From 3d32e0705a3e04ef756b6852364ac273ff67b23f Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Mon, 13 Jul 2026 19:45:58 +0200 Subject: [PATCH 1/2] nixos/pam: remove explicit hardcoded yescrypt Both `pam_unix.so` and `pam_unix_ng.so` look at `ENCRYPT_METHOD` in `/etc/login.defs` to determine the algorithm to use for password encryption: https://github.com/thkukuk/account-utils/blob/66fbd0382be49d99cb70410a4696c796684ffbf8/src/pam_unix_ng-common.c#L27-L62 If this is not set, both already default to `YESCRYPT`. The shadow module makes this configurable via `security.loginDefs.settings.ENCRYPT_METHOD`, which also defaults to `YESCRYPT`. Seeing as what was previously hardcoded is default anyways, with a global configuration option to change it, there is no point to keep this. --- nixos/modules/security/pam.nix | 1 - nixos/modules/services/display-managers/gdm.nix | 1 - nixos/modules/services/x11/display-managers/lightdm.nix | 1 - 3 files changed, 3 deletions(-) diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix index 96fce08754c9..356aa3b8cbd2 100644 --- a/nixos/modules/security/pam.nix +++ b/nixos/modules/security/pam.nix @@ -1422,7 +1422,6 @@ let modulePath = config.security.pam.pam_unixModulePath; settings = { nullok = true; - yescrypt = lib.mkIf config.security.pam.enableLegacySettings true; }; } { diff --git a/nixos/modules/services/display-managers/gdm.nix b/nixos/modules/services/display-managers/gdm.nix index c6d5c9337e10..1b3705a2787a 100644 --- a/nixos/modules/services/display-managers/gdm.nix +++ b/nixos/modules/services/display-managers/gdm.nix @@ -577,7 +577,6 @@ in control = "requisite"; modulePath = "${config.security.pam.package}/lib/security/pam_unix.so"; settings.nullok = true; - settings.yescrypt = true; } ]; diff --git a/nixos/modules/services/x11/display-managers/lightdm.nix b/nixos/modules/services/x11/display-managers/lightdm.nix index 699a9a9a07f3..e1384e560e30 100644 --- a/nixos/modules/services/x11/display-managers/lightdm.nix +++ b/nixos/modules/services/x11/display-managers/lightdm.nix @@ -456,7 +456,6 @@ in control = "requisite"; modulePath = "${config.security.pam.package}/lib/security/pam_unix.so"; settings.nullok = true; - settings.yescrypt = true; } ]; From 56f89898daebb29e85eb6bd62329b8e9469e28c3 Mon Sep 17 00:00:00 2001 From: Grimmauld Date: Mon, 13 Jul 2026 20:10:25 +0200 Subject: [PATCH 2/2] nixos/tests/login{,-nosuid}: assert yescrypt password format --- nixos/tests/login-nosuid.nix | 1 + nixos/tests/login.nix | 1 + 2 files changed, 2 insertions(+) diff --git a/nixos/tests/login-nosuid.nix b/nixos/tests/login-nosuid.nix index 1f00c37d0886..69d11803387f 100644 --- a/nixos/tests/login-nosuid.nix +++ b/nixos/tests/login-nosuid.nix @@ -49,6 +49,7 @@ with subtest("create user"): machine.succeed("useradd -m alice") machine.succeed("(echo foobar; echo foobar) | passwd alice") + machine.succeed("grep -F 'alice:$y$' /etc/shadow") with subtest("Check whether switching VTs works"): machine.fail("pgrep -f 'agetty.*tty2'") diff --git a/nixos/tests/login.nix b/nixos/tests/login.nix index bd0d3b7bc005..0eb0f8bf6ee3 100644 --- a/nixos/tests/login.nix +++ b/nixos/tests/login.nix @@ -28,6 +28,7 @@ with subtest("create user"): machine.succeed("useradd -m alice") machine.succeed("(echo foobar; echo foobar) | passwd alice") + machine.succeed("grep -F 'alice:$y$' /etc/shadow") with subtest("Check whether switching VTs works"): machine.fail("pgrep -f 'agetty.*tty2'")