Change:
Describe the bug There are reasons to want a system, that has no user that can log in by SSH or with their password, for example in a declarative container To Reproduce Steps to reproduce the behavior: up a minimal declarative container asserts that I will be locked out from the system and refuses to build the configuration with Expected behavior nix generates me a container that I can log in with , or maybe I don't want to log into it at all (because it's a disposable VM or something of the like). I think there should be a check whether the generated system is a container and an additional "I know what I'm doing" override for other cases. I'll create a PR once we agreed on what's best. Maintainer information: Code causing the problem: mentioning since you the check.
Is it an option to set a randomly-generated (the hash itself would be generated, not obtained by honestly hashing a password)? Recovering the password from such a hash is probably harder than a lot of other attack vectors. But an override «doLockOutEveryone» sounds fine.
Setting a password would certainly be a possibility, but somewhat (for lack of a better word) really lame. Having slept a night over it, I propose , that disables all the assertions at the bottom. I can see scenarios where two users with the same uid could be wanted. I want my unixoid to always give me enough rope to shoot myself in the leg.
What about not enabling ssh and disabling the getty? It should completely lock anyone out, unless I am missing something. Take a look at the profile.
In case of a nixos declaratively defined nixos container, you are not logged out because the root system(d) can generate a root shell without any authentication, which is why I consider this a bug. Having to "fool" the assertion to actually lock oneself out is another matter, I could live with that but I don't think it's nice behavior.
Thank you for your contributions. This has been automatically marked as stale because it has had no activity for 180 days. If this is still important to you, we ask that you leave a comment below. Your comment can be as simple as "still important to me". This lets people see that at least one person still cares about this. Someone will have to do this at most twice a year if there is no other activity. Here are suggestions that might help resolve this more quickly: for maintainers and people that previously touched the related code and @ mention them in a comment. on the . 3. Ask on the on .
This is still an issue.
I marked this as stale due to inactivity. &rarr;
Fixed via

Discussion:
imports = [ (mkAliasOptionModule [ "users" "extraUsers" ] [ "users" "users" ]) (mkAliasOptionModule [ "users" "extraGroups" ] [ "users" "groups" ]) <del> (mkChangedOptionModule [ "security" "initialRootPassword" ] [ "users" "users" "root" "initialHashedPassword" ] (cfg: if cfg.security.initialRootPassword == "!" then null else cfg.security.initialRootPassword)) </del> <ins> (mkRenamedOptionModule ["security" "initialRootPassword"] ["users" "users" "root" "initialHashedPassword"]) </ins> ]; ###### interface options = { users.mutableUsers = mkOption {

''; }; <ins> users.allowNoPasswordLogin = mkOption { type = types.bool; default = false; description = '' Disable checking that at least the <literal>root</literal> user or a user in the <literal>wheel</literal> group can log in using a password or an SSH key. WARNING: enabling this can lock you out of your system. Enable this only if you know what are you doing. ''; }; </ins> };

home = "/root"; shell = mkDefault cfg.defaultUserShell; group = "root"; <ins> initialHashedPassword = mkDefault "!"; </ins> }; nobody = { uid = ids.uids.nobody;

# there is at least one "privileged" account that has a # password or an SSH authorized key. Privileged accounts are # root and users in the wheel group. <del> assertion = !cfg.mutableUsers -> any id ((mapAttrsToList (_: cfg: (cfg.name == "root" </del> <ins> # The check does not apply when users.disableLoginPossibilityAssertion # The check does not apply when users.mutableUsers assertion = !cfg.mutableUsers -> !cfg.allowNoPasswordLogin -> any id (mapAttrsToList (name: cfg: (name == "root" </ins> || cfg.group == "wheel" || elem "wheel" cfg.extraGroups) &&

|| cfg.openssh.authorizedKeys.keyFiles != []) ) cfg.users) ++ [ config.security.googleOsLogin.enable <del> ]); </del> <ins> ]; </ins> message = '' Neither the root account nor any wheel user has a password or SSH authorized key. <del> You must set one to prevent being locked out of your system.''; </del> <ins> You must set one to prevent being locked out of your system. If you really want to be locked out of your system, set users.allowNoPasswordLogin = true; However you are most probably better off by setting users.mutableUsers = true; and manually running passwd root to set the root password. ''; </ins> } ] ++ flatten (flip mapAttrsToList cfg.users (name: user: [