alioth/nixpkgs
3
0
Fork 0
forked from mirrors/nixpkgs
Code Releases Activity

Setting pam otpw *after* pam_unix, for dovecot failed auth messages.

Browse source 
I think it's nice that it first asks the usual password, and then offers the
otpw one if enabled. That enables dovecot to show the last pam prompt.

I also add the dovecot option for that.
This commit is contained in:
Lluís Batlle i Rossell 2013-03-30 22:25:19 +01:00
parent c53bd1b279
commit 86c1e10a43
2 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
modules/security/pam.nix
View file

@ -87,9 +87,9 @@ let
"auth sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=~/.ssh/authorized_keys:~/.ssh/authorized_keys2:/etc/ssh/authorized_keys.d/%u"} "auth sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=~/.ssh/authorized_keys:~/.ssh/authorized_keys2:/etc/ssh/authorized_keys.d/%u"}
${optionalString usbAuth ${optionalString usbAuth
"auth sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so"} "auth sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so"}
auth sufficient pam_unix.so ${optionalString allowNullPassword "nullok"} likeauth
${optionalString otpwAuth ${optionalString otpwAuth
"auth sufficient ${pkgs.otpw}/lib/security/pam_otpw.so"} "auth sufficient ${pkgs.otpw}/lib/security/pam_otpw.so"}
auth sufficient pam_unix.so ${optionalString allowNullPassword "nullok"} likeauth
${optionalString config.users.ldap.enable ${optionalString config.users.ldap.enable
"auth sufficient ${pam_ldap}/lib/security/pam_ldap.so use_first_pass"} "auth sufficient ${pam_ldap}/lib/security/pam_ldap.so use_first_pass"}
${optionalString config.krb5.enable '' ${optionalString config.krb5.enable ''

6
modules/services/mail/dovecot.nix
View file

@ -39,7 +39,7 @@ let
} }
passdb { passdb {
driver = pam driver = pam
args = dovecot2 args = ${optionalString cfg.showPAMFailure "failure_show_msg=yes"} dovecot2
} }
pop3_uidl_format = %08Xv%08Xu pop3_uidl_format = %08Xv%08Xu
@ -111,6 +111,10 @@ in
description = "Server key."; description = "Server key.";
}; };
showPAMFailure = mkOption {
default = false;
description = "Show the PAM failure message on authentication error (useful for OTPW).";
};
}; };
}; };