fedora-cosmic: add Kanidm Unix authentication

Install kanidm-unixd-clients/kanidm-clients, point /etc/kanidm/config at auth.plabble.org, configure unixd (TPM-backed cache, pam_allowed_login_groups), and set up PAM/nsswitch via an authselect custom profile (with a direct-file fallback). Enable kanidm-unixd{,-tasks} and make unconfined_service_t permissive until Kanidm ships an SELinux policy.
2026-09-21 17:57:32 +02:00
parent de5b0f143a
commit dd2bf634f1
7 changed files with 118 additions and 0 deletions
@@ -0,0 +1,3 @@
+# Kanidm Unix authentication daemons.
+enable kanidm-unixd.service
+enable kanidm-unixd-tasks.service
@@ -0,0 +1 @@
+uri = "https://auth.plabble.org"
@@ -0,0 +1,14 @@
+passwd:     kanidm compat systemd
+group:      kanidm compat systemd
+shadow:     files
+hosts:      files dns myhostname
+services:   files
+netgroup:   files
+automount:  files
+aliases:    files
+ethers:     files
+gshadow:    files
+networks:   files dns
+protocols:  files
+publickey:  files
+rpc:        files
@@ -0,0 +1,19 @@
+auth        required                                     pam_env.so
+auth        required                                     pam_faildelay.so delay=2000000
+auth        sufficient                                   pam_kanidm.so ignore_unknown_user
+auth        sufficient                                   pam_unix.so nullok
+auth        required                                     pam_deny.so
+
+account     sufficient                                   pam_kanidm.so
+account     required                                     pam_unix.so
+
+password    requisite                                    pam_pwquality.so
+password    sufficient                                   pam_unix.so yescrypt shadow nullok use_authtok
+password    required                                     pam_deny.so
+
+session     optional                                     pam_keyinit.so revoke
+session     required                                     pam_limits.so
+-session    optional                                     pam_systemd.so
+session     [success=1 default=ignore]                   pam_succeed_if.so service in crond quiet use_uid
+session     optional                                     pam_kanidm.so
+session     required                                     pam_unix.so
@@ -0,0 +1,20 @@
+auth        required                                     pam_env.so
+auth        required                                     pam_faildelay.so delay=2000000
+auth        sufficient                                   pam_fprintd.so
+auth        sufficient                                   pam_kanidm.so ignore_unknown_user
+auth        sufficient                                   pam_unix.so nullok
+auth        required                                     pam_deny.so
+
+account     sufficient                                   pam_kanidm.so ignore_unknown_user
+account     required                                     pam_unix.so
+
+password    requisite                                    pam_pwquality.so
+password    sufficient                                   pam_unix.so yescrypt shadow nullok use_authtok
+password    required                                     pam_deny.so
+
+session     optional                                     pam_keyinit.so revoke
+session     required                                     pam_limits.so
+-session    optional                                     pam_systemd.so
+session     [success=1 default=ignore]                   pam_succeed_if.so service in crond quiet use_uid
+session     optional                                     pam_kanidm.so
+session     required                                     pam_unix.so
@@ -0,0 +1,20 @@
+version = "2"
+
+# Bind cached credentials to the local TPM when one is available.
+hsm_type = "tpm_if_possible"
+
+default_shell = "/bin/bash"
+home_prefix = "/home/"
+home_attr = "uuid"
+home_alias = "name"
+use_etc_skel = true
+selinux = true
+
+[kanidm]
+# Members of this Kanidm POSIX group are allowed to log in via PAM.
+pam_allowed_login_groups = ["unix_users"]
+
+# Token for the Kanidm service account used to resolve identities. Provision it
+# at /etc/kanidm/unixd_token (a single line) after install, or remove this line
+# if the server permits anonymous reads.
+service_account_token_path = "/etc/kanidm/unixd_token"