From 6318d118d91572dd5e838b01dc505bff336995ae Mon Sep 17 00:00:00 2001 From: Matthew Schmitt Date: Tue, 24 Jun 2014 13:34:31 -0700 Subject: [PATCH 1/4] Puppet-lint fixes --- manifests/pamd/redhat.pp | 7 +------ manifests/params.pp | 1 - 2 files changed, 1 insertion(+), 7 deletions(-) diff --git a/manifests/pamd/redhat.pp b/manifests/pamd/redhat.pp index 2b73162..624e578 100644 --- a/manifests/pamd/redhat.pp +++ b/manifests/pamd/redhat.pp @@ -20,7 +20,6 @@ } if($pam::pamd::pam_ldap) { - #File['/etc/ldap.conf'] -> File[$pam::params::ldap_conf] file { '/etc/ldap.conf': @@ -35,15 +34,12 @@ 5 : {} 6 : { - file { "${pam::params::prefix_pamd}/password-auth-ac": ensure => present, content => template('pam/pam.d/system-auth-ac.erb'), } - # rhel 6 uses pam_ldap.conf: if($pam::pamd::pam_ldap) { - #File['/etc/pam_ldap.conf'] -> File[$pam::params::ldap_conf] file { '/etc/pam_ldap.conf': @@ -52,11 +48,10 @@ } } - } default : { - notice("Version $::operatingsystemmajrelease not handled") + notice("Version ${::operatingsystemmajrelease} not handled") } } diff --git a/manifests/params.pp b/manifests/params.pp index 70dd48c..4f9ef05 100644 --- a/manifests/params.pp +++ b/manifests/params.pp @@ -49,7 +49,6 @@ 6 : { $package_pam_ldap = 'nss-pam-ldapd' } - default : { notice("${::operatingsystem} version ${::operatingsystemmajrelease} not handled") } From de75d73a8d48a696f31c05fc17629ccebd498541 Mon Sep 17 00:00:00 2001 From: Matthew Schmitt Date: Tue, 22 Jul 2014 10:24:07 -0700 Subject: [PATCH 2/4] Updating system-auth template to honor the passing of mkhomedir --- templates/pam.d/system-auth-ac.erb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/templates/pam.d/system-auth-ac.erb b/templates/pam.d/system-auth-ac.erb index 0a37784..2c577fd 100644 --- a/templates/pam.d/system-auth-ac.erb +++ b/templates/pam.d/system-auth-ac.erb @@ -44,4 +44,6 @@ session required pam_unix.so <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%> session <%= scope.lookupvar('pam::pamd::pam_ldap_session_set') %> <% end -%> - +<% if scope.lookupvar('pam::pamd::pam_mkhomedir') == true then -%> +session <%= scope.lookupvar('pam::pamd::pam_mkhomedir_session_set') %> +<% end -%> From 4ca59d12d651d47179b6da23365a1f0fcddf3f15 Mon Sep 17 00:00:00 2001 From: Matthew Schmitt Date: Tue, 22 Jul 2014 10:34:58 -0700 Subject: [PATCH 3/4] Implementing pull request #5 from remote branch --- manifests/pamd/redhat.pp | 1 + 1 file changed, 1 insertion(+) diff --git a/manifests/pamd/redhat.pp b/manifests/pamd/redhat.pp index 624e578..244afb1 100644 --- a/manifests/pamd/redhat.pp +++ b/manifests/pamd/redhat.pp @@ -6,6 +6,7 @@ File { ensure => present, + links => follow, owner => 'root', group => 'root', mode => '0644' From 7f0eebab78b893482ae0a045b4843695ca96c41b Mon Sep 17 00:00:00 2001 From: Matthew Schmitt Date: Tue, 18 Nov 2014 14:59:22 -0800 Subject: [PATCH 4/4] Adding new template and updating existing template. Updated redhat.pp to manage new template --- manifests/pamd/redhat.pp | 21 +++++++++++++++++---- templates/pam.d/smartcard-auth-ac.erb | 26 ++++++++++++++++++++++++++ templates/pam.d/system-auth-ac.erb | 15 ++++++++------- 3 files changed, 51 insertions(+), 11 deletions(-) create mode 100644 templates/pam.d/smartcard-auth-ac.erb diff --git a/manifests/pamd/redhat.pp b/manifests/pamd/redhat.pp index 244afb1..349de18 100644 --- a/manifests/pamd/redhat.pp +++ b/manifests/pamd/redhat.pp @@ -6,7 +6,6 @@ File { ensure => present, - links => follow, owner => 'root', group => 'root', mode => '0644' @@ -17,10 +16,21 @@ } file { "${pam::params::prefix_pamd}/system-auth": - content => template('pam/pam.d/system-auth-ac.erb') + ensure => 'link', + target => '/etc/pam.d/system-auth-ac' + } + + file { "${pam::params::prefix_pamd}/smartcard-auth-ac": + content => template('pam/pam.d/smartcard-auth-ac.erb') + } + + file { "${pam::params::prefix_pamd}/smartcard-auth": + ensure => 'link', + target => '/etc/pam.d/smartcard-auth-ac' } if($pam::pamd::pam_ldap) { + #File['/etc/ldap.conf'] -> File[$pam::params::ldap_conf] file { '/etc/ldap.conf': @@ -35,12 +45,15 @@ 5 : {} 6 : { + file { "${pam::params::prefix_pamd}/password-auth-ac": ensure => present, content => template('pam/pam.d/system-auth-ac.erb'), } + # rhel 6 uses pam_ldap.conf: if($pam::pamd::pam_ldap) { + #File['/etc/pam_ldap.conf'] -> File[$pam::params::ldap_conf] file { '/etc/pam_ldap.conf': @@ -49,13 +62,13 @@ } } + } default : { - notice("Version ${::operatingsystemmajrelease} not handled") + notice("Version $::operatingsystemmajrelease not handled") } } } - diff --git a/templates/pam.d/smartcard-auth-ac.erb b/templates/pam.d/smartcard-auth-ac.erb new file mode 100644 index 0000000..586acdf --- /dev/null +++ b/templates/pam.d/smartcard-auth-ac.erb @@ -0,0 +1,26 @@ +############################################################################### +# << FILE MANAGED BY PUPPET >> +# Manual changes are likey to be overwritten +############################################################################### +auth required pam_env.so +auth [success=done ignore=ignore default=die] pam_pkcs11.so wait_for_card card_only +auth required pam_deny.so + +account required pam_unix.so broken_shadow +account sufficient pam_localuser.so +account sufficient pam_succeed_if.so uid < 500 quiet +<% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%> +account <%= scope.lookupvar('pam::pamd::pam_ldap_account_set') %> +<% end -%> +account required pam_permit.so + +password required pam_pkcs11.so + +session optional pam_keyinit.so revoke +session required pam_limits.so +session optional pam_mkhomedir.so skel=/etc/skel umask=0077 +session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid +session required pam_unix.so +<% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%> +session <%= scope.lookupvar('pam::pamd::pam_ldap_session_set') %> +<% end -%> diff --git a/templates/pam.d/system-auth-ac.erb b/templates/pam.d/system-auth-ac.erb index 2c577fd..81fdcd3 100644 --- a/templates/pam.d/system-auth-ac.erb +++ b/templates/pam.d/system-auth-ac.erb @@ -18,15 +18,16 @@ auth <%= scope.lookupvar('pam::pamd::pam_ldap_auth_set') %> auth required pam_deny.so <% if scope.lookupvar('pam::pamd::pam_tally') == true then -%> -account <%= scope.lookupvar('pam::pamd::pam_tally_account_set') %> +account <%= scope.lookupvar('pam::pamd::pam_tally_account_set') %> <% end -%> <% if scope.lookupvar('pam::pamd::pam_tally2') == true then -%> -account <%= scope.lookupvar('pam::pamd::pam_tally2_account_set') %> +account <%= scope.lookupvar('pam::pamd::pam_tally2_account_set') %> <% end -%> account required pam_unix.so broken_shadow +account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%> -account <%= scope.lookupvar('pam::pamd::pam_ldap_account_set') %> +account <%= scope.lookupvar('pam::pamd::pam_ldap_account_set') %> <% end -%> account required pam_permit.so @@ -39,11 +40,11 @@ password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so +<% if scope.lookupvar('pam::pamd::pam_mkhomedir') == true then -%> +session <%= scope.lookupvar('pam::pamd::pam_mkhomedir_session') %> +<% end -%> session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%> -session <%= scope.lookupvar('pam::pamd::pam_ldap_session_set') %> -<% end -%> -<% if scope.lookupvar('pam::pamd::pam_mkhomedir') == true then -%> -session <%= scope.lookupvar('pam::pamd::pam_mkhomedir_session_set') %> +session <%= scope.lookupvar('pam::pamd::pam_ldap_session_set') %> <% end -%>