From d180bf3862e7c0c6ca7e5963f575483b69e7f04b Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Wed, 12 Dec 2018 14:03:13 +0100 Subject: [PATCH] security.pam: make pam_unix.so required, not sufficient Having pam_unix set to "sufficient" means early-succeeding account management group, as soon as pam_unix.so is succeeding. This is not sufficient. For example, nixos modules might install nss modules for user lookup, so pam_unix.so succeeds, and we end the stack successfully, even though other pam account modules might want to do more extensive checks. Other distros seem to set pam_unix.so to 'required', so if there are other pam modules in that management group, they get a chance to do some validation too. For SSSD, @PsyanticY already added a workaround knob in https://github.com/NixOS/nixpkgs/pull/31969, while stating this should be the default anyway. I did some thinking in what could break - after this commit, we require pam_unix to succeed, means we require `getent passwd $username` to return something. This is the case for all local users due to the passwd nss module, and also the case for all modules installing their nss module to nsswitch.conf - true for ldap (if not explicitly disabled) and sssd. I'm not so sure about krb5, cc @eqyiel for opinions. Is there some nss module loaded? Should the pam account module be placed before pam_unix? We don't drop the `security.pam.services..sssdStrictAccess` option, as it's also used some lines below to tweak error behaviour inside the pam sssd module itself (by changing it's 'control' field). This is also required to get admin login for Google OS Login working (#51566), as their pam_oslogin_admin accounts module takes care of sudo configuration. --- nixos/doc/manual/release-notes/rl-1903.xml | 16 ++++++++++++++++ nixos/modules/security/pam.nix | 2 +- 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/nixos/doc/manual/release-notes/rl-1903.xml b/nixos/doc/manual/release-notes/rl-1903.xml index 69e94fbccc5c..7bc887693376 100644 --- a/nixos/doc/manual/release-notes/rl-1903.xml +++ b/nixos/doc/manual/release-notes/rl-1903.xml @@ -318,6 +318,22 @@ case. + + + The pam_unix account module is now loaded with its + control field set to required instead of + sufficient, so that later pam account modules that + might do more extensive checks are being executed. + Previously, the whole account module verification was exited prematurely + in case a nss module provided the account name to + pam_unix. + The LDAP and SSSD NixOS modules already add their NSS modules when + enabled. In case your setup breaks due to some later pam account module + previosuly shadowed, or failing NSS lookups, please file a bug. You can + get back the old behaviour by manually setting + .text]]>. + + diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 926c6d77d3bb..812a71c68a30 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -269,7 +269,7 @@ let text = mkDefault ('' # Account management. - account ${if cfg.sssdStrictAccess then "required" else "sufficient"} pam_unix.so + account required pam_unix.so ${optionalString use_ldap "account sufficient ${pam_ldap}/lib/security/pam_ldap.so"} ${optionalString (config.services.sssd.enable && cfg.sssdStrictAccess==false)