nixos-configs/devices/wim/modules/security.nix

87 lines
2.8 KiB
Nix
Raw Normal View History

2023-09-29 23:46:34 -04:00
{ pkgs, lib, ... }:
2023-06-19 01:36:50 -04:00
{
services.fprintd.enable = true;
2023-06-20 15:24:07 -04:00
# https://www.reddit.com/r/NixOS/comments/z7i83r/fingertip_tip_start_fprintd_at_boot_for_a_quick/
2023-06-19 01:36:50 -04:00
systemd.services.fprintd = {
wantedBy = [ "multi-user.target" ];
serviceConfig.Type = "simple";
};
services.logind.lidSwitch = "lock";
security.sudo.extraConfig = ''
2023-08-09 22:09:48 -04:00
Defaults timestamp_timeout=600
2023-06-19 01:36:50 -04:00
'';
security.pam.services = {
2023-09-29 23:46:34 -04:00
2023-06-19 01:36:50 -04:00
gtklock = {};
# all the changes in /etc/pam.d/*
sddm.text = lib.mkBefore ''
2023-06-19 01:36:50 -04:00
auth [success=1 new_authtok_reqd=1 default=ignore] pam_unix.so try_first_pass likeauth nullok
auth sufficient ${pkgs.fprintd}/lib/security/pam_fprintd.so
2023-06-19 01:36:50 -04:00
'';
sudo.text = ''
# Account management.
auth sufficient ${pkgs.pam-fprint-grosshack}/lib/security/pam_fprintd_grosshack.so
2023-06-19 01:36:50 -04:00
auth sufficient pam_unix.so try_first_pass nullok
account required pam_unix.so
# Authentication management.
auth required pam_deny.so
# Password management.
password sufficient pam_unix.so nullok yescrypt
# Session management.
session required pam_env.so conffile=/etc/pam/environment readenv=0
session required pam_unix.so
'';
login.text = ''
# Account management.
account required pam_unix.so
# Authentication management.
auth sufficient ${pkgs.pam-fprint-grosshack}/lib/security/pam_fprintd_grosshack.so
2023-06-19 01:36:50 -04:00
auth optional pam_unix.so nullok likeauth
auth optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so
2023-06-19 01:36:50 -04:00
auth sufficient pam_unix.so try_first_pass nullok
auth required pam_deny.so
# Password management.
password sufficient pam_unix.so nullok yescrypt
password optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so use_authtok
2023-06-19 01:36:50 -04:00
# Session management.
session required pam_env.so conffile=/etc/pam/environment readenv=0
session required pam_unix.so
session required pam_loginuid.so
session required ${pkgs.pam}/lib/security/pam_lastlog.so silent
session optional ${pkgs.systemd}/lib/security/pam_systemd.so
session optional ${pkgs.gnome.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start
2023-06-19 01:36:50 -04:00
'';
polkit-1.text = ''
# Account management.
account required pam_unix.so
# Authentication management.
auth sufficient ${pkgs.pam-fprint-grosshack}/lib/security/pam_fprintd_grosshack.so
2023-06-19 01:36:50 -04:00
auth sufficient pam_unix.so try_first_pass nullok
auth required pam_deny.so
# Password management.
password sufficient pam_unix.so nullok yescrypt
# Session management.
session required pam_env.so conffile=/etc/pam/environment readenv=0
session required pam_unix.so
'';
};
}