nixos/fprintd: add service and pam support
This commit is contained in:
parent
006dceba14
commit
a164a0b4c5
|
@ -306,6 +306,7 @@
|
||||||
./services/search/solr.nix
|
./services/search/solr.nix
|
||||||
./services/security/clamav.nix
|
./services/security/clamav.nix
|
||||||
./services/security/fail2ban.nix
|
./services/security/fail2ban.nix
|
||||||
|
./services/security/fprintd.nix
|
||||||
./services/security/fprot.nix
|
./services/security/fprot.nix
|
||||||
./services/security/frandom.nix
|
./services/security/frandom.nix
|
||||||
./services/security/haveged.nix
|
./services/security/haveged.nix
|
||||||
|
|
|
@ -54,6 +54,15 @@ let
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
|
fprintAuth = mkOption {
|
||||||
|
default = config.services.fprintd.enable;
|
||||||
|
type = types.bool;
|
||||||
|
description = ''
|
||||||
|
If set, fingerprint reader will be used (if exists and
|
||||||
|
your fingerprints are enrolled).
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
sshAgentAuth = mkOption {
|
sshAgentAuth = mkOption {
|
||||||
default = false;
|
default = false;
|
||||||
type = types.bool;
|
type = types.bool;
|
||||||
|
@ -179,6 +188,8 @@ let
|
||||||
"auth required pam_tally.so"}
|
"auth required pam_tally.so"}
|
||||||
${optionalString (config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth)
|
${optionalString (config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth)
|
||||||
"auth sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=~/.ssh/authorized_keys:~/.ssh/authorized_keys2:/etc/ssh/authorized_keys.d/%u"}
|
"auth sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=~/.ssh/authorized_keys:~/.ssh/authorized_keys2:/etc/ssh/authorized_keys.d/%u"}
|
||||||
|
${optionalString cfg.fprintAuth
|
||||||
|
"auth sufficient ${pkgs.fprintd}/lib/security/pam_fprintd.so"}
|
||||||
${optionalString cfg.usbAuth
|
${optionalString cfg.usbAuth
|
||||||
"auth sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so"}
|
"auth sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so"}
|
||||||
${optionalString cfg.unixAuth
|
${optionalString cfg.unixAuth
|
||||||
|
|
53
nixos/modules/services/security/fprintd.nix
Normal file
53
nixos/modules/services/security/fprintd.nix
Normal file
|
@ -0,0 +1,53 @@
|
||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
let
|
||||||
|
|
||||||
|
cfg = config.services.fprintd;
|
||||||
|
|
||||||
|
in
|
||||||
|
|
||||||
|
|
||||||
|
{
|
||||||
|
|
||||||
|
###### interface
|
||||||
|
|
||||||
|
options = {
|
||||||
|
|
||||||
|
services.fprintd = {
|
||||||
|
|
||||||
|
enable = mkOption {
|
||||||
|
type = types.bool;
|
||||||
|
default = false;
|
||||||
|
description = ''
|
||||||
|
Whether to enable fprintd daemon and PAM module for fingerprint readers handling.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
};
|
||||||
|
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
###### implementation
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
|
||||||
|
services.dbus.packages = [ pkgs.fprintd ];
|
||||||
|
|
||||||
|
environment.systemPackages = [ pkgs.fprintd ];
|
||||||
|
|
||||||
|
systemd.services.fprintd = {
|
||||||
|
description = "Fingerprint Authentication Daemon";
|
||||||
|
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "dbus";
|
||||||
|
BusName = "net.reactivated.Fprint";
|
||||||
|
ExecStart = "${pkgs.fprintd}/libexec/fprintd";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
};
|
||||||
|
|
||||||
|
}
|
Loading…
Reference in a new issue