Skip to content

Commit ad537ee

Browse files
Use sufficient in remediation for pam_faillock rules
Usage of [success=1 default=ignore] confuses set_password_hashing_algorithm_commonauth rule(it is reported as failed) and remediation for set_password_hashing_algorithm_commonauth adds new pam_unix.so sha512 line. Change to sufficient for pam_unix.so is also added to set_password_hashing_algorithm_commonauth
1 parent ca385f7 commit ad537ee

3 files changed

Lines changed: 6 additions & 5 deletions

File tree

  • linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_commonauth
  • shared/macros

linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_commonauth/bash/shared.sh

Lines changed: 0 additions & 3 deletions
This file was deleted.

linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_commonauth/rule.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,11 @@ template:
5656
vars:
5757
path: /etc/pam.d/common-auth
5858
type: auth
59+
{{% if 'sle' in product %}}
60+
control_flag: sufficient
61+
{{% else %}}
5962
control_flag: required
63+
{{% endif %}}
6064
module: pam_unix.so
6165
arguments:
6266
- argument: sha512

shared/macros/10-bash.jinja

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -854,7 +854,7 @@ fi
854854
bash_ensure_pam_module_configuration(
855855
'/etc/pam.d/common-auth',
856856
'auth',
857-
'\[success=1 default=ignore\]',
857+
'sufficient',
858858
'pam_unix.so',
859859
'',
860860
'',
@@ -2766,7 +2766,7 @@ This macro creates a Bash conditional which checks the system architecture in /p
27662766

27672767

27682768
{{#
2769-
Set a sshd configuration parameter to a value for system with default configuration in /usr subdir
2769+
Set a sshd configuration parameter to a value for system with default configuration in /usr subdir
27702770

27712771
:parameter parameter: Parameter to set
27722772
:type parameter: str

0 commit comments

Comments
 (0)