Why is pam_unix required, even if unixAuth = false

[Rudi9719]

This is more of a proposal/question than an actual pull request. Not sure how to actually test it!

Motivation for this change

I was unable to set security.pam.services.sshd.unixAuth to false, and was having issues with SDDM/SSSD previously #94744 then I noticed no matter what, pam_unix.so was marked as required. Even if unixAuth = false.

Things done

Wrapped all * required pam_unix.so in optionalString's based on other lines I saw in this file. Not sure if that would fix my problem or not, hoping someone who knows more about NixOS could weigh in. I'd also like to note that SSSD worked with SSH/Console log in out of the box when I opened #94744 and are now both borked for some reason.

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[flokli]

Our whole PAM situation is in dire need of a refactor, and much more tests.

See #90490 (comment) for pointers and #90640 for details.

I'm pretty sure there are some interesting corner cases not handled properly.

[Rudi9719]

@flokli what would you suggest? I'm not sure how exactly to help, as it apparently the tests didn't like what I tried to do

[stale]

I marked this as stale due to inactivity. → More info

[Janik-Haag]

@Rudi9719 are you still interested in fixing this and getting it merged? I will close it in a few weeks if you aren't anymore.

[Janik-Haag]

I'll close this since @Rudi9719 seems to be mostly inactive. Feel free to reopen it or do a new one as soon as you have to again :D

Still thank you for your contribution

[Rudi9719]

I had to switch to a more stable distro and haven't had time to circle back and test updates- this branch is probably outdated

[Janik-Haag]

as I said feel free to reopen as soon as you have time to work on it again :D