Update bash remediation to fix bug

The account_disable_inactivity_password_auth & account_disable_inactivity_system_auth bash remediation has a bug when ensure the order of lines into file, if the value of pam_lastlog.so is after pam_unix.so the remediation insert a new line after each line. Signed-off-by: Armando Acosta <[email protected]>
ComplianceAsCode · Jul 5, 2024 · 82609bf · 82609bf
1 parent 4536240
commit 82609bf
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 6 deletions.
diff --git a/...s-restrictions/account_expiration/account_disable_inactivity_password_auth/bash/shared.sh b/...s-restrictions/account_expiration/account_disable_inactivity_password_auth/bash/shared.sh
@@ -16,13 +16,17 @@ fi
 {{{ bash_ensure_pam_module_line("$PAM_FILE_PATH",
                                 'auth',
                                 'sufficient', 
-                                'pam_unix.so') }}}
+                                'pam_unix.so',
+                                '^\s*auth.*required.*pam_lastlog\.so.*') }}}
 # Ensure pam_unix.so is configured after pam_lastlog.so
 if ! grep -Pz \
     "auth\s*required\s*pam_lastlog\.so[^#]*inactive=35[\s\S]*\n\s*auth\s*sufficient\s*pam_unix\.so"\
     "$PAM_FILE_PATH"  ; then
-    PAM_LASTLOG_LINE="$(grep -oP '^\s*auth.*pam_lastlog\.so.*' $PAM_FILE_PATH)"
-    sed -i "0,/^\s*auth.*pam_unix\.so.*/i$PAM_LASTLOG_LINE" "$PAM_FILE_PATH"
+    readarray -t pam_lastlog_lines <<< $(grep -oP '^\s*auth.*pam_lastlog\.so[^#]*inactive=35.*' $PAM_FILE_PATH)
+    sed -i "/^\s*auth.*pam_lastlog\.so[^#]*inactive=35.*/d" "$PAM_FILE_PATH"
+    for line in "${pam_lastlog_lines[@]}"; do
+        sed -i "/^\s*auth.*pam_unix\.so.*/i$line" "$PAM_FILE_PATH"
+    done
 fi
 if [ -f /usr/bin/authselect ]; then
     authselect apply-changes -b --backup=after-hardening-pam_lastlog.so-inactive.backup

diff --git a/...nts-restrictions/account_expiration/account_disable_inactivity_system_auth/bash/shared.sh b/...nts-restrictions/account_expiration/account_disable_inactivity_system_auth/bash/shared.sh
@@ -16,13 +16,17 @@ fi
 {{{ bash_ensure_pam_module_line("$PAM_FILE_PATH",
                                 'auth',
                                 'sufficient',
-                                'pam_unix.so') }}}
+                                'pam_unix.so',
+                                '^\s*auth.*required.*pam_lastlog\.so.*') }}}
 # Ensure pam_unix.so is configured after pam_lastlog.so
 if ! grep -Pz \
     "auth\s*required\s*pam_lastlog\.so[^#]*inactive=35[\s\S]*\n\s*auth\s*sufficient\s*pam_unix\.so"\
     "$PAM_FILE_PATH"  ; then
-    PAM_LASTLOG_LINE="$(grep -oP '^\s*auth.*pam_lastlog\.so.*' $PAM_FILE_PATH)"
-    sed -i "0,/^\s*auth.*pam_unix\.so.*/i$PAM_LASTLOG_LINE" "$PAM_FILE_PATH"
+    readarray -t pam_lastlog_lines <<< $(grep -oP '^\s*auth.*pam_lastlog\.so[^#]*inactive=35.*' $PAM_FILE_PATH)
+    sed -i "/^\s*auth.*pam_lastlog\.so[^#]*inactive=35.*/d" "$PAM_FILE_PATH"
+    for line in "${pam_lastlog_lines[@]}"; do
+        sed -i "/^\s*auth.*pam_unix\.so.*/i$line" "$PAM_FILE_PATH"
+    done
 fi
 if [ -f /usr/bin/authselect ]; then
     authselect apply-changes -b --backup=after-hardening-pam_lastlog.so-inactive.backup