add support for rhel8 and sssd

Signed-off-by: Martin Schurz <[email protected]>

roles/os_hardening/tasks/pam_rhel.yml

@@ -1,4 +1,11 @@
 ---
+- name: install sssd-clients
+  yum:
+    name: sssd-client
+    state: 'present'
+  when:
+    - os_auth_pam_sssd_enable | bool
+
 - name: configure passwdqc and faillock via central system-auth config
   template:
     src: 'etc/pam.d/rhel_system_auth.j2'
@@ -17,6 +24,24 @@
     group: 'root'
     state: link
 
+- name: configure passwdqc and faillock via central password-auth config
+  template:
+    src: 'etc/pam.d/rhel_password_auth.j2'
+    dest: '/etc/pam.d/password-auth-local'
+    mode: '0640'
+    owner: 'root'
+    group: 'root'
+    force: true
+
+- name: enable our config for passwordauth
+  file:
+    src: /etc/pam.d/password-auth-local
+    dest: /etc/pam.d/password-auth
+    mode: '0640'
+    owner: 'root'
+    group: 'root'
+    state: link
+
 - name: remove passwdqc
   yum:
     name: '{{ os_packages_pam_passwdqc }}'

roles/os_hardening/templates/etc/pam.d/rhel_password_auth.j2

@@ -0,0 +1,50 @@
+{{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}
+
+#%PAM-1.0
+auth        required      pam_env.so
+auth        required      pam_faildelay.so delay=2000000
+{% if os_auth_retries > 0 %}
+auth        required      pam_faillock.so preauth silent audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
+{% endif %}
+{% if (os_auth_pam_sssd_enable | bool) %}
+auth        [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
+auth        [default=1 ignore=ignore success=ok] pam_localuser.so
+{% else %}
+auth        sufficient    pam_unix.so nullok try_first_pass
+{% if os_auth_retries > 0 %}
+auth        [default=die] pam_faillock.so authfail audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
+{% endif %}
+auth        requisite     pam_succeed_if.so uid >= 1000 quiet
+{% if (os_auth_pam_sssd_enable | bool) %}
+auth        sufficient    pam_sss.so forward_pass
+{% else %}
+auth        required      pam_deny.so
+
+{% if os_auth_retries > 0 %}
+account     required      pam_faillock.so
+{% endif %}
+account     required      pam_unix.so
+account     sufficient    pam_localuser.so
+account     sufficient    pam_succeed_if.so uid < 1000 quiet
+{% if (os_auth_pam_sssd_enable | bool) %}
+account     [default=bad success=ok user_unknown=ignore] pam_sss.so
+{% else %}
+account     required      pam_permit.so
+
+{% if (os_auth_pam_passwdqc_enable | bool) %}
+password    required      pam_pwquality.so {{ os_auth_pam_pwquality_options }}
+{% endif %}
+# NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
+# NSA 2.3.3.6 Limit Password Reuse
+password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5
+password    required      pam_deny.so
+
+session     optional      pam_keyinit.so revoke
+session     required      pam_limits.so
+-session     optional      pam_systemd.so
+session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
+session     required      pam_unix.so
+{% if (os_auth_pam_sssd_enable | bool) %}
+session     optional      pam_sss.so
+{% else %}

roles/os_hardening/templates/etc/pam.d/rhel_system_auth.j2

@@ -7,11 +7,18 @@ auth        required      pam_faildelay.so delay=2000000
 {% if os_auth_retries > 0 %}
 auth        required      pam_faillock.so preauth silent audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
 {% endif %}
+{% if (os_auth_pam_sssd_enable | bool) %}
+auth        [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
+auth        [default=1 ignore=ignore success=ok] pam_localuser.so
+{% else %}
 auth        sufficient    pam_unix.so nullok try_first_pass
 {% if os_auth_retries > 0 %}
 auth        [default=die] pam_faillock.so authfail audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
 {% endif %}
 auth        requisite     pam_succeed_if.so uid >= 1000 quiet
+{% if (os_auth_pam_sssd_enable | bool) %}
+auth        sufficient    pam_sss.so forward_pass
+{% else %}
 auth        required      pam_deny.so
 
 {% if os_auth_retries > 0 %}
@@ -20,20 +27,27 @@ account     required      pam_faillock.so
 account     required      pam_unix.so
 account     sufficient    pam_localuser.so
 account     sufficient    pam_succeed_if.so uid < 1000 quiet
+{% if (os_auth_pam_sssd_enable | bool) %}
+account     [default=bad success=ok user_unknown=ignore] pam_sss.so
+{% else %}
 account     required      pam_permit.so
 
-{% if (os_auth_pam_passwdqc_enable|bool) %}
+{% if (os_auth_pam_passwdqc_enable | bool) %}
 password    required      pam_pwquality.so {{ os_auth_pam_pwquality_options }}
-{% else %}
-password    requisite     pam_cracklib.so try_first_pass retry=3 type=
 {% endif %}
 # NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
 # NSA 2.3.3.6 Limit Password Reuse
 password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5
+{% if (os_auth_pam_sssd_enable | bool) %}
+password    sufficient    pam_sss.so use_authtok
+{% else %}
 password    required      pam_deny.so
 
 session     optional      pam_keyinit.so revoke
 session     required      pam_limits.so
--session     optional      pam_systemd.so
+-session    optional      pam_systemd.so
 session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
 session     required      pam_unix.so
+{% if (os_auth_pam_sssd_enable | bool) %}
+session     optional      pam_sss.so
+{% else %}

roles/os_hardening/vars/Amazon.yml

@@ -27,6 +27,8 @@ os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
 
+os_auth_pam_sssd_enable: true
+
 # defaults for useradd
 os_useradd_mail_dir: /var/spool/mail
 os_useradd_create_home: true

roles/os_hardening/vars/Fedora.yml

@@ -27,6 +27,8 @@ os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
 
+os_auth_pam_sssd_enable: true
+
 # defaults for useradd
 os_useradd_mail_dir: /var/spool/mail
 os_useradd_create_home: true

roles/os_hardening/vars/RedHat.yml

@@ -27,6 +27,8 @@ os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
 
+os_auth_pam_sssd_enable: false
+
 # defaults for useradd
 os_useradd_mail_dir: /var/spool/mail
 os_useradd_create_home: true

roles/os_hardening/vars/RedHat_7.yml

@@ -27,6 +27,8 @@ os_auth_sys_uid_max: 999
 os_auth_sys_gid_min: 201
 os_auth_sys_gid_max: 999
 
+os_auth_pam_sssd_enable: true
+
 # defaults for useradd
 os_useradd_mail_dir: /var/spool/mail
 os_useradd_create_home: true