Change:
# Enable the accounts daemon to find lightdm's dbus interface environment.systemPackages = [ lightdm ]; <del> security.pam.services.lightdm = { allowNullPassword = true; startSession = true; }; security.pam.services.lightdm-greeter = { allowNullPassword = true; startSession = true; text = '' auth     required pam_env.so envfile=${config.system.build.pamEnvironment} auth     required pam_permit.so </del> <ins> security.pam.services.lightdm.text = '' auth      substack      login account   include       login password  substack      login session   include       login ''; </ins> <del> account  required pam_permit.so </del> <ins> security.pam.services.lightdm-greeter.text = '' auth     required       pam_succeed_if.so audit quiet_success user = lightdm auth     optional       pam_permit.so </ins> <del> password required pam_deny.so </del> <ins> account  required       pam_succeed_if.so audit quiet_success user = lightdm account  sufficient     pam_unix.so password required       pam_deny.so session  required       pam_succeed_if.so audit quiet_success user = lightdm session  required       pam_env.so envfile=${config.system.build.pamEnvironment} session  optional       ${pkgs.systemd}/lib/security/pam_systemd.so session  optional       pam_keyinit.so force revoke session  optional       pam_permit.so ''; </ins> <del> session  required pam_env.so envfile=${config.system.build.pamEnvironment} session  required pam_unix.so session  optional ${pkgs.systemd}/lib/security/pam_systemd.so ''; }; </del> security.pam.services.lightdm-autologin.text = '' <del> auth     requisite pam_nologin.so auth     required  pam_succeed_if.so uid >= 1000 quiet auth     required  pam_permit.so </del> <ins> auth      requisite     pam_nologin.so auth      required      pam_succeed_if.so uid >= 1000 quiet auth      required      pam_permit.so </ins> <del> account  include   lightdm </del> <ins> account   sufficient    pam_unix.so </ins> <del> password include   lightdm </del> <ins> password  requisite     pam_unix.so nullok sha512 </ins> <del> session  include   lightdm </del> <ins> session   optional      pam_keyinit.so revoke session   include       login </ins> ''; users.users.lightdm = {

Discussion:
When i try to connect to a VPN, just a red (!) appears. In the syslog, i see this messages: I tried 2 OpenVPN VPNs that worked in the past on Mac OS X (as it was named so) and elementary OS and also one vpnc. Not sure if the problem is related to Pantheon desktop or NetworkManager. Do VPNs work on GNOME? cc My config: system: host os: multi-user?: sandbox: version: channels(root): nixpkgs:
I'm using GNOME, OpenVPN + NetworkManager works fine. (configured through the GUI)
Did you use ? ! Otherwise I wouldn't work for me. I believe this is because isn't functioning in Pantheon. Does it work for you if you don't use ?
i used "store only for this user". the password is not visible anymore when i save and reopen. maybe it disappears. But i have this issue also when just using certificates with OpenVPN.
I also use "Store the password only for this user"
Yeah so this is because is improperly configured for Pantheon and LightDM. Specifically a keyring isn't created on Login or unlocked. Quoting Arch Wiki on NetworkManager and GNOME Keyring Pretty sure both Pantheon and GNOME3 are using and this applies to storing any secret. So for any connection to work you have to use or enter it manually every time. To fix this we need something like Additionally isn't handling this failure for VPN connection as gracefully as it could. (nmtui would just have you enter the password manually)
So for any connection to work you have to use Store the password for all users or enter it manually every time. It works for the vpnc connection, but i still have issues with OpenVPN. My home vpn uses certificates without password. But when i have no password set, i still get this error. When i set "1" as password, it tries to connect, but fails. I could configure a password, but i'm not at home the next days and it's also just a workaround. I'm also not able to save an empty password field. It was possible in 2 cases out of about 50!
I think that might be then. (different from just username and password)
I can confirm that fixing for Pantheon and enabling allows me to use for wifi connections and for OpenVPN username password. and Though I'm not so confidant in the correctness of