MOdify PAM to allow SSH Key logins with locked passwords

Signed-off-by: Martin Schurz <[email protected]>

roles/os_hardening/tasks/pam_debian.yml

@@ -118,3 +118,10 @@
     state: absent
   when:
     - not os_auth_pam_passwdqc_enable
+
+- name: Allow Login with SSH Keys, when user password is expired
+  lineinfile:
+    path: /etc/pam.d/common-account
+    backrefs: yes
+    regexp: "^(account.*pam_unix.so(?!.*no_pass_expiry).*)$"
+    line: '\1 no_pass_expiry'

roles/os_hardening/templates/etc/pam.d/rhel_auth.j2

@@ -24,7 +24,7 @@ auth        required      pam_deny.so
 {% if os_auth_retries|int > 0 %}
 account     required      pam_faillock.so
 {% endif %}
-account     required      pam_unix.so
+account     required      pam_unix.so no_pass_expiry
 account     sufficient    pam_localuser.so
 account     sufficient    pam_succeed_if.so uid < 1000 quiet
 {% if (os_auth_pam_sssd_enable | bool) %}