From ed40cb82f7fe59f6584309553f5619c263f8c64f Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Fri, 12 Jul 2019 12:17:12 +0200 Subject: [PATCH 1/3] factory: tighten PAM configuration Apparently PAM reacts differently on different systems (?) and if no authoritative matching module is found might either succeed/fail, depending on the system. Let's lock this down explicitly, by hooking in pam_deny.so. Of course, these PAM files are just examples, and no distro in its right mind would ship these unmodified, but let's default to something safe. Fixes: #12950 --- factory/etc/pam.d/system-auth | 3 +++ 1 file changed, 3 insertions(+) diff --git a/factory/etc/pam.d/system-auth b/factory/etc/pam.d/system-auth index dec7a8f017..d988233d1c 100644 --- a/factory/etc/pam.d/system-auth +++ b/factory/etc/pam.d/system-auth @@ -1,11 +1,14 @@ # This file is part of systemd. auth sufficient pam_unix.so nullok try_first_pass +auth required pam_deny.so account required pam_nologin.so account sufficient pam_unix.so +account required pam_permit.so password sufficient pam_unix.so nullok sha512 shadow try_first_pass try_authtok +password required pam_deny.so -session optional pam_loginuid.so -session optional pam_systemd.so From 29d30ae7b6f8d87223d9e9a32fd9d27e218cc7fc Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Fri, 12 Jul 2019 12:20:11 +0200 Subject: [PATCH 2/3] factory: add comment to PAM file, explaining that the defaults are not useful --- factory/etc/pam.d/system-auth | 3 +++ 1 file changed, 3 insertions(+) diff --git a/factory/etc/pam.d/system-auth b/factory/etc/pam.d/system-auth index d988233d1c..9342dd1ccf 100644 --- a/factory/etc/pam.d/system-auth +++ b/factory/etc/pam.d/system-auth @@ -1,5 +1,8 @@ # This file is part of systemd. +# You really want to adjust this to your local distribution. If you use this +# unmodified you are not building systems safely and securely. + auth sufficient pam_unix.so nullok try_first_pass auth required pam_deny.so From 4c92bf408db4f91928389c49bf06cfe5d7383d9a Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Fri, 12 Jul 2019 12:48:51 +0200 Subject: [PATCH 3/3] factory: include pam_keyinit.so in PAM factory configuration We use the keyring, so let's make sure it gets properly initialized for sessions in factory reset mode. --- factory/etc/pam.d/system-auth | 1 + 1 file changed, 1 insertion(+) diff --git a/factory/etc/pam.d/system-auth b/factory/etc/pam.d/system-auth index 9342dd1ccf..747efc1fbd 100644 --- a/factory/etc/pam.d/system-auth +++ b/factory/etc/pam.d/system-auth @@ -13,6 +13,7 @@ account required pam_permit.so password sufficient pam_unix.so nullok sha512 shadow try_first_pass try_authtok password required pam_deny.so +-session optional pam_keyinit.so revoke -session optional pam_loginuid.so -session optional pam_systemd.so session sufficient pam_unix.so