pam module

This module manages PAM including accesslogin and limits.conf with functionality to create limits fragments for use in other modules.

===

Compatibility

This module has been tested to work on the following systems with Puppet v3 (with and without the future parser) and v4 with Ruby versions 1.8.7, 1.9.3, 2.0.0 and 2.1.9. Please see .travis.yml for a full matrix of versions.

EL 5
EL 6
EL 7
Solaris 9
Solaris 10
Solaris 11
Suse 9
Suse 10
Suse 11
Suse 12
OpenSuSE 13.1
Ubuntu 12.04 LTS
Ubuntu 14.04 LTS
Ubuntu 16.04 LTS
Debian 7
Debian 8

EL no longer requires the redhat-lsb package.

===

Parameters

class pam

allowed_users

String, Array or Hash of strings and/or arrays to configure users and origins in access.conf. The default allows the root user/group from origin 'ALL'.

Default: 'root'

Hiera example for allowed_users

# as an array where the origin for each is 'ALL'
pam::allowed_users:
  - root
  - ops
  - devs

This would create /etc/security/access.conf with the following content.

# This file is being maintained by Puppet.
# DO NOT EDIT
#

#allow only the groups listed
+ : root : ALL
+ : ops : ALL
+ : devs : ALL

# as a hash where the user/group can optionally specify the origin
pam::allowed_users:
  'username':
  'username1':
    - 'cron'
    - 'tty0'
  'username2': 'tty1'

This would create /etc/security/access.conf with the following content.

# This file is being maintained by Puppet.
# DO NOT EDIT
#

#allow only the groups listed
+ : username : ALL
+ : username1 : cron tty0
+ : username2 : tty1

login_pam_access

Control module to be used for pam_access.so for login. Valid values are 'required', 'requisite', 'sufficient', 'optional' and 'absent'.

Default: 'required'

sshd_pam_access

Control module to be used for pam_access.so for sshd. Valid values are 'required', 'requisite', 'sufficient', 'optional' and 'absent'.

Default: 'required'

limits_fragments

Hash of fragments to pass to pam::limits::fragments

Default: undef

limits_fragments_hiera_merge

Boolean to control merges of all found instances of pam::limits_fragments in Hiera. This is useful for specifying fragments at different levels of the hierarchy and having them all included in the catalog.

Default: false

package_name

String or Array of packages providing the pam functionality. If undef, parameter is set based on the OS version.

Default: undef, default is set based on OS version

pam_conf_file

Path to pam.conf

Default: '/etc/pam.conf'

pam_d_login_oracle_options

Allow array of extra lines at the bottom of pam.d/login for oracle systems on EL5.

Default: UNSET

pam_d_login_path

PAM login path

Default: '/etc/pam.d/login'

pam_d_login_owner

Owner of $pam_d_login_path

Default: 'root'

pam_d_login_group

Group of $pam_d_login_path

Default: 'root'

pam_d_login_mode

Mode of $pam_d_login_path

Default: '0644'

pam_d_login_template

Content template of $pam_d_login_path. If undef, parameter is set based on the OS version.

Default: undef, default is set based on OS version

pam_d_sshd_path

PAM sshd path

Default: '/etc/pam.d/sshd'

pam_d_sshd_owner

Owner of $pam_d_sshd_path

Default: 'root'

pam_d_sshd_group

Group of $pam_d_sshd_path

Default: 'root'

pam_d_sshd_mode

Mode of $pam_d_sshd_path

Default: '0644'

pam_d_sshd_template

Content template of $pam_d_sshd_path. If undef, parameter is set based on the OS version.

For cases where a full customization of the sshd PAM configuration is required, set pam_d_sshd_template to use pam/sshd.custom.erb that is provided with this module. pam/sshd.custom.erb must be further configured with the parameters pam_sshd_auth_lines, pam_sshd_account_lines, pam_sshd_password_lines and pam_sshd_session_lines. Note that the pam_d_sshd_template parameter is a no-op on Solaris.

Default: undef, default is set based on OS version

pam_sshd_auth_lines

An ordered array of strings that define the content for PAM sshd auth. This setting is required and only valid if pam_d_sshd_template is configured to use the pam/sshd.custom.erb template.

Default: undef

pam_sshd_account_lines

An ordered array of strings that define the content for PAM sshd account. This setting is required and only valid if pam_d_sshd_template is configured to use the pam/sshd.custom.erb template.

Default: undef

pam_sshd_password_lines

An ordered array of strings that define the content for PAM sshd password. This setting is required and only valid if pam_d_sshd_template is configured to use the pam/sshd.custom.erb template.

Default: undef

pam_sshd_session_lines

An ordered array of strings that define the content for PAM sshd session. This setting is required and only valid if pam_d_sshd_template is configured to use the pam/sshd.custom.erb template.

Default: undef

pam_auth_lines

An ordered array of strings that define the content for PAM auth. If undef, parameter is set based on the OS version.

Default: undef, default is set based on OS version

pam_account_lines

An ordered array of strings that define the content for PAM account. If undef, parameter is set based on the OS version.

Default: undef, default is set based on OS version

pam_password_lines

An ordered array of strings that define the content for PAM password. If undef, parameter is set based on the OS version.

Default: undef, default is set based on OS version

pam_session_lines

An ordered array of strings that define the content for PAM session. If undef, parameter is set based on the OS version.

Default: undef, default is set based on OS version

pam_d_other_file

Path to other. Used on Suse.

Default: '/etc/pam.d/other'

common_auth_file

Path to common-auth. Used on Suse.

Default: '/etc/pam.d/common-auth'

common_auth_pc_file

Path to common-auth-pc. Used on Suse.

Default: '/etc/pam.d/common-auth-pc'

common_account_file

Path to common-account. Used on Suse.

Default: '/etc/pam.d/common-account'

common_account_pc_file

Path to common-account-pc. Used on Suse.

Default: '/etc/pam.d/common-account-pc'

common_password_file

Path to common-password. Used on Suse.

Default: '/etc/pam.d/common-password'

common_password_pc_file

Path to common-password-pc. Used on Suse.

Default: '/etc/pam.d/common-password-pc'

common_session_file

Path to common-session. Used on Suse.

Default: '/etc/pam.d/common-session'

common_session_pc_file

Path to common-session-pc. Used on Suse.

Default: '/etc/pam.d/common-session-pc'

common_session_noninteractive_file

Path to common-session-noninteractive, which is the same as common-session-pc used on Suse. Used on Ubuntu 12.04 LTS.

Default: '/etc/pam.d/common-session-noninteractive'

system_auth_file

Path to system-auth. Used on RedHat.

Default: '/etc/pam.d/system-auth'

system_auth_ac_file

Path to system-auth-ac. Used on RedHat.

Default: '/etc/pam.d/system-auth-ac'

system_auth_ac_auth_lines

Content template of $system_auth_ac_file. If undef, parameter is set based on the OS version.

Default: undef, default is set based on OS version

system_auth_ac_account_lines

Content template of $system_auth_ac_file. If undef, parameter is set based on the OS version.

Default: undef, default is set based on OS version

system_auth_ac_password_lines

Content template of $system_auth_ac_file. If undef, parameter is set based on the OS version.

Default: undef, default is set based on OS version

system_auth_ac_session_lines

Content template of $system_auth_ac_file. If undef, parameter is set based on the OS version.

Default: undef, default is set based on OS version

password_auth_file

Path to password-auth. Used on RedHat.

Default: '/etc/pam.d/password-auth'

password_auth_ac_file

Path to password-auth-ac. Used on RedHat.

Default: '/etc/pam.d/password-auth-ac'

pam_password_auth_lines

Array of lines used in content template of $password_auth_ac_file. If undef, parameter is set based on defaults for the detected platform.

Default: undef, default is set based on OS version

pam_password_account_lines

Array of lines used in content template of $password_auth_ac_file. If undef, parameter is set based on defaults for the detected platform.

Default: undef, default is set based on OS version

pam_password_password_lines

Array of lines used in content template of $password_auth_ac_file. If undef, parameter is set based on defaults for the detected platform.

Default: undef, default is set based on OS version

pam_password_session_lines

Array of lines used in content template of $password_auth_ac_file. If undef, parameter is set based on defaults for the detected platform.

Default: undef, default is set based on OS version ===

define pam::accesslogin

Manages login access See PAM_ACCESS(8)

Parameters for `pam::accesslogin` define

access_conf_path

Path to access.conf.

Default: '/etc/security/access.conf'

access_conf_owner

Owner of access.conf.

Default: 'root'

access_conf_group

Group of access.conf.

Default: 'root'

access_conf_mode

Mode of access.conf.

Default: '0644'

access_conf_template

Content template of access.conf.

Default: 'pam/access.conf.erb'

===

class pam::limits

Manage PAM limits.conf

Parameters for `pam::limits`

config_file

Path to limits.conf

Default: '/etc/security/limits.conf'

config_file_mode

Mode for config_file.

Default: '0640'

config_file_lines

Ordered array of limits that should be placed into limits.conf. Useful for Suse 10 which does not use limits.d.

Default: undef

config_file_source

String with source path to a limits.conf

Default: undef

limits_d_dir

Path to limits.d directory

Default: '/etc/security/limits.d'

limits_d_dir_mode

Mode for limits_d_dir.

Default: '0750'

purge_limits_d_dir

Boolean to purge the limits.d directory.

Default: false

manage_nsswitch

Boolean to manage the inclusion of the nsswitch class.

Default: true

===

pam::limits::fragment define

Places a fragment in $limits_d_dir directory

Parameters for `pam::limits::fragment`

Source or list must be set.

ensure

String with ensure attribute for the fragment file. Valid values are 'file', 'present' and 'absent'.

Default: 'file'

source

String - Path to the fragment file, such as 'puppet:///modules/pam/limits.nproc'

Default: 'UNSET'

list

Array of lines to add to the fragment file

Default: undef

===

pam::service

Manage PAM file for specific service. The pam::service resource is reversible, so that any service that Puppet has locked using PAM can be unlocked by setting the resource ensure to absent and waiting for the next puppet run.

Usage

you can specify a hash for to manage the services in Hiera

pam::services:
  "sudo":
    content : "auth     required       pam_unix2.so"

Parameters for `pam::service`

ensure

Specifies if a PAM service file should (present) or should not (absent) exist. The default is set to 'present'

pam_config_dir

Path to PAM files

Default: '/etc/pam.d/'

content

Content of the PAM file for the service. The content and lines parameters are mutually exclusive. Not setting either of these parameters will result in an empty service definition file.

lines

Provides content for the PAM service file as an array of lines. The content and lines parameters are mutually exclusive. Not setting either of these parameters will result in an empty service definition file.

===

Hiera example for limits_fragments

pam::limits_fragments:
  custom:
    list:
      - '* soft nofile 2048'
      - '* hard nofile 8192'
      - '* soft as 3145728'
      - '* hard as 4194304'
      - '* hard maxlogins 300'
      - '* soft cpu 720'
      - '* hard cpu 1440'

This would create /etc/security/limits.d/custom.conf with content

# This file is being maintained by Puppet.
# DO NOT EDIT
* soft nofile 2048
* hard nofile 8192
* soft as 3145728
* hard as 4194304
* hard maxlogins 300
* soft cpu 720
* hard cpu 1440

Name		Name	Last commit message	Last commit date
Latest commit History 276 Commits
manifests		manifests
spec		spec
templates		templates
tests		tests
.fixtures.yml		.fixtures.yml
.gitignore		.gitignore
.travis.yml		.travis.yml
CHANGELOG		CHANGELOG
Gemfile		Gemfile
LICENSE		LICENSE
README.md		README.md
Rakefile		Rakefile
metadata.json		metadata.json

License

benkevan/puppet-module-pam

Folders and files

Latest commit

History

Repository files navigation

pam module

Compatibility

Parameters

class pam

allowed_users

Hiera example for allowed_users

login_pam_access

sshd_pam_access

limits_fragments

limits_fragments_hiera_merge

package_name

pam_conf_file

pam_d_login_oracle_options

pam_d_login_path

pam_d_login_owner

pam_d_login_group

pam_d_login_mode

pam_d_login_template

pam_d_sshd_path

pam_d_sshd_owner

pam_d_sshd_group

pam_d_sshd_mode

pam_d_sshd_template

pam_sshd_auth_lines

pam_sshd_account_lines

pam_sshd_password_lines

pam_sshd_session_lines

pam_auth_lines

pam_account_lines

pam_password_lines

pam_session_lines

pam_d_other_file

common_auth_file

common_auth_pc_file

common_account_file

common_account_pc_file

common_password_file

common_password_pc_file

common_session_file

common_session_pc_file

common_session_noninteractive_file

system_auth_file

system_auth_ac_file

system_auth_ac_auth_lines

system_auth_ac_account_lines

system_auth_ac_password_lines

system_auth_ac_session_lines

password_auth_file

password_auth_ac_file

pam_password_auth_lines

pam_password_account_lines

pam_password_password_lines

pam_password_session_lines

define pam::accesslogin

Parameters for pam::accesslogin define

access_conf_path

access_conf_owner

access_conf_group

access_conf_mode

access_conf_template

class pam::limits

Parameters for pam::limits

config_file

config_file_mode

config_file_lines

config_file_source

limits_d_dir

limits_d_dir_mode

purge_limits_d_dir

manage_nsswitch

pam::limits::fragment define

Parameters for pam::limits::fragment

ensure

source

Parameters for `pam::accesslogin` define

Parameters for `pam::limits`

Parameters for `pam::limits::fragment`

Parameters for `pam::service`

Packages