diff options
Diffstat (limited to 'nixos')
| -rw-r--r-- | nixos/doc/manual/release-notes/rl-1903.xml | 16 | ||||
| -rw-r--r-- | nixos/modules/security/pam.nix | 2 |
2 files changed, 17 insertions, 1 deletions
diff --git a/nixos/doc/manual/release-notes/rl-1903.xml b/nixos/doc/manual/release-notes/rl-1903.xml index 69e94fbccc5c..7bc887693376 100644 --- a/nixos/doc/manual/release-notes/rl-1903.xml +++ b/nixos/doc/manual/release-notes/rl-1903.xml @@ -318,6 +318,22 @@ case. </para> </listitem> + <listitem> + <para> + The <literal>pam_unix</literal> account module is now loaded with its + control field set to <literal>required</literal> instead of + <literal>sufficient</literal>, so that later pam account modules that + might do more extensive checks are being executed. + Previously, the whole account module verification was exited prematurely + in case a nss module provided the account name to + <literal>pam_unix</literal>. + The LDAP and SSSD NixOS modules already add their NSS modules when + enabled. In case your setup breaks due to some later pam account module + previosuly shadowed, or failing NSS lookups, please file a bug. You can + get back the old behaviour by manually setting + <literal><![CDATA[security.pam.services.<name?>.text]]></literal>. + </para> + </listitem> </itemizedlist> </section> diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 926c6d77d3bb..812a71c68a30 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -269,7 +269,7 @@ let text = mkDefault ('' # Account management. - account ${if cfg.sssdStrictAccess then "required" else "sufficient"} pam_unix.so + account required pam_unix.so ${optionalString use_ldap "account sufficient ${pam_ldap}/lib/security/pam_ldap.so"} ${optionalString (config.services.sssd.enable && cfg.sssdStrictAccess==false) |