diff options
| author | Graham Christensen <graham@grahamc.com> | 2017-02-12 18:17:08 -0500 |
|---|---|---|
| committer | Graham Christensen <graham@grahamc.com> | 2017-02-12 18:27:11 -0500 |
| commit | 96d767de621242a5df6de5db82a9b088d24ef606 (patch) | |
| tree | 7b9169e1455d493c31259fa1d71d52096815a578 /nixos/modules/security/pam.nix | |
| parent | 59e77daf5b077d6f9b1e940a6c884bf0637f1732 (diff) | |
| download | nixlib-96d767de621242a5df6de5db82a9b088d24ef606.tar nixlib-96d767de621242a5df6de5db82a9b088d24ef606.tar.gz nixlib-96d767de621242a5df6de5db82a9b088d24ef606.tar.bz2 nixlib-96d767de621242a5df6de5db82a9b088d24ef606.tar.lz nixlib-96d767de621242a5df6de5db82a9b088d24ef606.tar.xz nixlib-96d767de621242a5df6de5db82a9b088d24ef606.tar.zst nixlib-96d767de621242a5df6de5db82a9b088d24ef606.zip | |
pam_oath: require OATH and pam_unix credentials to be valid
Diffstat (limited to 'nixos/modules/security/pam.nix')
| -rw-r--r-- | nixos/modules/security/pam.nix | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 96e7c45d4963..67652fbd1e70 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -253,6 +253,8 @@ let "auth sufficient ${pkgs.pam_u2f}/lib/security/pam_u2f.so"} ${optionalString cfg.usbAuth "auth sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so"} + ${let oath = config.security.pam.oath; in optionalString cfg.oathAuth + "auth requisite ${pkgs.oathToolkit}/lib/security/pam_oath.so window=${toString oath.window} usersfile=${toString oath.usersFile} digits=${toString oath.digits}"} '' + # Modules in this block require having the password set in PAM_AUTHTOK. # pam_unix is marked as 'sufficient' on NixOS which means nothing will run @@ -271,8 +273,6 @@ let "auth sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth try_first_pass"} ${optionalString cfg.otpwAuth "auth sufficient ${pkgs.otpw}/lib/security/pam_otpw.so"} - ${let oath = config.security.pam.oath; in optionalString cfg.oathAuth - "auth sufficient ${pkgs.oathToolkit}/lib/security/pam_oath.so window=${toString oath.window} usersfile=${toString oath.usersFile} digits=${toString oath.digits}"} ${optionalString use_ldap "auth sufficient ${pam_ldap}/lib/security/pam_ldap.so use_first_pass"} ${optionalString config.services.sssd.enable |