andersen/ansible-collection-hardening
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

consolidate auth for rhel

Browse Source 
Signed-off-by: Martin Schurz <[email protected]>
This commit is contained in:
Martin Schurz committed 2021-02-14 17:30:02 +01:00
1 parent 30f0839513
commit 7f1765c608
3 files changed
+10 -60
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

roles/os_hardening/tasks/pam_rhel.yml
+2 -2
View File
@@ -8,7 +8,7 @@
- name: configure passwdqc and faillock via central system-auth config
template:
src: 'etc/pam.d/rhel_system_auth.j2'
src: 'etc/pam.d/rhel_auth.j2'
dest: '/etc/pam.d/system-auth-local'
mode: '0640'
owner: 'root'
@@ -26,7 +26,7 @@
- name: configure passwdqc and faillock via central password-auth config
template:
src: 'etc/pam.d/rhel_password_auth.j2'
src: 'etc/pam.d/rhel_auth.j2'
dest: '/etc/pam.d/password-auth-local'
mode: '0640'
owner: 'root'
roles/os_hardening/templates/etc/pam.d/rhel_system_auth.j2 → roles/os_hardening/templates/etc/pam.d/rhel_auth.j2
+8 -8
View File
@@ -10,15 +10,15 @@ auth required pam_faillock.so preauth silent audit even_deny_root de
{% if (os_auth_pam_sssd_enable | bool) %}
auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
auth [default=1 ignore=ignore success=ok] pam_localuser.so
{% else %}
auth sufficient pam_unix.so nullok try_first_pass
{% if os_auth_retries > 0 %}
auth [default=die] pam_faillock.so authfail audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
{% endif %}
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 1000 quiet
{% if (os_auth_pam_sssd_enable | bool) %}
auth sufficient pam_sss.so forward_pass
{% else %}
{% endif %}
{% if os_auth_retries > 0 %}
auth required pam_faillock.so authfail audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
{% endif %}
auth required pam_deny.so
{% if os_auth_retries > 0 %}
@@ -29,7 +29,7 @@ account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
{% if (os_auth_pam_sssd_enable | bool) %}
account [default=bad success=ok user_unknown=ignore] pam_sss.so
{% else %}
{% endif %}
account required pam_permit.so
{% if (os_auth_pam_passwdqc_enable | bool) %}
@@ -40,7 +40,7 @@ password required pam_pwquality.so {{ os_auth_pam_pwquality_options }}
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5
{% if (os_auth_pam_sssd_enable | bool) %}
password sufficient pam_sss.so use_authtok
{% else %}
{% endif %}
password required pam_deny.so
session optional pam_keyinit.so revoke
@@ -50,4 +50,4 @@ session [success=1 default=ignore] pam_succeed_if.so service in crond quiet
session required pam_unix.so
{% if (os_auth_pam_sssd_enable | bool) %}
session optional pam_sss.so
{% else %}
{% endif %}
roles/os_hardening/templates/etc/pam.d/rhel_password_auth.j2
-50
View File
@@ -1,50 +0,0 @@
{{ ansible_managed | comment }}
# Generated by Ansible role {{ ansible_role_name }}
#%PAM-1.0
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
{% if os_auth_retries > 0 %}
auth required pam_faillock.so preauth silent audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
{% endif %}
{% if (os_auth_pam_sssd_enable | bool) %}
auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
auth [default=1 ignore=ignore success=ok] pam_localuser.so
{% else %}
auth sufficient pam_unix.so nullok try_first_pass
{% if os_auth_retries > 0 %}
auth [default=die] pam_faillock.so authfail audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
{% endif %}
auth requisite pam_succeed_if.so uid >= 1000 quiet
{% if (os_auth_pam_sssd_enable | bool) %}
auth sufficient pam_sss.so forward_pass
{% else %}
auth required pam_deny.so
{% if os_auth_retries > 0 %}
account required pam_faillock.so
{% endif %}
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
{% if (os_auth_pam_sssd_enable | bool) %}
account [default=bad success=ok user_unknown=ignore] pam_sss.so
{% else %}
account required pam_permit.so
{% if (os_auth_pam_passwdqc_enable | bool) %}
password required pam_pwquality.so {{ os_auth_pam_pwquality_options }}
{% endif %}
# NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
# NSA 2.3.3.6 Limit Password Reuse
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
{% if (os_auth_pam_sssd_enable | bool) %}
session optional pam_sss.so
{% else %}