-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix Ubuntu remediation for pam_faillock rules #11488
Conversation
The line `auth required pam_faillock.so preauth` is now added above the Primary block instead of above pam_unix.so. This prevents it from interfering with modules from other rules, specifically, pam_pkcs11.so in smartcard_pam_enabled.
The macro now ignores commented and empty lines when determining the position for pam_faillock authfail in the pam stack.
Cleaned up the comments in pam template and added missing tests for remediation.
Hi @mpurg. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Code Climate has analyzed commit c538c20 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 58.5% (0.0% change). View more on Code Climate. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm, thanks!
Description:
pam_faillock authfail
module in modified pam files.pam_faillock preauth
above the Primary block instead of abovepam_unix
.Rationale:
pam_faillock authfail
module when the pam file contains commented or empty lines, potentially locking the system.pam_faillock preauth
module directly abovepam_unix
interferes with modules from other rules, specifically,pam_pkcs11
insmartcard_pam_enabled
.Example /etc/pam.d/common-auth on Ubuntu 22.04 after remediation:
After fix: