Add sssd and pam_unix customization

manifests/pamd.pp

@@ -6,6 +6,30 @@
 #
 # === Parameters
 #
+#  [pam_unix_account]
+#  When specified, it allows for customization
+#  of pam_unix.so in account type
+#  *Requires* pam_unix => true
+#  *Optional* defaults to 'required      pam_unix.so broken_shadow'
+#
+#  [pam_unix_auth]
+#  When specified, it allows for customization
+#  of pam_unix.so in auth type
+#  *Requires* pam_unix => true
+#  *Optional* defaults to 'sufficient    pam_unix.so nullok try_first_pass'
+#
+#  [pam_unix_password]
+#  When specified, it allows for customization
+#  of pam_unix.so in password type
+#  *Requires* pam_unix => true
+#  *Optional* defaults to 'sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok'
+#
+#  [pam_unix_session]
+#  When specified, it allows for customization
+#  of pam_unix.so in session type
+#  *Requires* pam_unix => true
+#  *Optional* defaults to 'required      pam_unix.so'
+#
 #  [pam_ldap]
 #  If enabled sets up the usage of pam_ldap.so
 #  *Conflicts* pam_ldapd
@@ -57,6 +81,34 @@
 #  UNTESTED
 #  *Optional* defaults to false
 #
+#  [pam_sss]
+#  If enabled sets up the usage of pam_sss.so
+#  *Optional* defaults to false
+#
+#  [pam_sss_account]
+#  When specified it allows for customization
+#  of pam_sss.so in account type
+#  *Requires* pam_sss => true
+#  *Optional* defaults to '[default=bad success=ok user_unknown=ignore] pam_sss.so'
+#
+#  [pam_sss_auth]
+#  When specified it allows for customization
+#  of pam_sss.so in auth type
+#  *Requires* pam_sss => true
+#  *Optional* defaults to 'sufficient    pam_sss.so use_first_pass'
+#
+#  [pam_sss_password]
+#  When specified it allows for customization
+#  of pam_sss.so in password type
+#  *Requires* pam_sss => true
+#  *Optional* defaults to 'sufficient    pam_sss.so use_authtok'
+#
+#  [pam_sss_session]
+#  When specified it allows for customization
+#  of pam_sss.so in session type
+#  *Requires* pam_sss => true
+#  *Optional* defaults to 'optional      pam_sss.so'
+#
 #  [pam_tally]
 #  UNTESTED
 #  *Optional* defaults to false
@@ -138,6 +190,11 @@
 #
 #
 class pam::pamd (
+  $pam_unix_account      = false,
+  $pam_unix_auth         = false,
+  $pam_unix_password     = false,
+  $pam_unix_session      = false,
+
   $pam_ldap              = false,
   $pam_ldap_account      = false,
   $pam_ldap_auth         = false,
@@ -150,6 +207,13 @@
   $pam_ldapd_password    = false,
   $pam_ldapd_session     = false,
 
+  $pam_sss               = false,
+  $pam_sss_account       = false,
+  $pam_sss_auth          = false,
+  $pam_sss_password      = false,
+  $pam_sss_session       = false,
+  $sssd_conf             = false,
+
   $pam_tally             = false,
   $pam_tally_account     = false,
   $pam_tally_auth        = false,
@@ -172,6 +236,26 @@
     motd::register { 'pam::pamd': }
   }
 
+  case $pam_unix_account {
+    false:   { $pam_unix_account_set = $pam::params::pam_unix_account }
+    default: { $pam_unix_account_set = $pam_unix_account }
+  }
+
+  case $pam_unix_auth {
+    false:   { $pam_unix_auth_set = $pam::params::pam_unix_auth }
+    default: { $pam_unix_auth_set = $pam_unix_auth }
+  }
+
+  case $pam_unix_password {
+    false:   { $pam_unix_password_set = $pam::params::pam_unix_password }
+    default: { $pam_unix_password_set = $pam_unix_password }
+  }
+
+  case $pam_unix_session {
+    false:   { $pam_unix_session_set = $pam::params::pam_unix_session }
+    default: { $pam_unix_session_set = $pam_unix_session }
+  }
+
   if($pam_ldap) {
 
     #Class['ldap'] -> Class['pam::pamd']
@@ -228,6 +312,46 @@
 
   }
 
+  if($pam_sss) {
+
+    package { 'sssd':
+      ensure => present,
+    }
+
+    file { '/etc/sssd/sssd.conf':
+      ensure => file,
+      source => $sssd_conf,
+      require => Package['sssd'],
+    }
+
+    service { 'sssd':
+      ensure  => running,
+      enable  => true,
+      require => File['/etc/sssd/sssd.conf'],
+    }
+
+    case $pam_sss_account {
+      false:   { $pam_sss_account_set = $pam::params::pam_sss_account }
+      default: { $pam_sss_account_set = $pam_sss_account }
+    }
+
+    case $pam_sss_auth {
+      false:   { $pam_sss_auth_set = $pam::params::pam_sss_auth }
+      default: { $pam_sss_auth_set = $pam_sss_auth }
+    }
+
+    case $pam_sss_password {
+      false:   { $pam_sss_password_set = $pam::params::pam_sss_password }
+      default: { $pam_sss_password_set = $pam_sss_password }
+    }
+
+    case $pam_sss_session {
+      false:   { $pam_sss_session_set = $pam::params::pam_sss_session }
+      default: { $pam_sss_session_set = $pam_sss_session }
+    }
+
+  }
+
   if($pam_tally) {
 
     case $pam_tally_account {
@@ -267,6 +391,12 @@
 
   if($pam_mkhomedir) {
 
+    if($pam::params::pam_mkhomedir_package) {
+      package { $pam::params::pam_mkhomedir_package:
+        ensure => present
+      }
+    }
+
     case $pam_mkhomedir_session {
       false:   { $pam_mkhomedir_session_set = $pam::params::pam_mkhomedir_session }
       default: { $pam_mkhomedir_session_set = $pam_mkhomedir_session }

manifests/pamd/redhat.pp

@@ -16,7 +16,8 @@
   }
 
   file { "${pam::params::prefix_pamd}/system-auth":
-    content => template('pam/pam.d/system-auth-ac.erb')
+    ensure => link,
+    target => 'system-auth-ac',
   }
 
   if($pam::pamd::pam_ldap) {

manifests/params.pp

@@ -31,7 +31,7 @@
 
       $pam_cracklib_password = 'requisite     pam_cracklib.so try_first_pass retry=3 minlen=9 dcredit=-1'
 
-      $pam_mkhomedir_session = 'requisite     pam_mkhomedir.so skel=/etc/skel/ umask=0022'
+      $pam_mkhomedir_session = 'optional      pam_mkhomedir.so skel=/etc/skel umask=0022'
 
     }
 
@@ -44,17 +44,25 @@
       case $::operatingsystemmajrelease {
         5 : {
           $package_pam_ldap = 'nss_ldap'
+          $pam_mkhomedir_so = 'pam_mkhomedir.so'
         }
 
         6 : {
           $package_pam_ldap = 'nss-pam-ldapd'
+          $pam_mkhomedir_so = 'pam_oddjob_mkhomedir.so'
+          $pam_mkhomedir_package = 'oddjob-mkhomedir'
         }
 
         default : {
           notice("${::operatingsystem} version ${::operatingsystemmajrelease} not handled")
         }
       }
 
+      $pam_unix_account      = 'required      pam_unix.so broken_shadow'
+      $pam_unix_auth         = 'sufficient    pam_unix.so nullok try_first_pass'
+      $pam_unix_password     = 'sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok'
+      $pam_unix_session      = 'required      pam_unix.so'
+
       $pam_ldap_account      = '[default=bad success=ok user_unknown=ignore] pam_ldap.so'
       $pam_ldap_auth         = 'sufficient    pam_ldap.so use_first_pass'
       $pam_ldap_password     = 'sufficient    pam_ldap.so use_authtok'
@@ -65,6 +73,11 @@
       $pam_ldapd_password    = false
       $pam_ldapd_session     = false
 
+      $pam_sss_account       = '[default=bad success=ok user_unknown=ignore] pam_sss.so'
+      $pam_sss_auth          = 'sufficient    pam_sss.so use_first_pass'
+      $pam_sss_password      = 'sufficient    pam_sss.so use_authtok'
+      $pam_sss_session       = 'optional      pam_sss.so'
+
       $ldap_conf             = '/etc/openldap/ldap.conf'
 
       $pam_tally_account     = 'required      pam_tally.so'
@@ -75,7 +88,7 @@
 
       $pam_cracklib_password = 'requisite     pam_cracklib.so try_first_pass retry=3 minlen=9 dcredit=-1'
 
-      $pam_mkhomedir_session = 'requisite     pam_mkhomedir.so skel=/etc/skel/ umask=0022'
+      $pam_mkhomedir_session = "optional      ${pam_mkhomedir_so} skel=/etc/skel umask=0022"
 
     }
 
@@ -106,7 +119,7 @@
 
       $pam_cracklib_password = 'requisite     pam_cracklib.so try_first_pass retry=3 minlen=9 dcredit=-1'
 
-      $pam_mkhomedir_session = 'requisite     pam_mkhomedir.so skel=/etc/skel/ umask=0022'
+      $pam_mkhomedir_session = 'optional      pam_mkhomedir.so skel=/etc/skel umask=0022'
 
     }
 

templates/pam.d/system-auth-ac.erb

@@ -1,47 +1,62 @@
 ###############################################################################
 # << FILE MANAGED BY PUPPET >>
-# Manual changes are likey to be overwritten
+# Manual changes are likely to be overwritten
 ###############################################################################
 
 <% if scope.lookupvar('pam::pamd::pam_tally') == true then -%>
-auth  <%= scope.lookupvar('pam::pamd::pam_tally_auth_set') %>
+auth        <%= scope.lookupvar('pam::pamd::pam_tally_auth_set') %>
 <% end -%>
 <% if scope.lookupvar('pam::pamd::pam_tally2') == true then -%>
-auth  <%= scope.lookupvar('pam::pamd::pam_tally2_auth_set') %>
+auth        <%= scope.lookupvar('pam::pamd::pam_tally2_auth_set') %>
 <% end -%>
 auth        required      pam_env.so
-auth        sufficient    pam_unix.so nullok try_first_pass
+auth        <%= scope.lookupvar('pam::pamd::pam_unix_auth_set') %>
 auth        requisite     pam_succeed_if.so uid >= 500 quiet
+<% if scope.lookupvar('pam::pamd::pam_sss') == true then -%>
+auth        <%= scope.lookupvar('pam::pamd::pam_sss_auth_set') %>
+<% end -%>
 <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%>
-auth  <%= scope.lookupvar('pam::pamd::pam_ldap_auth_set') %>
+auth        <%= scope.lookupvar('pam::pamd::pam_ldap_auth_set') %>
 <% end -%>
 auth        required      pam_deny.so
 
 <% if scope.lookupvar('pam::pamd::pam_tally') == true then -%>
-account	<%= scope.lookupvar('pam::pamd::pam_tally_account_set') %>
+account	    <%= scope.lookupvar('pam::pamd::pam_tally_account_set') %>
 <% end -%>
 <% if scope.lookupvar('pam::pamd::pam_tally2') == true then -%>
-account	<%= scope.lookupvar('pam::pamd::pam_tally2_account_set') %>
+account	    <%= scope.lookupvar('pam::pamd::pam_tally2_account_set') %>
 <% end -%>
-account     required      pam_unix.so broken_shadow
+account     <%= scope.lookupvar('pam::pamd::pam_unix_account_set') %>
+account     sufficient    pam_localuser.so
 account     sufficient    pam_succeed_if.so uid < 500 quiet
+<% if scope.lookupvar('pam::pamd::pam_sss') == true then -%>
+account     <%= scope.lookupvar('pam::pamd::pam_sss_account_set') %>
+<% end -%>
 <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%>
-account	<%= scope.lookupvar('pam::pamd::pam_ldap_account_set') %>
+account     <%= scope.lookupvar('pam::pamd::pam_ldap_account_set') %>
 <% end -%>
 account     required      pam_permit.so
 
 password    requisite     pam_cracklib.so try_first_pass retry=3 type=
-password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
+password    <%= scope.lookupvar('pam::pamd::pam_unix_password_set') %>
+<% if scope.lookupvar('pam::pamd::pam_sss') == true then -%>
+password    <%= scope.lookupvar('pam::pamd::pam_sss_password_set') %>
+<% end -%>
 <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%>
-password  <%= scope.lookupvar('pam::pamd::pam_ldap_password_set') %>
+password    <%= scope.lookupvar('pam::pamd::pam_ldap_password_set') %>
 <% end -%>
 password    required      pam_deny.so
 
 session     optional      pam_keyinit.so revoke
 session     required      pam_limits.so
+<% if scope.lookupvar('pam::pamd::pam_mkhomedir') == true then -%>
+session     <%= scope.lookupvar('pam::pamd::pam_mkhomedir_session_set') %>
+<% end -%>
 session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
-session     required      pam_unix.so
+session     <%= scope.lookupvar('pam::pamd::pam_unix_session_set') %>
+<% if scope.lookupvar('pam::pamd::pam_sss') == true then -%>
+session     <%= scope.lookupvar('pam::pamd::pam_sss_session_set') %>
+<% end -%>
 <% if scope.lookupvar('pam::pamd::pam_ldap') == true then -%>
-session	<%= scope.lookupvar('pam::pamd::pam_ldap_session_set') %>
+session     <%= scope.lookupvar('pam::pamd::pam_ldap_session_set') %>
 <% end -%>
-