Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow duosec to be used in nixos as a pam module. #55792

Merged
merged 4 commits into from Feb 25, 2019

Conversation

@sdier
Copy link
Contributor

sdier commented Feb 14, 2019

A bit of no idea dog here -- I'm not entirely sure I understand the testing requirements yet for a nixos-only change. Please let me know if I misunderstood what to do.

Also, while I updated documentation in the nixos module, if additional documentation is needed please let me know where it should go.

Thanks!

Motivation for this change

Make it possible to configure duosec with pam for ssh. It allows folks to use ssh keys without a 2FA prompt, but passwords with a 2FA prompt.

Things done

I tested this by installing settings on a machine with ssh with this configuration:
services.openssh.enable = true;
security.duosec.pam.enable = true;
security.duosec.autopush = true;
security.pam.services.sshd.duoSecurity.enable = true;

I did manual tests:

  • Input of an invalid password does not prompt duo security.
  • Input of a valid password creates a prompt to duo.
  • Rejection of duo does not allow login.
  • Repeated invalid passwords do not allow login.
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Assured whether relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@sdier sdier force-pushed the sdier:fix/pam-update branch from 0b36e98 to 8008c74 Feb 14, 2019
@sdier sdier marked this pull request as ready for review Feb 14, 2019
@sdier sdier requested a review from Infinisil as a code owner Feb 14, 2019
@sdier sdier force-pushed the sdier:fix/pam-update branch from 8008c74 to 8ae9ed0 Feb 24, 2019
@sdier sdier force-pushed the sdier:fix/pam-update branch 2 times, most recently from d7ac2fc to a6d369c Feb 24, 2019
@flokli
flokli approved these changes Feb 24, 2019
Copy link
Contributor

flokli left a comment

LGTM. Could you add an item inside sec-release-19.03-new-services in nixos/doc/manual/release-notes/rl-1903.xml?

@sdier sdier force-pushed the sdier:fix/pam-update branch from a6d369c to a11ad16 Feb 24, 2019
@sdier

This comment has been minimized.

Copy link
Contributor Author

sdier commented Feb 24, 2019

@flokli I've added an item, PTAL -- I'm not sure if option hyperlinking supports linking in this form to support the '<name?>' syntax. I also caught a silly typo in the description I had updated in 096e66a earlier today and fixed it.

@Infinisil Infinisil merged commit 02db11d into NixOS:master Feb 25, 2019
10 checks passed
10 checks passed
grahamcofborg-eval ^.^!
Details
grahamcofborg-eval-check-maintainers matching changed paths to changed attrs...
Details
grahamcofborg-eval-check-meta config.nix: checkMeta = true
Details
grahamcofborg-eval-nixos-manual nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./nixos/release.nix -A manual
Details
grahamcofborg-eval-nixos-options nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./nixos/release.nix -A options
Details
grahamcofborg-eval-nixpkgs-manual nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./pkgs/top-level/release.nix -A manual
Details
grahamcofborg-eval-nixpkgs-tarball nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./pkgs/top-level/release.nix -A tarball
Details
grahamcofborg-eval-nixpkgs-unstable-jobset nix-instantiate --arg nixpkgs { outPath=./.; revCount=999999; shortRev="ofborg"; } ./pkgs/top-level/release.nix -A unstable
Details
grahamcofborg-eval-package-list nix-env -qa --json --file .
Details
grahamcofborg-eval-package-list-no-aliases nix-env -qa --json --file . --arg config { allowAliases = false; }
Details
@Infinisil

This comment has been minimized.

Copy link
Member

Infinisil commented Feb 25, 2019

Looking good :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

4 participants
You can’t perform that action at this time.