re-add debian tally config

Signed-off-by: Martin Schurz <[email protected]>

roles/os_hardening/tasks/pam.yml

@@ -53,12 +53,35 @@
     - ansible_facts.distribution in ['Debian', 'Ubuntu']
     - not os_auth_pam_passwdqc_enable
 
-- name: delete tally2 config
+- name: install tally2
+  apt:
+    name: 'libpam-modules'
+    state: 'present'
+  when:
+    - ansible_facts.distribution in ['Debian', 'Ubuntu']
+    - not os_auth_pam_passwdqc_enable
+    - os_auth_retries > 0
+
+- name: configure tally2
+  template:
+    src: 'usr/share/pam-configs/pam_tally2.j2'
+    dest: '{{ tally2_path }}'
+    mode: '0644'
+    owner: 'root'
+    group: 'root'
+  when:
+    - ansible_facts.distribution in ['Debian', 'Ubuntu']
+    - not os_auth_pam_passwdqc_enable
+    - os_auth_retries > 0
+
+- name: delete tally2 when retries is 0
   file:
-    path: /usr/share/pam-configs/tally2
+    path: '{{ tally2_path }}'
     state: 'absent'
   when:
     - ansible_facts.distribution in ['Debian', 'Ubuntu']
+    - not os_auth_pam_passwdqc_enable
+    - os_auth_retries == 0
 
 - name: remove pam_cracklib, because it does not play nice with passwdqc
   yum:
@@ -88,7 +111,7 @@
     - ansible_facts.os_family == 'RedHat'
     - not os_auth_pam_passwdqc_enable
 
-- name: configure pam via central system-auth config
+- name: configure passwdqc and tally via central system-auth confic
   template:
     src: 'etc/pam.d/rhel_system_auth.j2'
     dest: '/etc/pam.d/system-auth-ac'

roles/os_hardening/templates/etc/login.defs.j2

@@ -30,7 +30,7 @@ MAIL_DIR          {{ os_useradd_mail_dir }}
 CREATE_HOME       {{ 'yes' if os_useradd_create_home else 'no' }}
 
 {% endif %}
-# Enable logging and display of `/var/log/faillog` login failure info.
+# Enable logging and display of `/var/log/faillog` login failure info. This option conflicts with the `pam_tally` PAM module.
 FAILLOG_ENAB      yes
 
 # Enable display of unknown usernames when login failures are recorded.

roles/os_hardening/templates/usr/share/pam-configs/pam_tally2.j2

@@ -0,0 +1,13 @@
+{{ ansible_managed | comment }}
+# Generated by Ansible role {{ ansible_role_name }}
+
+Name: tally2 lockout after failed attempts enforcement
+Default: yes
+Priority: 1024
+Conflicts: cracklib
+Auth-Type: Primary
+Auth-Initial:
+  required      pam_tally2.so deny={{ os_auth_retries }} onerr=fail unlock_time={{ os_auth_lockout_time }}
+Account-Type: Primary
+Account-Initial:
+  required      pam_tally2.so

roles/os_hardening/vars/Debian.yml

@@ -33,6 +33,7 @@ os_useradd_mail_dir: /var/mail
 modprobe_package: 'kmod'
 auditd_package: 'auditd'
 
+tally2_path: '/usr/share/pam-configs/tally2'
 passwdqc_path: '/usr/share/pam-configs/passwdqc'
 
 hidepid_option: '2'  # allowed values: 0, 1, 2