andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

remove rhel6 support from pam

Browse Source 
Signed-off-by: Martin Schurz <[email protected]>
This commit is contained in:
Martin Schurz committed 2021-02-14 12:14:54 +01:00
1 parent 04654d0490
commit 532917d956
2 files changed
+11 -33
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

roles/os_hardening/templates/etc/pam.d/rhel_system_auth.j2
+4 -8
View File
@@ -3,6 +3,7 @@
#%PAM-1.0
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
{% if os_auth_retries > 0 %}
auth required pam_faillock.so preauth silent audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
{% endif %}
@@ -10,7 +11,7 @@ auth sufficient pam_unix.so nullok try_first_pass
{% if os_auth_retries > 0 %}
auth [default=die] pam_faillock.so authfail audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
{% endif %}
auth requisite pam_succeed_if.so uid >= 500 quiet
auth requisite pam_succeed_if.so uid >= 1000 quiet
auth required pam_deny.so
{% if os_auth_retries > 0 %}
@@ -18,20 +19,14 @@ account required pam_faillock.so
{% endif %}
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account sufficient pam_succeed_if.so uid < 1000 quiet
account required pam_permit.so
{% if (os_auth_pam_passwdqc_enable|bool) %}
{%- if ((ansible_facts.os_family == 'RedHat' and ansible_facts.distribution_version|int is version('7', '>=')) or ansible_facts.distribution == 'Amazon') %}
password required pam_pwquality.so {{ os_auth_pam_pwquality_options }}
{%- else %}
password requisite pam_passwdqc.so {{ os_auth_pam_passwdqc_options }}
{%- endif %}
{% else %}
password requisite pam_cracklib.so try_first_pass retry=3 type=
{% endif %}
# NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
# NSA 2.3.3.6 Limit Password Reuse
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5
@@ -39,5 +34,6 @@ password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so