split debian and rhel pam config
Signed-off-by: Martin Schurz <[email protected]>
This commit is contained in:
Martin Schurz committed
1 parent
19482c319c
commit
aa166f43fc
3 files changed
+147
-152
No files matched your search
@@ -17,163 +17,13 @@
|
||||
when:
|
||||
- ansible_facts.os_family != 'Archlinux'
|
||||
|
||||
- name: remove pam_cracklib, because it does not play nice with passwdqc
|
||||
apt:
|
||||
name: '{{ os_packages_pam_cracklib }}'
|
||||
state: 'absent'
|
||||
- import_tasks: pam_debian.yml
|
||||
when:
|
||||
- ansible_facts.distribution in ['Debian', 'Ubuntu']
|
||||
- os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: install the package for strong password checking
|
||||
apt:
|
||||
name: '{{ os_packages_pam_passwdqc }}'
|
||||
state: 'present'
|
||||
update_cache: 'yes'
|
||||
when:
|
||||
- ansible_facts.distribution in ['Debian', 'Ubuntu']
|
||||
- os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: configure passwdqc
|
||||
template:
|
||||
src: 'usr/share/pam-configs/pam_passwdqd.j2'
|
||||
dest: '{{ passwdqc_path }}'
|
||||
mode: '0644'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
when:
|
||||
- ansible_facts.distribution in ['Debian', 'Ubuntu']
|
||||
- os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: remove passwdqc
|
||||
apt:
|
||||
name: '{{ os_packages_pam_passwdqc }}'
|
||||
state: 'absent'
|
||||
when:
|
||||
- ansible_facts.distribution in ['Debian', 'Ubuntu']
|
||||
- not os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: install tally2
|
||||
apt:
|
||||
name: 'libpam-modules'
|
||||
state: 'present'
|
||||
when:
|
||||
- ansible_facts.distribution in ['Debian', 'Ubuntu']
|
||||
- os_auth_retries > 0
|
||||
|
||||
- name: manage tally on Debian stable
|
||||
block:
|
||||
- name: configure tally2
|
||||
template:
|
||||
src: 'usr/share/pam-configs/pam_tally2.j2'
|
||||
dest: '{{ tally2_path }}'
|
||||
mode: '0644'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
when:
|
||||
- os_auth_retries > 0
|
||||
|
||||
- name: delete tally2 when retries is 0
|
||||
file:
|
||||
path: '{{ tally2_path }}'
|
||||
state: 'absent'
|
||||
when:
|
||||
- os_auth_retries == 0
|
||||
when:
|
||||
- ansible_facts.distribution in ['Debian', 'Ubuntu']
|
||||
- "'libpam-modules' in ansible_facts.packages"
|
||||
- "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '<')"
|
||||
|
||||
- name: manage tally/faillock on Debian unstable
|
||||
block:
|
||||
- name: delete tally2
|
||||
file:
|
||||
path: '{{ tally2_path }}'
|
||||
state: 'absent'
|
||||
|
||||
- name: configure faillock
|
||||
template:
|
||||
src: 'etc/security/faillock.conf.j2'
|
||||
dest: '/etc/security/faillock.conf'
|
||||
mode: '0644'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
|
||||
- name: configure faillock pam
|
||||
template:
|
||||
src: 'usr/share/pam-configs/pam_faillock.j2'
|
||||
dest: '/usr/share/pam-configs/faillock'
|
||||
mode: '0644'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
when:
|
||||
- os_auth_retries > 0
|
||||
|
||||
- name: delete faillock when retries is 0
|
||||
file:
|
||||
path: '/usr/share/pam-configs/faillock'
|
||||
state: 'absent'
|
||||
when:
|
||||
- os_auth_retries == 0
|
||||
when:
|
||||
- ansible_facts.distribution in ['Debian', 'Ubuntu']
|
||||
- "'libpam-modules' in ansible_facts.packages"
|
||||
- "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '>=')"
|
||||
|
||||
- name: update pam on Debian systems
|
||||
command: 'pam-auth-update --package'
|
||||
environment:
|
||||
DEBIAN_FRONTEND: noninteractive
|
||||
changed_when: false
|
||||
when: ansible_facts.distribution in ['Debian', 'Ubuntu']
|
||||
|
||||
- name: remove pam_cracklib, because it does not play nice with passwdqc
|
||||
yum:
|
||||
name: '{{ os_packages_pam_cracklib }}'
|
||||
state: 'absent'
|
||||
- import_tasks: pam_rhel.yml
|
||||
when:
|
||||
- ansible_facts.os_family == 'RedHat'
|
||||
- ansible_facts.distribution_major_version|int is version('7', '<')
|
||||
- ansible_facts.distribution != 'Amazon'
|
||||
- os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: install the package for strong password checking
|
||||
yum:
|
||||
name: '{{ os_packages_pam_passwdqc }}'
|
||||
state: 'present'
|
||||
when:
|
||||
- ansible_facts.os_family == 'RedHat'
|
||||
- ansible_facts.distribution_major_version|int is version('7', '<')
|
||||
- ansible_facts.distribution != 'Amazon'
|
||||
- os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: remove passwdqc
|
||||
yum:
|
||||
name: '{{ os_packages_pam_passwdqc }}'
|
||||
state: 'absent'
|
||||
when:
|
||||
- ansible_facts.os_family == 'RedHat'
|
||||
- not os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: configure passwdqc and faillock via central system-auth config
|
||||
template:
|
||||
src: 'etc/pam.d/rhel_system_auth.j2'
|
||||
dest: '/etc/pam.d/system-auth-local'
|
||||
mode: '0640'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
force: true
|
||||
when: ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: enable our config for system-auth
|
||||
file:
|
||||
src: /etc/pam.d/system-auth-local
|
||||
dest: /etc/pam.d/system-auth
|
||||
mode: '0640'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
state: link
|
||||
when: ansible_facts.os_family == 'RedHat'
|
||||
|
||||
- name: NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
|
||||
template:
|
||||
|
||||
@@ -0,0 +1,102 @@
|
||||
---
|
||||
- name: remove pam_cracklib, because it does not play nice with passwdqc
|
||||
apt:
|
||||
name: '{{ os_packages_pam_cracklib }}'
|
||||
state: 'absent'
|
||||
when:
|
||||
- os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: install the package for strong password checking
|
||||
apt:
|
||||
name: '{{ os_packages_pam_passwdqc }}'
|
||||
state: 'present'
|
||||
update_cache: 'yes'
|
||||
when:
|
||||
- os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: configure passwdqc
|
||||
template:
|
||||
src: 'usr/share/pam-configs/pam_passwdqd.j2'
|
||||
dest: '{{ passwdqc_path }}'
|
||||
mode: '0644'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
when:
|
||||
- os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: remove passwdqc
|
||||
apt:
|
||||
name: '{{ os_packages_pam_passwdqc }}'
|
||||
state: 'absent'
|
||||
when:
|
||||
- not os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: install tally2
|
||||
apt:
|
||||
name: 'libpam-modules'
|
||||
state: 'present'
|
||||
when:
|
||||
- os_auth_retries > 0
|
||||
|
||||
- name: manage tally on Debian stable
|
||||
block:
|
||||
- name: configure tally2
|
||||
template:
|
||||
src: 'usr/share/pam-configs/pam_tally2.j2'
|
||||
dest: '{{ tally2_path }}'
|
||||
mode: '0644'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
when:
|
||||
- os_auth_retries > 0
|
||||
|
||||
- name: delete tally2 when retries is 0
|
||||
file:
|
||||
path: '{{ tally2_path }}'
|
||||
state: 'absent'
|
||||
when:
|
||||
- os_auth_retries == 0
|
||||
when:
|
||||
- "'libpam-modules' in ansible_facts.packages"
|
||||
- "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '<')"
|
||||
|
||||
- name: manage tally/faillock on Debian unstable
|
||||
block:
|
||||
- name: delete tally2
|
||||
file:
|
||||
path: '{{ tally2_path }}'
|
||||
state: 'absent'
|
||||
|
||||
- name: configure faillock
|
||||
template:
|
||||
src: 'etc/security/faillock.conf.j2'
|
||||
dest: '/etc/security/faillock.conf'
|
||||
mode: '0644'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
|
||||
- name: configure faillock pam
|
||||
template:
|
||||
src: 'usr/share/pam-configs/pam_faillock.j2'
|
||||
dest: '/usr/share/pam-configs/faillock'
|
||||
mode: '0644'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
when:
|
||||
- os_auth_retries > 0
|
||||
|
||||
- name: delete faillock when retries is 0
|
||||
file:
|
||||
path: '/usr/share/pam-configs/faillock'
|
||||
state: 'absent'
|
||||
when:
|
||||
- os_auth_retries == 0
|
||||
when:
|
||||
- "'libpam-modules' in ansible_facts.packages"
|
||||
- "ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '>=')"
|
||||
|
||||
- name: update pam on Debian systems
|
||||
command: 'pam-auth-update --package'
|
||||
environment:
|
||||
DEBIAN_FRONTEND: noninteractive
|
||||
changed_when: false
|
||||
@@ -0,0 +1,43 @@
|
||||
---
|
||||
- name: remove pam_cracklib, because it does not play nice with passwdqc
|
||||
yum:
|
||||
name: '{{ os_packages_pam_cracklib }}'
|
||||
state: 'absent'
|
||||
when:
|
||||
- ansible_facts.distribution_major_version|int is version('7', '<')
|
||||
- ansible_facts.distribution != 'Amazon'
|
||||
- os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: install the package for strong password checking
|
||||
yum:
|
||||
name: '{{ os_packages_pam_passwdqc }}'
|
||||
state: 'present'
|
||||
when:
|
||||
- ansible_facts.distribution_major_version|int is version('7', '<')
|
||||
- ansible_facts.distribution != 'Amazon'
|
||||
- os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: remove passwdqc
|
||||
yum:
|
||||
name: '{{ os_packages_pam_passwdqc }}'
|
||||
state: 'absent'
|
||||
when:
|
||||
- not os_auth_pam_passwdqc_enable
|
||||
|
||||
- name: configure passwdqc and faillock via central system-auth config
|
||||
template:
|
||||
src: 'etc/pam.d/rhel_system_auth.j2'
|
||||
dest: '/etc/pam.d/system-auth-local'
|
||||
mode: '0640'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
force: true
|
||||
|
||||
- name: enable our config for system-auth
|
||||
file:
|
||||
src: /etc/pam.d/system-auth-local
|
||||
dest: /etc/pam.d/system-auth
|
||||
mode: '0640'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
state: link
|
||||
Reference in new issue
Block a user