From 096e66a8ad3989d230a7dfcc4aad7297d028d769 Mon Sep 17 00:00:00 2001 From: Scott Dier Date: Wed, 13 Feb 2019 01:12:51 +0000 Subject: [PATCH 1/4] nixos/security: Add duo-unix support to pam. Also whitespace cleanup of surrounding code. --- nixos/modules/security/pam.nix | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 206b529ed680..03d2f899f2ab 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -131,6 +131,18 @@ let ''; }; + duoSecurity = { + enable = mkOption { + default = false; + type = types.bool; + description = '' + If set, use the Duo Security pam module + pam_duo for authentication. Requires + configuration of options. + ''; + }; + }; + startSession = mkOption { default = false; type = types.bool; @@ -340,7 +352,8 @@ let || cfg.pamMount || cfg.enableKwallet || cfg.enableGnomeKeyring - || cfg.googleAuthenticator.enable)) '' + || cfg.googleAuthenticator.enable + || cfg.duoSecurity.enable)) '' auth required pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth ${optionalString config.security.pam.enableEcryptfs "auth optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"} @@ -350,9 +363,11 @@ let ("auth optional ${pkgs.plasma5.kwallet-pam}/lib/security/pam_kwallet5.so" + " kwalletd=${pkgs.libsForQt5.kwallet.bin}/bin/kwalletd5")} ${optionalString cfg.enableGnomeKeyring - ("auth optional ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so")} + "auth optional ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so"} ${optionalString cfg.googleAuthenticator.enable - "auth required ${pkgs.googleAuthenticator}/lib/security/pam_google_authenticator.so no_increment_hotp"} + "auth required ${pkgs.googleAuthenticator}/lib/security/pam_google_authenticator.so no_increment_hotp"} + ${optionalString cfg.duoSecurity.enable + "auth required ${pkgs.duo-unix}/lib/security/pam_duo.so"} '') + '' ${optionalString cfg.unixAuth "auth sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth try_first_pass"} From 4e9ac79ef53a2da40a3a30c956925d25061d5cd0 Mon Sep 17 00:00:00 2001 From: Scott Dier Date: Sun, 24 Feb 2019 14:48:44 +0000 Subject: [PATCH 2/4] nixos/security: Allow configuration of pam for duosec. --- nixos/modules/security/duosec.nix | 6 ------ 1 file changed, 6 deletions(-) diff --git a/nixos/modules/security/duosec.nix b/nixos/modules/security/duosec.nix index df6108dede7c..630a10282719 100644 --- a/nixos/modules/security/duosec.nix +++ b/nixos/modules/security/duosec.nix @@ -180,12 +180,6 @@ in }; config = mkIf (cfg.ssh.enable || cfg.pam.enable) { - assertions = - [ { assertion = !cfg.pam.enable; - message = "PAM support is currently not implemented."; - } - ]; - environment.systemPackages = [ pkgs.duo-unix ]; security.wrappers.login_duo.source = "${pkgs.duo-unix.out}/bin/login_duo"; From a3273e85e3dda63cde87f46896525a595b468d71 Mon Sep 17 00:00:00 2001 From: Scott Dier Date: Wed, 13 Feb 2019 01:39:22 +0000 Subject: [PATCH 3/4] nixos/security: Fix pam configuration file generation. --- nixos/modules/security/duosec.nix | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/nixos/modules/security/duosec.nix b/nixos/modules/security/duosec.nix index 630a10282719..14bf118f2d84 100644 --- a/nixos/modules/security/duosec.nix +++ b/nixos/modules/security/duosec.nix @@ -7,7 +7,7 @@ let boolToStr = b: if b then "yes" else "no"; - configFile = '' + configFilePam = '' [duo] ikey=${cfg.ikey} skey=${cfg.skey} @@ -16,21 +16,24 @@ let failmode=${cfg.failmode} pushinfo=${boolToStr cfg.pushinfo} autopush=${boolToStr cfg.autopush} - motd=${boolToStr cfg.motd} prompts=${toString cfg.prompts} - accept_env_factor=${boolToStr cfg.acceptEnvFactor} fallback_local_ip=${boolToStr cfg.fallbackLocalIP} ''; + configFileLogin = configFilePam + '' + motd=${boolToStr cfg.motd} + accept_env_factor=${boolToStr cfg.acceptEnvFactor} + ''; + loginCfgFile = optional cfg.ssh.enable - { source = pkgs.writeText "login_duo.conf" configFile; + { source = pkgs.writeText "login_duo.conf" configFileLogin; mode = "0600"; user = "sshd"; target = "duo/login_duo.conf"; }; pamCfgFile = optional cfg.pam.enable - { source = pkgs.writeText "pam_duo.conf" configFile; + { source = pkgs.writeText "pam_duo.conf" configFilePam; mode = "0600"; user = "sshd"; target = "duo/pam_duo.conf"; From a11ad16bd7f1bd648ddad3bd5b9507b909472451 Mon Sep 17 00:00:00 2001 From: Scott Dier Date: Sun, 24 Feb 2019 22:47:19 +0000 Subject: [PATCH 4/4] nixos/security: Add release note for duosec pam support for 19.03. --- nixos/doc/manual/release-notes/rl-1903.xml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/nixos/doc/manual/release-notes/rl-1903.xml b/nixos/doc/manual/release-notes/rl-1903.xml index 0937a681d151..508a0882dd2a 100644 --- a/nixos/doc/manual/release-notes/rl-1903.xml +++ b/nixos/doc/manual/release-notes/rl-1903.xml @@ -53,6 +53,23 @@ + + + + + ./security/duosec.nix + + + + + The PAM module for Duo + Security has been enabled for use. One can configure it using + the options along with the + corresponding PAM option in + . + + +