Tentative semplification on pam configuration.
This commit is contained in:
parent
acf552e999
commit
e64b0ef44c
@ -7,48 +7,48 @@
|
|||||||
|
|
||||||
# common-auth
|
# common-auth
|
||||||
|
|
||||||
- name: 'common-auth: modifica pam_unix'
|
#- name: 'common-auth: modifica pam_unix'
|
||||||
replace:
|
# replace:
|
||||||
dest: /etc/pam.d/common-auth
|
# dest: /etc/pam.d/common-auth
|
||||||
regexp: '^.*pam_unix\.so.*nullok_secure$'
|
# regexp: '^.*pam_unix\.so.*nullok_secure$'
|
||||||
replace: 'auth [success=1 default=ignore] pam_unix.so nullok_secure use_first_pass'
|
# replace: 'auth [success=1 default=ignore] pam_unix.so nullok_secure use_first_pass'
|
||||||
backup: yes
|
# backup: yes
|
||||||
sudo: yes
|
# sudo: yes
|
||||||
|
#
|
||||||
- name: 'common-auth: aggiunta pam_winbind'
|
#- name: 'common-auth: aggiunta pam_winbind'
|
||||||
lineinfile:
|
# lineinfile:
|
||||||
dest: /etc/pam.d/common-auth
|
# dest: /etc/pam.d/common-auth
|
||||||
regexp: '^auth.*pam_winbind\.so$'
|
# regexp: '^auth.*pam_winbind\.so$'
|
||||||
insertbefore: '^auth.*pam_unix\.so'
|
# insertbefore: '^auth.*pam_unix\.so'
|
||||||
line: 'auth [success=2 default=ignore] pam_winbind.so'
|
# line: 'auth [success=2 default=ignore] pam_winbind.so'
|
||||||
state: present
|
# state: present
|
||||||
sudo: yes
|
# sudo: yes
|
||||||
|
#
|
||||||
- name: 'common-auth: rimuovo config auto pam_winbind'
|
#- name: 'common-auth: rimuovo config auto pam_winbind'
|
||||||
lineinfile:
|
# lineinfile:
|
||||||
dest: /etc/pam.d/common-auth
|
# dest: /etc/pam.d/common-auth
|
||||||
regexp: 'pam_winbind\.so krb5'
|
# regexp: 'pam_winbind\.so krb5'
|
||||||
state: absent
|
# state: absent
|
||||||
sudo: yes
|
# sudo: yes
|
||||||
|
#
|
||||||
# common-password
|
## common-password
|
||||||
|
#
|
||||||
- name: 'common-password: configurazione pam_unix'
|
#- name: 'common-password: configurazione pam_unix'
|
||||||
replace:
|
# replace:
|
||||||
dest: /etc/pam.d/common-password
|
# dest: /etc/pam.d/common-password
|
||||||
regexp: '^(password.*pam_unix\.so.*sha512)$'
|
# regexp: '^(password.*pam_unix\.so.*sha512)$'
|
||||||
replace: '\1 min=4 max=20'
|
# replace: '\1 min=4 max=20'
|
||||||
backup: yes
|
# backup: yes
|
||||||
sudo: yes
|
# sudo: yes
|
||||||
|
#
|
||||||
# common-session
|
## common-session
|
||||||
|
#
|
||||||
- name: 'common-session: configurazione pam_mkhomedir'
|
#- name: 'common-session: configurazione pam_mkhomedir'
|
||||||
lineinfile:
|
# lineinfile:
|
||||||
dest: /etc/pam.d/common-session
|
# dest: /etc/pam.d/common-session
|
||||||
regexp: '^session.*pam_mkhomedir\.so.*$'
|
# regexp: '^session.*pam_mkhomedir\.so.*$'
|
||||||
insertafter: '^session\s*required.*pam_permit.so'
|
# insertafter: '^session\s*required.*pam_permit.so'
|
||||||
line: 'session required pam_mkhomedir.so umask=0022 skel=/etc/skel silent'
|
# line: 'session required pam_mkhomedir.so umask=0022 skel=/etc/skel silent'
|
||||||
state: present
|
# state: present
|
||||||
backup: yes
|
# backup: yes
|
||||||
sudo: yes
|
# sudo: yes
|
||||||
|
@ -9,24 +9,24 @@
|
|||||||
template: src=pam_mount.conf.xml dest=/etc/security/pam_mount.conf.xml backup=yes
|
template: src=pam_mount.conf.xml dest=/etc/security/pam_mount.conf.xml backup=yes
|
||||||
sudo: yes
|
sudo: yes
|
||||||
|
|
||||||
- name: Creazione directory di default per Condiviso
|
#- name: Creazione directory di default per Condiviso
|
||||||
file: path=/etc/skel/Condiviso state=directory
|
# file: path=/etc/skel/Condiviso state=directory
|
||||||
sudo: yes
|
# sudo: yes
|
||||||
|
|
||||||
- name: 'common-auth: aggiunta pam_mount'
|
#- name: 'common-auth: aggiunta pam_mount'
|
||||||
lineinfile:
|
# lineinfile:
|
||||||
dest: /etc/pam.d/common-auth
|
# dest: /etc/pam.d/common-auth
|
||||||
regexp: '^auth.*pam_mount\.so$'
|
# regexp: '^auth.*pam_mount\.so$'
|
||||||
insertafter: EOF
|
# insertafter: EOF
|
||||||
line: 'auth optional pam_mount.so'
|
# line: 'auth optional pam_mount.so'
|
||||||
state: present
|
# state: present
|
||||||
sudo: yes
|
# sudo: yes
|
||||||
|
#
|
||||||
- name: 'common-session: aggiunta pam_mount'
|
#- name: 'common-session: aggiunta pam_mount'
|
||||||
lineinfile:
|
# lineinfile:
|
||||||
dest: /etc/pam.d/common-session
|
# dest: /etc/pam.d/common-session
|
||||||
regexp: '^session.*pam_mount\.so$'
|
# regexp: '^session.*pam_mount\.so$'
|
||||||
insertafter: 'session.*pam_winbind\.so'
|
# insertafter: 'session.*pam_winbind\.so'
|
||||||
line: 'session optional pam_mount.so'
|
# line: 'session optional pam_mount.so'
|
||||||
state: present
|
# state: present
|
||||||
sudo: yes
|
# sudo: yes
|
||||||
|
@ -1,45 +1,43 @@
|
|||||||
<?xml version="1.0" encoding="utf-8" ?>
|
<?xml version="1.0" encoding="utf-8" ?>
|
||||||
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
|
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
|
||||||
<!--
|
<!--
|
||||||
See pam_mount.conf(5) for a description.
|
See pam_mount.conf(5) for a description.
|
||||||
-->
|
-->
|
||||||
|
|
||||||
<pam_mount>
|
<pam_mount>
|
||||||
|
<!--
|
||||||
|
debug should come before everything else, since this file is still
|
||||||
|
processed in a single pass from top-to-bottom
|
||||||
|
-->
|
||||||
|
<debug enable="0" />
|
||||||
|
|
||||||
<!-- debug should come before everything else,
|
<!-- Volume definitions -->
|
||||||
since this file is still processed in a single pass
|
<volume user="*" sgrp="domain users" fstype="cifs" server="{{ server }}" path="%(USER)" mountpoint="~" options="iocharset=utf8,file_mode=0644,dir_mode=0755" />
|
||||||
from top-to-bottom -->
|
<volume user="*" sgrp="domain users" fstype="cifs" server="{{ server }}" path="shared" mountpoint="~/Condiviso" options="iocharset=utf8,file_mode=0664,dir_mode=0775" />
|
||||||
|
|
||||||
<debug enable="0" />
|
<!-- pam_mount parameters: General tunables -->
|
||||||
|
<!--
|
||||||
|
<luserconf name=".pam_mount.conf.xml" />
|
||||||
|
-->
|
||||||
|
|
||||||
<!-- Volume definitions -->
|
<!--
|
||||||
<volume user="*" sgrp="domain users" fstype="cifs" server="{{ server }}" path="%(USER)" mountpoint="~" options="iocharset=utf8,file_mode=0644,dir_mode=0755" />
|
Note that commenting out mntoptions will give you the defaults.
|
||||||
<volume user="*" fstype="cifs" server="{{ server }}" path="shared" mountpoint="~/Condiviso" options="iocharset=utf8,file_mode=0664,dir_mode=0775" />
|
You will need to explicitly initialize it with the empty string
|
||||||
|
to reset the defaults to nothing.
|
||||||
<!-- pam_mount parameters: General tunables -->
|
-->
|
||||||
|
<mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" />
|
||||||
<!--
|
<!--
|
||||||
<luserconf name=".pam_mount.conf.xml" />
|
<mntoptions deny="suid,dev" />
|
||||||
-->
|
<mntoptions allow="*" />
|
||||||
|
<mntoptions deny="*" />
|
||||||
<!-- Note that commenting out mntoptions will give you the defaults.
|
-->
|
||||||
You will need to explicitly initialize it with the empty string
|
<mntoptions require="nosuid,nodev" />
|
||||||
to reset the defaults to nothing. -->
|
|
||||||
<mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" />
|
|
||||||
<!--
|
|
||||||
<mntoptions deny="suid,dev" />
|
|
||||||
<mntoptions allow="*" />
|
|
||||||
<mntoptions deny="*" />
|
|
||||||
-->
|
|
||||||
<mntoptions require="nosuid,nodev" />
|
|
||||||
|
|
||||||
<logout wait="0" hup="0" term="0" kill="0" />
|
|
||||||
|
|
||||||
|
|
||||||
<!-- pam_mount parameters: Volume-related -->
|
|
||||||
|
|
||||||
<mkmountpoint enable="1" remove="true" />
|
|
||||||
|
|
||||||
|
<logout wait="10" hup="0" term="0" kill="0" />
|
||||||
|
|
||||||
|
<!-- pam_mount parameters: Volume-related -->
|
||||||
|
<mkmountpoint enable="1" remove="false" />
|
||||||
</pam_mount>
|
</pam_mount>
|
||||||
<!-- {{ ansible_managed }} -->
|
<!--
|
||||||
|
{{ ansible_managed }}
|
||||||
|
-->
|
||||||
|
Loading…
x
Reference in New Issue
Block a user