From 854ec20330f9f7d2274858014dc001dfa1343c88 Mon Sep 17 00:00:00 2001 From: Quentin Cazier Date: Fri, 11 Sep 2026 19:49:13 +0200 Subject: [PATCH] inventory, common: drop the example password hashes Bureautix authenticates with FIDO2 keys, so the example should not ship accounts with a known password. The user files now show the u2f_keys field instead, root gets a locked password and the NixOS check that requires a password or an SSH key on root or a wheel account is turned off explicitly, since no account is meant to have one. Closes #16 Signed-off-by: Quentin Cazier --- common/pam_u2f.nix | 3 +++ common/superadmins.nix | 4 ++-- inventory/users/abelard.nix | 4 ++-- inventory/users/alice.nix | 4 ++-- inventory/users/bob.nix | 4 ++-- inventory/users/heloise.nix | 4 ++-- 6 files changed, 13 insertions(+), 10 deletions(-) diff --git a/common/pam_u2f.nix b/common/pam_u2f.nix index df27728..89066f7 100644 --- a/common/pam_u2f.nix +++ b/common/pam_u2f.nix @@ -9,4 +9,7 @@ appId = "pam://bureautix-exemple"; origin = "pam://bureautix-exemple"; }; + + # Accounts authenticate with their FIDO2 key, none of them has a password. + users.allowNoPasswordLogin = true; } diff --git a/common/superadmins.nix b/common/superadmins.nix index 99f30c4..450770d 100644 --- a/common/superadmins.nix +++ b/common/superadmins.nix @@ -8,6 +8,6 @@ keys = [ ]; }; - # password is `nixos` - users.users.root.hashedPassword = "$y$j9T$1aoCSeVE6c0STJ0MLSVjK/$jNxZFMVj..HMf5/l14b6I4VufioAr/cNp29ea1S4C4D"; + # root has no password, remote access goes through the SSH keys above. + users.users.root.hashedPassword = "!"; } diff --git a/inventory/users/abelard.nix b/inventory/users/abelard.nix index b2ecb14..8a7566c 100644 --- a/inventory/users/abelard.nix +++ b/inventory/users/abelard.nix @@ -7,8 +7,8 @@ securix.self.user = { email = "abelard@example.com"; username = "abelard"; - # password is `test` - hashedPassword = "$y$j9T$zk4xGLyshz7RzqnMX6M8O0$AybRelILMkQSWcQZV4s.ykRNi/UlgaCUaDwdee0n7N2"; + # Generated with pamu2fcfg --appid pam://bureautix-exemple --origin pam://bureautix-exemple --nouser + u2f_keys = [ ]; defaultLoginShell = pkgs.zsh; }; } diff --git a/inventory/users/alice.nix b/inventory/users/alice.nix index 36c8fac..10e2016 100644 --- a/inventory/users/alice.nix +++ b/inventory/users/alice.nix @@ -7,8 +7,8 @@ securix.self.user = { email = "alice@example.com"; username = "alice"; - # password is `test` - hashedPassword = "$y$j9T$zk4xGLyshz7RzqnMX6M8O0$AybRelILMkQSWcQZV4s.ykRNi/UlgaCUaDwdee0n7N2"; + # Generated with pamu2fcfg --appid pam://bureautix-exemple --origin pam://bureautix-exemple --nouser + u2f_keys = [ ]; defaultLoginShell = pkgs.zsh; }; } diff --git a/inventory/users/bob.nix b/inventory/users/bob.nix index 865dbc8..b60e847 100644 --- a/inventory/users/bob.nix +++ b/inventory/users/bob.nix @@ -7,8 +7,8 @@ securix.self.user = { email = "bob@example.com"; username = "bob"; - # password is `test` - hashedPassword = "$y$j9T$zk4xGLyshz7RzqnMX6M8O0$AybRelILMkQSWcQZV4s.ykRNi/UlgaCUaDwdee0n7N2"; + # Generated with pamu2fcfg --appid pam://bureautix-exemple --origin pam://bureautix-exemple --nouser + u2f_keys = [ ]; defaultLoginShell = pkgs.zsh; }; } diff --git a/inventory/users/heloise.nix b/inventory/users/heloise.nix index 39b3f36..8fd3e90 100644 --- a/inventory/users/heloise.nix +++ b/inventory/users/heloise.nix @@ -7,8 +7,8 @@ securix.self.user = { email = "heloise@example.com"; username = "heloise"; - # password is `test` - hashedPassword = "$y$j9T$zk4xGLyshz7RzqnMX6M8O0$AybRelILMkQSWcQZV4s.ykRNi/UlgaCUaDwdee0n7N2"; + # Generated with pamu2fcfg --appid pam://bureautix-exemple --origin pam://bureautix-exemple --nouser + u2f_keys = [ ]; defaultLoginShell = pkgs.zsh; }; }