Puppet Class: os_hardening::pam

Defined in:
manifests/pam.pp

Overview

Class: os_hardening::pam

Configures PAM

Parameters:

  • passwdqc_enabled (Boolean) (defaults to: true)
  • auth_retries (Integer) (defaults to: 5)
  • auth_lockout_time (Integer) (defaults to: 600)
  • passwdqc_options (String) (defaults to: 'min=disabled,disabled,16,12,8')
  • manage_pam_unix (Boolean) (defaults to: false)
  • enable_pw_history (Boolean) (defaults to: false)
  • pw_remember_last (Integer) (defaults to: 5)
  • only_root_may_su (Boolean) (defaults to: false) 


12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
 
# File 'manifests/pam.pp', line 12

class os_hardening::pam (
  Boolean $passwdqc_enabled  = true,
  Integer $auth_retries      = 5,
  Integer $auth_lockout_time = 600,
  String  $passwdqc_options  = 'min=disabled,disabled,16,12,8',
  Boolean $manage_pam_unix   = false,
  Boolean $enable_pw_history = false,
  Integer $pw_remember_last  = 5,
  Boolean $only_root_may_su  = false,
) {

  # prepare package names
  case $::operatingsystem {
    redhat, fedora: {
      $pam_ccreds = 'pam_ccreds'
      $pam_passwdqc = 'pam_passwdqc'
      $pam_cracklib = 'pam_cracklib'
    }
    debian, ubuntu, cumuluslinux: {
      $pam_ccreds = 'libpam-ccreds'
      $pam_passwdqc = 'libpam-passwdqc'
      $pam_cracklib = 'libpam-cracklib'
    }
    default: {
      $pam_ccreds = 'pam_ccreds'
      $pam_passwdqc = 'pam_passwdqc'
      $pam_cracklib = 'pam_cracklib'
    }
  }

  # remove ccreds if not necessary
  package{ 'pam-ccreds':
    ensure => absent,
    name   => $pam_ccreds,
  }

  case $::operatingsystem {
    debian, ubuntu, cumuluslinux: {
      # configure paths
      $passwdqc_path = '/usr/share/pam-configs/passwdqc'
      $tally2_path   = '/usr/share/pam-configs/tally2'
      $unix_path     = '/usr/share/pam-configs/unix'
      $su_path       = '/etc/pam.d/su'

      # if passwdqc is enabled
      if $passwdqc_enabled == true {
        # remove pam_cracklib, because it does not play nice wiht passwdqc
        package { 'pam-cracklib':
          ensure => absent,
          name   => $pam_cracklib,
        }

        # get the package for strong password checking
        package { 'pam-passwdqc':
          ensure => present,
          name   => $pam_passwdqc,
        }

        # configure passwdqc via central module:
        file { $passwdqc_path:
          ensure  => file,
          content => template('os_hardening/pam_passwdqc.erb'),
          owner   => 'root',
          group   => 'root',
          mode    => '0640',
          require => Package['pam-passwdqc'],
          notify  => Exec['update-pam'],
        }

      } else {
        # deactivate passwdqc

        # delete passwdqc file on ubuntu and debian
        file { $passwdqc_path:
          ensure => absent,
          notify => Exec['update-pam'],
        }

        # make sure the package is not on the system,
        # if this feature is not wanted
        package { 'pam-passwdqc':
          ensure => absent,
          name   => $pam_passwdqc,
        }
      }

      #configure tally2
      if $auth_retries > 0 {
        # tally2 is needed for pam
        package { 'libpam-modules':
          ensure => present,
        }

        file { $tally2_path:
          ensure  => file,
          content => template('os_hardening/pam_tally2.erb'),
          owner   => 'root',
          group   => 'root',
          mode    => '0640',
          notify  => Exec['update-pam'],
        }
      } else {
        file { $tally2_path:
          ensure => absent,
          notify => Exec['update-pam'],
        }
      }

      #configure pam_unix with password history
      if $manage_pam_unix {
        if $enable_pw_history {
          $pw_history_options = "remember=${pw_remember_last}"
        } else {
          $pw_history_options = ''
        }
        file { $unix_path:
          ensure  => file,
          content => template('os_hardening/pam_unix.erb'),
          owner   => 'root',
          group   => 'root',
          mode    => '0640',
          notify  => Exec['update-pam'],
        }
      }

      #only allow root and members of the group wheel to su
      file { $su_path:
        ensure  => file,
        content => template('os_hardening/pam_su_debian_ubuntu.erb'),
        owner   => 'root',
        group   => 'root',
        mode    => '0640',
      }

      exec { 'update-pam':
        command     => '/usr/sbin/pam-auth-update --package',
        refreshonly => true,
      }
    }

    # others ...
    default: {
      # TODO: not supported warning
    }
  }

}