aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rwxr-xr-xpambase.py1
-rw-r--r--templates/system-auth.tpl18
-rw-r--r--templates/system-session.tpl4
3 files changed, 21 insertions, 2 deletions
diff --git a/pambase.py b/pambase.py
index eb3d4fe..b306ca4 100755
--- a/pambase.py
+++ b/pambase.py
@@ -15,6 +15,7 @@ def main():
parser.add_argument('--pwquality', action="store_true", help='enable pam_pwquality.so module')
parser.add_argument('--elogind', action="store_true", help='enable pam_elogind.so module')
parser.add_argument('--systemd', action="store_true", help='enable pam_systemd.so module')
+ parser.add_argument('--homed', action="store_true", help='enable pam_systemd_home.so module')
parser.add_argument('--selinux', action="store_true", help='enable pam_selinux.so module')
parser.add_argument('--mktemp', action="store_true", help='enable pam_mktemp.so module')
parser.add_argument('--pam-ssh', action="store_true", help='enable pam_ssh.so module')
diff --git a/templates/system-auth.tpl b/templates/system-auth.tpl
index 53557dc..174aacf 100644
--- a/templates/system-auth.tpl
+++ b/templates/system-auth.tpl
@@ -11,11 +11,16 @@ auth [success=3 default=ignore] pam_krb5.so {{ krb5_params }}
{% endif %}
auth requisite pam_faillock.so preauth
-auth [success=1 default=ignore] pam_unix.so {{ nullok|default('', true) }} {{ debug|default('', true) }} try_first_pass
+{% if homed %}
+auth [success=2 default=ignore] pam_unix.so {{ nullok|default('', true) }} {{ debug|default('', true) }} try_first_pass
+auth [success=1 default=ignore] pam_systemd_home.so
+{% else %}
+auth [success=1 default=ignore] pam_unix.so {{ nullok|default('', true) }} {{ debug|default('', true) }} try_first_pas
+{% endif %}
auth [default=die] pam_faillock.so authfail
{% if caps %}
--auth optional pam_cap.so
+auth optional pam_cap.so
{% endif %}
{% if homed %}
@@ -24,6 +29,11 @@ auth [default=die] pam_faillock.so authfail
{% if krb5 %}
account [success=2 default=ignore] pam_krb5.so {{ krb5_params }}
{% endif %}
+
+{% if homed %}
+account [success=1 default=ignore] pam_systemd_home.so
+{% endif %}
+
account required pam_unix.so {{ debug|default('', true) }}
account required pam_faillock.so
@@ -43,6 +53,10 @@ password required pam_pwhistory.so use_authtok remember=5 retry=3
password [success=1 default=ignore] pam_krb5.so {{ krb5_params }}
{% endif %}
+{% if homed %}
+password [success=1 default=ignore] pam_systemd_home.so
+{% endif %}
+
{% if passwdqc or pwquality %}
password required pam_unix.so try_first_pass {{ unix_authtok|default('', true) }} {{ nullok|default('', true) }} {{ unix_extended_encryption|default('', true) }} {{ debug|default('', true) }}
{% else %}
diff --git a/templates/system-session.tpl b/templates/system-session.tpl
index 3dd1d70..48653d4 100644
--- a/templates/system-session.tpl
+++ b/templates/system-session.tpl
@@ -12,4 +12,8 @@ session optional pam_mktemp.so
session [success=1 default=ignore] pam_krb5.so {{ krb5_params }}
{% endif %}
+{% if homed %}
+session [success=1 default=ignore] pam_systemd_home.so
+{% endif %}
+
session required pam_unix.so {{ debug|default('', true) }}