Mirrors/ansible-collection-hardening
2
0
Fork 0
mirror of https://github.com/dev-sec/ansible-collection-hardening synced 2024-11-10 09:14:18 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #594 from dlouzan/fix/type-cast-variables

Browse source 
fix(os_hardening): cast expected int types in pam tasks
This commit is contained in:
schurzi 2022-10-27 20:43:17 +02:00 committed by GitHub
commit 99fe8b6969
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 10 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
roles/os_hardening/tasks/pam_debian.yml
View file

@ -22,7 +22,7 @@
name: 'libpam-modules'
state: 'present'
when:
- os_auth_retries > 0
- os_auth_retries|int > 0
- name: Manage tally on Debian stable
when:
@ -37,14 +37,14 @@
owner: 'root'
group: 'root'
when:
- os_auth_retries > 0
- os_auth_retries|int > 0
- name: Delete tally2 when retries is 0
file:
path: '{{ tally2_path }}'
state: 'absent'
when:
- os_auth_retries == 0
- os_auth_retries|int == 0
- name: Manage tally/faillock on Debian unstable
when:
@ -80,7 +80,7 @@
owner: 'root'
group: 'root'
when:
- os_auth_retries > 0
- os_auth_retries|int > 0
- name: Configure faillock pam authfail
template:
@ -90,21 +90,21 @@
owner: 'root'
group: 'root'
when:
- os_auth_retries > 0
- os_auth_retries|int > 0
- name: Delete faillock when retries is 0
file:
path: '/usr/share/pam-configs/faillock'
state: 'absent'
when:
- os_auth_retries == 0
- os_auth_retries|int == 0
- name: Delete faillock authfail when retries is 0
file:
path: '/usr/share/pam-configs/faillock_authfail'
state: 'absent'
when:
- os_auth_retries == 0
- os_auth_retries|int == 0
- name: Update pam on Debian systems
command: 'pam-auth-update --package'

6
roles/os_hardening/templates/etc/pam.d/rhel_auth.j2
View file

@ -4,7 +4,7 @@
#%PAM-1.0
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
{% if os_auth_retries > 0 %}
{% if os_auth_retries|int > 0 %}
auth required pam_faillock.so preauth silent audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
{% endif %}
{% if (os_auth_pam_sssd_enable | bool) %}
@ -16,12 +16,12 @@ auth sufficient pam_unix.so nullok try_first_pass
auth [default=1 ignore=ignore success=ok] pam_succeed_if.so uid >= 1000 quiet
auth sufficient pam_sss.so forward_pass
{% endif %}
{% if os_auth_retries > 0 %}
{% if os_auth_retries|int > 0 %}
auth required pam_faillock.so authfail audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
{% endif %}
auth required pam_deny.so
{% if os_auth_retries > 0 %}
{% if os_auth_retries|int > 0 %}
account required pam_faillock.so
{% endif %}
account required pam_unix.so