From 266d8ce24690e372a5385c8054d04a6dc358dcf5 Mon Sep 17 00:00:00 2001 From: Zan Loy Date: Thu, 18 Sep 2014 12:21:16 -0400 Subject: [PATCH 01/14] updated template for proper spacing --- templates/pam.d/system-auth-ac.erb | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/templates/pam.d/system-auth-ac.erb b/templates/pam.d/system-auth-ac.erb index 0a37784..3da0365 100644 --- a/templates/pam.d/system-auth-ac.erb +++ b/templates/pam.d/system-auth-ac.erb @@ -1,39 +1,39 @@ ############################################################################### # << FILE MANAGED BY PUPPET >> -# Manual changes are likey to be overwritten +# Manual changes are likely to be overwritten ############################################################################### <% if scope.lookupvar('pam::pamd::pam_tally') == true then -%> -auth <%= scope.lookupvar('pam::pamd::pam_tally_auth_set') %> +auth <%= scope.lookupvar('pam::pamd::pam_tally_auth_set') %> <% end -%> <% if scope.lookupvar('pam::pamd::pam_tally2') == true then -%> -auth <%= scope.lookupvar('pam::pamd::pam_tally2_auth_set') %> +auth <%= scope.lookupvar('pam::pamd::pam_tally2_auth_set') %> <% end -%> auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 500 quiet <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%> -auth <%= scope.lookupvar('pam::pamd::pam_ldap_auth_set') %> +auth <%= scope.lookupvar('pam::pamd::pam_ldap_auth_set') %> <% end -%> auth required pam_deny.so <% if scope.lookupvar('pam::pamd::pam_tally') == true then -%> -account <%= scope.lookupvar('pam::pamd::pam_tally_account_set') %> +account <%= scope.lookupvar('pam::pamd::pam_tally_account_set') %> <% end -%> <% if scope.lookupvar('pam::pamd::pam_tally2') == true then -%> -account <%= scope.lookupvar('pam::pamd::pam_tally2_account_set') %> +account <%= scope.lookupvar('pam::pamd::pam_tally2_account_set') %> <% end -%> account required pam_unix.so broken_shadow account sufficient pam_succeed_if.so uid < 500 quiet <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%> -account <%= scope.lookupvar('pam::pamd::pam_ldap_account_set') %> +account <%= scope.lookupvar('pam::pamd::pam_ldap_account_set') %> <% end -%> account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type= password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%> -password <%= scope.lookupvar('pam::pamd::pam_ldap_password_set') %> +password <%= scope.lookupvar('pam::pamd::pam_ldap_password_set') %> <% end -%> password required pam_deny.so @@ -42,6 +42,5 @@ session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%> -session <%= scope.lookupvar('pam::pamd::pam_ldap_session_set') %> +session <%= scope.lookupvar('pam::pamd::pam_ldap_session_set') %> <% end -%> - From de9e352f225fdd6ec79c8d6b7c0976dda26b9af3 Mon Sep 17 00:00:00 2001 From: Zan Loy Date: Thu, 18 Sep 2014 13:00:41 -0400 Subject: [PATCH 02/14] added pam_unix to manifests and template --- manifests/pamd.pp | 49 ++++++++++++++++++++++++++++++ manifests/params.pp | 5 +++ templates/pam.d/system-auth-ac.erb | 12 ++++---- 3 files changed, 60 insertions(+), 6 deletions(-) diff --git a/manifests/pamd.pp b/manifests/pamd.pp index cecc867..09ff4a1 100644 --- a/manifests/pamd.pp +++ b/manifests/pamd.pp @@ -6,6 +6,30 @@ # # === Parameters # +# [pam_unix_account] +# When specified, it allows for customization +# of pam_unix.so in account type +# *Requires* pam_unix => true +# *Optional* defaults to 'required pam_unix.so broken_shadow' +# +# [pam_unix_auth] +# When specified, it allows for customization +# of pam_unix.so in auth type +# *Requires* pam_unix => true +# *Optional* defaults to 'sufficient pam_unix.so nullok try_first_pass' +# +# [pam_unix_password] +# When specified, it allows for customization +# of pam_unix.so in password type +# *Requires* pam_unix => true +# *Optional* defaults to 'sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok' +# +# [pam_unix_session] +# When specified, it allows for customization +# of pam_unix.so in session type +# *Requires* pam_unix => true +# *Optional* defaults to 'required pam_unix.so' +# # [pam_ldap] # If enabled sets up the usage of pam_ldap.so # *Conflicts* pam_ldapd @@ -138,6 +162,11 @@ # # class pam::pamd ( + $pam_unix_account = false, + $pam_unix_auth = false, + $pam_unix_password = false, + $pam_unix_session = false, + $pam_ldap = false, $pam_ldap_account = false, $pam_ldap_auth = false, @@ -172,6 +201,26 @@ motd::register { 'pam::pamd': } } + case $pam_unix_account { + false: { $pam_unix_account_set = $pam::params::pam_unix_account } + default: { $pam_unix_account_set = $pam_unix_account } + } + + case $pam_unix_auth { + false: { $pam_unix_auth_set = $pam::params::pam_unix_auth } + default: { $pam_unix_auth_set = $pam_unix_auth } + } + + case $pam_unix_password { + false: { $pam_unix_password_set = $pam::params::pam_unix_password } + default: { $pam_unix_password_set = $pam_unix_password } + } + + case $pam_unix_session { + false: { $pam_unix_session_set = $pam::params::pam_unix_session } + default: { $pam_unix_session_set = $pam_unix_session } + } + if($pam_ldap) { #Class['ldap'] -> Class['pam::pamd'] diff --git a/manifests/params.pp b/manifests/params.pp index 70dd48c..47b6847 100644 --- a/manifests/params.pp +++ b/manifests/params.pp @@ -55,6 +55,11 @@ } } + $pam_unix_account = 'required pam_unix.so broken_shadow' + $pam_unix_auth = 'sufficient pam_unix.so nullok try_first_pass' + $pam_unix_password = 'sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok' + $pam_unix_session = 'required pam_unix.so' + $pam_ldap_account = '[default=bad success=ok user_unknown=ignore] pam_ldap.so' $pam_ldap_auth = 'sufficient pam_ldap.so use_first_pass' $pam_ldap_password = 'sufficient pam_ldap.so use_authtok' diff --git a/templates/pam.d/system-auth-ac.erb b/templates/pam.d/system-auth-ac.erb index 3da0365..17b45d1 100644 --- a/templates/pam.d/system-auth-ac.erb +++ b/templates/pam.d/system-auth-ac.erb @@ -10,7 +10,7 @@ auth <%= scope.lookupvar('pam::pamd::pam_tally_auth_set') %> auth <%= scope.lookupvar('pam::pamd::pam_tally2_auth_set') %> <% end -%> auth required pam_env.so -auth sufficient pam_unix.so nullok try_first_pass +auth <%= scope.lookupvar('pam::pamd::pam_unix_auth_set') %> auth requisite pam_succeed_if.so uid >= 500 quiet <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%> auth <%= scope.lookupvar('pam::pamd::pam_ldap_auth_set') %> @@ -23,15 +23,15 @@ account <%= scope.lookupvar('pam::pamd::pam_tally_account_set') %> <% if scope.lookupvar('pam::pamd::pam_tally2') == true then -%> account <%= scope.lookupvar('pam::pamd::pam_tally2_account_set') %> <% end -%> -account required pam_unix.so broken_shadow +account <%= scope.lookupvar('pam::pamd::pam_unix_account_set') %> account sufficient pam_succeed_if.so uid < 500 quiet <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%> -account <%= scope.lookupvar('pam::pamd::pam_ldap_account_set') %> +account <%= scope.lookupvar('pam::pamd::pam_ldap_account_set') %> <% end -%> account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type= -password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok +password <%= scope.lookupvar('pam::pamd::pam_unix_password_set') %> <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%> password <%= scope.lookupvar('pam::pamd::pam_ldap_password_set') %> <% end -%> @@ -40,7 +40,7 @@ password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid -session required pam_unix.so +session <%= scope.lookupvar('pam::pamd::pam_unix_session_set') %> <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%> -session <%= scope.lookupvar('pam::pamd::pam_ldap_session_set') %> +session <%= scope.lookupvar('pam::pamd::pam_ldap_session_set') %> <% end -%> From e8d1c0e43368b94ae5852102743b09fa1946311b Mon Sep 17 00:00:00 2001 From: Zan Loy Date: Thu, 18 Sep 2014 13:52:02 -0400 Subject: [PATCH 03/14] added options for pam_sss (RedHat only) --- manifests/pamd.pp | 68 ++++++++++++++++++++++++++++++ manifests/params.pp | 5 +++ templates/pam.d/system-auth-ac.erb | 12 ++++++ 3 files changed, 85 insertions(+) diff --git a/manifests/pamd.pp b/manifests/pamd.pp index 09ff4a1..b9395d4 100644 --- a/manifests/pamd.pp +++ b/manifests/pamd.pp @@ -81,6 +81,34 @@ # UNTESTED # *Optional* defaults to false # +# [pam_sss] +# If enabled sets up the usage of pam_sss.so +# *Optional* defaults to false +# +# [pam_sss_account] +# When specified it allows for customization +# of pam_sss.so in account type +# *Requires* pam_sss => true +# *Optional* defaults to '[default=bad success=ok user_unknown=ignore] pam_sss.so' +# +# [pam_sss_auth] +# When specified it allows for customization +# of pam_sss.so in auth type +# *Requires* pam_sss => true +# *Optional* defaults to 'sufficient pam_sss.so use_first_pass' +# +# [pam_sss_password] +# When specified it allows for customization +# of pam_sss.so in password type +# *Requires* pam_sss => true +# *Optional* defaults to 'sufficient pam_sss.so use_authtok' +# +# [pam_sss_session] +# When specified it allows for customization +# of pam_sss.so in session type +# *Requires* pam_sss => true +# *Optional* defaults to 'optional pam_sss.so' +# # [pam_tally] # UNTESTED # *Optional* defaults to false @@ -179,6 +207,12 @@ $pam_ldapd_password = false, $pam_ldapd_session = false, + $pam_sss = false, + $pam_sss_account = false, + $pam_sss_auth = false, + $pam_sss_password = false, + $pam_sss_session = false, + $pam_tally = false, $pam_tally_account = false, $pam_tally_auth = false, @@ -277,6 +311,40 @@ } + if($pam_sss) { + + package { 'sssd': + ensure => present, + } + + service { 'sssd': + ensure => running, + enabled => true, + require => Package['sssd'], + } + + case $pam_sss_account { + false: { $pam_sss_account_set = $pam::params::pam_sss_account } + default: { $pam_sss_account_set = $pam_sss_account } + } + + case $pam_sss_auth { + false: { $pam_sss_auth_set = $pam::params::pam_sss_auth } + default: { $pam_sss_auth_set = $pam_sss_auth } + } + + case $pam_sss_password { + false: { $pam_sss_password_set = $pam::params::pam_sss_password } + default: { $pam_sss_password_set = $pam_sss_password } + } + + case $pam_sss_session { + false: { $pam_sss_session_set = $pam::params::pam_sss_session } + default: { $pam_sss_session_set = $pam_sss_session } + } + + } + if($pam_tally) { case $pam_tally_account { diff --git a/manifests/params.pp b/manifests/params.pp index 47b6847..143c6df 100644 --- a/manifests/params.pp +++ b/manifests/params.pp @@ -70,6 +70,11 @@ $pam_ldapd_password = false $pam_ldapd_session = false + $pam_sss_account = '[default=bad success=ok user_unknown=ignore] pam_sss.so' + $pam_sss_auth = 'sufficient pam_sss.so use_first_pass' + $pam_sss_password = 'sufficient pam_sss.so use_authtok' + $pam_sss_session = 'optional pam_sss.so' + $ldap_conf = '/etc/openldap/ldap.conf' $pam_tally_account = 'required pam_tally.so' diff --git a/templates/pam.d/system-auth-ac.erb b/templates/pam.d/system-auth-ac.erb index 17b45d1..cd29900 100644 --- a/templates/pam.d/system-auth-ac.erb +++ b/templates/pam.d/system-auth-ac.erb @@ -12,6 +12,9 @@ auth <%= scope.lookupvar('pam::pamd::pam_tally2_auth_set') %> auth required pam_env.so auth <%= scope.lookupvar('pam::pamd::pam_unix_auth_set') %> auth requisite pam_succeed_if.so uid >= 500 quiet +<% if scope.lookupvar('pam::pamd::pam_sss') == true then -%> +auth <%= scope.lookupvar('pam::pamd::pam_sss_auth_set') %> +<% end -%> <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%> auth <%= scope.lookupvar('pam::pamd::pam_ldap_auth_set') %> <% end -%> @@ -25,6 +28,9 @@ account <%= scope.lookupvar('pam::pamd::pam_tally2_account_set') %> <% end -%> account <%= scope.lookupvar('pam::pamd::pam_unix_account_set') %> account sufficient pam_succeed_if.so uid < 500 quiet +<% if scope.lookupvar('pam::pamd::pam_sss') == true then -%> +account <%= scope.lookupvar('pam::pamd::pam_sss_account_set') %> +<% end -%> <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%> account <%= scope.lookupvar('pam::pamd::pam_ldap_account_set') %> <% end -%> @@ -32,6 +38,9 @@ account required pam_permit.so password requisite pam_cracklib.so try_first_pass retry=3 type= password <%= scope.lookupvar('pam::pamd::pam_unix_password_set') %> +<% if scope.lookupvar('pam::pamd::pam_sss') == true then -%> +password <%= scope.lookupvar('pam::pamd::pam_sss_password_set') %> +<% end -%> <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%> password <%= scope.lookupvar('pam::pamd::pam_ldap_password_set') %> <% end -%> @@ -41,6 +50,9 @@ session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session <%= scope.lookupvar('pam::pamd::pam_unix_session_set') %> +<% if scope.lookupvar('pam::pamd::pam_sss') == true then -%> +session <%= scope.lookupvar('pam::pamd::pam_sss_session_set') %> +<% end -%> <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%> session <%= scope.lookupvar('pam::pamd::pam_ldap_session_set') %> <% end -%> From d9d03a68b220fc4314eb2ad7aeec74da6b20c20e Mon Sep 17 00:00:00 2001 From: Zan Loy Date: Thu, 18 Sep 2014 14:08:05 -0400 Subject: [PATCH 04/14] typo fixed --- manifests/pamd.pp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/manifests/pamd.pp b/manifests/pamd.pp index b9395d4..5dc75ce 100644 --- a/manifests/pamd.pp +++ b/manifests/pamd.pp @@ -318,8 +318,8 @@ } service { 'sssd': - ensure => running, - enabled => true, + ensure => running, + enable => true, require => Package['sssd'], } From 027d43f9fdd073d700b7774d7ca2ebf90ee013f1 Mon Sep 17 00:00:00 2001 From: Zan Loy Date: Thu, 18 Sep 2014 14:18:29 -0400 Subject: [PATCH 05/14] updated to use oddjob-mkhomedir in RHEL6 --- manifests/pamd.pp | 6 ++++++ manifests/params.pp | 5 ++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/manifests/pamd.pp b/manifests/pamd.pp index 5dc75ce..e61adc6 100644 --- a/manifests/pamd.pp +++ b/manifests/pamd.pp @@ -384,6 +384,12 @@ if($pam_mkhomedir) { + if($pam::params::pam_mkhomedir_package) { + package { $pam::params::pam_mkhomedir_package: + ensure => present + } + } + case $pam_mkhomedir_session { false: { $pam_mkhomedir_session_set = $pam::params::pam_mkhomedir_session } default: { $pam_mkhomedir_session_set = $pam_mkhomedir_session } diff --git a/manifests/params.pp b/manifests/params.pp index 143c6df..e904294 100644 --- a/manifests/params.pp +++ b/manifests/params.pp @@ -44,10 +44,13 @@ case $::operatingsystemmajrelease { 5 : { $package_pam_ldap = 'nss_ldap' + $pam_mkhomedir_so = 'pam_mkhomdir.so' } 6 : { $package_pam_ldap = 'nss-pam-ldapd' + $pam_mkhomedir_so = 'pam_oddjob_mkhomdir.so' + $pam_mkhomedir_package = 'oddjob-mkhomedir' } default : { @@ -85,7 +88,7 @@ $pam_cracklib_password = 'requisite pam_cracklib.so try_first_pass retry=3 minlen=9 dcredit=-1' - $pam_mkhomedir_session = 'requisite pam_mkhomedir.so skel=/etc/skel/ umask=0022' + $pam_mkhomedir_session = "requisite ${pam_mkhomedir_so} skel=/etc/skel/ umask=0022" } From c45d235322de7ca2568b75619962dcb11a9fb564 Mon Sep 17 00:00:00 2001 From: Zan Loy Date: Thu, 18 Sep 2014 14:26:29 -0400 Subject: [PATCH 06/14] added pam_mkhomedir to template --- templates/pam.d/system-auth-ac.erb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/templates/pam.d/system-auth-ac.erb b/templates/pam.d/system-auth-ac.erb index cd29900..83f695a 100644 --- a/templates/pam.d/system-auth-ac.erb +++ b/templates/pam.d/system-auth-ac.erb @@ -48,6 +48,9 @@ password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so +<% if scope.lookupvar('pam::pamd::pam_mkhomedir') == true then -%> +session <%= scope.lookupvar('pam::pamd::pam_mkhomdir_session_set') %> +<% end -%> session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session <%= scope.lookupvar('pam::pamd::pam_unix_session_set') %> <% if scope.lookupvar('pam::pamd::pam_sss') == true then -%> From 7f242091adb912709c3113deb4cb33c771925a14 Mon Sep 17 00:00:00 2001 From: Zan Loy Date: Thu, 18 Sep 2014 14:27:52 -0400 Subject: [PATCH 07/14] fixed typo in template --- templates/pam.d/system-auth-ac.erb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/pam.d/system-auth-ac.erb b/templates/pam.d/system-auth-ac.erb index 83f695a..121e76d 100644 --- a/templates/pam.d/system-auth-ac.erb +++ b/templates/pam.d/system-auth-ac.erb @@ -49,7 +49,7 @@ password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so <% if scope.lookupvar('pam::pamd::pam_mkhomedir') == true then -%> -session <%= scope.lookupvar('pam::pamd::pam_mkhomdir_session_set') %> +session <%= scope.lookupvar('pam::pamd::pam_mkhomedir_session_set') %> <% end -%> session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session <%= scope.lookupvar('pam::pamd::pam_unix_session_set') %> From 71b8c01d1985f276a148ba99efceee7c6e089447 Mon Sep 17 00:00:00 2001 From: Zan Loy Date: Thu, 18 Sep 2014 14:29:17 -0400 Subject: [PATCH 08/14] fixed more typos accociated with mkhomedir --- manifests/params.pp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/manifests/params.pp b/manifests/params.pp index e904294..5d3bc60 100644 --- a/manifests/params.pp +++ b/manifests/params.pp @@ -44,12 +44,12 @@ case $::operatingsystemmajrelease { 5 : { $package_pam_ldap = 'nss_ldap' - $pam_mkhomedir_so = 'pam_mkhomdir.so' + $pam_mkhomedir_so = 'pam_mkhomedir.so' } 6 : { $package_pam_ldap = 'nss-pam-ldapd' - $pam_mkhomedir_so = 'pam_oddjob_mkhomdir.so' + $pam_mkhomedir_so = 'pam_oddjob_mkhomedir.so' $pam_mkhomedir_package = 'oddjob-mkhomedir' } From 30523e1d4e59a67ac20e1b2d3a6ce9212c37c2d2 Mon Sep 17 00:00:00 2001 From: Zan Loy Date: Thu, 18 Sep 2014 14:30:55 -0400 Subject: [PATCH 09/14] set mkhomedir to optional --- manifests/params.pp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/manifests/params.pp b/manifests/params.pp index 5d3bc60..e152229 100644 --- a/manifests/params.pp +++ b/manifests/params.pp @@ -31,7 +31,7 @@ $pam_cracklib_password = 'requisite pam_cracklib.so try_first_pass retry=3 minlen=9 dcredit=-1' - $pam_mkhomedir_session = 'requisite pam_mkhomedir.so skel=/etc/skel/ umask=0022' + $pam_mkhomedir_session = 'optional pam_mkhomedir.so skel=/etc/skel/ umask=0022' } From 9e9fd2c1458009741036b01b2fd08b45e9abcd6e Mon Sep 17 00:00:00 2001 From: Zan Loy Date: Thu, 18 Sep 2014 14:34:04 -0400 Subject: [PATCH 10/14] added pam_localuser.so since this is a default option in RHEL6 (untested elsewhere) --- manifests/params.pp | 2 +- templates/pam.d/system-auth-ac.erb | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/manifests/params.pp b/manifests/params.pp index e152229..4927817 100644 --- a/manifests/params.pp +++ b/manifests/params.pp @@ -31,7 +31,7 @@ $pam_cracklib_password = 'requisite pam_cracklib.so try_first_pass retry=3 minlen=9 dcredit=-1' - $pam_mkhomedir_session = 'optional pam_mkhomedir.so skel=/etc/skel/ umask=0022' + $pam_mkhomedir_session = 'optional pam_mkhomedir.so skel=/etc/skel umask=0022' } diff --git a/templates/pam.d/system-auth-ac.erb b/templates/pam.d/system-auth-ac.erb index 121e76d..02d1393 100644 --- a/templates/pam.d/system-auth-ac.erb +++ b/templates/pam.d/system-auth-ac.erb @@ -27,6 +27,7 @@ account <%= scope.lookupvar('pam::pamd::pam_tally_account_set') %> account <%= scope.lookupvar('pam::pamd::pam_tally2_account_set') %> <% end -%> account <%= scope.lookupvar('pam::pamd::pam_unix_account_set') %> +account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet <% if scope.lookupvar('pam::pamd::pam_sss') == true then -%> account <%= scope.lookupvar('pam::pamd::pam_sss_account_set') %> From 4343adfa7ba7331b84b1d8a8f7d7f5d9c45e3cc0 Mon Sep 17 00:00:00 2001 From: Zan Loy Date: Thu, 18 Sep 2014 14:35:34 -0400 Subject: [PATCH 11/14] updated other osfamily to set mkhomedir optional --- manifests/params.pp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/manifests/params.pp b/manifests/params.pp index 4927817..0a11052 100644 --- a/manifests/params.pp +++ b/manifests/params.pp @@ -88,7 +88,7 @@ $pam_cracklib_password = 'requisite pam_cracklib.so try_first_pass retry=3 minlen=9 dcredit=-1' - $pam_mkhomedir_session = "requisite ${pam_mkhomedir_so} skel=/etc/skel/ umask=0022" + $pam_mkhomedir_session = "optional ${pam_mkhomedir_so} skel=/etc/skel umask=0022" } @@ -119,7 +119,7 @@ $pam_cracklib_password = 'requisite pam_cracklib.so try_first_pass retry=3 minlen=9 dcredit=-1' - $pam_mkhomedir_session = 'requisite pam_mkhomedir.so skel=/etc/skel/ umask=0022' + $pam_mkhomedir_session = 'optional pam_mkhomedir.so skel=/etc/skel umask=0022' } From 13c3fbda5946784d352b42719a826276af95620d Mon Sep 17 00:00:00 2001 From: Zan Loy Date: Thu, 18 Sep 2014 14:40:44 -0400 Subject: [PATCH 12/14] in redhat, system-auth should be a symlink to system-auth-ac --- manifests/pamd/redhat.pp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/manifests/pamd/redhat.pp b/manifests/pamd/redhat.pp index 2b73162..b299d64 100644 --- a/manifests/pamd/redhat.pp +++ b/manifests/pamd/redhat.pp @@ -16,7 +16,8 @@ } file { "${pam::params::prefix_pamd}/system-auth": - content => template('pam/pam.d/system-auth-ac.erb') + ensure => link, + target => "${pam::params::prefix_pamd}/system-auth-ac", } if($pam::pamd::pam_ldap) { From 4d2aca44437d0d52091ac1264b33bd6f34cc601d Mon Sep 17 00:00:00 2001 From: Zan Loy Date: Thu, 18 Sep 2014 14:42:55 -0400 Subject: [PATCH 13/14] use relative link instead of absolute --- manifests/pamd/redhat.pp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/manifests/pamd/redhat.pp b/manifests/pamd/redhat.pp index b299d64..a1b290e 100644 --- a/manifests/pamd/redhat.pp +++ b/manifests/pamd/redhat.pp @@ -17,7 +17,7 @@ file { "${pam::params::prefix_pamd}/system-auth": ensure => link, - target => "${pam::params::prefix_pamd}/system-auth-ac", + target => 'system-auth-ac', } if($pam::pamd::pam_ldap) { From f9aa28af7976e61fe61573864bcb86c14db45dcb Mon Sep 17 00:00:00 2001 From: Zan Loy Date: Tue, 23 Sep 2014 11:26:36 -0400 Subject: [PATCH 14/14] added sssd_conf --- manifests/pamd.pp | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/manifests/pamd.pp b/manifests/pamd.pp index e61adc6..8dc7784 100644 --- a/manifests/pamd.pp +++ b/manifests/pamd.pp @@ -212,6 +212,7 @@ $pam_sss_auth = false, $pam_sss_password = false, $pam_sss_session = false, + $sssd_conf = false, $pam_tally = false, $pam_tally_account = false, @@ -317,10 +318,16 @@ ensure => present, } + file { '/etc/sssd/sssd.conf': + ensure => file, + source => $sssd_conf, + require => Package['sssd'], + } + service { 'sssd': ensure => running, enable => true, - require => Package['sssd'], + require => File['/etc/sssd/sssd.conf'], } case $pam_sss_account {