Sebastian Gumprich
bb588bd777
* linting Signed-off-by: Sebastian Gumprich <[email protected]> * more linting Signed-off-by: Sebastian Gumprich <[email protected]> * change line length issues Signed-off-by: Sebastian Gumprich <[email protected]> * replace yes with true in tasks Signed-off-by: Sebastian Gumprich <[email protected]> * use manual line-wrapping because ansible-lint does not support it correctly. see https://github.com/ansible/ansible-lint/issues/2522 * use manual line-wrapping because ansible-lint does not support it correctly. see https://github.com/ansible/ansible-lint/issues/2522 Signed-off-by: Sebastian Gumprich <[email protected]> * use manual line-wrapping because ansible-lint does not support it correctly. see https://github.com/ansible/ansible-lint/issues/2522 Signed-off-by: Sebastian Gumprich <[email protected]> * add exception for task Signed-off-by: Sebastian Gumprich <[email protected]> * remove trailing whitespace * add back deleted params Signed-off-by: Sebastian Gumprich <[email protected]> * add back deleted params Signed-off-by: Sebastian Gumprich <[email protected]> * add back tasks Signed-off-by: Sebastian Gumprich <[email protected]>
121 lines
3.1 KiB
YAML
121 lines
3.1 KiB
YAML
---
|
|
- name: Install the package for strong password checking
|
|
ansible.builtin.apt:
|
|
name: libpam-passwdqc
|
|
state: present
|
|
update_cache: true
|
|
when:
|
|
- os_auth_pam_passwdqc_enable
|
|
|
|
- name: Configure passwdqc
|
|
ansible.builtin.template:
|
|
src: usr/share/pam-configs/pam_passwdqc.j2
|
|
dest: "{{ passwdqc_path }}"
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
when:
|
|
- os_auth_pam_passwdqc_enable
|
|
|
|
- name: Install tally2
|
|
ansible.builtin.apt:
|
|
name: libpam-modules
|
|
state: present
|
|
when:
|
|
- os_auth_retries|int > 0
|
|
|
|
- name: Manage tally on Debian stable
|
|
when:
|
|
- "'libpam-modules' in ansible_facts.packages"
|
|
- ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '<')
|
|
block:
|
|
- name: Configure tally2
|
|
ansible.builtin.template:
|
|
src: usr/share/pam-configs/pam_tally2.j2
|
|
dest: "{{ tally2_path }}"
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
when:
|
|
- os_auth_retries|int > 0
|
|
|
|
- name: Delete tally2 when retries is 0
|
|
ansible.builtin.file:
|
|
path: "{{ tally2_path }}"
|
|
state: absent
|
|
when:
|
|
- os_auth_retries|int == 0
|
|
|
|
- name: Manage tally/faillock on Debian unstable
|
|
when:
|
|
- "'libpam-modules' in ansible_facts.packages"
|
|
- ansible_facts.packages['libpam-modules'][0].version is version('1.4.0', '>=')
|
|
block:
|
|
- name: Delete tally2
|
|
ansible.builtin.file:
|
|
path: "{{ tally2_path }}"
|
|
state: absent
|
|
|
|
- name: Create tally directory
|
|
ansible.builtin.file:
|
|
path: /var/run/faillock
|
|
state: directory
|
|
mode: "0755"
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Configure faillock
|
|
ansible.builtin.template:
|
|
src: etc/security/faillock.conf.j2
|
|
dest: /etc/security/faillock.conf
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
|
|
- name: Configure faillock pam
|
|
ansible.builtin.template:
|
|
src: usr/share/pam-configs/pam_faillock.j2
|
|
dest: /usr/share/pam-configs/faillock
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
when:
|
|
- os_auth_retries|int > 0
|
|
|
|
- name: Configure faillock pam authfail
|
|
ansible.builtin.template:
|
|
src: usr/share/pam-configs/pam_faillock_authfail.j2
|
|
dest: /usr/share/pam-configs/faillock_authfail
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
when:
|
|
- os_auth_retries|int > 0
|
|
|
|
- name: Delete faillock when retries is 0
|
|
ansible.builtin.file:
|
|
path: /usr/share/pam-configs/faillock
|
|
state: absent
|
|
when:
|
|
- os_auth_retries|int == 0
|
|
|
|
- name: Delete faillock authfail when retries is 0
|
|
ansible.builtin.file:
|
|
path: /usr/share/pam-configs/faillock_authfail
|
|
state: absent
|
|
when:
|
|
- os_auth_retries|int == 0
|
|
|
|
- name: Update pam on Debian systems
|
|
ansible.builtin.command: pam-auth-update --package
|
|
environment:
|
|
DEBIAN_FRONTEND: noninteractive
|
|
changed_when: false
|
|
|
|
- name: Remove passwdqc
|
|
ansible.builtin.apt:
|
|
name: libpam-passwdqc
|
|
state: absent
|
|
when:
|
|
- not os_auth_pam_passwdqc_enable
|