pyrox.dev
1# Configuration for the pwdutils suite of tools: passwd, useradd, etc.
2
3{ config, lib, utils, pkgs, ... }:
4
5with lib;
6
7let
8
9 loginDefs =
10 ''
11 DEFAULT_HOME yes
12
13 SYS_UID_MIN 400
14 SYS_UID_MAX 499
15 UID_MIN 1000
16 UID_MAX 29999
17
18 SYS_GID_MIN 400
19 SYS_GID_MAX 499
20 GID_MIN 1000
21 GID_MAX 29999
22
23 TTYGROUP tty
24 TTYPERM 0620
25
26 # Ensure privacy for newly created home directories.
27 UMASK 077
28
29 # Uncomment this to allow non-root users to change their account
30 #information. This should be made configurable.
31 #CHFN_RESTRICT frwh
32
33 '';
34
35in
36
37{
38
39 ###### interface
40
41 options = {
42
43 users.defaultUserShell = lib.mkOption {
44 description = ''
45 This option defines the default shell assigned to user
46 accounts. This can be either a full system path or a shell package.
47
48 This must not be a store path, since the path is
49 used outside the store (in particular in /etc/passwd).
50 '';
51 example = literalExample "pkgs.zsh";
52 type = types.either types.path types.shellPackage;
53 };
54
55 };
56
57
58 ###### implementation
59
60 config = {
61
62 environment.systemPackages =
63 lib.optional config.users.mutableUsers pkgs.shadow ++
64 lib.optional (types.shellPackage.check config.users.defaultUserShell)
65 config.users.defaultUserShell;
66
67 environment.etc =
68 [ { # /etc/login.defs: global configuration for pwdutils. You
69 # cannot login without it!
70 source = pkgs.writeText "login.defs" loginDefs;
71 target = "login.defs";
72 }
73
74 { # /etc/default/useradd: configuration for useradd.
75 source = pkgs.writeText "useradd"
76 ''
77 GROUP=100
78 HOME=/home
79 SHELL=${utils.toShellPath config.users.defaultUserShell}
80 '';
81 target = "default/useradd";
82 }
83 ];
84
85 security.pam.services =
86 { chsh = { rootOK = true; };
87 chfn = { rootOK = true; };
88 su = { rootOK = true; forwardXAuth = true; logFailures = true; };
89 passwd = {};
90 # Note: useradd, groupadd etc. aren't setuid root, so it
91 # doesn't really matter what the PAM config says as long as it
92 # lets root in.
93 useradd = { rootOK = true; };
94 usermod = { rootOK = true; };
95 userdel = { rootOK = true; };
96 groupadd = { rootOK = true; };
97 groupmod = { rootOK = true; };
98 groupmems = { rootOK = true; };
99 groupdel = { rootOK = true; };
100 login = { startSession = true; allowNullPassword = true; showMotd = true; updateWtmp = true; };
101 chpasswd = { rootOK = true; };
102 };
103
104 security.wrappers = {
105 su.source = "${pkgs.shadow.su}/bin/su";
106 chfn.source = "${pkgs.shadow.out}/bin/chfn";
107 newuidmap.source = "${pkgs.shadow.out}/bin/newuidmap";
108 newgidmap.source = "${pkgs.shadow.out}/bin/newgidmap";
109 } // (if config.users.mutableUsers then {
110 passwd.source = "${pkgs.shadow.out}/bin/passwd";
111 sg.source = "${pkgs.shadow.out}/bin/sg";
112 newgrp.source = "${pkgs.shadow.out}/bin/newgrp";
113 } else {});
114 };
115}