nixos/duosec: replace insecure skey option with secure secretKeyFile option
This commit is contained in:
parent
4f9cea70bd
commit
b9dca769f1
|
@ -96,6 +96,14 @@
|
|||
<option>systemd.services.supybot.serviceConfig</option>.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The <literal>security.duosec.skey</literal> option, which stored a secret in the
|
||||
nix store, has been replaced by a new
|
||||
<link linkend="opt-security.duosec.secretKeyFile">security.duosec.secretKeyFile</link>
|
||||
option for better security.
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
|
||||
|
|
|
@ -10,7 +10,6 @@ let
|
|||
configFilePam = ''
|
||||
[duo]
|
||||
ikey=${cfg.ikey}
|
||||
skey=${cfg.skey}
|
||||
host=${cfg.host}
|
||||
${optionalString (cfg.groups != "") ("groups="+cfg.groups)}
|
||||
failmode=${cfg.failmode}
|
||||
|
@ -24,26 +23,11 @@ let
|
|||
motd=${boolToStr cfg.motd}
|
||||
accept_env_factor=${boolToStr cfg.acceptEnvFactor}
|
||||
'';
|
||||
|
||||
loginCfgFile = optionalAttrs cfg.ssh.enable {
|
||||
"duo/login_duo.conf" =
|
||||
{ source = pkgs.writeText "login_duo.conf" configFileLogin;
|
||||
mode = "0600";
|
||||
user = "sshd";
|
||||
};
|
||||
};
|
||||
|
||||
pamCfgFile = optional cfg.pam.enable {
|
||||
"duo/pam_duo.conf" =
|
||||
{ source = pkgs.writeText "pam_duo.conf" configFilePam;
|
||||
mode = "0600";
|
||||
user = "sshd";
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
(mkRenamedOptionModule [ "security" "duosec" "group" ] [ "security" "duosec" "groups" ])
|
||||
(mkRemovedOptionModule [ "security" "duosec" "skey" ] "The insecure security.duosec.skey option has been replaced by a new security.duosec.secretKeyFile option. Use this new option to store a secure copy of your key instead.")
|
||||
];
|
||||
|
||||
options = {
|
||||
|
@ -65,9 +49,13 @@ in
|
|||
description = "Integration key.";
|
||||
};
|
||||
|
||||
skey = mkOption {
|
||||
type = types.str;
|
||||
description = "Secret key.";
|
||||
secretKeyFile = mkOption {
|
||||
type = types.path;
|
||||
default = null;
|
||||
description = ''
|
||||
A file containing your secret key. The security of your Duo application is tied to the security of your secret key.
|
||||
'';
|
||||
example = "/run/keys/duo-skey";
|
||||
};
|
||||
|
||||
host = mkOption {
|
||||
|
@ -198,7 +186,38 @@ in
|
|||
environment.systemPackages = [ pkgs.duo-unix ];
|
||||
|
||||
security.wrappers.login_duo.source = "${pkgs.duo-unix.out}/bin/login_duo";
|
||||
environment.etc = loginCfgFile // pamCfgFile;
|
||||
|
||||
system.activationScripts = {
|
||||
login_duo = mkIf cfg.ssh.enable ''
|
||||
if test -f "${cfg.secretKeyFile}"; then
|
||||
mkdir -m 0755 -p /etc/duo
|
||||
|
||||
umask 0077
|
||||
conf="$(mktemp)"
|
||||
{
|
||||
cat ${pkgs.writeText "login_duo.conf" configFileLogin}
|
||||
printf 'skey = %s\n' "$(cat ${cfg.secretKeyFile})"
|
||||
} >"$conf"
|
||||
|
||||
chown sshd "$conf"
|
||||
mv -fT "$conf" /etc/duo/login_duo.conf
|
||||
fi
|
||||
'';
|
||||
pam_duo = mkIf cfg.pam.enable ''
|
||||
if test -f "${cfg.secretKeyFile}"; then
|
||||
mkdir -m 0755 -p /etc/duo
|
||||
|
||||
umask 0077
|
||||
conf="$(mktemp)"
|
||||
{
|
||||
cat ${pkgs.writeText "login_duo.conf" configFilePam}
|
||||
printf 'skey = %s\n' "$(cat ${cfg.secretKeyFile})"
|
||||
} >"$conf"
|
||||
|
||||
mv -fT "$conf" /etc/duo/pam_duo.conf
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
/* If PAM *and* SSH are enabled, then don't do anything special.
|
||||
If PAM isn't used, set the default SSH-only options. */
|
||||
|
|
Loading…
Reference in a new issue