Grimmauld
79 lines
2.4 KiB
Nix
79 lines
2.4 KiB
Nix
{
|
|
lib,
|
|
config,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.security.account-utils;
|
|
format = pkgs.formats.ini { };
|
|
in
|
|
{
|
|
options.security.account-utils = {
|
|
enable = lib.mkEnableOption "the account-utils implementation of Unix user authentication and management";
|
|
package = lib.mkPackageOption pkgs "account-utils" { };
|
|
extraArgs = lib.mkOption {
|
|
type = lib.types.listOf lib.types.nonEmptyStr;
|
|
default = [ ];
|
|
example = [
|
|
"--debug"
|
|
"-v"
|
|
];
|
|
description = ''
|
|
List of arguments to pass to the socket activated service executables.
|
|
::: {.note}
|
|
This is passed to both pwupdd and pwaccessd, which support identical flags.
|
|
:::
|
|
'';
|
|
};
|
|
pwaccessd.settings = lib.mkOption {
|
|
description = ''
|
|
Options for pwaccessd.
|
|
See {manpage}`pwaccessd.conf(5)` for available options.
|
|
'';
|
|
type = lib.types.submodule {
|
|
freeformType = format.type;
|
|
};
|
|
default = { };
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
# use account-utils reimplementation of pam_unix
|
|
security.pam = {
|
|
pam_unixModulePath = "${cfg.package}/lib/security/pam_unix_ng.so";
|
|
enableLegacySettings = false;
|
|
};
|
|
|
|
systemd = {
|
|
packages = [ cfg.package ];
|
|
sockets.pwaccessd.wantedBy = [ "sockets.target" ];
|
|
sockets.pwupdd.wantedBy = lib.optional config.users.mutableUsers "sockets.target"; # immutable users do not need password updating
|
|
sockets.newidmapd.wantedBy = [ "sockets.target" ];
|
|
services."pwupdd@".environment.PWUPDD_OPTS = lib.escapeShellArgs cfg.extraArgs;
|
|
services."pwaccessd".environment.PWACCESSD_OPTS = lib.escapeShellArgs cfg.extraArgs;
|
|
};
|
|
|
|
environment.systemPackages = [ cfg.package ];
|
|
environment.etc."account-utils/pwaccessd.conf".source =
|
|
format.generate "pwaccessd.conf" cfg.pwaccessd.settings;
|
|
|
|
security.pam.services = {
|
|
pwupd-passwd = { };
|
|
pwupd-chsh = { };
|
|
pwupd-chfn = { };
|
|
};
|
|
|
|
# covered by account-utils via socket-activated service
|
|
security.wrappers = {
|
|
# shadow suid binaries are no longer necessary, but disabling the entire shadow module is too intrusive
|
|
newuidmap.enable = false;
|
|
newgidmap.enable = false;
|
|
chsh.enable = false;
|
|
passwd.enable = false;
|
|
|
|
unix_chkpwd.enable = false; # Not necessary when using pam_unix_ng.so
|
|
};
|
|
};
|
|
}
|