1
0
Fork 0
mirror of https://github.com/nix-community/home-manager synced 2024-12-23 10:19:48 +01:00

pam: add yubico option

Write YubiKey token IDs in the format yubico_pam expects. See
https://developers.yubico.com/yubico-pam/ for details. Also refer to
the NixOS option security.pam.services.<name>.yubicoAuth.

Closes #2502
This commit is contained in:
Vincent Haupert 2021-11-22 12:10:11 +01:00 committed by Robert Helgesson
parent 78aa7cceff
commit d8f9dcfbd3
No known key found for this signature in database
GPG key ID: 36BDAA14C2797E89
4 changed files with 69 additions and 7 deletions

View file

@ -4,10 +4,10 @@ with lib;
let
vars = config.pam.sessionVariables;
cfg = config.pam;
in {
meta.maintainers = [ maintainers.rycee ];
meta.maintainers = with maintainers; [ rycee veehaitch ];
options = {
pam.sessionVariables = mkOption {
@ -26,10 +26,46 @@ in {
therefore discouraged.
'';
};
pam.yubico.authorizedYubiKeys = {
ids = mkOption {
type = with types;
let
yubiKeyId = addCheck str (s: stringLength s == 12) // {
name = "yubiKeyId";
description = "string of length 12";
};
in listOf yubiKeyId;
default = [ ];
description = ''
List of authorized YubiKey token IDs. Refer to
<link xlink:href="https://developers.yubico.com/yubico-pam"/>
for details on how to obtain the token ID of a YubiKey.
'';
};
config = mkIf (vars != { }) {
home.file.".pam_environment".text = concatStringsSep "\n"
(mapAttrsToList (n: v: ''${n} OVERRIDE="${toString v}"'') vars) + "\n";
path = mkOption {
type = types.str;
default = ".yubico/authorized_yubikeys";
description = ''
File path to write the authorized YubiKeys,
relative to <envar>HOME</envar>.
'';
};
};
};
config = mkMerge [
(mkIf (cfg.sessionVariables != { }) {
home.file.".pam_environment".text = concatStringsSep "\n"
(mapAttrsToList (n: v: ''${n} OVERRIDE="${toString v}"'')
cfg.sessionVariables) + "\n";
})
(mkIf (cfg.yubico.authorizedYubiKeys.ids != [ ]) {
home.file.${cfg.yubico.authorizedYubiKeys.path}.text =
concatStringsSep ":"
([ config.home.username ] ++ cfg.yubico.authorizedYubiKeys.ids);
})
];
}

View file

@ -1 +1,5 @@
{ pam-session-variables = ./session-variables.nix; }
{
pam-session-variables = ./session-variables.nix;
pam-yubico-with-ids = ./yubico-with-ids.nix;
pam-yubico-no-ids = ./yubico-with-ids.nix;
}

View file

@ -0,0 +1,7 @@
{
config = {
nmt.script = ''
assertPathNotExists home-files/.yubico/authorized_yubikeys
'';
};
}

View file

@ -0,0 +1,15 @@
{
config = {
pam.yubico.authorizedYubiKeys.ids = [ "abcdefghijkl" "012345678912" ];
nmt.script = ''
assertFileExists home-files/.yubico/authorized_yubikeys
assertFileContent \
home-files/.yubico/authorized_yubikeys \
${
builtins.toFile "yubico-with-ids-expected.txt"
"hm-user:abcdefghijkl:012345678912"
}
'';
};
}