nixos/pam: remove explicit hardcoded yescrypt

Both `pam_unix.so` and `pam_unix_ng.so` look at `ENCRYPT_METHOD` in
`/etc/login.defs` to determine the algorithm to use for password
encryption: https://github.com/thkukuk/account-utils/blob/66fbd0382be49d99cb70410a4696c796684ffbf8/src/pam_unix_ng-common.c#L27-L62
If this is not set, both already default to `YESCRYPT`.
The shadow module makes this configurable via
`security.loginDefs.settings.ENCRYPT_METHOD`, which also defaults to `YESCRYPT`.
Seeing as what was previously hardcoded is default anyways, with a global
configuration option to change it, there is no point to keep this.
This commit is contained in:
Grimmauld
2026-07-13 20:29:02 +02:00
parent b6511a3b8b
commit 3d32e0705a
3 changed files with 0 additions and 3 deletions
-1
View File
@@ -1422,7 +1422,6 @@ let
modulePath = config.security.pam.pam_unixModulePath;
settings = {
nullok = true;
yescrypt = lib.mkIf config.security.pam.enableLegacySettings true;
};
}
{
@@ -577,7 +577,6 @@ in
control = "requisite";
modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
settings.nullok = true;
settings.yescrypt = true;
}
];
@@ -456,7 +456,6 @@ in
control = "requisite";
modulePath = "${config.security.pam.package}/lib/security/pam_unix.so";
settings.nullok = true;
settings.yescrypt = true;
}
];