A bit of no idea dog here -- I'm not entirely sure I understand the testing requirements yet for a nixos-only change. Please let me know if I misunderstood what to do.

Also, while I updated documentation in the nixos module, if additional documentation is needed please let me know where it should go.

Thanks!

Motivation for this change

Make it possible to configure duosec with pam for ssh. It allows folks to use ssh keys without a 2FA prompt, but passwords with a 2FA prompt.

Things done

I tested this by installing settings on a machine with ssh with this configuration:
services.openssh.enable = true;
security.duosec.pam.enable = true;
security.duosec.autopush = true;
security.pam.services.sshd.duoSecurity.enable = true;

I did manual tests:

• Input of an invalid password does not prompt duo security.
• Input of a valid password creates a prompt to duo.
• Rejection of duo does not allow login.
• Repeated invalid passwords do not allow login.

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Assured whether relevant documentation is up to date
• Fits CONTRIBUTING.md.