From 87942da08e3221f32c7a43a17b165fabfdb04082 Mon Sep 17 00:00:00 2001 From: Lara Date: Mon, 20 Sep 2021 08:53:29 +0200 Subject: [PATCH 1/5] nixos/sssd: Add secrets handling Currently, it is not possible to supply sensitive credentials like `ldap_default_authtok` without writing them to the nix store. This This commit introduces a new option `environmentFile` where those credentials can be supplied via environment substitution. --- nixos/modules/services/misc/sssd.nix | 48 ++++++++++++++++++++++++---- 1 file changed, 41 insertions(+), 7 deletions(-) diff --git a/nixos/modules/services/misc/sssd.nix b/nixos/modules/services/misc/sssd.nix index 70afbe0433ae..039c9737b1f4 100644 --- a/nixos/modules/services/misc/sssd.nix +++ b/nixos/modules/services/misc/sssd.nix @@ -3,6 +3,10 @@ with lib; let cfg = config.services.sssd; nscd = config.services.nscd; + + dataDir = "/var/lib/sssd"; + settingsFile = "${dataDir}/sssd.conf"; + settingsFileUnsubstituted = pkgs.writeText "${dataDir}/sssd-unsubsituted.conf" cfg.config; in { options = { services.sssd = { @@ -47,6 +51,30 @@ in { Kerberos will be configured to cache credentials in SSS. ''; }; + environmentFile = mkOption { + type = types.nullOr types.path; + default = null; + description = '' + Environment file as defined in + systemd.exec5 + . + + Secrets may be passed to the service without adding them to the world-readable + Nix store, by specifying placeholder variables as the option value in Nix and + setting these variables accordingly in the environment file. + + + # snippet of sssd-related config + [domain/LDAP] + ldap_default_authtok = $SSSD_LDAP_DEFAULT_AUTHTOK + + + + # contents of the environment file + SSSD_LDAP_DEFAULT_AUTHTOK=verysecretpassword + + ''; + }; }; }; config = mkMerge [ @@ -60,22 +88,28 @@ in { wants = [ "nss-user-lookup.target" ]; restartTriggers = [ config.environment.etc."nscd.conf".source - config.environment.etc."sssd/sssd.conf".source + settingsFileUnsubstituted ]; script = '' export LDB_MODULES_PATH+="''${LDB_MODULES_PATH+:}${pkgs.ldb}/modules/ldb:${pkgs.sssd}/modules/ldb" mkdir -p /var/lib/sss/{pubconf,db,mc,pipes,gpo_cache,secrets} /var/lib/sss/pipes/private /var/lib/sss/pubconf/krb5.include.d - ${pkgs.sssd}/bin/sssd -D + ${pkgs.sssd}/bin/sssd -D -c ${settingsFile} ''; serviceConfig = { Type = "forking"; PIDFile = "/run/sssd.pid"; + StateDirectory = baseNameOf dataDir; + EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile; }; - }; - - environment.etc."sssd/sssd.conf" = { - text = cfg.config; - mode = "0400"; + preStart = '' + [ -f ${settingsFile} ] && rm -f ${settingsFile} + old_umask=$(umask) + umask 0177 + ${pkgs.envsubst}/bin/envsubst \ + -o ${settingsFile} \ + -i ${settingsFileUnsubstituted} + umask $old_umask + ''; }; system.nssModules = [ pkgs.sssd ]; From 8d92d42c5c6c19e3ef5d9e01f94bde763364c48b Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Thu, 18 Aug 2022 11:34:06 +0200 Subject: [PATCH 2/5] nixos/sssd: fix typo --- nixos/modules/services/misc/sssd.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/misc/sssd.nix b/nixos/modules/services/misc/sssd.nix index 039c9737b1f4..299002d516da 100644 --- a/nixos/modules/services/misc/sssd.nix +++ b/nixos/modules/services/misc/sssd.nix @@ -6,7 +6,7 @@ let dataDir = "/var/lib/sssd"; settingsFile = "${dataDir}/sssd.conf"; - settingsFileUnsubstituted = pkgs.writeText "${dataDir}/sssd-unsubsituted.conf" cfg.config; + settingsFileUnsubstituted = pkgs.writeText "${dataDir}/sssd-unsubstituted.conf" cfg.config; in { options = { services.sssd = { From 2f0bd926ea9c15b9b76c25410ce3dd7c2bdda869 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Thu, 18 Aug 2022 11:34:20 +0200 Subject: [PATCH 3/5] nixos/sssd-ldap: fix eval Introduced by fd7d901133f9fbfc893cdb33f7d630846bb21f9c. The openldap module now expects the database directory to be below `/var/lib/openldap`, oterhwise it'll fail evaluation like this: Failed assertions: - Database dc=example,dc=org has `olcDbDirectory` (/var/db/openldap) that is not a subdirectory of `/var/lib/openldap/`. --- nixos/tests/sssd-ldap.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/tests/sssd-ldap.nix b/nixos/tests/sssd-ldap.nix index f816c0652cc5..2b328f71d17c 100644 --- a/nixos/tests/sssd-ldap.nix +++ b/nixos/tests/sssd-ldap.nix @@ -28,7 +28,7 @@ in import ./make-test-python.nix ({pkgs, ...}: { attrs = { objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ]; olcDatabase = "{1}mdb"; - olcDbDirectory = "/var/db/openldap"; + olcDbDirectory = "/var/lib/openldap/db"; olcSuffix = dbSuffix; olcRootDN = "cn=${ldapRootUser},${dbSuffix}"; olcRootPW = ldapRootPassword; From 204d32c5c1be0d172d7c6a1840334994979eb0d3 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Thu, 18 Aug 2022 11:37:43 +0200 Subject: [PATCH 4/5] nixos/sssd-ldap: verify that passing secrets via env works --- nixos/tests/sssd-ldap.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/nixos/tests/sssd-ldap.nix b/nixos/tests/sssd-ldap.nix index 2b328f71d17c..27dce6ceb98c 100644 --- a/nixos/tests/sssd-ldap.nix +++ b/nixos/tests/sssd-ldap.nix @@ -67,6 +67,8 @@ in import ./make-test-python.nix ({pkgs, ...}: { services.sssd = { enable = true; + # just for testing purposes, don't put this into the Nix store in production! + environmentFile = "${pkgs.writeText "ldap-root" "LDAP_BIND_PW=${ldapRootPassword}"}"; config = '' [sssd] config_file_version = 2 @@ -80,7 +82,7 @@ in import ./make-test-python.nix ({pkgs, ...}: { ldap_search_base = ${dbSuffix} ldap_default_bind_dn = cn=${ldapRootUser},${dbSuffix} ldap_default_authtok_type = password - ldap_default_authtok = ${ldapRootPassword} + ldap_default_authtok = $LDAP_BIND_PW ''; }; }; From 5ec8223e637bf89fd6f8e122ce9f0ff7bde36204 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Thu, 18 Aug 2022 11:38:49 +0200 Subject: [PATCH 5/5] nixos/sssd: explain why we use EnvironmentFile= --- nixos/modules/services/misc/sssd.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/services/misc/sssd.nix b/nixos/modules/services/misc/sssd.nix index 299002d516da..60d4a799d5d2 100644 --- a/nixos/modules/services/misc/sssd.nix +++ b/nixos/modules/services/misc/sssd.nix @@ -99,6 +99,7 @@ in { Type = "forking"; PIDFile = "/run/sssd.pid"; StateDirectory = baseNameOf dataDir; + # We cannot use LoadCredential here because it's not available in ExecStartPre EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile; }; preStart = ''