Tentative semplification on pam configuration.

This commit is contained in:
Emiliano Vavassori 2015-07-28 22:19:44 +02:00
parent acf552e999
commit e64b0ef44c
3 changed files with 97 additions and 99 deletions

View File

@ -7,48 +7,48 @@
# common-auth
- name: 'common-auth: modifica pam_unix'
replace:
dest: /etc/pam.d/common-auth
regexp: '^.*pam_unix\.so.*nullok_secure$'
replace: 'auth [success=1 default=ignore] pam_unix.so nullok_secure use_first_pass'
backup: yes
sudo: yes
- name: 'common-auth: aggiunta pam_winbind'
lineinfile:
dest: /etc/pam.d/common-auth
regexp: '^auth.*pam_winbind\.so$'
insertbefore: '^auth.*pam_unix\.so'
line: 'auth [success=2 default=ignore] pam_winbind.so'
state: present
sudo: yes
- name: 'common-auth: rimuovo config auto pam_winbind'
lineinfile:
dest: /etc/pam.d/common-auth
regexp: 'pam_winbind\.so krb5'
state: absent
sudo: yes
# common-password
- name: 'common-password: configurazione pam_unix'
replace:
dest: /etc/pam.d/common-password
regexp: '^(password.*pam_unix\.so.*sha512)$'
replace: '\1 min=4 max=20'
backup: yes
sudo: yes
# common-session
- name: 'common-session: configurazione pam_mkhomedir'
lineinfile:
dest: /etc/pam.d/common-session
regexp: '^session.*pam_mkhomedir\.so.*$'
insertafter: '^session\s*required.*pam_permit.so'
line: 'session required pam_mkhomedir.so umask=0022 skel=/etc/skel silent'
state: present
backup: yes
sudo: yes
#- name: 'common-auth: modifica pam_unix'
# replace:
# dest: /etc/pam.d/common-auth
# regexp: '^.*pam_unix\.so.*nullok_secure$'
# replace: 'auth [success=1 default=ignore] pam_unix.so nullok_secure use_first_pass'
# backup: yes
# sudo: yes
#
#- name: 'common-auth: aggiunta pam_winbind'
# lineinfile:
# dest: /etc/pam.d/common-auth
# regexp: '^auth.*pam_winbind\.so$'
# insertbefore: '^auth.*pam_unix\.so'
# line: 'auth [success=2 default=ignore] pam_winbind.so'
# state: present
# sudo: yes
#
#- name: 'common-auth: rimuovo config auto pam_winbind'
# lineinfile:
# dest: /etc/pam.d/common-auth
# regexp: 'pam_winbind\.so krb5'
# state: absent
# sudo: yes
#
## common-password
#
#- name: 'common-password: configurazione pam_unix'
# replace:
# dest: /etc/pam.d/common-password
# regexp: '^(password.*pam_unix\.so.*sha512)$'
# replace: '\1 min=4 max=20'
# backup: yes
# sudo: yes
#
## common-session
#
#- name: 'common-session: configurazione pam_mkhomedir'
# lineinfile:
# dest: /etc/pam.d/common-session
# regexp: '^session.*pam_mkhomedir\.so.*$'
# insertafter: '^session\s*required.*pam_permit.so'
# line: 'session required pam_mkhomedir.so umask=0022 skel=/etc/skel silent'
# state: present
# backup: yes
# sudo: yes

View File

@ -9,24 +9,24 @@
template: src=pam_mount.conf.xml dest=/etc/security/pam_mount.conf.xml backup=yes
sudo: yes
- name: Creazione directory di default per Condiviso
file: path=/etc/skel/Condiviso state=directory
sudo: yes
#- name: Creazione directory di default per Condiviso
# file: path=/etc/skel/Condiviso state=directory
# sudo: yes
- name: 'common-auth: aggiunta pam_mount'
lineinfile:
dest: /etc/pam.d/common-auth
regexp: '^auth.*pam_mount\.so$'
insertafter: EOF
line: 'auth optional pam_mount.so'
state: present
sudo: yes
- name: 'common-session: aggiunta pam_mount'
lineinfile:
dest: /etc/pam.d/common-session
regexp: '^session.*pam_mount\.so$'
insertafter: 'session.*pam_winbind\.so'
line: 'session optional pam_mount.so'
state: present
sudo: yes
#- name: 'common-auth: aggiunta pam_mount'
# lineinfile:
# dest: /etc/pam.d/common-auth
# regexp: '^auth.*pam_mount\.so$'
# insertafter: EOF
# line: 'auth optional pam_mount.so'
# state: present
# sudo: yes
#
#- name: 'common-session: aggiunta pam_mount'
# lineinfile:
# dest: /etc/pam.d/common-session
# regexp: '^session.*pam_mount\.so$'
# insertafter: 'session.*pam_winbind\.so'
# line: 'session optional pam_mount.so'
# state: present
# sudo: yes

View File

@ -1,45 +1,43 @@
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
<!--
See pam_mount.conf(5) for a description.
See pam_mount.conf(5) for a description.
-->
<pam_mount>
<!--
debug should come before everything else, since this file is still
processed in a single pass from top-to-bottom
-->
<debug enable="0" />
<!-- debug should come before everything else,
since this file is still processed in a single pass
from top-to-bottom -->
<!-- Volume definitions -->
<volume user="*" sgrp="domain users" fstype="cifs" server="{{ server }}" path="%(USER)" mountpoint="~" options="iocharset=utf8,file_mode=0644,dir_mode=0755" />
<volume user="*" sgrp="domain users" fstype="cifs" server="{{ server }}" path="shared" mountpoint="~/Condiviso" options="iocharset=utf8,file_mode=0664,dir_mode=0775" />
<debug enable="0" />
<!-- Volume definitions -->
<volume user="*" sgrp="domain users" fstype="cifs" server="{{ server }}" path="%(USER)" mountpoint="~" options="iocharset=utf8,file_mode=0644,dir_mode=0755" />
<volume user="*" fstype="cifs" server="{{ server }}" path="shared" mountpoint="~/Condiviso" options="iocharset=utf8,file_mode=0664,dir_mode=0775" />
<!-- pam_mount parameters: General tunables -->
<!--
<luserconf name=".pam_mount.conf.xml" />
-->
<!-- Note that commenting out mntoptions will give you the defaults.
You will need to explicitly initialize it with the empty string
to reset the defaults to nothing. -->
<mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" />
<!--
<mntoptions deny="suid,dev" />
<mntoptions allow="*" />
<mntoptions deny="*" />
-->
<mntoptions require="nosuid,nodev" />
<logout wait="0" hup="0" term="0" kill="0" />
<!-- pam_mount parameters: Volume-related -->
<mkmountpoint enable="1" remove="true" />
<!-- pam_mount parameters: General tunables -->
<!--
<luserconf name=".pam_mount.conf.xml" />
-->
<!--
Note that commenting out mntoptions will give you the defaults.
You will need to explicitly initialize it with the empty string
to reset the defaults to nothing.
-->
<mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" />
<!--
<mntoptions deny="suid,dev" />
<mntoptions allow="*" />
<mntoptions deny="*" />
-->
<mntoptions require="nosuid,nodev" />
<logout wait="10" hup="0" term="0" kill="0" />
<!-- pam_mount parameters: Volume-related -->
<mkmountpoint enable="1" remove="false" />
</pam_mount>
<!-- {{ ansible_managed }} -->
<!--
{{ ansible_managed }}
-->