Skip to content
This repository has been archived by the owner on Feb 21, 2018. It is now read-only.

Updates for amazon linux and best-practice #37

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Updates for amazon linux and best-practice #37

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a651d6b
Updates for amazon linux and add gecos
tinnightcap Jun 14, 2017
085ebf7
Making it work on Amazon and Ubuntu
tinnightcap Jun 14, 2017
891aa68
Unbork packer builds
tinnightcap Jun 16, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion manifests/init.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@
$manage_pam = true,
$pam_unix_control = 'requisite',
$package_version = 'installed',
$send_gecos = '',
) {
if $ikey == '' or $skey == '' or $host == '' {
fail('ikey, skey, and host must all be defined.')
Expand All @@ -39,7 +40,7 @@
$gpg_file = '/etc/pki/rpm-gpg/RPM-GPG-KEY-DUO'

$pam_file = $::operatingsystemrelease ? {
/^5/ => '/etc/pam.d/system-auth',
/^(5|2017)/ => '/etc/pam.d/system-auth',
/^(6|7|2014)/ => '/etc/pam.d/password-auth'
}

Expand Down
47 changes: 45 additions & 2 deletions manifests/pam.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,11 +24,54 @@
changes => [
'set /files/etc/ssh/sshd_config/UsePAM yes',
'set /files/etc/ssh/sshd_config/UseDNS no',
'set /files/etc/ssh/sshd_config/ChallengeResponseAuthentication yes'
],
'set /files/etc/ssh/sshd_config/ChallengeResponseAuthentication yes',
'set /files/etc/ssh/sshd_config/PubkeyAuthentication yes',
'set /files/etc/ssh/sshd_config/PasswordAuthentication no',
'set /files/etc/ssh/sshd_config/AuthenticationMethods "publickey,keyboard-interactive publickey"',
'set /files/etc/ssh/sshd_config/PermitRootLogin no'
],
require => Package[$duo_unix::duo_package],
notify => Service[$duo_unix::ssh_service];
}
case $::osfamily {
'RedHat': {
augeas { 'Duo Security SSH PAM Configuration' :
changes => [
'rm /files/etc/pam.d/sshd/*[type = "auth"][module = "password-auth"]',
'ins 100 after /files/etc/pam.d/sshd/*[type = "auth"][module = "pam_sepermit.so"]',
'set /files/etc/pam.d/sshd/100/type auth',
'set /files/etc/pam.d/sshd/100/control required',
"set /files/etc/pam.d/sshd/100/module ${duo_unix::pam_module}"
],
require => Package[$duo_unix::duo_package],
onlyif => "match /files/etc/pam.d/sshd/*[module = '${duo_unix::pam_module}'] size == 0";
}
}
'Debian': {
augeas { 'Duo Security SSH PAM Configuration' :
changes => [
'ins 100 after /files/etc/pam.d/sshd/include[1]',
'set /files/etc/pam.d/sshd/100/type auth',
'set /files/etc/pam.d/sshd/100/control "[success=1 default=ignore]"',
"set /files/etc/pam.d/sshd/100/module ${duo_unix::pam_module}",
"ins 200 after /files/etc/pam.d/sshd/*[type = 'auth'][module = '${duo_unix::pam_module}']",
'set /files/etc/pam.d/sshd/200/type auth',
'set /files/etc/pam.d/sshd/200/control requisite',
'set /files/etc/pam.d/sshd/200/module pam_deny.so',
'ins 300 after /files/etc/pam.d/sshd/*[type = "auth"][module = "pam_deny.so"]',
'set /files/etc/pam.d/sshd/300/type auth',
'set /files/etc/pam.d/sshd/300/control required',
'set /files/etc/pam.d/sshd/300/module pam_permit.so',
'rm /files/etc/pam.d/sshd/include[1]'
],
require => Package[$duo_unix::duo_package],
onlyif => "match /files/etc/pam.d/sshd/*[module = '${duo_unix::pam_module}'] size == 0";
}
}
default: {
fail("Module ${module_name} does not support ${::osfamily}")
}
}
}

if $duo_unix::manage_pam {
Expand Down
4 changes: 2 additions & 2 deletions manifests/yum.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,10 @@
# Map RedHat 5 to CentOS 5 equivalent releases
if $::operatingsystem == 'Amazon' {
$releasever = $::operatingsystemmajrelease ? {
'2014' => '6Server',
/^(2014|2017)/ => '6Server',
default => undef,
}
$os = $::operatingsystem
$os = 'CentOS'
} elsif ( $::operatingsystem == 'RedHat' and
$::operatingsystemmajrelease == 5 ) {
$os = 'CentOS'
Expand Down
5 changes: 5 additions & 0 deletions templates/duo.conf.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,3 +40,8 @@ groups=<%= @group %>
; HTTP proxy
http_proxy=<%= @http_proxy %>
<% end -%>
<% if @send_gecos != '' -%>

; Send user comment instead of user name
send_gecos=<%= @send_gecos %>
<% end -%>