summary refs log tree commit diff
path: root/nixos/modules/services/security
Commit message (Collapse)AuthorAge
* Merge pull request #164330 from Luflosi/fix-tor-client-disableSandro2022-03-20
|\
| * nixos/tor: fix services.tor.client.enable = false not workingLuflosi2022-03-15
| | | | | | | | | | If `services.tor.client.enable` is set to false (the default), the `SOCKSPort` option is not added to the torrc file but since Tor defaults to listening on port 9050 when the option is not specified, the tor client is not actually disabled. To fix this, simply set `SOCKSPort` to 0, which disables the client. Use `mkForce` to prevent potentially two different `SOCKSPort` options in the torrc file, with one of them being 0 as this would cause Tor to fail to start. When `services.tor.client.enable` is set to false, this should always be disabled.
* | nixos/oauth2_proxy: add missing oidc providers (#164632)Benjamin Staffin2022-03-20
|/ | | | - Add adfs and keycloak-oidc providrs - Sort the list alphabetically
* nixos/tor: allow tor to read resolv.conf when using resolvedLuflosi2022-03-15
| | | | | | | | | | When `services.resolved.enable` is set to true, the file /etc/resolv.conf becomes a symlink to /etc/static/resolv.conf, which is a symlink to /run/systemd/resolve/stub-resolv.conf. Without this commit, tor does not have access to this file thanks to systemd confinement. This results in the following warning when tor starts: ``` [warn] Unable to stat resolver configuration in '/etc/resolv.conf': No such file or directory [warn] Could not read your DNS config from '/etc/resolv.conf' - please investigate your DNS configuration. This is possibly a problem. Meanwhile, falling back to local DNS at 127.0.0.1. ``` To fix this, simply allow read-only access to the file when resolved is in use. According to https://github.com/NixOS/nixpkgs/pull/161818#discussion_r824820462, the symlink may also point to /run/systemd/resolve/resolv.conf, so allow that as well.
* nixos/tor: admit newlines in secret keylassulus2022-03-09
|
* nixos/opensnitch: Add options to configure daemonJonas Heinrich2022-03-02
|
* Remove F-PROT package and service module (EoL) (#160372)Renaud2022-03-02
|
* Merge pull request #155207 from rapenne-s/freshclam_when_internetMaximilian Bosch2022-03-01
|\ | | | | clamav: start freshclan after network-online target
| * clamav: remove freshclam service dependencySolene Rapenne2022-02-28
| |
* | Merge pull request #161056 from dywedir/nixos/vaultwardenPascal Wittmann2022-02-23
|\ \ | | | | | | nixos/vaultwarden: fix evaluation
| * | nixos/vaultwarden: fix evaluationVladyslav M2022-02-20
| | |
* | | Merge pull request #150886 from mohe2015/improve-step-caLassulus2022-02-22
|\ \ \ | |/ / |/| | nixos/step-ca: create a step-ca user
| * | nixos/step-ca: create a step-ca userMoritz Hedtke2021-12-15
| | | | | | | | | | | | This allows you to create the certificate files owned by that user so the service can read them.
* | | nixos/step-ca: Remove unnecessary passthru.testsMoritz Hedtke2022-02-13
| | |
* | | Merge pull request #151123 from Artturin/havegedupdateArtturi2022-02-10
|\ \ \
| * | | haveged: 1.9.2 -> 1.9.15Artturin2021-12-17
| |/ /
* | | nixos/cfssl: minor updates/cleanupAaron Andersen2022-02-05
| | |
* | | nixos/cfssl: use systemd StateDirectory to provision the data directoryAaron Andersen2022-02-05
| | |
* | | nixos/vaultwarden: fix alias after #152372K9002022-02-01
| | |
* | | nixos/tor: fix tor getting killed by systemd when shuttding downLuflosi2022-01-25
| |/ |/| | | | | | | | | Tor waits ShutdownWaitLength seconds (30s by default) before actually shutting down. Since the systemd timeout is also set to 30 seconds, this results in a race condition that ends up killing Tor most of the time on my machine during shutdown. To fix this, add the ShutdownWaitLength setting and tell systemd to wait 30 seconds more than that. Arch Linux also has `TimeoutSec` set to 60 seconds: https://github.com/archlinux/svntogit-community/blob/6df716fe195984624d475b79b2cd9d290452c346/trunk/tor.service.
* | nixos/intel-sgx: add option for Intel SGX DCAP compatibilityVincent Haupert2022-01-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Intel SGX DCAP driver makes the SGX application enclave device and the SGX provisioning enclave available below the path `/dev/sgx/`. Since Linux 5.11, a derivation of the DCAP driver is part of the kernel and available through the X86_SGX config option; NixOS enables this option by default. In contrast to the out-of-tree DCAP driver, the in-tree SGX driver uses a flat hierarchy for the SGX devices resulting in the paths `/dev/sgx_enclave` for the application enclave device and `/dev/sgx_provison` for the provisioning enclave device. As of this commit, even the latest version of the Intel SGX PSW libraries still tries to open the (legacy) DCAP paths only. This means that SGX software currently cannot find the required SGX devices even if the system actually supports SGX through the in-tree driver. Intel wants to change this behavior in an upcoming release of intel/linux-sgx. Having said that, SGX software assuming the SGX devices below `/dev/sgx/` will prevail. Therefore, this commit introduces the NixOS configuration option `hardware.cpu.intel.sgx.enableDcapCompat` which creates the necessary symlinks to support existing SGX software. The option defaults to true as it is currently the only way to support SGX software. Also, enabling the SGX AESM service enables the option. The permissions of the devices `/dev/sgx_enclave` and `/dev/sgx_provison` remain the same, i.e., are not affected regardless of having the new option enabled or not.
* | nixos/documentation: split options doc buildpennae2022-01-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | most modules can be evaluated for their documentation in a very restricted environment that doesn't include all of nixpkgs. this evaluation can then be cached and reused for subsequent builds, merging only documentation that has changed into the cached set. since nixos ships with a large number of modules of which only a few are used in any given config this can save evaluation a huge percentage of nixos options available in any given config. in tests of this caching, despite having to copy most of nixos/, saves about 80% of the time needed to build the system manual, or about two second on the machine used for testing. build time for a full system config shrank from 9.4s to 7.4s, while turning documentation off entirely shortened the build to 7.1s.
* | nixos/aesmd: add missing defaultTextpennae2021-12-29
| |
* | nixos/privacyidea: increase buffer-size of uwsgi from 4096 to 8192Maximilian Bosch2021-12-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When accessing the Audit log, I get an HTTP 502 when the frontend requests `/audit` and I get the following error in my `nginx`-log: Dec 20 22:12:48 ldap nginx[336]: 2021/12/20 22:12:48 [error] 336#336: *8421 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 10.237.0.1, server: _, request: "GET /audit/?action=**&action_detail=**&administrator=**&client=**&date=**&duration=**&info=**&page=1&page_size=10&policies=**&privacyidea_server=**&realm=**&resolver=**&serial=**&sortorder=desc&startdate=**&success=**&tokentype=**&user=** HTTP/1.1", upstream: "uwsgi://unix:/run/privacyidea/socket:", host: "ldap.ist.nicht-so.sexy", referrer: "https://ldap.ist.nicht-so.sexy/" This is because of an "invalid request block size"-error according to `journalctl -u privacyidea.service`: Dec 20 22:12:48 ldap uwsgi[10721]: invalid request block size: 4245 (max 4096)...skip Increasing the buffer to 8192 fixes the problem for me.
* | Merge pull request #148785 from pennae/more-option-doc-staticizingGraham Christensen2021-12-17
|\ \ | |/ |/| treewide: more defaultText for options
| * treewide: add defaultText for options with simple cfg.* expression defaultspennae2021-12-09
| | | | | | | | | | adds defaultText for options with defaults that use only literals, full config.* paths, and the cfg shortcut binding.
| * treewide: add defaultText for options with simple interpolation defaultspennae2021-12-09
| | | | | | | | | | | | adds defaultText for all options that use `cfg.*` values in their defaults, but only for interpolations with no extra processing (other than toString where necessary)
* | nixos/aesmd: add moduleVincent Haupert2021-12-10
| | | | | | | | Co-authored-by: Alex Zero <joseph@marsden.space>
* | Merge pull request #147441 from pennae/option-doc-staticizingRobert Hensing2021-12-06
|\ \ | | | | | | nixos/*: add trivial defaultText to options where applicable
| * | nixos/*: add trivial defaultText for options with simple defaultspennae2021-12-02
| |/
* / nixos/tests: add step-ca testMoritz Hedtke2021-11-13
|/
* Merge pull request #122452 from ju1m/torSandro2021-11-09
|\
| * nixos/tor: harden ProcSubset and ProtectProcJulien Moutinho2021-05-10
| |
* | nixos/yubikey-agent add maintainer jwoudenbergJasper Woudenberg2021-10-29
| |
* | nixos/yubikey-agent: start enabled agent on bootJasper Woudenberg2021-10-29
| | | | | | | | | | | | | | | | | | | | | | This adds a `wantedBy` clause to the user systemd service for yubikey-agent, to ensure an enabled agent is started on boot. This brings the behavior inline with existing documentation. If the user has selected a graphical pinentry program, then we need to wait for the graphical environment to exist before starting the yubikey-agent. I've found that if we start the agent earlier it will fail when we perform an ssh command later.
* | nixos/step-ca: fix comment typoWei Tang2021-10-26
| |
* | pythonPackages.privacyidea-ldap-proxy: 0.6.1 -> 0.6.2, switch to python3Maximilian Bosch2021-10-18
| |
* | nixos/doc: clean up defaults and examplesNaïm Favier2021-10-04
| |
* | Merge pull request #132319 from onny/opensnitchAaron Andersen2021-09-19
|\ \ | | | | | | nixos/opensnitch: Add module for opensnitch
| * | Opensnitch: Add moduleJonas Heinrich2021-09-14
| | |
* | | nixos/physlock: fix broken wrapperrnhmjoj2021-09-19
| | | | | | | | | | | | | | | - `user` doesn't exist -> `owner` - set `setuid,group` as well (no longer optional)
* | | Merge pull request #135626 from delroth/tor-netlinkBobby Rong2021-09-14
|\ \ \ | | | | | | | | nixos/tor: allow AF_NETLINK address family
| * | | nixos/tor: allow AF_NETLINK address familyPierre Bourdon2021-08-25
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Tor attempts to detect what external IP address a machine is using by listing addresses on all network interfaces on the system. This listing is done using getifaddrs(3), which relies on netlink in order to get IPv6 address information. This change fixes Tor not finding the relay's IPv6 address unless explicitly configured via either an ORPort directive or via DNS resolution of the machine hostname.
* | | Merge pull request #133166 from symphorien/nonogroupGuillaume Girol2021-09-13
|\ \ \ | | | | | | | | Don't default to nogroup for the primary group of users.
| * | | nixos: define the primary group of users where neededGuillaume Girol2021-09-12
| |/ /
* / / nixos/privacyidea: use `sudo(8)` that's configured via the moduleMaximilian Bosch2021-09-08
|/ /
* | nixos/hockeypuck: Add service for hockeypuckElis Hirwing2021-07-19
| |
* | nixos/vaultwarden: make package configurable (#113216)Antoine Martin2021-07-14
| | | | | | | | | | This allows the user to override the version of Vaultwarden used by the service, if using an overlay to keep up to date with releases for example.
* | vaultwarden: update to 1.22.1, rename from bitwarden_rsK9002021-07-01
| | | | | | | | | | | | I tried to make this as non-breaking as possible, but it will still break things slightly for people expecting certain file names in the packages themselves.
* | sshd service: Default to INFO logLevel (upstream default).Niklas Hambüchen2021-06-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The previous justification for using "VERBOSE" is incorrect, because OpenSSH does use level INFO to log "which key was used to log in" for sccessful logins, see: https://github.com/openssh/openssh-portable/blob/6247812c76f70b2245f3c23f5074665b3d436cae/auth.c#L323-L328 Also update description to the wording of the sshd_config man page. `fail2ban` needs, sshd to be "VERBOSE" to work well, thus the `fail2ban` module sets it to "VERBOSE" if enabled. The docs are updated accordingly.
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-05-31 14:46:22 +0000