jory
f489259af9
- Add fingerprint.nix hardware module with TOD driver support - Create separate laptop-work configuration with Cisco, Himmelblau, and MDATP work modules - Move work-specific modules from shared to laptop-work profile - Change work module enable defaults to false for better security-by-default - Add MDATP support with enhanced modular structure
93 lines
2.8 KiB
Nix
93 lines
2.8 KiB
Nix
{ config, lib, pkgs, self, ... }:
|
|
|
|
# Cisco Secure Client (proprietary VPN client, successor to AnyConnect)
|
|
#
|
|
# Package: pkgs/cisco-secure-client — fetches the Linux pre-deployment .tgz
|
|
# from archive.org and extracts the bundled .deb.
|
|
#
|
|
# The user can override the source by passing a different package:
|
|
# work.cisco.package = pkgs.cisco-secure-client.overrideAttrs (_: {
|
|
# src = /path/to/local/cisco-secure-client-linux64-5.1.17.3394-predeploy-deb-k9.tgz;
|
|
# });
|
|
#
|
|
# Reference: https://github.com/NixOS/nixpkgs/issues/265443
|
|
|
|
let
|
|
cfg = config.work.cisco;
|
|
in {
|
|
options.work.cisco = {
|
|
enable = lib.mkEnableOption "Cisco Secure Client" // {
|
|
default = false;
|
|
};
|
|
|
|
package = lib.mkOption {
|
|
description = "cisco-secure-client package to use";
|
|
type = lib.types.package;
|
|
default = pkgs.cisco-secure-client;
|
|
defaultText = "pkgs.cisco-secure-client";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
environment.systemPackages = with pkgs; [
|
|
cfg.package
|
|
];
|
|
|
|
# The vpnagentd binary has /opt/cisco/secureclient/ hardcoded for runtime
|
|
# config paths (openssl.cnf, ossl-modules/). Create a symlink to the Nix store.
|
|
systemd.tmpfiles.rules = [
|
|
"d /opt 0755 root root -"
|
|
"L+ /opt/cisco/secureclient - - - - ${cfg.package}/cisco/secureclient"
|
|
];
|
|
|
|
# Load the tun module required by the VPN client
|
|
boot.kernelModules = [ "tun" ];
|
|
|
|
systemd.services.cisco-vpnagentd = {
|
|
description = "Cisco Secure Client VPN Agent Daemon";
|
|
# vpnagentd daemonizes itself; tracked via PID file.
|
|
after = [ "network-online.target" "NetworkManager.service" ];
|
|
wants = [ "network-online.target" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
serviceConfig = {
|
|
Type = "forking";
|
|
PIDFile = "/run/vpnagentd.pid";
|
|
# Use the wrapper (sets LD_LIBRARY_PATH) — the raw binary was restored
|
|
# from backup to preserve its embedded Cisco code signature, so it has
|
|
# no RPATH and needs the env var to find its bundled .so files.
|
|
ExecStart = "${cfg.package}/bin/vpnagentd";
|
|
Restart = "on-failure";
|
|
RestartSec = "5";
|
|
|
|
# Minimal capability set for VPN operation
|
|
CapabilityBoundingSet = [
|
|
"CAP_NET_ADMIN"
|
|
"CAP_NET_RAW"
|
|
"CAP_NET_BIND_SERVICE"
|
|
"CAP_DAC_OVERRIDE"
|
|
"CAP_SETUID"
|
|
"CAP_SETGID"
|
|
"CAP_CHOWN"
|
|
"CAP_FOWNER"
|
|
];
|
|
AmbientCapabilities = [
|
|
"CAP_NET_ADMIN"
|
|
"CAP_NET_RAW"
|
|
"CAP_NET_BIND_SERVICE"
|
|
"CAP_DAC_OVERRIDE"
|
|
"CAP_SETUID"
|
|
"CAP_SETGID"
|
|
"CAP_CHOWN"
|
|
"CAP_FOWNER"
|
|
];
|
|
DeviceAllow = [ "/dev/net/tun rw" ];
|
|
PrivateTmp = true;
|
|
ProtectSystem = "full";
|
|
ProtectHome = false;
|
|
NoNewPrivileges = false;
|
|
};
|
|
};
|
|
};
|
|
}
|