From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id E37D515838C for ; Fri, 19 Jan 2024 05:31:58 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 2F92AE2B3B; Fri, 19 Jan 2024 05:31:58 +0000 (UTC) Received: from smtp.gentoo.org (woodpecker.gentoo.org [140.211.166.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 0AD59E2B3B for ; Fri, 19 Jan 2024 05:31:58 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 05051335DCD for ; Fri, 19 Jan 2024 05:31:57 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 5D6EF1018 for ; Fri, 19 Jan 2024 05:31:55 +0000 (UTC) From: "Sam James" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sam James" Message-ID: <1705642302.c2060f499d483e11ba4524283c2d95a6a8beb8dc.sam@gentoo> Subject: [gentoo-commits] proj/pambase:master commit in: templates/, / X-VCS-Repository: proj/pambase X-VCS-Files: pambase.py templates/system-auth.tpl templates/system-session.tpl X-VCS-Directories: / templates/ X-VCS-Committer: sam X-VCS-Committer-Name: Sam James X-VCS-Revision: c2060f499d483e11ba4524283c2d95a6a8beb8dc X-VCS-Branch: master Date: Fri, 19 Jan 2024 05:31:55 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: 97da661c-a887-4b7c-8963-29fa94f66d2f X-Archives-Hash: 2262e35be9c513d88249dcd5faeed3a1 commit: c2060f499d483e11ba4524283c2d95a6a8beb8dc Author: Christopher Byrne gmail com> AuthorDate: Sun Sep 3 16:32:19 2023 +0000 Commit: Sam James gentoo org> CommitDate: Fri Jan 19 05:31:42 2024 +0000 URL: https://gitweb.gentoo.org/proj/pambase.git/commit/?id=c2060f49 Add sssd support Bug: https://bugs.gentoo.org/726050 Closes: https://github.com/gentoo/pambase/issues/1 Signed-off-by: Christopher Byrne gmail.com> Closes: https://github.com/gentoo/pambase/pull/17 Signed-off-by: Sam James gentoo.org> pambase.py | 7 ++++++- templates/system-auth.tpl | 38 ++++++++++++++++++++++++++++++++------ templates/system-session.tpl | 4 ++++ 3 files changed, 42 insertions(+), 7 deletions(-) diff --git a/pambase.py b/pambase.py index 3875e89..ceec8cb 100755 --- a/pambase.py +++ b/pambase.py @@ -19,6 +19,7 @@ def main(): parser.add_argument('--mktemp', action="store_true", help='enable pam_mktemp.so module') parser.add_argument('--pam-ssh', action="store_true", help='enable pam_ssh.so module') parser.add_argument('--securetty', action="store_true", help='enable pam_securetty.so module') + parser.add_argument('--sssd', action="store_true", help='enable sssd.so module') parser.add_argument('--yescrypt', action="store_true", help='enable yescrypt option for pam_unix.so module') parser.add_argument('--sha512', action="store_true", help='enable sha512 option for pam_unix.so module') parser.add_argument('--krb5', action="store_true", help='enable pam_krb5.so module') @@ -41,7 +42,8 @@ def process_args(args): "unix_authtok", "unix_extended_encryption", "likeauth", - "nullok" + "nullok", + "local_users_only" ] # create a blank dictionary @@ -62,6 +64,9 @@ def process_args(args): if args.krb5: output["krb5_params"] = "{0} ignore_root try_first_pass".format("debug").strip() + if args.sssd: + output["local_users_only"] = "local_users_only" + if args.yescrypt: output["unix_extended_encryption"] = "yescrypt shadow" elif args.sha512: diff --git a/templates/system-auth.tpl b/templates/system-auth.tpl index 9b078f3..4065e89 100644 --- a/templates/system-auth.tpl +++ b/templates/system-auth.tpl @@ -7,34 +7,55 @@ auth sufficient pam_ssh.so auth [success={{ 4 if homed else 3 }} default=ignore] pam_krb5.so {{ krb5_params }} {% endif %} +{% if sssd %} +auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular +auth [default=3 ignore=ignore success=ok] pam_localuser.so +{% endif %} + auth requisite pam_faillock.so preauth + {% if homed %} auth [success=2 default=ignore] pam_systemd_home.so {% endif %} + +{% if sssd %} +auth sufficient pam_unix.so {{ nullok|default('', true) }} {{ debug|default('', true) }} +{% else %} auth [success=1 new_authtok_reqd=1 ignore=ignore default=bad] pam_unix.so {{ nullok|default('', true) }} {{ debug|default('', true) }} try_first_pass +{% endif %} auth [default=die] pam_faillock.so authfail - +{% if sssd %} +auth sufficient pam_sss.so forward_pass {{ debug|default('', true) }} +{% endif %} {% if caps %} auth optional pam_cap.so {% endif %} - +{% if sssd %} +auth sufficient pam_deny.so +{% endif %} {% if krb5 %} account [success=2 default=ignore] pam_krb5.so {{ krb5_params }} {% endif %} {% if homed %} -account [success=1 default=ignore] pam_systemd_home.so +account [success={{ 2 if sssd else 1 }} default=ignore] pam_systemd_home.so {% endif %} account required pam_unix.so {{ debug|default('', true) }} account required pam_faillock.so +{% if sssd %} +account sufficient pam_localuser.so +account sufficient pam_usertype.so issystem +account [default=bad success=ok user_unknown=ignore] pam_sss.so {{ debug|default('', true) }} +account required pam_permit.so +{% endif %} {% if passwdqc %} password required pam_passwdqc.so config=/etc/security/passwdqc.conf {% endif %} {% if pwquality %} -password required pam_pwquality.so +password required pam_pwquality.so {{ local_users_only|default('', true ) }} {% endif %} {% if pwhistory %} @@ -50,9 +71,14 @@ password [success=1 default=ignore] pam_systemd_home.so {% endif %} {% if passwdqc or pwquality %} -password required pam_unix.so try_first_pass {{ unix_authtok|default('', true) }} {{ nullok|default('', true) }} {{ unix_extended_encryption|default('', true) }} {{ debug|default('', true) }} +password {{ 'sufficient' if sssd else 'required' }} pam_unix.so try_first_pass {{ unix_authtok|default('', true) }} {{ nullok|default('', true) }} {{ unix_extended_encryption|default('', true) }} {{ debug|default('', true) }} {% else %} -password required pam_unix.so try_first_pass {{ nullok|default('', true) }} {{ unix_extended_encryption|default('', true) }} {{ debug|default('', true) }} +password {{ 'sufficient' if sssd else 'required' }} pam_unix.so try_first_pass {{ nullok|default('', true) }} {{ unix_extended_encryption|default('', true) }} {{ debug|default('', true) }} +{% endif %} + +{% if sssd %} +password sufficient pam_sss.so use_authtok +password required pam_deny.so {% endif %} {% if pam_ssh %} diff --git a/templates/system-session.tpl b/templates/system-session.tpl index 536db49..4c5585b 100644 --- a/templates/system-session.tpl +++ b/templates/system-session.tpl @@ -13,3 +13,7 @@ session [success=1 default=ignore] pam_systemd_home.so {% endif %} session required pam_unix.so {{ debug|default('', true) }} + +{% if sssd %} +session optional pam_sss.so {{ debug|default('', true) }} +{% endif %}