nixos/pam: add pam_nologin.so by default #53989
Conversation
Some NixOS services already override the default PAM config and add pam_nologin.so. This change adds it to the default config, so that it applies to services like sshd and login too. (It also applies to things like sudo, which might be surprising, but I'm having a hard time justifying "forking" the default config for sshd etc. just because of this.) pam_nologin.so prevents non-root user login if the file /etc/nologin or /run/nologin exists. (The file can also contain a message that will be shown to the user before getting access denied.)
|
Seems only display managers add it, and there are a lot of use cases which aren't graphical. Do other distros add nologin by default? |
|
I checked Ubuntu, and the answer is no. pam_nologin.so is neither part of the /etc/pam.d/common-* files, nor is it part of all services. But it is part of /etc/pam.d/{login,ssh,gdm-*,...}. For example, /etc/pam.d/runuser does not even include common-auth. |
|
I wrote this because I was having trouble merging the default PAM config with small custom config. It appears one can do lib.mkDefault for merging, so I have a local workaround now. But I'm having trouble combining mkBefore with mkDefault, so I'm not confident my workaround is a good one, seeing as pam_nologin should be placed early in the config (not something to submit in a PR). "man pam_nologin" says "all login methods should be secured by it". I initially thought that meant all PAM services, but apparently there are non-login services. Evidence: I see /etc/pam.d/user{add,del,mod} and Ubuntu doesn't put pam_nologin.so in their common-auth. I'm a PAM newbie, obviously :-) |
Motivation for this change
Some NixOS services already override the default PAM config and add
pam_nologin.so. This change adds it to the default config, so that it
applies to services like sshd and login too. (It also applies to things
like sudo, which might be surprising, but I'm having a hard time
justifying "forking" the default config for sshd etc. just because of
this.)
pam_nologin.so prevents non-root user login if the file /etc/nologin or
/run/nologin exists. (The file can also contain a message that will be
shown to the user before getting access denied.)
Things done
sandboxinnix.confon non-NixOS)nix-shell -p nox --run "nox-review wip"./result/bin/)nix path-info -Sbefore and after)