From f5250601f32ce6feb7e64e1b063914043c9a1220 Mon Sep 17 00:00:00 2001 From: Alexandre Skrzyniarz Date: Thu, 4 Apr 2024 18:01:17 +0200 Subject: [PATCH] add an account_password_pam_faillock template rewrite accounts_passwords_pam_faillock_interval and accounts_passwords_pam_faillock_unlock_time to use this new template. --- .../ansible/shared.yml | 7 - .../bash/shared.sh | 6 - .../oval/debian.xml | 1 - .../oval/shared.xml | 285 ---------------- .../oval/ubuntu.xml | 195 ----------- .../rule.yml | 10 + .../ansible/shared.yml | 7 - .../bash/shared.sh | 6 - .../oval/debian.xml | 1 - .../oval/openeuler.xml | 285 ---------------- .../oval/shared.xml | 285 ---------------- .../oval/ubuntu.xml | 195 ----------- .../rule.yml | 10 + .../ansible.template | 7 + .../bash.template | 6 + .../oval.template | 315 ++++++++++++++++++ .../template.yml | 4 + .../tests/authselect_modified_pam.fail.sh | 12 + .../conflicting_settings_authselect.fail.sh | 30 ++ .../pam_faillock_conflicting_settings.fail.sh | 16 + .../tests/pam_faillock_disabled.fail.sh | 15 + ...am_faillock_expected_faillock_conf.pass.sh | 10 + .../pam_faillock_expected_pam_files.pass.sh | 6 + ...pam_faillock_lenient_faillock_conf.fail.sh | 10 + .../pam_faillock_lenient_pam_files.fail.sh | 6 + ...ck_multiple_pam_unix_faillock_conf.fail.sh | 18 + ...illock_multiple_pam_unix_pam_files.fail.sh | 12 + ...am_faillock_not_required_pam_files.fail.sh | 24 ++ ...am_faillock_stricter_faillock_conf.pass.sh | 10 + .../pam_faillock_stricter_pam_files.pass.sh | 6 + .../tests/ubuntu_commented_values.fail.sh | 9 + .../tests/ubuntu_common.sh | 50 +++ .../tests/ubuntu_correct.pass.sh | 6 + .../tests/ubuntu_correct_pamd.pass.sh | 7 + .../tests/ubuntu_empty_faillock_conf.fail.sh | 8 + .../tests/ubuntu_missing_pamd.fail.sh | 9 + .../tests/ubuntu_multiple_pam_unix.fail.sh | 11 + .../tests/ubuntu_wrong_value.fail.sh | 6 + 38 files changed, 633 insertions(+), 1273 deletions(-) delete mode 100644 linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/ansible/shared.yml delete mode 100644 linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/bash/shared.sh delete mode 120000 linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/oval/debian.xml delete mode 100644 linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/oval/shared.xml delete mode 100644 linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/oval/ubuntu.xml delete mode 100644 linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/ansible/shared.yml delete mode 100644 linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/bash/shared.sh delete mode 120000 linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/oval/debian.xml delete mode 100644 linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/oval/openeuler.xml delete mode 100644 linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/oval/shared.xml delete mode 100644 linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/oval/ubuntu.xml create mode 100644 shared/templates/pam_account_password_faillock/ansible.template create mode 100644 shared/templates/pam_account_password_faillock/bash.template create mode 100644 shared/templates/pam_account_password_faillock/oval.template create mode 100644 shared/templates/pam_account_password_faillock/template.yml create mode 100644 shared/templates/pam_account_password_faillock/tests/authselect_modified_pam.fail.sh create mode 100644 shared/templates/pam_account_password_faillock/tests/conflicting_settings_authselect.fail.sh create mode 100644 shared/templates/pam_account_password_faillock/tests/pam_faillock_conflicting_settings.fail.sh create mode 100644 shared/templates/pam_account_password_faillock/tests/pam_faillock_disabled.fail.sh create mode 100644 shared/templates/pam_account_password_faillock/tests/pam_faillock_expected_faillock_conf.pass.sh create mode 100644 shared/templates/pam_account_password_faillock/tests/pam_faillock_expected_pam_files.pass.sh create mode 100644 shared/templates/pam_account_password_faillock/tests/pam_faillock_lenient_faillock_conf.fail.sh create mode 100644 shared/templates/pam_account_password_faillock/tests/pam_faillock_lenient_pam_files.fail.sh create mode 100644 shared/templates/pam_account_password_faillock/tests/pam_faillock_multiple_pam_unix_faillock_conf.fail.sh create mode 100644 shared/templates/pam_account_password_faillock/tests/pam_faillock_multiple_pam_unix_pam_files.fail.sh create mode 100644 shared/templates/pam_account_password_faillock/tests/pam_faillock_not_required_pam_files.fail.sh create mode 100644 shared/templates/pam_account_password_faillock/tests/pam_faillock_stricter_faillock_conf.pass.sh create mode 100644 shared/templates/pam_account_password_faillock/tests/pam_faillock_stricter_pam_files.pass.sh create mode 100644 shared/templates/pam_account_password_faillock/tests/ubuntu_commented_values.fail.sh create mode 100644 shared/templates/pam_account_password_faillock/tests/ubuntu_common.sh create mode 100644 shared/templates/pam_account_password_faillock/tests/ubuntu_correct.pass.sh create mode 100644 shared/templates/pam_account_password_faillock/tests/ubuntu_correct_pamd.pass.sh create mode 100644 shared/templates/pam_account_password_faillock/tests/ubuntu_empty_faillock_conf.fail.sh create mode 100644 shared/templates/pam_account_password_faillock/tests/ubuntu_missing_pamd.fail.sh create mode 100644 shared/templates/pam_account_password_faillock/tests/ubuntu_multiple_pam_unix.fail.sh create mode 100644 shared/templates/pam_account_password_faillock/tests/ubuntu_wrong_value.fail.sh diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/ansible/shared.yml deleted file mode 100644 index 039fc5191822..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/ansible/shared.yml +++ /dev/null @@ -1,7 +0,0 @@ -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv -# reboot = false -# strategy = restrict -# complexity = low -# disruption = low -{{{ ansible_pam_faillock_enable() }}} -{{{ ansible_pam_faillock_parameter_value("fail_interval", "var_accounts_passwords_pam_faillock_fail_interval") }}} diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/bash/shared.sh deleted file mode 100644 index 289690e3d525..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/bash/shared.sh +++ /dev/null @@ -1,6 +0,0 @@ -# platform = multi_platform_all - -{{{ bash_instantiate_variables("var_accounts_passwords_pam_faillock_fail_interval") }}} - -{{{ bash_pam_faillock_enable() }}} -{{{ bash_pam_faillock_parameter_value("fail_interval", "$var_accounts_passwords_pam_faillock_fail_interval") }}} diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/oval/debian.xml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/oval/debian.xml deleted file mode 120000 index 70f08ba8db12..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/oval/debian.xml +++ /dev/null @@ -1 +0,0 @@ -ubuntu.xml \ No newline at end of file diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/oval/shared.xml deleted file mode 100644 index 1e22214cf84d..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/oval/shared.xml +++ /dev/null @@ -1,285 +0,0 @@ - - - {{{ oval_metadata("The number of allowed failed logins should be set correctly.") }}} - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ^[\s]*auth\N+pam_unix\.so - - - - ^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail - - - - ^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so - - - - ^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*fail_interval=([0-9]+) - - - - ^[\s]*fail_interval[\s]*=[\s]*([0-9]+) - - - - - ^/etc/pam.d/system-auth$ - - - 1 - - - - - - - - - ^/etc/pam.d/password-auth$ - - 1 - - - - - - - - - ^/etc/pam.d/system-auth$ - - 1 - - - - - - - - ^/etc/pam.d/system-auth$ - - 1 - - - - - - - - - ^/etc/pam.d/password-auth$ - - 1 - - - - - - - - ^/etc/pam.d/password-auth$ - - 1 - - - - - - - - - - - - - - - - - ^/etc/pam.d/system-auth$ - - 1 - - - - - - - - - - - - - - ^/etc/pam.d/password-auth$ - - 1 - - - - - - - - - - - - - - ^/etc/security/faillock.conf$ - - 1 - - - - - - - - - - - diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/oval/ubuntu.xml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/oval/ubuntu.xml deleted file mode 100644 index 02a8568e010f..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/oval/ubuntu.xml +++ /dev/null @@ -1,195 +0,0 @@ -{{# Very similar OVAL is used in several rules, differing primarily in faillock.so parameter. #}} -{{# For transferability, we define the parameter and corresponding regular expressions in jinja. #}} -{{# The rules should ideally use a single template. #}} - -{{% set prm_name = "fail_interval" %}} -{{% set prm_regex_conf = "^[\s]*fail_interval[\s]*=[\s]*([0-9]+)" %}} -{{% set prm_regex_pamd = "^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*fail_interval=([0-9]+)" %}} -{{% set ext_variable = "var_accounts_passwords_pam_faillock_fail_interval" %}} -{{% set description = "The number of allowed failed logins should be set correctly." %}} - - - - {{{ oval_metadata(description) }}} - - - - - - - - - - - - - - - - - - - - - - - - - ^\s*auth.*pam_unix\.so - - - - ^\s*auth\s+required\s+pam_faillock\.so.*preauth.*[\s\S]*^\s*auth.*pam_unix\.so[\s\S]*^\s*auth\s+\[default=die\]\s+pam_faillock\.so\s+authfail[\s\S]*^\s*auth\s+sufficient\s+pam_faillock\.so\s+authsucc - - - - ^\s*account\s+required\s+pam_faillock\.so\s*(#.*)?$ - - - - {{{ prm_regex_pamd }}} - - - - {{{ prm_regex_conf }}} - - - - - - - - - /etc/pam.d/common-auth - - 1 - - - - - - - - - /etc/pam.d/common-auth - - 1 - - - - - - - - - /etc/pam.d/common-account - - 1 - - - - - - - - - - - - - - - - - - - - - - - - - /etc/pam.d/common-auth - - 1 - - - - - - - - - - - - - - - - /etc/security/faillock.conf - - 1 - - diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/rule.yml index e4bd615121e1..7d785f2d9a34 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/rule.yml @@ -120,3 +120,13 @@ warnings: be shown in the remediation report. If the system supports the /etc/security/faillock.conf file, the pam_faillock parameters should be defined in faillock.conf file. + +template: + name: pam_account_password_faillock + vars: + prm_name: fail_interval + prm_regex_conf: ^[\s]*fail_interval[\s]*=[\s]*([0-9]+) + prm_regex_pamd: ^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*fail_interval=([0-9]+) + ext_variable: var_accounts_passwords_pam_faillock_fail_interval + description: The number of allowed failed logins should be set correctly. + variable_lower_bound: use_ext_variable diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/ansible/shared.yml deleted file mode 100644 index 230ff5eaa3dd..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/ansible/shared.yml +++ /dev/null @@ -1,7 +0,0 @@ -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv -# reboot = false -# strategy = restrict -# complexity = low -# disruption = low -{{{ ansible_pam_faillock_enable() }}} -{{{ ansible_pam_faillock_parameter_value("unlock_time", "var_accounts_passwords_pam_faillock_unlock_time") }}} diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/bash/shared.sh deleted file mode 100644 index 51ef7f323473..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/bash/shared.sh +++ /dev/null @@ -1,6 +0,0 @@ -# platform = multi_platform_all - -{{{ bash_instantiate_variables("var_accounts_passwords_pam_faillock_unlock_time") }}} - -{{{ bash_pam_faillock_enable() }}} -{{{ bash_pam_faillock_parameter_value("unlock_time", "$var_accounts_passwords_pam_faillock_unlock_time") }}} diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/oval/debian.xml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/oval/debian.xml deleted file mode 120000 index 70f08ba8db12..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/oval/debian.xml +++ /dev/null @@ -1 +0,0 @@ -ubuntu.xml \ No newline at end of file diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/oval/openeuler.xml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/oval/openeuler.xml deleted file mode 100644 index 94c1ecaa55cb..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/oval/openeuler.xml +++ /dev/null @@ -1,285 +0,0 @@ - - - {{{ oval_metadata("The unlock time after number of failed logins should be set correctly.") }}} - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ^[\s]*auth\N+pam_unix\.so - - - - ^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)?(?=.*?\bnew_authtok_reqd=ok\b)?(?=.*?\bignore=ignore\b)?(?=.*?\bdefault=bad\b)?.*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)?(?=.*?\bnew_authtok_reqd=done\b)?(?=.*?\bdefault=ignore\b)?.*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)?(?=.*?\bnew_authtok_reqd=ok\b)?(?=.*?\bignore=ignore\b)?(?=.*?\bdefault=die\b)?.*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail - - - - ^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)?(?=.*?\bnew_authtok_reqd=ok\b)?(?=.*?\bignore=ignore\b)?(?=.*?\bdefault=bad\b)?.*\])[\s]+pam_unix\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)?(?=.*?\bnew_authtok_reqd=ok\b)?(?=.*?\bignore=ignore\b)?(?=.*?\bdefault=bad\b)?.*\])[\s]+pam_faillock\.so - - - - ^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*unlock_time=([0-9]+) - - - - ^[\s]*unlock_time[\s]*=[\s]*([0-9]+) - - - - - ^/etc/pam.d/system-auth$ - - - 1 - - - - - - - - - ^/etc/pam.d/password-auth$ - - 1 - - - - - - - - - ^/etc/pam.d/system-auth$ - - 1 - - - - - - - - ^/etc/pam.d/system-auth$ - - 1 - - - - - - - - - ^/etc/pam.d/password-auth$ - - 1 - - - - - - - - ^/etc/pam.d/password-auth$ - - 1 - - - - - - - - - - - - - - - - - ^/etc/pam.d/system-auth$ - - 1 - - - - - - - - - - - - - - ^/etc/pam.d/password-auth$ - - 1 - - - - - - - - - - - - - - ^/etc/security/faillock.conf$ - - 1 - - - - - - - - - - - diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/oval/shared.xml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/oval/shared.xml deleted file mode 100644 index 5dd850d8caf6..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/oval/shared.xml +++ /dev/null @@ -1,285 +0,0 @@ - - - {{{ oval_metadata("The unlock time after number of failed logins should be set correctly.") }}} - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ^[\s]*auth\N+pam_unix\.so - - - - ^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail - - - - ^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so - - - - ^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*unlock_time=([0-9]+) - - - - ^[\s]*unlock_time[\s]*=[\s]*([0-9]+) - - - - - ^/etc/pam.d/system-auth$ - - - 1 - - - - - - - - - ^/etc/pam.d/password-auth$ - - 1 - - - - - - - - - ^/etc/pam.d/system-auth$ - - 1 - - - - - - - - ^/etc/pam.d/system-auth$ - - 1 - - - - - - - - - ^/etc/pam.d/password-auth$ - - 1 - - - - - - - - ^/etc/pam.d/password-auth$ - - 1 - - - - - - - - - - - - - - - - - ^/etc/pam.d/system-auth$ - - 1 - - - - - - - - - - - - - - ^/etc/pam.d/password-auth$ - - 1 - - - - - - - - - - - - - - ^/etc/security/faillock.conf$ - - 1 - - - - - - - - - - - diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/oval/ubuntu.xml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/oval/ubuntu.xml deleted file mode 100644 index 6f90a6e6a5f2..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/oval/ubuntu.xml +++ /dev/null @@ -1,195 +0,0 @@ -{{# Very similar OVAL is used in several rules, differing primarily in faillock.so parameter. #}} -{{# For transferability, we define the parameter and corresponding regular expressions in jinja. #}} -{{# The rules should ideally use a single template. #}} - -{{% set prm_name = "unlock_time" %}} -{{% set prm_regex_conf = "^[\s]*unlock_time[\s]*=[\s]*([0-9]+)" %}} -{{% set prm_regex_pamd = "^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*unlock_time=([0-9]+)" %}} -{{% set ext_variable = "var_accounts_passwords_pam_faillock_unlock_time" %}} -{{% set description = "The unlock time after number of failed logins should be set correctly." %}} - - - - {{{ oval_metadata(description) }}} - - - - - - - - - - - - - - - - - - - - - - - - - ^\s*auth.*pam_unix\.so - - - - ^\s*auth\s+required\s+pam_faillock\.so.*preauth.*[\s\S]*^\s*auth.*pam_unix\.so[\s\S]*^\s*auth\s+\[default=die\]\s+pam_faillock\.so\s+authfail[\s\S]*^\s*auth\s+sufficient\s+pam_faillock\.so\s+authsucc - - - - ^\s*account\s+required\s+pam_faillock\.so\s*(#.*)?$ - - - - {{{ prm_regex_pamd }}} - - - - {{{ prm_regex_conf }}} - - - - - - - - - /etc/pam.d/common-auth - - 1 - - - - - - - - - /etc/pam.d/common-auth - - 1 - - - - - - - - - /etc/pam.d/common-account - - 1 - - - - - - - - - - - - - - - - - - - - - - - - - /etc/pam.d/common-auth - - 1 - - - - - - - - - - - - - - - - /etc/security/faillock.conf - - 1 - - diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml index ea9414e6b078..e20bb698663b 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml @@ -127,3 +127,13 @@ warnings: be shown in the remediation report. If the system supports the /etc/security/faillock.conf file, the pam_faillock parameters should be defined in faillock.conf file. + +template: + name: pam_account_password_faillock + vars: + prm_name: unlock_time + prm_regex_conf: ^[\s]*unlock_time[\s]*=[\s]*([0-9]+) + prm_regex_pamd: ^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*unlock_time=([0-9]+) + ext_variable: var_accounts_passwords_pam_faillock_unlock_time + description: The unlock time after number of failed logins should be set correctly. + variable_lower_bound: use_ext_variable diff --git a/shared/templates/pam_account_password_faillock/ansible.template b/shared/templates/pam_account_password_faillock/ansible.template new file mode 100644 index 000000000000..5e1161920e57 --- /dev/null +++ b/shared/templates/pam_account_password_faillock/ansible.template @@ -0,0 +1,7 @@ +# platform = multi_platform_all +# reboot = false +# strategy = restrict +# complexity = low +# disruption = low +{{{ ansible_pam_faillock_enable() }}} +{{{ ansible_pam_faillock_parameter_value(PRM_NAME, EXT_VARIABLE) }}} diff --git a/shared/templates/pam_account_password_faillock/bash.template b/shared/templates/pam_account_password_faillock/bash.template new file mode 100644 index 000000000000..e46c3b851976 --- /dev/null +++ b/shared/templates/pam_account_password_faillock/bash.template @@ -0,0 +1,6 @@ +# platform = multi_platform_all + +{{{ bash_instantiate_variables(EXT_VARIABLE) }}} + +{{{ bash_pam_faillock_enable() }}} +{{{ bash_pam_faillock_parameter_value(PRM_NAME, '$'+EXT_VARIABLE) }}} diff --git a/shared/templates/pam_account_password_faillock/oval.template b/shared/templates/pam_account_password_faillock/oval.template new file mode 100644 index 000000000000..928876ee53ad --- /dev/null +++ b/shared/templates/pam_account_password_faillock/oval.template @@ -0,0 +1,315 @@ + + + {{{ oval_metadata(DESCRIPTION) }}} + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ^\s*auth\N+pam_unix\.so + + + + {{% if 'debian' in product or 'ubuntu' in product %}} + ^\s*auth\s+required\s+pam_faillock\.so.*preauth.*[\s\S]*^\s*auth.*pam_unix\.so[\s\S]*^\s*auth\s+\[default=die\]\s+pam_faillock\.so\s+authfail[\s\S]*^\s*auth\s+sufficient\s+pam_faillock\.so\s+authsucc + {{% elif 'openeuler' in product %}} + ^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)?(?=.*?\bnew_authtok_reqd=ok\b)?(?=.*?\bignore=ignore\b)?(?=.*?\bdefault=bad\b)?.*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)?(?=.*?\bnew_authtok_reqd=done\b)?(?=.*?\bdefault=ignore\b)?.*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)?(?=.*?\bnew_authtok_reqd=ok\b)?(?=.*?\bignore=ignore\b)?(?=.*?\bdefault=die\b)?.*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail + {{% else %}} + ^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail + {{% endif %}} + + + + {{% if 'debian' in product or 'ubuntu' in product %}} + ^\s*account\s+required\s+pam_faillock\.so\s*(#.*)?$ + {{% elif 'openeuler' in product %}} + ^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)?(?=.*?\bnew_authtok_reqd=ok\b)?(?=.*?\bignore=ignore\b)?(?=.*?\bdefault=bad\b)?.*\])[\s]+pam_unix\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)?(?=.*?\bnew_authtok_reqd=ok\b)?(?=.*?\bignore=ignore\b)?(?=.*?\bdefault=bad\b)?.*\])[\s]+pam_faillock\.so + {{% else %}} + ^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so + {{% endif %}} + + + + {{{ PRM_REGEX_PAMD }}} + + + + {{{ PRM_REGEX_CONF }}} + + + {{% macro generate_test_faillock_enabled(file_stem) %}} + + + + + + + /etc/pam.d/{{{file_stem}}}-auth + + 1 + + + + + + + + + /etc/pam.d/{{{ file_stem }}}-auth + + 1 + + {{% endmacro %}} + + {{{ generate_test_faillock_enabled (file_stem="system") }}} + {{{ generate_test_faillock_enabled (file_stem="password") }}} + {{{ generate_test_faillock_enabled (file_stem="common") }}} + + {{% macro generate_test_faillock_account(file_stem, file) %}} + + + + + + + /etc/pam.d/{{{ file }}} + + 1 + + {{% endmacro %}} + + {{{ generate_test_faillock_account (file_stem="system", file="system-auth") }}} + {{{ generate_test_faillock_account (file_stem="password", file="password-auth") }}} + {{{ generate_test_faillock_account (file_stem="common", file="common-account") }}} + + {{% macro generate_check_parameter_in_pam_file(file_stem) %}} + + + + + + + + + {{% if VARIABLE_UPPER_BOUND is defined and VARIABLE_UPPER_BOUND != "none" %}} + + {{% endif %}} + {{% if VARIABLE_LOWER_BOUND is defined and VARIABLE_LOWER_BOUND != "none" %}} + + {{% endif %}} + + + + /etc/pam.d/{{{ file_stem }}}-auth + + 1 + + {{% endmacro %}} + + + + + + {{% if VARIABLE_UPPER_BOUND is defined and VARIABLE_UPPER_BOUND != "none" %}} + + {{% if VARIABLE_UPPER_BOUND == "use_ext_variable" %}} + + {{% elif VARIABLE_UPPER_BOUND is number %}} + {{{ VARIABLE_UPPER_BOUND }}} + {{% else %}} + + {{% endif %}} + + {{% endif %}} + + {{% if VARIABLE_LOWER_BOUND is defined and VARIABLE_LOWER_BOUND != "none" %}} + + {{% if VARIABLE_LOWER_BOUND == "use_ext_variable" %}} + + {{% elif VARIABLE_LOWER_BOUND is number %}} + {{{ VARIABLE_LOWER_BOUND }}} + {{% else %}} + + {{% endif %}} + + {{% endif %}} + + {{{ generate_check_parameter_in_pam_file (file_stem="system") }}} + {{{ generate_check_parameter_in_pam_file (file_stem="password") }}} + {{{ generate_check_parameter_in_pam_file (file_stem="common") }}} + + + + + {{% if VARIABLE_UPPER_BOUND is defined and VARIABLE_UPPER_BOUND != "none" %}} + + {{% endif %}} + {{% if VARIABLE_LOWER_BOUND is defined and VARIABLE_LOWER_BOUND != "none" %}} + + {{% endif %}} + + + + + + + + + /etc/security/faillock.conf + + 1 + + + diff --git a/shared/templates/pam_account_password_faillock/template.yml b/shared/templates/pam_account_password_faillock/template.yml new file mode 100644 index 000000000000..b57de6fbb63e --- /dev/null +++ b/shared/templates/pam_account_password_faillock/template.yml @@ -0,0 +1,4 @@ +supported_languages: + - ansible + - bash + - oval diff --git a/shared/templates/pam_account_password_faillock/tests/authselect_modified_pam.fail.sh b/shared/templates/pam_account_password_faillock/tests/authselect_modified_pam.fail.sh new file mode 100644 index 000000000000..b3232cc93ec2 --- /dev/null +++ b/shared/templates/pam_account_password_faillock/tests/authselect_modified_pam.fail.sh @@ -0,0 +1,12 @@ +#!/bin/bash +# platform = Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_fedora +# remediation = none + +SYSTEM_AUTH_FILE="/etc/pam.d/system-auth" + +# This modification will break the integrity checks done by authselect. +if ! $(grep -q "^[^#].*pam_pwhistory\.so.*remember=" $SYSTEM_AUTH_FILE); then + sed -i "/^password.*requisite.*pam_pwquality\.so/a password requisite pam_pwhistory.so" $SYSTEM_AUTH_FILE +else + sed -i "s/\(.*pam_pwhistory\.so.*remember=\)[[:digit:]]\+\s\(.*\)/\1/g" $SYSTEM_AUTH_FILE +fi diff --git a/shared/templates/pam_account_password_faillock/tests/conflicting_settings_authselect.fail.sh b/shared/templates/pam_account_password_faillock/tests/conflicting_settings_authselect.fail.sh new file mode 100644 index 000000000000..24f5731f63dd --- /dev/null +++ b/shared/templates/pam_account_password_faillock/tests/conflicting_settings_authselect.fail.sh @@ -0,0 +1,30 @@ +#!/bin/bash +# packages = authselect,pam +# platform = Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 + +pam_files=("password-auth" "system-auth") + +authselect create-profile testingProfile --base-on minimal + +CUSTOM_PROFILE_DIR="/etc/authselect/custom/testingProfile" + +authselect select --force custom/testingProfile + +truncate -s 0 /etc/security/faillock.conf + +echo "deny = 3" > /etc/security/faillock.conf + +{{{ bash_pam_faillock_enable() }}} + +for file in ${pam_files[@]}; do + if grep -qP "auth.*faillock\.so.*preauth" $CUSTOM_PROFILE_DIR/$file; then + sed -i "/^\s*auth.*faillock\.so.*preauth/ s/$/deny=3/" \ + "$CUSTOM_PROFILE_DIR/$file" + else + sed -i "0,/^\s*auth.*/i auth required pam_faillock.so preauth deny=3" \ + "$CUSTOM_PROFILE_DIR/$file" + fi +done + + +authselect apply-changes diff --git a/shared/templates/pam_account_password_faillock/tests/pam_faillock_conflicting_settings.fail.sh b/shared/templates/pam_account_password_faillock/tests/pam_faillock_conflicting_settings.fail.sh new file mode 100644 index 000000000000..aa3ca061de72 --- /dev/null +++ b/shared/templates/pam_account_password_faillock/tests/pam_faillock_conflicting_settings.fail.sh @@ -0,0 +1,16 @@ +#!/bin/bash +# packages = authselect +# platform = multi_platform_fedora,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,Oracle Linux 8 +# remediation = none +# variables = var_accounts_passwords_pam_faillock_deny=3 + +authselect select sssd --force +authselect enable-feature with-faillock +# This test scenario simulates conflicting settings in pam and faillock.conf files. +# It means that authselect is not properly configured and may have a unexpected behaviour. The +# authselect integrity check will fail and the remediation will be aborted in order to preserve +# intentional changes. In this case, an informative message will be shown in the remediation report. +sed -i --follow-symlinks 's/\(pam_faillock.so \(preauth silent\|authfail\)\).*$/\1 deny=3/g' /etc/pam.d/system-auth /etc/pam.d/password-auth +> /etc/security/faillock.conf +echo "deny = 3" >> /etc/security/faillock.conf +echo "silent" >> /etc/security/faillock.conf diff --git a/shared/templates/pam_account_password_faillock/tests/pam_faillock_disabled.fail.sh b/shared/templates/pam_account_password_faillock/tests/pam_faillock_disabled.fail.sh new file mode 100644 index 000000000000..579e5670ea1a --- /dev/null +++ b/shared/templates/pam_account_password_faillock/tests/pam_faillock_disabled.fail.sh @@ -0,0 +1,15 @@ +#!/bin/bash +# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_ol,multi_platform_rhv,multi_platform_sle +{{%- if product in ["rhel7"] %}} +# packages = authconfig +{{%- else %}} +# packages = authselect +{{%- endif %}} +# variables = var_accounts_passwords_pam_faillock_deny=3 + +if [ -f /usr/sbin/authconfig ]; then + authconfig --disablefaillock --update +else + authselect select sssd --force + authselect disable-feature with-faillock +fi diff --git a/shared/templates/pam_account_password_faillock/tests/pam_faillock_expected_faillock_conf.pass.sh b/shared/templates/pam_account_password_faillock/tests/pam_faillock_expected_faillock_conf.pass.sh new file mode 100644 index 000000000000..e770e300f526 --- /dev/null +++ b/shared/templates/pam_account_password_faillock/tests/pam_faillock_expected_faillock_conf.pass.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# packages = authselect +# platform = multi_platform_fedora,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,Oracle Linux 8 +# variables = var_accounts_passwords_pam_faillock_deny=3 + +authselect select sssd --force +authselect enable-feature with-faillock +> /etc/security/faillock.conf +echo "deny = 3" >> /etc/security/faillock.conf +echo "silent" >> /etc/security/faillock.conf diff --git a/shared/templates/pam_account_password_faillock/tests/pam_faillock_expected_pam_files.pass.sh b/shared/templates/pam_account_password_faillock/tests/pam_faillock_expected_pam_files.pass.sh new file mode 100644 index 000000000000..249366097061 --- /dev/null +++ b/shared/templates/pam_account_password_faillock/tests/pam_faillock_expected_pam_files.pass.sh @@ -0,0 +1,6 @@ +#!/bin/bash +# packages = authconfig +# platform = Oracle Linux 7,Red Hat Enterprise Linux 7,multi_platform_fedora +# variables = var_accounts_passwords_pam_faillock_deny=3 + +authconfig --enablefaillock --faillockargs="deny=3" --update diff --git a/shared/templates/pam_account_password_faillock/tests/pam_faillock_lenient_faillock_conf.fail.sh b/shared/templates/pam_account_password_faillock/tests/pam_faillock_lenient_faillock_conf.fail.sh new file mode 100644 index 000000000000..fd57152b8c4b --- /dev/null +++ b/shared/templates/pam_account_password_faillock/tests/pam_faillock_lenient_faillock_conf.fail.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# packages = authselect +# platform = multi_platform_fedora,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,Oracle Linux 8 +# variables = var_accounts_passwords_pam_faillock_deny=3 + +authselect select sssd --force +authselect enable-feature with-faillock +> /etc/security/faillock.conf +echo "deny = 5" >> /etc/security/faillock.conf +echo "silent" >> /etc/security/faillock.conf diff --git a/shared/templates/pam_account_password_faillock/tests/pam_faillock_lenient_pam_files.fail.sh b/shared/templates/pam_account_password_faillock/tests/pam_faillock_lenient_pam_files.fail.sh new file mode 100644 index 000000000000..34405f594223 --- /dev/null +++ b/shared/templates/pam_account_password_faillock/tests/pam_faillock_lenient_pam_files.fail.sh @@ -0,0 +1,6 @@ +#!/bin/bash +# packages = authconfig +# platform = Oracle Linux 7,Red Hat Enterprise Linux 7,multi_platform_fedora +# variables = var_accounts_passwords_pam_faillock_deny=3 + +authconfig --enablefaillock --faillockargs="deny=5" --update diff --git a/shared/templates/pam_account_password_faillock/tests/pam_faillock_multiple_pam_unix_faillock_conf.fail.sh b/shared/templates/pam_account_password_faillock/tests/pam_faillock_multiple_pam_unix_faillock_conf.fail.sh new file mode 100644 index 000000000000..efb57601cb9c --- /dev/null +++ b/shared/templates/pam_account_password_faillock/tests/pam_faillock_multiple_pam_unix_faillock_conf.fail.sh @@ -0,0 +1,18 @@ +#!/bin/bash +# packages = authselect +# platform = multi_platform_fedora,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,Oracle Linux 8 +# remediation = none +# variables = var_accounts_passwords_pam_faillock_deny=3 + +authselect select sssd --force +authselect enable-feature with-faillock +# Ensure the parameters only in /etc/security/faillock.conf +sed -i --follow-symlinks 's/\(pam_faillock.so \(preauth silent\|authfail\)\).*$/\1/g' /etc/pam.d/system-auth /etc/pam.d/password-auth +> /etc/security/faillock.conf +echo "deny = 3" >> /etc/security/faillock.conf +echo "silent" >> /etc/security/faillock.conf + +# Multiple instances of pam_unix.so in auth section may, intentionally or not, interfere +# in the expected behaviour of pam_faillock.so. Remediation does not solve this automatically +# in order to preserve intentional changes. +echo "auth sufficient pam_unix.so" >> /etc/pam.d/password-auth diff --git a/shared/templates/pam_account_password_faillock/tests/pam_faillock_multiple_pam_unix_pam_files.fail.sh b/shared/templates/pam_account_password_faillock/tests/pam_faillock_multiple_pam_unix_pam_files.fail.sh new file mode 100644 index 000000000000..dbc12db6b9f7 --- /dev/null +++ b/shared/templates/pam_account_password_faillock/tests/pam_faillock_multiple_pam_unix_pam_files.fail.sh @@ -0,0 +1,12 @@ +#!/bin/bash +# packages = authconfig +# platform = Oracle Linux 7,Red Hat Enterprise Linux 7,multi_platform_fedora +# remediation = none +# variables = var_accounts_passwords_pam_faillock_deny=3 + +authconfig --enablefaillock --faillockargs="deny=3" --update + +# Multiple instances of pam_unix.so in auth section may, intentionally or not, interfere +# in the expected behaviour of pam_faillock.so. Remediation does not solve this automatically +# in order to preserve intentional changes. +echo "auth sufficient pam_unix.so" >> /etc/pam.d/password-auth diff --git a/shared/templates/pam_account_password_faillock/tests/pam_faillock_not_required_pam_files.fail.sh b/shared/templates/pam_account_password_faillock/tests/pam_faillock_not_required_pam_files.fail.sh new file mode 100644 index 000000000000..b780f3203624 --- /dev/null +++ b/shared/templates/pam_account_password_faillock/tests/pam_faillock_not_required_pam_files.fail.sh @@ -0,0 +1,24 @@ +#!/bin/bash +# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_ol,multi_platform_rhv,multi_platform_sle +{{%- if product in ["rhel7"] %}} +# packages = authconfig +{{%- else %}} +# packages = authselect +# remediation = none +{{%- endif %}} +# variables = var_accounts_passwords_pam_faillock_deny=3 + +# This test scenario manually modify the pam_faillock.so entries in auth section from +# "required" to "sufficient". This makes pam_faillock.so behave differently than initially +# intentioned. We catch this, but we can't safely remediate in an automated way. +if [ -f /usr/sbin/authconfig ]; then + authconfig --enablefaillock --faillockargs="deny=3" --update +else + authselect select sssd --force + authselect enable-feature with-faillock + sed -i --follow-symlinks 's/\(pam_faillock.so \(preauth silent\|authfail\)\).*$/\1 deny=3/g' /etc/pam.d/system-auth /etc/pam.d/password-auth +fi +sed -i --follow-symlinks 's/\(^\s*auth\s*\)\(\s.*\)\(pam_faillock\.so.*$\)/\1 sufficient \3/g' /etc/pam.d/system-auth /etc/pam.d/password-auth +if [ -f /etc/security/faillock.conf ]; then + > /etc/security/faillock.conf +fi diff --git a/shared/templates/pam_account_password_faillock/tests/pam_faillock_stricter_faillock_conf.pass.sh b/shared/templates/pam_account_password_faillock/tests/pam_faillock_stricter_faillock_conf.pass.sh new file mode 100644 index 000000000000..595b85192da1 --- /dev/null +++ b/shared/templates/pam_account_password_faillock/tests/pam_faillock_stricter_faillock_conf.pass.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# packages = authselect +# platform = multi_platform_fedora,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,Oracle Linux 8 +# variables = var_accounts_passwords_pam_faillock_deny=3 + +authselect select sssd --force +authselect enable-feature with-faillock +> /etc/security/faillock.conf +echo "deny = 2" >> /etc/security/faillock.conf +echo "silent" >> /etc/security/faillock.conf diff --git a/shared/templates/pam_account_password_faillock/tests/pam_faillock_stricter_pam_files.pass.sh b/shared/templates/pam_account_password_faillock/tests/pam_faillock_stricter_pam_files.pass.sh new file mode 100644 index 000000000000..03f93edaa4f5 --- /dev/null +++ b/shared/templates/pam_account_password_faillock/tests/pam_faillock_stricter_pam_files.pass.sh @@ -0,0 +1,6 @@ +#!/bin/bash +# packages = authconfig +# platform = Oracle Linux 7,Red Hat Enterprise Linux 7,multi_platform_fedora +# variables = var_accounts_passwords_pam_faillock_deny=3 + +authconfig --enablefaillock --faillockargs="deny=2" --update diff --git a/shared/templates/pam_account_password_faillock/tests/ubuntu_commented_values.fail.sh b/shared/templates/pam_account_password_faillock/tests/ubuntu_commented_values.fail.sh new file mode 100644 index 000000000000..06e07a9d9685 --- /dev/null +++ b/shared/templates/pam_account_password_faillock/tests/ubuntu_commented_values.fail.sh @@ -0,0 +1,9 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +source ubuntu_common.sh + +sed -i 's/\(^.*pam_faillock\.so.*\)/# \1/' /etc/pam.d/common-auth +sed -i 's/\(^.*pam_faillock\.so.*\)/# \1/' /etc/pam.d/common-account + +echo "#deny=1" > /etc/security/faillock.conf diff --git a/shared/templates/pam_account_password_faillock/tests/ubuntu_common.sh b/shared/templates/pam_account_password_faillock/tests/ubuntu_common.sh new file mode 100644 index 000000000000..e64fb3528e8f --- /dev/null +++ b/shared/templates/pam_account_password_faillock/tests/ubuntu_common.sh @@ -0,0 +1,50 @@ +#!/bin/bash + +# Create passing pam.d files based on defaults from a clean installation of Ubuntu 22.04 LTS +# Extra comments and whitespaces were added to test for edge cases + +cat >/etc/pam.d/common-auth </etc/pam.d/common-account < /etc/security/faillock.conf diff --git a/shared/templates/pam_account_password_faillock/tests/ubuntu_correct_pamd.pass.sh b/shared/templates/pam_account_password_faillock/tests/ubuntu_correct_pamd.pass.sh new file mode 100644 index 000000000000..e6d203a01c5e --- /dev/null +++ b/shared/templates/pam_account_password_faillock/tests/ubuntu_correct_pamd.pass.sh @@ -0,0 +1,7 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +source ubuntu_common.sh + +sed -i 's/\(.*pam_faillock.so.*\)/\1 deny=1/g' /etc/pam.d/common-auth + diff --git a/shared/templates/pam_account_password_faillock/tests/ubuntu_empty_faillock_conf.fail.sh b/shared/templates/pam_account_password_faillock/tests/ubuntu_empty_faillock_conf.fail.sh new file mode 100644 index 000000000000..3b73ba396a64 --- /dev/null +++ b/shared/templates/pam_account_password_faillock/tests/ubuntu_empty_faillock_conf.fail.sh @@ -0,0 +1,8 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +# This test should fail because neither pam.d or faillock.conf have deny defined + +source ubuntu_common.sh + +echo > /etc/security/faillock.conf diff --git a/shared/templates/pam_account_password_faillock/tests/ubuntu_missing_pamd.fail.sh b/shared/templates/pam_account_password_faillock/tests/ubuntu_missing_pamd.fail.sh new file mode 100644 index 000000000000..40c103dc6f9c --- /dev/null +++ b/shared/templates/pam_account_password_faillock/tests/ubuntu_missing_pamd.fail.sh @@ -0,0 +1,9 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +source ubuntu_common.sh + +sed -i '/pam_faillock\.so/d' /etc/pam.d/common-auth +sed -i '/pam_faillock\.so/d' /etc/pam.d/common-account + +echo "deny=1" > /etc/security/faillock.conf diff --git a/shared/templates/pam_account_password_faillock/tests/ubuntu_multiple_pam_unix.fail.sh b/shared/templates/pam_account_password_faillock/tests/ubuntu_multiple_pam_unix.fail.sh new file mode 100644 index 000000000000..23be5083c6ff --- /dev/null +++ b/shared/templates/pam_account_password_faillock/tests/ubuntu_multiple_pam_unix.fail.sh @@ -0,0 +1,11 @@ +#!/bin/bash +# platform = multi_platform_ubuntu +# remediation = none + +# Multiple instances of pam_unix.so in auth section may, intentionally or not, interfere +# in the expected behaviour of pam_faillock.so. Remediation does not solve this automatically +# in order to preserve intentional changes. + +source ubuntu_common.sh + +echo "auth sufficient pam_unix.so" >> /etc/pam.d/common-auth diff --git a/shared/templates/pam_account_password_faillock/tests/ubuntu_wrong_value.fail.sh b/shared/templates/pam_account_password_faillock/tests/ubuntu_wrong_value.fail.sh new file mode 100644 index 000000000000..d236f32cb8bc --- /dev/null +++ b/shared/templates/pam_account_password_faillock/tests/ubuntu_wrong_value.fail.sh @@ -0,0 +1,6 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +source ubuntu_common.sh + +echo "deny=999" > /etc/security/faillock.conf