From 7b3261b5a60a7721249abc01a1fbb0cad552ff5e Mon Sep 17 00:00:00 2001 From: Mikael Voss Date: Thu, 10 Oct 2024 16:07:36 +0200 Subject: [PATCH] nixos/pam: Strip config in documentation and messages config can be assumed as the options root and is therefore redundant. --- nixos/modules/security/pam.nix | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index acd0673877b8..e50038ecbec9 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -1168,8 +1168,7 @@ in If set, users can authenticate with their Kerberos password. This requires a valid Kerberos configuration - (`config.security.krb5.enable` should be set to - `true`). + (`security.krb5.enable` should be set to `true`). Note that the Kerberos PAM modules are not necessary when using SSS to handle Kerberos authentication. @@ -1587,8 +1586,8 @@ in warnings = lib.optional (with config.security.pam.sshAgentAuth; - enable && lib.any (s: lib.hasPrefix "%h" s || lib.hasPrefix "~" s) authorizedKeysFiles) - ''config.security.pam.sshAgentAuth.authorizedKeysFiles contains files in the user's home directory. + enable && lib.any (s: lib.hasPrefix "%h" s || lib.hasPrefix "~" s) authorizedKeysFiles) '' + security.pam.sshAgentAuth.authorizedKeysFiles contains files in the user's home directory. Specifying user-writeable files there result in an insecure configuration: a malicious process can then edit such an authorized_keys file and bypass the ssh-agent-based authentication.