Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add oddjob mkhomedir option rhel pam #675

Merged
merged 7 commits into from
May 23, 2023
Merged

Add oddjob mkhomedir option rhel pam #675

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
2ffe0c0
added support for oddjob mkhomedir via optional var
May 22, 2023
1f88e6a
optimized conditional
May 22, 2023
d1e6eaf
added variable description
May 22, 2023
290c2b9
added support for oddjob mkhomedir via optional var
May 22, 2023
593996f
optimized conditional
May 22, 2023
fec5391
added variable description
May 22, 2023
325903e
t push
May 22, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions roles/os_hardening/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,6 +134,9 @@ We know that this is the case on Raspberry Pi.
- `os_auth_pam_sssd_enable`
- Default: `false` (on RHEL8/CentOS8/Fedora `true`)
- Description: activate PAM auth support for sssd
- `os_auth_pam_oddjob_mkhomedir`
- Default: `false`
- Description: Enables automatic homedir e.g. in FreeIPA environments
- `os_security_users_allow`
- Default: `[]`
- Description: list of things, that a user is allowed to do. May contain `change_user`.
Expand Down
1 change: 1 addition & 0 deletions roles/os_hardening/defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ os_auth_retries: 5
os_auth_lockout_time: 600 # Seconds (600 = 10min)
os_auth_timeout: 60
os_auth_allow_homeless: false
os_auth_pam_oddjob_mkhomedir: false
os_auth_pam_passwdqc_enable: true
os_auth_pam_passwdqc_options: min=disabled,disabled,16,12,8 # Used in Debian
os_auth_pam_pwquality_options: try_first_pass retry=3 authtok_type= # Used in RHEL7 and RHEL8
Expand Down
3 changes: 3 additions & 0 deletions roles/os_hardening/templates/etc/pam.d/rhel_auth.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,9 @@ password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
{% if (os_auth_pam_oddjob_mkhomedir | bool) %}
session optional pam_oddjob_mkhomedir.so umask=0077
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sorry for being late to the party.
We have a special variable fo setting the expected umask (os_env_umask). While checking for this, I also found, that this setting might be ignored, because of authselect/authselect#223

So no real problem here, but a minor inconvenience from my point of view.

{% endif %}
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
{% if (os_auth_pam_sssd_enable | bool) %}
Expand Down