Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion templates/other.tpl
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
auth required pam_deny.so
account required pam_deny.so
password required pam_deny.so
password required pam_deny.so
session required pam_deny.so
22 changes: 11 additions & 11 deletions templates/system-auth.tpl
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ auth sufficient pam_ssh.so
{% endif %}

{% if krb5 %}
auth [success={{ 4 if homed else 3 }} default=ignore] pam_krb5.so {{ krb5_params }}
auth [success={{ 4 if homed else 3 }} default=ignore] pam_krb5.so {{ krb5_params }}
{% endif %}

{% if sssd %}
Expand All @@ -15,13 +15,13 @@ auth [default=3 ignore=ignore success=ok] pam_localuser.so
auth requisite pam_faillock.so preauth

{% if homed %}
auth [success=2 default=ignore] pam_systemd_home.so
auth [success=2 default=ignore] pam_systemd_home.so
{% endif %}

{% if sssd %}
auth sufficient pam_unix.so {{ nullok|default('', true) }} {{ debug|default('', true) }}
auth sufficient pam_unix.so {{ nullok|default('', true) }} {{ debug|default('', true) }}
{% else %}
auth [success=1 new_authtok_reqd=1 ignore=ignore default=bad] pam_unix.so {{ nullok|default('', true) }} {{ debug|default('', true) }} try_first_pass
auth [success=1 new_authtok_reqd=1 ignore=ignore default=bad] pam_unix.so {{ nullok|default('', true) }} {{ debug|default('', true) }} try_first_pass
{% endif %}
auth [default=die] pam_faillock.so authfail
{% if sssd %}
Expand All @@ -38,15 +38,15 @@ account [success=2 default=ignore] pam_krb5.so {{ krb5_params }}
{% endif %}

{% if homed %}
account [success={{ 2 if sssd else 1 }} default=ignore] pam_systemd_home.so
account [success={{ 2 if sssd else 1 }} default=ignore] pam_systemd_home.so
{% endif %}

account required pam_unix.so {{ debug|default('', true) }}
account required pam_faillock.so
account required pam_faillock.so
{% if sssd %}
account sufficient pam_localuser.so
account sufficient pam_usertype.so issystem
account [default=bad success=ok user_unknown=ignore] pam_sss.so {{ debug|default('', true) }}
account [default=bad success=ok user_unknown=ignore] pam_sss.so {{ debug|default('', true) }}
account required pam_permit.so
{% endif %}

Expand All @@ -55,25 +55,25 @@ password required pam_passwdqc.so config=/etc/security/passwdqc.conf
{% endif %}

{% if pwquality %}
password required pam_pwquality.so {{ local_users_only|default('', true ) }}
password required pam_pwquality.so {{ local_users_only|default('', true ) }}
{% endif %}

{% if pwhistory %}
password required pam_pwhistory.so use_authtok remember=5 retry=3
password required pam_pwhistory.so use_authtok remember=5 retry=3
{% endif %}

{% if krb5 %}
password [success=1 default=ignore] pam_krb5.so {{ krb5_params }}
{% endif %}

{% if homed %}
password [success=1 default=ignore] pam_systemd_home.so
password [success=1 default=ignore] pam_systemd_home.so
{% endif %}

{% if passwdqc or pwquality %}
password {{ 'sufficient' if sssd else 'required' }} pam_unix.so try_first_pass {{ unix_authtok|default('', true) }} {{ nullok|default('', true) }} {{ unix_extended_encryption|default('', true) }} {{ debug|default('', true) }}
{% else %}
password {{ 'sufficient' if sssd else 'required' }} pam_unix.so try_first_pass {{ nullok|default('', true) }} {{ unix_extended_encryption|default('', true) }} {{ debug|default('', true) }}
password {{ 'sufficient' if sssd else 'required' }} pam_unix.so try_first_pass {{ nullok|default('', true) }} {{ unix_extended_encryption|default('', true) }} {{ debug|default('', true) }}
{% endif %}

{% if sssd %}
Expand Down
2 changes: 1 addition & 1 deletion templates/system-login.tpl
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ session optional pam_lastlog.so silent {{ debug|default('', true) }}
{% endif %}
session include system-auth
{% if selinux %}
# Note: modules that run in the user's context must come after this line.
# Note: modules that run in the user's context must come after this line.
session required pam_selinux.so multiple open
{% endif %}

Expand Down
2 changes: 1 addition & 1 deletion templates/system-services.tpl
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
auth sufficient pam_permit.so
account include system-auth
session optional pam_loginuid.so
session optional pam_loginuid.so
{% include "templates/system-session.tpl" %}
2 changes: 1 addition & 1 deletion templates/system-session.tpl
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ session [success=1 default=ignore] pam_krb5.so {{ krb5_params }}
{% endif %}

{% if homed %}
session [success=1 default=ignore] pam_systemd_home.so
session [success=1 default=ignore] pam_systemd_home.so
{% endif %}

session required pam_unix.so {{ debug|default('', true) }}
Expand Down
2 changes: 1 addition & 1 deletion tests/rendered/custom/other
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
auth required pam_deny.so
account required pam_deny.so
password required pam_deny.so
password required pam_deny.so
session required pam_deny.so
4 changes: 2 additions & 2 deletions tests/rendered/custom/system-auth
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
auth required pam_env.so
auth requisite pam_faillock.so preauth
auth [success=1 new_authtok_reqd=1 ignore=ignore default=bad] pam_unix.so nullok try_first_pass
auth [success=1 new_authtok_reqd=1 ignore=ignore default=bad] pam_unix.so nullok try_first_pass
auth [default=die] pam_faillock.so authfail
account required pam_unix.so
account required pam_faillock.so
account required pam_faillock.so
password required pam_passwdqc.so config=/etc/security/passwdqc.conf
password required pam_unix.so try_first_pass use_authtok nullok sha512 shadow
session required pam_limits.so
Expand Down
2 changes: 1 addition & 1 deletion tests/rendered/custom/system-services
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
auth sufficient pam_permit.so
account include system-auth
session optional pam_loginuid.so
session optional pam_loginuid.so
session required pam_limits.so
session required pam_env.so
session required pam_unix.so
2 changes: 1 addition & 1 deletion tests/rendered/default/other
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
auth required pam_deny.so
account required pam_deny.so
password required pam_deny.so
password required pam_deny.so
session required pam_deny.so
6 changes: 3 additions & 3 deletions tests/rendered/default/system-auth
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
auth required pam_env.so
auth requisite pam_faillock.so preauth
auth [success=1 new_authtok_reqd=1 ignore=ignore default=bad] pam_unix.so try_first_pass
auth [success=1 new_authtok_reqd=1 ignore=ignore default=bad] pam_unix.so try_first_pass
auth [default=die] pam_faillock.so authfail
account required pam_unix.so
account required pam_faillock.so
password required pam_unix.so try_first_pass md5 shadow
account required pam_faillock.so
password required pam_unix.so try_first_pass md5 shadow
session required pam_limits.so
session required pam_env.so
session required pam_unix.so
2 changes: 1 addition & 1 deletion tests/rendered/default/system-services
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
auth sufficient pam_permit.so
account include system-auth
session optional pam_loginuid.so
session optional pam_loginuid.so
session required pam_limits.so
session required pam_env.so
session required pam_unix.so
2 changes: 1 addition & 1 deletion tests/rendered/minimal/other
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
auth required pam_deny.so
account required pam_deny.so
password required pam_deny.so
password required pam_deny.so
session required pam_deny.so
6 changes: 3 additions & 3 deletions tests/rendered/minimal/system-auth
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
auth required pam_env.so
auth requisite pam_faillock.so preauth
auth [success=1 new_authtok_reqd=1 ignore=ignore default=bad] pam_unix.so try_first_pass
auth [success=1 new_authtok_reqd=1 ignore=ignore default=bad] pam_unix.so try_first_pass
auth [default=die] pam_faillock.so authfail
account required pam_unix.so
account required pam_faillock.so
password required pam_unix.so try_first_pass md5 shadow
account required pam_faillock.so
password required pam_unix.so try_first_pass md5 shadow
session required pam_limits.so
session required pam_env.so
session required pam_unix.so
2 changes: 1 addition & 1 deletion tests/rendered/minimal/system-services
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
auth sufficient pam_permit.so
account include system-auth
session optional pam_loginuid.so
session optional pam_loginuid.so
session required pam_limits.so
session required pam_env.so
session required pam_unix.so