inventory, common: drop the example password hashes - #20
Open
QuentinCazier wants to merge 1 commit into
Open
QuentinCazier wants to merge 1 commit into
QuentinCazier wants to merge 1 commit into
Conversation
Bureautix authenticates with FIDO2 keys, so the example should not ship accounts with a known password. The user files now show the u2f_keys field instead, root gets a locked password and the NixOS check that requires a password or an SSH key on root or a wheel account is turned off explicitly, since no account is meant to have one. Closes cloud-gouv#16 Signed-off-by: Quentin Cazier <cazierquentin@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #16
Bureautix authenticates with FIDO2 keys (LUKS FIDO2 plus PAM U2F), so the example should not ship accounts with a known password.
inventory/users/*.nix: thehashedPasswordlines (passwordtest) are replaced by theu2f_keysfield, with thepamu2fcfgcommand to fill it, as incommon/admins.nix.common/superadmins.nix: root gets a locked password (!). Remote access goes through the superadmin SSH keys. The value stays explicit so the installer keeps passing--no-root-passwordtonixos-install.common/pam_u2f.nix:users.allowNoPasswordLogin = true. Withusers.mutableUsers = false, NixOS refuses to build a system where neither root nor a wheel account has a password or an SSH key, and it does not count PAM U2F. Since no account is meant to have a password, the check is turned off next to the authentication settings.Checks
nix-instantiate -A toplevelRegistry(every terminal of the inventory) and-A usb-installersucceed with the change.-A net-installeralready fails onmainwith "The option securix.pam does not exist", independently of this change. nixfmt, statix and reuse pass.