beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ipa): use NOPASSWD sudo for IPA user to bypass broken PAM path #87

Merged
beatzaplenty merged 1 commits from worktree-ipa-lxc-kerberos-fix into main 2026-07-28 03:16:03 +00:00
Conversation 0 Commits 1 Files Changed 1
+14
beatzaplenty commented 2026-07-28 03:16:00 +00:00
Owner
Copy Link
Copy Source

HM's useUserPackages creates a users.users stub for every configured HM
user, which lands wayne in /etc/passwd. NixOS adds pam_sss.so with the
"localusers" flag to the sudo PAM stack when SSSD is enabled; that flag
causes pam_sss to skip SSSD for any user found in local /etc/passwd,
falling through to pam_unix which has no shadow password for the stub.
Result: sudo auth always fails for the IPA user despite being in wheel.

Use NOPASSWD for the IPA user in sudoers instead. The IPA user already
authenticated to reach a shell (SSH key from IPA or Kerberos), so
re-prompting via a broken PAM path is security theater on a homelab.

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

HM's useUserPackages creates a users.users stub for every configured HM user, which lands wayne in /etc/passwd. NixOS adds pam_sss.so with the "localusers" flag to the sudo PAM stack when SSSD is enabled; that flag causes pam_sss to skip SSSD for any user found in local /etc/passwd, falling through to pam_unix which has no shadow password for the stub. Result: sudo auth always fails for the IPA user despite being in wheel. Use NOPASSWD for the IPA user in sudoers instead. The IPA user already authenticated to reach a shell (SSH key from IPA or Kerberos), so re-prompting via a broken PAM path is security theater on a homelab. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
beatzaplenty added 1 commit 2026-07-28 03:16:00 +00:00
fix(ipa): use NOPASSWD sudo for IPA user to bypass broken PAM path
Check NixOS configurations / eval-hosts (pull_request) Failing after 9m44s
Details
186e9187ce 
HM's useUserPackages creates a users.users stub for every configured HM
user, which lands wayne in /etc/passwd. NixOS adds pam_sss.so with the
"localusers" flag to the sudo PAM stack when SSSD is enabled; that flag
causes pam_sss to skip SSSD for any user found in local /etc/passwd,
falling through to pam_unix which has no shadow password for the stub.
Result: sudo auth always fails for the IPA user despite being in wheel.

Use NOPASSWD for the IPA user in sudoers instead. The IPA user already
authenticated to reach a shell (SSH key from IPA or Kerberos), so
re-prompting via a broken PAM path is security theater on a homelab.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
beatzaplenty merged commit 5c2d61d35a into main 2026-07-28 03:16:03 +00:00
This repo is archived. You cannot comment on pull requests.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
beatzaplenty
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: beatzaplenty/nixos#87