Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement pwquality macro #12656

Merged
merged 6 commits into from
Dec 10, 2024
Merged

Implement pwquality macro #12656

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
deaf5b7
Create bash_pam_pwquality_enable macro
alanmcanonical Dec 1, 2024
1e1cb20
Create bash_pam_pwquality_parameter_value macro
alanmcanonical Dec 1, 2024
bb219fc
Use the new macro to update the accounts_password_pam_retry remediation
alanmcanonical Dec 1, 2024
d0c1d87
Update tests of accounts_password_pam_retry
alanmcanonical Dec 1, 2024
55fff1f
Only delete the default pwquality config file
alanmcanonical Dec 6, 2024
73b8561
Remove duplicated configuration
alanmcanonical Dec 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion ...am/password_quality/password_quality_pwquality/accounts_password_pam_retry/bash/ubuntu.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,5 @@

{{{ bash_instantiate_variables("var_password_pam_retry") }}}

{{{ bash_ensure_pam_module_options('/etc/pam.d/common-password', 'password', 'requisite', 'pam_pwquality.so', 'retry', "$var_password_pam_retry", "$var_password_pam_retry") }}}
{{{ bash_pam_pwquality_enable() }}}
{{{ bash_pam_pwquality_parameter_value('retry', "$var_password_pam_retry") }}}
3 changes: 3 additions & 0 deletions ...m/password_quality/password_quality_pwquality/accounts_password_pam_retry/tests/common.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,9 @@ for file in ${configuration_files[@]}; do
"/etc/authselect/custom/testingProfile/$file"
done
authselect select --force custom/testingProfile
{{% elif 'ubuntu' in product %}}
rm -f /usr/share/pam-configs/pwquality
DEBIAN_FRONTEND=noninteractive pam-auth-update
{{% else %}}
for file in ${configuration_files[@]}; do
sed -i --follow-symlinks "/pam_pwquality\.so/d" "/etc/pam.d/$file"
Expand Down
14 changes: 14 additions & 0 deletions ...uality/password_quality_pwquality/accounts_password_pam_retry/tests/correct_value.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,19 @@

source common.sh

{{% if 'ubuntu' in product %}}
cat << EOF > /usr/share/pam-configs/pwquality
Name: Pwquality password strength checking
Default: yes
Priority: 1024
Conflicts: cracklib
Password-Type: Primary
Password:
requisite pam_pwquality.so retry=3
EOF

DEBIAN_FRONTEND=noninteractive pam-auth-update
{{% else %}}
for file in ${configuration_files[@]}; do
{{{ bash_ensure_pam_module_option('/etc/pam.d/$file',
'password',
Expand All @@ -13,3 +26,4 @@ for file in ${configuration_files[@]}; do
'3',
'^\s*account') }}}
done
{{% endif %}}
15 changes: 15 additions & 0 deletions ..._quality/password_quality_pwquality/accounts_password_pam_retry/tests/wrong_value.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,19 @@

source common.sh

{{% if 'ubuntu' in product %}}
cat << EOF > /usr/share/pam-configs/pwquality
Name: Pwquality password strength checking
Default: yes
Priority: 1024
Conflicts: cracklib
Password-Type: Primary
Password:
requisite pam_pwquality.so retry=7
EOF

DEBIAN_FRONTEND=noninteractive pam-auth-update
{{% else %}}
for file in ${configuration_files[@]}; do
{{{ bash_ensure_pam_module_option('/etc/pam.d/$file',
'password',
Expand All @@ -13,3 +26,5 @@ for file in ${configuration_files[@]}; do
'7',
'^\s*account') }}}
done
{{% endif %}}

54 changes: 54 additions & 0 deletions shared/macros/10-bash.jinja
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -847,6 +847,28 @@ fi
{{%- endmacro -%}}


{{#
Enable pam_pwquality.so PAM module by using pam-auth-update.
This option is only recommended when pam-auth-update tool is available for the system.
#}}
{{%- macro bash_pam_pwquality_enable() -%}}
conf_name=cac_pwquality
if [ ! -f /usr/share/pam-configs/"$conf_name" ]; then
cat << EOF > /usr/share/pam-configs/"$conf_name"
Name: Pwquality password strength checking
Default: yes
Priority: 1025
Conflicts: cracklib, pwquality
Password-Type: Primary
Password:
requisite pam_pwquality.so
EOF
fi

DEBIAN_FRONTEND=noninteractive pam-auth-update
{{%- endmacro -%}}


{{#
Validate an authselect custom profile integrity and ensures the correct file path is defined
in the "PAM_FILE_PATH" variable. The macros which change PAM files are the same regardless of
Expand Down Expand Up @@ -1052,6 +1074,38 @@ fi
{{%- endmacro -%}}


{{#
Sets PAM pwquality module options and values. The module argument is not removed from pam files
since it is not inserted there in Ubuntu case.
It also assume pam_pwquality.so is added as required module for account.

:param option: pwquality option eg. retry, minlen, dcredit
:type option: str
:param value: value of option
:type value: str

#}}
{{%- macro bash_pam_pwquality_parameter_value(option, value='') -%}}
PWQUALITY_CONF="/etc/security/pwquality.conf"
{{%- if value == '' %}}
regex="^\s*{{{ option }}}"
line="{{{ option }}}"
{{%- else %}}
regex="^\s*{{{ option }}}\s*="
line="{{{ option }}} = {{{ value }}}"
{{%- endif %}}
if ! grep -q $regex $PWQUALITY_CONF; then
echo $line >> $PWQUALITY_CONF
{{%- if value == '' %}}
fi
{{%- else %}}
else
sed -i --follow-symlinks 's|^\s*\({{{ option }}}\s*=\s*\)\(\S\+\)|\1'"{{{ value }}}"'|g' $PWQUALITY_CONF
fi
{{%- endif %}}
{{%- endmacro -%}}


{{#
Print a message to stderr and exit the shell

Expand Down
Loading