diff options
| author | nicoo <nicoo@mur.at> | 2023-12-24 15:16:29 +0000 |
|---|---|---|
| committer | nicoo <nicoo@mur.at> | 2023-12-30 22:19:38 +0000 |
| commit | 607679c6d3ff1c18b28f9cc61356d0c4d95378f3 (patch) | |
| tree | df20d05b1ba965da17d622c60c7a193fd484cba7 /nixos | |
| parent | 3ff2ce71b8f848da4907df074f9a69d453657690 (diff) | |
nixos/pam: Assert that `authorizedKeysFiles` is non-empty when using `pam_ssh_agent_auth`
Diffstat (limited to 'nixos')
| -rw-r--r-- | nixos/doc/manual/release-notes/rl-2405.section.md | 3 | ||||
| -rw-r--r-- | nixos/modules/security/pam.nix | 7 |
2 files changed, 10 insertions, 0 deletions
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md index a1d26f6a12f72..85c2f52f6524d 100644 --- a/nixos/doc/manual/release-notes/rl-2405.section.md +++ b/nixos/doc/manual/release-notes/rl-2405.section.md @@ -87,6 +87,9 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m - `systemd.oomd.enableUserServices` is renamed to `systemd.oomd.enableUserSlices`. +- `security.pam.enableSSHAgentAuth` now requires `services.openssh.authorizedKeysFiles` to be non-empty, + which is the case when `services.openssh.enable` is true. Previously, `pam_ssh_agent_auth` silently failed to work. + ## Other Notable Changes {#sec-release-24.05-notable-changes} <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. --> diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index c99615d5a6362..2f777f874f23e 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -1456,6 +1456,13 @@ in `security.pam.zfs.enable` requires enabling ZFS (`boot.zfs.enabled` or `boot.zfs.enableUnstable`). ''; } + { + assertion = config.security.pam.enableSSHAgentAuth -> config.services.openssh.authorizedKeysFiles != []; + message = '' + `security.pam.enableSSHAgentAuth` requires `services.openssh.authorizedKeysFiles` to be a non-empty list. + Did you forget to set `services.openssh.enable` ? + ''; + } ]; environment.systemPackages = |