00
|
|
|
|
'' +
|
|
|
|
|
optionalString cfg.forwardXAuth ''
|
|
|
|
|
session optional pam_xauth.so xauthpath=${pkgs.xorg.xauth}/bin/xauth systemuser=99
|
|
|
|
|
'' +
|
|
|
|
|
optionalString (cfg.limits != []) ''
|
|
|
|
|
session required ${pkgs.pam}/lib/security/pam_limits.so conf=${makeLimitsConf cfg.limits}
|
|
|
|
|
'' +
|
2022-11-11 15:11:37 +00:00
|
|
|
|
optionalString (cfg.showMotd && (config.users.motd != null || config.users.motdFile != null)) ''
|
2021-11-12 01:19:54 +00:00
|
|
|
|
session optional ${pkgs.pam}/lib/security/pam_motd.so motd=${motd}
|
|
|
|
|
'' +
|
|
|
|
|
optionalString (cfg.enableAppArmor && config.security.apparmor.enable) ''
|
|
|
|
|
session optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug
|
|
|
|
|
'' +
|
|
|
|
|
optionalString (cfg.enableKwallet) ''
|
|
|
|
|
session optional ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so kwalletd=${pkgs.plasma5Packages.kwallet.bin}/bin/kwalletd5
|
|
|
|
|
'' +
|
|
|
|
|
optionalString (cfg.enableGnomeKeyring) ''
|
|
|
|
|
session optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start
|
|
|
|
|
'' +
|
|
|
|
|
optionalString cfg.gnupg.enable ''
|
|
|
|
|
session optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.noAutostart " no-autostart"}
|
|
|
|
|
'' +
|
|
|
|
|
optionalString (config.virtualisation.lxc.lxcfs.enable) ''
|
|
|
|
|
session optional ${pkgs.lxc}/lib/security/pam_cgfs.so -c all
|
|
|
|
|
''
|
|
|
|
|
);
|
2013-10-15 12:47:51 +00:00
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
inherit (pkgs) pam_krb5 pam_ccreds;
|
|
|
|
|
|
2016-07-18 13:20:21 +00:00
|
|
|
|
use_ldap = (config.users.ldap.enable && config.users.ldap.loginPam);
|
2013-10-15 12:47:51 +00:00
|
|
|
|
pam_ldap = if config.users.ldap.daemon.enable then pkgs.nss_pam_ldapd else pkgs.pam_ldap;
|
|
|
|
|
|
|
|
|
|
# Create a limits.conf(5) file.
|
|
|
|
|
makeLimitsConf = limits:
|
|
|
|
|
pkgs.writeText "limits.conf"
|
2013-10-17 13:36:59 +00:00
|
|
|
|
(concatMapStrings ({ domain, type, item, value }:
|
|
|
|
|
"${domain} ${type} ${item} ${toString value}\n")
|
|
|
|
|
limits);
|
2013-10-15 12:47:51 +00:00
|
|
|
|
|
2021-12-07 17:26:25 +00:00
|
|
|
|
limitsType = with lib.types; listOf (submodule ({ ... }: {
|
|
|
|
|
options = {
|
|
|
|
|
domain = mkOption {
|
|
|
|
|
description = lib.mdDoc "Username, groupname, or wildcard this limit applies to";
|
|
|
|
|
example = "@wheel";
|
|
|
|
|
type = str;
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
type = mkOption {
|
|
|
|
|
description = lib.mdDoc "Type of this limit";
|
|
|
|
|
type = enum [ "-" "hard" "soft" ];
|
|
|
|
|
default = "-";
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
item = mkOption {
|
|
|
|
|
description = lib.mdDoc "Item this limit applies to";
|
|
|
|
|
type = enum [
|
|
|
|
|
"core"
|
|
|
|
|
"data"
|
|
|
|
|
"fsize"
|
|
|
|
|
"memlock"
|
|
|
|
|
"nofile"
|
|
|
|
|
"rss"
|
|
|
|
|
"stack"
|
|
|
|
|
"cpu"
|
|
|
|
|
"nproc"
|
|
|
|
|
"as"
|
|
|
|
|
"maxlogins"
|
|
|
|
|
"maxsyslogins"
|
|
|
|
|
"priority"
|
|
|
|
|
"locks"
|
|
|
|
|
"sigpending"
|
|
|
|
|
"msgqueue"
|
|
|
|
|
"nice"
|
|
|
|
|
"rtprio"
|
|
|
|
|
];
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
value = mkOption {
|
|
|
|
|
description = lib.mdDoc "Value of this limit";
|
|
|
|
|
type = oneOf [ str int ];
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
}));
|
|
|
|
|
|
2023-03-05 21:08:45 +00:00
|
|
|
|
motd = if config.users.motdFile == null
|
2022-11-11 15:11:37 +00:00
|
|
|
|
then pkgs.writeText "motd" config.users.motd
|
|
|
|
|
else config.users.motdFile;
|
2013-10-15 12:47:51 +00:00
|
|
|
|
|
2019-09-14 17:51:29 +00:00
|
|
|
|
makePAMService = name: service:
|
|
|
|
|
{ name = "pam.d/${name}";
|
|
|
|
|
value.source = pkgs.writeText "${name}.pam" service.text;
|
2009-05-28 13:10:02 +00:00
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
in
|
|
|
|
|
|
|
|
|
|
{
|
2009-08-16 14:49:14 +00:00
|
|
|
|
|
2019-12-10 01:51:19 +00:00
|
|
|
|
imports = [
|
|
|
|
|
(mkRenamedOptionModule [ "security" "pam" "enableU2F" ] [ "security" "pam" "u2f" "enable" ])
|
|
|
|
|
];
|
|
|
|
|
|
2009-08-16 14:49:14 +00:00
|
|
|
|
###### interface
|
|
|
|
|
|
|
|
|
|
options = {
|
|
|
|
|
|
2010-01-12 11:02:23 +00:00
|
|
|
|
security.pam.loginLimits = mkOption {
|
|
|
|
|
default = [];
|
2021-12-07 17:26:25 +00:00
|
|
|
|
type = limitsType;
|
2010-01-12 11:02:23 +00:00
|
|
|
|
example =
|
|
|
|
|
[ { domain = "ftp";
|
|
|
|
|
type = "hard";
|
|
|
|
|
item = "nproc";
|
|
|
|
|
value = "0";
|
|
|
|
|
}
|
|
|
|
|
{ domain = "@student";
|
|
|
|
|
type = "-";
|
|
|
|
|
item = "maxlogins";
|
|
|
|
|
value = "4";
|
|
|
|
|
}
|
|
|
|
|
];
|
|
|
|
|
|
2022-08-14 03:16:55 +00:00
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Define resource limits that should apply to users or groups.
|
|
|
|
|
Each item in the list should be an attribute set with a
|
|
|
|
|
{var}`domain`, {var}`type`,
|
|
|
|
|
{var}`item`, and {var}`value`
|
|
|
|
|
attribute. The syntax and semantics of these attributes
|
|
|
|
|
must be that described in {manpage}`limits.conf(5)`.
|
|
|
|
|
|
|
|
|
|
Note that these limits do not apply to systemd services,
|
|
|
|
|
whose limits can be changed via {option}`systemd.extraConfig`
|
|
|
|
|
instead.
|
|
|
|
|
'';
|
2010-01-12 11:02:23 +00:00
|
|
|
|
};
|
|
|
|
|
|
2009-08-16 14:49:14 +00:00
|
|
|
|
security.pam.services = mkOption {
|
2021-10-03 16:06:03 +00:00
|
|
|
|
default = {};
|
2020-08-22 23:28:45 +00:00
|
|
|
|
type = with types; attrsOf (submodule pamOpts);
|
2009-08-16 14:49:14 +00:00
|
|
|
|
description =
|
|
|
|
|
lib.mdDoc ''
|
|
|
|
|
This option defines the PAM services. A service typically
|
|
|
|
|
corresponds to a program that uses PAM,
|
|
|
|
|
e.g. {command}`login` or {command}`passwd`.
|
2013-10-15 12:47:51 +00:00
|
|
|
|
Each attribute of this set defines a PAM service, with the attribute name
|
|
|
|
|
defining the name of the service.
|
2009-08-16 14:49:14 +00:00
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2016-04-14 18:18:09 +00:00
|
|
|
|
security.pam.makeHomeDir.skelDirectory = mkOption {
|
|
|
|
|
type = types.str;
|
|
|
|
|
default = "/var/empty";
|
|
|
|
|
example = "/etc/skel";
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Path to skeleton directory whose contents are copied to home
|
|
|
|
|
directories newly created by `pam_mkhomedir`.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2023-08-11 00:35:08 +00:00
|
|
|
|
security.pam.makeHomeDir.umask = mkOption {
|
|
|
|
|
type = types.str;
|
|
|
|
|
default = "0077";
|
|
|
|
|
example = "0022";
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
The user file mode creation mask to use on home directories
|
|
|
|
|
newly created by `pam_mkhomedir`.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2012-06-11 22:41:07 +00:00
|
|
|
|
security.pam.enableSSHAgentAuth = mkOption {
|
2020-04-27 07:04:07 +00:00
|
|
|
|
type = types.bool;
|
2012-06-11 22:41:07 +00:00
|
|
|
|
default = false;
|
|
|
|
|
description =
|
|
|
|
|
lib.mdDoc ''
|
|
|
|
|
Enable sudo logins if the user's SSH agent provides a key
|
|
|
|
|
present in {file}`~/.ssh/authorized_keys`.
|
|
|
|
|
This allows machines to exclusively use SSH keys instead of
|
|
|
|
|
passwords.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2020-04-27 07:04:07 +00:00
|
|
|
|
security.pam.enableOTPW = mkEnableOption (lib.mdDoc "the OTPW (one-time password) PAM module");
|
2013-03-30 20:06:23 +00:00
|
|
|
|
|
2023-07-01 19:48:38 +00:00
|
|
|
|
security.pam.dp9ik = {
|
|
|
|
|
enable = mkEnableOption (
|
|
|
|
|
lib.mdDoc ''
|
|
|
|
|
the dp9ik pam module provided by tlsclient.
|
|
|
|
|
|
|
|
|
|
If set, users can be authenticated against the 9front
|
|
|
|
|
authentication server given in {option}`security.pam.dp9ik.authserver`.
|
|
|
|
|
''
|
|
|
|
|
);
|
|
|
|
|
control = mkOption {
|
|
|
|
|
default = "sufficient";
|
|
|
|
|
type = types.str;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
This option sets the pam "control" used for this module.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
authserver = mkOption {
|
|
|
|
|
default = null;
|
2023-08-08 12:45:53 +00:00
|
|
|
|
type = with types; nullOr str;
|
2023-07-01 19:48:38 +00:00
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
This controls the hostname for the 9front authentication server
|
|
|
|
|
that users will be authenticated against.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
2022-07-16 05:38:42 +00:00
|
|
|
|
security.pam.krb5 = {
|
|
|
|
|
enable = mkOption {
|
|
|
|
|
default = config.krb5.enable;
|
|
|
|
|
defaultText = literalExpression "config.krb5.enable";
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Enables Kerberos PAM modules (`pam-krb5`,
|
|
|
|
|
`pam-ccreds`).
|
|
|
|
|
|
|
|
|
|
If set, users can authenticate with their Kerberos password.
|
|
|
|
|
This requires a valid Kerberos configuration
|
|
|
|
|
(`config.krb5.enable` should be set to
|
|
|
|
|
`true`).
|
|
|
|
|
|
|
|
|
|
Note that the Kerberos PAM modules are not necessary when using SSS
|
|
|
|
|
to handle Kerberos authentication.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
2020-05-30 09:03:10 +00:00
|
|
|
|
security.pam.p11 = {
|
|
|
|
|
enable = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Enables P11 PAM (`pam_p11`) module.
|
|
|
|
|
|
|
|
|
|
If set, users can log in with SSH keys and PKCS#11 tokens.
|
|
|
|
|
|
|
|
|
|
More information can be found [here](https://github.com/OpenSC/pam_p11).
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
control = mkOption {
|
|
|
|
|
default = "sufficient";
|
|
|
|
|
type = types.enum [ "required" "requisite" "sufficient" "optional" ];
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
This option sets pam "control".
|
|
|
|
|
If you want to have multi factor authentication, use "required".
|
|
|
|
|
If you want to use the PKCS#11 device instead of the regular password,
|
|
|
|
|
use "sufficient".
|
|
|
|
|
|
|
|
|
|
Read
|
|
|
|
|
{manpage}`pam.conf(5)`
|
|
|
|
|
for better understanding of this option.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
2019-01-29 16:45:26 +00:00
|
|
|
|
security.pam.u2f = {
|
|
|
|
|
enable = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Enables U2F PAM (`pam-u2f`) module.
|
|
|
|
|
|
|
|
|
|
If set, users listed in
|
|
|
|
|
{file}`$XDG_CONFIG_HOME/Yubico/u2f_keys` (or
|
|
|
|
|
{file}`$HOME/.config/Yubico/u2f_keys` if XDG variable is
|
|
|
|
|
not set) are able to log in with the associated U2F key. The path can
|
|
|
|
|
be changed using {option}`security.pam.u2f.authFile` option.
|
|
|
|
|
|
|
|
|
|
File format is:
|
|
|
|
|
`username:first_keyHandle,first_public_key: second_keyHandle,second_public_key`
|
|
|
|
|
This file can be generated using {command}`pamu2fcfg` command.
|
|
|
|
|
|
|
|
|
|
More information can be found [here](https://developers.yubico.com/pam-u2f/).
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
authFile = mkOption {
|
|
|
|
|
default = null;
|
|
|
|
|
type = with types; nullOr path;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
By default `pam-u2f` module reads the keys from
|
|
|
|
|
{file}`$XDG_CONFIG_HOME/Yubico/u2f_keys` (or
|
|
|
|
|
{file}`$HOME/.config/Yubico/u2f_keys` if XDG variable is
|
|
|
|
|
not set).
|
|
|
|
|
|
|
|
|
|
If you want to change auth file locations or centralize database (for
|
|
|
|
|
example use {file}`/etc/u2f-mappings`) you can set this
|
|
|
|
|
option.
|
|
|
|
|
|
|
|
|
|
File format is:
|
|
|
|
|
`username:first_keyHandle,first_public_key: second_keyHandle,second_public_key`
|
|
|
|
|
This file can be generated using {command}`pamu2fcfg` command.
|
|
|
|
|
|
|
|
|
|
More information can be found [here](https://developers.yubico.com/pam-u2f/).
|
|
|
|
|
'';
|
|
|
|
|
};
|
2020-10-09 08:31:15 +00:00
|
|
|
|
|
2020-10-08 18:37:40 +00:00
|
|
|
|
appId = mkOption {
|
|
|
|
|
default = null;
|
|
|
|
|
type = with types; nullOr str;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
By default `pam-u2f` module sets the application
|
|
|
|
|
ID to `pam://$HOSTNAME`.
|
|
|
|
|
|
|
|
|
|
When using {command}`pamu2fcfg`, you can specify your
|
|
|
|
|
application ID with the `-i` flag.
|
|
|
|
|
|
|
|
|
|
More information can be found [here](https://developers.yubico.com/pam-u2f/Manuals/pam_u2f.8.html)
|
|
|
|
|
'';
|
|
|
|
|
};
|
2019-01-29 16:45:26 +00:00
|
|
|
|
|
2022-04-06 10:23:17 +00:00
|
|
|
|
origin = mkOption {
|
|
|
|
|
default = null;
|
|
|
|
|
type = with types; nullOr str;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
By default `pam-u2f` module sets the origin
|
|
|
|
|
to `pam://$HOSTNAME`.
|
|
|
|
|
Setting origin to an host independent value will allow you to
|
|
|
|
|
reuse credentials across machines
|
|
|
|
|
|
|
|
|
|
When using {command}`pamu2fcfg`, you can specify your
|
|
|
|
|
application ID with the `-o` flag.
|
|
|
|
|
|
|
|
|
|
More information can be found [here](https://developers.yubico.com/pam-u2f/Manuals/pam_u2f.8.html)
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
2019-01-29 16:45:26 +00:00
|
|
|
|
control = mkOption {
|
|
|
|
|
default = "sufficient";
|
|
|
|
|
type = types.enum [ "required" "requisite" "sufficient" "optional" ];
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
This option sets pam "control".
|
|
|
|
|
If you want to have multi factor authentication, use "required".
|
|
|
|
|
If you want to use U2F device instead of regular password, use "sufficient".
|
|
|
|
|
|
|
|
|
|
Read
|
|
|
|
|
{manpage}`pam.conf(5)`
|
|
|
|
|
for better understanding of this option.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
debug = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Debug output to stderr.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
interactive = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Set to prompt a message and wait before testing the presence of a U2F device.
|
|
|
|
|
Recommended if your device doesn’t have a tactile trigger.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
cue = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
By default `pam-u2f` module does not inform user
|
|
|
|
|
that he needs to use the u2f device, it just waits without a prompt.
|
|
|
|
|
|
|
|
|
|
If you set this option to `true`,
|
|
|
|
|
`cue` option is added to `pam-u2f`
|
|
|
|
|
module and reminder message will be displayed.
|
|
|
|
|
'';
|
|
|
|
|
};
|
2015-05-03 14:29:42 +00:00
|
|
|
|
};
|
|
|
|
|
|
2022-03-13 17:20:23 +00:00
|
|
|
|
security.pam.ussh = {
|
|
|
|
|
enable = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Enables Uber's USSH PAM (`pam-ussh`) module.
|
|
|
|
|
|
|
|
|
|
This is similar to `pam-ssh-agent`, except that
|
|
|
|
|
the presence of a CA-signed SSH key with a valid principal is checked
|
|
|
|
|
instead.
|
|
|
|
|
|
|
|
|
|
Note that this module must both be enabled using this option and on a
|
|
|
|
|
per-PAM-service level as well (using `usshAuth`).
|
|
|
|
|
|
|
|
|
|
More information can be found [here](https://github.com/uber/pam-ussh).
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
caFile = mkOption {
|
|
|
|
|
default = null;
|
|
|
|
|
type = with types; nullOr path;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
By default `pam-ussh` reads the trusted user CA keys
|
|
|
|
|
from {file}`/etc/ssh/trusted_user_ca`.
|
|
|
|
|
|
|
|
|
|
This should be set the same as your `TrustedUserCAKeys`
|
|
|
|
|
option for sshd.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
authorizedPrincipals = mkOption {
|
|
|
|
|
default = null;
|
|
|
|
|
type = with types; nullOr commas;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Comma-separated list of authorized principals to permit; if the user
|
|
|
|
|
presents a certificate with one of these principals, then they will be
|
|
|
|
|
authorized.
|
|
|
|
|
|
|
|
|
|
Note that `pam-ussh` also requires that the certificate
|
|
|
|
|
contain a principal matching the user's username. The principals from
|
|
|
|
|
this list are in addition to those principals.
|
|
|
|
|
|
|
|
|
|
Mutually exclusive with `authorizedPrincipalsFile`.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
authorizedPrincipalsFile = mkOption {
|
|
|
|
|
default = null;
|
|
|
|
|
type = with types; nullOr path;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Path to a list of principals; if the user presents a certificate with
|
|
|
|
|
one of these principals, then they will be authorized.
|
|
|
|
|
|
|
|
|
|
Note that `pam-ussh` also requires that the certificate
|
|
|
|
|
contain a principal matching the user's username. The principals from
|
|
|
|
|
this file are in addition to those principals.
|
|
|
|
|
|
|
|
|
|
Mutually exclusive with `authorizedPrincipals`.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
group = mkOption {
|
|
|
|
|
default = null;
|
|
|
|
|
type = with types; nullOr str;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
If set, then the authenticating user must be a member of this group
|
|
|
|
|
to use this module.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
control = mkOption {
|
|
|
|
|
default = "sufficient";
|
|
|
|
|
type = types.enum [ "required" "requisite" "sufficient" "optional" ];
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
This option sets pam "control".
|
|
|
|
|
If you want to have multi factor authentication, use "required".
|
|
|
|
|
If you want to use the SSH certificate instead of the regular password,
|
|
|
|
|
use "sufficient".
|
|
|
|
|
|
|
|
|
|
Read
|
|
|
|
|
{manpage}`pam.conf(5)`
|
|
|
|
|
for better understanding of this option.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
2019-03-31 01:07:16 +00:00
|
|
|
|
security.pam.yubico = {
|
|
|
|
|
enable = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Enables Yubico PAM (`yubico-pam`) module.
|
|
|
|
|
|
|
|
|
|
If set, users listed in
|
|
|
|
|
{file}`~/.yubico/authorized_yubikeys`
|
|
|
|
|
are able to log in with the associated Yubikey tokens.
|
|
|
|
|
|
|
|
|
|
The file must have only one line:
|
|
|
|
|
`username:yubikey_token_id1:yubikey_token_id2`
|
|
|
|
|
More information can be found [here](https://developers.yubico.com/yubico-pam/).
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
control = mkOption {
|
|
|
|
|
default = "sufficient";
|
|
|
|
|
type = types.enum [ "required" "requisite" "sufficient" "optional" ];
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
This option sets pam "control".
|
|
|
|
|
If you want to have multi factor authentication, use "required".
|
|
|
|
|
If you want to use Yubikey instead of regular password, use "sufficient".
|
|
|
|
|
|
|
|
|
|
Read
|
|
|
|
|
{manpage}`pam.conf(5)`
|
|
|
|
|
for better understanding of this option.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
id = mkOption {
|
|
|
|
|
example = "42";
|
2019-08-08 20:48:27 +00:00
|
|
|
|
type = types.str;
|
2019-03-31 01:07:16 +00:00
|
|
|
|
description = lib.mdDoc "client id";
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
debug = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Debug output to stderr.
|
|
|
|
|
'';
|
|
|
|
|
};
|
2019-08-30 17:33:08 +00:00
|
|
|
|
mode = mkOption {
|
|
|
|
|
default = "client";
|
|
|
|
|
type = types.enum [ "client" "challenge-response" ];
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Mode of operation.
|
|
|
|
|
|
|
|
|
|
Use "client" for online validation with a YubiKey validation service such as
|
|
|
|
|
the YubiCloud.
|
|
|
|
|
|
|
|
|
|
Use "challenge-response" for offline validation using YubiKeys with HMAC-SHA-1
|
|
|
|
|
Challenge-Response configurations. See the man-page ykpamcfg(1) for further
|
2019-12-10 01:51:19 +00:00
|
|
|
|
details on how to configure offline Challenge-Response validation.
|
2019-08-30 17:33:08 +00:00
|
|
|
|
|
2021-07-17 06:56:55 +00:00
|
|
|
|
More information can be found [here](https://developers.yubico.com/yubico-pam/Authentication_Using_Challenge-Response.html).
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
challengeResponsePath = mkOption {
|
|
|
|
|
default = null;
|
2021-08-17 14:55:50 +00:00
|
|
|
|
type = types.nullOr types.path;
|
2021-07-17 06:56:55 +00:00
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
If not null, set the path used by yubico pam module where the challenge expected response is stored.
|
|
|
|
|
|
2019-08-30 17:33:08 +00:00
|
|
|
|
More information can be found [here](https://developers.yubico.com/yubico-pam/Authentication_Using_Challenge-Response.html).
|
|
|
|
|
'';
|
|
|
|
|
};
|
2019-03-31 01:07:16 +00:00
|
|
|
|
};
|
|
|
|
|
|
2023-04-29 17:35:29 +00:00
|
|
|
|
security.pam.zfs = {
|
|
|
|
|
enable = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
2023-04-30 09:32:16 +00:00
|
|
|
|
Enable unlocking and mounting of encrypted ZFS home dataset at login.
|
2023-04-29 17:35:29 +00:00
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
homes = mkOption {
|
|
|
|
|
example = "rpool/home";
|
|
|
|
|
default = "rpool/home";
|
|
|
|
|
type = types.str;
|
|
|
|
|
description = lib.mdDoc ''
|
2023-04-30 09:32:16 +00:00
|
|
|
|
Prefix of home datasets. This value will be concatenated with
|
2023-04-29 17:35:29 +00:00
|
|
|
|
`"/" + <username>` in order to determine the home dataset to unlock.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
noUnmount = mkOption {
|
|
|
|
|
default = false;
|
|
|
|
|
type = types.bool;
|
|
|
|
|
description = lib.mdDoc ''
|
|
|
|
|
Do not unmount home dataset on logout.
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
2020-04-27 07:04:07 +00:00
|
|
|
|
security.pam.enableEcryptfs = mkEnableOption (lib.mdDoc "eCryptfs PAM module (mounting ecryptfs home directory on login)");
|
2022-05-17 18:16:22 +00:00
|
|
|
|
security.pam.enableFscrypt = mkEnableOption (lib.mdDoc ''
|
2023-09-11 10:06:39 +00:00
|
|
|
|
fscrypt to automatically unlock directories with the user's login password.
|
2022-05-17 18:16:22 +00:00
|
|
|
|
|
|
|
|
|
This also enables a service at security.pam.services.fscrypt which is used by
|
|
|
|
|
fscrypt to verify the user's password when setting up a new protector. If you
|
|
|
|
|
use something other than pam_unix to verify user passwords, please remember to
|
|
|
|
|
adjust this PAM service.
|
|
|
|
|
'');
|
2015-03-05 00:33:05 +00:00
|
|
|
|
|
2012-10-23 13:10:48 +00:00
|
|
|
|
users.motd = mkOption {
|
|
|
|
|
default = null;
|
|
|
|
|
example = "Today is Sweetmorn, the 4th day of The Aftermath in the YOLD 3178.";
|
2015-08-17 17:52:45 +00:00
|
|
|
|
type = types.nullOr types.lines;
|
2012-10-23 13:10:48 +00:00
|
|
|
|
description = lib.mdDoc "Message of the day shown to users when they log in.";
|
|
|
|
|
};
|
|
|
|
|
|
2022-11-11 15:11:37 +00:00
|
|
|
|
users.motdFile = mkOption {
|
|
|
|
|
default = null;
|
|
|
|
|
example = "/etc/motd";
|
|
|
|
|
type = types.nullOr types.path;
|
|
|
|
|
description = lib.mdDoc "A file containing the message of the day shown to users when they log in.";
|
|
|
|
|
};
|
2009-08-16 14:49:14 +00:00
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
###### implementation
|
|
|
|
|
|
|
|
|
|
config = {
|
2022-11-11 15:11:37 +00:00
|
|
|
|
assertions = [
|
|
|
|
|
{
|
2023-03-05 21:08:45 +00:00
|
|
|
|
assertion = config.users.motd == null || config.users.motdFile == null;
|
2022-11-11 15:11:37 +00:00
|
|
|
|
message = ''
|
|
|
|
|
Only one of users.motd and users.motdFile can be set.
|
|
|
|
|
'';
|
|
|
|
|
}
|
2023-04-30 10:07:45 +00:00
|
|
|
|
{
|
2023-05-15 10:06:04 +00:00
|
|
|
|
assertion = config.security.pam.zfs.enable -> (config.boot.zfs.enabled || config.boot.zfs.enableUnstable);
|
2023-04-30 10:07:45 +00:00
|
|
|
|
message = ''
|
|
|
|
|
`security.pam.zfs.enable` requires enabling ZFS (`boot.zfs.enabled` or `boot.zfs.enableUnstable`).
|
|
|
|
|
'';
|
|
|
|
|
}
|
2022-11-11 15:11:37 +00:00
|
|
|
|
];
|
2010-08-13 14:07:34 +00:00
|
|
|
|
|
2009-08-16 14:49:14 +00:00
|
|
|
|
environment.systemPackages =
|
|
|
|
|
# Include the PAM modules in the system path mostly for the manpages.
|
2010-06-02 19:59:44 +00:00
|
|
|
|
[ pkgs.pam ]
|
2010-08-06 08:50:48 +00:00
|
|
|
|
++ optional config.users.ldap.enable pam_ldap
|
2023-06-08 20:35:30 +00:00
|
|
|
|
++ optional config.services.kanidm.enablePam pkgs.kanidm
|
2016-04-14 18:18:09 +00:00
|
|
|
|
++ optional config.services.sssd.enable pkgs.sssd
|
2022-07-16 05:38:42 +00:00
|
|
|
|
++ optionals config.security.pam.krb5.enable [pam_krb5 pam_ccreds]
|
2015-02-14 22:52:22 +00:00
|
|
|
|
++ optionals config.security.pam.enableOTPW [ pkgs.otpw ]
|
2022-04-04 01:08:24 +00:00
|
|
|
|
++ optionals config.security.pam.oath.enable [ pkgs.oath-toolkit ]
|
2020-05-30 09:03:10 +00:00
|
|
|
|
++ optionals config.security.pam.p11.enable [ pkgs.pam_p11 ]
|
2022-05-17 18:16:22 +00:00
|
|
|
|
++ optionals config.security.pam.enableFscrypt [ pkgs.fscrypt-experimental ]
|
2019-01-29 16:45:26 +00:00
|
|
|
|
++ optionals config.security.pam.u2f.enable [ pkgs.pam_u2f ];
|
2017-10-07 15:27:46 +00:00
|
|
|
|
|
|
|
|
|
boot.supportedFilesystems = optionals config.security.pam.enableEcryptfs [ "ecryptfs" ];
|
2015-03-05 00:33:05 +00:00
|
|
|
|
|
2017-01-29 11:33:56 +00:00
|
|
|
|
security.wrappers = {
|
|
|
|
|
unix_chkpwd = {
|
|
|
|
|
setuid = true;
|
2021-09-12 17:04:55 +00:00
|
|
|
|
owner = "root";
|
|
|
|
|
group = "root";
|
2022-01-09 09:20:36 +00:00
|
|
|
|
source = "${pkgs.pam}/bin/unix_chkpwd";
|
2017-01-29 11:33:56 +00:00
|
|
|
|
};
|
2017-10-07 15:27:46 +00:00
|
|
|
|
};
|
2009-08-16 14:49:14 +00:00
|
|
|
|
|
2019-09-14 17:51:29 +00:00
|
|
|
|
environment.etc = mapAttrs' makePAMService config.security.pam.services;
|
2009-08-16 14:49:14 +00:00
|
|
|
|
|
|
|
|
|
security.pam.services =
|
2013-10-15 12:47:51 +00:00
|
|
|
|
{ other.text =
|
|
|
|
|
''
|
|
|
|
|
auth required pam_warn.so
|
|
|
|
|
auth required pam_deny.so
|
|
|
|
|
account required pam_warn.so
|
|
|
|
|
account required pam_deny.so
|
|
|
|
|
password required pam_warn.so
|
|
|
|
|
password required pam_deny.so
|
|
|
|
|
session required pam_warn.so
|
|
|
|
|
session required pam_deny.so
|
|
|
|
|
'';
|
|
|
|
|
|
|
|
|
|
# Most of these should be moved to specific modules.
|
|
|
|
|
i3lock = {};
|
2016-05-15 05:47:31 +00:00
|
|
|
|
i3lock-color = {};
|
2013-10-15 12:47:51 +00:00
|
|
|
|
vlock = {};
|
|
|
|
|
xlock = {};
|
|
|
|
|
xscreensaver = {};
|
2016-09-06 15:23:27 +00:00
|
|
|
|
|
|
|
|
|
runuser = { rootOK = true; unixAuth = false; setEnvironment = false; };
|
|
|
|
|
|
|
|
|
|
/* FIXME: should runuser -l start a systemd session? Currently
|
|
|
|
|
it complains "Cannot create session: Already running in a
|
|
|
|
|
session". */
|
|
|
|
|
runuser-l = { rootOK = true; unixAuth = false; };
|
2022-05-17 18:16:22 +00:00
|
|
|
|
} // optionalAttrs (config.security.pam.enableFscrypt) {
|
|
|
|
|
# Allow fscrypt to verify login passphrase
|
|
|
|
|
fscrypt = {};
|
2013-10-15 12:47:51 +00:00
|
|
|
|
};
|
2009-08-16 14:49:14 +00:00
|
|
|
|
|
2020-10-18 13:36:24 +00:00
|
|
|
|
security.apparmor.includes."abstractions/pam" = let
|
|
|
|
|
isEnabled = test: fold or false (map test (attrValues config.security.pam.services));
|
2021-02-27 20:26:47 +00:00
|
|
|
|
in
|
2021-11-21 22:04:38 +00:00
|
|
|
|
lib.concatMapStrings
|
|
|
|
|
(name: "r ${config.environment.etc."pam.d/${name}".source},\n")
|
2021-02-27 20:26:47 +00:00
|
|
|
|
(attrNames config.security.pam.services) +
|
|
|
|
|
''
|
2020-10-18 13:36:24 +00:00
|
|
|
|
mr ${getLib pkgs.pam}/lib/security/pam_filter/*,
|
|
|
|
|
mr ${getLib pkgs.pam}/lib/security/pam_*.so,
|
|
|
|
|
r ${getLib pkgs.pam}/lib/security/,
|
2021-02-27 20:26:47 +00:00
|
|
|
|
'' +
|
|
|
|
|
optionalString use_ldap ''
|
|
|
|
|
mr ${pam_ldap}/lib/security/pam_ldap.so,
|
|
|
|
|
'' +
|
2023-06-08 20:35:30 +00:00
|
|
|
|
optionalString config.services.kanidm.enablePam ''
|
|
|
|
|
mr ${pkgs.kanidm}/lib/pam_kanidm.so,
|
|
|
|
|
'' +
|
2021-02-27 20:26:47 +00:00
|
|
|
|
optionalString config.services.sssd.enable ''
|
|
|
|
|
mr ${pkgs.sssd}/lib/security/pam_sss.so,
|
|
|
|
|
'' +
|
2022-07-16 05:38:42 +00:00
|
|
|
|
optionalString config.security.pam.krb5.enable ''
|
2020-10-18 13:36:24 +00:00
|
|
|
|
mr ${pam_krb5}/lib/security/pam_krb5.so,
|
|
|
|
|
mr ${pam_ccreds}/lib/security/pam_ccreds.so,
|
2021-02-27 20:26:47 +00:00
|
|
|
|
'' +
|
|
|
|
|
optionalString (isEnabled (cfg: cfg.googleOsLoginAccountVerification)) ''
|
2021-03-18 17:02:07 +00:00
|
|
|
|
mr ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so,
|
|
|
|
|
mr ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_admin.so,
|
2021-02-27 20:26:47 +00:00
|
|
|
|
'' +
|
|
|
|
|
optionalString (isEnabled (cfg: cfg.googleOsLoginAuthentication)) ''
|
2021-03-18 17:02:07 +00:00
|
|
|
|
mr ${pkgs.google-guest-oslogin}/lib/security/pam_oslogin_login.so,
|
2021-02-27 20:26:47 +00:00
|
|
|
|
'' +
|
|
|
|
|
optionalString (config.security.pam.enableSSHAgentAuth
|
|
|
|
|
&& isEnabled (cfg: cfg.sshAgentAuth)) ''
|
|
|
|
|
mr ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so,
|
|
|
|
|
'' +
|
|
|
|
|
optionalString (isEnabled (cfg: cfg.fprintAuth)) ''
|
|
|
|
|
mr ${pkgs.fprintd}/lib/security/pam_fprintd.so,
|
|
|
|
|
'' +
|
|
|
|
|
optionalString (isEnabled (cfg: cfg.u2fAuth)) ''
|
|
|
|
|
mr ${pkgs.pam_u2f}/lib/security/pam_u2f.so,
|
|
|
|
|
'' +
|
|
|
|
|
optionalString (isEnabled (cfg: cfg.usbAuth)) ''
|
|
|
|
|
mr ${pkgs.pam_usb}/lib/security/pam_usb.so,
|
|
|
|
|
'' +
|
2022-03-13 17:20:23 +00:00
|
|
|
|
optionalString (isEnabled (cfg: cfg.usshAuth)) ''
|
|
|
|
|
mr ${pkgs.pam_ussh}/lib/security/pam_ussh.so,
|
|
|
|
|
'' +
|
2021-02-27 20:26:47 +00:00
|
|
|
|
optionalString (isEnabled (cfg: cfg.oathAuth)) ''
|
2022-04-04 01:08:24 +00:00
|
|
|
|
"mr ${pkgs.oath-toolkit}/lib/security/pam_oath.so,
|
2021-02-27 20:26:47 +00:00
|
|
|
|
'' +
|
2022-07-29 15:23:44 +00:00
|
|
|
|
optionalString (isEnabled (cfg: cfg.mysqlAuth)) ''
|
|
|
|
|
mr ${pkgs.pam_mysql}/lib/security/pam_mysql.so,
|
|
|
|
|
'' +
|
2021-02-27 20:26:47 +00:00
|
|
|
|
optionalString (isEnabled (cfg: cfg.yubicoAuth)) ''
|
|
|
|
|
mr ${pkgs.yubico-pam}/lib/security/pam_yubico.so,
|
|
|
|
|
'' +
|
|
|
|
|
optionalString (isEnabled (cfg: cfg.duoSecurity.enable)) ''
|
|
|
|
|
mr ${pkgs.duo-unix}/lib/security/pam_duo.so,
|
|
|
|
|
'' +
|
|
|
|
|
optionalString (isEnabled (cfg: cfg.otpwAuth)) ''
|
|
|
|
|
mr ${pkgs.otpw}/lib/security/pam_otpw.so,
|
|
|
|
|
'' +
|
|
|
|
|
optionalString config.security.pam.enableEcryptfs ''
|
|
|
|
|
mr ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so,
|
|
|
|
|
'' +
|
2022-05-17 18:16:22 +00:00
|
|
|
|
optionalString config.security.pam.enableFscrypt ''
|
|
|
|
|
mr ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so,
|
|
|
|
|
'' +
|
2021-02-27 20:26:47 +00:00
|
|
|
|
optionalString (isEnabled (cfg: cfg.pamMount)) ''
|
|
|
|
|
mr ${pkgs.pam_mount}/lib/security/pam_mount.so,
|
|
|
|
|
'' +
|
|
|
|
|
optionalString (isEnabled (cfg: cfg.enableGnomeKeyring)) ''
|
2022-09-25 05:38:04 +00:00
|
|
|
|
mr ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so,
|
2021-02-27 20:26:47 +00:00
|
|
|
|
'' +
|
|
|
|
|
optionalString (isEnabled (cfg: cfg.startSession)) ''
|
2022-05-05 11:23:32 +00:00
|
|
|
|
mr ${config.systemd.package}/lib/security/pam_systemd.so,
|
2021-02-27 20:26:47 +00:00
|
|
|
|
'' +
|
|
|
|
|
optionalString (isEnabled (cfg: cfg.enableAppArmor)
|
|
|
|
|
&& config.security.apparmor.enable) ''
|
|
|
|
|
mr ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so,
|
|
|
|
|
'' +
|
|
|
|
|
optionalString (isEnabled (cfg: cfg.enableKwallet)) ''
|
2021-05-30 19:42:39 +00:00
|
|
|
|
mr ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so,
|
2021-02-27 20:26:47 +00:00
|
|
|
|
'' +
|
|
|
|
|
optionalString config.virtualisation.lxc.lxcfs.enable ''
|
2023-04-29 17:35:29 +00:00
|
|
|
|
mr ${pkgs.lxc}/lib/security/pam_cgfs.so,
|
|
|
|
|
'' +
|
|
|
|
|
optionalString (isEnabled (cfg: cfg.zfs)) ''
|
|
|
|
|
mr ${config.boot.zfs.package}/lib/security/pam_zfs_key.so,
|
2022-12-08 08:49:12 +00:00
|
|
|
|
'' +
|
|
|
|
|
optionalString config.services.homed.enable ''
|
|
|
|
|
mr ${config.systemd.package}/lib/security/pam_systemd_home.so
|
2021-02-27 20:26:47 +00:00
|
|
|
|
'';
|
2009-08-16 14:49:14 +00:00
|
|
|
|
};
|
2010-08-13 14:07:34 +00:00
|
|
|
|
|
2009-05-28 13:10:02 +00:00
|
|
|
|
}
|