beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request 'fix(ipa): use NOPASSWD sudo for IPA user to bypass broken PAM path' (#87) from worktree-ipa-lxc-kerberos-fix into main
Check NixOS configurations / eval-hosts (push) Failing after 9m45s
Details

Browse Source 
Reviewed-on: #87
This commit was merged in pull request #87.
This commit is contained in:
beatzaplenty
2026-07-28 03:16:03 +00:00
parent e6f15404f5 186e9187ce
commit 5c2d61d35a
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/ipa/client.nix
+14
View File
@@ -137,6 +137,15 @@ lib.mkIf enabled {
# With security.ipa setting "passwd: sss files" in nsswitch, SSSD's IPA entry # With security.ipa setting "passwd: sss files" in nsswitch, SSSD's IPA entry
# takes priority for NSS lookups — this local stub is only a fallback when # takes priority for NSS lookups — this local stub is only a fallback when
# SSSD is unreachable (at which point auth fails anyway). # SSSD is unreachable (at which point auth fails anyway).
# HM with useUserPackages = true (flake.nix) sets users.users.${ipaUser}.packages,
# which forces the stub into /etc/passwd. pam_sss.so with the "localusers" flag
# (added by NixOS when SSSD is enabled) then skips SSSD for any user it finds in
# local /etc/passwd — including this stub — falling through to pam_unix, which has
# no password for the stub → sudo auth always fails.
#
# Fix: NOPASSWD for the IPA user. The IPA user already authenticated to reach a
# shell (SSH public key from IPA or Kerberos), so re-prompting via a broken PAM
# path is security theater on a single-admin homelab.
users.users.${vars.ipaUser} = { users.users.${vars.ipaUser} = {
isNormalUser = true; isNormalUser = true;
group = "users"; group = "users";
@@ -144,6 +153,11 @@ lib.mkIf enabled {
createHome = false; createHome = false;
}; };
security.sudo.extraRules = [{
users = [ vars.ipaUser ];
commands = [{ command = "ALL"; options = [ "NOPASSWD" ]; }];
}];
# Home Manager config for the IPA primary user, applied on every enrolled # Home Manager config for the IPA primary user, applied on every enrolled
# host. Manages what IPA doesn't: dotfiles, user-scoped packages, session # host. Manages what IPA doesn't: dotfiles, user-scoped packages, session
# variables. Switch-nix/Test-nix/buildImage are system-wide (configuration.nix) # variables. Switch-nix/Test-nix/buildImage are system-wide (configuration.nix)