movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 21:50:33 +03:00
Code Activity

Merge pull request #186628 from ocfox/pam_faildelay

Browse source 
nixos/pam: add option failDelay
This commit is contained in:
Bobby Rong 2022-11-07 19:54:57 +08:00 • committed by GitHub
commit 03e68946a0
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 22 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

22
nixos/modules/security/pam.nix
View file

@ -392,6 +392,24 @@ let
''; '';
}; };
failDelay = {
enable = mkOption {
type = types.bool;
default = false;
description = lib.mdDoc ''
If enabled, this will replace the `FAIL_DELAY` setting from `login.defs`.
Change the delay on failure per-application.
'';
};
delay = mkOption {
default = 3000000;
type = types.int;
example = 1000000;
description = lib.mdDoc "The delay time (in microseconds) on failure.";
};
};
gnupg = { gnupg = {
enable = mkOption { enable = mkOption {
type = types.bool; type = types.bool;
@ -531,6 +549,7 @@ let
|| cfg.enableGnomeKeyring || cfg.enableGnomeKeyring
|| cfg.googleAuthenticator.enable || cfg.googleAuthenticator.enable
|| cfg.gnupg.enable || cfg.gnupg.enable
|| cfg.failDelay.enable
|| cfg.duoSecurity.enable)) || cfg.duoSecurity.enable))
( (
'' ''
@ -551,6 +570,9 @@ let
optionalString cfg.gnupg.enable '' optionalString cfg.gnupg.enable ''
auth optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.storeOnly " store-only"} auth optional ${pkgs.pam_gnupg}/lib/security/pam_gnupg.so ${optionalString cfg.gnupg.storeOnly " store-only"}
'' + '' +
optionalString cfg.failDelay.enable ''
auth optional ${pkgs.pam}/lib/security/pam_faildelay.so delay=${toString cfg.failDelay.delay}
'' +
optionalString cfg.googleAuthenticator.enable '' optionalString cfg.googleAuthenticator.enable ''
auth required ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so no_increment_hotp auth required ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so no_increment_hotp
'' + '' +