-
Notifications
You must be signed in to change notification settings - Fork 674
/
shared.yml
69 lines (57 loc) · 2.66 KB
/
shared.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = medium
{{{ ansible_instantiate_variables("var_password_pam_unix_remember") }}}
{{% if "ubuntu" in product or "debian" in product %}}
{{% set pam_file='/etc/pam.d/common-password' %}}
{{% set group='password' %}}
{{% set control='\[success=[A-Za-z0-9].*\]' %}}
{{% set module='pam_unix.so' %}}
{{% set option='remember' %}}
{{% set value='{{ var_password_pam_unix_remember }}' %}}
{{% elif product in [ "sle12", "sle15" ] %}}
{{% set pam_file='/etc/pam.d/common-password' %}}
{{% else %}}
{{% set pam_file='/etc/pam.d/system-auth' %}}
{{% endif %}}
{{% if "ubuntu" in product or "debian" in product %}}
# Modified version of macro ansible_ensure_pam_module_option(pam_file, group, control, module, option, value='', after_match='').
# The original macro is designed to search/replace also the control field thus treating the field as a constant and escaping the regex.
# Here we adapt the code to allow using regex on the control field.
- name: '{{{ rule_title }}} - Check if the required PAM module option is present in {{{ pam_file }}}'
ansible.builtin.lineinfile:
path: "{{{ pam_file }}}"
regexp: ^\s*{{{ group }}}\s+{{{ control }}}\s+{{{ module }}}\s*.*\s{{{ option }}}\b
state: absent
check_mode: true
changed_when: false
register: result_pam_module_{{{ option }}}_option_present
- name: '{{{ rule_title }}} - Ensure the "{{{ option }}}" PAM option for "{{{ module }}}" is included in {{{ pam_file }}}'
ansible.builtin.lineinfile:
path: "{{{ pam_file }}}"
backrefs: true
regexp: ^(\s*{{{ group }}}\s+{{{ control }}}\s+{{{ module }}}.*)
line: \1 {{{ option }}}={{{ value }}}
state: present
register: result_pam_{{{ option }}}_add
when:
- result_pam_module_{{{ option }}}_option_present.found == 0
- name: '{{{ rule_title }}} - Ensure the required value for "{{{ option }}}" PAM option from "{{{ module }}}" in {{{ pam_file }}}'
ansible.builtin.lineinfile:
path: "{{{ pam_file }}}"
backrefs: true
regexp: ^(\s*{{{ group }}}\s+{{{ control }}}\s+{{{ module }}}\s+.*)({{{ option }}})=[0-9a-zA-Z]+\s*(.*)
line: \1\2={{{ value }}} \3
register: result_pam_{{{ option }}}_edit
when:
- result_pam_module_{{{ option }}}_option_present.found > 0
{{% else %}}
{{{ ansible_pam_pwhistory_enable(pam_file,
'requisite',
'^password.*requisite.*pam_pwquality\.so') }}}
{{{ ansible_pam_pwhistory_parameter_value(pam_file,
'remember',
'{{ var_password_pam_unix_remember }}') }}}
{{% endif %}}