From 82ccc499f7262982beb2da9827d5706967a334f0 Mon Sep 17 00:00:00 2001 From: Carlo Zancanaro Date: Sun, 19 Feb 2017 10:32:58 +1100 Subject: services: Add exim-service-type. * gnu/services/mail.scm (): New record type. (exim-computed-config-file, exim-shepherd-service, exim-activation, exim-etc, exim-profile): New procedures. (exim-service-type, %exim-accounts): New variables. * doc/guix.text (Mail Services): Document it. Signed-off-by: Ludovic Courtès --- gnu/services/mail.scm | 102 +++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 101 insertions(+), 1 deletion(-) (limited to 'gnu/services') diff --git a/gnu/services/mail.scm b/gnu/services/mail.scm index 30b1672d3..b211ab61a 100644 --- a/gnu/services/mail.scm +++ b/gnu/services/mail.scm @@ -1,6 +1,7 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2015 Andy Wingo ;;; Copyright © 2017 Clément Lassieur +;;; Copyright © 2017 Carlo Zancanaro ;;; ;;; This file is part of GNU Guix. ;;; @@ -33,6 +34,7 @@ #:use-module (guix packages) #:use-module (guix gexp) #:use-module (ice-9 match) + #:use-module (ice-9 format) #:export (dovecot-service dovecot-service-type dovecot-configuration @@ -53,7 +55,12 @@ opensmtpd-configuration opensmtpd-configuration? opensmtpd-service-type - %default-opensmtpd-config-file)) + %default-opensmtpd-config-file + + exim-configuration + exim-configuration? + exim-service-type + %default-exim-config-file)) ;;; Commentary: ;;; @@ -1620,3 +1627,96 @@ accept from local for any relay (compose list opensmtpd-configuration-package)) (service-extension shepherd-root-service-type opensmtpd-shepherd-service))))) + + +;;; +;;; Exim. +;;; + +(define-record-type* exim-configuration + make-exim-configuration + exim-configuration? + (package exim-configuration-package ; + (default exim)) + (config-file exim-configuration-config-file ;file-like + (default #f)) + (aliases exim-configuration-aliases ;; list of lists + (default '()))) + +(define %exim-accounts + (list (user-group + (name "exim") + (system? #t)) + (user-account + (name "exim") + (group "exim") + (system? #t) + (comment "Exim Daemon") + (home-directory "/var/empty") + (shell (file-append shadow "/sbin/nologin"))))) + +(define (exim-computed-config-file package config-file) + (computed-file "exim.conf" + #~(call-with-output-file #$output + (lambda (port) + (format port " +exim_user = exim +exim_group = exim +.include ~a" + #$(or config-file + (file-append package "/etc/exim.conf"))))))) + +(define exim-shepherd-service + (match-lambda + (($ package config-file aliases) + (list (shepherd-service + (provision '(exim mta)) + (documentation "Run the exim daemon.") + (requirement '(networking)) + (start #~(make-forkexec-constructor + '(#$(file-append package "/bin/exim") + "-bd" "-v" "-C" + #$(exim-computed-config-file package config-file)))) + (stop #~(make-kill-destructor))))))) + +(define exim-activation + (match-lambda + (($ package config-file aliases) + (with-imported-modules '((guix build utils)) + #~(begin + (use-modules (guix build utils)) + + (let ((uid (passwd:uid (getpw "exim"))) + (gid (group:gid (getgr "exim")))) + (mkdir-p "/var/spool/exim") + (chown "/var/spool/exim" uid gid)) + + (zero? (system* #$(file-append package "/bin/exim") + "-bV" "-C" #$(exim-computed-config-file package config-file)))))))) + +(define exim-etc + (match-lambda + (($ package config-file aliases) + `(("aliases" ,(plain-file "aliases" + ;; Ideally we'd use a format string like + ;; "~:{~a: ~{~a~^,~}\n~}", but it gives a + ;; warning that I can't figure out how to fix, + ;; so we'll just use string-join below instead. + (format #f "~:{~a: ~a\n~}" + (map (lambda (entry) + (list (car entry) + (string-join (cdr entry) ","))) + aliases)))))))) + +(define exim-profile + (compose list exim-configuration-package)) + +(define exim-service-type + (service-type + (name 'exim) + (extensions + (list (service-extension shepherd-root-service-type exim-shepherd-service) + (service-extension account-service-type (const %exim-accounts)) + (service-extension activation-service-type exim-activation) + (service-extension profile-service-type exim-profile) + (service-extension etc-service-type exim-etc))))) -- cgit v1.3 From 563c5d42c954eacc54151d46a04ae14b9dbb1a10 Mon Sep 17 00:00:00 2001 From: Clément Lassieur Date: Thu, 2 Mar 2017 22:06:27 +0100 Subject: services: openssh: Enable PAM. * gnu/services/ssh.scm: (openssh-pam-services): New procedure. (openssh-service-type): Use it to extend PAM-ROOT-SERVICE-TYPE. ()[challenge-response-authentication?]: New field. ()[use-pam?]: New field. (openssh-config-file): Add them. * doc/guix.texi (Networking Services): Document them. Signed-off-by: Danny Milosavljevic --- doc/guix.texi | 16 ++++++++++++++++ gnu/services/ssh.scm | 21 ++++++++++++++++++++- 2 files changed, 36 insertions(+), 1 deletion(-) (limited to 'gnu/services') diff --git a/doc/guix.texi b/doc/guix.texi index 18821b9a9..5aed6771d 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -9344,6 +9344,22 @@ enabled---in other words, @command{ssh} options @option{-X} and @item @code{protocol-number} (default: @code{2}) The SSH protocol number to use. + +@item @code{challenge-response-authentication?} (default: @code{#f}) +Specifies whether challenge response authentication is allowed (e.g. via +PAM). + +@item @code{use-pam?} (default: @code{#t}) +Enables the Pluggable Authentication Module interface. If set to +@code{#t}, this will enable PAM authentication using +@code{challenge-response-authentication?} and +@code{password-authentication?}, in addition to PAM account and session +module processing for all authentication types. + +Because PAM challenge response authentication usually serves an +equivalent role to password authentication, you should disable either +@code{challenge-response-authentication?} or +@code{password-authentication?}. @end table @end deftp diff --git a/gnu/services/ssh.scm b/gnu/services/ssh.scm index c1d42e70c..716a0fbbd 100644 --- a/gnu/services/ssh.scm +++ b/gnu/services/ssh.scm @@ -279,7 +279,11 @@ The other options should be self-descriptive." (x11-forwarding? openssh-configuration-x11-forwarding? ;Boolean (default #f)) (protocol-number openssh-configuration-protocol-number ;integer - (default 2))) + (default 2)) + (challenge-response-authentication? openssh-challenge-response-authentication? + (default #f)) ;Boolean + (use-pam? openssh-configuration-use-pam? + (default #t))) ;Boolean (define %openssh-accounts (list (user-group (name "sshd") (system? #t)) @@ -336,6 +340,12 @@ The other options should be self-descriptive." "yes" "no")) (format port "PidFile ~a\n" #$(openssh-configuration-pid-file config)) + (format port "ChallengeResponseAuthentication ~a\n" + #$(if (openssh-challenge-response-authentication? config) + "yes" "no")) + (format port "UsePAM ~a\n" + #$(if (openssh-configuration-use-pam? config) + "yes" "no")) #t)))) (define (openssh-shepherd-service config) @@ -356,11 +366,20 @@ The other options should be self-descriptive." #:pid-file #$pid-file)) (stop #~(make-kill-destructor))))) +(define (openssh-pam-services config) + "Return a list of for sshd with CONFIG." + (list (unix-pam-service + "sshd" + #:allow-empty-passwords? + (openssh-configuration-allow-empty-passwords? config)))) + (define openssh-service-type (service-type (name 'openssh) (extensions (list (service-extension shepherd-root-service-type openssh-shepherd-service) + (service-extension pam-root-service-type + openssh-pam-services) (service-extension activation-service-type openssh-activation) (service-extension account-service-type -- cgit v1.3 From 1806a670f06bd745e7e3744046f50bb6f9113d26 Mon Sep 17 00:00:00 2001 From: Clément Lassieur Date: Thu, 2 Mar 2017 22:06:28 +0100 Subject: services: openssh: Remove deprecated options. * gnu/services/ssh.scm (openssh-config-file): Remove them. ()[rsa-authentication?]: Remove it. ()[protocol-number]: Remove it. * doc/guix.texi (Networking Services): Remove them. Signed-off-by: Danny Milosavljevic --- doc/guix.texi | 8 -------- gnu/services/ssh.scm | 10 ---------- 2 files changed, 18 deletions(-) (limited to 'gnu/services') diff --git a/doc/guix.texi b/doc/guix.texi index 5aed6771d..21434f6c7 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -9332,19 +9332,11 @@ false, users have to use other authentication method. Authorized public keys are stored in @file{~/.ssh/authorized_keys}. This is used only by protocol version 2. -@item @code{rsa-authentication?} (default: @code{#t}) -When true, users may log in using pure RSA authentication. When false, -users have to use other means of authentication. This is used only by -protocol 1. - @item @code{x11-forwarding?} (default: @code{#f}) When true, forwarding of X11 graphical client connections is enabled---in other words, @command{ssh} options @option{-X} and @option{-Y} will work. -@item @code{protocol-number} (default: @code{2}) -The SSH protocol number to use. - @item @code{challenge-response-authentication?} (default: @code{#f}) Specifies whether challenge response authentication is allowed (e.g. via PAM). diff --git a/gnu/services/ssh.scm b/gnu/services/ssh.scm index 716a0fbbd..ef7d546d1 100644 --- a/gnu/services/ssh.scm +++ b/gnu/services/ssh.scm @@ -274,12 +274,8 @@ The other options should be self-descriptive." (default #t)) (public-key-authentication? openssh-configuration-public-key-authentication? (default #t)) ;Boolean - (rsa-authentication? openssh-configuration-rsa-authentication? ;Boolean - (default #t)) (x11-forwarding? openssh-configuration-x11-forwarding? ;Boolean (default #f)) - (protocol-number openssh-configuration-protocol-number ;integer - (default 2)) (challenge-response-authentication? openssh-challenge-response-authentication? (default #f)) ;Boolean (use-pam? openssh-configuration-use-pam? @@ -313,9 +309,6 @@ The other options should be self-descriptive." #~(call-with-output-file #$output (lambda (port) (display "# Generated by 'openssh-service'.\n" port) - (format port "Protocol ~a\n" - #$(if (eq? (openssh-configuration-protocol-number config) 1) - "1" "2")) (format port "Port ~a\n" #$(number->string (openssh-configuration-port-number config))) (format port "PermitRootLogin ~a\n" @@ -332,9 +325,6 @@ The other options should be self-descriptive." (format port "PubkeyAuthentication ~a\n" #$(if (openssh-configuration-public-key-authentication? config) "yes" "no")) - (format port "RSAAuthentication ~a\n" - #$(if (openssh-configuration-rsa-authentication? config) - "yes" "no")) (format port "X11Forwarding ~a\n" #$(if (openssh-configuration-x11-forwarding? config) "yes" "no")) -- cgit v1.3 From f895dce41b5495849a7e26fef747db14f6dd4ef0 Mon Sep 17 00:00:00 2001 From: Clément Lassieur Date: Thu, 2 Mar 2017 22:06:29 +0100 Subject: services: openssh: Fix 'PrintLastLog' default behaviour. * gnu/services/ssh.scm (openssh-config-file): Add 'print-last-log?' option. ()[print-last-log?]: Add it. (openssh-activation): Touch /var/log/lastlog. * doc/guix.texi (Networking Services): Document 'print-last-log?'. Before that, the service did not work as expected because /var/log/lastlog did not exist. Signed-off-by: Danny Milosavljevic --- doc/guix.texi | 4 ++++ gnu/services/ssh.scm | 13 +++++++++++++ 2 files changed, 17 insertions(+) (limited to 'gnu/services') diff --git a/doc/guix.texi b/doc/guix.texi index 21434f6c7..966a5458f 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -9352,6 +9352,10 @@ Because PAM challenge response authentication usually serves an equivalent role to password authentication, you should disable either @code{challenge-response-authentication?} or @code{password-authentication?}. + +@item @code{print-last-log?} (default: @code{#t}) +Specifies whether @command{sshd} should print the date and time of the +last user login when a user logs in interactively. @end table @end deftp diff --git a/gnu/services/ssh.scm b/gnu/services/ssh.scm index ef7d546d1..d8a3ad35a 100644 --- a/gnu/services/ssh.scm +++ b/gnu/services/ssh.scm @@ -279,6 +279,8 @@ The other options should be self-descriptive." (challenge-response-authentication? openssh-challenge-response-authentication? (default #f)) ;Boolean (use-pam? openssh-configuration-use-pam? + (default #t)) ;Boolean + (print-last-log? openssh-configuration-print-last-log? (default #t))) ;Boolean (define %openssh-accounts @@ -298,6 +300,14 @@ The other options should be self-descriptive." (mkdir-p "/etc/ssh") (mkdir-p (dirname #$(openssh-configuration-pid-file config))) + (define (touch file-name) + (call-with-output-file file-name (const #t))) + + (let ((lastlog "/var/log/lastlog")) + (when #$(openssh-configuration-print-last-log? config) + (unless (file-exists? lastlog) + (touch lastlog)))) + ;; Generate missing host keys. (system* (string-append #$(openssh-configuration-openssh config) "/bin/ssh-keygen") "-A"))) @@ -336,6 +346,9 @@ The other options should be self-descriptive." (format port "UsePAM ~a\n" #$(if (openssh-configuration-use-pam? config) "yes" "no")) + (format port "PrintLastLog ~a\n" + #$(if (openssh-configuration-print-last-log? config) + "yes" "no")) #t)))) (define (openssh-shepherd-service config) -- cgit v1.3 From eba560765a5afccbc5d3b64df410d89b1f79a18e Mon Sep 17 00:00:00 2001 From: Clément Lassieur Date: Sun, 26 Feb 2017 19:54:52 +0100 Subject: services: dovecot: Fix unix_listeners and fifo_listeners path types. * gnu/services/mail.scm (unix-listener-configuration)[path] (fifo-listener-configuration)[path]: Change type from 'file-name' to 'string'. * doc/guix.texi (Mail Services): Document it. Signed-off-by: Clément Lassieur --- doc/guix.texi | 10 ++++++---- gnu/services/mail.scm | 10 ++++++---- 2 files changed, 12 insertions(+), 8 deletions(-) (limited to 'gnu/services') diff --git a/doc/guix.texi b/doc/guix.texi index 93d0b7a08..ddfd70766 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -10930,8 +10930,9 @@ Defaults to @samp{()}. Available @code{unix-listener-configuration} fields are: -@deftypevr {@code{unix-listener-configuration} parameter} file-name path -The file name on which to listen. +@deftypevr {@code{unix-listener-configuration} parameter} string path +Path to the file, relative to @code{base-dir} field. This is also used as +the section name. @end deftypevr @deftypevr {@code{unix-listener-configuration} parameter} string mode @@ -10952,8 +10953,9 @@ Defaults to @samp{""}. Available @code{fifo-listener-configuration} fields are: -@deftypevr {@code{fifo-listener-configuration} parameter} file-name path -The file name on which to listen. +@deftypevr {@code{fifo-listener-configuration} parameter} string path +Path to the file, relative to @code{base-dir} field. This is also used as +the section name. @end deftypevr @deftypevr {@code{fifo-listener-configuration} parameter} string mode diff --git a/gnu/services/mail.scm b/gnu/services/mail.scm index b211ab61a..dbc5de9e6 100644 --- a/gnu/services/mail.scm +++ b/gnu/services/mail.scm @@ -165,8 +165,9 @@ (define-configuration unix-listener-configuration (path - (file-name (configuration-missing-field 'unix-listener 'path)) - "The file name on which to listen.") + (string (configuration-missing-field 'unix-listener 'path)) + "Path to the file, relative to @code{base-dir} field. This is also used as +the section name.") (mode (string "0600") "The access mode for the socket.") @@ -184,8 +185,9 @@ (define-configuration fifo-listener-configuration (path - (file-name (configuration-missing-field 'fifo-listener 'path)) - "The file name on which to listen.") + (string (configuration-missing-field 'fifo-listener 'path)) + "Path to the file, relative to @code{base-dir} field. This is also used as +the section name.") (mode (string "0600") "The access mode for the socket.") -- cgit v1.3 From 56aef188a2a014e254d3c93c8a79cd1fb5a1ece6 Mon Sep 17 00:00:00 2001 From: Clément Lassieur Date: Tue, 28 Feb 2017 23:02:14 +0100 Subject: services: dovecot: Reimplement proper configuration functions. * gnu/services/mail.scm (uglify-field-name, serialize-field, serialize-string) (space-separated-string-list?, serialize-space-separated-string-list) (file-name?, serialize-file-name, serialize-boolean): Add them. These functions were inadvertently changed while being factorized in gnu/service/configuration.scm. Signed-off-by: Clément Lassieur --- gnu/services/mail.scm | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) (limited to 'gnu/services') diff --git a/gnu/services/mail.scm b/gnu/services/mail.scm index dbc5de9e6..05978e006 100644 --- a/gnu/services/mail.scm +++ b/gnu/services/mail.scm @@ -69,6 +69,27 @@ ;;; ;;; Code: +(define (uglify-field-name field-name) + (let ((str (symbol->string field-name))) + (string-join (string-split (if (string-suffix? "?" str) + (substring str 0 (1- (string-length str))) + str) + #\-) + "_"))) + +(define (serialize-field field-name val) + (format #t "~a=~a\n" (uglify-field-name field-name) val)) + +(define (serialize-string field-name val) + (serialize-field field-name val)) + +(define (space-separated-string-list? val) + (and (list? val) + (and-map (lambda (x) + (and (string? x) (not (string-index x #\space)))) + val))) +(define (serialize-space-separated-string-list field-name val) + (serialize-field field-name (string-join val " "))) (define (comma-separated-string-list? val) (and (list? val) @@ -78,6 +99,12 @@ (define (serialize-comma-separated-string-list field-name val) (serialize-field field-name (string-join val ","))) +(define (file-name? val) + (and (string? val) + (string-prefix? "/" val))) +(define (serialize-file-name field-name val) + (serialize-string field-name val)) + (define (colon-separated-file-name-list? val) (and (list? val) ;; Trailing slashes not needed and not @@ -85,6 +112,9 @@ (define (serialize-colon-separated-file-name-list field-name val) (serialize-field field-name (string-join val ":"))) +(define (serialize-boolean field-name val) + (serialize-string field-name (if val "yes" "no"))) + (define (non-negative-integer? val) (and (exact-integer? val) (not (negative? val)))) (define (serialize-non-negative-integer field-name val) -- cgit v1.3 From 720cb10c15a4606fe0dc3511db4fef325f3d9dc6 Mon Sep 17 00:00:00 2001 From: Clément Lassieur Date: Tue, 28 Feb 2017 01:44:03 +0100 Subject: services: Move configuration functions that shouldn't be factorized. * gnu/services/configuration.scm (serialize-field, serialize-string) (serialize-space-separated-string-list, space-separated-string-list?) (serialize-file-name, file-name?, serialize-boolean): Move these functions... * gnu/services/cups.scm: ...to this file. * gnu/services/kerberos.scm: ...to this file. Configuration syntaxes are very specific to services. Some services may have the same configuration syntax, but none of them is common enough to be abstracted in configuration.scm. Signed-off-by: Clément Lassieur --- gnu/services/configuration.scm | 40 ---------------------------------------- gnu/services/cups.scm | 32 ++++++++++++++++++++++++++++++++ gnu/services/kerberos.scm | 15 +++++++++++++++ 3 files changed, 47 insertions(+), 40 deletions(-) (limited to 'gnu/services') diff --git a/gnu/services/configuration.scm b/gnu/services/configuration.scm index a98db64fa..2ad3a637a 100644 --- a/gnu/services/configuration.scm +++ b/gnu/services/configuration.scm @@ -39,14 +39,6 @@ define-configuration validate-configuration generate-documentation - serialize-field - serialize-string - serialize-name - serialize-space-separated-string-list - space-separated-string-list? - serialize-file-name - file-name? - serialize-boolean serialize-package)) ;;; Commentary: @@ -140,41 +132,9 @@ #,(id #'stem #'stem #'-fields)) conf)))))))) -(define (uglify-field-name field-name) - (let ((str (symbol->string field-name))) - (string-concatenate - (map string-titlecase - (string-split (if (string-suffix? "?" str) - (substring str 0 (1- (string-length str))) - str) - #\-))))) - -(define (serialize-field field-name val) - (format #t "~a ~a\n" (uglify-field-name field-name) val)) - (define (serialize-package field-name val) #f) -(define (serialize-string field-name val) - (serialize-field field-name val)) - -(define (space-separated-string-list? val) - (and (list? val) - (and-map (lambda (x) - (and (string? x) (not (string-index x #\space)))) - val))) -(define (serialize-space-separated-string-list field-name val) - (serialize-field field-name (string-join val " "))) - -(define (file-name? val) - (and (string? val) - (string-prefix? "/" val))) -(define (serialize-file-name field-name val) - (serialize-string field-name val)) - -(define (serialize-boolean field-name val) - (serialize-string field-name (if val "yes" "no"))) - ;; A little helper to make it easier to document all those fields. (define (generate-documentation documentation documentation-name) (define (str x) (object->string x)) diff --git a/gnu/services/cups.scm b/gnu/services/cups.scm index 70b858479..70a71eff0 100644 --- a/gnu/services/cups.scm +++ b/gnu/services/cups.scm @@ -57,6 +57,21 @@ (home-directory "/var/empty") (shell (file-append shadow "/sbin/nologin"))))) +(define (uglify-field-name field-name) + (let ((str (symbol->string field-name))) + (string-concatenate + (map string-titlecase + (string-split (if (string-suffix? "?" str) + (substring str 0 (1- (string-length str))) + str) + #\-))))) + +(define (serialize-field field-name val) + (format #t "~a ~a\n" (uglify-field-name field-name) val)) + +(define (serialize-string field-name val) + (serialize-field field-name val)) + (define (multiline-string-list? val) (and (list? val) (and-map (lambda (x) @@ -65,11 +80,28 @@ (define (serialize-multiline-string-list field-name val) (for-each (lambda (str) (serialize-field field-name str)) val)) +(define (space-separated-string-list? val) + (and (list? val) + (and-map (lambda (x) + (and (string? x) (not (string-index x #\space)))) + val))) +(define (serialize-space-separated-string-list field-name val) + (serialize-field field-name (string-join val " "))) + (define (space-separated-symbol-list? val) (and (list? val) (and-map symbol? val))) (define (serialize-space-separated-symbol-list field-name val) (serialize-field field-name (string-join (map symbol->string val) " "))) +(define (file-name? val) + (and (string? val) + (string-prefix? "/" val))) +(define (serialize-file-name field-name val) + (serialize-string field-name val)) + +(define (serialize-boolean field-name val) + (serialize-string field-name (if val "yes" "no"))) + (define (non-negative-integer? val) (and (exact-integer? val) (not (negative? val)))) (define (serialize-non-negative-integer field-name val) diff --git a/gnu/services/kerberos.scm b/gnu/services/kerberos.scm index cb33a7c53..f09f47893 100644 --- a/gnu/services/kerberos.scm +++ b/gnu/services/kerberos.scm @@ -96,6 +96,12 @@ trailing '?' removed." (unless (eq? val unset-field) (serialize-field* field-name (string-join val " ")))) +(define (space-separated-string-list? val) + (and (list? val) + (and-map (lambda (x) + (and (string? x) (not (string-index x #\space)))) + val))) + (define space-separated-string-list/unset? (predicate/unset space-separated-string-list?)) @@ -118,10 +124,19 @@ trailing '?' removed." (lambda (val) (string-prefix? "/" val)))) +(define (serialize-field field-name val) + (format #t "~a ~a\n" (uglify-field-name field-name) val)) + +(define (serialize-string field-name val) + (serialize-field field-name val)) + (define (serialize-file-name field-name val) (unless (eq? val unset-field) (serialize-string field-name val))) +(define (serialize-space-separated-string-list field-name val) + (serialize-field field-name (string-join val " "))) + (define (non-negative-integer? val) (and (exact-integer? val) (not (negative? val)))) -- cgit v1.3