nixos/pam: remove explicit hardcoded yescrypt
Both `pam_unix.so` and `pam_unix_ng.so` look at `ENCRYPT_METHOD` in `/etc/login.defs` to determine the algorithm to use for password encryption: https://github.com/thkukuk/account-utils/blob/66fbd0382be49d99cb70410a4696c796684ffbf8/src/pam_unix_ng-common.c#L27-L62 If this is not set, both already default to `YESCRYPT`. The shadow module makes this configurable via `security.loginDefs.settings.ENCRYPT_METHOD`, which also defaults to `YESCRYPT`. Seeing as what was previously hardcoded is default anyways, with a global configuration option to change it, there is no point to keep this.
This commit is contained in:
@@ -1422,7 +1422,6 @@ let
|
||||
modulePath = config.security.pam.pam_unixModulePath;
|
||||
settings = {
|
||||
nullok = true;
|
||||
yescrypt = lib.mkIf config.security.pam.enableLegacySettings true;
|
||||
};
|
||||
}
|
||||
{
|
||||
|
||||
@@ -577,7 +577,6 @@ in
|
||||
control = "requisite";
|
||||
modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
|
||||
settings.nullok = true;
|
||||
settings.yescrypt = true;
|
||||
}
|
||||
];
|
||||
|
||||
|
||||
@@ -456,7 +456,6 @@ in
|
||||
control = "requisite";
|
||||
modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
|
||||
settings.nullok = true;
|
||||
settings.yescrypt = true;
|
||||
}
|
||||
];
|
||||
|
||||
|
||||
Reference in New Issue
Block a user