1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
|
auth required pam_env.so {{ debug|default('', true) }}
{% if pam_ssh %}
auth sufficient pam_ssh.so
{% endif %}
{% if krb5 %}
auth [success={{ 4 if homed else 3 }} default=ignore] pam_krb5.so {{ krb5_params }}
{% endif %}
{% if sssd %}
auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular
auth [default=3 ignore=ignore success=ok] pam_localuser.so
{% endif %}
auth requisite pam_faillock.so preauth
{% if homed %}
auth [success=2 default=ignore] pam_systemd_home.so
{% endif %}
{% if sssd %}
auth sufficient pam_unix.so {{ nullok|default('', true) }} {{ debug|default('', true) }}
{% else %}
auth [success=1 new_authtok_reqd=1 ignore=ignore default=bad] pam_unix.so {{ nullok|default('', true) }} {{ debug|default('', true) }} try_first_pass
{% endif %}
auth [default=die] pam_faillock.so authfail
{% if sssd %}
auth sufficient pam_sss.so forward_pass {{ debug|default('', true) }}
{% endif %}
{% if caps %}
auth optional pam_cap.so
{% endif %}
{% if sssd %}
auth sufficient pam_deny.so
{% endif %}
{% if krb5 %}
account [success=2 default=ignore] pam_krb5.so {{ krb5_params }}
{% endif %}
{% if homed %}
account [success={{ 2 if sssd else 1 }} default=ignore] pam_systemd_home.so
{% endif %}
account required pam_unix.so {{ debug|default('', true) }}
account required pam_faillock.so
{% if sssd %}
account sufficient pam_localuser.so
account sufficient pam_usertype.so issystem
account [default=bad success=ok user_unknown=ignore] pam_sss.so {{ debug|default('', true) }}
account required pam_permit.so
{% endif %}
{% if passwdqc %}
password required pam_passwdqc.so config=/etc/security/passwdqc.conf
{% endif %}
{% if pwquality %}
password required pam_pwquality.so {{ local_users_only|default('', true ) }}
{% endif %}
{% if pwhistory %}
password required pam_pwhistory.so use_authtok remember=5 retry=3
{% endif %}
{% if krb5 %}
password [success=1 default=ignore] pam_krb5.so {{ krb5_params }}
{% endif %}
{% if homed %}
password [success=1 default=ignore] pam_systemd_home.so
{% endif %}
{% if passwdqc or pwquality %}
password {{ 'sufficient' if sssd else 'required' }} pam_unix.so try_first_pass {{ unix_authtok|default('', true) }} {{ nullok|default('', true) }} {{ unix_extended_encryption|default('', true) }} {{ debug|default('', true) }}
{% else %}
password {{ 'sufficient' if sssd else 'required' }} pam_unix.so try_first_pass {{ nullok|default('', true) }} {{ unix_extended_encryption|default('', true) }} {{ debug|default('', true) }}
{% endif %}
{% if sssd %}
password sufficient pam_sss.so use_authtok
password required pam_deny.so
{% endif %}
{% if pam_ssh %}
session optional pam_ssh.so
{% endif %}
{% include "templates/system-session.tpl" %}
|
GitWeb