gnu/services/authentication.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2018 Danny Milosavljevic <dannym@scratchpost.org>
   3 ;;; Copyright © 2018, 2019 Ricardo Wurmus <rekado@elephly.net>
   4 ;;;
   5 ;;; This file is part of GNU Guix.
   6 ;;;
   7 ;;; GNU Guix is free software; you can redistribute it and/or modify it
   8 ;;; under the terms of the GNU General Public License as published by
   9 ;;; the Free Software Foundation; either version 3 of the License, or (at
  10 ;;; your option) any later version.
  11 ;;;
  12 ;;; GNU Guix is distributed in the hope that it will be useful, but
  13 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  14 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 ;;; GNU General Public License for more details.
  16 ;;;
  17 ;;; You should have received a copy of the GNU General Public License
  18 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  19
  20 (define-module (gnu services authentication)
  21   #:use-module (gnu services)
  22   #:use-module (gnu services base)
  23   #:use-module (gnu services configuration)
  24   #:use-module (gnu services dbus)
  25   #:use-module (gnu services shepherd)
  26   #:use-module (gnu system pam)
  27   #:use-module (gnu system shadow)
  28   #:use-module (gnu packages admin)
  29   #:use-module (gnu packages freedesktop)
  30   #:use-module (gnu packages openldap)
  31   #:use-module (guix gexp)
  32   #:use-module (guix records)
  33   #:use-module (guix packages)
  34   #:use-module (ice-9 match)
  35   #:use-module (srfi srfi-1)
  36   #:use-module (srfi srfi-26)
  37   #:export (fprintd-configuration
  38             fprintd-configuration?
  39             fprintd-service-type
  40
  41             nslcd-configuration
  42             nslcd-configuration?
  43             nslcd-service-type))
  44
  45 (define-record-type* <fprintd-configuration>
  46   fprintd-configuration make-fprintd-configuration
  47   fprintd-configuration?
  48   (ntp      fprintd-configuration-fprintd
  49             (default fprintd)))
  50
  51 (define fprintd-service-type
  52   (service-type (name 'fprintd)
  53                 (extensions
  54                  (list (service-extension dbus-root-service-type
  55                                           list)))
  56                 (description
  57                  "Run fprintd, a fingerprint management daemon.")))
  58
  59 \f
  60 ;;;
  61 ;;; NSS Pam LDAP service (nslcd)
  62 ;;;
  63
  64 (define (uglify-field-name name)
  65   (match name
  66     ('filters "filter")
  67     ('maps "map")
  68     (_ (string-map (match-lambda
  69                      (#\- #\_)
  70                      (chr chr))
  71                    (symbol->string name)))))
  72
  73 (define (value->string val)
  74   (cond
  75    ((boolean? val)
  76     (if val "on" "off"))
  77    ((number? val)
  78     (number->string val))
  79    ((symbol? val)
  80     (string-map (match-lambda
  81                      (#\- #\_)
  82                      (chr chr))
  83                    (symbol->string val)))
  84    (else val)))
  85
  86 (define (serialize-field field-name val)
  87   (if (eq? field-name 'pam-services)
  88       #t
  89       (format #t "~a ~a\n"
  90               (uglify-field-name field-name)
  91               (value->string val))))
  92
  93 (define serialize-string serialize-field)
  94 (define serialize-boolean serialize-field)
  95 (define serialize-number serialize-field)
  96 (define (serialize-list field-name val)
  97   (map (cut serialize-field field-name <>) val))
  98 (define-maybe string)
  99 (define-maybe boolean)
 100 (define-maybe number)
 101
 102 (define (ssl-option? val)
 103   (or (boolean? val)
 104       (eq? val 'start-tls)))
 105 (define serialize-ssl-option serialize-field)
 106 (define-maybe ssl-option)
 107
 108 (define (tls-reqcert-option? val)
 109   (member val '(never allow try demand hard)))
 110 (define serialize-tls-reqcert-option serialize-field)
 111 (define-maybe tls-reqcert-option)
 112
 113 (define (deref-option? val)
 114   (member val '(never searching finding always)))
 115 (define serialize-deref-option serialize-field)
 116 (define-maybe deref-option)
 117
 118 (define (comma-separated-list-of-strings? val)
 119   (and (list? val)
 120        (every string? val)))
 121 (define (ignore-users-option? val)
 122   (or (comma-separated-list-of-strings? val)
 123       (eq? 'all-local val)))
 124 (define (serialize-ignore-users-option field-name val)
 125   (serialize-field field-name (if (eq? 'all-local val)
 126                                   val
 127                                   (string-join val ","))))
 128 (define-maybe ignore-users-option)
 129
 130 (define (log-option? val)
 131   (let ((valid-scheme? (lambda (scheme)
 132                          (or (string? scheme)
 133                              (member scheme '(none syslog))))))
 134     (match val
 135       ((scheme level)
 136        (and (valid-scheme? scheme)
 137             (member level '(crit error warning notice info debug))))
 138       ((scheme)
 139        (valid-scheme? scheme)))))
 140 (define (serialize-log-option field-name val)
 141   (serialize-field field-name
 142                    (string-join (map (cut format #f "~a" <>) val))))
 143
 144 (define (valid-map? val)
 145   "Is VAL a supported map name?"
 146   (member val
 147           '(alias aliases ether ethers group host hosts netgroup network networks
 148             passwd protocol protocols rpc service services shadow)))
 149
 150 (define (scope-option? val)
 151   (let ((valid-scopes '(subtree onelevel base children)))
 152     (match val
 153       ((map-name scope)
 154        (and (valid-map? map-name)
 155             (member scope valid-scopes)))
 156       ((scope)
 157        (member scope valid-scopes)))))
 158 (define (serialize-scope-option field-name val)
 159   (serialize-field field-name
 160                    (string-join (map (cut format #f "~a" <>) val))))
 161
 162 (define (map-entry? val)
 163   (match val
 164     (((? valid-map? map-name)
 165       (? string? attribute)
 166       (? string? new-attribute)) #t)
 167     (_ #f)))
 168
 169 (define (list-of-map-entries? val)
 170   (and (list? val)
 171        (every map-entry? val)))
 172
 173 (define (filter-entry? val)
 174   (match val
 175     (((? valid-map? map-name)
 176       (? string? filter-expression)) #t)
 177     (_ #f)))
 178
 179 (define (list-of-filter-entries? val)
 180   (and (list? val)
 181        (every filter-entry? val)))
 182
 183 (define (serialize-filter-entry field-name val)
 184   (serialize-field 'filter
 185                    (match val
 186                      (((? valid-map? map-name)
 187                        (? string? filter-expression))
 188                       (string-append (symbol->string map-name)
 189                                      " " filter-expression)))))
 190
 191 (define (serialize-list-of-filter-entries field-name val)
 192   (for-each (cut serialize-filter-entry field-name <>) val))
 193
 194 (define (serialize-map-entry field-name val)
 195   (serialize-field 'map
 196                    (match val
 197                      (((? valid-map? map-name)
 198                        (? string? attribute)
 199                        (? string? new-attribute))
 200                       (string-append (symbol->string map-name)
 201                                      " " attribute
 202                                      " " new-attribute)))))
 203
 204 (define (serialize-list-of-map-entries field-name val)
 205   (for-each (cut serialize-map-entry field-name <>) val))
 206
 207 \f
 208 (define-configuration nslcd-configuration
 209   (nss-pam-ldapd
 210    (package nss-pam-ldapd)
 211    "The NSS-PAM-LDAPD package to use.")
 212
 213   ;; Runtime options
 214   (threads
 215    (maybe-number 'disabled)
 216    "The number of threads to start that can handle requests and perform LDAP
 217 queries.  Each thread opens a separate connection to the LDAP server.  The
 218 default is to start 5 threads.")
 219   (uid
 220    (string "nslcd")
 221    "This specifies the user id with which the daemon should be run.")
 222   (gid
 223    (string "nslcd")
 224    "This specifies the group id with which the daemon should be run.")
 225   (log
 226    (log-option '("/var/log/nslcd" info))
 227    "This option controls the way logging is done via a list containing SCHEME
 228 and LEVEL.  The SCHEME argument may either be the symbols \"none\" or
 229 \"syslog\", or an absolute file name.  The LEVEL argument is optional and
 230 specifies the log level.  The log level may be one of the following symbols:
 231 \"crit\", \"error\", \"warning\", \"notice\", \"info\" or \"debug\".  All
 232 messages with the specified log level or higher are logged.")
 233
 234   ;; LDAP connection settings
 235   (uri
 236    (list '("ldap://localhost:389/"))
 237    "The list of LDAP server URIs.  Normally, only the first server will be
 238 used with the following servers as fall-back.")
 239   (ldap-version
 240    (maybe-string 'disabled)
 241    "The version of the LDAP protocol to use.  The default is to use the
 242 maximum version supported by the LDAP library.")
 243   (binddn
 244    (maybe-string 'disabled)
 245    "Specifies the distinguished name with which to bind to the directory
 246 server for lookups.  The default is to bind anonymously.")
 247   (bindpw
 248    (maybe-string 'disabled)
 249    "Specifies the credentials with which to bind.  This option is only
 250 applicable when used with binddn.")
 251   (rootpwmoddn
 252    (maybe-string 'disabled)
 253    "Specifies the distinguished name to use when the root user tries to modify
 254 a user's password using the PAM module.")
 255   (rootpwmodpw
 256    (maybe-string 'disabled)
 257    "Specifies the credentials with which to bind if the root user tries to
 258 change a user's password.  This option is only applicable when used with
 259 rootpwmoddn")
 260
 261   ;; SASL authentication options
 262   (sasl-mech
 263    (maybe-string 'disabled)
 264    "Specifies the SASL mechanism to be used when performing SASL
 265 authentication.")
 266   (sasl-realm
 267    (maybe-string 'disabled)
 268    "Specifies the SASL realm to be used when performing SASL authentication.")
 269   (sasl-authcid
 270    (maybe-string 'disabled)
 271    "Specifies the authentication identity to be used when performing SASL
 272 authentication.")
 273   (sasl-authzid
 274    (maybe-string 'disabled)
 275    "Specifies the authorization identity to be used when performing SASL
 276 authentication.")
 277   (sasl-canonicalize?
 278    (maybe-boolean 'disabled)
 279    "Determines whether the LDAP server host name should be canonicalised.  If
 280 this is enabled the LDAP library will do a reverse host name lookup.  By
 281 default, it is left up to the LDAP library whether this check is performed or
 282 not.")
 283
 284   ;; Kerberos authentication options
 285   (krb5-ccname
 286    (maybe-string 'disabled)
 287    "Set the name for the GSS-API Kerberos credentials cache.")
 288
 289   ;; Search / mapping options
 290   (base
 291    (string "dc=example,dc=com")
 292    "The directory search base.")
 293   (scope
 294    (scope-option '(subtree))
 295    "Specifies the search scope (subtree, onelevel, base or children).  The
 296 default scope is subtree; base scope is almost never useful for name service
 297 lookups; children scope is not supported on all servers.")
 298   (deref
 299    (maybe-deref-option 'disabled)
 300    "Specifies the policy for dereferencing aliases.  The default policy is to
 301 never dereference aliases.")
 302   (referrals
 303    (maybe-boolean 'disabled)
 304    "Specifies whether automatic referral chasing should be enabled.  The
 305 default behaviour is to chase referrals.")
 306   (maps
 307    (list-of-map-entries '())
 308    "This option allows for custom attributes to be looked up instead of the
 309 default RFC 2307 attributes.  It is a list of maps, each consisting of the
 310 name of a map, the RFC 2307 attribute to match and the query expression for
 311 the attribute as it is available in the directory.")
 312   (filters
 313    (list-of-filter-entries '())
 314    "A list of filters consisting of the name of a map to which the filter
 315 applies and an LDAP search filter expression.")
 316
 317   ;; Timing / reconnect options
 318   (bind-timelimit
 319    (maybe-number 'disabled)
 320    "Specifies the time limit in seconds to use when connecting to the
 321 directory server.  The default value is 10 seconds.")
 322   (timelimit
 323    (maybe-number 'disabled)
 324    "Specifies the time limit (in seconds) to wait for a response from the LDAP
 325 server.  A value of zero, which is the default, is to wait indefinitely for
 326 searches to be completed.")
 327   (idle-timelimit
 328    (maybe-number 'disabled)
 329    "Specifies the period if inactivity (in seconds) after which the con‐
 330 nection to the LDAP server will be closed.  The default is not to time out
 331 connections.")
 332   (reconnect-sleeptime
 333    (maybe-number 'disabled)
 334    "Specifies the number of seconds to sleep when connecting to all LDAP
 335 servers fails.  By default one second is waited between the first failure and
 336 the first retry.")
 337   (reconnect-retrytime
 338    (maybe-number 'disabled)
 339    "Specifies the time after which the LDAP server is considered to be
 340 permanently unavailable.  Once this time is reached retries will be done only
 341 once per this time period.  The default value is 10 seconds.")
 342
 343   ;; TLS options
 344   (ssl
 345    (maybe-ssl-option 'disabled)
 346    "Specifies whether to use SSL/TLS or not (the default is not to).  If
 347 'start-tls is specified then StartTLS is used rather than raw LDAP over SSL.")
 348   (tls-reqcert
 349    (maybe-tls-reqcert-option 'disabled)
 350    "Specifies what checks to perform on a server-supplied certificate.
 351 The meaning of the values is described in the ldap.conf(5) manual page.")
 352   (tls-cacertdir
 353    (maybe-string 'disabled)
 354    "Specifies the directory containing X.509 certificates for peer authen‐
 355 tication.  This parameter is ignored when using GnuTLS.")
 356   (tls-cacertfile
 357    (maybe-string 'disabled)
 358    "Specifies the path to the X.509 certificate for peer authentication.")
 359   (tls-randfile
 360    (maybe-string 'disabled)
 361    "Specifies the path to an entropy source.  This parameter is ignored when
 362 using GnuTLS.")
 363   (tls-ciphers
 364    (maybe-string 'disabled)
 365    "Specifies the ciphers to use for TLS as a string.")
 366   (tls-cert
 367    (maybe-string 'disabled)
 368    "Specifies the path to the file containing the local certificate for client
 369 TLS authentication.")
 370   (tls-key
 371    (maybe-string 'disabled)
 372    "Specifies the path to the file containing the private key for client TLS
 373 authentication.")
 374
 375   ;; Other options
 376   (pagesize
 377    (maybe-number 'disabled)
 378    "Set this to a number greater than 0 to request paged results from the LDAP
 379 server in accordance with RFC2696.  The default (0) is to not request paged
 380 results.")
 381   (nss-initgroups-ignoreusers
 382    (maybe-ignore-users-option 'disabled)
 383    "This option prevents group membership lookups through LDAP for the
 384 specified users.  Alternatively, the value 'all-local may be used.  With that
 385 value nslcd builds a full list of non-LDAP users on startup.")
 386   (nss-min-uid
 387    (maybe-number 'disabled)
 388    "This option ensures that LDAP users with a numeric user id lower than the
 389 specified value are ignored.")
 390   (nss-uid-offset
 391    (maybe-number 'disabled)
 392    "This option specifies an offset that is added to all LDAP numeric user
 393 ids.  This can be used to avoid user id collisions with local users.")
 394   (nss-gid-offset
 395    (maybe-number 'disabled)
 396    "This option specifies an offset that is added to all LDAP numeric group
 397 ids.  This can be used to avoid user id collisions with local groups.")
 398   (nss-nested-groups
 399    (maybe-boolean 'disabled)
 400    "If this option is set, the member attribute of a group may point to
 401 another group.  Members of nested groups are also returned in the higher level
 402 group and parent groups are returned when finding groups for a specific user.
 403 The default is not to perform extra searches for nested groups.")
 404   (nss-getgrent-skipmembers
 405    (maybe-boolean 'disabled)
 406    "If this option is set, the group member list is not retrieved when looking
 407 up groups.  Lookups for finding which groups a user belongs to will remain
 408 functional so the user will likely still get the correct groups assigned on
 409 login.")
 410   (nss-disable-enumeration
 411    (maybe-boolean 'disabled)
 412    "If this option is set, functions which cause all user/group entries to be
 413 loaded from the directory will not succeed in doing so.  This can dramatically
 414 reduce LDAP server load in situations where there are a great number of users
 415 and/or groups.  This option is not recommended for most configurations.")
 416   (validnames
 417    (maybe-string 'disabled)
 418    "This option can be used to specify how user and group names are verified
 419 within the system.  This pattern is used to check all user and group names
 420 that are requested and returned from LDAP.")
 421   (ignorecase
 422    (maybe-boolean 'disabled)
 423    "This specifies whether or not to perform searches using case-insensitive
 424 matching.  Enabling this could open up the system to authorization bypass
 425 vulnerabilities and introduce nscd cache poisoning vulnerabilities which allow
 426 denial of service.")
 427   (pam-authc-ppolicy
 428    (maybe-boolean 'disabled)
 429    "This option specifies whether password policy controls are requested and
 430 handled from the LDAP server when performing user authentication.")
 431   (pam-authc-search
 432    (maybe-string 'disabled)
 433    "By default nslcd performs an LDAP search with the user's credentials after
 434 BIND (authentication) to ensure that the BIND operation was successful.  The
 435 default search is a simple check to see if the user's DN exists.  A search
 436 filter can be specified that will be used instead.  It should return at least
 437 one entry.")
 438   (pam-authz-search
 439    (maybe-string 'disabled)
 440    "This option allows flexible fine tuning of the authorisation check that
 441 should be performed.  The search filter specified is executed and if any
 442 entries match, access is granted, otherwise access is denied.")
 443   (pam-password-prohibit-message
 444    (maybe-string 'disabled)
 445    "If this option is set password modification using pam_ldap will be denied
 446 and the specified message will be presented to the user instead.  The message
 447 can be used to direct the user to an alternative means of changing their
 448 password.")
 449
 450   ;; Options for extension of pam-root-service-type.
 451   (pam-services
 452    (list '())
 453    "List of pam service names for which LDAP authentication should suffice."))
 454
 455 (define %nslcd-accounts
 456   (list (user-group
 457          (name "nslcd")
 458          (system? #t))
 459         (user-account
 460          (name "nslcd")
 461          (group "nslcd")
 462          (comment "NSLCD service account")
 463          (home-directory "/var/empty")
 464          (shell (file-append shadow "/sbin/nologin"))
 465          (system? #t))))
 466
 467 (define (nslcd-config-file config)
 468   "Return an NSLCD configuration file."
 469   (plain-file "nslcd.conf"
 470               (with-output-to-string
 471                 (lambda ()
 472                   (serialize-configuration config nslcd-configuration-fields)
 473                   ;; The file must end with a newline character.
 474                   (format #t "\n")))))
 475
 476 ;; XXX: The file should only be readable by root if it contains a "bindpw"
 477 ;; declaration.  Unfortunately, this etc-service-type extension does not
 478 ;; support setting file modes, so we do this in the activation service.
 479 (define (nslcd-etc-service config)
 480   `(("nslcd.conf" ,(nslcd-config-file config))))
 481
 482 (define (nslcd-shepherd-service config)
 483   (list (shepherd-service
 484          (documentation "Run the nslcd service for resolving names from LDAP.")
 485          (provision '(nslcd))
 486          (requirement '(networking user-processes))
 487          (start #~(make-forkexec-constructor
 488                    (list (string-append #$(nslcd-configuration-nss-pam-ldapd config)
 489                                         "/sbin/nslcd")
 490                          "--nofork")
 491                    #:pid-file "/var/run/nslcd/nslcd.pid"
 492                    #:environment-variables
 493                    (list (string-append "LD_LIBRARY_PATH="
 494                                         #$(nslcd-configuration-nss-pam-ldapd config)
 495                                         "/lib"))))
 496          (stop #~(make-kill-destructor)))))
 497
 498 (define (pam-ldap-pam-service config)
 499   "Return a PAM service for LDAP authentication."
 500   (define pam-ldap-module
 501     #~(string-append #$(nslcd-configuration-nss-pam-ldapd config)
 502                      "/lib/security/pam_ldap.so"))
 503   (lambda (pam)
 504     (if (member (pam-service-name pam)
 505                 (nslcd-configuration-pam-services config))
 506         (let ((sufficient
 507                (pam-entry
 508                 (control "sufficient")
 509                 (module pam-ldap-module))))
 510           (pam-service
 511            (inherit pam)
 512            (auth (cons sufficient (pam-service-auth pam)))
 513            (session (cons sufficient (pam-service-session pam)))
 514            (account (cons sufficient (pam-service-account pam)))))
 515         pam)))
 516
 517 (define (pam-ldap-pam-services config)
 518   (list (pam-ldap-pam-service config)))
 519
 520 (define nslcd-service-type
 521   (service-type
 522    (name 'nslcd)
 523    (description "Run the NSLCD service for looking up names from LDAP.")
 524    (extensions
 525     (list (service-extension account-service-type
 526                              (const %nslcd-accounts))
 527           (service-extension etc-service-type
 528                              nslcd-etc-service)
 529           (service-extension activation-service-type
 530                              (const #~(begin
 531                                         (use-modules (guix build utils))
 532                                         (let ((rundir "/var/run/nslcd")
 533                                               (user (getpwnam "nslcd")))
 534                                           (mkdir-p rundir)
 535                                           (chown rundir (passwd:uid user) (passwd:gid user))
 536                                           (chmod rundir #o755)
 537                                           (when (file-exists? "/etc/nslcd.conf")
 538                                             (chmod "/etc/nslcd.conf" #o400))))))
 539           (service-extension pam-root-service-type
 540                              pam-ldap-pam-services)
 541           (service-extension nscd-service-type
 542                              (const (list nss-pam-ldapd)))
 543           (service-extension shepherd-root-service-type
 544                              nslcd-shepherd-service)))
 545    (default-value (nslcd-configuration))))
 546
 547 (define (generate-nslcd-documentation)
 548   (generate-documentation
 549    `((nslcd-configuration ,nslcd-configuration-fields))
 550    'nslcd-configuration))