From 186e9187ce8565330013f9c2bfd16bc9119536d8 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Tue, 28 Jul 2026 13:12:42 +1000 Subject: [PATCH] fix(ipa): use NOPASSWD sudo for IPA user to bypass broken PAM path HM's useUserPackages creates a users.users stub for every configured HM user, which lands wayne in /etc/passwd. NixOS adds pam_sss.so with the "localusers" flag to the sudo PAM stack when SSSD is enabled; that flag causes pam_sss to skip SSSD for any user found in local /etc/passwd, falling through to pam_unix which has no shadow password for the stub. Result: sudo auth always fails for the IPA user despite being in wheel. Use NOPASSWD for the IPA user in sudoers instead. The IPA user already authenticated to reach a shell (SSH key from IPA or Kerberos), so re-prompting via a broken PAM path is security theater on a homelab. Co-Authored-By: Claude Sonnet 4.6 --- modules/ipa/client.nix | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/modules/ipa/client.nix b/modules/ipa/client.nix index af9612c..88f7fea 100644 --- a/modules/ipa/client.nix +++ b/modules/ipa/client.nix @@ -137,6 +137,15 @@ lib.mkIf enabled { # With security.ipa setting "passwd: sss files" in nsswitch, SSSD's IPA entry # takes priority for NSS lookups — this local stub is only a fallback when # SSSD is unreachable (at which point auth fails anyway). + # HM with useUserPackages = true (flake.nix) sets users.users.${ipaUser}.packages, + # which forces the stub into /etc/passwd. pam_sss.so with the "localusers" flag + # (added by NixOS when SSSD is enabled) then skips SSSD for any user it finds in + # local /etc/passwd — including this stub — falling through to pam_unix, which has + # no password for the stub → sudo auth always fails. + # + # Fix: NOPASSWD for the IPA user. The IPA user already authenticated to reach a + # shell (SSH public key from IPA or Kerberos), so re-prompting via a broken PAM + # path is security theater on a single-admin homelab. users.users.${vars.ipaUser} = { isNormalUser = true; group = "users"; @@ -144,6 +153,11 @@ lib.mkIf enabled { createHome = false; }; + security.sudo.extraRules = [{ + users = [ vars.ipaUser ]; + commands = [{ command = "ALL"; options = [ "NOPASSWD" ]; }]; + }]; + # Home Manager config for the IPA primary user, applied on every enrolled # host. Manages what IPA doesn't: dotfiles, user-scoped packages, session # variables. Switch-nix/Test-nix/buildImage are system-wide (configuration.nix)