From: John Darrington <jmd@gnu.org>
To: guix-devel@gnu.org
Cc: John Darrington <jmd@gnu.org>
Subject: [PATCH 3/3] gnu: Add pam-krb5 service.
Date: Sat, 22 Oct 2016 17:28:00 +0200 [thread overview]
Message-ID: <1477150080-17187-3-git-send-email-jmd@gnu.org> (raw)
In-Reply-To: <1477150080-17187-1-git-send-email-jmd@gnu.org>
* doc/guix.texi (Kerberos Services): New node.
* gnu/services/kerberos.scm: New file.
* gnu/local.mk: Add it.
---
doc/guix.texi | 38 ++++++++++++++++++++++++++-
gnu/local.mk | 1 +
gnu/services/kerberos.scm | 67 +++++++++++++++++++++++++++++++++++++++++++++++
3 files changed, 105 insertions(+), 1 deletion(-)
create mode 100644 gnu/services/kerberos.scm
diff --git a/doc/guix.texi b/doc/guix.texi
index 86b82c8..1f4e808 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -220,6 +220,7 @@ Services
* Desktop Services:: D-Bus and desktop services.
* Database Services:: SQL databases.
* Mail Services:: IMAP, POP3, SMTP, and all that.
+* Kerberos Services:: Kerberos services.
* Web Services:: Web servers.
* Network File System:: NFS related services.
* Miscellaneous Services:: Other services.
@@ -7685,6 +7686,7 @@ declaration.
* Desktop Services:: D-Bus and desktop services.
* Database Services:: SQL databases.
* Mail Services:: IMAP, POP3, SMTP, and all that.
+* Kerberos Services:: Kerberos services.
* Web Services:: Web servers.
* Network File System:: NFS related services.
* Miscellaneous Services:: Other services.
@@ -10389,6 +10391,40 @@ could instantiate a dovecot service like this:
(string "")))
@end example
+
+@node Kerberos Services
+@subsubsection Kerberos Services
+@cindex Kerberos
+
+The @code{(gnu services Kerberos)} module provides services relating to
+the authentication protocol @dfn{Kerberos}.
+
+@subsubheading PAM krb5 Service
+@cindex pam-krb5
+
+The pam-krb5 service allows for login authentication and password
+management via Kerberos.
+You will need this service if you want PAM enabled applications to authenticate
+users using Kerberos.
+
+@defvr {Scheme Variable} pam-krb5-service-type
+A service type for the Kerberos 5 PAM module.
+@end defvr
+
+@deftp {Data Type} pam-krb5-configuration
+Data type representing the configuration of the Kerberos 5 PAM module
+This type has the following parameters:
+@table @asis
+@item @code{pam-krb5} (default: @code{pam-krb5})
+The pam-krb5 package to use.
+
+@item @code{minimum-uid} (default: @code{1000})
+The smallest user ID for which Kerberos authentications should be attempted.
+Local accounts with lower values will silently fail to authenticate.
+@end table
+@end deftp
+
+
@node Web Services
@subsubsection Web Services
@@ -10475,7 +10511,7 @@ The @dfn{global security system} (GSS) daemon provides strong security for RPC
based protocols.
Before exchanging RPC requests an RPC client must establish a security
context. Typically this is done using the Kerberos command @command{kinit}
-or automatically at login time using PAM services.
+or automatically at login time using PAM services (@pxref{Kerberos Services}).
@defvr {Scheme Variable} gss-service-type
A service type for the Global Security System (GSS) daemon.
diff --git a/gnu/local.mk b/gnu/local.mk
index cfd4480..4021468 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -396,6 +396,7 @@ GNU_SYSTEM_MODULES = \
%D%/services/dbus.scm \
%D%/services/desktop.scm \
%D%/services/dict.scm \
+ %D%/services/kerberos.scm \
%D%/services/lirc.scm \
%D%/services/mail.scm \
%D%/services/mcron.scm \
diff --git a/gnu/services/kerberos.scm b/gnu/services/kerberos.scm
new file mode 100644
index 0000000..144c71b
--- /dev/null
+++ b/gnu/services/kerberos.scm
@@ -0,0 +1,67 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2016 John Darrington <jmd@gnu.org>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu services kerberos)
+ #:use-module (gnu packages admin)
+ #:use-module (gnu services)
+ #:use-module (gnu system pam)
+ #:use-module (guix gexp)
+ #:use-module (guix records)
+ #:export (pam-krb5-configuration
+ pam-krb5-configuration?
+ pam-krb5-service-type))
+
+(define-record-type* <pam-krb5-configuration>
+ pam-krb5-configuration make-pam-krb5-configuration
+ pam-krb5-configuration?
+ (pam-krb5 pam-krb5-configuration-pam-krb5
+ (default pam-krb5))
+ (minimum-uid pam-krb5-configuration-minimum-uid
+ (default 1000)))
+
+(define (pam-krb5-pam-service config)
+ "Return a PAM service for Kerberos authentication."
+ (lambda (pam)
+ (define pam-krb5-module
+ #~(string-append #$(pam-krb5-configuration-pam-krb5 config) "/lib/security/pam_krb5.so"))
+
+ (let ((pam-krb5-sufficient
+ (pam-entry
+ (control "sufficient")
+ (module pam-krb5-module)
+ (arguments (list
+ (format #f "minimum_uid=~a"
+ (pam-krb5-configuration-minimum-uid config)))))))
+ (pam-service
+ (inherit pam)
+ (auth (cons* pam-krb5-sufficient
+ (pam-service-auth pam)))
+ (session (cons* pam-krb5-sufficient
+ (pam-service-session pam)))
+ (account (cons* pam-krb5-sufficient
+ (pam-service-account pam)))))))
+
+(define (pam-krb5-pam-services config)
+ (list (pam-krb5-pam-service config)))
+
+(define pam-krb5-service-type
+ (service-type (name 'pam-krb5)
+ (extensions
+ (list
+ (service-extension pam-root-service-type
+ pam-krb5-pam-services)))))
--
2.1.4
prev parent reply other threads:[~2016-10-22 15:28 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-10-22 15:27 [PATCH 1/3] gnu: Remove comment which is factually incorrect John Darrington
2016-10-22 15:27 ` [PATCH 2/3] gnu: pam_unix.so Add use_first_pass option John Darrington
2016-10-23 21:45 ` Leo Famulari
2016-10-24 4:56 ` John Darrington
2016-10-27 12:51 ` Ludovic Courtès
2016-10-28 5:22 ` John Darrington
2016-10-28 12:48 ` Ludovic Courtès
2016-10-22 15:28 ` John Darrington [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1477150080-17187-3-git-send-email-jmd@gnu.org \
--to=jmd@gnu.org \
--cc=guix-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.