Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update accounts_password_pam_retry for RHEL 10 #12783

Merged
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Update accounts_password_pam_retry for RHEL 10
Mab879 committed Jan 7, 2025
commit 9d32548d86dee919d9a54b001c66dffd097a2aaa
Original file line number Diff line number Diff line change
@@ -5,7 +5,7 @@
# disruption = medium
{{% if 'ubuntu' in product %}}
{{% set configuration_files = ["common-password"] %}}
{{% elif product in ['ol8', 'ol9', 'rhel8', 'rhel9'] %}}
{{% elif product in ['ol8', 'ol9'] or 'rhel' in product %}}
{{% set configuration_files = ["password-auth","system-auth"] %}}
{{% else %}}
{{% set configuration_files = ["system-auth"] %}}
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# platform = multi_platform_all

{{% if product in ['ol8', 'ol9', 'rhel8', 'rhel9'] %}}
{{% if product in ['ol8', 'ol9'] or 'rhel' in product %}}
{{% set configuration_files = ["password-auth","system-auth"] %}}
{{% else %}}
{{% set configuration_files = ["system-auth"] %}}
@@ -9,7 +9,7 @@

{{{ bash_instantiate_variables("var_password_pam_retry") }}}

{{% if product in ['ol8', 'ol9', 'rhel8', 'rhel9'] -%}}
{{% if product in ['ol8', 'ol9'] or 'rhel' in product -%}}
{{{ bash_replace_or_append('/etc/security/pwquality.conf',
'^retry',
'$var_password_pam_retry',
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{{% if 'ubuntu' in product or 'debian' in product %}}
{{% set configuration_files = ["common-password"] %}}
{{% elif product in ['ol8','ol9','rhel8', 'rhel9'] %}}
{{% elif product in ['ol8','ol9'] or 'rhel' in product %}}
{{% set configuration_files = ["password-auth","system-auth"] %}}
{{% else %}}
{{% set configuration_files = ["system-auth"] %}}
@@ -17,7 +17,7 @@
</criteria>
<criteria operator="AND" comment="Conditions for retry in pwquality.conf file are satisfied">
{{% for file in configuration_files %}}
<criterion
<criterion
comment="retry value not set in PAM files"
test_ref="test_password_pam_pwquality_retry_{{{ (file | escape_id) }}}_not_set"/>
{{% endfor %}}
Original file line number Diff line number Diff line change
@@ -5,7 +5,7 @@ title: 'Ensure PAM Enforces Password Requirements - Authentication Retry Prompts

description: |-
To configure the number of retry prompts that are permitted per-session:
{{% if product in ['ol8', 'ol9', 'rhel8', 'rhel9'] %}}
{{% if product in ['ol8', 'ol9'] or 'rhel' in product %}}
Edit the <tt>/etc/security/pwquality.conf</tt> to include
{{% else %}}
Edit the <tt>pam_pwquality.so</tt> statement in
@@ -56,7 +56,7 @@ ocil_clause: 'the value of "retry" is set to "0" or greater than "{{{ xccdf_valu
ocil: |-
Verify {{{ full_name }}} is configured to limit the "pwquality" retry option to {{{ xccdf_value("var_password_pam_retry") }}}.

{{% if product in ['ol8', 'ol9', 'rhel8', 'rhel9'] %}}
{{% if product in ['ol8', 'ol9'] or 'rhel' in product %}}
Check for the use of the "pwquality" retry option in the pwquality.conf file with the following command:
<pre>$ grep retry /etc/security/pwquality.conf</pre>
{{% else %}}
@@ -75,7 +75,7 @@ platform: package[pam]
fixtext: |-
Configure {{{ full_name }}} to limit the "pwquality" retry option to {{{ xccdf_value("var_password_pam_retry") }}}.

{{% if product in ['ol8', 'ol9', 'rhel8', 'rhel9'] %}}
{{% if product in ['ol8', 'ol9'] or 'rhel' in product %}}
Add the following line to the "/etc/security/pwquality.conf" file (or modify the line to have the required value):

retry={{{ xccdf_value("var_password_pam_retry") }}}
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
{{% if 'ubuntu' in product %}}
configuration_files=("common-password")
{{% elif product in ['ol8', 'ol9', 'rhel8', 'rhel9'] %}}
{{% elif product in ['ol8', 'ol9'] or 'rhel' in product %}}
configuration_files=("password-auth" "system-auth")
{{% else %}}
configuration_files=("system-auth")
{{% endif %}}


{{% if product in ['ol8', 'ol9', 'rhel8', 'rhel9'] %}}
{{% if product in ['ol8', 'ol9'] or 'rhel' in product %}}
authselect create-profile testingProfile --base-on sssd

for file in ${configuration_files[@]}; do
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/bin/bash
# packages = authselect
# platform = Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9
# platform = Oracle Linux 8,Oracle Linux 9,multi_platform_rhel
# variables = var_password_pam_retry=3

source common.sh
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/bin/bash
# packages = authselect
# platform = Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9
# platform = Oracle Linux 8,Oracle Linux 9,multi_platform_rhel
# variables = var_password_pam_retry=3

source common.sh
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/bin/bash
# packages = authselect
# platform = Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9
# platform = Oracle Linux 8,Oracle Linux 9,multi_platform_rhel
# variables = var_password_pam_retry=3

source common.sh
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/bin/bash
# packages = authselect
# platform = Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9
# platform = Oracle Linux 8,Oracle Linux 9,multi_platform_rhel
# variables = var_password_pam_retry=3

source common.sh
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/bin/bash
# packages = authselect
# platform = Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9
# platform = Oracle Linux 8,Oracle Linux 9,multi_platform_rhel
# variables = var_password_pam_retry=3

source common.sh