From dadf18aa28778afbf87eae93c4755e482c51b179 Mon Sep 17 00:00:00 2001 From: Alan Moore Date: Mon, 2 Dec 2024 16:19:51 +0000 Subject: [PATCH 01/18] Create bash_pam_unix_enable macro --- shared/macros/10-bash.jinja | 39 +++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/shared/macros/10-bash.jinja b/shared/macros/10-bash.jinja index aed5e6451a3..786bc316d5e 100644 --- a/shared/macros/10-bash.jinja +++ b/shared/macros/10-bash.jinja @@ -901,6 +901,45 @@ DEBIAN_FRONTEND=noninteractive pam-auth-update {{%- endmacro -%}} +{{# + Enable pam_unix.so PAM module by using pam-auth-update. + This option is only recommended when pam-auth-update tool is available for the system. +#}} +{{%- macro bash_pam_unix_enable() -%}} +conf_name=cac_unix +if [ ! -f /usr/share/pam-configs/"$conf_name" ]; then + cat << EOF > /usr/share/pam-configs/"$conf_name" +Name: Unix authentication +Default: yes +Priority: 257 +Conflicts: unix +Auth-Type: Primary +Auth: + [success=end default=ignore] pam_unix.so try_first_pass +Auth-Initial: + [success=end default=ignore] pam_unix.so +Account-Type: Primary +Account: + [success=end new_authtok_reqd=done default=ignore] pam_unix.so +Account-Initial: + [success=end new_authtok_reqd=done default=ignore] pam_unix.so +Session-Type: Additional +Session: + required pam_unix.so +Session-Initial: + required pam_unix.so +Password-Type: Primary +Password: + [success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt +Password-Initial: + [success=end default=ignore] pam_unix.so obscure yescrypt +EOF +fi + +DEBIAN_FRONTEND=noninteractive pam-auth-update +{{%- endmacro -%}} + + {{# Validate an authselect custom profile integrity and ensures the correct file path is defined in the "PAM_FILE_PATH" variable. The macros which change PAM files are the same regardless of From 1f71398cb03ed681e4cd0c4456a46ca05dcc1f29 Mon Sep 17 00:00:00 2001 From: Alan Moore Date: Mon, 2 Dec 2024 16:22:13 +0000 Subject: [PATCH 02/18] Use pam-auth-update to remediate the pam_unix related rules --- .../bash/shared.sh | 16 +++++++-- .../bash/shared.sh | 36 ++++++++++++++++--- .../no_empty_passwords/bash/shared.sh | 5 +-- 3 files changed, 48 insertions(+), 9 deletions(-) diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/bash/shared.sh index fe43d9d396f..d6b8ed4d34e 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/bash/shared.sh +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/bash/shared.sh @@ -2,16 +2,28 @@ {{{ bash_instantiate_variables("var_password_pam_unix_remember") }}} -{{% if "debian" in product or "ubuntu" in product or "sle12" in product %}} +{{% if "debian" in product or "sle12" in product %}} {{%- set accounts_password_pam_unix_remember_file = '/etc/pam.d/common-password' -%}} +{{% elif "ubuntu" in product %}} +{{%- set accounts_password_pam_unix_remember_file = '/usr/share/pam-configs/unix' -%}} {{% else %}} {{%- set accounts_password_pam_unix_remember_file = '/etc/pam.d/system-auth' -%}} {{% endif %}} -{{% if "debian" in product or "ubuntu" in product %}} +{{% if "debian" in product %}} {{{ bash_ensure_pam_module_options(accounts_password_pam_unix_remember_file, 'password', '\[success=[[:alnum:]].*\]', 'pam_unix.so', 'remember', "$var_password_pam_unix_remember", "$var_password_pam_unix_remember") }}} +{{% elif "ubuntu" in product %}} +{{{ bash_pam_unix_enable() }}} +sed -i -E '/^Password:/,/^[^[:space:]]/ { + /pam_unix\.so/ { + s/\s*remember=[^[:space:]]*//g + s/$/ remember='"$var_password_pam_unix_remember"'/g + } +}' "$accounts_password_pam_unix_remember_file" + +DEBIAN_FRONTEND=noninteractive pam-auth-update {{% else %}} {{{ bash_pam_pwhistory_enable(accounts_password_pam_unix_remember_file, diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/bash/shared.sh index 18f72ed0e13..977e62cd3ea 100644 --- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/bash/shared.sh +++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/bash/shared.sh @@ -6,18 +6,30 @@ PAM_FILE_PATH="/etc/pam.d/common-password" CONTROL="required" {{%- elif 'ubuntu' in product -%}} -PAM_FILE_PATH="/etc/pam.d/common-password" +{{{ bash_pam_unix_enable() }}} +PAM_FILE_PATH=/usr/share/pam-configs/cac_unix {{%- else -%}} PAM_FILE_PATH="/etc/pam.d/system-auth" CONTROL="sufficient" {{%- endif %}} {{% if 'ubuntu' in product -%}} -# Can't use macro bash_ensure_pam_module_configuration because the control -# contains special characters and is not static ([success=N default=ignore) -if ! grep -qP "^\s*password\s+.*\s+pam_unix.so\s+.*\b$var_password_hashing_algorithm_pam\b" "$PAM_FILE_PATH"; then - sed -i -E --follow-symlinks "/\s*password\s+.*\s+pam_unix.so.*/ s/$/ $var_password_hashing_algorithm_pam/" "$PAM_FILE_PATH" +if ! grep -qzP "Password:\s*\n\s+.*\s+pam_unix.so\s+.*\b$var_password_hashing_algorithm_pam\b" "$PAM_FILE_PATH"; then + sed -i -E '/^Password:/,/^[^[:space:]]/ { + /pam_unix\.so/ { + s/$/ '"$var_password_hashing_algorithm_pam"'/g + } +}' "$PAM_FILE_PATH" +fi + +if ! grep -qzP "Password-Initial:\s*\n\s+.*\s+pam_unix.so\s+.*\b$var_password_hashing_algorithm_pam\b" "$PAM_FILE_PATH"; then + sed -i -E '/^Password-Initial:/,/^[^[:space:]]/ { + /pam_unix\.so/ { + s/$/ '"$var_password_hashing_algorithm_pam"'/g + } +}' "$PAM_FILE_PATH" fi + {{%- else -%}} {{{ bash_ensure_pam_module_configuration("$PAM_FILE_PATH", 'password', "$CONTROL", 'pam_unix.so', "$var_password_hashing_algorithm_pam", '', '') }}} {{%- endif %}} @@ -27,8 +39,22 @@ declare -a HASHING_ALGORITHMS_OPTIONS=("sha512" "yescrypt" "gost_yescrypt" "blow for hash_option in "${HASHING_ALGORITHMS_OPTIONS[@]}"; do if [ "$hash_option" != "$var_password_hashing_algorithm_pam" ]; then + {{% if 'ubuntu' in product -%}} + sed -i -E '/^Password:/,/^[^[:space:]]/ { + /pam_unix\.so/ { + s/\s*'"$hash_option"'//g + } + }' "$PAM_FILE_PATH" + sed -i -E '/^Password-Initial:/,/^[^[:space:]]/ { + /pam_unix\.so/ { + s/\s*'"$hash_option"'//g + } + }' "$PAM_FILE_PATH" + DEBIAN_FRONTEND=noninteractive pam-auth-update + {{%- else -%}} if grep -qP "^\s*password\s+.*\s+pam_unix.so\s+.*\b$hash_option\b" "$PAM_FILE_PATH"; then {{{ bash_remove_pam_module_option_configuration("$PAM_FILE_PATH", 'password', ".*", 'pam_unix.so', "$hash_option") }}} fi + {{%- endif %}} fi done diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/bash/shared.sh b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/bash/shared.sh index 88999830909..a52ca717c84 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/bash/shared.sh +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/bash/shared.sh @@ -11,8 +11,9 @@ for FILE in ${NULLOK_FILES}; do sed --follow-symlinks -i 's/\//g' ${FILE} done {{% elif 'ubuntu' in product %}} -FILE="/etc/pam.d/common-password" -sed -i 's/\(.*pam_unix\.so.*\)\s\\(.*\)/\1\2/g' ${FILE} +{{{ bash_pam_unix_enable() }}} +sed --follow-symlinks -i 's/\//g' /usr/share/pam-configs/cac_unix +DEBIAN_FRONTEND=noninteractive pam-auth-update {{% else %}} if [ -f /usr/bin/authselect ]; then {{{ bash_enable_authselect_feature('without-nullok') }}} From 7faac26f0309783f709d240604609b3c68d312d9 Mon Sep 17 00:00:00 2001 From: Alan Moore Date: Tue, 3 Dec 2024 12:43:44 +0000 Subject: [PATCH 03/18] correct the pam-auth-update conf path --- .../accounts_password_pam_unix_remember/bash/shared.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/bash/shared.sh index d6b8ed4d34e..913e1f51d68 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/bash/shared.sh +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/bash/shared.sh @@ -5,7 +5,7 @@ {{% if "debian" in product or "sle12" in product %}} {{%- set accounts_password_pam_unix_remember_file = '/etc/pam.d/common-password' -%}} {{% elif "ubuntu" in product %}} -{{%- set accounts_password_pam_unix_remember_file = '/usr/share/pam-configs/unix' -%}} +{{%- set accounts_password_pam_unix_remember_file = '/usr/share/pam-configs/cac_unix' -%}} {{% else %}} {{%- set accounts_password_pam_unix_remember_file = '/etc/pam.d/system-auth' -%}} {{% endif %}} From 280ee4362b675484c68db9d8fa7547c686335f32 Mon Sep 17 00:00:00 2001 From: Alan Moore Date: Tue, 3 Dec 2024 16:24:24 +0000 Subject: [PATCH 04/18] Use bash variable instead of jinja variable --- .../bash/shared.sh | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/bash/shared.sh index 913e1f51d68..be98288d7a4 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/bash/shared.sh +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/bash/shared.sh @@ -5,7 +5,7 @@ {{% if "debian" in product or "sle12" in product %}} {{%- set accounts_password_pam_unix_remember_file = '/etc/pam.d/common-password' -%}} {{% elif "ubuntu" in product %}} -{{%- set accounts_password_pam_unix_remember_file = '/usr/share/pam-configs/cac_unix' -%}} +config_file="/usr/share/pam-configs/cac_unix" {{% else %}} {{%- set accounts_password_pam_unix_remember_file = '/etc/pam.d/system-auth' -%}} {{% endif %}} @@ -21,7 +21,14 @@ sed -i -E '/^Password:/,/^[^[:space:]]/ { s/\s*remember=[^[:space:]]*//g s/$/ remember='"$var_password_pam_unix_remember"'/g } -}' "$accounts_password_pam_unix_remember_file" +}' "$config_file" + +sed -i -E '/^Password-Initial:/,/^[^[:space:]]/ { + /pam_unix\.so/ { + s/\s*remember=[^[:space:]]*//g + s/$/ remember='"$var_password_pam_unix_remember"'/g + } +}' "$config_file" DEBIAN_FRONTEND=noninteractive pam-auth-update {{% else %}} From 34c80d836dfca28cc45b0e3da15af783e2894dc1 Mon Sep 17 00:00:00 2001 From: Alan Moore Date: Tue, 3 Dec 2024 16:25:42 +0000 Subject: [PATCH 05/18] Use pam-auth-update to fix the accounts_password_pam_unix_remember test --- .../tests/ubuntu_arg_missing.fail.sh | 31 ++++++++++++++++--- .../tests/ubuntu_correct_value.pass.sh | 20 ++++++++++-- .../tests/ubuntu_wrong_value.fail.sh | 30 ++++++++++++++++-- 3 files changed, 73 insertions(+), 8 deletions(-) diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/ubuntu_arg_missing.fail.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/ubuntu_arg_missing.fail.sh index db7fb6f2ea7..4c2c430a011 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/ubuntu_arg_missing.fail.sh +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/ubuntu_arg_missing.fail.sh @@ -1,7 +1,30 @@ #!/bin/bash # platform = multi_platform_ubuntu -config_file=/etc/pam.d/common-password -if grep -q "pam_unix\.so.*remember=" "${config_file}" ; then - sed -i "/pam_unix\.so/ s/\bremember=\S*//" "${config_file}" -fi +cat << EOF > /usr/share/pam-configs/unix +Name: Unix authentication +Default: yes +Priority: 256 +Auth-Type: Primary +Auth: + [success=end default=ignore] pam_unix.so try_first_pass +Auth-Initial: + [success=end default=ignore] pam_unix.so +Account-Type: Primary +Account: + [success=end new_authtok_reqd=done default=ignore] pam_unix.so +Account-Initial: + [success=end new_authtok_reqd=done default=ignore] pam_unix.so +Session-Type: Additional +Session: + required pam_unix.so +Session-Initial: + required pam_unix.so +Password-Type: Primary +Password: + [success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt +Password-Initial: + [success=end default=ignore] pam_unix.so obscure yescrypt +EOF + +DEBIAN_FRONTEND=noninteractive pam-auth-update diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/ubuntu_correct_value.pass.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/ubuntu_correct_value.pass.sh index d66fdd55278..9c3c606b024 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/ubuntu_correct_value.pass.sh +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/ubuntu_correct_value.pass.sh @@ -2,6 +2,22 @@ # platform = multi_platform_ubuntu # variables = var_password_pam_unix_remember=5 -config_file=/etc/pam.d/common-password +config_file=/usr/share/pam-configs/cac_unix remember_cnt=5 -sed -i "s/password.*pam_unix.so.*/password [success=1 default=ignore] pam_unix.so obscure sha512 shadow remember=${remember_cnt} rounds=5000/" "${config_file}" + +{{{ bash_pam_unix_enable() }}} +sed -i -E '/^Password:/,/^[^[:space:]]/ { + /pam_unix\.so/ { + s/\s*remember=[^[:space:]]*//g + s/$/ remember='"$remember_cnt"'/g + } +}' "$config_file" + +sed -i -E '/^Password-Initial:/,/^[^[:space:]]/ { + /pam_unix\.so/ { + s/\s*remember=[^[:space:]]*//g + s/$/ remember='"$remember_cnt"'/g + } +}' "$config_file" + +DEBIAN_FRONTEND=noninteractive pam-auth-update diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/ubuntu_wrong_value.fail.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/ubuntu_wrong_value.fail.sh index 2fe578bfcfe..4295c4dc27e 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/ubuntu_wrong_value.fail.sh +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/ubuntu_wrong_value.fail.sh @@ -2,7 +2,33 @@ # platform = multi_platform_ubuntu # variables = var_password_pam_unix_remember=5 -config_file=/etc/pam.d/common-password +config_file=/usr/share/pam-configs/unix remember_cnt=3 -sed -i "s/password.*pam_unix.so.*/password [success=1 default=ignore] pam_unix.so obscure sha512 shadow remember=${remember_cnt} rounds=5000/" "${config_file}" +cat << EOF > "$config_file" +Name: Unix authentication +Default: yes +Priority: 256 +Auth-Type: Primary +Auth: + [success=end default=ignore] pam_unix.so try_first_pass +Auth-Initial: + [success=end default=ignore] pam_unix.so +Account-Type: Primary +Account: + [success=end new_authtok_reqd=done default=ignore] pam_unix.so +Account-Initial: + [success=end new_authtok_reqd=done default=ignore] pam_unix.so +Session-Type: Additional +Session: + required pam_unix.so +Session-Initial: + required pam_unix.so +Password-Type: Primary +Password: + [success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt remember=$remember_cnt +Password-Initial: + [success=end default=ignore] pam_unix.so obscure yescrypt remember=$remember_cnt +EOF + +DEBIAN_FRONTEND=noninteractive pam-auth-update From 84a9c942109f23dd1f2011c6a349a8352a56ce35 Mon Sep 17 00:00:00 2001 From: Alan Moore Date: Tue, 3 Dec 2024 16:26:20 +0000 Subject: [PATCH 06/18] Use pam-auth-update to fix the set_password_hashing_algorithm_systemauth tests --- .../tests/commented_value.fail.sh | 28 +++++++++++++++-- .../tests/correct.pass.sh | 31 ++++++++++++++++--- .../tests/missing.fail.sh | 27 +++++++++++++++- 3 files changed, 78 insertions(+), 8 deletions(-) diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/commented_value.fail.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/commented_value.fail.sh index 40adbb8d548..60e5a07a877 100644 --- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/commented_value.fail.sh +++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/commented_value.fail.sh @@ -3,5 +3,29 @@ # variables = var_password_hashing_algorithm_pam=sha512 # remediation = none -sed -i --follow-symlinks '/^\s*password.*pam_unix\.so/ s/sha512//g' /etc/pam.d/common-password -sed -i --follow-symlinks '/^\s*password.*pam_unix\.so/ s/$/ # sha512/' /etc/pam.d/common-password +cat << EOF > /usr/share/pam-configs/unix +Name: Unix authentication +Default: yes +Priority: 256 +Auth-Type: Primary +Auth: + [success=end default=ignore] pam_unix.so try_first_pass +Auth-Initial: + [success=end default=ignore] pam_unix.so +Account-Type: Primary +Account: + [success=end new_authtok_reqd=done default=ignore] pam_unix.so +Account-Initial: + [success=end new_authtok_reqd=done default=ignore] pam_unix.so +Session-Type: Additional +Session: + required pam_unix.so +Session-Initial: + required pam_unix.so +Password-Type: Primary +Password: + [success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass # sha512 +Password-Initial: + [success=end default=ignore] pam_unix.so obscure # sha512 +EOF +DEBIAN_FRONTEND=noninteractive pam-auth-update diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/correct.pass.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/correct.pass.sh index 23e5eb547b8..67ca0ca7615 100644 --- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/correct.pass.sh +++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/correct.pass.sh @@ -3,11 +3,32 @@ # variables = var_password_hashing_algorithm_pam=sha512 {{% if 'ubuntu' in product %}} -pam_file="/etc/pam.d/common-password" - -if ! grep -q "^\s*password.*pam_unix\.so.*sha512" "$pam_file"; then - sed -i --follow-symlinks '/^\s*password.*pam_unix\.so/ s/$/ sha512/' "$pam_file" -fi +cat << EOF > /usr/share/pam-configs/unix +Name: Unix authentication +Default: yes +Priority: 256 +Auth-Type: Primary +Auth: + [success=end default=ignore] pam_unix.so try_first_pass +Auth-Initial: + [success=end default=ignore] pam_unix.so +Account-Type: Primary +Account: + [success=end new_authtok_reqd=done default=ignore] pam_unix.so +Account-Initial: + [success=end new_authtok_reqd=done default=ignore] pam_unix.so +Session-Type: Additional +Session: + required pam_unix.so +Session-Initial: + required pam_unix.so +Password-Type: Primary +Password: + [success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass sha512 +Password-Initial: + [success=end default=ignore] pam_unix.so obscure sha512 +EOF +DEBIAN_FRONTEND=noninteractive pam-auth-update {{% else %}} pam_file="/etc/pam.d/system-auth" diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/missing.fail.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/missing.fail.sh index 2bb932df8c0..3787dd5bbd9 100644 --- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/missing.fail.sh +++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/tests/missing.fail.sh @@ -3,7 +3,32 @@ # variables = var_password_hashing_algorithm_pam=sha512 {{% if 'ubuntu' in product %}} -sed -i --follow-symlinks '/^\s*password.*pam_unix\.so/ s/sha512//g' "/etc/pam.d/common-password" +cat << EOF > /usr/share/pam-configs/unix +Name: Unix authentication +Default: yes +Priority: 256 +Auth-Type: Primary +Auth: + [success=end default=ignore] pam_unix.so try_first_pass +Auth-Initial: + [success=end default=ignore] pam_unix.so +Account-Type: Primary +Account: + [success=end new_authtok_reqd=done default=ignore] pam_unix.so +Account-Initial: + [success=end new_authtok_reqd=done default=ignore] pam_unix.so +Session-Type: Additional +Session: + required pam_unix.so +Session-Initial: + required pam_unix.so +Password-Type: Primary +Password: + [success=end default=ignore] pam_unix.so obscure use_authtok try_first_pass +Password-Initial: + [success=end default=ignore] pam_unix.so obscure +EOF +DEBIAN_FRONTEND=noninteractive pam-auth-update {{% else %}} sed -i --follow-symlinks '/^password.*sufficient.*pam_unix\.so/ s/sha512//g' "/etc/pam.d/system-auth" {{% endif %}} From 0879b3eae735c3fbb0fbf0a6d046990437b2b670 Mon Sep 17 00:00:00 2001 From: Alan Moore Date: Tue, 3 Dec 2024 17:05:37 +0000 Subject: [PATCH 07/18] Make oval of set_password_hashing_algorithm_systemauth to also exclude the comment out hash --- .../set_password_hashing_algorithm_systemauth/oval/shared.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/oval/shared.xml index c599abe49f5..d55c83d218e 100644 --- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/oval/shared.xml +++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/oval/shared.xml @@ -18,7 +18,7 @@ {{% endif %}} {{% set pam_unix_algorithms = "(sha512|yescrypt|gost_yescrypt|blowfish|sha256|md5|bigcrypt)" %}} - {{% set hashing_pattern = line_pattern + "(?!.*" + pam_unix_algorithms + ".*" + pam_unix_algorithms + ").*" + pam_unix_algorithms + ".*$" %}} + {{% set hashing_pattern = line_pattern + "(?!.*" + pam_unix_algorithms + "[^#]*" + pam_unix_algorithms + ").*" + pam_unix_algorithms + ".*$" %}}