evolix/ansible-roles
22
2
Fork 2
Code Issues 61 Pull requests 19 Releases 33 Wiki Activity

policy_pam > Add support for Debian 10/9
All checks were successful
Ansible Lint |Total|New|Outstanding|Fixed|Trend |:-:|:-:|:-:|:-:|:-: |2785|7|2778|12|:+1: Reference build: <a href="https://jenkins.evolix.org/job/gitea/job/ansible-roles/job/unstable/269//ansiblelint">Evolix » ansible-roles » unstable #269</a>
Details
gitea/ansible-roles/pipeline/head This commit looks good
Details

Browse source
This commit is contained in:
Ludovic Poujol 2023-06-12 11:35:53 +02:00
parent 1ec212f514
commit 9a5b5a39a9
2 changed files with 24 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
policy_pam/meta/main.yml
View file

@ -14,6 +14,8 @@ galaxy_info:
- name: Debian - name: Debian
versions: versions:
- bullseye - bullseye
- buster
- stretch
galaxy_tags: [] galaxy_tags: []
# Be sure to remove the '[]' above if you add dependencies # Be sure to remove the '[]' above if you add dependencies

32
policy_pam/tasks/main.yml
View file

@ -1,20 +1,32 @@
--- ---
# System compatibility check. yescrypt only works on Debian 11+ # System compatibility check.
# So we ensure that this role isn't executed on older systems # Untested on old (Jessie & older) Debian versions
- name: "System compatibility check" - name: "System compatibility check"
assert: ansible.builtin.assert:
that: that:
- ansible_distribution == "Debian" - ansible_distribution == "Debian"
- ansible_distribution_major_version is version_compare('11', '>=') - ansible_distribution_major_version is version_compare('9', '>=')
msg: pam_policy is only compatible with Debian >= 11 msg: pam_policy is only compatible with Debian >= 9
# yescrypt, Debian 11 default hashing alg isn't present on Debian 10 and lower
- name: "Set hashing alg (sha512 - Debian <= 10)"
ansible.builtin.set_fact:
pam_policy_hashing_alg: 'sha512'
when:
ansible_distribution_major_version is version_compare('10', '<=')
- name: "Set hashing alg (yescrypt - Debian >= 11 )"
ansible.builtin.set_fact:
pam_policy_hashing_alg: 'yescrypt'
when:
ansible_distribution_major_version is version_compare('11', '>=')
# PAM -- pam_pwquality # PAM -- pam_pwquality
- name: libpam-pwquality is installed - name: libpam-pwquality is installed
apt: ansible.builtin.apt:
state: present state: present
name: name:
- libpam-pwquality - libpam-pwquality
@ -37,7 +49,7 @@
when: policy_pam_pwquality is false when: policy_pam_pwquality is false
- name: Configure pam_pwquality - name: Configure pam_pwquality
replace: ansible.builtin.replace:
dest: /etc/security/pwquality.conf dest: /etc/security/pwquality.conf
regexp: "^#? ?{{ item.name }} = .*" regexp: "^#? ?{{ item.name }} = .*"
replace: "{{ item.name }} = {{ item.value }}" replace: "{{ item.name }} = {{ item.value }}"
@ -70,7 +82,7 @@
# Enforce password minimal age to prevent pam_pwhistory to be circumvented by multiples password changes # Enforce password minimal age to prevent pam_pwhistory to be circumvented by multiples password changes
- name: Change PASS_MIN_DAYS - name: Change PASS_MIN_DAYS
replace: ansible.builtin.replace:
dest: /etc/login.defs dest: /etc/login.defs
replace: 'PASS_MIN_DAYS\g<1>{{ policy_pam_password_min_days }}' replace: 'PASS_MIN_DAYS\g<1>{{ policy_pam_password_min_days }}'
regexp: '^PASS_MIN_DAYS(\s+).*' regexp: '^PASS_MIN_DAYS(\s+).*'
@ -81,12 +93,12 @@
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
dest: /etc/pam.d/common-password dest: /etc/pam.d/common-password
regexp: 'pam_unix.so obscure' regexp: 'pam_unix.so obscure'
line: "password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt" line: "password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass {{ pam_policy_hashing_alg }}"
when: policy_pam_pwhistory or policy_pam_pwquality when: policy_pam_pwhistory or policy_pam_pwquality
- name: Update pam_unix if previous modules are all disabled - name: Update pam_unix if previous modules are all disabled
ansible.builtin.lineinfile: ansible.builtin.lineinfile:
dest: /etc/pam.d/common-password dest: /etc/pam.d/common-password
regexp: 'pam_unix.so obscure' regexp: 'pam_unix.so obscure'
line: "password [success=1 default=ignore] pam_unix.so obscure yescrypt" line: "password [success=1 default=ignore] pam_unix.so obscure {{ pam_policy_hashing_alg }}"
when: policy_pam_pwhistory is false and policy_pam_pwquality is false when: policy_pam_pwhistory is false and policy_pam_pwquality is false