Puppet PAM Module

Introduction

Puppet module to manage PAM configuration.

Usage

Class pam::pamd

No module configuration

class { 'pam::pamd': }

Ldap module

If you want pam_ldap:

class { 'pam::pamd': pam_ldap => true, } Or even if you need a specific behavoir on auth:

class { 'pam::pamd': pam_ldap => true, pam_ldap_auth => '[success=1 default=ignore] pam_ldap.so use_first_pass' }

Note: otherwise, pam_ldap_auth defaults to 'sufficient pam_ldap.so use_first_pass'

Notes

Tested on

• Debian: Etch / Squeeze / Wheezy
• Redhat: 5.x / 6.x
• OVS: 2.x / 3.x
• OpenSuSE 12.x / SLES 11.x

Tested PAM Modules:

• pam_ldap
• pam_tally
• pam_tally2

Requirements

• If pam_ldap is enabled (pam_ldap => true) you'll need puppet-ldap
• If enable_motd is enabled (enable_motd => true) you'll need puppet-motd

TODO

• Testing was done only on pam_ldap parameters

CopyLeft

Copyleft (C) 2012 Emiliano Castagnari ecastag@gmail.com (a.k.a. Torian)

2013-05-28 - Version 0.0.7

• added support for pam_tally / pam_tally2

2013-04-30 - Version 0.0.6

• Added support for rhel 6.x (password-auth-ac)
• fixed typo when evaluating $pam_ldapd ($pam::pam_ldapd) at pam::pamd()

2013-04-29 - Version 0.0.5

• bugfix: ensure => symlink to ensure => link.
• bugfix: Redhat: real file system-auth-ac.
• added support for OVS
• added support for OpenSuSE 12.x SLES 11.x
• packages required by pam_ldap => true are now managed by pam::pamd()

2013-04-27 - Version 0.0.4

• Complete rewrite / interface changes
• class pam::pamd handles configuration inside /etc/pam.d
• pam modules are enabled by pam<module_name> parameters and configured via pam_ (account, auth, password, session where applicable)
  • pam_ldap
  • pam_ldapd
  • pam_tally
  • pam_tally2
  • pam_cracklib
  • pam_mkhomedir
• If pam_ldap => true in pam::pamd() create a symlink to /etc/{ldap,openldap}/ldap.conf (debian / redhat). This requires the use of ldap module.

2013-04-17 - Version 0.0.3

• moved pam.d files to templates

2013-04-10 - Version 0.0.2

• Udo Waechter u.waechter@mysportgroup.de
  • adding pam_mkhomedir.so
  • fixing download paths for pam.d/ in debian

2013-03-20 - version 0.0.1

• Initial commit