Patch 5.4.2 to ensure account module using pam_faillock.so setup #8
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Tony Ng <[email protected]>
tonystaark
force-pushed
the
5.4.2_update
branch
from
6cdc279 to
3e7f534
Compare
|
Thank you for your help. Please proceed to merge the PR. |
Merged
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Signed-off-by: Tony Ng [email protected]
Overall Review of Changes:
According to CIS AL2 Benchmark v2.0.0, for rule 5.4.2, the following line should be configured for system-auth :
/etc/pam.d/system-auth:account required pam_faillock.soand similiarly for password-auth files :
/etc/pam.d/spassword-auth:account required pam_faillock.soHowever, upon turning on Ansible rule for 5.4.2, the above 2 lines are not seen.
Issue Fixes:
This PR is to add the lines above in the files. It also makes sure the line is positioned on the first line under the account module for each file, as mentioned in the benchmark report.
How has this been tested?:
Tested with our STG environment machines and the result shows the expected here:
/etc/pam.d/spassword-auth:account:
/etc/pam.d/system-auth:account :
