pyrox.dev
1# Configuration for the pwdutils suite of tools: passwd, useradd, etc.
2
3{ config, lib, utils, pkgs, ... }:
4
5with lib;
6
7let
8
9 /*
10 There are three different sources for user/group id ranges, each of which gets
11 used by different programs:
12 - The login.defs file, used by the useradd, groupadd and newusers commands
13 - The update-users-groups.pl file, used by NixOS in the activation phase to
14 decide on which ids to use for declaratively defined users without a static
15 id
16 - Systemd compile time options -Dsystem-uid-max= and -Dsystem-gid-max=, used
17 by systemd for features like ConditionUser=@system and systemd-sysusers
18 */
19 loginDefs =
20 ''
21 DEFAULT_HOME yes
22
23 SYS_UID_MIN 400
24 SYS_UID_MAX 999
25 UID_MIN 1000
26 UID_MAX 29999
27
28 SYS_GID_MIN 400
29 SYS_GID_MAX 999
30 GID_MIN 1000
31 GID_MAX 29999
32
33 TTYGROUP tty
34 TTYPERM 0620
35
36 # Ensure privacy for newly created home directories.
37 UMASK 077
38
39 # Uncomment this and install chfn SUID to allow non-root
40 # users to change their account GECOS information.
41 # This should be made configurable.
42 #CHFN_RESTRICT frwh
43
44 '';
45
46in
47
48{
49
50 ###### interface
51
52 options = {
53
54 users.defaultUserShell = lib.mkOption {
55 description = ''
56 This option defines the default shell assigned to user
57 accounts. This can be either a full system path or a shell package.
58
59 This must not be a store path, since the path is
60 used outside the store (in particular in /etc/passwd).
61 '';
62 example = literalExample "pkgs.zsh";
63 type = types.either types.path types.shellPackage;
64 };
65
66 };
67
68
69 ###### implementation
70
71 config = {
72
73 environment.systemPackages =
74 lib.optional config.users.mutableUsers pkgs.shadow ++
75 lib.optional (types.shellPackage.check config.users.defaultUserShell)
76 config.users.defaultUserShell;
77
78 environment.etc =
79 { # /etc/login.defs: global configuration for pwdutils. You
80 # cannot login without it!
81 "login.defs".source = pkgs.writeText "login.defs" loginDefs;
82
83 # /etc/default/useradd: configuration for useradd.
84 "default/useradd".source = pkgs.writeText "useradd"
85 ''
86 GROUP=100
87 HOME=/home
88 SHELL=${utils.toShellPath config.users.defaultUserShell}
89 '';
90 };
91
92 security.pam.services =
93 { chsh = { rootOK = true; };
94 chfn = { rootOK = true; };
95 su = { rootOK = true; forwardXAuth = true; logFailures = true; };
96 passwd = {};
97 # Note: useradd, groupadd etc. aren't setuid root, so it
98 # doesn't really matter what the PAM config says as long as it
99 # lets root in.
100 useradd = { rootOK = true; };
101 usermod = { rootOK = true; };
102 userdel = { rootOK = true; };
103 groupadd = { rootOK = true; };
104 groupmod = { rootOK = true; };
105 groupmems = { rootOK = true; };
106 groupdel = { rootOK = true; };
107 login = { startSession = true; allowNullPassword = true; showMotd = true; updateWtmp = true; };
108 chpasswd = { rootOK = true; };
109 };
110
111 security.wrappers = {
112 su.source = "${pkgs.shadow.su}/bin/su";
113 sg.source = "${pkgs.shadow.out}/bin/sg";
114 newgrp.source = "${pkgs.shadow.out}/bin/newgrp";
115 newuidmap.source = "${pkgs.shadow.out}/bin/newuidmap";
116 newgidmap.source = "${pkgs.shadow.out}/bin/newgidmap";
117 } // lib.optionalAttrs config.users.mutableUsers {
118 chsh.source = "${pkgs.shadow.out}/bin/chsh";
119 passwd.source = "${pkgs.shadow.out}/bin/passwd";
120 };
121 };
122}