nixos/users-groups: drop the weak-hash activation warning (#529154)
This commit is contained in:
@@ -950,32 +950,8 @@ in
|
||||
};
|
||||
};
|
||||
|
||||
# Warn about user accounts with deprecated password hashing schemes
|
||||
# This does not work when the users and groups are created by
|
||||
# systemd-sysusers because the users are created too late then.
|
||||
system.activationScripts.hashes =
|
||||
if !config.systemd.sysusers.enable && !config.services.userborn.enable then
|
||||
{
|
||||
deps = [ "users" ];
|
||||
text = ''
|
||||
users=()
|
||||
while IFS=: read -r user hash _; do
|
||||
if [[ "$hash" = "$"* && ! "$hash" =~ ^\''$${cryptSchemeIdPatternGroup}\$ ]]; then
|
||||
users+=("$user")
|
||||
fi
|
||||
done </etc/shadow
|
||||
|
||||
if (( "''${#users[@]}" )); then
|
||||
echo "
|
||||
WARNING: The following user accounts rely on password hashing algorithms
|
||||
that have been removed. They need to be renewed as soon as possible, as
|
||||
they do prevent their users from logging in."
|
||||
printf ' - %s\n' "''${users[@]}"
|
||||
fi
|
||||
'';
|
||||
}
|
||||
else
|
||||
""; # keep around for backwards compatibility
|
||||
# for backwards compatibility
|
||||
system.activationScripts.hashes = stringAfter [ "users" ] "";
|
||||
|
||||
# for backwards compatibility
|
||||
system.activationScripts.groups = stringAfter [ "users" ] "";
|
||||
|
||||
Reference in New Issue
Block a user