Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow configuration of password remember in pam #467

Merged
merged 3 commits into from
Jul 22, 2021
Merged

Allow configuration of password remember in pam #467

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a40e97b
Add Configuration of password remember
m41kc0d3 Jul 21, 2021
cfb7817
set default for password remember back to 5
m41kc0d3 Jul 22, 2021
dc2c680
readme default for password remember back to 5
m41kc0d3 Jul 22, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
3 changes: 3 additions & 0 deletions roles/os_hardening/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,9 @@ We know that this is the case on Raspberry Pi.
- `os_auth_pw_min_age`
- Default: `7`
- Description: minimum password age (before allowing any other password change).
- `os_auth_pw_remember`
- Default: `5`
- Description: how many used passwords are record.
- `os_auth_retries`
- Default: `5`
- Description: the maximum number of authentication attempts, before the account is locked for some time.
Expand Down
1 change: 1 addition & 0 deletions roles/os_hardening/defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ os_desktop_enable: false
os_env_extra_user_paths: []
os_auth_pw_max_age: 60
os_auth_pw_min_age: 7 # Discourage password cycling
os_auth_pw_remember: 5 # Specify how many used passwords are record
os_auth_retries: 5
os_auth_lockout_time: 600 # Seconds (600 = 10min)
os_auth_timeout: 60
Expand Down
2 changes: 1 addition & 1 deletion roles/os_hardening/templates/etc/pam.d/rhel_auth.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ account required pam_permit.so
password requisite pam_pwquality.so {{ os_auth_pam_pwquality_options }}
{% endif %}
{# NSA 2.3.3.6 Limit Password Reuse #}
password requisite pam_pwhistory.so remember=5 use_authtok
password requisite pam_pwhistory.so remember={{ os_auth_pw_remember }} use_authtok
{# NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512 #}
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok rounds={{ os_sha_crypt_min_rounds }}
{% if (os_auth_pam_sssd_enable | bool) %}
Expand Down