| Message ID | 20220724175344.14522-1-venkata.pyla@toshiba-tsip.com (mailing list archive) |
|---|---|
| State | Handled Elsewhere |
| Headers | show |
| Series | [isar-cip-core,v2] security-customizations: Fix pam_tally2 deprecation | expand |
On 24.07.22 19:53, venkata.pyla@toshiba-tsip.com wrote: > From: venkata pyla <venkata.pyla@toshiba-tsip.com> > > pam_tally2 is deprecated from PAM version 1.4.0-7 that is from > Debian Bullseye, and introduced pam_faillock as replacement. > > Modified the security customizations to check first pam_tally2 existence > for backward compatibility and if not found use the pam_faillock > instead to achieve the same functionality. > > Fixes #33 > > Signed-off-by: venkata pyla <venkata.pyla@toshiba-tsip.com> > --- > .../security-customizations/files/postinst | 20 +++++++++++++++---- > 1 file changed, 16 insertions(+), 4 deletions(-) > > diff --git a/recipes-core/security-customizations/files/postinst b/recipes-core/security-customizations/files/postinst > index 9ba8540..0d0eb07 100644 > --- a/recipes-core/security-customizations/files/postinst > +++ b/recipes-core/security-customizations/files/postinst > @@ -22,11 +22,23 @@ sed -i "0,/^password.*/s/^password.*/${pam_cracklib_config}\n&/" "${PAM_PWD_FILE > # CR1.11: Unsuccessful login attempts > # Lock user account after unsuccessful login attempts > PAM_AUTH_FILE="/etc/pam.d/common-auth" > -pam_tally="auth required pam_tally2.so deny=3 even_deny_root unlock_time=60 root_unlock_time=60" > -if grep -c "pam_tally2.so" "${PAM_AUTH_FILE}";then > - sed -i '/pam_tally2/ s/^#*/#/' "${PAM_AUTH_FILE}" > +# pam_tally2 is deprecated from pam version 1.4.0-7 > +if [ -f /lib/*-linux-gnu*/security/pam_tally2.so ]; then > + PAM_MODULE="pam_tally2.so" > + PAM_CONFIG="auth required pam_tally2.so deny=3 even_deny_root unlock_time=60 root_unlock_time=60" > +elif [ -f /lib/*-linux-gnu*/security/pam_faillock.so ]; then > + PAM_MODULE="pam_faillock.so" > + PAM_CONFIG="auth required pam_faillock.so preauth silent deny=3 even_deny_root unlock_time=60 root_unlock_time=60 \ > + \nauth required pam_faillock.so .so authfail deny=3 even_deny_root unlock_time=60 root_unlock_time=60" > +else > + echo "No suitable pam module found to lock failed login attempts" > + exit 1 > fi > -sed -i "0,/^auth.*/s/^auth.*/${pam_tally}\n&/" "${PAM_AUTH_FILE}" > + > +if grep -c "${PAM_MODULE}" "${PAM_AUTH_FILE}";then > + sed -i '/${PAM_MODULE}/ s/^#*/#/' "${PAM_AUTH_FILE}" > +fi > +sed -i "0,/^auth.*/s/^auth.*/${PAM_CONFIG}\n&/" "${PAM_AUTH_FILE}" > > # CR2.6: Remote session termination > # Terminate remote session after inactive time period Thanks, applied. Jan
diff --git a/recipes-core/security-customizations/files/postinst b/recipes-core/security-customizations/files/postinst index 9ba8540..0d0eb07 100644 --- a/recipes-core/security-customizations/files/postinst +++ b/recipes-core/security-customizations/files/postinst @@ -22,11 +22,23 @@ sed -i "0,/^password.*/s/^password.*/${pam_cracklib_config}\n&/" "${PAM_PWD_FILE # CR1.11: Unsuccessful login attempts # Lock user account after unsuccessful login attempts PAM_AUTH_FILE="/etc/pam.d/common-auth" -pam_tally="auth required pam_tally2.so deny=3 even_deny_root unlock_time=60 root_unlock_time=60" -if grep -c "pam_tally2.so" "${PAM_AUTH_FILE}";then - sed -i '/pam_tally2/ s/^#*/#/' "${PAM_AUTH_FILE}" +# pam_tally2 is deprecated from pam version 1.4.0-7 +if [ -f /lib/*-linux-gnu*/security/pam_tally2.so ]; then + PAM_MODULE="pam_tally2.so" + PAM_CONFIG="auth required pam_tally2.so deny=3 even_deny_root unlock_time=60 root_unlock_time=60" +elif [ -f /lib/*-linux-gnu*/security/pam_faillock.so ]; then + PAM_MODULE="pam_faillock.so" + PAM_CONFIG="auth required pam_faillock.so preauth silent deny=3 even_deny_root unlock_time=60 root_unlock_time=60 \ + \nauth required pam_faillock.so .so authfail deny=3 even_deny_root unlock_time=60 root_unlock_time=60" +else + echo "No suitable pam module found to lock failed login attempts" + exit 1 fi -sed -i "0,/^auth.*/s/^auth.*/${pam_tally}\n&/" "${PAM_AUTH_FILE}" + +if grep -c "${PAM_MODULE}" "${PAM_AUTH_FILE}";then + sed -i '/${PAM_MODULE}/ s/^#*/#/' "${PAM_AUTH_FILE}" +fi +sed -i "0,/^auth.*/s/^auth.*/${PAM_CONFIG}\n&/" "${PAM_AUTH_FILE}" # CR2.6: Remote session termination # Terminate remote session after inactive time period