config: nest PAM settings under pam: with per-service overrides

[adombeck]

The auth_fail_* brute-force mitigation settings belong to the PAM service, not to authd globally. They are now nested under pam: in authd.yaml, and can be overridden per PAM service:

pam:
  auth_fail_delay: 2s
  services:
    sshd:
      auth_fail_delay: 5s

[codecov]

Codecov Report

❌ Patch coverage is 97.36842% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 87.93%. Comparing base (9b65618) to head (60475ce).

Files with missing lines	Patch %	Lines
pam/internal/adapter/model.go	80.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1675      +/-   ##
==========================================
+ Coverage   87.91%   87.93%   +0.02%     
==========================================
  Files          96       96              
  Lines        6976     7005      +29     
  Branches      112      112              
==========================================
+ Hits         6133     6160      +27     
- Misses        787      789       +2     
  Partials       56       56              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR moves PAM brute-force mitigation settings into a dedicated pam: config section and introduces per-PAM-service override support, requiring the PAM client to send the PAM service name to authd so the daemon can apply the correct policy.

Changes:

• Add service_name to SBRequest and propagate PAM service name from the PAM adapter → gRPC → broker session tracking.
• Refactor PAM service brute-force mitigation configuration to support defaults plus per-service overrides (e.g., pam.services.sshd).
• Add startup warning for config entries referencing PAM services not present in /etc/pam.d, plus tests for override behavior.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
pam/internal/adapter/model.go	Captures PAM service name from PAM transaction for later propagation.
pam/internal/adapter/commands.go	Sends PAM service name in SelectBroker (SBRequest).
internal/services/pam/pam.go	Introduces nested PAM brute-force config with per-service overrides and uses service name during auth failure delay logic.
internal/services/pam/pam_test.go	Adds tests for unknown-service warnings and per-service fail-delay/reset-window behavior.
internal/services/pam/auth_fail_tracker_test.go	Updates tracker tests for new recordFailure signature.
internal/proto/authd/authd.proto	Adds service_name field to SBRequest.
internal/proto/authd/authd.pb.go	Regenerates Go protobuf for service_name.
internal/brokers/manager.go	Stores service name alongside session ID for later policy lookup.
internal/brokers/manager_test.go	Extends tests to validate service name is remembered per session.
debian/authd-config/authd.yaml	Updates example config comments to document pam: nesting and per-service overrides.
cmd/authd/daemon/daemon.go	Nests PAM config under pam: and warns on unknown PAM services at startup.
cmd/authd/daemon/daemon_test.go	Verifies default PAM config is set on daemon startup.

Files not reviewed (1)

• internal/proto/authd/authd.pb.go: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[denisonbarbosa]

Looks good to me, but I'd like to see if @3v1n0 has something to point out

[3v1n0]

Oh nice this was what I was also working on in the past, and it would ideally be used in future by the module itself to control module-only settings there without having to deal with pam config files.

[3v1n0]

Well, this can also be /usr/lib/pam.d, we don't have a dynamic way to figure it out though.

[3v1n0]

Ah, I found what I was sketching on, not sure if that gives some hints, but just leaving it as it was my internal/services/pam/config.go

package pam

const (
        // SSHServiceName is the default PAM service name for sshd.
	SSHServiceName = "sshd"
)

type ConfigValues struct {
        DisableLocalStack bool `mapstructure:"disable_local_stack" yaml:"disable_local_stack"`
}

// Config is the configuration for the PAM service.
type Config struct {
        ConfigValues `mapstructure:",squash" yaml:",inline"`

	// TODO: Include here all the relevant PAM module `supportedArgs` values and
	// providing them to the client via a new GetConfig GRPC request, thus
	// only allow to override them from the PAM module side, since they may
	// be useful for debugging.

	// ServicesOverrides is a map containing the [ConfigValue] overrides for
	// specific services.
	ServicesOverrides map[string]ConfigValues `mapstructure:"services_overrides" yaml:"services_overrides"`
}

func (c Config) GetServiceConfigValues(serviceName string) ConfigValues {
        so, ok := c.ServicesOverrides[serviceName]
        if !ok {
                return c.ConfigValues
        }

        // FIXME: Use reflect to iterate over values when we'll have more...
	c.DisableLocalStack = so.DisableLocalStack
        return c.ConfigValues
}

// DefaultConfig is the default configuration for the PAM service.
var DefaultConfig = Config{
        ServicesOverrides: map[string]ConfigValues{SSHServiceName: {DisableLocalStack: true}},
}

And that was used as per in commit 3v1n0@dab2981