diff options
| author | Lennart Poettering <lennart@poettering.net> | 2019-07-12 12:17:12 +0200 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2019-07-13 11:06:24 +0200 |
| commit | ed40cb82f7fe59f6584309553f5619c263f8c64f (patch) | |
| tree | 3fb1326c368014bc6b585c3a1b4aac547bfabe38 /factory | |
| parent | alloc-util: drop _alloc_ decorator from memdup_suffix0() (diff) | |
| download | systemd-ed40cb82f7fe59f6584309553f5619c263f8c64f.tar.xz systemd-ed40cb82f7fe59f6584309553f5619c263f8c64f.zip | |
factory: tighten PAM configuration
Apparently PAM reacts differently on different systems (?) and if no
authoritative matching module is found might either succeed/fail,
depending on the system.
Let's lock this down explicitly, by hooking in pam_deny.so.
Of course, these PAM files are just examples, and no distro in its right
mind would ship these unmodified, but let's default to something safe.
Fixes: #12950
Diffstat (limited to 'factory')
| -rw-r--r-- | factory/etc/pam.d/system-auth | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/factory/etc/pam.d/system-auth b/factory/etc/pam.d/system-auth index dec7a8f017..d988233d1c 100644 --- a/factory/etc/pam.d/system-auth +++ b/factory/etc/pam.d/system-auth @@ -1,11 +1,14 @@ # This file is part of systemd. auth sufficient pam_unix.so nullok try_first_pass +auth required pam_deny.so account required pam_nologin.so account sufficient pam_unix.so +account required pam_permit.so password sufficient pam_unix.so nullok sha512 shadow try_first_pass try_authtok +password required pam_deny.so -session optional pam_loginuid.so -session optional pam_systemd.so |