Mirrors/ansible-collection-hardening
2
0
Fork 0
mirror of https://github.com/dev-sec/ansible-collection-hardening synced 2024-11-10 09:14:18 +00:00
Code Issues Projects Releases Packages Wiki Activity

add rhel faillock config

Browse source 
Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
This commit is contained in:
Martin Schurz 2021-02-08 10:51:16 +01:00
parent b210df1233
commit ebbf6855e8
2 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
roles/os_hardening/tasks/pam.yml
View file

@ -111,7 +111,7 @@
- ansible_facts.os_family == 'RedHat' - ansible_facts.os_family == 'RedHat'
- not os_auth_pam_passwdqc_enable - not os_auth_pam_passwdqc_enable
- name: configure passwdqc and tally via central system-auth confic - name: configure passwdqc and faillock via central system-auth confic
template: template:
src: 'etc/pam.d/rhel_system_auth.j2' src: 'etc/pam.d/rhel_system_auth.j2'
dest: '/etc/pam.d/system-auth-ac' dest: '/etc/pam.d/system-auth-ac'

9
roles/os_hardening/templates/etc/pam.d/rhel_system_auth.j2
View file

@ -2,14 +2,19 @@
# Generated by Ansible role {{ ansible_role_name }} # Generated by Ansible role {{ ansible_role_name }}
#%PAM-1.0 #%PAM-1.0
{% if os_auth_retries > 0 %}
{% endif %}
auth required pam_env.so auth required pam_env.so
{% if os_auth_retries > 0 %}
auth required pam_faillock.so preauth silent audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
{% endif %}
auth sufficient pam_unix.so nullok try_first_pass auth sufficient pam_unix.so nullok try_first_pass
{% if os_auth_retries > 0 %}
auth [default=die] pam_faillock.so authfail audit even_deny_root deny={{ os_auth_retries }} unlock_time={{ os_auth_lockout_time }}
{% endif %}
auth requisite pam_succeed_if.so uid >= 500 quiet auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_deny.so auth required pam_deny.so
{% if os_auth_retries > 0 %} {% if os_auth_retries > 0 %}
account required pam_faillock.so
{% endif %} {% endif %}
account required pam_unix.so account required pam_unix.so
account sufficient pam_localuser.so account sufficient pam_localuser.so