From 7a5f8c03a92a4d83a8238868ecb645b65d91265b Mon Sep 17 00:00:00 2001 From: Michael Jones Date: Sat, 6 Aug 2022 00:00:58 -0500 Subject: [PATCH 1/2] Normalize whitespace of system-auth on tabs --- templates/system-auth.tpl | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/templates/system-auth.tpl b/templates/system-auth.tpl index 9739b6f..9022caf 100644 --- a/templates/system-auth.tpl +++ b/templates/system-auth.tpl @@ -1,17 +1,20 @@ auth required pam_env.so {{ debug|default('', true) }} + {% if pam_ssh %} auth sufficient pam_ssh.so {% endif %} {% if krb5 %} -auth [success={{ 4 if homed else 3 }} default=ignore] pam_krb5.so {{ krb5_params }} +auth [success={{ 4 if homed else 3 }} default=ignore] pam_krb5.so {{ krb5_params }} {% endif %} auth requisite pam_faillock.so preauth + {% if homed %} -auth [success=2 default=ignore] pam_systemd_home.so +auth [success=2 default=ignore] pam_systemd_home.so {% endif %} -auth [success=1 default=ignore] pam_unix.so {{ nullok|default('', true) }} {{ debug|default('', true) }} try_first_pass + +auth [success=1 default=ignore] pam_unix.so {{ nullok|default('', true) }} {{ debug|default('', true) }} try_first_pass auth [default=die] pam_faillock.so authfail {% if caps %} @@ -23,36 +26,36 @@ account [success=2 default=ignore] pam_krb5.so {{ krb5_params }} {% endif %} {% if homed %} -account [success=1 default=ignore] pam_systemd_home.so +account [success=1 default=ignore] pam_systemd_home.so {% endif %} account required pam_unix.so {{ debug|default('', true) }} -account required pam_faillock.so +account required pam_faillock.so {% if passwdqc %} -password required pam_passwdqc.so config=/etc/security/passwdqc.conf +password required pam_passwdqc.so config=/etc/security/passwdqc.conf {% endif %} {% if pwquality %} -password required pam_pwquality.so +password required pam_pwquality.so {% endif %} {% if pwhistory %} -password required pam_pwhistory.so use_authtok remember=5 retry=3 +password required pam_pwhistory.so use_authtok remember=5 retry=3 {% endif %} {% if krb5 %} -password [success=1 default=ignore] pam_krb5.so {{ krb5_params }} +password [success=1 default=ignore] pam_krb5.so {{ krb5_params }} {% endif %} {% if homed %} -password [success=1 default=ignore] pam_systemd_home.so +password [success=1 default=ignore] pam_systemd_home.so {% endif %} {% if passwdqc or pwquality %} -password required pam_unix.so try_first_pass {{ unix_authtok|default('', true) }} {{ nullok|default('', true) }} {{ unix_extended_encryption|default('', true) }} {{ debug|default('', true) }} +password required pam_unix.so try_first_pass {{ unix_authtok|default('', true) }} {{ nullok|default('', true) }} {{ unix_extended_encryption|default('', true) }} {{ debug|default('', true) }} {% else %} -password required pam_unix.so try_first_pass {{ nullok|default('', true) }} {{ unix_extended_encryption|default('', true) }} {{ debug|default('', true) }} +password required pam_unix.so try_first_pass {{ nullok|default('', true) }} {{ unix_extended_encryption|default('', true) }} {{ debug|default('', true) }} {% endif %} {% if pam_ssh %} From 85cd5a7c8eed86ff017f76a6e020ac483d35eee7 Mon Sep 17 00:00:00 2001 From: Michael Jones Date: Sat, 6 Aug 2022 00:08:05 -0500 Subject: [PATCH 2/2] Add template code to attempt winbind auth if enabled --- templates/system-auth.tpl | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/templates/system-auth.tpl b/templates/system-auth.tpl index 9022caf..60c1cc3 100644 --- a/templates/system-auth.tpl +++ b/templates/system-auth.tpl @@ -1,20 +1,24 @@ auth required pam_env.so {{ debug|default('', true) }} - {% if pam_ssh %} auth sufficient pam_ssh.so {% endif %} {% if krb5 %} -auth [success={{ 4 if homed else 3 }} default=ignore] pam_krb5.so {{ krb5_params }} +auth [success={{ 3 + 1 if homed else 0 + 1 if winbind else 0 }} default=ignore] pam_krb5.so {{ krb5_params }} {% endif %} auth requisite pam_faillock.so preauth {% if homed %} -auth [success=2 default=ignore] pam_systemd_home.so +auth [success={{ 3 if winbind else 2 }} default=ignore] pam_systemd_home.so +{% endif %} + +auth [success={{ 2 if winbind else 1 }} default=ignore] pam_unix.so {{ nullok|default('', true) }} {{ debug|default('', true) }} try_first_pass + +{% if winbind %} +auth [success=1 default=ignore] pam_winbind.so use_first_pass {{ debug|default('', true) }} {% endif %} -auth [success=1 default=ignore] pam_unix.so {{ nullok|default('', true) }} {{ debug|default('', true) }} try_first_pass auth [default=die] pam_faillock.so authfail {% if caps %} @@ -22,14 +26,19 @@ auth optional pam_cap.so {% endif %} {% if krb5 %} -account [success=2 default=ignore] pam_krb5.so {{ krb5_params }} +account [success={{ 1 + 1 if homed else 0 + 1 if winbind else 0 }} default=ignore] pam_krb5.so {{ krb5_params }} {% endif %} {% if homed %} -account [success=1 default=ignore] pam_systemd_home.so +account [success={{ 2 if winbind else 1 }} default=ignore] pam_systemd_home.so +{% endif %} + +{% if winbind %} +account [success=1 default=ignore] pam_winbind.so {{ debug|default('', true) }} {% endif %} account required pam_unix.so {{ debug|default('', true) }} + account required pam_faillock.so {% if passwdqc %} @@ -58,6 +67,11 @@ password required pam_unix.so try_first_pass {{ unix_authtok|default('', true) password required pam_unix.so try_first_pass {{ nullok|default('', true) }} {{ unix_extended_encryption|default('', true) }} {{ debug|default('', true) }} {% endif %} +{% if winbind %} +password required pam_winbind.so {{ unix_authtok|default('', true) }} {{ debug|default('', true) }} +{% endif %} + + {% if pam_ssh %} session optional pam_ssh.so {% endif %}