about summary refs log tree commit diff
path: root/nixos
Commit message (Collapse)AuthorAge
* Merge branch 'yubikey' of git://github.com/Calrama/nixpkgsPetr Rockai2014-01-29
|\
| * Add library dependencies explicitlyMoritz Maxeiner2014-01-29
| |
| * Implement muli-user authentication for yubikey pba, i.e. multiple users can ↵Moritz Maxeiner2014-01-29
| | | | | | | | | | | | | | | | now share a single luks keyslot. This is achieved by having multiple lines per storage file, one for each user (if the feature is enabled); each of these lines has the same format as would be the case for the userless authentication, except that they are prepended with a SHA-512 of the user's id.
| * Change the crypt-storage file to be hex encoded instead of raw binary. To ↵Moritz Maxeiner2014-01-29
| | | | | | | | update from the previous configuration, convert your crypt-storage file from raw binary to hex.
| * Enable two-factor authentication by default. Add proper descriptions to ↵Moritz Maxeiner2014-01-29
| | | | | | | | attributes.
| * Cosmetic change to yubikey detectionMoritz Maxeiner2014-01-28
| |
| * Rewrite as a pre-boot authentication module (mostly) comforming to the ↵Moritz Maxeiner2014-01-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | design specification of 'YubiKey Integration for Full Disk Encryption Pre-Boot Authentication (Copyright) Yubico, 2011 Version: 1.1'. Used binaries: * uuidgen - for generation of random sequence numbers * ykchalresp - for challenging a Yubikey * ykinfo - to check if a Yubikey is plugged in at boot (fallback to passphrase authentication otherwise) * openssl - for calculation of SHA-1, HMAC-SHA-1, as well as AES-256-CTR (de/en)cryption Main differences to the specification mentioned above: * No user management (yet), only one password+yubikey per LUKS device * SHA-512 instead of CRC-16 for checksum Main differences to the previous implementation: * Instead of changing the key slot of the LUKS device each boot, the actual key for the LUKS device will be encrypted itself * Since the response for the new challenge is now calculated locally with openssl, the MITM-USB-attack with which previously an attacker could obtain the new response (that was used as the new encryption key for the LUKS device) by listening to the Yubikey has ideally become useless (as long as uuidgen can successfuly generate new random sequence numbers). Remarks: * This is not downwards compatible to the previous implementation
| * Implement authentication for a LUKS device with a yubikey (HMAC-SHA1); ↵Moritz Maxeiner2014-01-25
| | | | | | | | supports simple challenge-response and two-factor authentication
* | nixos-generate-config: Fix reference to <nixos>.aszlig2014-01-29
| | | | | | | | | | | | | | | | | | IIUC, <nixos> is going to be deprecated someday in the future, and as most of those references are already replaced I guess it's safe to replace it here as well, as it is only relevant on new/updated installations. Signed-off-by: aszlig <aszlig@redmoonstudios.org>
* | Merge pull request #1178 from chexxor/fix-httpd-sshRob Vermaas2014-01-27
|\ \ | | | | | | HTTPD: Check for SSL Cert value before building with SSL support.
| * | Check empty stringfor globalRedirect. It breaks RedirectPermanent.Alex Berg2013-11-11
| | |
| * | Add HTTPD SSH assertion to check null cert/key.Alex Berg2013-11-11
| | |
| * | Check for SSL Cert value before building with SSL support.Alex Berg2013-11-06
| | |
* | | nixos: Add a dictd service.Petr Rockai2014-01-25
| | |
* | | support -Q in nixos-rebuildAristid Breitkreuz2014-01-25
| |/ |/|
* | networkmanager: load modules required for PPTPThomas Tuegel2014-01-24
| |
* | remove .topmsg (close #1578)Vladimír Čunát2014-01-23
| |
* | nixos X tests: wait for logind to link a session to the serverShea Levy2014-01-22
| | | | | | | | | | | | There seems to be some race causing failures if an X command gets in before slim starts the session Signed-off-by: Shea Levy <shea@shealevy.com>
* | Rename linuxManualConfig to buildLinuxShea Levy2014-01-21
| | | | | | | | Signed-off-by: Shea Levy <shea@shealevy.com>
* | Whitespace to force a buildShea Levy2014-01-19
| | | | | | | | | | | | Ugh Signed-off-by: Shea Levy <shea@shealevy.com>
* | Merge pull request #1536 from Shados/service-havegedDomen Kožar2014-01-18
|\ \ | | | | | | Adds a service for haveged, the entropy daemon
| * | Adds a service for haveged, the entropy daemonAlexei Robyn2014-01-17
| | | | | | | | | | | | | | | | | | Includes configuration option for the threshold beneath which to refill the entropy pool - defaults to 1024 bits as this is the number used in other distro's existing service files I looked at.
* | | kmscon: Don't re-run systemd-vconsole-setup after boot, and let tty1 wait ↵Shea Levy2014-01-18
| | | | | | | | | | | | | | | | | | for vconsole setup Signed-off-by: Shea Levy <shea@shealevy.com>
* | | systemd: Enable specifying extra config files for a unitShea Levy2014-01-18
| | | | | | | | | | | | | | | | | | | | | This will allow overriding package-provided units, or overriding only a specific instance of a unit template. Signed-off-by: Shea Levy <shea@shealevy.com>
* | | Whitespace to force a rebuildShea Levy2014-01-17
| | | | | | | | | | | | Signed-off-by: Shea Levy <shea@shealevy.com>
* | | Merge branch 'xprofile' of git://github.com/pSub/nixpkgs into masterShea Levy2014-01-17
|\ \ \ | |/ / |/| | | | | | | | | | | Allow the user to execute commands at the beginning of the X session. Signed-off-by: Shea Levy <shea@shealevy.com>
| * | Allow the user to execute commands at the beginning of the X session.Pascal Wittmann2014-01-02
| | | | | | | | | | | | | | | | | | The difference between xsession and xprofile is that xsession is exec'd and xprofile is sourced. So with xprofile all commands after sourcing will still be exectued. This allows for instance autostarting of applications while configuring the start of a window manager via configuration.nix.
* | | Fix environment.etc settingShea Levy2014-01-15
| | | | | | | | | | | | Signed-off-by: Shea Levy <shea@shealevy.com>
* | | Fix typoShea Levy2014-01-15
| | | | | | | | | | | | | | | | | | Thanks to @bennofs for pointing it out Signed-off-by: Shea Levy <shea@shealevy.com>
* | | Don't restart kmscon VTs if the unit changesShea Levy2014-01-15
| | | | | | | | | | | | Signed-off-by: Shea Levy <shea@shealevy.com>
* | | Option description formattingShea Levy2014-01-15
| | | | | | | | | | | | Signed-off-by: Shea Levy <shea@shealevy.com>
* | | nixos: Split mesa setup from xserver.nixShea Levy2014-01-15
| | | | | | | | | | | | | | | | | | | | | With kmscon, it is now possible to have a system without X that still needs the mesa setup in /run/opengl-driver Signed-off-by: Shea Levy <shea@shealevy.com>
* | | Add module to use kmscon instead of linux-console for VTsShea Levy2014-01-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This required some changes to systemd unit handling: * Add an option to specify that a unit is just a symlink * Allow specified units to overwrite systemd-provided ones * Have gettys.target require autovt@1.service instead of getty@1.service Signed-off-by: Shea Levy <shea@shealevy.com>
* | | Adds kippo SSH honeypotThomas Bereknyei2014-01-14
| | |
* | | Merge branch 'java'Eelco Dolstra2014-01-13
|\ \ \
| * | | Don't set $TZEelco Dolstra2014-01-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Now that Java is happy with our /etc/localtime, there is no reason to set $TZ anymore. (See 945849b86fe33474da569b307d7e5880877491b6, 279248f6c562eb88227d22b824c9324683980b96, 1b5e860f65607b4cc7de4b6b5db95460cf144526.) Fixes #1463.
| * | | Make /etc/localtime a direct symlink to the zoneinfo fileEelco Dolstra2014-01-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Some programs (notably the Java Runtime Environment) expect to be able to extract the name of the time zone from the target of the /etc/localtime symlink. That doesn't work if /etc/localtime is a symlink to /etc/static/localtime. So make it a direct symlink.
* | | | xfce: add xfce screenshooterJaka Hudoklin2014-01-13
| | | |
* | | | nixos/cgminer: fix restarts, set uidJaka Hudoklin2014-01-13
| | | |
* | | | services.postgresql: Hint to use mkForce for authenticationOliver Charles2014-01-11
| | | | | | | | | | | | | | | | This fixes #1395
* | | | connman-vpn and connman-vpn dbus servise should start after connman serviceRok Garbas2014-01-11
| | | |
* | | | connman: new packages ConnMan v1.20 and connman-uiMatej Cotman2014-01-11
| | | |
* | | | gummiboot module: Don't use obsolete environment.nix optionShea Levy2014-01-05
| | | | | | | | | | | | | | | | Signed-off-by: Shea Levy <shea@shealevy.com>
* | | | Fix extra kernelDev referenceShea Levy2014-01-05
| | | | | | | | | | | | | | | | Signed-off-by: Shea Levy <shea@shealevy.com>
* | | | Merge branch 'merge-kernel-builds' into upstream-masterShea Levy2014-01-05
|\ \ \ \ | |/ / / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a second attempt at unifying the generic and manual-config kernel builds (see #412 for the last time). The set of working kernel packages is a superset of those that work on master, and as the only objection last time was the size of the $dev closure and now both $out and $dev combined are 20M smaller than $out on master (see message for ac2035287fbec30d92165fd3839d1bf71b8edd47), this should be unobjectionable. Signed-off-by: Shea Levy <shea@shealevy.com>
| * | | Update and fix kernel packages to new kernel buildShea Levy2014-01-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In most cases, this just meant changing kernelDev (now removed from linuxPackagesFor) to kernel.dev. Some packages needed more work (though whether that was because of my changes or because they were already broken, I'm not sure). Specifics: * psmouse-alps builds on 3.4 but not 3.10, as noted in the comments that were already there * blcr builds on 3.4 but not 3.10, as noted in comments that were already there * open-iscsi, ati-drivers, wis-go7007, and openafsClient don't build on 3.4 or 3.10 on this branch or on master, so they're marked broken * A version-specific kernelHeaders package was added The following packages were removed: * atheros/madwifi is superceded by official ath*k modules * aufs is no longer used by any of our kernels * broadcom-sta v6 (which was already packaged) replaces broadcom-sta * exmap has not been updated since 2011 and doesn't build * iscis-target has not been updated since 2010 and doesn't build * iwlwifi is part of mainline now and doesn't build * nivida-x11-legacy-96 hasn't been updated since 2008 and doesn't build Everything not specifically mentioned above builds successfully on 3.10. I haven't yet tested on 3.4, but will before opening a pull request. Signed-off-by: Shea Levy <shea@shealevy.com>
* | | | networkmanager: register PPTP serviceThomas Tuegel2014-01-02
| |/ / |/| |
* | | network-interfaces: Add the ability to create bond devicesWilliam A. Kennington III2013-12-31
|/ / | | | | | | | | | | | | | | This patch adds support for the creations of new bond devices, aggregate pipes of physical devices for extra throughput or failover. Additionally, add better correction at the startup of a bridge of vlan interface (delete old, stale interfaces).
* | Merge pull request #1430 from wkennington/mtuMathijs Kwik2013-12-30
|\ \ | | | | | | network-interfaces: Add mtu setting support
| * | network-interfaces: Add mtu setting supportWilliam A. Kennington III2013-12-30
| | | | | | | | | | | | | | | Adds a setting to the network interface configuration for changing the mtu for each specified interface.
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-08-05 08:03:44 +0000