diff --git a/manifests/pamd.pp b/manifests/pamd.pp index cecc867..8dc7784 100644 --- a/manifests/pamd.pp +++ b/manifests/pamd.pp @@ -6,6 +6,30 @@ # # === Parameters # +# [pam_unix_account] +# When specified, it allows for customization +# of pam_unix.so in account type +# *Requires* pam_unix => true +# *Optional* defaults to 'required pam_unix.so broken_shadow' +# +# [pam_unix_auth] +# When specified, it allows for customization +# of pam_unix.so in auth type +# *Requires* pam_unix => true +# *Optional* defaults to 'sufficient pam_unix.so nullok try_first_pass' +# +# [pam_unix_password] +# When specified, it allows for customization +# of pam_unix.so in password type +# *Requires* pam_unix => true +# *Optional* defaults to 'sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok' +# +# [pam_unix_session] +# When specified, it allows for customization +# of pam_unix.so in session type +# *Requires* pam_unix => true +# *Optional* defaults to 'required pam_unix.so' +# # [pam_ldap] # If enabled sets up the usage of pam_ldap.so # *Conflicts* pam_ldapd @@ -57,6 +81,34 @@ # UNTESTED # *Optional* defaults to false # +# [pam_sss] +# If enabled sets up the usage of pam_sss.so +# *Optional* defaults to false +# +# [pam_sss_account] +# When specified it allows for customization +# of pam_sss.so in account type +# *Requires* pam_sss => true +# *Optional* defaults to '[default=bad success=ok user_unknown=ignore] pam_sss.so' +# +# [pam_sss_auth] +# When specified it allows for customization +# of pam_sss.so in auth type +# *Requires* pam_sss => true +# *Optional* defaults to 'sufficient pam_sss.so use_first_pass' +# +# [pam_sss_password] +# When specified it allows for customization +# of pam_sss.so in password type +# *Requires* pam_sss => true +# *Optional* defaults to 'sufficient pam_sss.so use_authtok' +# +# [pam_sss_session] +# When specified it allows for customization +# of pam_sss.so in session type +# *Requires* pam_sss => true +# *Optional* defaults to 'optional pam_sss.so' +# # [pam_tally] # UNTESTED # *Optional* defaults to false @@ -138,6 +190,11 @@ # # class pam::pamd ( + $pam_unix_account = false, + $pam_unix_auth = false, + $pam_unix_password = false, + $pam_unix_session = false, + $pam_ldap = false, $pam_ldap_account = false, $pam_ldap_auth = false, @@ -150,6 +207,13 @@ $pam_ldapd_password = false, $pam_ldapd_session = false, + $pam_sss = false, + $pam_sss_account = false, + $pam_sss_auth = false, + $pam_sss_password = false, + $pam_sss_session = false, + $sssd_conf = false, + $pam_tally = false, $pam_tally_account = false, $pam_tally_auth = false, @@ -172,6 +236,26 @@ motd::register { 'pam::pamd': } } + case $pam_unix_account { + false: { $pam_unix_account_set = $pam::params::pam_unix_account } + default: { $pam_unix_account_set = $pam_unix_account } + } + + case $pam_unix_auth { + false: { $pam_unix_auth_set = $pam::params::pam_unix_auth } + default: { $pam_unix_auth_set = $pam_unix_auth } + } + + case $pam_unix_password { + false: { $pam_unix_password_set = $pam::params::pam_unix_password } + default: { $pam_unix_password_set = $pam_unix_password } + } + + case $pam_unix_session { + false: { $pam_unix_session_set = $pam::params::pam_unix_session } + default: { $pam_unix_session_set = $pam_unix_session } + } + if($pam_ldap) { #Class['ldap'] -> Class['pam::pamd'] @@ -228,6 +312,46 @@ } + if($pam_sss) { + + package { 'sssd': + ensure => present, + } + + file { '/etc/sssd/sssd.conf': + ensure => file, + source => $sssd_conf, + require => Package['sssd'], + } + + service { 'sssd': + ensure => running, + enable => true, + require => File['/etc/sssd/sssd.conf'], + } + + case $pam_sss_account { + false: { $pam_sss_account_set = $pam::params::pam_sss_account } + default: { $pam_sss_account_set = $pam_sss_account } + } + + case $pam_sss_auth { + false: { $pam_sss_auth_set = $pam::params::pam_sss_auth } + default: { $pam_sss_auth_set = $pam_sss_auth } + } + + case $pam_sss_password { + false: { $pam_sss_password_set = $pam::params::pam_sss_password } + default: { $pam_sss_password_set = $pam_sss_password } + } + + case $pam_sss_session { + false: { $pam_sss_session_set = $pam::params::pam_sss_session } + default: { $pam_sss_session_set = $pam_sss_session } + } + + } + if($pam_tally) { case $pam_tally_account { @@ -267,6 +391,12 @@ if($pam_mkhomedir) { + if($pam::params::pam_mkhomedir_package) { + package { $pam::params::pam_mkhomedir_package: + ensure => present + } + } + case $pam_mkhomedir_session { false: { $pam_mkhomedir_session_set = $pam::params::pam_mkhomedir_session } default: { $pam_mkhomedir_session_set = $pam_mkhomedir_session } diff --git a/manifests/pamd/redhat.pp b/manifests/pamd/redhat.pp index 2b73162..a1b290e 100644 --- a/manifests/pamd/redhat.pp +++ b/manifests/pamd/redhat.pp @@ -16,7 +16,8 @@ } file { "${pam::params::prefix_pamd}/system-auth": - content => template('pam/pam.d/system-auth-ac.erb') + ensure => link, + target => 'system-auth-ac', } if($pam::pamd::pam_ldap) { diff --git a/manifests/params.pp b/manifests/params.pp index 70dd48c..0a11052 100644 --- a/manifests/params.pp +++ b/manifests/params.pp @@ -31,7 +31,7 @@ $pam_cracklib_password = 'requisite pam_cracklib.so try_first_pass retry=3 minlen=9 dcredit=-1' - $pam_mkhomedir_session = 'requisite pam_mkhomedir.so skel=/etc/skel/ umask=0022' + $pam_mkhomedir_session = 'optional pam_mkhomedir.so skel=/etc/skel umask=0022' } @@ -44,10 +44,13 @@ case $::operatingsystemmajrelease { 5 : { $package_pam_ldap = 'nss_ldap' + $pam_mkhomedir_so = 'pam_mkhomedir.so' } 6 : { $package_pam_ldap = 'nss-pam-ldapd' + $pam_mkhomedir_so = 'pam_oddjob_mkhomedir.so' + $pam_mkhomedir_package = 'oddjob-mkhomedir' } default : { @@ -55,6 +58,11 @@ } } + $pam_unix_account = 'required pam_unix.so broken_shadow' + $pam_unix_auth = 'sufficient pam_unix.so nullok try_first_pass' + $pam_unix_password = 'sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok' + $pam_unix_session = 'required pam_unix.so' + $pam_ldap_account = '[default=bad success=ok user_unknown=ignore] pam_ldap.so' $pam_ldap_auth = 'sufficient pam_ldap.so use_first_pass' $pam_ldap_password = 'sufficient pam_ldap.so use_authtok' @@ -65,6 +73,11 @@ $pam_ldapd_password = false $pam_ldapd_session = false + $pam_sss_account = '[default=bad success=ok user_unknown=ignore] pam_sss.so' + $pam_sss_auth = 'sufficient pam_sss.so use_first_pass' + $pam_sss_password = 'sufficient pam_sss.so use_authtok' + $pam_sss_session = 'optional pam_sss.so' + $ldap_conf = '/etc/openldap/ldap.conf' $pam_tally_account = 'required pam_tally.so' @@ -75,7 +88,7 @@ $pam_cracklib_password = 'requisite pam_cracklib.so try_first_pass retry=3 minlen=9 dcredit=-1' - $pam_mkhomedir_session = 'requisite pam_mkhomedir.so skel=/etc/skel/ umask=0022' + $pam_mkhomedir_session = "optional ${pam_mkhomedir_so} skel=/etc/skel umask=0022" } @@ -106,7 +119,7 @@ $pam_cracklib_password = 'requisite pam_cracklib.so try_first_pass retry=3 minlen=9 dcredit=-1' - $pam_mkhomedir_session = 'requisite pam_mkhomedir.so skel=/etc/skel/ umask=0022' + $pam_mkhomedir_session = 'optional pam_mkhomedir.so skel=/etc/skel umask=0022' } diff --git a/templates/pam.d/system-auth-ac.erb b/templates/pam.d/system-auth-ac.erb index 0a37784..02d1393 100644 --- a/templates/pam.d/system-auth-ac.erb +++ b/templates/pam.d/system-auth-ac.erb @@ -1,47 +1,62 @@ ############################################################################### # << FILE MANAGED BY PUPPET >> -# Manual changes are likey to be overwritten +# Manual changes are likely to be overwritten ############################################################################### <% if scope.lookupvar('pam::pamd::pam_tally') == true then -%> -auth <%= scope.lookupvar('pam::pamd::pam_tally_auth_set') %> +auth <%= scope.lookupvar('pam::pamd::pam_tally_auth_set') %> <% end -%> <% if scope.lookupvar('pam::pamd::pam_tally2') == true then -%> -auth <%= scope.lookupvar('pam::pamd::pam_tally2_auth_set') %> +auth <%= scope.lookupvar('pam::pamd::pam_tally2_auth_set') %> <% end -%> auth required pam_env.so -auth sufficient pam_unix.so nullok try_first_pass +auth <%= scope.lookupvar('pam::pamd::pam_unix_auth_set') %> auth requisite pam_succeed_if.so uid >= 500 quiet +<% if scope.lookupvar('pam::pamd::pam_sss') == true then -%> +auth <%= scope.lookupvar('pam::pamd::pam_sss_auth_set') %> +<% end -%> <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%> -auth <%= scope.lookupvar('pam::pamd::pam_ldap_auth_set') %> +auth <%= scope.lookupvar('pam::pamd::pam_ldap_auth_set') %> <% end -%> auth required pam_deny.so <% if scope.lookupvar('pam::pamd::pam_tally') == true then -%> -account <%= scope.lookupvar('pam::pamd::pam_tally_account_set') %> +account <%= scope.lookupvar('pam::pamd::pam_tally_account_set') %> <% end -%> <% if scope.lookupvar('pam::pamd::pam_tally2') == true then -%> -account <%= scope.lookupvar('pam::pamd::pam_tally2_account_set') %> +account <%= scope.lookupvar('pam::pamd::pam_tally2_account_set') %> <% end -%> -account required pam_unix.so broken_shadow +account <%= scope.lookupvar('pam::pamd::pam_unix_account_set') %> +account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet +<% if scope.lookupvar('pam::pamd::pam_sss') == true then -%> +account <%= scope.lookupvar('pam::pamd::pam_sss_account_set') %> +<% end -%> <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%> -account <%= scope.lookupvar('pam::pamd::pam_ldap_account_set') %> +account <%= scope.lookupvar('pam::pamd::pam_ldap_account_set') %> <% end -%> account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type= -password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok +password <%= scope.lookupvar('pam::pamd::pam_unix_password_set') %> +<% if scope.lookupvar('pam::pamd::pam_sss') == true then -%> +password <%= scope.lookupvar('pam::pamd::pam_sss_password_set') %> +<% end -%> <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%> -password <%= scope.lookupvar('pam::pamd::pam_ldap_password_set') %> +password <%= scope.lookupvar('pam::pamd::pam_ldap_password_set') %> <% end -%> password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so +<% if scope.lookupvar('pam::pamd::pam_mkhomedir') == true then -%> +session <%= scope.lookupvar('pam::pamd::pam_mkhomedir_session_set') %> +<% end -%> session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid -session required pam_unix.so +session <%= scope.lookupvar('pam::pamd::pam_unix_session_set') %> +<% if scope.lookupvar('pam::pamd::pam_sss') == true then -%> +session <%= scope.lookupvar('pam::pamd::pam_sss_session_set') %> +<% end -%> <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%> -session <%= scope.lookupvar('pam::pamd::pam_ldap_session_set') %> +session <%= scope.lookupvar('pam::pamd::pam_ldap_session_set') %> <% end -%> -