* On the CD or on a newly installed system, create the root account
with an empty password, rather than with a hashed empty password. The latter is a security risk, because it allows remote root logins if a user enables sshd before setting a proper root password. * Allow empty passwords for login and slim, but nothing else. svn path=/nixos/trunk/; revision=17833
This commit is contained in:
parent
77ec877a8c
commit
5dfaf565bf
|
@ -32,6 +32,14 @@ let
|
||||||
, # Whether to forward XAuth keys between users. Mostly useful
|
, # Whether to forward XAuth keys between users. Mostly useful
|
||||||
# for "su".
|
# for "su".
|
||||||
forwardXAuth ? false
|
forwardXAuth ? false
|
||||||
|
, # Whether to allow logging into accounts that have no password
|
||||||
|
# set (i.e., have an empty password field in /etc/passwd or
|
||||||
|
# /etc/group). This does not enable logging into disabled
|
||||||
|
# accounts (i.e., that have the password field set to `!').
|
||||||
|
# Note that regardless of what the pam_unix2 documentation says,
|
||||||
|
# accounts with hashed empty passwords are always allowed to log
|
||||||
|
# in.
|
||||||
|
allowNullPassword ? false
|
||||||
}:
|
}:
|
||||||
|
|
||||||
{ source = pkgs.writeText "${name}.pam"
|
{ source = pkgs.writeText "${name}.pam"
|
||||||
|
@ -49,7 +57,8 @@ let
|
||||||
"auth sufficient pam_rootok.so"}
|
"auth sufficient pam_rootok.so"}
|
||||||
${optionalString config.users.ldap.enable
|
${optionalString config.users.ldap.enable
|
||||||
"auth sufficient ${pam_ldap}/lib/security/pam_ldap.so"}
|
"auth sufficient ${pam_ldap}/lib/security/pam_ldap.so"}
|
||||||
auth sufficient ${pam_unix2}/lib/security/pam_unix2.so
|
auth sufficient ${pam_unix2}/lib/security/pam_unix2.so ${
|
||||||
|
optionalString allowNullPassword "nullok"}
|
||||||
auth required pam_deny.so
|
auth required pam_deny.so
|
||||||
|
|
||||||
# Password management.
|
# Password management.
|
||||||
|
@ -139,7 +148,7 @@ in
|
||||||
{ name = "useradd"; rootOK = true; }
|
{ name = "useradd"; rootOK = true; }
|
||||||
# Used by groupadd etc.
|
# Used by groupadd etc.
|
||||||
{ name = "shadow"; rootOK = true; }
|
{ name = "shadow"; rootOK = true; }
|
||||||
{ name = "login"; ownDevices = true; }
|
{ name = "login"; ownDevices = true; allowNullPassword = true; }
|
||||||
];
|
];
|
||||||
|
|
||||||
};
|
};
|
||||||
|
|
|
@ -104,7 +104,9 @@ in
|
||||||
execCmd = "${pkgs.slim}/bin/slim";
|
execCmd = "${pkgs.slim}/bin/slim";
|
||||||
};
|
};
|
||||||
|
|
||||||
security.pam.services = [ { name = "slim"; } ];
|
# Allow null passwords so that the user can login as root on the
|
||||||
|
# installation CD.
|
||||||
|
security.pam.services = [ { name = "slim"; allowNullPassword = true; } ];
|
||||||
|
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
|
@ -112,7 +112,6 @@ let
|
||||||
# (bootstrap problem!).
|
# (bootstrap problem!).
|
||||||
echo "root:x:0:0:System administrator:$rootHome:${config.users.defaultUserShell}" >> /etc/passwd
|
echo "root:x:0:0:System administrator:$rootHome:${config.users.defaultUserShell}" >> /etc/passwd
|
||||||
echo "root::::::::" >> /etc/shadow
|
echo "root::::::::" >> /etc/shadow
|
||||||
echo | passwd --stdin root
|
|
||||||
fi
|
fi
|
||||||
'' [
|
'' [
|
||||||
"defaultPath" # path to touch & passwd
|
"defaultPath" # path to touch & passwd
|
||||||
|
|
Loading…
Reference in a new issue