pyrox.dev
1# This module provides configuration for the OATH PAM modules.
2
3{ config, lib, pkgs, ... }:
4
5with lib;
6
7{
8 options = {
9
10 security.pam.oath = {
11 enable = mkOption {
12 type = types.bool;
13 default = false;
14 description = ''
15 Enable the OATH (one-time password) PAM module.
16 '';
17 };
18
19 digits = mkOption {
20 type = types.enum [ 6 7 8 ];
21 default = 6;
22 description = ''
23 Specify the length of the one-time password in number of
24 digits.
25 '';
26 };
27
28 window = mkOption {
29 type = types.int;
30 default = 5;
31 description = ''
32 Specify the number of one-time passwords to check in order
33 to accommodate for situations where the system and the
34 client are slightly out of sync (iteration for HOTP or time
35 steps for TOTP).
36 '';
37 };
38
39 usersFile = mkOption {
40 type = types.path;
41 default = "/etc/users.oath";
42 description = ''
43 Set the path to file where the user's credentials are
44 stored. This file must not be world readable!
45 '';
46 };
47 };
48
49 };
50}