diff options
| author | Graham Christensen <graham@grahamc.com> | 2017-02-13 09:36:35 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2017-02-13 09:36:35 -0500 |
| commit | 1d2548772ebfd52cd5ce3d37644dd90c88c57bff (patch) | |
| tree | b7c454907e150d3f90c906660074dde0972f2cff /nixos/modules | |
| parent | 909a1dd569b214660769f75a79827d9267786fd5 (diff) | |
| parent | 96d767de621242a5df6de5db82a9b088d24ef606 (diff) | |
| download | nixlib-1d2548772ebfd52cd5ce3d37644dd90c88c57bff.tar nixlib-1d2548772ebfd52cd5ce3d37644dd90c88c57bff.tar.gz nixlib-1d2548772ebfd52cd5ce3d37644dd90c88c57bff.tar.bz2 nixlib-1d2548772ebfd52cd5ce3d37644dd90c88c57bff.tar.lz nixlib-1d2548772ebfd52cd5ce3d37644dd90c88c57bff.tar.xz nixlib-1d2548772ebfd52cd5ce3d37644dd90c88c57bff.tar.zst nixlib-1d2548772ebfd52cd5ce3d37644dd90c88c57bff.zip | |
Merge pull request #22724 from grahamc/pam-oath-fixup
pam_oath: require OATH and pam_unix credentials to be valid
Diffstat (limited to 'nixos/modules')
| -rw-r--r-- | nixos/modules/security/pam.nix | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 96e7c45d4963..67652fbd1e70 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -253,6 +253,8 @@ let "auth sufficient ${pkgs.pam_u2f}/lib/security/pam_u2f.so"} ${optionalString cfg.usbAuth "auth sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so"} + ${let oath = config.security.pam.oath; in optionalString cfg.oathAuth + "auth requisite ${pkgs.oathToolkit}/lib/security/pam_oath.so window=${toString oath.window} usersfile=${toString oath.usersFile} digits=${toString oath.digits}"} '' + # Modules in this block require having the password set in PAM_AUTHTOK. # pam_unix is marked as 'sufficient' on NixOS which means nothing will run @@ -271,8 +273,6 @@ let "auth sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth try_first_pass"} ${optionalString cfg.otpwAuth "auth sufficient ${pkgs.otpw}/lib/security/pam_otpw.so"} - ${let oath = config.security.pam.oath; in optionalString cfg.oathAuth - "auth sufficient ${pkgs.oathToolkit}/lib/security/pam_oath.so window=${toString oath.window} usersfile=${toString oath.usersFile} digits=${toString oath.digits}"} ${optionalString use_ldap "auth sufficient ${pam_ldap}/lib/security/pam_ldap.so use_first_pass"} ${optionalString config.services.sssd.enable |