diff --git a/roles/domain/tasks/pam_base.yml b/roles/domain/tasks/pam_base.yml index 283f09e..b0e8b00 100644 --- a/roles/domain/tasks/pam_base.yml +++ b/roles/domain/tasks/pam_base.yml @@ -7,48 +7,48 @@ # common-auth -- name: 'common-auth: modifica pam_unix' - replace: - dest: /etc/pam.d/common-auth - regexp: '^.*pam_unix\.so.*nullok_secure$' - replace: 'auth [success=1 default=ignore] pam_unix.so nullok_secure use_first_pass' - backup: yes - sudo: yes - -- name: 'common-auth: aggiunta pam_winbind' - lineinfile: - dest: /etc/pam.d/common-auth - regexp: '^auth.*pam_winbind\.so$' - insertbefore: '^auth.*pam_unix\.so' - line: 'auth [success=2 default=ignore] pam_winbind.so' - state: present - sudo: yes - -- name: 'common-auth: rimuovo config auto pam_winbind' - lineinfile: - dest: /etc/pam.d/common-auth - regexp: 'pam_winbind\.so krb5' - state: absent - sudo: yes - -# common-password - -- name: 'common-password: configurazione pam_unix' - replace: - dest: /etc/pam.d/common-password - regexp: '^(password.*pam_unix\.so.*sha512)$' - replace: '\1 min=4 max=20' - backup: yes - sudo: yes - -# common-session - -- name: 'common-session: configurazione pam_mkhomedir' - lineinfile: - dest: /etc/pam.d/common-session - regexp: '^session.*pam_mkhomedir\.so.*$' - insertafter: '^session\s*required.*pam_permit.so' - line: 'session required pam_mkhomedir.so umask=0022 skel=/etc/skel silent' - state: present - backup: yes - sudo: yes +#- name: 'common-auth: modifica pam_unix' +# replace: +# dest: /etc/pam.d/common-auth +# regexp: '^.*pam_unix\.so.*nullok_secure$' +# replace: 'auth [success=1 default=ignore] pam_unix.so nullok_secure use_first_pass' +# backup: yes +# sudo: yes +# +#- name: 'common-auth: aggiunta pam_winbind' +# lineinfile: +# dest: /etc/pam.d/common-auth +# regexp: '^auth.*pam_winbind\.so$' +# insertbefore: '^auth.*pam_unix\.so' +# line: 'auth [success=2 default=ignore] pam_winbind.so' +# state: present +# sudo: yes +# +#- name: 'common-auth: rimuovo config auto pam_winbind' +# lineinfile: +# dest: /etc/pam.d/common-auth +# regexp: 'pam_winbind\.so krb5' +# state: absent +# sudo: yes +# +## common-password +# +#- name: 'common-password: configurazione pam_unix' +# replace: +# dest: /etc/pam.d/common-password +# regexp: '^(password.*pam_unix\.so.*sha512)$' +# replace: '\1 min=4 max=20' +# backup: yes +# sudo: yes +# +## common-session +# +#- name: 'common-session: configurazione pam_mkhomedir' +# lineinfile: +# dest: /etc/pam.d/common-session +# regexp: '^session.*pam_mkhomedir\.so.*$' +# insertafter: '^session\s*required.*pam_permit.so' +# line: 'session required pam_mkhomedir.so umask=0022 skel=/etc/skel silent' +# state: present +# backup: yes +# sudo: yes diff --git a/roles/domain/tasks/pam_mount.yml b/roles/domain/tasks/pam_mount.yml index 4846260..1b62a92 100644 --- a/roles/domain/tasks/pam_mount.yml +++ b/roles/domain/tasks/pam_mount.yml @@ -9,24 +9,24 @@ template: src=pam_mount.conf.xml dest=/etc/security/pam_mount.conf.xml backup=yes sudo: yes -- name: Creazione directory di default per Condiviso - file: path=/etc/skel/Condiviso state=directory - sudo: yes + #- name: Creazione directory di default per Condiviso + # file: path=/etc/skel/Condiviso state=directory + # sudo: yes -- name: 'common-auth: aggiunta pam_mount' - lineinfile: - dest: /etc/pam.d/common-auth - regexp: '^auth.*pam_mount\.so$' - insertafter: EOF - line: 'auth optional pam_mount.so' - state: present - sudo: yes - -- name: 'common-session: aggiunta pam_mount' - lineinfile: - dest: /etc/pam.d/common-session - regexp: '^session.*pam_mount\.so$' - insertafter: 'session.*pam_winbind\.so' - line: 'session optional pam_mount.so' - state: present - sudo: yes + #- name: 'common-auth: aggiunta pam_mount' + # lineinfile: + # dest: /etc/pam.d/common-auth + # regexp: '^auth.*pam_mount\.so$' + # insertafter: EOF + # line: 'auth optional pam_mount.so' + # state: present + # sudo: yes + # + #- name: 'common-session: aggiunta pam_mount' + # lineinfile: + # dest: /etc/pam.d/common-session + # regexp: '^session.*pam_mount\.so$' + # insertafter: 'session.*pam_winbind\.so' + # line: 'session optional pam_mount.so' + # state: present + # sudo: yes diff --git a/roles/domain/templates/pam_mount.conf.xml b/roles/domain/templates/pam_mount.conf.xml index 15e5e18..7ded0ab 100644 --- a/roles/domain/templates/pam_mount.conf.xml +++ b/roles/domain/templates/pam_mount.conf.xml @@ -1,45 +1,43 @@ <?xml version="1.0" encoding="utf-8" ?> <!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd"> <!-- - See pam_mount.conf(5) for a description. + See pam_mount.conf(5) for a description. --> <pam_mount> + <!-- + debug should come before everything else, since this file is still +processed in a single pass from top-to-bottom + --> + <debug enable="0" /> - <!-- debug should come before everything else, - since this file is still processed in a single pass - from top-to-bottom --> + <!-- Volume definitions --> + <volume user="*" sgrp="domain users" fstype="cifs" server="{{ server }}" path="%(USER)" mountpoint="~" options="iocharset=utf8,file_mode=0644,dir_mode=0755" /> + <volume user="*" sgrp="domain users" fstype="cifs" server="{{ server }}" path="shared" mountpoint="~/Condiviso" options="iocharset=utf8,file_mode=0664,dir_mode=0775" /> -<debug enable="0" /> - - <!-- Volume definitions --> - <volume user="*" sgrp="domain users" fstype="cifs" server="{{ server }}" path="%(USER)" mountpoint="~" options="iocharset=utf8,file_mode=0644,dir_mode=0755" /> - <volume user="*" fstype="cifs" server="{{ server }}" path="shared" mountpoint="~/Condiviso" options="iocharset=utf8,file_mode=0664,dir_mode=0775" /> - - <!-- pam_mount parameters: General tunables --> - -<!-- -<luserconf name=".pam_mount.conf.xml" /> ---> - -<!-- Note that commenting out mntoptions will give you the defaults. - You will need to explicitly initialize it with the empty string - to reset the defaults to nothing. --> -<mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" /> -<!-- -<mntoptions deny="suid,dev" /> -<mntoptions allow="*" /> -<mntoptions deny="*" /> ---> -<mntoptions require="nosuid,nodev" /> - -<logout wait="0" hup="0" term="0" kill="0" /> - - - <!-- pam_mount parameters: Volume-related --> - -<mkmountpoint enable="1" remove="true" /> + <!-- pam_mount parameters: General tunables --> + <!-- + <luserconf name=".pam_mount.conf.xml" /> + --> + <!-- + Note that commenting out mntoptions will give you the defaults. + You will need to explicitly initialize it with the empty string + to reset the defaults to nothing. + --> + <mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" /> + <!-- + <mntoptions deny="suid,dev" /> + <mntoptions allow="*" /> + <mntoptions deny="*" /> + --> + <mntoptions require="nosuid,nodev" /> + <logout wait="10" hup="0" term="0" kill="0" /> + + <!-- pam_mount parameters: Volume-related --> + <mkmountpoint enable="1" remove="false" /> </pam_mount> -<!-- {{ ansible_managed }} --> +<!-- +{{ ansible_managed }} +-->