Without this, an invalid capabilities string would cause the activation
script to fail completely, meaning all wrappers would be missing. This
causes unix_chkpwd to be missing, and thus all logins to fail.
See https://github.com/NixOS/nixpkgs/issues/398934.
These are likely to differ for many folks, and running these checks
should be quite fast (`runCommandLocal` docs suggest anything less than
one second should use local).
According to `man 8 audisp-af_unix`:
> If the output format is not specified, the plugin defaults to the "string" format.
`string` format is more compatible with existing parsers,
and differing from the upstream default should be opt-in.
Also adjust the socket path in the option description to what we actually set up.
Both `pam_unix.so` and `pam_unix_ng.so` look at `ENCRYPT_METHOD` in
`/etc/login.defs` to determine the algorithm to use for password
encryption: 66fbd0382b/src/pam_unix_ng-common.c (L27-L62)
If this is not set, both already default to `YESCRYPT`.
The shadow module makes this configurable via
`security.loginDefs.settings.ENCRYPT_METHOD`, which also defaults to `YESCRYPT`.
Seeing as what was previously hardcoded is default anyways, with a global
configuration option to change it, there is no point to keep this.
The acmedns backend consumes a ACME_DNS_STORAGE_PATH environment
variable.
Upstream does treat this file as mutable (if you create or delete
accounts through the CLI, it would update it. We don't do this in our
module).
But the possibility for edits is probably why they didn't go with
`ACME_DNS_CONFIG` env var for the contents (as they'd be read-only), or
a `ACME_DNS_CONFIG_FILE`. (And the fact that a
`ACME_DNS_STORAGE_PATH_FILE` env var with questionable usability exists
is due to this logic being generic for most env vars).
So instead of fighting upstream over this, let's simply make our module
assertion also accept `_PATH` suffixes for `credentialFiles`.
Fixes#344684.
We concluded this is fine, because we don't require elevation while
switching generations.
Co-Authored-By: r-vdp <ramses@well-founded.dev>
Co-Authored-By: Grimmauld <Grimmauld@grimmauld.de>
The module now enables polkit, which run0 requires to faciliate
elevation. This warrants guarding the config by an opt-in enable toggle.
For the options that existed prior to the enable toggle we now assert
that users need to opt into the module for them to have an effect.
This module was deprecated in 26.05 and is being removed in 26.11.
Generating your own dhparams has been obsoleted by RFC 7919 (2016).
DHE itself has been obsoleted by ECHDE (RFC8422, 2018) and Hybrid PQ
(draft-ietf-tls-ecdhe-mlkem, 2026) key exchanges.
TLS 1.3 (RFC8446, 2018) stopped defining any DHE cipher suites and lists
this as a major difference from TLS 1.2.
