3
0
Fork 0
forked from mirrors/nixpkgs
nixpkgs/nixos
Florian Klink d180bf3862 security.pam: make pam_unix.so required, not sufficient
Having pam_unix set to "sufficient" means early-succeeding account
management group, as soon as pam_unix.so is succeeding.

This is not sufficient. For example, nixos modules might install nss
modules for user lookup, so pam_unix.so succeeds, and we end the stack
successfully, even though other pam account modules might want to do
more extensive checks.

Other distros seem to set pam_unix.so to 'required', so if there are
other pam modules in that management group, they get a chance to do some
validation too.

For SSSD, @PsyanticY already added a workaround knob in
https://github.com/NixOS/nixpkgs/pull/31969, while stating this should
be the default anyway.

I did some thinking in what could break - after this commit, we require
pam_unix to succeed, means we require `getent passwd $username` to
return something.
This is the case for all local users due to the passwd nss module, and
also the case for all modules installing their nss module to
nsswitch.conf - true for ldap (if not explicitly disabled) and sssd.

I'm not so sure about krb5, cc @eqyiel for opinions. Is there some nss
module loaded? Should the pam account module be placed before pam_unix?

We don't drop the `security.pam.services.<name?>.sssdStrictAccess`
option, as it's also used some lines below to tweak error behaviour
inside the pam sssd module itself (by changing it's 'control' field).

This is also required to get admin login for Google OS Login working
(#51566), as their pam_oslogin_admin accounts module takes care of sudo
configuration.
2018-12-21 15:31:07 +01:00
..
doc security.pam: make pam_unix.so required, not sufficient 2018-12-21 15:31:07 +01:00
lib Merge pull request #52379 from erikarvstedt/tesseract 2018-12-20 14:41:48 +00:00
maintainers google-compute-image: make it a module and the size tuneable (#49854) 2018-11-26 14:51:00 +00:00
modules security.pam: make pam_unix.so required, not sufficient 2018-12-21 15:31:07 +01:00
tests Merge pull request #52345 from r-ryantm/auto-update/clickhouse 2018-12-20 18:48:37 +01:00
COPYING
default.nix
README
release-combined.nix nixos/release-combined.nix: Filters failing tests 2018-12-19 22:28:10 -05:00
release-small.nix
release.nix Merge pull request #52534 from samueldr/aarch64/supported 2018-12-20 20:58:59 -05:00

*** NixOS ***

NixOS is a Linux distribution based on the purely functional package
management system Nix.  More information can be found at
http://nixos.org/nixos and in the manual in doc/manual.