public
/
nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

pam: Add logFailures option for adding pam_tally to su

This commit is contained in:
Luca Bruno 2014-05-14 17:53:58 +02:00
parent 0138b81ed6
commit 1d5d7fdee2
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
nixos/modules/programs/shadow.nix
View File

@ -82,7 +82,7 @@ in
security.pam.services = security.pam.services =
{ chsh = { rootOK = true; }; { chsh = { rootOK = true; };
chfn = { rootOK = true; }; chfn = { rootOK = true; };
su = { rootOK = true; forwardXAuth = true; }; su = { rootOK = true; forwardXAuth = true; logFailures = true; };
passwd = {}; passwd = {};
# Note: useradd, groupadd etc. aren't setuid root, so it # Note: useradd, groupadd etc. aren't setuid root, so it
# doesn't really matter what the PAM config says as long as it # doesn't really matter what the PAM config says as long as it

8
nixos/modules/security/pam.nix
View File

@ -132,6 +132,12 @@ let
description = "Whether to update <filename>/var/log/wtmp</filename>."; description = "Whether to update <filename>/var/log/wtmp</filename>.";
}; };
logFailures = mkOption {
default = false;
type = types.bool;
description = "Whether to log authentication failures in <filename>/var/log/faillog</filename>.";
};
text = mkOption { text = mkOption {
type = types.nullOr types.lines; type = types.nullOr types.lines;
description = "Contents of the PAM service file."; description = "Contents of the PAM service file.";
@ -159,6 +165,8 @@ let
# Authentication management. # Authentication management.
${optionalString cfg.rootOK ${optionalString cfg.rootOK
"auth sufficient pam_rootok.so"} "auth sufficient pam_rootok.so"}
${optionalString cfg.logFailures
"auth required pam_tally.so"}
${optionalString (config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth) ${optionalString (config.security.pam.enableSSHAgentAuth && cfg.sshAgentAuth)
"auth sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=~/.ssh/authorized_keys:~/.ssh/authorized_keys2:/etc/ssh/authorized_keys.d/%u"} "auth sufficient ${pkgs.pam_ssh_agent_auth}/libexec/pam_ssh_agent_auth.so file=~/.ssh/authorized_keys:~/.ssh/authorized_keys2:/etc/ssh/authorized_keys.d/%u"}
${optionalString cfg.usbAuth ${optionalString cfg.usbAuth