Skip to content

Commit 03ec647

Browse files
kamunaskamunas
committed
added templates for debian 12
restored pam data and templates for debian 10 support
1 parent dffa455 commit 03ec647

17 files changed

+230
-3
lines changed

‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -277,6 +277,7 @@ module aims to support the current and previous major Puppet versions.
277277
* Amazon Linux 2
278278
* Debian 10
279279
* Debian 11
280+
* Debian 12
280281
* Ubuntu 20.04 LTS
281282
* Ubuntu 22.04 LTS
282283

‎data/os/Debian/10.yaml

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
pam::common_files_create_links: false
3+
pam::common_files_suffix: ~
4+
pam::common_files:
5+
- common_account
6+
- common_auth
7+
- common_password
8+
- common_session
9+
- common_session_noninteractive
10+
11+
pam::pam_d_login_template: pam/login.debian10.erb
12+
pam::pam_d_sshd_template: pam/sshd.debian10.erb
13+
pam::package_name: libpam0g
14+
pam::pam_auth_lines:
15+
- 'auth [success=1 default=ignore] pam_unix.so nullok_secure'
16+
- 'auth requisite pam_deny.so'
17+
- 'auth required pam_permit.so'
18+
pam::pam_account_lines:
19+
- 'account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so'
20+
- 'account requisite pam_deny.so'
21+
- 'account required pam_permit.so'
22+
pam::pam_password_lines:
23+
- 'password [success=1 default=ignore] pam_unix.so obscure sha512'
24+
- 'password requisite pam_deny.so'
25+
- 'password required pam_permit.so'
26+
pam::pam_session_lines:
27+
- 'session [default=1] pam_permit.so'
28+
- 'session requisite pam_deny.so'
29+
- 'session required pam_permit.so'
30+
- 'session required pam_unix.so'
31+
- 'session optional pam_systemd.so'

‎data/os/Debian/12.yaml

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
pam::common_files_create_links: false
3+
pam::common_files_suffix: ~
4+
pam::common_files:
5+
- common_account
6+
- common_auth
7+
- common_password
8+
- common_session
9+
- common_session_noninteractive
10+
11+
pam::pam_d_login_template: pam/login.debian12.erb
12+
pam::pam_d_sshd_template: pam/sshd.debian12.erb
13+
pam::package_name: libpam0g
14+
pam::pam_auth_lines:
15+
- 'auth [success=1 default=ignore] pam_unix.so nullok'
16+
- 'auth requisite pam_deny.so'
17+
- 'auth required pam_permit.so'
18+
pam::pam_account_lines:
19+
- 'account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so'
20+
- 'account requisite pam_deny.so'
21+
- 'account required pam_permit.so'
22+
pam::pam_password_lines:
23+
- 'password [success=1 default=ignore] pam_unix.so obscure yescrypt'
24+
- 'password requisite pam_deny.so'
25+
- 'password required pam_permit.so'
26+
pam::pam_session_lines:
27+
- 'session [default=1] pam_permit.so'
28+
- 'session requisite pam_deny.so'
29+
- 'session required pam_permit.so'
30+
- 'session required pam_unix.so'
31+
- 'session optional pam_systemd.so'

‎manifests/init.pp

+2-2
Original file line numberDiff line numberDiff line change
@@ -266,8 +266,8 @@
266266
fail("osfamily Suse's os.release.major is <${::facts['os']['release']['major']}> and must be 9, 10, 11, 12, 13 or 15")
267267
}
268268

269-
if $facts['os']['name'] == 'Debian' and !($facts['os']['release']['major'] in ['7','8','9','10', '11']) {
270-
fail("Debian's os.release.major is <${facts['os']['release']['major']}> and must be 7, 8, 9, 10 or 11")
269+
if $facts['os']['name'] == 'Debian' and !($facts['os']['release']['major'] in ['7','8','9','10','11','12']) {
270+
fail("Debian's os.release.major is <${facts['os']['release']['major']}> and must be 7, 8, 9, 10, 11 or 12")
271271
}
272272

273273
if $facts['os']['name'] == 'Ubuntu' and !($facts['os']['release']['major'] in ['12.04', '14.04', '16.04', '18.04', '20.04', '22.04']) {

‎metadata.json

+2-1
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,8 @@
2727
{
2828
"operatingsystem": "Debian",
2929
"operatingsystemrelease": [
30-
"11"
30+
"11",
31+
"12"
3132
]
3233
},
3334
{

‎spec/acceptance/nodesets/debian-12.yml

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
HOSTS:
2+
debian11:
3+
roles:
4+
- agent
5+
platform: debian-12-amd64
6+
hypervisor: docker
7+
image: debian:12
8+
docker_preserve_image: true
9+
docker_cmd:
10+
- '/sbin/init'
11+
docker_image_commands:
12+
- 'apt-get install -y wget net-tools systemd-sysv locales apt-transport-https ca-certificates'
13+
- 'echo "LC_ALL=en_US.UTF-8" >> /etc/environment'
14+
- 'echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen'
15+
- 'echo "LANG=en_US.UTF-8" > /etc/locale.conf'
16+
- 'locale-gen en_US.UTF-8'
17+
docker_env:
18+
- LANG=en_US.UTF-8
19+
- LANGUAGE=en_US.UTF-8
20+
- LC_ALL=en_US.UTF-8
21+
docker_container_name: 'pam-debian12'
22+
CONFIG:
23+
log_level: debug
24+
type: foss
25+
ssh:
26+
password: root
27+
auth_methods: ["password"]

‎spec/fixtures/debian-12-x86_64-pam_common_account

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# This file is being maintained by Puppet.
2+
# DO NOT EDIT
3+
account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so
4+
account requisite pam_deny.so
5+
account required pam_permit.so

‎spec/fixtures/debian-12-x86_64-pam_common_auth

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# This file is being maintained by Puppet.
2+
# DO NOT EDIT
3+
auth [success=1 default=ignore] pam_unix.so nullok
4+
auth requisite pam_deny.so
5+
auth required pam_permit.so

‎spec/fixtures/debian-12-x86_64-pam_common_password

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# This file is being maintained by Puppet.
2+
# DO NOT EDIT
3+
password [success=1 default=ignore] pam_unix.so obscure yescrypt
4+
password requisite pam_deny.so
5+
password required pam_permit.so

‎spec/fixtures/debian-12-x86_64-pam_common_session

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# This file is being maintained by Puppet.
2+
# DO NOT EDIT
3+
session [default=1] pam_permit.so
4+
session requisite pam_deny.so
5+
session required pam_permit.so
6+
session required pam_unix.so
7+
session optional pam_systemd.so

‎spec/fixtures/debian-12-x86_64-pam_common_session_noninteractive

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# This file is being maintained by Puppet.
2+
# DO NOT EDIT
3+
session [default=1] pam_permit.so
4+
session requisite pam_deny.so
5+
session required pam_permit.so
6+
session required pam_unix.so
7+
session optional pam_systemd.so

‎spec/fixtures/debian-12-x86_64-pam_d_login

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
auth optional pam_faildelay.so delay=3000000
2+
auth requisite pam_nologin.so
3+
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
4+
session required pam_loginuid.so
5+
session optional pam_motd.so motd=/run/motd.dynamic
6+
session optional pam_motd.so noupdate
7+
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
8+
session required pam_env.so readenv=1
9+
session required pam_env.so readenv=1 envfile=/etc/default/locale
10+
@include common-auth
11+
auth optional pam_group.so
12+
session required pam_limits.so
13+
session optional pam_lastlog.so
14+
session optional pam_mail.so standard
15+
session optional pam_keyinit.so force revoke
16+
@include common-account
17+
@include common-session
18+
@include common-password

‎spec/fixtures/debian-12-x86_64-pam_d_sshd

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
@include common-auth
2+
account required pam_nologin.so
3+
account required pam_access.so
4+
@include common-account
5+
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
6+
session required pam_loginuid.so
7+
session optional pam_keyinit.so force revoke
8+
@include common-session
9+
session optional pam_motd.so motd=/run/motd.dynamic
10+
session optional pam_motd.so noupdate
11+
session optional pam_mail.so standard noenv # [1]
12+
session required pam_limits.so
13+
session required pam_env.so # [1]
14+
session required pam_env.so user_readenv=1 envfile=/etc/default/locale
15+
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
16+
@include common-password

‎templates/login.debian10.erb

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
auth optional pam_faildelay.so delay=3000000
2+
auth [success=ok new_authtok_reqd=ok ignore=ignore user_unknown=bad default=die] pam_securetty.so
3+
auth requisite pam_nologin.so
4+
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
5+
session required pam_loginuid.so
6+
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
7+
session required pam_env.so readenv=1
8+
session required pam_env.so readenv=1 envfile=/etc/default/locale
9+
@include common-auth
10+
auth optional pam_group.so
11+
session required pam_limits.so
12+
session optional pam_lastlog.so
13+
session optional pam_motd.so motd=/run/motd.dynamic
14+
session optional pam_motd.so noupdate
15+
session optional pam_mail.so standard
16+
session optional pam_keyinit.so force revoke
17+
@include common-account
18+
@include common-session
19+
@include common-password

‎templates/login.debian12.erb

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
auth optional pam_faildelay.so delay=3000000
2+
auth requisite pam_nologin.so
3+
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
4+
session required pam_loginuid.so
5+
session optional pam_motd.so motd=/run/motd.dynamic
6+
session optional pam_motd.so noupdate
7+
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
8+
session required pam_env.so readenv=1
9+
session required pam_env.so readenv=1 envfile=/etc/default/locale
10+
@include common-auth
11+
auth optional pam_group.so
12+
session required pam_limits.so
13+
session optional pam_lastlog.so
14+
session optional pam_mail.so standard
15+
session optional pam_keyinit.so force revoke
16+
@include common-account
17+
@include common-session
18+
@include common-password

‎templates/sshd.debian10.erb

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
@include common-auth
2+
account required pam_nologin.so
3+
<% if @sshd_pam_access != 'absent' -%>
4+
account <%= @sshd_pam_access %> pam_access.so
5+
<% end -%>
6+
@include common-account
7+
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
8+
session required pam_loginuid.so
9+
session optional pam_keyinit.so force revoke
10+
@include common-session
11+
session optional pam_motd.so motd=/run/motd.dynamic
12+
session optional pam_motd.so noupdate
13+
session optional pam_mail.so standard noenv # [1]
14+
session required pam_limits.so
15+
session required pam_env.so # [1]
16+
session required pam_env.so user_readenv=1 envfile=/etc/default/locale
17+
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
18+
@include common-password

‎templates/sshd.debian12.erb

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
@include common-auth
2+
account required pam_nologin.so
3+
<% if @sshd_pam_access != 'absent' -%>
4+
account <%= @sshd_pam_access %> pam_access.so
5+
<% end -%>
6+
@include common-account
7+
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
8+
session required pam_loginuid.so
9+
session optional pam_keyinit.so force revoke
10+
@include common-session
11+
session optional pam_motd.so motd=/run/motd.dynamic
12+
session optional pam_motd.so noupdate
13+
session optional pam_mail.so standard noenv # [1]
14+
session required pam_limits.so
15+
session required pam_env.so # [1]
16+
session required pam_env.so user_readenv=1 envfile=/etc/default/locale
17+
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
18+
@include common-password

0 commit comments

Comments
 (0)