Support for Ubuntu24

README.md

@@ -179,6 +179,8 @@ module aims to support the current and previous major Puppet versions.
  * Ubuntu 16.04 LTS
  * Ubuntu 18.04 LTS
  * Ubuntu 20.04 LTS
+ * Ubuntu 22.04 LTS
+ * Ubuntu 24.04 LTS
 
 ### May work
 

data/os/Ubuntu/24.04.yaml

@@ -0,0 +1,33 @@
+---
+pam::common_files_create_links: false
+pam::common_files_suffix:       ~
+pam::common_files:
+  - common_account
+  - common_auth
+  - common_password
+  - common_session
+  - common_session_noninteractive
+
+pam::pam_d_login_template: pam/login.ubuntu24.erb
+pam::pam_d_sshd_template: pam/sshd.ubuntu24.erb
+pam::package_name: libpam0g
+pam::pam_auth_lines:
+  - 'auth       [success=1 default=ignore]      pam_unix.so nullok'
+  - 'auth       requisite                       pam_deny.so'
+  - 'auth       required                        pam_permit.so'
+  - 'auth       optional                        pam_cap.so'
+pam::pam_account_lines:
+  - 'account    [success=1 new_authtok_reqd=done default=ignore]        pam_unix.so'
+  - 'account    requisite                       pam_deny.so'
+  - 'account    required                        pam_permit.so'
+pam::pam_password_lines:
+  - 'password   [success=1 default=ignore]      pam_unix.so obscure yescrypt'
+  - 'password   requisite                       pam_deny.so'
+  - 'password   required                        pam_permit.so'
+pam::pam_session_lines:
+  - 'session    [default=1]     pam_permit.so'
+  - 'session    requisite       pam_deny.so'
+  - 'session    required        pam_permit.so'
+  - 'session    optional        pam_umask.so'
+  - 'session    required        pam_unix.so'
+  - 'session    optional        pam_systemd.so'

manifests/init.pp

@@ -254,8 +254,8 @@
     fail("Debian's os.release.major is <${facts['os']['release']['major']}> and must be 7, 8, 9, 10 or 11")
   }
 
-  if $facts['os']['name'] == 'Ubuntu' and !($facts['os']['release']['major'] in ['12.04', '14.04', '16.04', '18.04', '20.04', '22.04']) {
-    fail("Ubuntu's os.release.major is <${facts['os']['release']['major']}> and must be 12.04, 14.04, 16.04, 18.04, 20.04 or 22.04")
+  if $facts['os']['name'] == 'Ubuntu' and !($facts['os']['release']['major'] in ['12.04', '14.04', '16.04', '18.04', '20.04', '22.04', '24.04']) {
+    fail("Ubuntu's os.release.major is <${facts['os']['release']['major']}> and must be 12.04, 14.04, 16.04, 18.04, 20.04, 22.04 or 24.04")
   }
 
   if $pam_d_sshd_template == 'pam/sshd.custom.erb' {

metadata.json

@@ -104,7 +104,8 @@
         "16.04",
         "18.04",
         "20.04",
-        "22.04"
+        "22.04",
+        "24.04"
       ]
     }
   ],

spec/fixtures/ubuntu-24.04-x86_64-pam_common_account

@@ -0,0 +1,5 @@
+# This file is being maintained by Puppet.
+# DO NOT EDIT
+account    [success=1 new_authtok_reqd=done default=ignore]        pam_unix.so
+account    requisite                       pam_deny.so
+account    required                        pam_permit.so

spec/fixtures/ubuntu-24.04-x86_64-pam_common_auth

@@ -0,0 +1,6 @@
+# This file is being maintained by Puppet.
+# DO NOT EDIT
+auth       [success=1 default=ignore]      pam_unix.so nullok
+auth       requisite                       pam_deny.so
+auth       required                        pam_permit.so
+auth       optional                        pam_cap.so

spec/fixtures/ubuntu-24.04-x86_64-pam_common_password

@@ -0,0 +1,5 @@
+# This file is being maintained by Puppet.
+# DO NOT EDIT
+password   [success=1 default=ignore]      pam_unix.so obscure yescrypt
+password   requisite                       pam_deny.so
+password   required                        pam_permit.so

spec/fixtures/ubuntu-24.04-x86_64-pam_common_session

@@ -0,0 +1,8 @@
+# This file is being maintained by Puppet.
+# DO NOT EDIT
+session    [default=1]     pam_permit.so
+session    requisite       pam_deny.so
+session    required        pam_permit.so
+session    optional        pam_umask.so
+session    required        pam_unix.so
+session    optional        pam_systemd.so

spec/fixtures/ubuntu-24.04-x86_64-pam_common_session_noninteractive

@@ -0,0 +1,8 @@
+# This file is being maintained by Puppet.
+# DO NOT EDIT
+session    [default=1]     pam_permit.so
+session    requisite       pam_deny.so
+session    required        pam_permit.so
+session    optional        pam_umask.so
+session    required        pam_unix.so
+session    optional        pam_systemd.so

spec/fixtures/ubuntu-24.04-x86_64-pam_d_login

@@ -0,0 +1,18 @@
+auth       optional   pam_faildelay.so  delay=3000000
+auth       requisite  pam_nologin.so
+session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
+session    required     pam_loginuid.so
+session    optional   pam_motd.so motd=/run/motd.dynamic
+session    optional   pam_motd.so noupdate
+session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
+session       required   pam_env.so readenv=1
+session       required   pam_env.so readenv=1 envfile=/etc/default/locale
+@include common-auth
+auth       optional   pam_group.so
+session    required   pam_limits.so
+session    optional   pam_lastlog.so
+session    optional   pam_mail.so standard
+session    optional   pam_keyinit.so force revoke
+@include common-account
+@include common-session
+@include common-password

spec/fixtures/ubuntu-24.04-x86_64-pam_d_sshd

@@ -0,0 +1,16 @@
+@include common-auth
+account    required     pam_nologin.so
+account    required     pam_access.so
+@include common-account
+session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so close
+session    required     pam_loginuid.so
+session    optional     pam_keyinit.so force revoke
+@include common-session
+session    optional     pam_motd.so  motd=/run/motd.dynamic
+session    optional     pam_motd.so noupdate
+session    optional     pam_mail.so standard noenv # [1]
+session    required     pam_limits.so
+session    required     pam_env.so # [1]
+session    required     pam_env.so user_readenv=1 envfile=/etc/default/locale
+session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so open
+@include common-password

templates/login.ubuntu24.erb

@@ -0,0 +1,18 @@
+auth       optional   pam_faildelay.so  delay=3000000
+auth       requisite  pam_nologin.so
+session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
+session    required     pam_loginuid.so
+session    optional   pam_motd.so motd=/run/motd.dynamic
+session    optional   pam_motd.so noupdate
+session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
+session       required   pam_env.so readenv=1
+session       required   pam_env.so readenv=1 envfile=/etc/default/locale
+@include common-auth
+auth       optional   pam_group.so
+session    required   pam_limits.so
+session    optional   pam_lastlog.so
+session    optional   pam_mail.so standard
+session    optional   pam_keyinit.so force revoke
+@include common-account
+@include common-session
+@include common-password

templates/sshd.ubuntu24.erb

@@ -0,0 +1,18 @@
+@include common-auth
+account    required     pam_nologin.so
+<% if @sshd_pam_access != 'absent' -%>
+account    <%= @sshd_pam_access %>     pam_access.so
+<% end -%>
+@include common-account
+session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so close
+session    required     pam_loginuid.so
+session    optional     pam_keyinit.so force revoke
+@include common-session
+session    optional     pam_motd.so  motd=/run/motd.dynamic
+session    optional     pam_motd.so noupdate
+session    optional     pam_mail.so standard noenv # [1]
+session    required     pam_limits.so
+session    required     pam_env.so # [1]
+session    required     pam_env.so user_readenv=1 envfile=/etc/default/locale
+session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so open
+@include common-password