59 lines
1.8 KiB
YAML
59 lines
1.8 KiB
YAML
---
|
|
- name: Gather package facts
|
|
ansible.builtin.package_facts:
|
|
manager: auto
|
|
when:
|
|
- ansible_facts.os_family != 'Suse'
|
|
- ansible_facts.os_family != 'Archlinux'
|
|
|
|
# the reason for this is so a user cannot connect to a server,
|
|
# that isn't connected to an LDAP server anymore.
|
|
# normally caching credentials shouldn't be necessary for most machines.
|
|
# removing it provides some more security while not removing usability.
|
|
- name: Remove pam ccreds to disable password caching
|
|
ansible.builtin.package:
|
|
name: "{{ os_packages_pam_ccreds }}"
|
|
state: absent
|
|
when:
|
|
- ansible_facts.os_family != 'Archlinux'
|
|
|
|
- name: Import tasks for Debian PAM
|
|
ansible.builtin.import_tasks: pam_debian.yml
|
|
when:
|
|
- ansible_facts.os_family == 'Debian'
|
|
|
|
- name: Import tasks for RedHat PAM
|
|
ansible.builtin.import_tasks: pam_rhel.yml
|
|
when:
|
|
- ansible_facts.os_family == 'RedHat'
|
|
|
|
- name: Allow Login with SSH Keys, when user password is expired
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/pam.d/system-auth
|
|
backrefs: true
|
|
regexp: "^(account.*pam_unix.so(?!.*no_pass_expiry).*)$"
|
|
line: '\1 no_pass_expiry'
|
|
when:
|
|
- ansible_facts.os_family == 'Archlinux'
|
|
|
|
- name: Allow Login with SSH Keys, when user password is expired
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/pam.d/common-account
|
|
backrefs: true
|
|
regexp: "^(account.*pam_unix.so(?!.*no_pass_expiry).*)$"
|
|
line: '\1 no_pass_expiry'
|
|
when:
|
|
- ansible_facts.os_family == 'Suse'
|
|
|
|
- name: NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512
|
|
ansible.builtin.template:
|
|
src: etc/libuser.conf.j2
|
|
dest: /etc/libuser.conf
|
|
mode: "0640"
|
|
owner: root
|
|
group: root
|
|
when:
|
|
- ansible_facts.os_family != 'Suse'
|
|
- ansible_facts.os_family != 'Archlinux'
|
|
- "'libuser' in ansible_facts.packages"
|