fix(mail,nb): keep pam_krb5 out of the PAM stack #274

Merged

dominik.polakovics merged 1 commit from lab/20260807-0936 into main

2026-08-07 16:15:31 +02:00

dominik.polakovics commented

2026-08-07 16:12:31 +02:00

Owner

security.pam.krb5.enable defaults to security.krb5.enable, so enabling the Kerberos client config on mail (#267) and nb (#269) also injected pam_krb5 into every PAM stack on both hosts. #271 caught this on web-arm and opted out there; these two were missed.

nb: an off-VPN login stalls while pam_krb5 tries to reach the KDC before falling through to pam_unix — the offline case #269 explicitly set out to keep working. Redundant too: SSSD's auth_provider = krb5 already does the Kerberos auth and puts the ticket in KCM.
mail: opens an auth path where a local account matching a principal could log in with its Kerberos password, on the host holding the KDC and the directory.

Two lines plus comments; no behaviour change beyond removing pam_krb5.

The pre-commit dry-build did not run for this commit. The shared hook symlink in the bare repo pointed at worktrees/cloonar-nixos-271, which was removed when that PR's worktree was torn down, so git skipped a dangling hook silently. This sandbox also has no nix, so I could not run it manually. The option name is proven — hosts/web-arm/modules/keycloak/default.nix:106 uses it and that host dry-built in #272 — but mail and nb have not been evaluated with this change. Worth a local scripts/test-configuration mail and nb before merging.

Closes #273

`security.pam.krb5.enable` defaults to `security.krb5.enable`, so enabling the Kerberos client config on `mail` (#267) and `nb` (#269) also injected pam_krb5 into every PAM stack on both hosts. #271 caught this on `web-arm` and opted out there; these two were missed. - **`nb`:** an off-VPN login stalls while pam_krb5 tries to reach the KDC before falling through to `pam_unix` — the offline case #269 explicitly set out to keep working. Redundant too: SSSD's `auth_provider = krb5` already does the Kerberos auth and puts the ticket in KCM. - **`mail`:** opens an auth path where a local account matching a principal could log in with its Kerberos password, on the host holding the KDC and the directory. Two lines plus comments; no behaviour change beyond removing pam_krb5. **The pre-commit dry-build did not run for this commit.** The shared hook symlink in the bare repo pointed at `worktrees/cloonar-nixos-271`, which was removed when that PR's worktree was torn down, so git skipped a dangling hook silently. This sandbox also has no `nix`, so I could not run it manually. The option name is proven — `hosts/web-arm/modules/keycloak/default.nix:106` uses it and that host dry-built in #272 — but `mail` and `nb` have not been evaluated with this change. Worth a local `scripts/test-configuration mail` and `nb` before merging. Closes #273

dominik.polakovics added 1 commit

2026-08-07 16:12:31 +02:00

fix(mail,nb): keep pam_krb5 out of the PAM stack 35076fe8e7

security.pam.krb5.enable defaults to security.krb5.enable, so enabling the
Kerberos client config on mail and nb also injected pam_krb5 into every PAM
stack on both hosts. web-arm already opts out; these two did not.

On nb an off-VPN login stalls while pam_krb5 tries to reach the KDC before
falling through to pam_unix, and it duplicates SSSD's auth_provider = krb5.
On mail it opens an auth path where a local account matching a principal
could log in with its Kerberos password.

dominik.polakovics merged commit 29d1c627c3 into main

2026-08-07 16:15:31 +02:00

dominik.polakovics deleted branch lab/20260807-0936

2026-08-07 16:15:31 +02:00

dominik.polakovics referenced this pull request from a commit

2026-08-07 16:15:32 +02:00

Merge pull request 'fix(mail,nb): keep pam_krb5 out of the PAM stack' (#274) from lab/20260807-0936 into main

dominik.polakovics referenced this pull request

2026-08-07 16:34:55 +02:00

feat(nb): declare the LDAP account so SDDM can offer it #276