From 3194d1c498ffa4d2e11cadb3585d2e66667b6472 Mon Sep 17 00:00:00 2001
From: Mynacol <Mynacol@users.noreply.github.com>
Date: Sun, 15 Jun 2025 20:36:00 +0000
Subject: [PATCH] nixos/sshd: Allow UsePAM being null
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit allows setting the `UsePAM` setting to null. Without it, nix
fails to evaluate with:
```
error: ‘mkIf’ called with a non-Boolean condition
```

Setting it to null means no line for `UsePAM` is written into the
resulting sshd config file. This is needed if openssh is compiled
without PAM support. Otherwise the following log message is produced:
```
rexec line 15: Unsupported option UsePAM
```

This also adds the nixos test openssh-null-pam to set `UsePAM` to null.
This also tests that the above log line is not produced in that case.
---
 .../modules/services/networking/ssh/sshd.nix  |  2 +-
 nixos/tests/openssh.nix                       | 29 +++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index 8c5c7de61fec..d4457560dbf1 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -793,7 +793,7 @@ in
 
       networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall cfg.ports;
 
-      security.pam.services.sshd = lib.mkIf cfg.settings.UsePAM {
+      security.pam.services.sshd = lib.mkIf (cfg.settings.UsePAM == true) {
         startSession = true;
         showMotd = true;
         unixAuth = if cfg.settings.PasswordAuthentication == true then true else false;
diff --git a/nixos/tests/openssh.nix b/nixos/tests/openssh.nix
index 940db7139b32..4bf584338c49 100644
--- a/nixos/tests/openssh.nix
+++ b/nixos/tests/openssh.nix
@@ -224,6 +224,23 @@ in
         ];
       };
 
+    server-null-pam =
+      { pkgs, ... }:
+      {
+        services.openssh = {
+          enable = true;
+          package = pkgs.opensshPackages.openssh.override {
+            withPAM = false;
+          };
+          settings = {
+            UsePAM = null;
+          };
+        };
+        users.users.root.openssh.authorizedKeys.keys = [
+          snakeOilPublicKey
+        ];
+      };
+
     server-sftp =
       { pkgs, ... }:
       {
@@ -279,6 +296,8 @@ in
     server_match_rule.wait_for_unit("sshd", timeout=30)
     server_no_openssl.wait_for_unit("sshd", timeout=30)
     server_no_pam.wait_for_unit("sshd", timeout=30)
+    server_null_pam.wait_for_unit("sshd", timeout=30)
+    server_null_pam.fail("journalctl -u sshd.service | grep 'Unsupported option UsePAM'")
     server_sftp.wait_for_unit("sshd", timeout=30)
 
     server_lazy.wait_for_unit("sshd.socket", timeout=30)
@@ -391,6 +410,16 @@ in
             timeout=30
         )
 
+    with subtest("null-pam"):
+        client.succeed(
+            "cat ${snakeOilPrivateKey} > privkey.snakeoil"
+        )
+        client.succeed("chmod 600 privkey.snakeoil")
+        client.succeed(
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-null-pam true",
+            timeout=30
+        )
+
     with subtest("sftp"):
         server_sftp.succeed(
           "mkdir -p /srv/sftp/uploads"