fedora-cosmic: add Kanidm Unix authentication

Install kanidm-unixd-clients/kanidm-clients, point /etc/kanidm/config at auth.plabble.org, configure unixd (TPM-backed cache, pam_allowed_login_groups), and set up PAM/nsswitch via an authselect custom profile (with a direct-file fallback). Enable kanidm-unixd{,-tasks} and make unconfined_service_t permissive until Kanidm ships an SELinux policy.
2026-09-21 17:57:32 +02:00
parent de5b0f143a
commit dd2bf634f1
7 changed files with 118 additions and 0 deletions
@@ -0,0 +1,19 @@
+auth        required                                     pam_env.so
+auth        required                                     pam_faildelay.so delay=2000000
+auth        sufficient                                   pam_kanidm.so ignore_unknown_user
+auth        sufficient                                   pam_unix.so nullok
+auth        required                                     pam_deny.so
+
+account     sufficient                                   pam_kanidm.so
+account     required                                     pam_unix.so
+
+password    requisite                                    pam_pwquality.so
+password    sufficient                                   pam_unix.so yescrypt shadow nullok use_authtok
+password    required                                     pam_deny.so
+
+session     optional                                     pam_keyinit.so revoke
+session     required                                     pam_limits.so
+-session    optional                                     pam_systemd.so
+session     [success=1 default=ignore]                   pam_succeed_if.so service in crond quiet use_uid
+session     optional                                     pam_kanidm.so
+session     required                                     pam_unix.so