Changeset 154

Show
Ignore:
Timestamp:
01/08/08 08:08:26 (11 months ago)
Author:
slawrence
Message:

Fix rpm/kickstart pam differences

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • trunk/RHEL5.1/conf/pam/login.pam

    r59 r154  
    88#ACCOUNT------------------------------------------------------------------- 
    99account    include      system-auth 
     10account    required     pam_access.so 
    1011 
    1112#PASSWORD ---------------------------------------------------------------- 

  • trunk/RHEL5.1/conf/pam/sshd.pam

    r63 r154  
    44 
    55account    include      system-auth 
     6account    required     pam_access.so 
    67 
    78password   include      system-auth 

  • trunk/RHEL5.1/conf/pam/system-auth.pam

    r73 r154  
    33# User changes will be destroyed the next time authconfig is run. 
    44#5 login attempts within 30 seconds.  Locked out for 60 seconds if fail 
    5 auth        required      pam_tally3.so deny=5 deny_interval=30 onerr=fail unlock_time=60 quiet 
     5auth        required      pam_tally3.so deny=3 deny_interval=30 onerr=fail unlock_time=900 quiet 
    66 
    77auth        required      pam_env.so 
    …… 
    1010account     required      pam_unix.so 
    1111account     required      pam_tally3.so 
    12 password    required      pam_cracklib.so try_first_pass retry=3 minlen=12 difok=3 dcredit=1 ucredit=1 ocredit=2 lcredit=0 
     12password    required      pam_cracklib.so try_first_pass retry=3 minlen=12 difok=3 dcredit=-2 ucredit=-2 ocredit=-2 lcredit=-2 
    1313password    required      pam_unix.so md5 shadow nullok try_first_pass use_authtok remember=12 
    1414 

  • trunk/RHEL5.1/kickstart/clip.ks

    r152 r154  
    331331## failed logon attempts for an account, the account is locked for 15 minutes or until 
    332332## the SA unlocks the account. 
    333 sed -i '/^auth.*pam_deny/ a\ 
    334 auth\t   required\t  /lib/security/$ISA/pam_tally.so onerr=fail no_magic_root' /etc/pam.d/system-auth 
    335 sed -i '/^account.*pam_unix/ a\ 
    336 account\t required\t  /lib/security/$ISA/pam_tally.so per_user deny=3 no_magic_root reset' /etc/pam.d/system-auth 
     333cat <<-EOF > /etc/pam.d/system-auth 
     334#%PAM-1.0 
     335auth        required      pam_tally.so deny=3 onerr=fail unlock_time=900 quiet 
     336 
     337auth        required      pam_env.so 
     338auth        required      pam_unix.so nullok try_first_pass audit 
     339 
     340account     required      pam_unix.so 
     341account     required      pam_tally.so 
     342password    required      pam_cracklib.so try_first_pass retry=3 minlen=12 difok=3 dcredit=-2 ucredit=-2 ocredit=-2 lcredit=-2 
     343password    required      pam_unix.so md5 shadow nullok try_first_pass use_authtok remember=12 
     344 
     345session     optional      pam_keyinit.so revoke 
     346session     required      pam_limits.so 
     347session     required      pam_unix.so 
     348EOF 
     349chmod ugo-x /usr/sbin/authconfig 
    337350 
    338351## (GEN000480: CAT II) (Previously – G015) The SA will ensure the logon delay between 
    …… 
    368381## (GEN000600: CAT II) (Previously – G019) The IAO will ensure passwords include at 
    369382## least two alphabetic characters, one of which must be capitalized. 
    370 sed -i s/minlen\=8/minlen\=9/ /etc/pam.d/system-auth 
    371 sed -i "s/difok\=3/difok\=3 dcredit\=-2 ucredit\=-2 ocredit\=-2 lcredit\=-2/" /etc/pam.d/system-auth 
    372 # Running the authconfig tool WILL clobber these changes! 
    373 # Taking the executable permissions off of /usr/sbin/authconfig 
    374 chmod ugo-x /usr/sbin/authconfig 
     383# See GEN000460 
    375384 
    376385## (GEN000700: CAT II) (Previously – G020) The SA will ensure passwords are 
    …… 
    380389## (GEN000800: CAT II) (Previously – G606) The SA will ensure passwords will not be 
    381390## reused within the last ten changes. 
    382 sed -i "s/shadow/shadow remember\=10/" /etc/pam.d/system-auth 
     391# See GEN000460 
    383392 
    384393## (GEN000920: CAT II) (Previously – G023) The SA will ensure the root account 
    …… 
    396405## user to root. 
    397406# Configure sshd and login to consult pam_access.so 
    398 sed -i '/^account/ a\account\t\trequired\tpam_access.so' /etc/pam.d/sshd 
    399 sed -i '/^account.*auth$/ a\account\t   required\tpam_access.so' /etc/pam.d/login 
    400 # Configure pam_access to refuse direct logins for accounts not in users group 
    401 sed -i '/^# All other/d' /etc/security/access.conf 
    402 echo "# Restrict direct login to accounts in the users group" >> /etc/security/access.conf 
     407sed -i '/^account.*auth$/ a\account\t\trequired\tpam_access.so' /etc/pam.d/sshd 
     408sed -i '/^account.*auth$/ a\account\t\trequired\tpam_access.so' /etc/pam.d/login 
    403409echo "-:ALL EXCEPT users :ALL" >> /etc/security/access.conf 
    404 # Add a User who is in the users group allowing access to the system 
    405410adduser -G users,wheel clipuser 
    406411echo "123)(*qweASD" | passwd --stdin clipuser 
    407 # Cron was previously set to use /etc/security/access.conf, which did 
    408 # nothing by default. We don't want to block root from using cron. 
    409 # So, we create a blank config file and direct crond to use that instead. 
    410 touch /etc/security/access-cron.conf 
    411 chmod 644 /etc/security/access-cron.conf 
    412 sed -i 's/pam_access.so/pam_access.so\ accessfile=\/etc\/security\/access-cron.conf/' /etc/pam.d/crond 
    413412 
    414413## (GEN001080: CAT III) (Previously – G229) The SA will ensure the root shell 
    …… 
    656655## unauthorized access attempts to files (unsuccessful) 
    657656cat <<-EOF >> /etc/audit/audit.rules 
    658         -a exit,always -S open -F success!=0 
     657        -a exit,always -S open -F success=0 
    659658        -a exit,always -S mknod -F success=0 
    660659        -a exit,always -S pipe -F success=0 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen000460.sh

    r115 r154  
    88echo '                     failed attempts per account' 
    99echo '===================================================' 
    10 sed -i '/^auth.*pam_deny/ a\ 
    11 auth\t   required\t  /lib/security/$ISA/pam_tally.so onerr=fail no_magic_root' /etc/pam.d/system-auth 
     10cat <<-EOF > /etc/pam.d/system-auth 
     11#%PAM-1.0 
     12auth       required      pam_tally.so deny=3 onerr=fail unlock_time=900 quiet 
    1213 
    13 sed -i '/^account.*pam_unix/ a\ 
    14 account\t required\t  /lib/security/$ISA/pam_tally.so per_user deny=3 no_magic_root reset' /etc/pam.d/system-auth 
     14auth        required      pam_env.so 
     15auth        required      pam_unix.so nullok try_first_pass audit 
     16 
     17account     required      pam_unix.so 
     18account     required     pam_tally.so 
     19password    required      pam_cracklib.so try_first_pass retry=3 minlen=12 difok=3 dcredit=-2 ucredit=-2 ocredit=-2 lcredit=-2 
     20password    required      pam_unix.so md5 shadow nullok try_first_pass use_authtok remember=12 
     21 
     22session     optional      pam_keyinit.so revoke 
     23session     required      pam_limits.so 
     24session     required      pam_unix.so 
     25EOF 
     26 
     27# auth config overwrites these changes, make it non executable 
     28chmod ugo-x /usr/sbin/authconfig 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen000600.sh

    r115 r154  
    66echo ' Patching GEN000600: Enforce more secure passwords.' 
    77echo '===================================================' 
    8 sed -i s/minlen\=8/minlen\=9/ /etc/pam.d/system-auth 
    9 sed -i "s/difok\=3/difok\=3 dcredit\=-2 ucredit\=-2 ocredit\=-2 lcredit\=-2/" /etc/pam.d/system-auth 
    10  
    11 # Running the authconfig tool WILL clobber these changes! 
    12 # Taking the executable permissions off of /usr/sbin/authconfig 
    13  
    14 chmod ugo-x /usr/sbin/authconfig 
     8# See GEN000460 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen000800.sh

    r115 r154  
    66echo ' Patching GEN000800: Disallow duplication passwords.' 
    77echo '===================================================' 
    8 sed -i "s/shadow/shadow remember\=10/" /etc/pam.d/system-auth 
     8# See GEN000460 

  • trunk/RHEL5.1/scripts/stig-fix/cat2/gen001020.sh

    r152 r154  
    88echo '                     via switch from user account.' 
    99echo '===================================================' 
    10 # Configure sshd and login to consult pam_access.so 
    11 sed -i '/^account/ a\account\t\trequired\tpam_access.so' /etc/pam.d/sshd 
    12 sed -i '/^account.*auth$/ a\account\t   required\tpam_access.so' /etc/pam.d/login 
    13  
    14 # Configure pam_access to refuse direct logins for accounts not in users group 
    15 sed -i '/^# All other/d' /etc/security/access.conf 
    16 echo "# Restrict direct login to accounts in the "users" group 
    17 -:ALL EXCEPT users :ALL" >> /etc/security/access.conf 
     10sed -i '/^account.*auth$/ a\account\t\trequired\tpam_access.so' /etc/pam.d/sshd 
     11sed -i '/^account.*auth$/ a\account\t\trequired\tpam_access.so' /etc/pam.d/login 
     12echo "-:ALL EXCEPT users :ALL" >> /etc/security/access.conf 
    1813 
    1914# Add a User who is in the users group allowing access to the system 
    2015/usr/sbin/adduser -G users,wheel clipuser 
    2116echo "123)(*qweASD" | passwd --stdin clipuser 
    22  
    23 # Cron was previously set to use /etc/security/access.conf, which did 
    24 # nothing by default. We don't want to block root from using cron. 
    25 # So, we create a blank config file and direct crond to use that instead. 
    26 touch /etc/security/access-cron.conf 
    27 chmod 644 /etc/security/access-cron.conf 
    28 sed -i 's/pam_access.so/pam_access.so\ accessfile=\/etc\/security\/access-cron.conf/' /etc/pam.d/crond 
    29  
    30