Commit graph

234 commits

Author SHA1 Message Date
Rickard Nilsson 65c1c6525b network-manager: Big overhaul
* Add group 'networkmanager' and implement polkit configuration
    that allows users in this group to make persistent, system-wide
    changes to NetworkManager settings.

  * Add support for ModemManager. 3G modems should work out of the
    box now (it does for me...). This introduces a dependency on
    pkgs.modemmanager.

  * Write NetworkManger config file to Nix store, and let the
    daemon use it from there.
2012-09-27 09:26:07 +02:00
Eelco Dolstra d4af6edd5e firewall.nix: Allow specifying trusted network interfaces
Trusted network interfaces (such as "lo") will accept any incoming
traffic.
2012-09-20 17:51:44 -04:00
Eelco Dolstra d12dd340b6 firewall.nix: Respect networking.enableIPv6 = false
Reported-by: Pablo Costa <modulistic@gmail.com>
2012-09-18 17:20:46 -04:00
Ludovic Courtès f7530dc5ee avahi: Never set host-name' to the empty string in avahi-daemon.conf'. 2012-09-07 10:58:53 +02:00
Mathijs Kwik 52fd5ea6ca gogoclient: setup config and dirs on service start, not on system activation 2012-07-31 20:07:05 +02:00
Peter Simons e988324534 Use a dedicated user ('named') for BIND instead of running the daemon as super user. 2012-07-27 00:08:41 +02:00
Eelco Dolstra 73532c3855 Global replace /var/run/current-system -> /run/current-system 2012-07-16 11:34:21 -04:00
Eelco Dolstra 57d74e6f4f openssh.authorizedKeys.keyFiles: allow multiple keys
Ugly hack to get around the error "a string that refers to a store
path cannot be appended to a path".  The underlying problem is that
you cannot do

  "${./file1} ${./file2}"

but you can do

  " ${./file1} ${./file2}"

Obviously we should allow the first case as well.
2012-07-13 17:59:03 -04:00
Eelco Dolstra 7e77dae458 sshd.nix: Create ~/.ssh/authorized_keys with the right ownership 2012-07-13 11:48:47 -04:00
Peter Simons f22dbd5e05 modules/services/networking/wpa_supplicant.nix: strip trailing whitespace 2012-06-29 11:53:16 +02:00
Peter Simons 61b8ee9029 modules/services/networking/wpa_supplicant.nix: document that interface auto-detection doesn't work on Linux 3.4.x 2012-06-29 11:53:16 +02:00
Lluís Batlle i Rossell 9b833aafb9 Fix prayer so it does not start a server at port 80.
svn path=/nixos/trunk/; revision=34420
2012-06-10 14:51:43 +00:00
Lluís Batlle i Rossell 78333e5d84 Add a 'named' option to run only for ipv4.
I remember the 'named' log was giving annoying messages on systems not ipv6
capable (I can't recall if lacking the kernel ipv6 code or unconfigured ipv6
addresses).


svn path=/nixos/trunk/; revision=34419
2012-06-10 14:50:44 +00:00
Eelco Dolstra 87e06b97a3 * Don't include the hostname in option default values. Default values
are included in the manual, so this causes a different manual to be
  built for each machine.
* Clean up indentation of cntlm module.

svn path=/nixos/trunk/; revision=34387
2012-06-08 14:29:31 +00:00
Rickard Nilsson 35f9502a27 Added option for specifying the path to the private key file sshd should use.
svn path=/nixos/trunk/; revision=34039
2012-05-09 22:13:53 +00:00
Rickard Nilsson 658ea20e7f Added option for specifying system-wide known hosts file for OpenSSH.
svn path=/nixos/trunk/; revision=34038
2012-05-09 22:11:07 +00:00
Peter Simons 7a69733704 Added 'networking.dhcpcd.denyInterfaces' to extend the list of network
interfaces black-listed for dhcpcd via configuration.nix. I use this option to
disable DHCP for "veth*" interfaces, which are created by LXC for use inside of
virtual machines.

svn path=/nixos/trunk/; revision=34018
2012-05-08 11:46:01 +00:00
Eelco Dolstra be189991e0 * Revert r33928: veth* can also be a bridged interface requiring dhcp.
See e.g. https://nixos.org/repos/nix/configurations/trunk/tud/stan.nix

  So we need a better solution for this...

svn path=/nixos/trunk/; revision=33957
2012-04-30 17:46:11 +00:00
Peter Simons 8b841505ff modules/services/networking/{dhclient,dhcpcd}.nix: ignore virtual veth* devices created by LXC/cgroups
svn path=/nixos/trunk/; revision=33928
2012-04-26 12:31:33 +00:00
Peter Simons 86ba0c52b3 modules/services/networking/ssh/sshd.nix: stripped trailing whitespace
svn path=/nixos/trunk/; revision=33926
2012-04-26 08:13:24 +00:00
Peter Simons ee2fcb645b modules/services/networking/ssh/sshd.nix: don't write debug output to /tmp/log
svn path=/nixos/trunk/; revision=33925
2012-04-26 08:13:21 +00:00
Eelco Dolstra e6fd0fa893 * Cleanup.
svn path=/nixos/trunk/; revision=33921
2012-04-25 15:44:47 +00:00
Eelco Dolstra 43215ff80f * In the implementation of the ‘authorizedKeys’, don't delete all
lines below a certain marker.  This is undesirable because commands
  like "ssh-copy-id" add keys to the end of the file.  Instead mark
  all automatically added lines individually.

svn path=/nixos/trunk/; revision=33918
2012-04-25 14:14:20 +00:00
Arie Middelkoop 298e0e1829 Some additional xinetd settings.
svn path=/nixos/trunk/; revision=33836
2012-04-19 08:28:54 +00:00
Eelco Dolstra a7af5588b6 * Drop ugly reference to var/run/current-system/sw/sbin/wpa_cli, and
make it conditional.

svn path=/nixos/trunk/; revision=33717
2012-04-10 12:07:30 +00:00
Mathijs Kwik 9a91181be9 damn you shell syntax! :)
svn path=/nixos/trunk/; revision=33603
2012-04-05 08:20:43 +00:00
Lluís Batlle i Rossell 56d9e60bb7 Making bind start on started network-interfaces. It wasn't starting ever.
svn path=/nixos/trunk/; revision=33542
2012-04-02 18:28:42 +00:00
Mathijs Kwik a1e86494d0 made challenge-response authentication method configurable for openssh
challenge-response is an authentication method that does not need the
plain text password to be emitted over the (encrypted) connection.
This is nice if you don't fully trust the server.

It is enabled (upstream) by default.

To the end user, it still looks like normal password authentication,
but instead of sending it, it is used to hash some challenge.

This means that if you don't want passwords to be used ever at all,
and just stick to public key authentication, you probably want to
disable this option too.

svn path=/nixos/trunk/; revision=33513
2012-04-01 10:54:17 +00:00
Mathijs Kwik e216ce07df dhcpcd: ip-up and ip-down emit more info (like wifi access point)
useful to only start certain services (like vpn) on certain networks

svn path=/nixos/trunk/; revision=33512
2012-04-01 10:54:15 +00:00
Mathijs Kwik 7d4fd69b5f dhcpcd: wifi disconnect should also generate ip-down
svn path=/nixos/trunk/; revision=33511
2012-04-01 10:54:13 +00:00
Mathijs Kwik 7ba690add6 optionally allow normal users to control wpa_supplicant through
wpa_gui or wpa_cli.

Comes with a default wpa_supplicant.conf, which gets updated through
aforementioned utilities.

svn path=/nixos/trunk/; revision=33510
2012-04-01 10:54:10 +00:00
Mathijs Kwik de5b437004 assertions '.msg' doesn't exist => .message
svn path=/nixos/trunk/; revision=33508
2012-04-01 10:54:06 +00:00
Mathijs Kwik f31fefdfd9 splitted ssh/sshd X11 forwarding logic. Backward compatible change.
You can now set the forwardX11 config option for the ssh client and server separately.

For server, the option means "allow clients to request X11 forwarding".
For client, the option means "request X11 forwarding by default on all connections".

I don't think it made sense to couple them. I might not even run the server on some machines.
Also, I ssh to a lot of machines, and rarely want X11 forwarding. The times I want it,
I use the -X/-Y option, or set it in my ~/.ssh/config.

I also decoupled the 'XAuthLocation' logic from forwardX11.
For my case where ssh client doesn't want forwarding by default, it still wants to set the path for the cases I do need it.

As this flag is the one that pulls in X11 dependencies, I changed the minimal profile and the no-x-libs config to check that instead now.

svn path=/nixos/trunk/; revision=33407
2012-03-25 15:42:05 +00:00
Eelco Dolstra 326891443c * dhcpcd: Don't use the "persistent" option. With it, dhcpcd won't
delete routes and addresses when it quits.  This causes those routes
  and addresses to stick around forever, since dhcpcd won't delete
  them when it runs next (even if it acquires a new lease on the same
  interface).  This is bad; in particular the stale (default) routes
  can break networking.

  The downside to removing "persistent" is that you should never ever
  do "stop dhcpcd" on a remote machine configured by dhcpcd.

svn path=/nixos/trunk/; revision=33388
2012-03-23 21:00:32 +00:00
Eelco Dolstra 89a21f7a7d * GIDs are supposed to match UIDs.
svn path=/nixos/trunk/; revision=33346
2012-03-22 10:11:15 +00:00
Lluís Batlle i Rossell 5ddae4a83a Changing portmap by rpcbind on nfs services.
That could make rpc.statd work.

Patch by Rickard Nilsson.

I'm not sure we need that netconfig file in etc.


svn path=/nixos/trunk/; revision=33342
2012-03-21 20:37:37 +00:00
Eelco Dolstra ee6c9bb998 * Provide two utility functions in Upstart jobs: "ensure JOBNAME"
starts the given job and waits until it's running; "stop_check"
  checks that the current job hasn't been asked to stop.

svn path=/nixos/trunk/; revision=33214
2012-03-17 19:12:33 +00:00
Eelco Dolstra 07df536c42 * Fix comment.
svn path=/nixos/trunk/; revision=33213
2012-03-17 18:01:42 +00:00
Eelco Dolstra 53847ef665 * Don't use the non-existent "never" condition in stopOn.
svn path=/nixos/trunk/; revision=33212
2012-03-17 18:00:20 +00:00
Eelco Dolstra dd693fdc5e * Revert unintended commit.
svn path=/nixos/trunk/; revision=33209
2012-03-17 17:31:08 +00:00
Eelco Dolstra 573877c1ac * Use boot.kernelModules everywhere instead of explicit calls to
modprobe.
* Move the implementation of boot.kernelModules from the udev job to
  the activation script.  This prevents races with the udev job.
* Drop references to the "capability" kernel module, which no longer
  exists.

svn path=/nixos/trunk/; revision=33208
2012-03-17 17:26:17 +00:00
Eelco Dolstra 646d67465c * Upstart stupidly doesn't kill post-start scripts if we do "stop
JOB", but it does kill the job's main process.  So if the post-start
  script if waiting for the job's main process to reach some state, it
  may hang forever.  Thus, the post-start script should monitor
  whether its job has been requested to stop and exit in that case.

svn path=/nixos/trunk/; revision=33176
2012-03-16 21:24:51 +00:00
Eelco Dolstra a395e46192 * Fix the NFS Upstart dependencies. Mountd is now started before
nfsd, as suggested by the nfs-utils README.

  Also, rather than relying on Upstart events (which have all sorts of
  problems, especially if you have jobs that have multiple
  dependencies), we know just let jobs start their on prerequisites.
  That is, nfsd starts mountd in its preStart script; mountd starts
  statd; statd starts portmap.  Likewise, mountall starts statd to
  ensure that it can mount NFS filesystems.  This means that doing
  something like "start nfsd" from the command line will Do The Right
  Thing and start the dependencies of nfsd.

svn path=/nixos/trunk/; revision=33172
2012-03-16 20:10:14 +00:00
Eelco Dolstra 823471a100 * portmap: add a postStart action that ensures that portmap is
actually listening.  Otherwise we have a race condition during boot
  where statd's start can be delayed, causing NFSv3 mounting to fail.

svn path=/nixos/trunk/; revision=33171
2012-03-16 19:49:47 +00:00
Eelco Dolstra 5a36c25e9f * nfsd and statd do not need to be stopped when portmap stops.
svn path=/nixos/trunk/; revision=33167
2012-03-16 17:43:18 +00:00
Yury G. Kudryashov 9bb1132525 NM: add IFACE to ip-up
svn path=/nixos/trunk/; revision=33107
2012-03-15 13:51:17 +00:00
Yury G. Kudryashov 339d5b2b48 Add NetworkManager module
It works but it doesn't respect ignoredInterfaces etc.
Probably I forgotten to create some directories (all of them exist on my
laptop). Feel free to fix this module.

svn path=/nixos/trunk/; revision=33097
2012-03-15 07:19:17 +00:00
Ludovic Courtès 5fad465261 BitlBee: Add `job.name'; cleanup white space.
svn path=/nixos/trunk/; revision=33012
2012-03-12 13:10:13 +00:00
Mathijs Kwik f68c95d1fe completely removed gw6c. use gogoclient
svn path=/nixos/trunk/; revision=32990
2012-03-11 14:36:39 +00:00
Mathijs Kwik 7d964498b8 changed the way networking-providers plug themselves before "networking"
svn path=/nixos/trunk/; revision=32781
2012-03-04 18:44:47 +00:00