Tentative semplification on pam configuration.

This commit is contained in:
Emiliano Vavassori 2015-07-28 22:19:44 +02:00
parent acf552e999
commit e64b0ef44c
3 changed files with 97 additions and 99 deletions

View File

@ -7,48 +7,48 @@
# common-auth # common-auth
- name: 'common-auth: modifica pam_unix' #- name: 'common-auth: modifica pam_unix'
replace: # replace:
dest: /etc/pam.d/common-auth # dest: /etc/pam.d/common-auth
regexp: '^.*pam_unix\.so.*nullok_secure$' # regexp: '^.*pam_unix\.so.*nullok_secure$'
replace: 'auth [success=1 default=ignore] pam_unix.so nullok_secure use_first_pass' # replace: 'auth [success=1 default=ignore] pam_unix.so nullok_secure use_first_pass'
backup: yes # backup: yes
sudo: yes # sudo: yes
#
- name: 'common-auth: aggiunta pam_winbind' #- name: 'common-auth: aggiunta pam_winbind'
lineinfile: # lineinfile:
dest: /etc/pam.d/common-auth # dest: /etc/pam.d/common-auth
regexp: '^auth.*pam_winbind\.so$' # regexp: '^auth.*pam_winbind\.so$'
insertbefore: '^auth.*pam_unix\.so' # insertbefore: '^auth.*pam_unix\.so'
line: 'auth [success=2 default=ignore] pam_winbind.so' # line: 'auth [success=2 default=ignore] pam_winbind.so'
state: present # state: present
sudo: yes # sudo: yes
#
- name: 'common-auth: rimuovo config auto pam_winbind' #- name: 'common-auth: rimuovo config auto pam_winbind'
lineinfile: # lineinfile:
dest: /etc/pam.d/common-auth # dest: /etc/pam.d/common-auth
regexp: 'pam_winbind\.so krb5' # regexp: 'pam_winbind\.so krb5'
state: absent # state: absent
sudo: yes # sudo: yes
#
# common-password ## common-password
#
- name: 'common-password: configurazione pam_unix' #- name: 'common-password: configurazione pam_unix'
replace: # replace:
dest: /etc/pam.d/common-password # dest: /etc/pam.d/common-password
regexp: '^(password.*pam_unix\.so.*sha512)$' # regexp: '^(password.*pam_unix\.so.*sha512)$'
replace: '\1 min=4 max=20' # replace: '\1 min=4 max=20'
backup: yes # backup: yes
sudo: yes # sudo: yes
#
# common-session ## common-session
#
- name: 'common-session: configurazione pam_mkhomedir' #- name: 'common-session: configurazione pam_mkhomedir'
lineinfile: # lineinfile:
dest: /etc/pam.d/common-session # dest: /etc/pam.d/common-session
regexp: '^session.*pam_mkhomedir\.so.*$' # regexp: '^session.*pam_mkhomedir\.so.*$'
insertafter: '^session\s*required.*pam_permit.so' # insertafter: '^session\s*required.*pam_permit.so'
line: 'session required pam_mkhomedir.so umask=0022 skel=/etc/skel silent' # line: 'session required pam_mkhomedir.so umask=0022 skel=/etc/skel silent'
state: present # state: present
backup: yes # backup: yes
sudo: yes # sudo: yes

View File

@ -9,24 +9,24 @@
template: src=pam_mount.conf.xml dest=/etc/security/pam_mount.conf.xml backup=yes template: src=pam_mount.conf.xml dest=/etc/security/pam_mount.conf.xml backup=yes
sudo: yes sudo: yes
- name: Creazione directory di default per Condiviso #- name: Creazione directory di default per Condiviso
file: path=/etc/skel/Condiviso state=directory # file: path=/etc/skel/Condiviso state=directory
sudo: yes # sudo: yes
- name: 'common-auth: aggiunta pam_mount' #- name: 'common-auth: aggiunta pam_mount'
lineinfile: # lineinfile:
dest: /etc/pam.d/common-auth # dest: /etc/pam.d/common-auth
regexp: '^auth.*pam_mount\.so$' # regexp: '^auth.*pam_mount\.so$'
insertafter: EOF # insertafter: EOF
line: 'auth optional pam_mount.so' # line: 'auth optional pam_mount.so'
state: present # state: present
sudo: yes # sudo: yes
#
- name: 'common-session: aggiunta pam_mount' #- name: 'common-session: aggiunta pam_mount'
lineinfile: # lineinfile:
dest: /etc/pam.d/common-session # dest: /etc/pam.d/common-session
regexp: '^session.*pam_mount\.so$' # regexp: '^session.*pam_mount\.so$'
insertafter: 'session.*pam_winbind\.so' # insertafter: 'session.*pam_winbind\.so'
line: 'session optional pam_mount.so' # line: 'session optional pam_mount.so'
state: present # state: present
sudo: yes # sudo: yes

View File

@ -5,26 +5,26 @@
--> -->
<pam_mount> <pam_mount>
<!--
<!-- debug should come before everything else, debug should come before everything else, since this file is still
since this file is still processed in a single pass processed in a single pass from top-to-bottom
from top-to-bottom --> -->
<debug enable="0" /> <debug enable="0" />
<!-- Volume definitions --> <!-- Volume definitions -->
<volume user="*" sgrp="domain users" fstype="cifs" server="{{ server }}" path="%(USER)" mountpoint="~" options="iocharset=utf8,file_mode=0644,dir_mode=0755" /> <volume user="*" sgrp="domain users" fstype="cifs" server="{{ server }}" path="%(USER)" mountpoint="~" options="iocharset=utf8,file_mode=0644,dir_mode=0755" />
<volume user="*" fstype="cifs" server="{{ server }}" path="shared" mountpoint="~/Condiviso" options="iocharset=utf8,file_mode=0664,dir_mode=0775" /> <volume user="*" sgrp="domain users" fstype="cifs" server="{{ server }}" path="shared" mountpoint="~/Condiviso" options="iocharset=utf8,file_mode=0664,dir_mode=0775" />
<!-- pam_mount parameters: General tunables --> <!-- pam_mount parameters: General tunables -->
<!-- <!--
<luserconf name=".pam_mount.conf.xml" /> <luserconf name=".pam_mount.conf.xml" />
--> -->
<!-- Note that commenting out mntoptions will give you the defaults. <!--
Note that commenting out mntoptions will give you the defaults.
You will need to explicitly initialize it with the empty string You will need to explicitly initialize it with the empty string
to reset the defaults to nothing. --> to reset the defaults to nothing.
-->
<mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" /> <mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" />
<!-- <!--
<mntoptions deny="suid,dev" /> <mntoptions deny="suid,dev" />
@ -33,13 +33,11 @@
--> -->
<mntoptions require="nosuid,nodev" /> <mntoptions require="nosuid,nodev" />
<logout wait="0" hup="0" term="0" kill="0" /> <logout wait="10" hup="0" term="0" kill="0" />
<!-- pam_mount parameters: Volume-related --> <!-- pam_mount parameters: Volume-related -->
<mkmountpoint enable="1" remove="false" />
<mkmountpoint enable="1" remove="true" />
</pam_mount> </pam_mount>
<!-- {{ ansible_managed }} --> <!--
{{ ansible_managed }}
-->