puppet-module-pam

Table of Contents

1. Module Description - What the module does and why it is useful
2. Setup - The basics of getting started with pam
   • What pam affects
   • Setup requirements
   • Beginning with pam
3. Usage - Configuration options and additional functionality
4. Limitations - OS compatibility, etc.
5. Development - Guide for contributing to the module

Module description

This module manages PAM including accesslogin and limits.conf with functionality to create limits fragments for use in other modules. There are examples for using this with VAS/QAS.

Setup

What pam affects

Manages the packages and files regarding PAM. These vary by platform though generally include things such as the following.

• /etc/pam.conf
• /etc/pam.d
• /etc/security/access.conf
• /etc/security/limits.conf
• /etc/security/limits.d

The management of /etc/security/access.conf can be controlled by the pam::manage_accesslogin parameter (enabled by default).

The management of /etc/security/faillock.conf can be controlled by the pam::manage_faillock parameter (disabled by default).

The management of /etc/security/pwquality.conf and /etc/security/pwquality.conf.d can be controlled by the pam::manage_pwquality parameter (disabled by default).

Setup requirements

This module requires stdlib. When deployed by default it will require nsswitch. See below for more information.

Optional

nsswitch

By default this module will include the nsswitch class with the settings pam::manage_nsswitch. This module is meant to be used with the Approved nsswitch module.

SSSD

This module has been deployed in production along with sgnl05/sssd. Please see examples/hiera/sssd/RedHat-6.yaml file for an example with the additional SSSD entries added via hiera.

Beginning with pam

Include the main pam class.

Specifying the allowed users

Example using an array

As an array where the origin for each is 'ALL'.

pam::allowed_users:
  - root
  - ops
  - devs

This would create /etc/security/access.conf with the following content.

# This file is being maintained by Puppet.
# DO NOT EDIT
#

# allow only the groups listed
+:root:ALL
+:ops:ALL
+:devs:ALL

# default deny
-:ALL:ALL

Example using a hash

As a hash where the user/group can optionally specify the origin.

pam::allowed_users:
  'username':
  'username1':
    - 'cron'
    - 'tty0'
  'username2': 'tty1'

This would create /etc/security/access.conf with the following content.

# This file is being maintained by Puppet.
# DO NOT EDIT
#

#allow only the groups listed
+:username:ALL
+:username1:cron tty0
+:username2:tty1

# default deny
-:ALL:ALL

Setting limits

Example:

pam::limits_fragments:
  custom:
    list:
      - '* soft nofile 2048'
      - '* hard nofile 8192'
      - '* soft as 3145728'
      - '* hard as 4194304'
      - '* hard maxlogins 300'
      - '* soft cpu 720'
      - '* hard cpu 1440'

This would create /etc/security/limits.d/custom.conf with content

# This file is being maintained by Puppet.
# DO NOT EDIT
* soft nofile 2048
* hard nofile 8192
* soft as 3145728
* hard as 4194304
* hard maxlogins 300
* soft cpu 720
* hard cpu 1440

The parameter pam::limits_fragments_hiera_merge can be set to true to allow Hiera to define and merge limits from multiple locations. Example:

# data/common.yaml
---
pam::limits_fragments_hiera_merge: true
pam::limits_fragments:
  custom:
    list:
      - '* soft nofile 2048'
      - '* hard nofile 8192'
# data/os/RedHat/8.yaml
---
pam::limits_fragments:
  custom:
    list:
      - '* soft as 3145728'
      - '* hard as 4194304'

The contents of /etc/security/limits.d can optionally be purged of unmanaged files.

pam::limits::purge_limits_d_dir: true

Below is an example of ignoring certain files from the limits.d purge:

pam::limits::purge_limits_d_dir_ignore: 'ignore*.conf'

The ignore can also be an Array of file names

pam::limits::purge_limits_d_dir_ignore:
  - custom.conf
  - foo.conf

Specifying the content of a service

Manage PAM file for specific service.

Example:

You can specify a hash to manage the services in Hiera

pam::services:
  'sudo':
    content : 'auth     required       pam_unix2.so'

Manage faillock

Management of faillock and faillock.conf is enabled via pam::manage_faillock.

The following example would enable faillock, configure it, and add it to the PAM stack.

pam::manage_faillock: true
pam::faillock::deny: 3
pam::pam_auth_lines:
  - 'auth        required      pam_env.so'
  - 'auth        required      pam_faillock.so preauth silent audit deny=5 unlock_time=900'
  - 'auth        sufficient    pam_unix.so try_first_pass nullok'
  - 'auth        [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900'
  - 'auth        required      pam_deny.so'
pam::pam_account_lines:
  - 'account     required      pam_faillock.so'
  - 'account     required      pam_unix.so'
pam::pam_password_auth_lines:
  - 'auth        required      pam_env.so'
  - 'auth        required      pam_faillock.so preauth silent audit deny=5 unlock_time=900'
  - 'auth        sufficient    pam_unix.so try_first_pass nullok'
  - 'auth        [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900'
  - 'auth        required      pam_deny.so'
pam::pam_password_account_lines:
  - 'account     required      pam_faillock.so'
  - 'account     required      pam_unix.so'

Manage pwquality

Management of pwquality and pwquality.conf is enabled via pam::manage_pwquality.

The following example would enable pwquality, configure it, and add it to the PAM stack.

pam::manage_pwquality: true
pam::pwquality::retry: 3
pam::pwquality::maxclassrepeat: 4
pam::pwquality::maxrepeat: 3
pam::pwquality::minclass: 4
pam::pwquality::difok: 8
pam::pwquality::minlen: 15
pam::pam_password_lines:
  - 'password    requisite     pam_pwquality.so try_first_pass local_users_only difok=3 minlen=15 dcredit= 2 ocredit=2'
  - 'password    sufficient    pam_unix.so try_first_pass use_authtok nullok sha512 shadow'
  - 'password    required      pam_deny.so'
pam::pam_password_password_lines:
  - 'password    requisite     pam_pwquality.so try_first_pass local_users_only difok=3 minlen=15 dcredit= 2 ocredit=2'
  - 'password    sufficient    pam_unix.so try_first_pass use_authtok nullok sha512 shadow'
  - 'password    required      pam_deny.so'

Usage

Minimal and normal usage.

include pam

Limitations

This module has been tested to work on the following systems with Puppet versions 7 and 8 with the Ruby version associated with those releases. Please see .github/workflows/ci.yaml for a full matrix of supported versions. This module aims to support the current and previous major Puppet versions.

• EL 7
• EL 8
• EL 9
• Amazon Linux 2
• Debian 10
• Debian 11
• Ubuntu 20.04 LTS
• Ubuntu 22.04 LTS

May work

These platforms have spec tests and have been verified in the past, though are not functionally tested and formally supported.

The Hiera data for some of these platforms can be found in examples/hiera/eol.

• EL 5
• EL 6
• Solaris 9
• Solaris 10
• Solaris 11
• Suse 9
• Suse 10
• Suse 11
• Suse 12
• Suse 15
• OpenSuSE 13.1
• Debian 7
• Debian 8
• Debian 9
• Ubuntu 12.04 LTS
• Ubuntu 14.04 LTS
• Ubuntu 16.04 LTS
• Ubuntu 18.04 LTS

Development

See CONTRIBUTING.md for information related to the development of this module.

Reference

Table of Contents

Classes

• pam: This module manages PAM.
• pam::accesslogin: Manage login access See PAM_ACCESS(8)
• pam::faillock: Manage faillock.conf
• pam::limits: Manage PAM limits.conf
• pam::pwquality: Manage pwquality.conf

Defined types

• pam::limits::fragment: Places a fragment in $limits_d_dir directory One of the parameters source or list must be set.
• pam::service: Manage PAM file for specific service. The pam::service resource is

Classes

pam

This module manages PAM.

Examples

Declaring the class

include pam

Parameters

The following parameters are available in the pam class:

• allowed_users
• manage_accesslogin
• login_pam_access
• sshd_pam_access
• limits_fragments
• limits_fragments_hiera_merge
• manage_faillock
• manage_pwquality
• package_name
• pam_conf_file
• services
• pam_d_login_oracle_options
• pam_d_login_path
• pam_d_login_owner
• pam_d_login_group
• pam_d_login_mode
• pam_d_login_template
• pam_d_sshd_path
• pam_d_sshd_owner
• pam_d_sshd_group
• pam_d_sshd_mode
• pam_d_sshd_template
• pam_sshd_auth_lines
• pam_sshd_account_lines
• pam_sshd_password_lines
• pam_sshd_session_lines
• pam_auth_lines
• pam_account_lines
• pam_password_lines
• pam_session_lines
• other_file
• common_auth_file
• common_auth_pc_file
• common_account_file
• common_account_pc_file
• common_password_file
• common_password_pc_file
• common_session_file
• common_session_pc_file
• common_session_noninteractive_file
• system_auth_file
• system_auth_ac_file
• password_auth_file
• password_auth_ac_file
• pam_password_auth_lines
• pam_password_account_lines
• pam_password_password_lines
• pam_password_session_lines
• manage_nsswitch
• common_files
• common_files_create_links
• common_files_suffix

allowed_users

Data type: Variant[Array, Hash, String]

String, Array or Hash of strings and/or arrays to configure users and origins in access.conf. The default allows the root user/group from origin 'ALL'.

Default value: 'root'

manage_accesslogin

Data type: Boolean

Boolean to manage the inclusion of the pam::accesslogin class. Can be useful if /etc/security/access.conf is managed externally. Defaults to true.

Default value: true

login_pam_access

Data type: Enum['absent', 'optional', 'required', 'requisite', 'sufficient']

Control module to be used for pam_access.so for login. Valid values are 'required', 'requisite', 'sufficient', 'optional' and 'absent'.

Default value: 'required'

sshd_pam_access

Data type: Enum['absent', 'optional', 'required', 'requisite', 'sufficient']

Control module to be used for pam_access.so for sshd. Valid values are 'required', 'requisite', 'sufficient', 'optional' and 'absent'.

Default value: 'required'

limits_fragments

Data type: Optional[Hash]

Hash of fragments to pass to pam::limits::fragments

Default value: undef

limits_fragments_hiera_merge

Data type: Boolean

Boolean to control merges of all found instances of pam::limits_fragments in Hiera. This is useful for specifying fragments at different levels of the hierarchy and having them all included in the catalog.

Default value: false

manage_faillock

Data type: Boolean

Controls whether to manage faillock.conf

Default value: false

manage_pwquality

Data type: Boolean

Controls whether to manage pwquality.conf and pwquality.conf.d

Default value: false

package_name

Data type: Optional[Variant[Array, String]]

String or Array of packages providing the pam functionality. If undef, parameter is set based on the OS version.

Default value: undef

pam_conf_file

Data type: Stdlib::Absolutepath

Absolute path to pam.conf.

Default value: '/etc/pam.conf'

services

Data type: Optional[Hash]

Hash of pam::service entries to be created.

Default value: undef

pam_d_login_oracle_options

Data type: Array

Allow array of extra lines at the bottom of pam.d/login for oracle systems on EL5.

Default value: []

pam_d_login_path

Data type: Stdlib::Absolutepath

Absolute path to PAM login file.

Default value: '/etc/pam.d/login'

pam_d_login_owner

Data type: String

Owner of $pam_d_login_path.

Default value: 'root'

pam_d_login_group

Data type: String

Group of $pam_d_login_path.

Default value: 'root'

pam_d_login_mode

Data type: Stdlib::Filemode

Mode of $pam_d_login_path.

Default value: '0644'

pam_d_login_template

Data type: Optional[String]

Content template of $pam_d_login_path. If undef, parameter is set based on the OS version.

Default value: undef

pam_d_sshd_path

Data type: Stdlib::Absolutepath

PAM sshd path.

Default value: '/etc/pam.d/sshd'

pam_d_sshd_owner

Data type: String

Owner of $pam_d_sshd_path.

Default value: 'root'

pam_d_sshd_group

Data type: String

Group of $pam_d_sshd_path.

Default value: 'root'

pam_d_sshd_mode

Data type: Stdlib::Filemode

Mode of $pam_d_sshd_path.

Default value: '0644'

pam_d_sshd_template

Data type: Optional[String]

Content template of $pam_d_sshd_path. If undef, parameter is set based on the OS version. For cases where a full customization of the sshd PAM configuration is required, set pam_d_sshd_template to use pam/sshd.custom.erb that is provided with this module. pam/sshd.custom.erb must be further configured with the parameters pam_sshd_auth_lines, pam_sshd_account_lines, pam_sshd_password_lines and pam_sshd_session_lines. Note that the pam_d_sshd_template parameter is a no-op on Solaris.

Default value: undef

pam_sshd_auth_lines

Data type: Optional[Array]

An ordered array of strings that define the content for PAM sshd auth. This setting is required and only valid if pam_d_sshd_template is configured to use the pam/sshd.custom.erb template.

Default value: undef

pam_sshd_account_lines

Data type: Optional[Array]

An ordered array of strings that define the content for PAM sshd account. This setting is required and only valid if pam_d_sshd_template is configured to use the pam/sshd.custom.erb template.

Default value: undef

pam_sshd_password_lines

Data type: Optional[Array]

An ordered array of strings that define the content for PAM sshd password. This setting is required and only valid if pam_d_sshd_template is configured to use the pam/sshd.custom.erb template.

Default value: undef

pam_sshd_session_lines

Data type: Optional[Array]

An ordered array of strings that define the content for PAM sshd session. This setting is required and only valid if pam_d_sshd_template is configured to use the pam/sshd.custom.erb template.

Default value: undef

pam_auth_lines

Data type: Optional[Array]

An ordered array of strings that define the content for PAM auth. If undef, parameter is set based on the OS version.

Default value: undef

pam_account_lines

Data type: Optional[Array]

An ordered array of strings that define the content for PAM account. If undef, parameter is set based on the OS version.

Default value: undef

pam_password_lines

Data type: Optional[Array]

An ordered array of strings that define the content for PAM password. If undef, parameter is set based on the OS version.

Default value: undef

pam_session_lines

Data type: Optional[Array]

An ordered array of strings that define the content for PAM session. If undef, parameter is set based on the OS version.

Default value: undef

other_file

Data type: Stdlib::Absolutepath

Path to PAM other file. Used on Suse 9 and Solaris.

Default value: '/etc/pam.d/other'

common_auth_file

Data type: Stdlib::Absolutepath

Path to PAM common-auth file. Used on Debian/Ubuntu and Suse.

Default value: '/etc/pam.d/common-auth'

common_auth_pc_file

Data type: Stdlib::Absolutepath

Path to PAM common-auth-pc file. Used on Suse.

Default value: '/etc/pam.d/common-auth-pc'

common_account_file

Data type: Stdlib::Absolutepath

Path to PAM common-account file. Used on Suse.

Default value: '/etc/pam.d/common-account'

common_account_pc_file

Data type: Stdlib::Absolutepath

Path to PAM common-account-pc file. Used on Suse.

Default value: '/etc/pam.d/common-account-pc'

common_password_file

Data type: Stdlib::Absolutepath

Path to PAM common-password file. Used on Suse.

Default value: '/etc/pam.d/common-password'

common_password_pc_file

Data type: Stdlib::Absolutepath

Path to PAM common-password-pc file. Used on Suse.

Default value: '/etc/pam.d/common-password-pc'

common_session_file

Data type: Stdlib::Absolutepath

Path to PAM common-session file. Used on Suse.

Default value: '/etc/pam.d/common-session'

common_session_pc_file

Data type: Stdlib::Absolutepath

Path to PAM common-session-pc file. Used on Suse.

Default value: '/etc/pam.d/common-session-pc'

common_session_noninteractive_file

Data type: Stdlib::Absolutepath

Path to PAM common-session-noninteractive file, which is the same as common-session-pc used on Suse. Used on Ubuntu 12.04 LTS.

Default value: '/etc/pam.d/common-session-noninteractive'

system_auth_file

Data type: Stdlib::Absolutepath

Path to PAM system-auth file. Used on RedHat.

Default value: '/etc/pam.d/system-auth'

system_auth_ac_file

Data type: Stdlib::Absolutepath

Path to PAM system-auth-ac file. Used on RedHat.

Default value: '/etc/pam.d/system-auth-ac'

password_auth_file

Data type: Stdlib::Absolutepath

Path to PAM password-auth file. Used on RedHat.

Default value: '/etc/pam.d/password-auth'

password_auth_ac_file

Data type: Stdlib::Absolutepath

Path to PAM password-auth-ac file. Used on RedHat.

Default value: '/etc/pam.d/password-auth-ac'

pam_password_auth_lines

Data type: Optional[Array]

Array of lines used in content template of $password_auth_ac_file. If undef, parameter is set based on defaults for the detected platform.

Default value: undef

pam_password_account_lines

Data type: Optional[Array]

Array of lines used in content template of $password_auth_ac_file. If undef, parameter is set based on defaults for the detected platform.

Default value: undef

pam_password_password_lines

Data type: Optional[Array]

Array of lines used in content template of $password_auth_ac_file. If undef, parameter is set based on defaults for the detected platform.

Default value: undef

pam_password_session_lines

Data type: Optional[Array]

Array of lines used in content template of $password_auth_ac_file. If undef, parameter is set based on defaults for the detected platform.

Default value: undef

manage_nsswitch

Data type: Boolean

Boolean to manage the inclusion of the nsswitch class.

Default value: true

common_files

Data type: Array

Private, do not specify. Manage pam files where the entries match existing template names. These common_files* parameters are used internally to specify which files and names are needed. The data is coming out of Hiera in data/os/.

Default value: []

common_files_create_links

Data type: Boolean

Private, do not specify. If true, then symlinks are created from the suffixed files to the originals without the suffix.

Default value: false

common_files_suffix

Data type: Optional[String]

Suffix added to the common_files entries for the filename.

Default value: undef

pam::accesslogin

Manage login access See PAM_ACCESS(8)

Examples

This class is included by the pam class for platforms which use it.

Parameters

The following parameters are available in the pam::accesslogin class:

• access_conf_path
• access_conf_owner
• access_conf_group
• access_conf_mode
• access_conf_template
• allowed_users

access_conf_path

Data type: Stdlib::Absolutepath

Path to access.conf.

Default value: '/etc/security/access.conf'

access_conf_owner

Data type: String

Owner of access.conf.

Default value: 'root'

access_conf_group

Data type: String

Group of access.conf.

Default value: 'root'

access_conf_mode

Data type: Stdlib::Filemode

Mode of access.conf.

Default value: '0644'

access_conf_template

Data type: String

Content template of access.conf.

Default value: 'pam/access.conf.erb'

allowed_users

Data type: Variant[Array, Hash, String]

String, Array or Hash of strings and/or arrays to configure users and origins in access.conf. The default allows the root user/group from origin 'ALL'.

Default value: $pam::allowed_users

pam::faillock

Manage faillock.conf

Parameters

The following parameters are available in the pam::faillock class:

• config_file
• config_file_owner
• config_file_group
• config_file_mode
• config_file_template
• config_file_source
• dir
• audit_enabled
• silent
• no_log_info
• local_users_only
• deny
• fail_interval
• unlock_time
• even_deny_root
• root_unlock_time
• admin_group

config_file

Data type: Stdlib::Absolutepath

The faillock config path

Default value: '/etc/security/faillock.conf'

config_file_owner

Data type: String[1]

The faillock config owner

Default value: 'root'

config_file_group

Data type: String[1]

The faillock config group

Default value: 'root'

config_file_mode

Data type: Stdlib::Filemode

The faillock config mode

Default value: '0644'

config_file_template

Data type: String[1]

The faillock config template

Default value: 'pam/faillock.conf.erb'

config_file_source

Data type: Optional[Stdlib::Filesource]

The faillock config source

Default value: undef

dir

Data type: Stdlib::Absolutepath

The faillock 'dir' config option

Default value: '/var/run/faillock'

audit_enabled

Data type: Optional[Boolean]

The faillock 'audit' config option

Default value: undef

silent

Data type: Optional[Boolean]

The faillock 'silent' config option

Default value: undef

no_log_info

Data type: Optional[Boolean]

The faillock 'no_log_info' config option

Default value: undef

local_users_only

Data type: Optional[Boolean]

The faillock 'local_users_only' config option

Default value: undef

deny

Data type: Integer[0]

The faillock 'deny' config option

Default value: 3

fail_interval

Data type: Integer[0]

The faillock 'fail_interval' config option

Default value: 900

unlock_time

Data type: Integer[0]

The faillock 'unlock_time' config option

Default value: 600

even_deny_root

Data type: Optional[Boolean]

The faillock 'even_deny_root' config option

Default value: undef

root_unlock_time

Data type: Integer[0]

The faillock 'root_unlock_time' config option

Default value: $unlock_time

admin_group

Data type: Optional[String[1]]

The faillock 'admin_group' config option

Default value: undef

pam::limits

Manage PAM limits.conf

Examples

This class is included by the pam class for platforms which use it.

Parameters

The following parameters are available in the pam::limits class:

• config_file
• config_file_mode
• config_file_lines
• config_file_source
• limits_d_dir
• limits_d_dir_mode
• purge_limits_d_dir
• purge_limits_d_dir_ignore

config_file

Data type: Stdlib::Absolutepath

Path to limits.conf.

Default value: '/etc/security/limits.conf'

config_file_mode

Data type: Stdlib::Filemode

Mode for config_file.

Default value: '0640'

config_file_lines

Data type: Optional[Array]

Ordered array of limits that should be placed into limits.conf. Useful for Suse 10 which does not use limits.d.

Default value: undef

config_file_source

Data type: Optional[String]

String with source path to a limits.conf

Default value: undef

limits_d_dir

Data type: Stdlib::Absolutepath

Path to limits.d directory.

Default value: '/etc/security/limits.d'

limits_d_dir_mode

Data type: Stdlib::Filemode

Mode for limits_d_dir.

Default value: '0750'

purge_limits_d_dir

Data type: Boolean

Boolean to purge the limits.d directory.

Default value: false

purge_limits_d_dir_ignore

Data type: Optional[Variant[String[1], Array[String[1]]]]

A glob or array of file names to ignore when purging limits.d

Default value: undef

pam::pwquality

Manage pwquality.conf

Examples

This class is included by the pam class for platforms which use it.

Parameters

The following parameters are available in the pam::pwquality class:

• config_file
• config_file_owner
• config_file_group
• config_file_mode
• config_file_source
• config_file_template
• config_d_dir
• config_d_dir_owner
• config_d_dir_group
• config_d_dir_mode
• purge_config_d_dir
• purge_config_d_dir_ignore
• difok
• minlen
• dcredit
• ucredit
• lcredit
• ocredit
• minclass
• maxrepeat
• maxsequence
• maxclassrepeat
• gecoscheck
• dictcheck
• usercheck
• usersubstr
• enforcing
• badwords
• dictpath
• retry
• enforce_for_root
• local_users_only

config_file

Data type: Stdlib::Absolutepath

Path to pwquality.conf.

Default value: '/etc/security/pwquality.conf'

config_file_owner

Data type: String[1]

Owner for pwquality.conf

Default value: 'root'

config_file_group

Data type: String[1]

Group for pwquality.conf

Default value: 'root'

config_file_mode

Data type: Stdlib::Filemode

Mode for config_file.

Default value: '0644'

config_file_source

Data type: Optional[Stdlib::Filesource]

String with source path to a pwquality.conf

Default value: undef

config_file_template

Data type: String[1]

Template to render pwquality.conf

Default value: 'pam/pwquality.conf.erb'

config_d_dir

Data type: Stdlib::Absolutepath

Path to pwquality.conf.d directory.

Default value: '/etc/security/pwquality.conf.d'

config_d_dir_owner

Data type: String[1]

Owner for pwquality.conf.d

Default value: 'root'

config_d_dir_group

Data type: String[1]

Group for pwquality.conf.d

Default value: 'root'

config_d_dir_mode

Data type: Stdlib::Filemode

Mode for pwquality.conf.d

Default value: '0755'

purge_config_d_dir

Data type: Boolean

Boolean to purge the pwquality.conf.d directory.

Default value: true

purge_config_d_dir_ignore

Data type: Optional[Variant[String[1], Array[String[1]]]]

A glob or array of file names to ignore when purging pwquality.conf.d

Default value: undef

difok

Data type: Integer[0]

The pwquality.conf 'difok' option

Default value: 1

minlen

Data type: Integer[6]

The pwquality.conf 'minlen' option

Default value: 8

dcredit

Data type: Integer

The pwquality.conf 'dcredit' option

Default value: 0

ucredit

Data type: Integer

The pwquality.conf 'ucredit' option

Default value: 0

lcredit

Data type: Integer

The pwquality.conf 'lcredit' option

Default value: 0

ocredit

Data type: Integer

The pwquality.conf 'ocredit' option

Default value: 0

minclass

Data type: Integer[0]

The pwquality.conf 'minclass' option

Default value: 0

maxrepeat

Data type: Integer[0]

The pwquality.conf 'maxrepeat' option

Default value: 0

maxsequence

Data type: Integer[0]

The pwquality.conf 'maxsequence' option

Default value: 0

maxclassrepeat

Data type: Integer[0]

The pwquality.conf 'maxclassrepeat' option

Default value: 0

gecoscheck

Data type: Integer[0]

The pwquality.conf 'gecoscheck' option

Default value: 0

dictcheck

Data type: Integer[0]

The pwquality.conf 'dictcheck' option

Default value: 1

usercheck

Data type: Integer[0]

The pwquality.conf 'usercheck' option

Default value: 1

usersubstr

Data type: Integer[0]

The pwquality.conf 'usersubstr' option

Default value: 0

enforcing

Data type: Integer[0]

The pwquality.conf 'enforcing' option

Default value: 1

badwords

Data type: Optional[Array[String[1]]]

The pwquality.conf 'badwords' option

Default value: undef

dictpath

Data type: Optional[Stdlib::Absolutepath]

The pwquality.conf 'dictpath' option

Default value: undef

retry

Data type: Integer[0]

The pwquality.conf 'retry' option

Default value: 1

enforce_for_root

Data type: Optional[Boolean]

The pwquality.conf 'enforce_for_root' option

Default value: undef

local_users_only

Data type: Optional[Boolean]

The pwquality.conf 'local_users_only' option

Default value: undef

Defined types

pam::limits::fragment

Places a fragment in $limits_d_dir directory One of the parameters source or list must be set.

Examples

pam::limits::fragment { 'nproc':
  source => 'puppet:///modules/pam/limits.nproc',
}

Parameters

The following parameters are available in the pam::limits::fragment defined type:

• ensure
• source
• list

ensure

Data type: Enum['file', 'present', 'absent']

Ensure attribute for the fragment file.

Default value: 'file'

source

Data type: Optional[String]

Path to the fragment file, such as 'puppet:///modules/pam/limits.nproc'

Default value: undef

list

Data type: Optional[Array]

Array of lines to add to the fragment file.

Default value: undef

pam::service

reversible, so that any service that Puppet has locked using PAM can be unlocked by setting the resource ensure to absent and waiting for the next puppet run.

Examples

pam::service { 'sudo':
  content => 'auth     required       pam_unix2.so',
}

Parameters

The following parameters are available in the pam::service defined type:

• ensure
• pam_config_dir
• content
• lines

ensure

Data type: Enum['present', 'absent']

Specifies if a PAM service file should (present) or should not (absent) exist. The default is set to 'present'

Default value: 'present'

pam_config_dir

Data type: Stdlib::Absolutepath

Path to PAM files.

Default value: '/etc/pam.d'

content

Data type: Optional[String]

Content of the PAM file for the service. The content and lines parameters are mutually exclusive. Not setting either of these parameters will result in an empty service definition file.

Default value: undef

lines

Data type: Optional[Array]

Provides content for the PAM service file as an array of lines. The content and lines parameters are mutually exclusive. Not setting either of these parameters will result in an empty service definition file.

Default value: undef

Change log

All notable changes to this project will be documented in this file. The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

v5.1.0 (2024-03-15)

Full Changelog

Merged pull requests:

• Support managing faillock.conf and pwquality.conf #270 (treydock)

v5.0.0 (2023-12-08)

Full Changelog

Merged pull requests:

• Support Puppet 8 and stdlib 9.x #269 (treydock)

v4.3.0 (2023-07-18)

Full Changelog

Added

• Add examples for pwquality and faillock #267 (treydock)
• Make EOL OS Hiera data accessible via examples directory #265 (treydock)

Merged pull requests:

• Add pam::limits::purge_limits_d_dir_ignore parameter #266 (treydock)

v4.2.0 (2023-07-17)

Full Changelog

Added

• Ensure limits_fragments_hiera_merge is using proper lookup function #263 (treydock)

Merged pull requests:

• Remove support for Vagrant #264 (ghoneycutt)

v4.1.0 (2023-07-17)

Full Changelog

Added

• add parameter to control manamgent of access.conf #262 (treydock)

v4.0.0 (2023-07-14)

Full Changelog

Merged pull requests:

• Numerous updates plus remove EOL OS support #261 (treydock)

v3.10.0 (2023-02-21)

Full Changelog

Merged pull requests:

• Add amazon linux 2 support #259 (treydock)
• Support Ubuntu 22.04 #245 (anders-larsson)

v3.9.0 (2023-01-30)

Full Changelog

Merged pull requests:

• Use tailoredautomation pdk template (cont) #258 (treydock)
• Support EL9 continued #257 (treydock)
• Use tailoredautomation pdk template #255 (ghoneycutt)

v3.8.0 (2022-12-28)

Full Changelog

Fixed

• Missing entries in pam.d/sshd for Ubuntu 16 #241 (gnobironts)

Merged pull requests:

• Add Github Action for release process #253 (treydock)
• Allow pam_access to be used on EL8 #252 (treydock)
• Convert to use PDK and restructure spec tests #243 (anders-larsson)
• Added support for Debian 11 #239 (ZloeSabo)
• Upgrade to GitHub-native Dependabot #235 (dependabot-preview[bot])
• Debian8 eol #232 (ghoneycutt)

v3.8.1 (2022-11-04)

Full Changelog

v3.7.1 (2022-10-18)

Full Changelog

v3.7.0 (2020-11-17)

Full Changelog

Merged pull requests:

• Ubuntu 20.04 #225 (amateo)

v3.6.0 (2020-11-09)

Full Changelog

Added

• Support EL8 #231 (ghoneycutt)

Merged pull requests:

• Fix style issues #228 (ghoneycutt)
• Use correct templates for sshd and login in Debian 10 #220 (thechristschn)

v3.5.0 (2020-03-07)

Full Changelog

Merged pull requests:

• Add support for Debian 10 #217 (thechristschn)

v2.35.0 (2019-11-25)

Full Changelog

v3.4.0 (2019-11-24)

Full Changelog

Merged pull requests:

• (GH-211) Add support for RHEL 8 #213 (ph84172)

v3.3.1 (2019-08-27)

Full Changelog

Merged pull requests:

• Fixed a compatibility issue that effects listsep changes #215 (mears148)

v3.3.0 (2019-05-23)

Full Changelog

Merged pull requests:

• GH-210 Add support for SLES 15 #212 (ph84172)
• Simplify gemfile #209 (ghoneycutt)
• Update json requirement from ~> 2.1.0 to ~> 2.2.0 #208 (dependabot-preview[bot])
• Update json_pure requirement from ~> 2.1.0 to ~> 2.2.0 #207 (dependabot-preview[bot])

v3.2.0 (2019-01-15)

Full Changelog

Added

• Debian9 #206 (ghoneycutt)

Merged pull requests:

• Use SHA512 instead of md5 for for passwords on EL6 and EL7 #196 (synaptis)

v3.1.0 (2019-01-15)

Full Changelog

Merged pull requests:

• Ubuntu1804 #205 (ghoneycutt)
• Validate shell scripts #204 (ghoneycutt)
• Add Vagrant support #203 (ghoneycutt)
• Test with latest (2.1.0) release of trlinkin/nsswitch #202 (ghoneycutt)
• Update json requirement from ~> 1.8.3 to ~> 2.1.0 #201 (dependabot-preview[bot])
• Update rake requirement from ~> 10.0 to ~> 12.3 #200 (dependabot-preview[bot])
• Update json_pure requirement from ~> 1.8.3 to ~> 2.1.0 #199 (dependabot-preview[bot])

v3.0.0 (2018-11-09)

Full Changelog

Merged pull requests:

• Add acceptance tests #191 (treydock)
• Deprecate create_resources() #190 (ghoneycutt)
• Document module #189 (ghoneycutt)
• V3 #179 (ghoneycutt)
• use new readme format #174 (Phil-Friderici)
• Switch to trlinkin/nsswitch for nsswitch dependency #173 (treydock)
• Refactors #172 (Phil-Friderici)
• Replacing lsb* facts for SuSE distros #171 (v4ld3r5)
• Use Hiera 5 module data #170 (treydock)
• Remove VAS logic and create examples that show old behavior #169 (treydock)
• Add example SSSD integration using hiera #143 (jeffmccune)

v2.34.0 (2018-09-18)

Full Changelog

2.34.0 (2018-09-18)

Full Changelog

v2.33.0 (2017-04-20)

Full Changelog

Merged pull requests:

• Restrict users by default per SSH on Debian and Ubuntu distros. #160 (fbarbeira)

v2.32.0 (2017-04-07)

Full Changelog

Merged pull requests:

• Puppet v4.10 #159 (ghoneycutt)

v2.31.0 (2017-02-27)

Full Changelog

Merged pull requests:

• Add support for VAS 4 on Ubuntu 16.04 #153 (ghoneycutt)
• Fix dependencies #150 (ghoneycutt)
• Manage nsswitch #149 (ghoneycutt)

v2.30.0 (2016-10-21)

Full Changelog

v2.29.1 (2016-10-12)

Full Changelog

Merged pull requests:

• Set pam_access on EL7 for sshd and login - treat the same as EL5 and EL6 #116 (treydock)

v2.29.0 (2016-10-04)

Full Changelog

Merged pull requests:

• Prep v2.29.0 #148 (ghoneycutt)
• Add support for Debian 7 #147 (mandos)

v2.28.0 (2016-08-31)

Full Changelog

Merged pull requests:

• Use newer puppetlabs_spec_helper which does strict variable checking #144 (ghoneycutt)

v2.27.0 (2016-08-29)

Full Changelog

Merged pull requests:

• Add template for performing custom sshd pam config #141 (boandersson)

v2.26.0 (2016-08-12)

Full Changelog

Merged pull requests:

• Add support for Ruby 2.3.1 #140 (ghoneycutt)

v2.25.0 (2016-07-21)

Full Changelog

Merged pull requests:

• Added more general support for Debian 8 #139 (ghoneycutt)
• Fix travis #138 (ghoneycutt)

v2.24.0 (2016-06-15)

Full Changelog

Merged pull requests:

• Add Ubuntu 16.04 LTS Support #136 (ghoneycutt)

v2.23.0 (2016-06-14)

Full Changelog

Merged pull requests:

• Improve testing #135 (ghoneycutt)

v2.22.0 (2016-04-08)

Full Changelog

Merged pull requests:

• Satisfy strict variables test #130 (Phil-Friderici)
• El6 password auth support #129 (ghoneycutt)

v1.5.0 (2016-04-07)

Full Changelog

v1.4.0 (2016-02-28)

Full Changelog

v2.21.0 (2016-01-12)

Full Changelog

v2.20.0 (2015-12-16)

Full Changelog

Merged pull requests:

• Future parser and v4 #124 (ghoneycutt)

v1.3.0 (2015-10-26)

Full Changelog

v2.19.1 (2015-06-09)

Full Changelog

Merged pull requests:

• Suse12: Add systemd and pam_envd to common session #111 (anders-larsson)

v2.19.0 (2015-04-15)

Full Changelog

Merged pull requests:

• Add support for OpenSuSE 13.1. #110 (buzzdeee)

v1.2.1 (2015-04-10)

Full Changelog

v2.18.0 (2015-04-07)

Full Changelog

Merged pull requests:

• Make pam::service resources reversible #103 (ghoneycutt)

v2.17.0 (2015-04-02)

Full Changelog

Merged pull requests:

• Add hiera_hash support for limits fragments #106 (jwennerberg)

v2.16.0 (2015-03-31)

Full Changelog

Merged pull requests:

• Add ensure attribute for limits fragment #109 (jwennerberg)
• Update testing and metadata #108 (ghoneycutt)
• Refactored spec tests #104 (ghost)

v2.15.0 (2015-02-05)

Full Changelog

Merged pull requests:

• Trusty #99 (ghoneycutt)

v2.14.0 (2015-02-02)

Full Changelog

Merged pull requests:

• Add SLES10.x support #96 (propyless)

v2.13.0 (2015-01-28)

Full Changelog

Merged pull requests:

• Allow override pam access control flags #93 (ghoneycutt)

v2.12.0 (2015-01-28)

Full Changelog

Merged pull requests:

• Replace lsbmajdistrelease fact check with operatingsystemmajrelease for ... #92 (ghoneycutt)

v2.11.0 (2015-01-28)

Full Changelog

Merged pull requests:

• Order hash for access.conf, useful for Ruby 1.8.7 #91 (ghoneycutt)
• Add ability to optionally purge limits_d #90 (ghoneycutt)
• Epic change in array layout reduces excessive line length that hurts my editor #88 (Aethylred)

v2.10.0 (2014-12-08)

Full Changelog

Merged pull requests:

• Support newer software #87 (ghoneycutt)
• El7 support #85 (ghoneycutt)

v2.9.0-el7 (2014-10-08)

Full Changelog

v2.9.0 (2014-09-30)

Full Changelog

Merged pull requests:

• Add suse 12 support #80 (ghost)
• Add suse 12 support #77 (eabecho)

v2.8.0 (2014-09-30)

Full Changelog

Merged pull requests:

• Add ensure_vas for Solaris 10 #79 (ghost)

v1.2.0 (2014-09-27)

Full Changelog

v2.7.1-el7 (2014-09-10)

Full Changelog

v2.7.1 (2014-08-12)

Full Changelog

Merged pull requests:

• Fix common::mkdir_p usage #69 (ghoneycutt)
• Do not include the common class as not required #68 (treydock)

v2.7.0 (2014-07-19)

Full Changelog

Merged pull requests:

• Access conf support hashes #64 (ghoneycutt)

v2.6.1 (2014-06-01)

Full Changelog

Merged pull requests:

• Fix variable access method in template. #61 (ghoneycutt)

v2.6.0 (2014-05-23)

Full Changelog

Merged pull requests:

• Add ability to specify file modes in pam::limits #59 (ghoneycutt)

v2.5.0 (2014-05-12)

Full Changelog

Merged pull requests:

• Add Solaris 9 support #57 (ghoneycutt)

v2.4.5 (2014-05-02)

Full Changelog

Merged pull requests:

• Support Ruby v1.9.3 and v2.0.0 #56 (ghoneycutt)

v2.4.4 (2014-05-02)

Full Changelog

Merged pull requests:

• Manage limits.d directory #52 (jwennerberg)

v1.1.0 (2014-02-13)

Full Changelog

v2.4.3 (2014-02-05)

Full Changelog

Merged pull requests:

• Improve spec tests - ensure require attribute is tested #51 (ghoneycutt)
• Fixed refrence to pam-package #50 (philippvh)

v2.4.2 (2014-02-01)

Full Changelog

Merged pull requests:

• Support Puppet v3.4 #49 (ghoneycutt)

v2.4.1 (2014-01-28)

Full Changelog

Merged pull requests:

• Prep for 2 4 1 #48 (ghoneycutt)
• Fixed: deprecated variables access in templates #47 (Phil-Friderici)
• Travis #46 (ghoneycutt)
• Support rspec-puppet v1.0.0 #45 (ghoneycutt)

v2.4.0 (2013-12-10)

Full Changelog

Merged pull requests:

• 237 suse support #44 (ghoneycutt)
• Include_class is deprecated. Use contain_class instead. #42 (tbartelmess)
• SuSE/VAS support #41 (ghoneycutt)

v2.3.0 (2013-12-04)

Full Changelog

Merged pull requests:

• WIP #40 (ghoneycutt)
• Add option to enable default pam config for VAS #37 (jwennerberg)

v1.0.0 (2013-12-02)

Full Changelog

v2.2.0 (2013-11-07)

Full Changelog

Merged pull requests:

• Release v2 2 0 #39 (ghoneycutt)
• Add nonfile fragments #38 (ghoneycutt)
• Added rspec content tests, removed tab in sshd el6 template #36 (kentjohansson)
• Add support for Suse 9 #34 (ghoneycutt)
• Add support for Solaris 11 #33 (ghoneycutt)
• Add support for Suse 10 #30 (kentjohansson)
• Add ubuntu 1204lts #29 (ghoneycutt)
• Add support for Suse 11 #27 (jwennerberg)

v2.1.0 (2013-08-26)

Full Changelog

Merged pull requests:

• Release 2.1.0 - Solaris 10 support #26 (ghoneycutt)
• Refactor documentation out of code. #25 (ghoneycutt)
• Solaris support #23 (ghoneycutt)
• Allow ruby 1.9.3 to fail Travis #22 (ghoneycutt)
• Add Travis-ci.org support #21 (ghoneycutt)
• Clean up documentation #18 (ghoneycutt)
• Collab spec tests with marulkan #16 (ghoneycutt)
• Collab spec tests with nyren #13 (ghoneycutt)
• Collab with mwinther spec #8 (ghoneycutt)
• Add more documentation #6 (ghost)
• Docs working with jonathanbower #4 (ghoneycutt)
• First stab to document this module. #3 (jonathanbower)

* This Changelog was automatically generated by github_changelog_generator