diff options
Diffstat (limited to 'modules/pam')
-rw-r--r-- | modules/pam/manifests/init.pp | 27 | ||||
-rw-r--r-- | modules/pam/templates/system-auth | 35 |
2 files changed, 62 insertions, 0 deletions
diff --git a/modules/pam/manifests/init.pp b/modules/pam/manifests/init.pp new file mode 100644 index 00000000..4c68a80c --- /dev/null +++ b/modules/pam/manifests/init.pp @@ -0,0 +1,27 @@ +class pam { + + package { ["pam_ldap","nss_ldap", "pam_mkhomedir"]: + ensure => installed, + } + + + file { "system-auth": + path => "/etc/pam.d/system-auth", + owner => root, + group => root, + mode => 644, + content => template("openldap/system-auth") + } + + # for server where only admin can connect + class admin_access { + $access_class = "admin" + file { "system-auth": } + } + + # for server where people can connect with ssh ( git, svn ) + class commiters_access { + $access_class = "commiters" + file { "system-auth": } + } +} diff --git a/modules/pam/templates/system-auth b/modules/pam/templates/system-auth new file mode 100644 index 00000000..b02aec3a --- /dev/null +++ b/modules/pam/templates/system-auth @@ -0,0 +1,35 @@ +auth required pam_env.so +# this part is here if the module don't exist +# basically, the idea is to copy the exact detail of sufficient, +# and add abort=ignore +auth [abort=ignore success=done new_authtok_reqd=done default=ignore] pam_tcb.so shadow fork nullok prefix=$2a$ count=8 +auth sufficient pam_unix.so likeauth nullok +auth sufficient pam_ldap.so use_first_pass +<% if access_class = 'admin' %> +auth required pam_wheel.so group=mga-sysadmin +<% end %> +<% if access_class = 'commiters' %> +auth required pam_wheel.so group=mga-commiters +<% end %> +auth required pam_deny.so + + +account sufficient pam_localuser.so +account sufficient pam_ldap.so +account required pam_deny.so + + +password required pam_cracklib.so retry=3 minlen=8 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 dcredit=0 ucredit=0 ucredit=0 +# TODO check this part too +password sufficient pam_tcb.so use_authtok shadow write_to=shadow fork nullok prefix=$2a$ count=8 abort=ignore +password sufficient pam_ldap.so use_authtok +password sufficient pam_unix.so use_authtok nullok md5 shadow +password required pam_deny.so + +session optional pam_keyinit.so revoke +# optional if there is a problem when creating the account +session optional pam_mkhomedir.so +session required pam_limits.so +session required pam_unix.so +session optional pam_ldap.so + |