BoomMicrophone/nixpkgs-suyu
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

nixos/security/pam: added origin option to pamu2f

Browse source
This commit is contained in:
shimun 2022-04-06 12:23:17 +02:00
parent 4b0a37b89f
commit 327d99c0ca
No known key found for this signature in database
GPG key ID: E0420647856EA39E
2 changed files with 22 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
nixos/modules/security/pam.nix
View file

@ -470,7 +470,8 @@ let
auth ${p11.control} ${pkgs.pam_p11}/lib/security/pam_p11.so ${pkgs.opensc}/lib/opensc-pkcs11.so
'') +
(let u2f = config.security.pam.u2f; in optionalString cfg.u2fAuth ''
auth ${u2f.control} ${pkgs.pam_u2f}/lib/security/pam_u2f.so ${optionalString u2f.debug "debug"} ${optionalString (u2f.authFile != null) "authfile=${u2f.authFile}"} ${optionalString u2f.interactive "interactive"} ${optionalString u2f.cue "cue"} ${optionalString (u2f.appId != null) "appid=${u2f.appId}"}
auth ${u2f.control} ${pkgs.pam_u2f}/lib/security/pam_u2f.so ${optionalString u2f.debug "debug"} ${optionalString (u2f.authFile != null) "authfile=${u2f.authFile}"} ''
+ ''${optionalString u2f.interactive "interactive"} ${optionalString u2f.cue "cue"} ${optionalString (u2f.appId != null) "appid=${u2f.appId}"} ${optionalString (u2f.origin != null) "origin=${u2f.origin}"}
'') +
optionalString cfg.usbAuth ''
auth sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so
@ -878,6 +879,24 @@ in
'';
};
origin = mkOption {
default = null;
type = with types; nullOr str;
description = ''
By default <literal>pam-u2f</literal> module sets the origin
to <literal>pam://$HOSTNAME</literal>.
Setting origin to an host independent value will allow you to
reuse credentials across machines
When using <command>pamu2fcfg</command>, you can specify your
application ID with the <literal>-o</literal> flag.
More information can be found <link
xlink:href="https://developers.yubico.com/pam-u2f/Manuals/pam_u2f.8.html">
here</link>
'';
};
control = mkOption {
default = "sufficient";
type = types.enum [ "required" "requisite" "sufficient" "optional" ];

3
nixos/tests/pam/pam-u2f.nix
View file

@ -12,6 +12,7 @@ import ../make-test-python.nix ({ ... }:
debug = true;
enable = true;
interactive = true;
origin = "nixos-test";
};
};
@ -19,7 +20,7 @@ import ../make-test-python.nix ({ ... }:
''
machine.wait_for_unit("multi-user.target")
machine.succeed(
'egrep "auth required .*/lib/security/pam_u2f.so.*debug.*interactive.*cue" /etc/pam.d/ -R'
'egrep "auth required .*/lib/security/pam_u2f.so.*debug.*interactive.*cue.*origin=nixos-test" /etc/pam.d/ -R'
)
'';
})