You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
235 lines
7.5 KiB
235 lines
7.5 KiB
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
cfg = config.security.duosec;
|
|
|
|
boolToStr = b: if b then "yes" else "no";
|
|
|
|
configFilePam = ''
|
|
[duo]
|
|
ikey=${cfg.integrationKey}
|
|
host=${cfg.host}
|
|
${optionalString (cfg.groups != "") ("groups="+cfg.groups)}
|
|
failmode=${cfg.failmode}
|
|
pushinfo=${boolToStr cfg.pushinfo}
|
|
autopush=${boolToStr cfg.autopush}
|
|
prompts=${toString cfg.prompts}
|
|
fallback_local_ip=${boolToStr cfg.fallbackLocalIP}
|
|
'';
|
|
|
|
configFileLogin = configFilePam + ''
|
|
motd=${boolToStr cfg.motd}
|
|
accept_env_factor=${boolToStr cfg.acceptEnvFactor}
|
|
'';
|
|
in
|
|
{
|
|
imports = [
|
|
(mkRenamedOptionModule [ "security" "duosec" "group" ] [ "security" "duosec" "groups" ])
|
|
(mkRenamedOptionModule [ "security" "duosec" "ikey" ] [ "security" "duosec" "integrationKey" ])
|
|
(mkRemovedOptionModule [ "security" "duosec" "skey" ] "The insecure security.duosec.skey option has been replaced by a new security.duosec.secretKeyFile option. Use this new option to store a secure copy of your key instead.")
|
|
];
|
|
|
|
options = {
|
|
security.duosec = {
|
|
ssh.enable = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = "If enabled, protect SSH logins with Duo Security.";
|
|
};
|
|
|
|
pam.enable = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = "If enabled, protect logins with Duo Security using PAM support.";
|
|
};
|
|
|
|
integrationKey = mkOption {
|
|
type = types.str;
|
|
description = "Integration key.";
|
|
};
|
|
|
|
secretKeyFile = mkOption {
|
|
type = types.nullOr types.path;
|
|
default = null;
|
|
description = ''
|
|
A file containing your secret key. The security of your Duo application is tied to the security of your secret key.
|
|
'';
|
|
example = "/run/keys/duo-skey";
|
|
};
|
|
|
|
host = mkOption {
|
|
type = types.str;
|
|
description = "Duo API hostname.";
|
|
};
|
|
|
|
groups = mkOption {
|
|
type = types.str;
|
|
default = "";
|
|
example = "users,!wheel,!*admin guests";
|
|
description = ''
|
|
If specified, Duo authentication is required only for users
|
|
whose primary group or supplementary group list matches one
|
|
of the space-separated pattern lists. Refer to
|
|
<link xlink:href="https://duo.com/docs/duounix"/> for details.
|
|
'';
|
|
};
|
|
|
|
failmode = mkOption {
|
|
type = types.enum [ "safe" "secure" ];
|
|
default = "safe";
|
|
description = ''
|
|
On service or configuration errors that prevent Duo
|
|
authentication, fail "safe" (allow access) or "secure" (deny
|
|
access). The default is "safe".
|
|
'';
|
|
};
|
|
|
|
pushinfo = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
Include information such as the command to be executed in
|
|
the Duo Push message.
|
|
'';
|
|
};
|
|
|
|
autopush = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
If <literal>true</literal>, Duo Unix will automatically send
|
|
a push login request to the user’s phone, falling back on a
|
|
phone call if push is unavailable. If
|
|
<literal>false</literal>, the user will be prompted to
|
|
choose an authentication method. When configured with
|
|
<literal>autopush = yes</literal>, we recommend setting
|
|
<literal>prompts = 1</literal>.
|
|
'';
|
|
};
|
|
|
|
motd = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
Print the contents of <literal>/etc/motd</literal> to screen
|
|
after a successful login.
|
|
'';
|
|
};
|
|
|
|
prompts = mkOption {
|
|
type = types.enum [ 1 2 3 ];
|
|
default = 3;
|
|
description = ''
|
|
If a user fails to authenticate with a second factor, Duo
|
|
Unix will prompt the user to authenticate again. This option
|
|
sets the maximum number of prompts that Duo Unix will
|
|
display before denying access. Must be 1, 2, or 3. Default
|
|
is 3.
|
|
|
|
For example, when <literal>prompts = 1</literal>, the user
|
|
will have to successfully authenticate on the first prompt,
|
|
whereas if <literal>prompts = 2</literal>, if the user
|
|
enters incorrect information at the initial prompt, he/she
|
|
will be prompted to authenticate again.
|
|
|
|
When configured with <literal>autopush = true</literal>, we
|
|
recommend setting <literal>prompts = 1</literal>.
|
|
'';
|
|
};
|
|
|
|
acceptEnvFactor = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
Look for factor selection or passcode in the
|
|
<literal>$DUO_PASSCODE</literal> environment variable before
|
|
prompting the user for input.
|
|
|
|
When $DUO_PASSCODE is non-empty, it will override
|
|
autopush. The SSH client will need SendEnv DUO_PASSCODE in
|
|
its configuration, and the SSH server will similarly need
|
|
AcceptEnv DUO_PASSCODE.
|
|
'';
|
|
};
|
|
|
|
fallbackLocalIP = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
Duo Unix reports the IP address of the authorizing user, for
|
|
the purposes of authorization and whitelisting. If Duo Unix
|
|
cannot detect the IP address of the client, setting
|
|
<literal>fallbackLocalIP = yes</literal> will cause Duo Unix
|
|
to send the IP address of the server it is running on.
|
|
|
|
If you are using IP whitelisting, enabling this option could
|
|
cause unauthorized logins if the local IP is listed in the
|
|
whitelist.
|
|
'';
|
|
};
|
|
|
|
allowTcpForwarding = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = ''
|
|
By default, when SSH forwarding, enabling Duo Security will
|
|
disable TCP forwarding. By enabling this, you potentially
|
|
undermine some of the SSH based login security. Note this is
|
|
not needed if you use PAM.
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
|
|
config = mkIf (cfg.ssh.enable || cfg.pam.enable) {
|
|
environment.systemPackages = [ pkgs.duo-unix ];
|
|
|
|
security.wrappers.login_duo.source = "${pkgs.duo-unix.out}/bin/login_duo";
|
|
|
|
system.activationScripts = {
|
|
login_duo = mkIf cfg.ssh.enable ''
|
|
if test -f "${cfg.secretKeyFile}"; then
|
|
mkdir -m 0755 -p /etc/duo
|
|
|
|
umask 0077
|
|
conf="$(mktemp)"
|
|
{
|
|
cat ${pkgs.writeText "login_duo.conf" configFileLogin}
|
|
printf 'skey = %s\n' "$(cat ${cfg.secretKeyFile})"
|
|
} >"$conf"
|
|
|
|
chown sshd "$conf"
|
|
mv -fT "$conf" /etc/duo/login_duo.conf
|
|
fi
|
|
'';
|
|
pam_duo = mkIf cfg.pam.enable ''
|
|
if test -f "${cfg.secretKeyFile}"; then
|
|
mkdir -m 0755 -p /etc/duo
|
|
|
|
umask 0077
|
|
conf="$(mktemp)"
|
|
{
|
|
cat ${pkgs.writeText "login_duo.conf" configFilePam}
|
|
printf 'skey = %s\n' "$(cat ${cfg.secretKeyFile})"
|
|
} >"$conf"
|
|
|
|
mv -fT "$conf" /etc/duo/pam_duo.conf
|
|
fi
|
|
'';
|
|
};
|
|
|
|
/* If PAM *and* SSH are enabled, then don't do anything special.
|
|
If PAM isn't used, set the default SSH-only options. */
|
|
services.openssh.extraConfig = mkIf (cfg.ssh.enable || cfg.pam.enable) (
|
|
if cfg.pam.enable then "UseDNS no" else ''
|
|
# Duo Security configuration
|
|
ForceCommand ${config.security.wrapperDir}/login_duo
|
|
PermitTunnel no
|
|
${optionalString (!cfg.allowTcpForwarding) ''
|
|
AllowTcpForwarding no
|
|
''}
|
|
'');
|
|
};
|
|
}
|
|
|