diff --git a/README.md b/README.md index a8c0c59..d876e88 100644 --- a/README.md +++ b/README.md @@ -179,6 +179,8 @@ module aims to support the current and previous major Puppet versions. * Ubuntu 16.04 LTS * Ubuntu 18.04 LTS * Ubuntu 20.04 LTS + * Ubuntu 22.04 LTS + * Ubuntu 24.04 LTS ### May work diff --git a/data/os/Ubuntu/24.04.yaml b/data/os/Ubuntu/24.04.yaml new file mode 100644 index 0000000..1ad7cbd --- /dev/null +++ b/data/os/Ubuntu/24.04.yaml @@ -0,0 +1,33 @@ +--- +pam::common_files_create_links: false +pam::common_files_suffix: ~ +pam::common_files: + - common_account + - common_auth + - common_password + - common_session + - common_session_noninteractive + +pam::pam_d_login_template: pam/login.ubuntu24.erb +pam::pam_d_sshd_template: pam/sshd.ubuntu24.erb +pam::package_name: libpam0g +pam::pam_auth_lines: + - 'auth [success=1 default=ignore] pam_unix.so nullok' + - 'auth requisite pam_deny.so' + - 'auth required pam_permit.so' + - 'auth optional pam_cap.so' +pam::pam_account_lines: + - 'account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so' + - 'account requisite pam_deny.so' + - 'account required pam_permit.so' +pam::pam_password_lines: + - 'password [success=1 default=ignore] pam_unix.so obscure yescrypt' + - 'password requisite pam_deny.so' + - 'password required pam_permit.so' +pam::pam_session_lines: + - 'session [default=1] pam_permit.so' + - 'session requisite pam_deny.so' + - 'session required pam_permit.so' + - 'session optional pam_umask.so' + - 'session required pam_unix.so' + - 'session optional pam_systemd.so' diff --git a/manifests/init.pp b/manifests/init.pp index 05dc989..01ca3ef 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -254,8 +254,8 @@ fail("Debian's os.release.major is <${facts['os']['release']['major']}> and must be 7, 8, 9, 10 or 11") } - if $facts['os']['name'] == 'Ubuntu' and !($facts['os']['release']['major'] in ['12.04', '14.04', '16.04', '18.04', '20.04', '22.04']) { - fail("Ubuntu's os.release.major is <${facts['os']['release']['major']}> and must be 12.04, 14.04, 16.04, 18.04, 20.04 or 22.04") + if $facts['os']['name'] == 'Ubuntu' and !($facts['os']['release']['major'] in ['12.04', '14.04', '16.04', '18.04', '20.04', '22.04', '24.04']) { + fail("Ubuntu's os.release.major is <${facts['os']['release']['major']}> and must be 12.04, 14.04, 16.04, 18.04, 20.04, 22.04 or 24.04") } if $pam_d_sshd_template == 'pam/sshd.custom.erb' { diff --git a/metadata.json b/metadata.json index da220c4..f964a6f 100644 --- a/metadata.json +++ b/metadata.json @@ -104,7 +104,8 @@ "16.04", "18.04", "20.04", - "22.04" + "22.04", + "24.04" ] } ], diff --git a/spec/fixtures/ubuntu-24.04-x86_64-pam_common_account b/spec/fixtures/ubuntu-24.04-x86_64-pam_common_account new file mode 100644 index 0000000..f538239 --- /dev/null +++ b/spec/fixtures/ubuntu-24.04-x86_64-pam_common_account @@ -0,0 +1,5 @@ +# This file is being maintained by Puppet. +# DO NOT EDIT +account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so +account requisite pam_deny.so +account required pam_permit.so diff --git a/spec/fixtures/ubuntu-24.04-x86_64-pam_common_auth b/spec/fixtures/ubuntu-24.04-x86_64-pam_common_auth new file mode 100644 index 0000000..f61564f --- /dev/null +++ b/spec/fixtures/ubuntu-24.04-x86_64-pam_common_auth @@ -0,0 +1,6 @@ +# This file is being maintained by Puppet. +# DO NOT EDIT +auth [success=1 default=ignore] pam_unix.so nullok +auth requisite pam_deny.so +auth required pam_permit.so +auth optional pam_cap.so diff --git a/spec/fixtures/ubuntu-24.04-x86_64-pam_common_password b/spec/fixtures/ubuntu-24.04-x86_64-pam_common_password new file mode 100644 index 0000000..0286efc --- /dev/null +++ b/spec/fixtures/ubuntu-24.04-x86_64-pam_common_password @@ -0,0 +1,5 @@ +# This file is being maintained by Puppet. +# DO NOT EDIT +password [success=1 default=ignore] pam_unix.so obscure yescrypt +password requisite pam_deny.so +password required pam_permit.so diff --git a/spec/fixtures/ubuntu-24.04-x86_64-pam_common_session b/spec/fixtures/ubuntu-24.04-x86_64-pam_common_session new file mode 100644 index 0000000..2fe27e1 --- /dev/null +++ b/spec/fixtures/ubuntu-24.04-x86_64-pam_common_session @@ -0,0 +1,8 @@ +# This file is being maintained by Puppet. +# DO NOT EDIT +session [default=1] pam_permit.so +session requisite pam_deny.so +session required pam_permit.so +session optional pam_umask.so +session required pam_unix.so +session optional pam_systemd.so diff --git a/spec/fixtures/ubuntu-24.04-x86_64-pam_common_session_noninteractive b/spec/fixtures/ubuntu-24.04-x86_64-pam_common_session_noninteractive new file mode 100644 index 0000000..2fe27e1 --- /dev/null +++ b/spec/fixtures/ubuntu-24.04-x86_64-pam_common_session_noninteractive @@ -0,0 +1,8 @@ +# This file is being maintained by Puppet. +# DO NOT EDIT +session [default=1] pam_permit.so +session requisite pam_deny.so +session required pam_permit.so +session optional pam_umask.so +session required pam_unix.so +session optional pam_systemd.so diff --git a/spec/fixtures/ubuntu-24.04-x86_64-pam_d_login b/spec/fixtures/ubuntu-24.04-x86_64-pam_d_login new file mode 100644 index 0000000..6a09e6a --- /dev/null +++ b/spec/fixtures/ubuntu-24.04-x86_64-pam_d_login @@ -0,0 +1,18 @@ +auth optional pam_faildelay.so delay=3000000 +auth requisite pam_nologin.so +session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close +session required pam_loginuid.so +session optional pam_motd.so motd=/run/motd.dynamic +session optional pam_motd.so noupdate +session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open +session required pam_env.so readenv=1 +session required pam_env.so readenv=1 envfile=/etc/default/locale +@include common-auth +auth optional pam_group.so +session required pam_limits.so +session optional pam_lastlog.so +session optional pam_mail.so standard +session optional pam_keyinit.so force revoke +@include common-account +@include common-session +@include common-password diff --git a/spec/fixtures/ubuntu-24.04-x86_64-pam_d_sshd b/spec/fixtures/ubuntu-24.04-x86_64-pam_d_sshd new file mode 100644 index 0000000..bacb27c --- /dev/null +++ b/spec/fixtures/ubuntu-24.04-x86_64-pam_d_sshd @@ -0,0 +1,16 @@ +@include common-auth +account required pam_nologin.so +account required pam_access.so +@include common-account +session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close +session required pam_loginuid.so +session optional pam_keyinit.so force revoke +@include common-session +session optional pam_motd.so motd=/run/motd.dynamic +session optional pam_motd.so noupdate +session optional pam_mail.so standard noenv # [1] +session required pam_limits.so +session required pam_env.so # [1] +session required pam_env.so user_readenv=1 envfile=/etc/default/locale +session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open +@include common-password diff --git a/templates/login.ubuntu24.erb b/templates/login.ubuntu24.erb new file mode 100644 index 0000000..6a09e6a --- /dev/null +++ b/templates/login.ubuntu24.erb @@ -0,0 +1,18 @@ +auth optional pam_faildelay.so delay=3000000 +auth requisite pam_nologin.so +session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close +session required pam_loginuid.so +session optional pam_motd.so motd=/run/motd.dynamic +session optional pam_motd.so noupdate +session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open +session required pam_env.so readenv=1 +session required pam_env.so readenv=1 envfile=/etc/default/locale +@include common-auth +auth optional pam_group.so +session required pam_limits.so +session optional pam_lastlog.so +session optional pam_mail.so standard +session optional pam_keyinit.so force revoke +@include common-account +@include common-session +@include common-password diff --git a/templates/sshd.ubuntu24.erb b/templates/sshd.ubuntu24.erb new file mode 100644 index 0000000..d638d65 --- /dev/null +++ b/templates/sshd.ubuntu24.erb @@ -0,0 +1,18 @@ +@include common-auth +account required pam_nologin.so +<% if @sshd_pam_access != 'absent' -%> +account <%= @sshd_pam_access %> pam_access.so +<% end -%> +@include common-account +session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close +session required pam_loginuid.so +session optional pam_keyinit.so force revoke +@include common-session +session optional pam_motd.so motd=/run/motd.dynamic +session optional pam_motd.so noupdate +session optional pam_mail.so standard noenv # [1] +session required pam_limits.so +session required pam_env.so # [1] +session required pam_env.so user_readenv=1 envfile=/etc/default/locale +session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open +@include common-password