···
# Configuration for the pwdutils suite of tools: passwd, useradd, etc.
{ config, lib, utils, pkgs, ... }:
+
cfg = config.security.loginDefs;
+
options = with types; {
+
package = mkPackageOptionMD pkgs "shadow" { };
+
chfnRestrict = mkOption {
+
Use chfn SUID to allow non-root users to change their account GECOS information.
+
Config options for the /etc/login.defs file, that defines
+
the site-specific configuration for the shadow password suite.
+
See login.defs(5) man page for available options.
+
freeformType = (pkgs.formats.keyValue { }).type;
+
/* There are three different sources for user/group id ranges, each of which gets
+
used by different programs:
+
- The login.defs file, used by the useradd, groupadd and newusers commands
+
- The update-users-groups.pl file, used by NixOS in the activation phase to
+
decide on which ids to use for declaratively defined users without a static
+
- Systemd compile time options -Dsystem-uid-max= and -Dsystem-gid-max=, used
+
by systemd for features like ConditionUser=@system and systemd-sysusers
+
DEFAULT_HOME = mkOption {
+
description = mdDoc "Indicate if login is allowed if we can't cd to the home directory.";
+
type = enum [ "yes" "no" ];
+
ENCRYPT_METHOD = mkOption {
+
description = mdDoc "This defines the system default encryption algorithm for encrypting passwords.";
+
# The default crypt() method, keep in sync with the PAM default
+
type = enum [ "YESCRYPT" "SHA512" "SHA256" "MD5" "DES"];
+
SYS_UID_MIN = mkOption {
+
description = mdDoc "Range of user IDs used for the creation of system users by useradd or newusers.";
+
SYS_UID_MAX = mkOption {
+
description = mdDoc "Range of user IDs used for the creation of system users by useradd or newusers.";
+
description = mdDoc "Range of user IDs used for the creation of regular users by useradd or newusers.";
+
description = mdDoc "Range of user IDs used for the creation of regular users by useradd or newusers.";
+
SYS_GID_MIN = mkOption {
+
description = mdDoc "Range of group IDs used for the creation of system groups by useradd, groupadd, or newusers";
+
SYS_GID_MAX = mkOption {
+
description = mdDoc "Range of group IDs used for the creation of system groups by useradd, groupadd, or newusers";
+
description = mdDoc "Range of group IDs used for the creation of regular groups by useradd, groupadd, or newusers.";
+
description = mdDoc "Range of group IDs used for the creation of regular groups by useradd, groupadd, or newusers.";
+
The terminal permissions: the login tty will be owned by the TTYGROUP group,
+
and the permissions will be set to TTYPERM'';
+
The terminal permissions: the login tty will be owned by the TTYGROUP group,
+
and the permissions will be set to TTYPERM'';
+
# Ensure privacy for newly created home directories.
+
description = mdDoc "The file mode creation mask is initialized to this value.";
+
users.defaultUserShell = mkOption {
This option defines the default shell assigned to user
accounts. This can be either a full system path or a shell package.
···
used outside the store (in particular in /etc/passwd).
example = literalExpression "pkgs.zsh";
+
type = either path shellPackage;
+
assertion = cfg.settings.SYS_UID_MIN <= cfg.settings.SYS_UID_MAX;
+
message = "SYS_UID_MIN must be less than or equal to SYS_UID_MAX";
+
assertion = cfg.settings.UID_MIN <= cfg.settings.UID_MAX;
+
message = "UID_MIN must be less than or equal to UID_MAX";
+
assertion = cfg.settings.SYS_GID_MIN <= cfg.settings.SYS_GID_MAX;
+
message = "SYS_GID_MIN must be less than or equal to SYS_GID_MAX";
+
assertion = cfg.settings.GID_MIN <= cfg.settings.GID_MAX;
+
message = "GID_MIN must be less than or equal to GID_MAX";
+
security.loginDefs.settings.CHFN_RESTRICT =
+
mkIf (cfg.chfnRestrict != null) cfg.chfnRestrict;
+
environment.systemPackages = optional config.users.mutableUsers cfg.package
+
++ optional (types.shellPackage.check config.users.defaultUserShell) config.users.defaultUserShell
+
++ optional (cfg.chfnRestrict != null) pkgs.util-linux;
+
# Create custom toKeyValue generator
+
# see https://man7.org/linux/man-pages/man5/login.defs.5.html for config specification
+
toKeyValue = generators.toKeyValue {
+
mkKeyValue = generators.mkKeyValueDefault { } " ";
+
# /etc/login.defs: global configuration for pwdutils.
+
# You cannot login without it!
+
"login.defs".source = pkgs.writeText "login.defs" (toKeyValue cfg.settings);
# /etc/default/useradd: configuration for useradd.
+
"default/useradd".source = pkgs.writeText "useradd" ''
+
SHELL=${utils.toShellPath config.users.defaultUserShell}
+
security.pam.services = {
+
chsh = { rootOK = true; };
+
chfn = { rootOK = true; };
+
# Note: useradd, groupadd etc. aren't setuid root, so it
+
# doesn't really matter what the PAM config says as long as it
+
groupadd.rootOK = true;
+
groupmod.rootOK = true;
+
groupmems.rootOK = true;
+
groupdel.rootOK = true;
+
allowNullPassword = true;
+
chpasswd = { rootOK = true; };
+
mkSetuidRoot = source: {
+
su = mkSetuidRoot "${cfg.package.su}/bin/su";
+
sg = mkSetuidRoot "${cfg.package.out}/bin/sg";
+
newgrp = mkSetuidRoot "${cfg.package.out}/bin/newgrp";
+
newuidmap = mkSetuidRoot "${cfg.package.out}/bin/newuidmap";
+
newgidmap = mkSetuidRoot "${cfg.package.out}/bin/newgidmap";
+
// optionalAttrs config.users.mutableUsers {
+
chsh = mkSetuidRoot "${cfg.package.out}/bin/chsh";
+
passwd = mkSetuidRoot "${cfg.package.out}/bin/passwd";
pyrox.dev