From dd2bf634f1fc058d7a713d695f859609f5929edf Mon Sep 17 00:00:00 2001 From: Wesley van Tilburg Date: Mon, 21 Sep 2026 17:57:32 +0200 Subject: [PATCH] fedora-cosmic: add Kanidm Unix authentication Install kanidm-unixd-clients/kanidm-clients, point /etc/kanidm/config at auth.plabble.org, configure unixd (TPM-backed cache, pam_allowed_login_groups), and set up PAM/nsswitch via an authselect custom profile (with a direct-file fallback). Enable kanidm-unixd{,-tasks} and make unconfined_service_t permissive until Kanidm ships an SELinux policy. --- images/fedora-cosmic/custom.yaml | 41 +++++++++++++++++++ images/fedora-cosmic/files/50-kanidm.preset | 3 ++ images/fedora-cosmic/files/kanidm-config | 1 + .../fedora-cosmic/files/kanidm-nsswitch.conf | 14 +++++++ .../fedora-cosmic/files/kanidm-password-auth | 19 +++++++++ images/fedora-cosmic/files/kanidm-system-auth | 20 +++++++++ images/fedora-cosmic/files/kanidm-unixd | 20 +++++++++ 7 files changed, 118 insertions(+) create mode 100644 images/fedora-cosmic/files/50-kanidm.preset create mode 100644 images/fedora-cosmic/files/kanidm-config create mode 100644 images/fedora-cosmic/files/kanidm-nsswitch.conf create mode 100644 images/fedora-cosmic/files/kanidm-password-auth create mode 100644 images/fedora-cosmic/files/kanidm-system-auth create mode 100644 images/fedora-cosmic/files/kanidm-unixd diff --git a/images/fedora-cosmic/custom.yaml b/images/fedora-cosmic/custom.yaml index cebc3a7..bdc88f4 100644 --- a/images/fedora-cosmic/custom.yaml +++ b/images/fedora-cosmic/custom.yaml @@ -23,6 +23,10 @@ packages: - pam-u2f - token2-fido-bridge + # Kanidm Unix authentication (kanidm-unixd-clients pulls kanidm-clients). + - kanidm-unixd-clients + - kanidm-clients + # Firefox is intentionally not part of the base system. It is preinstalled as a # per-user Flatpak on first login instead (see flatpaks.list). exclude-packages: @@ -35,6 +39,13 @@ add-files: - ["flatpaks.list", "/usr/share/flatpak/flatpaks.list"] - ["50-token2-fido-bridge.preset", "/usr/lib/systemd/system-preset/50-token2-fido-bridge.preset"] - ["uhid.conf", "/usr/lib/modules-load.d/uhid.conf"] + # Kanidm client config and authselect profile sources. + - ["kanidm-config", "/etc/kanidm/config"] + - ["kanidm-unixd", "/etc/kanidm/unixd"] + - ["kanidm-system-auth", "/usr/share/fedora-cosmic/authselect/system-auth"] + - ["kanidm-password-auth", "/usr/share/fedora-cosmic/authselect/password-auth"] + - ["kanidm-nsswitch.conf", "/usr/share/fedora-cosmic/authselect/nsswitch.conf"] + - ["50-kanidm.preset", "/usr/lib/systemd/system-preset/50-kanidm.preset"] postprocess: # The upstream fedora.yaml removes the Google Chrome repo from the Fedora @@ -52,3 +63,33 @@ postprocess: set -xeuo pipefail chmod 0755 /usr/libexec/flatpak-user-firstboot systemctl --user --global preset-all + + # Kanidm PAM/nsswitch integration. Prefer an authselect profile; fall back to + # installing the files directly (and dropping the authselect symlinks) if + # authselect is unavailable in the compose environment. + - | + #!/usr/bin/env bash + set -xeuo pipefail + if ! ( + set -euo pipefail + authselect create-profile kanidm -b local + install -m 0644 /usr/share/fedora-cosmic/authselect/system-auth \ + /etc/authselect/custom/kanidm/system-auth + install -m 0644 /usr/share/fedora-cosmic/authselect/password-auth \ + /etc/authselect/custom/kanidm/password-auth + install -m 0644 /usr/share/fedora-cosmic/authselect/nsswitch.conf \ + /etc/authselect/custom/kanidm/nsswitch.conf + authselect select custom/kanidm --force + ); then + echo "authselect setup failed, installing PAM/nsswitch directly" >&2 + rm -f /etc/pam.d/system-auth /etc/pam.d/password-auth /etc/nsswitch.conf + install -m 0644 /usr/share/fedora-cosmic/authselect/system-auth /etc/pam.d/system-auth + install -m 0644 /usr/share/fedora-cosmic/authselect/password-auth /etc/pam.d/password-auth + install -m 0644 /usr/share/fedora-cosmic/authselect/nsswitch.conf /etc/nsswitch.conf + fi + + # Kanidm does not ship an SELinux policy yet; let the unixd daemons run. + - | + #!/usr/bin/env bash + set -xeuo pipefail + semanage permissive -a unconfined_service_t || true diff --git a/images/fedora-cosmic/files/50-kanidm.preset b/images/fedora-cosmic/files/50-kanidm.preset new file mode 100644 index 0000000..aaa3fb5 --- /dev/null +++ b/images/fedora-cosmic/files/50-kanidm.preset @@ -0,0 +1,3 @@ +# Kanidm Unix authentication daemons. +enable kanidm-unixd.service +enable kanidm-unixd-tasks.service diff --git a/images/fedora-cosmic/files/kanidm-config b/images/fedora-cosmic/files/kanidm-config new file mode 100644 index 0000000..78e1c17 --- /dev/null +++ b/images/fedora-cosmic/files/kanidm-config @@ -0,0 +1 @@ +uri = "https://auth.plabble.org" diff --git a/images/fedora-cosmic/files/kanidm-nsswitch.conf b/images/fedora-cosmic/files/kanidm-nsswitch.conf new file mode 100644 index 0000000..c3857f5 --- /dev/null +++ b/images/fedora-cosmic/files/kanidm-nsswitch.conf @@ -0,0 +1,14 @@ +passwd: kanidm compat systemd +group: kanidm compat systemd +shadow: files +hosts: files dns myhostname +services: files +netgroup: files +automount: files +aliases: files +ethers: files +gshadow: files +networks: files dns +protocols: files +publickey: files +rpc: files diff --git a/images/fedora-cosmic/files/kanidm-password-auth b/images/fedora-cosmic/files/kanidm-password-auth new file mode 100644 index 0000000..ea9d379 --- /dev/null +++ b/images/fedora-cosmic/files/kanidm-password-auth @@ -0,0 +1,19 @@ +auth required pam_env.so +auth required pam_faildelay.so delay=2000000 +auth sufficient pam_kanidm.so ignore_unknown_user +auth sufficient pam_unix.so nullok +auth required pam_deny.so + +account sufficient pam_kanidm.so +account required pam_unix.so + +password requisite pam_pwquality.so +password sufficient pam_unix.so yescrypt shadow nullok use_authtok +password required pam_deny.so + +session optional pam_keyinit.so revoke +session required pam_limits.so +-session optional pam_systemd.so +session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid +session optional pam_kanidm.so +session required pam_unix.so diff --git a/images/fedora-cosmic/files/kanidm-system-auth b/images/fedora-cosmic/files/kanidm-system-auth new file mode 100644 index 0000000..41019d3 --- /dev/null +++ b/images/fedora-cosmic/files/kanidm-system-auth @@ -0,0 +1,20 @@ +auth required pam_env.so +auth required pam_faildelay.so delay=2000000 +auth sufficient pam_fprintd.so +auth sufficient pam_kanidm.so ignore_unknown_user +auth sufficient pam_unix.so nullok +auth required pam_deny.so + +account sufficient pam_kanidm.so ignore_unknown_user +account required pam_unix.so + +password requisite pam_pwquality.so +password sufficient pam_unix.so yescrypt shadow nullok use_authtok +password required pam_deny.so + +session optional pam_keyinit.so revoke +session required pam_limits.so +-session optional pam_systemd.so +session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid +session optional pam_kanidm.so +session required pam_unix.so diff --git a/images/fedora-cosmic/files/kanidm-unixd b/images/fedora-cosmic/files/kanidm-unixd new file mode 100644 index 0000000..70608fa --- /dev/null +++ b/images/fedora-cosmic/files/kanidm-unixd @@ -0,0 +1,20 @@ +version = "2" + +# Bind cached credentials to the local TPM when one is available. +hsm_type = "tpm_if_possible" + +default_shell = "/bin/bash" +home_prefix = "/home/" +home_attr = "uuid" +home_alias = "name" +use_etc_skel = true +selinux = true + +[kanidm] +# Members of this Kanidm POSIX group are allowed to log in via PAM. +pam_allowed_login_groups = ["unix_users"] + +# Token for the Kanidm service account used to resolve identities. Provision it +# at /etc/kanidm/unixd_token (a single line) after install, or remove this line +# if the server permits anonymous reads. +service_account_token_path = "/etc/kanidm/unixd_token"