From 5c9ef1ddcb985839e79ef8d8277e5d430f376b40 Mon Sep 17 00:00:00 2001
From: stephan <s.wilkens@gmx.net>
Date: Sun, 28 Dec 2025 14:49:36 +0100
Subject: [PATCH] auth: add Debian/Ubuntu PAM service skd

---
 AGENTS.md          |  1 +
 README.md          |  1 +
 env.example        |  3 ++-
 scripts/install.sh | 34 ++++++++++++++++++++++++++++++++++
 4 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/AGENTS.md b/AGENTS.md
index fc6f9d3..facec9a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -7,6 +7,7 @@
 
 ## Build, Test, and Development Commands
 - `bash -n sk.sh` — Syntax check to catch parsing errors early.
+- `sudo ./scripts/install.sh` — On Ubuntu/Debian creates `/etc/pam.d/skd` and sets `SKD_AUTH_PAM_SERVICE=skd` if unset.
 - `shellcheck sk.sh` — Linting for style, safety, and portability; fix or suppress with clear rationale.
 - `./sk.sh <user> disable|enable [countdown] [sound] [seconds]` — Run the tool; requires root. Use a test account when iterating.
 - `sudo ./sk.sh demo_user disable countdown sound 90` — Example invocation combining optional modes.
diff --git a/README.md b/README.md
index be0f1cf..ad8659c 100644
--- a/README.md
+++ b/README.md
@@ -25,6 +25,7 @@ Set in `/etc/skd/env` (see `env.example`):
 - `SKD_TOKEN_TTL_SECONDS`: token lifetime (default 900s).
 - `SKD_AUTH_ALLOWED_USERS`: optional comma list of accounts allowed to log in (used for PAM and as an allowlist for OIDC claims).
 - `SKD_AUTH_ALLOWED_GROUPS`: groups whose members may log in (PAM only, default `sudo`).
+- `SKD_AUTH_PAM_SERVICE`: PAM service name; Ubuntu/Debian uses `/etc/pam.d/skd` (created by `scripts/install.sh`), other distros may prefer `login` or `sshd`.
 - `SKD_OIDC_*`: `ISSUER`, `CLIENT_ID`, `CLIENT_SECRET`, `REDIRECT_URI`, `SCOPES` to point at your OIDC provider; set `SKD_SESSION_COOKIE_SECURE=true` for HTTPS.
 - OIDC dynamic registration helper: `scripts/register_oidc_client.sh` (requires `OIDC_INITIAL_ACCESS_TOKEN` and `SKD_OIDC_ISSUER`; uses `SKD_OIDC_REDIRECT_URI` for the redirect). Run once during setup if your provider issues initial access tokens for client creation.
 - `SKD_ALLOWED_USERS`: optional comma list to limit manageable accounts (must exist on the system).
diff --git a/env.example b/env.example
index 5abcb2c..f5fe9bc 100644
--- a/env.example
+++ b/env.example
@@ -8,7 +8,8 @@ SKD_TOKEN_TTL_SECONDS=900
 SKD_AUTH_MODE=pam
 SKD_AUTH_ALLOWED_USERS=
 SKD_AUTH_ALLOWED_GROUPS=sudo
-SKD_AUTH_PAM_SERVICE=login
+# Ubuntu/Debian: install.sh creates /etc/pam.d/skd; adjust for other distros.
+SKD_AUTH_PAM_SERVICE=skd
 SKD_OIDC_ISSUER=
 SKD_OIDC_CLIENT_ID=
 SKD_OIDC_CLIENT_SECRET=
diff --git a/scripts/install.sh b/scripts/install.sh
index 1f6d5e4..522f94e 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -56,6 +56,40 @@ if [[ ! -f "${ENV_FILE}" ]]; then
   sudo chown root:"${SERVICE_GROUP}" "${ENV_FILE}"
 fi
 
+is_debian_like() {
+  if [[ ! -r /etc/os-release ]]; then
+    return 1
+  fi
+  # shellcheck disable=SC1091
+  . /etc/os-release
+  if [[ "${ID:-}" == "ubuntu" || "${ID:-}" == "debian" ]]; then
+    return 0
+  fi
+  if [[ "${ID_LIKE:-}" == *"ubuntu"* || "${ID_LIKE:-}" == *"debian"* ]]; then
+    return 0
+  fi
+  return 1
+}
+
+if is_debian_like; then
+  PAM_DIR="/etc/pam.d"
+  PAM_SERVICE_NAME="skd"
+  PAM_SERVICE_FILE="${PAM_DIR}/${PAM_SERVICE_NAME}"
+  if [[ -d "${PAM_DIR}" && ! -f "${PAM_SERVICE_FILE}" ]]; then
+    log "Creating PAM service ${PAM_SERVICE_NAME} for Debian/Ubuntu..."
+    sudo tee "${PAM_SERVICE_FILE}" >/dev/null <<'EOF'
+# PAM configuration for Safe Kiddo Daemon
+auth    include   common-auth
+account include   common-account
+password include  common-password
+session include   common-session
+EOF
+  fi
+  if ! sudo grep -q "^SKD_AUTH_PAM_SERVICE=" "${ENV_FILE}"; then
+    echo "SKD_AUTH_PAM_SERVICE=${PAM_SERVICE_NAME}" | sudo tee -a "${ENV_FILE}" >/dev/null
+  fi
+fi
+
 log "Ensuring minimal ENV defaults (PAM always on, allowed user)..."
 DEFAULT_USER="${SUDO_USER:-}"
 if [[ -n "${DEFAULT_USER}" ]]; then