Merge remote-tracking branch 'gum/master'

9 files changed, 250 insertions, 28 deletions

diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index d64d8047a..9af42acc9 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -28,6 +28,7 @@ let
       ./on-failure.nix
       ./os-release.nix
       ./per-user.nix
+      ./power-action.nix
       ./Reaktor.nix
       ./realwallpaper.nix
       ./retiolum-bootstrap.nix
diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix
index aba6ee0b5..cfe2e5f04 100644
--- a/krebs/3modules/exim-smarthost.nix
+++ b/krebs/3modules/exim-smarthost.nix
@@ -2,6 +2,7 @@
 
 with config.krebs.lib;
 let
+  indent = replaceChars ["\n"] ["\n  "];
   cfg = config.krebs.exim-smarthost;
 
   out = {
@@ -12,6 +13,11 @@ let
   api = {
     enable = mkEnableOption "krebs.exim-smarthost";
 
+    authenticators = mkOption {
+      type = types.attrsOf types.str;
+      default = {};
+    };
+
     dkim = mkOption {
       type = types.listOf (types.submodule ({ config, ... }: {
         options = {
@@ -80,6 +86,16 @@ let
       default = [];
     };
 
+    ssl_cert = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+    };
+
+    ssl_key = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+    };
+
     system-aliases = mkOption {
       type = types.listOf (types.submodule ({
         options = {
@@ -136,7 +152,9 @@ let
         syslog_timestamp = false
         syslog_duplication = false
 
-        tls_advertise_hosts =
+        ${optionalString (cfg.ssl_cert != null) "tls_certificate = ${cfg.ssl_cert}"}
+        ${optionalString (cfg.ssl_key != null) "tls_privatekey = ${cfg.ssl_key}"}
+        tls_advertise_hosts =${optionalString (cfg.ssl_cert != null) " *"}
 
         begin acl
 
@@ -257,6 +275,10 @@ let
 
         begin rewrite
         begin authenticators
+        ${concatStringsSep "\n" (mapAttrsToList (name: text: ''
+        ${name}:
+          ${indent text}
+        '') cfg.authenticators)}
       '';
     };
   };
diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index 52db3de85..dffb6b0a1 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -49,10 +49,22 @@ with config.krebs.lib;
           '';
         };
         siem = {
-          ip4.addr = "10.8.10.2";
+          ip4.addr   = "10.8.10.2";
+          ip4.prefix = "10.8.10.0/24";
           aliases = [
             "darth.siem"
           ];
+          tinc.pubkey = ''
+            Ed25519PublicKey = 24t9ye4gRLg6UbVxBvuuDlvU/cnByxMjYjym4LO6GkK
+            -----BEGIN RSA PUBLIC KEY-----
+            MIIBCQKCAQEApcUeTecVahqNIfLEkfgNiaW+eHQ9Y90DxHhy9vdPZh8dmLqoFBoW
+            TCPcZIRpyj7hxRkNIhh34Ewpul0oQ1tzrUGcT2xvMNwaCupRDmhZn9jR9aFFEYKb
+            fUOplCxb4y2UKbWAA6hie3PKH9wnPfbwSsexb2BSQAqSt4iNIVCV6j7LXpiopbGS
+            Exs3/Pz+IeMtGyuMYA3rUmJsVRKR1o7axLtlhYK7JSMbqdYhaQJ4NZrvIXw//w21
+            kM/TJTPZ4j47ME18jQInO62X5h+xVch6DtvwvjBMMMKbS0am9qw1P3qo7MP3PmQh
+            rvVQRth8L63q4NLOnT29XmnxPSVGL1PBQQICEAE=
+            -----END RSA PUBLIC KEY-----
+          '';
         };
       };
     };
@@ -60,9 +72,20 @@ with config.krebs.lib;
       nets = {
         siem = {
           ip4.addr = "10.8.10.6";
+          ip4.prefix = "10.8.10.0/24";
           aliases = [
             "ossim.siem"
           ];
+        tinc.pubkey = ''
+          -----BEGIN RSA PUBLIC KEY-----
+          MIIBCgKCAQEAv5qv9R3E1AHJOhTnHJ2E5zWjItRdXSw/inpz/W+KcBeM/HSG0XEl
+          RyGAwty7VP4CiLp7CagWmtVsz/5ytnXJzLDeRLn5t+KzO6am0aOpvAt6ZggZXPhL
+          cQkn4IGi1TJE5tw+lzabBkUZm3zD1KEXpqJeZ6spA4e9lB/+T3Tx23g9WDEOKand
+          mAJrsdsvTCIiVJefidOAmgeZVVOV3ltBonNP1nqEy+5v4B3EBT/Uj7ImL2aRj/pd
+          dPs6dGV2LqSQvnrSbFZzuKVXKpD1M+wgT/5NQk/hVJJxBQC6rxvpg1XyQkepcLWL
+          WjvogOl4NjXStmKDX2+gPPFx6XTmwDenOwIDAQAB
+          -----END RSA PUBLIC KEY-----
+        '';
         };
       };
     };
@@ -103,15 +126,15 @@ with config.krebs.lib;
         };
       };
     };
-    pornocauster = {
+    x = {
       cores = 2;
       nets = {
         retiolum = {
           ip4.addr = "10.243.0.91";
           ip6.addr = "42:0b2c:d90e:e717:03dc:9ac1:7c30:a4db";
           aliases = [
-            "pornocauster.retiolum"
-            "pornocauster.r"
+            "x.retiolum"
+            "x.r"
           ];
           tinc.pubkey = ''
             -----BEGIN RSA PUBLIC KEY-----
@@ -126,13 +149,25 @@ with config.krebs.lib;
         };
         siem = {
           ip4.addr = "10.8.10.4";
+          ip4.prefix = "10.8.10.0/24";
           aliases = [
-            "arch.siem"
+            "makefu.siem"
           ];
+          tinc.pubkey = ''
+            Ed25519PublicKey = rFTglGxm563e/w82Q9Qqy/E+V/ipT4DOTyTuYrWrtmI
+            -----BEGIN RSA PUBLIC KEY-----
+            MIIBCQKCAQEAx+OQXQj6rlXIByo48JZXSexRz5G5oJVZTHAJ0GF5f70U65C0x83p
+            XtNp4LGYti+cyyzmQjf/N7jr2CxUlOATN2nRO4CT+JaMM2MoqnPWqTZBPMDiHq2y
+            ce0zjLPPl0hVc5mg+6F0tgolbUvTIo2CgAIl5lNvJiVfmXRSehmMprf1NPkxJd/O
+            vAOD7mgnCjkEAWElf1cfxSGZqSLbNltRK340nE5x6A5tY7iEueP/r9chEmOnVjKm
+            t+GJAJIe1PClWJHJYAXF8I7R3g+XQIqgw+VTN3Ng5cS5W/mbTFIzLWMZpdZaAhWR
+            56pthtZAE5FZ+4vxMpDQ4yeDu0b6gajWNQICEAE=
+            -----END RSA PUBLIC KEY-----
+          '';
         };
       };
       ssh.privkey.path = <secrets/ssh_host_ed25519_key>;
-      ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHDM0E608d/6rGzXqGbNSuMb2RlCojCJSiiz6QcPOC2G root@pornocauster";
+      ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHDM0E608d/6rGzXqGbNSuMb2RlCojCJSiiz6QcPOC2G root@x";
 
     };
 
@@ -167,6 +202,7 @@ with config.krebs.lib;
       extraZones = {
         "krebsco.de" = ''
           euer              IN MX 1   aspmx.l.google.com.
+          nixos.unstable    IN CNAME  krebscode.github.io.
           pigstarter        IN A      ${nets.internet.ip4.addr}
           gold              IN A      ${nets.internet.ip4.addr}
           boot              IN A      ${nets.internet.ip4.addr}
@@ -324,7 +360,21 @@ with config.krebs.lib;
       nets = {
         siem = {
           ip4.addr = "10.8.10.7";
+          ip4.prefix = "10.8.10.0/24";
           aliases = [ "display.siem" ];
+          tinc.pubkey = ''
+            -----BEGIN RSA PUBLIC KEY-----
+            MIIBCgKCAQEA+/TpxsVIBL9J9QAe/+jB6sgu/O6J+KY4YrAzZ6dM4kbFv5JA64f5
+            6znv8EFqn6loS9Aez3e08P5scyGjiwWytdKN5Yztlffc0xDD7MUU2RiCsQF1X74J
+            +1i8NhSq3PJ6UeUURxYYnAYzBlFvsxev4vpniFTsIR9tmcAYX9NT9420D6nV7xq7
+            FdkoBlYj4eUQqQzHH1T/Lmt+BGmf+BufIJas+Oo/Sg59vIk9OM08WyAjHVT2iNbg
+            LXDhzVaeGOOM3GOa0YGG0giM3Rd245YPaPiVbwrMy8HQRBpMzXOPjcC1nYZSjxrW
+            LQxtRS+dmfEMG7MJ8T2T2bseX6z6mONc1QIDAQAB
+            -----END RSA PUBLIC KEY-----
+            -----BEGIN ED25519 PUBLIC KEY-----
+            3JGeGnADWR+hfb4TEoHDyopEYgkfGNJKwy71bqcsNrO
+            -----END ED25519 PUBLIC KEY-----
+          '';
         };
         retiolum = {
           ip4.addr = "10.243.214.15";
@@ -391,13 +441,26 @@ TNs2RYfwDy/r6H/hDeB/BSngPouedEVcPwIDAQAB
     };
     shoney = rec {
       cores = 1;
-      nets = {
+      nets = rec {
         siem = {
+          via = internet;
           ip4.addr = "10.8.10.1";
+          ip4.prefix = "10.8.10.0/24";
           aliases = [
-            "sjump.siem"
+            "shoney.siem"
             "graphs.siem"
           ];
+          tinc.pubkey = ''
+            -----BEGIN RSA PUBLIC KEY-----
+            MIIBCgKCAQEA0OK28PHsMGMxAqVRiRGv93zzEWJgV3hMFquWrpbYC3OZwHDYcNHu
+            74skwRRwwnbcq0ZtWroEvUTmZczuPt2FewdtuEutT7uZJnAYnzSOrB9lmmdoXKQU
+            l4ho1LEf/J0sMBi7RU/OJosuruQTAl53ca5KQbRCXkcPlmq4KzUpvgPINpEpYQjB
+            CGC3ErOvw2jXESbDnWomYZgJl3uilJUEYlyQEwyWVG+fO8uxlz9qKLXMlkoJTbs4
+            fTIcxh7y6ZA7QfMN3Ruq1R66smfXQ4xu1hybvqL66RLiDQgH3BRyKIgobS1UxI4z
+            L+xhIsiMXQIo2hv8aOUnf/7Ac9DXNR83GwIDAQAB
+            -----END RSA PUBLIC KEY-----
+          '';
+          tinc.port = 1655;
         };
         internet = {
           ip4.addr = "64.137.234.215";
@@ -729,8 +792,8 @@ TNs2RYfwDy/r6H/hDeB/BSngPouedEVcPwIDAQAB
   };
   users = rec {
     makefu = {
-      mail = "makefu@pornocauster.retiolum";
-      pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCl3RTOHd5DLiVeUbUr/GSiKoRWknXQnbkIf+uNiFO+XxiqZVojPlumQUVhasY8UzDzj9tSDruUKXpjut50FhIO5UFAgsBeMJyoZbgY/+R+QKU00Q19+IiUtxeFol/9dCO+F4o937MC0OpAC10LbOXN/9SYIXueYk3pJxIycXwUqhYmyEqtDdVh9Rx32LBVqlBoXRHpNGPLiswV2qNe0b5p919IGcslzf1XoUzfE3a3yjk/XbWh/59xnl4V7Oe7+iQheFxOT6rFA30WYwEygs5As//ZYtxvnn0gA02gOnXJsNjOW9irlxOUeP7IOU6Ye3WRKFRR0+7PS+w8IJLag2xb makefu@pornocauster";
+      mail = "makefu@x.retiolum";
+      pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCl3RTOHd5DLiVeUbUr/GSiKoRWknXQnbkIf+uNiFO+XxiqZVojPlumQUVhasY8UzDzj9tSDruUKXpjut50FhIO5UFAgsBeMJyoZbgY/+R+QKU00Q19+IiUtxeFol/9dCO+F4o937MC0OpAC10LbOXN/9SYIXueYk3pJxIycXwUqhYmyEqtDdVh9Rx32LBVqlBoXRHpNGPLiswV2qNe0b5p919IGcslzf1XoUzfE3a3yjk/XbWh/59xnl4V7Oe7+iQheFxOT6rFA30WYwEygs5As//ZYtxvnn0gA02gOnXJsNjOW9irlxOUeP7IOU6Ye3WRKFRR0+7PS+w8IJLag2xb makefu@x";
       pgp.pubkeys.default = builtins.readFile ./default.pgp;
       pgp.pubkeys.brain = builtins.readFile ./brain.pgp;
     };
diff --git a/krebs/3modules/nginx.nix b/krebs/3modules/nginx.nix
index bc32da3b1..214f55018 100644
--- a/krebs/3modules/nginx.nix
+++ b/krebs/3modules/nginx.nix
@@ -71,6 +71,14 @@ let
                   type = bool;
                   default = true;
                 };
+                force_encryption = mkOption {
+                  type = bool;
+                  default = false;
+                  description = ''
+                    redirect all `http` traffic to the same domain but with ssl
+                    protocol.
+                  '';
+                };
                 protocols = mkOption {
                   type = listOf (enum [ "SSLv2" "SSLv3" "TLSv1" "TLSv1.1" "TLSv1.2" ]);
                   default = [ "TLSv1.1" "TLSv1.2" ];
@@ -120,6 +128,11 @@ let
       server_name ${toString (unique server-names)};
       ${concatMapStringsSep "\n" (x: indent "listen ${x};") listen}
       ${optionalString ssl.enable (indent ''
+        ${optionalString ssl.force_encryption ''
+          if ($scheme = http){
+            return 301 https://$server_name$request_uri;
+          }
+        ''}
         listen 443 ssl;
         ssl_certificate ${ssl.certificate};
         ssl_certificate_key ${ssl.certificate_key};
diff --git a/krebs/3modules/power-action.nix b/krebs/3modules/power-action.nix
new file mode 100644
index 000000000..bb5b3e521
--- /dev/null
+++ b/krebs/3modules/power-action.nix
@@ -0,0 +1,92 @@
+{ config, lib, pkgs, ... }:
+
+with config.krebs.lib;
+
+let
+  cfg = config.krebs.power-action;
+
+  out = {
+    options.krebs.power-action = api;
+    config = lib.mkIf cfg.enable imp;
+  };
+
+  api = {
+    enable = mkEnableOption "power-action";
+    battery = mkOption {
+      type = types.str;
+      default = "BAT0";
+    };
+    user = mkOption {
+      type = types.string;
+      default = "power-action";
+    };
+    startAt = mkOption {
+      type = types.str;
+      default = "*:0/1";
+    };
+    plans = mkOption {
+      type = with types; attrsOf (submodule {
+        options = {
+          charging = mkOption {
+            type = nullOr bool;
+            default = null;
+            description = ''
+              check for charging status.
+              null = don't care
+              true = only if system is charging or unknown
+              false = only if system is discharging
+            '';
+          };
+          upperLimit = mkOption {
+            type = int;
+          };
+          lowerLimit = mkOption {
+            type = int;
+          };
+          action = mkOption {
+            type = path;
+          };
+        };
+      });
+    };
+  };
+
+  imp = {
+    systemd.services.power-action = {
+      serviceConfig = rec {
+        ExecStart = startScript;
+        User = cfg.user;
+      };
+      startAt = cfg.startAt;
+    };
+  };
+
+  startScript = pkgs.writeDash "power-action" ''
+    set -euf
+
+    power="$(${powerlvl})"
+    state="$(${state})"
+    ${concatStringsSep "\n" (mapAttrsToList writeRule cfg.plans)}
+  '';
+  charging_check = plan:
+    if (plan.charging == null) then "" else
+      if plan.charging
+        then ''&& [ "$state" = "true" ]''
+        else ''&& ! [ "$state" = "true" ]''
+    ;
+
+  writeRule = _: plan:
+    "if [ $power -ge ${toString plan.lowerLimit} ] && [ $power -le ${toString plan.upperLimit} ] ${charging_check plan}; then ${plan.action}; fi";
+
+  powerlvl = pkgs.writeDash "powerlvl" ''
+    cat /sys/class/power_supply/${cfg.battery}/capacity
+  '';
+
+  state = pkgs.writeDash "state" ''
+    if [ "$(cat /sys/class/power_supply/${cfg.battery}/status)" = "Discharging" ]
+      then echo "false"
+      else echo "true"
+    fi
+  '';
+
+in out
diff --git a/krebs/3modules/retiolum.nix b/krebs/3modules/retiolum.nix
index 0bd815211..2b181a556 100644
--- a/krebs/3modules/retiolum.nix
+++ b/krebs/3modules/retiolum.nix
@@ -12,9 +12,11 @@ let
       define a tinc network
     '';
     type = with types; attrsOf (submodule (tinc: {
-      options = {
+      options = let
+        netname = tinc.config._module.args.name;
+      in {
 
-        enable = mkEnableOption "krebs.tinc.${tinc.config._module.args.name}" // { default = true; };
+        enable = mkEnableOption "krebs.tinc.${netname}" // { default = true; };
 
         host = mkOption {
           type = types.host;
@@ -23,7 +25,7 @@ let
 
         netname = mkOption {
           type = types.enum (attrNames tinc.config.host.nets);
-          default = tinc.config._module.args.name;
+          default = netname;
           description = ''
             The tinc network name.
             It is used to name the TUN device and to generate the default value for
@@ -38,6 +40,27 @@ let
             Extra Configuration to be appended to tinc.conf
           '';
         };
+        tincUp = mkOption {
+          type = types.string;
+          default = let
+            net = tinc.config.host.nets.${netname};
+            iproute = tinc.config.iproutePackage;
+          in ''
+            ${optionalString (net.ip4 != null) /* sh */ ''
+              ${iproute}/sbin/ip -4 addr add ${net.ip4.addr} dev ${netname}
+              ${iproute}/sbin/ip -4 route add ${net.ip4.prefix} dev ${netname}
+            ''}
+            ${optionalString (net.ip6 != null) /* sh */ ''
+              ${iproute}/sbin/ip -6 addr add ${net.ip6.addr} dev ${netname}
+              ${iproute}/sbin/ip -6 route add ${net.ip6.prefix} dev ${netname}
+            ''}
+          '';
+          description = ''
+            tinc-up script to be used. Defaults to setting the
+            krebs.host.nets.<netname>.ip4 and ip6 for the new ips and
+            configures forwarding of the respecitive netmask as subnet.
+          '';
+        };
 
         tincPackage = mkOption {
           type = types.package;
@@ -109,8 +132,8 @@ let
             routeable IPv4 or IPv6 address.
 
             In stockholm this can be done by configuring:
-              krebs.hosts.${connect-host}.nets.${netname?"retiolum"}.via.addrs4 =
-                [ "${external-ip} ${external-port}" ]
+              krebs.hosts.${connect-host}.nets.${netname?"retiolum"}.via.ip4.addr = external-ip
+              krebs.hosts.${connect-host}.nets.${netname?"retiolum"}.tinc.port = 1655;
           '';
         };
 
@@ -131,6 +154,7 @@ let
 
     krebs.secret.files = mapAttrs' (netname: cfg:
       nameValuePair "${netname}.rsa_key.priv" cfg.privkey ) config.krebs.tinc;
+
     users.users = mapAttrs' (netname: cfg:
       nameValuePair "${netname}" {
         inherit (cfg.user) home name uid;
@@ -140,7 +164,6 @@ let
 
     systemd.services = mapAttrs (netname: cfg:
       let
-        net = cfg.host.nets.${netname};
         tinc = cfg.tincPackage;
         iproute = cfg.iproutePackage;
 
@@ -153,18 +176,12 @@ let
               Interface = ${netname}
               ${concatStrings (map (c: "ConnectTo = ${c}\n") cfg.connectTo)}
               PrivateKeyFile = ${cfg.privkey.path}
+              Port = ${toString cfg.host.nets.${cfg.netname}.tinc.port}
               ${cfg.extraConfig}
             '';
             "tinc-up" = pkgs.writeDash "${netname}-tinc-up" ''
               ${iproute}/sbin/ip link set ${netname} up
-              ${optionalString (net.ip4 != null) /* sh */ ''
-                ${iproute}/sbin/ip -4 addr add ${net.ip4.addr} dev ${netname}
-                ${iproute}/sbin/ip -4 route add ${net.ip4.prefix} dev ${netname}
-              ''}
-              ${optionalString (net.ip6 != null) /* sh */ ''
-                ${iproute}/sbin/ip -6 addr add ${net.ip6.addr} dev ${netname}
-                ${iproute}/sbin/ip -6 route add ${net.ip6.prefix} dev ${netname}
-              ''}
+              ${cfg.tincUp}
             '';
           }
         );
diff --git a/krebs/4lib/default.nix b/krebs/4lib/default.nix
index 8a822ed7d..49241cc82 100644
--- a/krebs/4lib/default.nix
+++ b/krebs/4lib/default.nix
@@ -33,6 +33,7 @@ let out = import <stockholm/lib> // rec {
   dir.has-default-nix = path: pathExists (path + "/default.nix");
 
   genid = import ./genid.nix { lib = lib // out; };
+  genid_signed = x: ((genid x) + 16777216) / 2;
   git = import ./git.nix { lib = lib // out; };
   tree = import ./tree.nix { inherit lib; };
 
diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix
index 8906eff4a..37d44606b 100644
--- a/krebs/4lib/types.nix
+++ b/krebs/4lib/types.nix
@@ -130,16 +130,28 @@ types // rec {
               type = str;
               default = concatStringsSep "\n" (
                 (optionals (net.via != null)
-                  (map (a: "Address = ${a}") net.via.addrs))
+                  (map (a: "Address = ${a} ${toString config.port}") net.via.addrs))
                 ++
                 (map (a: "Subnet = ${a}") net.addrs)
                 ++
+                [config.extraConfig]
+                ++
                 [config.pubkey]
               );
             };
             pubkey = mkOption {
               type = tinc-pubkey;
             };
+            extraConfig = mkOption {
+              description = "Extra Configuration to be appended to the hosts file";
+              default = "";
+              type = string;
+            };
+            port = mkOption {
+              type = int;
+              description = "tinc port to use to connect to host";
+              default = 655;
+            };
           };
         }));
         default = null;
diff --git a/krebs/5pkgs/exim/default.nix b/krebs/5pkgs/exim/default.nix
index 0918e308d..835970555 100644
--- a/krebs/5pkgs/exim/default.nix
+++ b/krebs/5pkgs/exim/default.nix
@@ -1,4 +1,4 @@
-{ coreutils, fetchurl, db, openssl, pcre, perl, pkgconfig, stdenv }:
+{ coreutils, fetchurl, db, openssl, pam, pcre, perl, pkgconfig, stdenv }:
 
 stdenv.mkDerivation rec {
   name = "exim-4.87";
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "1jbxn13shq90kpn0s73qpjnx5xm8jrpwhcwwgqw5s6sdzw6iwsbl";
   };
 
-  buildInputs = [ coreutils db openssl pcre perl pkgconfig ];
+  buildInputs = [ coreutils db openssl pam pcre perl pkgconfig ];
 
   preBuild = ''
     sed '
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
       s:^# \(SUPPORT_TLS\)=.*:\1=yes:
       s:^# \(USE_OPENSSL_PC=openssl\)$:\1:
       s:^# \(LOG_FILE_PATH=syslog\)$:\1:
+      s:^# \(SUPPORT_PAM\)=.*:\1=yes\nEXTRALIBS=-lpam:
       s:^# \(HAVE_IPV6=yes\)$:\1:
       s:^# \(CHOWN_COMMAND\)=.*:\1=${coreutils}/bin/chown:
       s:^# \(CHGRP_COMMAND\)=.*:\1=${coreutils}/bin/chgrp: