<% node['config_disclaimer'].to_s.split("\n").each do |l| %> # <%= l %> <% end %> #--- #%PAM-1.0 auth required pam_faillock.so preauth audit silent deny=<%= node['os-hardening']['auth']['retries'] %> unlock_time=<%= node['os-hardening']['auth']['lockout_time'] %> auth required pam_env.so auth [success=1 default=bad] pam_unix.so auth [default=die] pam_faillock.so authfail audit deny=<%= node['os-hardening']['auth']['retries'] %> unlock_time=<%= node['os-hardening']['auth']['lockout_time'] %> auth sufficient pam_faillock.so authsucc audit deny=<%= node['os-hardening']['auth']['retries'] %> unlock_time=<%= node['os-hardening']['auth']['lockout_time'] %> auth requisite pam_succeed_if.so uid >= 500 quiet auth required pam_deny.so <% if node['os-hardening']['auth']['retries'] > 0 %> account required pam_faillock.so <% end %> account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 500 quiet account required pam_permit.so <% if node['os-hardening']['auth']['pam']['passwdqc']['enable'] %> password requisite pam_passwdqc.so <%= node['os-hardening']['auth']['pam']['passwdqc']['options'] %> <% elsif node['os-hardening']['auth']['pam']['pwquality']['enable'] %> password requisite pam_pwquality.so <%= node['os-hardening']['auth']['pam']['pwquality']['options'] %> <% else %> password requisite pam_cracklib.so <%= node['os-hardening']['auth']['pam']['cracklib']['options'] %> <% end %> # NSA 2.3.3.5 Upgrade Password Hashing Algorithm to SHA-512 # NSA 2.3.3.6 Limit Password Reuse password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5 password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so