NixOS/nixpkgs — pull request #1775 by thoughtpolice (2014-02-18 10:19:47+00:00)
Title: Duo unix

This series of commits adds two things:

* First, in 798a33d52002b96b8284753f372a2b6b7a0649ab, it adds support for `uid` and `gid` attributes on `environment.etc` files. The rationale here is that sometimes a configuration file needs to be owned by a specific user - for example, a binary may drop permissions and afterwords read a configuration file. I couldn't find a sane way to do this with `system.activationScripts` at the right time in a principled way. I think for copied files, setting permissions directly is reasonable even if the file is generated by a module.

uid/gid permissions only take affect if the file's mode is not `symlink`. By default, all copied files have uid/gid of `root/root`.

* Adds a module for [Duo Security](https://duosecurity.com) along with the `duo_unix` package, which makes it trivial to enable two-factor authentication. This module requires the `uid` and `eid` support - the `login_duo` application is a setuid binary which drops privileges to the `sshd` user immediately, and then reads the configuration file. As a result, `/etc/duo/login_duo.conf` needs `sshd:root` permissions (with mode `0600`).

A few things to note:

- The `login_duo` command is enforced at SSH login time by amending `ForceCommand /login_duo` as well as some other commands to the SSH daemon config.

I'm not sure how to enforce the fact this does not conflict with another `ForceCommand`, but perhaps it does not matter as it's so rare anyway.

- PAM authentication is supported, but the module does not attempt to override `pam_unix.so` settings by default. Because I imagine the defaults are what 99% of people use, perhaps this should also do the 'right thing' by default as well and enforce it for PAM when applicable.