remove pam_tally2

Signed-off-by: Martin Schurz <[email protected]>

roles/os_hardening/tasks/pam.yml

@@ -53,35 +53,12 @@
     - ansible_facts.distribution in ['Debian', 'Ubuntu']
     - not os_auth_pam_passwdqc_enable
 
-- name: install tally2
-  apt:
-    name: 'libpam-modules'
-    state: 'present'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - not os_auth_pam_passwdqc_enable
-    - os_auth_retries > 0
-
-- name: configure tally2
-  template:
-    src: 'usr/share/pam-configs/pam_tally2.j2'
-    dest: '{{ tally2_path }}'
-    mode: '0644'
-    owner: 'root'
-    group: 'root'
-  when:
-    - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - not os_auth_pam_passwdqc_enable
-    - os_auth_retries > 0
-
-- name: delete tally2 when retries is 0
+- name: delete tally2 config
   file:
-    path: '{{ tally2_path }}'
+    path: /usr/share/pam-configs/tally2
     state: 'absent'
   when:
     - ansible_facts.distribution in ['Debian', 'Ubuntu']
-    - not os_auth_pam_passwdqc_enable
-    - os_auth_retries == 0
 
 - name: remove pam_cracklib, because it does not play nice with passwdqc
   yum:
@@ -111,7 +88,7 @@
     - ansible_facts.os_family == 'RedHat'
     - not os_auth_pam_passwdqc_enable
 
-- name: configure passwdqc and tally via central system-auth confic
+- name: configure pam via central system-auth config
   template:
     src: 'etc/pam.d/rhel_system_auth.j2'
     dest: '/etc/pam.d/system-auth-ac'

roles/os_hardening/templates/etc/login.defs.j2

@@ -30,7 +30,7 @@ MAIL_DIR          {{ os_useradd_mail_dir }}
 CREATE_HOME       {{ 'yes' if os_useradd_create_home else 'no' }}
 
 {% endif %}
-# Enable logging and display of `/var/log/faillog` login failure info. This option conflicts with the `pam_tally` PAM module.
+# Enable logging and display of `/var/log/faillog` login failure info.
 FAILLOG_ENAB      yes
 
 # Enable display of unknown usernames when login failures are recorded.

roles/os_hardening/templates/etc/pam.d/rhel_system_auth.j2

@@ -3,7 +3,6 @@
 
 #%PAM-1.0
 {% if os_auth_retries > 0 %}
-auth        required      pam_tally2.so deny={{ os_auth_retries }} onerr=fail unlock_time={{ os_auth_lockout_time }}
 {% endif %}
 auth        required      pam_env.so
 auth        sufficient    pam_unix.so nullok try_first_pass
@@ -11,7 +10,6 @@ auth        requisite     pam_succeed_if.so uid >= 500 quiet
 auth        required      pam_deny.so
 
 {% if os_auth_retries > 0 %}
-account     required      pam_tally2.so
 {% endif %}
 account     required      pam_unix.so
 account     sufficient    pam_localuser.so

roles/os_hardening/templates/usr/share/pam-configs/pam_tally2.j2

@@ -1,13 +0,0 @@
-{{ ansible_managed | comment }}
-# Generated by Ansible role {{ ansible_role_name }}
-
-Name: tally2 lockout after failed attempts enforcement
-Default: yes
-Priority: 1024
-Conflicts: cracklib
-Auth-Type: Primary
-Auth-Initial:
-  required      pam_tally2.so deny={{ os_auth_retries }} onerr=fail unlock_time={{ os_auth_lockout_time }}
-Account-Type: Primary
-Account-Initial:
-  required      pam_tally2.so

roles/os_hardening/vars/Debian.yml

@@ -33,7 +33,6 @@ os_useradd_mail_dir: /var/mail
 modprobe_package: 'kmod'
 auditd_package: 'auditd'
 
-tally2_path: '/usr/share/pam-configs/tally2'
 passwdqc_path: '/usr/share/pam-configs/passwdqc'
 
 hidepid_option: '2'  # allowed values: 0, 1, 2