diff options
| -rw-r--r-- | molecule/default/converge.yml | 2 | ||||
| -rw-r--r-- | roles/password_policy/README.md | 21 | ||||
| -rw-r--r-- | roles/password_policy/defaults/main.yml | 14 | ||||
| -rw-r--r-- | roles/password_policy/meta/argument_specs.yml (renamed from roles/settings/meta/argument_specs.yml) | 26 | ||||
| -rw-r--r-- | roles/password_policy/meta/main.yml (renamed from roles/settings/meta/main.yml) | 4 | ||||
| -rw-r--r-- | roles/password_policy/tasks/main.yml (renamed from roles/settings/tasks/main.yml) | 14 | ||||
| -rw-r--r-- | roles/password_policy/templates/archlinux-pam-pw.j2 (renamed from roles/settings/templates/archlinux-pam-pw.j2) | 24 | ||||
| -rw-r--r-- | roles/password_policy/templates/debian-pam-pw.j2 (renamed from roles/settings/templates/debian-pam-pw.j2) | 24 | ||||
| -rw-r--r-- | roles/password_policy/vars/archlinux.yml | 2 | ||||
| -rw-r--r-- | roles/password_policy/vars/debian.yml | 2 | ||||
| -rw-r--r-- | roles/settings/README.md | 23 | ||||
| -rw-r--r-- | roles/settings/defaults/main.yml | 14 | ||||
| -rw-r--r-- | roles/settings/vars/archlinux.yml | 2 | ||||
| -rw-r--r-- | roles/settings/vars/debian.yml | 2 | ||||
| -rw-r--r-- | site.yml | 6 |
15 files changed, 84 insertions, 96 deletions
diff --git a/molecule/default/converge.yml b/molecule/default/converge.yml index d04d8628..eacb6559 100644 --- a/molecule/default/converge.yml +++ b/molecule/default/converge.yml @@ -15,6 +15,6 @@ - role: network - role: user - role: ssh + - role: password_policy - role: locales - role: timezone - - role: settings diff --git a/roles/password_policy/README.md b/roles/password_policy/README.md new file mode 100644 index 00000000..c499dcdc --- /dev/null +++ b/roles/password_policy/README.md @@ -0,0 +1,21 @@ +# Ansible Role: password_policy + +This role configure the machine password quality policy + +## Role Variables + +- `password_policy_enabled` boolean to enable or disable the enforcement of password policy +- `password_policy_difok` the number of differences between new and old password (default 0 - disabled) +- `password_policy_minlen` min password length (default 8) +- `password_policy_dcredit` required digits in password (default 0) +- `password_policy_ucredit` required uppercase chars in password (default 0) +- `password_policy_ocredit` required other chars in password (default 0) +- `password_policy_lcredit` required lowercase chars in password (default 0) +- `password_policy_minclass` required minimum classes in password upper/lower/digit/other (default 0 - disabled) +- `password_policy_maxrepeat` allowed maximum repeats in password (default 0 - disabled) +- `password_policy_maxclassrepeat` maximum allowed consecutive class repeats (default 0 -disabled) +- `password_policy_gecoscheck` (default 0 - disabled) + +## Docs + +- https://linux.die.net/man/8/pam_pwquality diff --git a/roles/password_policy/defaults/main.yml b/roles/password_policy/defaults/main.yml new file mode 100644 index 00000000..1c5f7254 --- /dev/null +++ b/roles/password_policy/defaults/main.yml @@ -0,0 +1,14 @@ +--- +# Password policy +# https://linux.die.net/man/8/pam_pwquality +password_policy_enabled: true +password_policy_difok: 0 +password_policy_minlen: 8 +password_policy_dcredit: 0 +password_policy_ucredit: 0 +password_policy_ocredit: 0 +password_policy_lcredit: 0 +password_policy_minclass: 0 +password_policy_maxrepeat: 0 +password_policy_maxclassrepeat: 0 +password_policy_gecoscheck: 0 diff --git a/roles/settings/meta/argument_specs.yml b/roles/password_policy/meta/argument_specs.yml index 0507db86..8c312a8c 100644 --- a/roles/settings/meta/argument_specs.yml +++ b/roles/password_policy/meta/argument_specs.yml @@ -2,51 +2,47 @@ argument_specs: main: options: - settings_timezone: - type: "str" - description: "timezone configuration to use" - default: "UTC" - settings_pw_policy_enabled: + password_policy_enabled: type: "bool" description: "Enable password policy" default: true - settings_pw_policy_difok: + password_policy_difok: type: "int" description: "The number of differences between new and old password" default: 0 - settings_pw_policy_minlen: + password_policy_minlen: type: "int" description: "Min password length" default: 8 - settings_pw_policy_dcredit: + password_policy_dcredit: type: "int" description: "Num of digits required in password" default: 0 - settings_pw_policy_ucredit: + password_policy_ucredit: type: "int" description: "Num of uppercase chars required in password" default: 0 - settings_pw_policy_ocredit: + password_policy_ocredit: type: "int" description: "Num of special chars required in password" default: 0 - settings_pw_policy_lcredit: + password_policy_lcredit: type: "int" description: "Num of lowercase chars required in password" default: 0 - settings_pw_policy_minclass: + password_policy_minclass: type: "int" description: "Num of required classes (upper/lower/digit/special) chars required in password" default: 0 - settings_pw_policy_maxrepeat: + password_policy_maxrepeat: type: "int" description: "Num of allowed repeats in password" default: 0 - settings_pw_policy_maxclassrepeat: + password_policy_maxclassrepeat: type: "int" description: "Maximum number of consecutive class repeats in password" default: 0 - settings_pw_policy_gecoscheck: + password_policy_gecoscheck: type: "int" description: | If nonzero, check whether the individual words longer than 3 characters from the diff --git a/roles/settings/meta/main.yml b/roles/password_policy/meta/main.yml index d8070386..fdcf75a1 100644 --- a/roles/settings/meta/main.yml +++ b/roles/password_policy/meta/main.yml @@ -1,9 +1,9 @@ --- dependencies: [] galaxy_info: - role_name: settings + role_name: password_policy author: a14m - description: "Configure the linux distro settings" + description: "Configure the linux distro password policy" company: "kartoffeln.work GmbH." license: "license MIT" min_ansible_version: "2.18" diff --git a/roles/settings/tasks/main.yml b/roles/password_policy/tasks/main.yml index 32fe9178..10aa3837 100644 --- a/roles/settings/tasks/main.yml +++ b/roles/password_policy/tasks/main.yml @@ -2,13 +2,11 @@ - name: "Include OS-specific variables" ansible.builtin.include_vars: "{{ ansible_os_family | lower }}.yml" -- name: "Ensure settings packages are installed" +- name: "Ensure password_policy package is installed" become: true ansible.builtin.package: - name: "{{ item }}" + name: "{{ password_policy_pkg }}" state: "present" - with_items: - - "{{ settings_pw_quality }}" - name: "Configure archlinux password policy" become: true @@ -17,10 +15,6 @@ dest: "/etc/pam.d/system-auth" mode: "0644" when: ansible_os_family == "Archlinux" - # Password policy is technically not required for boot, - # But it's quite nice to configure it for boot and therefore - # enforce the required policies/configurations wanted for the first passwrod change - tags: ["required_for_boot"] - name: "Configure debian password policy" become: true @@ -29,7 +23,3 @@ dest: "/etc/pam.d/common-password" mode: "0644" when: ansible_os_family == "Debian" - # Password policy is technically not required for boot, - # But it's quite nice to configure it for boot and therefore - # enforce the required policies/configurations wanted for the first passwrod change - tags: ["required_for_boot"] diff --git a/roles/settings/templates/archlinux-pam-pw.j2 b/roles/password_policy/templates/archlinux-pam-pw.j2 index 7be41ccb..b5e3914e 100644 --- a/roles/settings/templates/archlinux-pam-pw.j2 +++ b/roles/password_policy/templates/archlinux-pam-pw.j2 @@ -17,26 +17,26 @@ account required pam_unix.so account optional pam_permit.so account required pam_time.so -{% if settings_pw_policy_enabled %} +{% if password_policy_enabled %} -password [success=2 default=ignore] pam_systemd_home.so password requisite pam_pwquality.so retry=3 \ - difok={{ settings_pw_policy_difok }} \ - minlen={{ settings_pw_policy_minlen }} \ - dcredit={{ settings_pw_policy_dcredit }} \ - ucredit={{ settings_pw_policy_ucredit }} \ - ocredit={{ settings_pw_policy_ocredit }} \ - lcredit={{ settings_pw_policy_lcredit }} \ - minclass={{ settings_pw_policy_minclass }} \ - maxrepeat={{ settings_pw_policy_maxrepeat }} \ - maxclassrepeat={{ settings_pw_policy_maxclassrepeat }} \ - gecoscheck={{ settings_pw_policy_gecoscheck }} + difok={{ password_policy_difok }} \ + minlen={{ password_policy_minlen }} \ + dcredit={{ password_policy_dcredit }} \ + ucredit={{ password_policy_ucredit }} \ + ocredit={{ password_policy_ocredit }} \ + lcredit={{ password_policy_lcredit }} \ + minclass={{ password_policy_minclass }} \ + maxrepeat={{ password_policy_maxrepeat }} \ + maxclassrepeat={{ password_policy_maxclassrepeat }} \ + gecoscheck={{ password_policy_gecoscheck }} {% else %} -password [success=1 default=ignore] pam_systemd_home.so {% endif %} password required pam_unix.so try_first_pass \ nullok \ shadow \ - minlen={{ settings_pw_policy_minlen }} + minlen={{ password_policy_minlen }} password optional pam_permit.so -session optional pam_systemd_home.so diff --git a/roles/settings/templates/debian-pam-pw.j2 b/roles/password_policy/templates/debian-pam-pw.j2 index 521b822a..dceedf97 100644 --- a/roles/settings/templates/debian-pam-pw.j2 +++ b/roles/password_policy/templates/debian-pam-pw.j2 @@ -22,21 +22,21 @@ # pam-auth-update(8) for details. # here are the per-package modules (the "Primary" block) -{% if settings_pw_policy_enabled %} +{% if password_policy_enabled %} password requisite pam_pwquality.so retry=3 \ - difok={{ settings_pw_policy_difok }} \ - minlen={{ settings_pw_policy_minlen }} \ - dcredit={{ settings_pw_policy_dcredit }} \ - ucredit={{ settings_pw_policy_ucredit }} \ - ocredit={{ settings_pw_policy_ocredit }} \ - lcredit={{ settings_pw_policy_lcredit }} \ - minclass={{ settings_pw_policy_minclass }} \ - maxrepeat={{ settings_pw_policy_maxrepeat }} \ - maxclassrepeat={{ settings_pw_policy_maxclassrepeat }} \ - gecoscheck={{ settings_pw_policy_gecoscheck }} + difok={{ password_policy_difok }} \ + minlen={{ password_policy_minlen }} \ + dcredit={{ password_policy_dcredit }} \ + ucredit={{ password_policy_ucredit }} \ + ocredit={{ password_policy_ocredit }} \ + lcredit={{ password_policy_lcredit }} \ + minclass={{ password_policy_minclass }} \ + maxrepeat={{ password_policy_maxrepeat }} \ + maxclassrepeat={{ password_policy_maxclassrepeat }} \ + gecoscheck={{ password_policy_gecoscheck }} password [success=1 default=ignore] pam_unix.so obscure use_authtok try_first_pass yescrypt {% else %} -password [success=1 default=ignore] pam_unix.so obsecure sha512 minlen={{ settings_pw_policy_minlen }} +password [success=1 default=ignore] pam_unix.so obsecure sha512 minlen={{ password_policy_minlen }} {% endif %} # here's the fallback if no module succeeds password requisite pam_deny.so diff --git a/roles/password_policy/vars/archlinux.yml b/roles/password_policy/vars/archlinux.yml new file mode 100644 index 00000000..59d439d6 --- /dev/null +++ b/roles/password_policy/vars/archlinux.yml @@ -0,0 +1,2 @@ +--- +password_policy_pkg: "libpwquality" diff --git a/roles/password_policy/vars/debian.yml b/roles/password_policy/vars/debian.yml new file mode 100644 index 00000000..cb52b37d --- /dev/null +++ b/roles/password_policy/vars/debian.yml @@ -0,0 +1,2 @@ +--- +password_policy_pkg: "libpam-pwquality" diff --git a/roles/settings/README.md b/roles/settings/README.md deleted file mode 100644 index 9f6c7bb9..00000000 --- a/roles/settings/README.md +++ /dev/null @@ -1,23 +0,0 @@ -# Ansible Role: settings - -This role configure the machine settings (locales/timezone/password policy/etc.) - -## Role Variables - -- `settings_timezone` the timezone default `CET` - -- `settings_pw_policy_enabled` boolean to enable or disable the enforcement of password policy -- `settings_pw_policy_difok` the number of differences between new and old password (default 0 - disabled) -- `settings_pw_policy_minlen` min password length (default 8) -- `settings_pw_policy_dcredit` required digits in password (default 0) -- `settings_pw_policy_ucredit` required uppercase chars in password (default 0) -- `settings_pw_policy_ocredit` required other chars in password (default 0) -- `settings_pw_policy_lcredit` required lowercase chars in password (default 0) -- `settings_pw_policy_minclass` required minimum classes in password upper/lower/digit/other (default 0 - disabled) -- `settings_pw_policy_maxrepeat` allowed maximum repeats in password (default 0 - disabled) -- `settings_pw_policy_maxclassrepeat` maximum allowed consecutive class repeats (default 0 -disabled) -- `settings_pw_policy_gecoscheck` (default 0 - disabled) - -## Docs - -- https://linux.die.net/man/8/pam_pwquality diff --git a/roles/settings/defaults/main.yml b/roles/settings/defaults/main.yml deleted file mode 100644 index a7001ab0..00000000 --- a/roles/settings/defaults/main.yml +++ /dev/null @@ -1,14 +0,0 @@ ---- -# Password policy -# https://linux.die.net/man/8/pam_pwquality -settings_pw_policy_enabled: true -settings_pw_policy_difok: 0 -settings_pw_policy_minlen: 8 -settings_pw_policy_dcredit: 0 -settings_pw_policy_ucredit: 0 -settings_pw_policy_ocredit: 0 -settings_pw_policy_lcredit: 0 -settings_pw_policy_minclass: 0 -settings_pw_policy_maxrepeat: 0 -settings_pw_policy_maxclassrepeat: 0 -settings_pw_policy_gecoscheck: 0 diff --git a/roles/settings/vars/archlinux.yml b/roles/settings/vars/archlinux.yml deleted file mode 100644 index cbe08e80..00000000 --- a/roles/settings/vars/archlinux.yml +++ /dev/null @@ -1,2 +0,0 @@ ---- -settings_pw_quality: "libpwquality" diff --git a/roles/settings/vars/debian.yml b/roles/settings/vars/debian.yml deleted file mode 100644 index 6767ffd7..00000000 --- a/roles/settings/vars/debian.yml +++ /dev/null @@ -1,2 +0,0 @@ ---- -settings_pw_quality: "libpam-pwquality" @@ -11,9 +11,13 @@ tags: ["required_for_boot"] - role: "ssh" tags: ["required_for_boot"] + - role: "password_policy" + # Password policy is technically not required for boot, + # But it's quite nice to configure it for boot and therefore + # enforce the required policies/configurations wanted for the first passwrod change + tags: ["required_for_boot"] - role: "locales" - role: "timezone" - - role: "settings" pre_tasks: - name: "Update package cache" |