duosec: fix module [20.03]

[aanderse]

Motivation for this change

#86852

@reanimus I'm looking to you for all testing relating to this. Also a big FYI you probably shouldn't be using this module from 20.03 or before as it leaks sensitive data into the nix store. I would highly suggest cherry picking this module from 20.09 (current unstable).

If I had to guess I would wonder if #63103 was the culprit for the error you experienced... but I'm not going to spend any time investigating or thinking about it as this is a non issue in master 🤷‍♂️

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[reanimus]

it leaks sensitive data into the nix store

oh dear. how do i go about backporting this module?

[aanderse]

@reanimus as long as you only use this on a single user machine with either an encrypted drive (or physically secure) you shouldn't need to worry too much... but in any other scenario see https://nixos.org/nixos/manual/index.html#sec-replace-modules

Specifically:

imports = [ <nixos-unstable/nixos/modules/security/duosec.nix> ];
disabledModules = [ "modules/security/duosec.nix" ];

Regardless... can I get you to test this so I can merge? 😄

[reanimus]

@aanderse it's an internet-facing server so I'd prefer to be safe. thanks for the heads up.

I just tested nixos-rebuild build with your branch and it no longer errors out. I checked result/etc/duo/pam_duo.conf and it has the expected content.

This looks fine. I'll see about cherry-picking the module now. Thanks!

[rnhmjoj]

Uhm, loginCfgFile is an attrset but the optional here is producing a list. It shouldn't be an error yet: loaOf is deprecated but it should just raise a warning, not sure what's going on here.
In any case this is the proper fix for the future removal of loaOf.

[aanderse]

Yeah... wild stab in the dark. Not worth effort as master is different anyways. Thanks for taking a look!