From 93699b88a53066212999851bd248c5b5813b34a3 Mon Sep 17 00:00:00 2001 From: Adam Dinwoodie Date: Tue, 5 May 2026 20:30:40 +0100 Subject: [PATCH] nixos/vsftpd: release note PAM regression Commit 5aa9012bb3fa (nixos: replace 'text' with structured PAM rules (#420889), 2026-04-14) resulted in the vsftpd module no longer creating a PAM module, and therefore configurations relying on `cfg.localUsers` stopped permitting logins unless the PAM module was being set up by other configuration. In the absence of a better fix, document this change of behaviour as a regression. Per the discussion at [0], provide a mechanims to restore the previous behaviour, but with the caveat that this may be insecure. I'd prefer more useful advice, but if I had a better understanding of NixOS's PAM configuration and how it interacts with vsftpd, I'd just be providing the better fix in the first place. [0]: https://github.com/NixOS/nixpkgs/issues/515531#issuecomment-4367747991 --- nixos/doc/manual/release-notes/rl-2605.section.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md index e2eff27bc5ec..e77610ebc9bd 100644 --- a/nixos/doc/manual/release-notes/rl-2605.section.md +++ b/nixos/doc/manual/release-notes/rl-2605.section.md @@ -200,6 +200,8 @@ - `post-resume.target` has been removed. See {manpage}`systemd.special(7)` about `sleep.target` for instructions on ordering a process after resume with `ExecStop=`. +- `services.vsftpd` no longer automatically configures a PAM module. This means configurations using `services.vsftpd.localUsers` will no longer work unless `services.vsftpd.enableVirtualUsers` and `services.vsftpd.userDbPath` are also configured. The old behaviour can be restored by setting `security.pam.services.vsftpd.enable = true`, although this only ever worked by accident and may not be secure. + - `services.kubernetes.addons.dns.coredns` has been renamed to `services.kubernetes.addons.dns.corednsImage` and now expects a package instead of attrs. Now, by default, nixpkgs.coredns in conjunction with dockerTools.buildImage is used, instead of pulling the upstream container image from Docker Hub. If you want the old behavior, you can set: