Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #196762 > unrolled thread

Using config management to automate pam-auth-update(8) change

Back to article view | Back to linux.debian.user

Contents

  Using config management to automate pam-auth-update(8) change "Darren S." <phatbuckett@gmail.com> - 2018-06-19 10:00 +0200
    Re: Using config management to automate pam-auth-update(8) change deloptes <deloptes@gmail.com> - 2018-06-19 20:30 +0200

#196762 — Using config management to automate pam-auth-update(8) change

Greetings,

I'm using Ansible to manage Debian configurations, and am attempting
to add a role to enable multi-factor auth in SSH with public keys and
Duo (via libpam-duo).

I almost have the configuration I want, but as part of it - once the
libpam-duo package is installed - I need to enable the pam_duo.so
module correctly with the included profile using pam-auth-update(8). I
can execute this program manually and in the curses dialog select the
Duo PAM profile and disable the Unix authentication profile. This is
basically what this dialog looks like when the program is first run:

    PAM profiles to enable:

          [*] Unix authentication
          [ ] Duo Security two-factor authentication

And the desired state when modified:

    PAM profiles to enable:

          [ ] Unix authentication
          [*] Duo Security two-factor authentication

The question I have is: how can this be achieved using Ansible (i.e.
automation)? So far I've tried to manipulate debconf selections by
working backwards (determine the desired setting when it's been
configured using pam-auth-update, so I can just set it this way using
Ansible) but I'm sure this isn't the approach I need:

-libpam-runtime libpam-runtime/profiles multiselect     unix
+libpam-runtime libpam-runtime/profiles multiselect     duo-unix

I know that when the proper configuration is triggered that the target
files in /etc/pam.d/ are modified, but I can't figure out how to call
into pam-auth-update from Ansible to set the profiles. I'd rather use
the profile and avoid troublesome manual manipulation of the files
under /etc/pam.d. So is there a way other than interactive execution
of pam-auth-update to configure/activate the profiles as I'd like? Or
put another way, what is the best/correct approach to achieving my
goal?

-- 
Darren Spruell
phatbuckett@gmail.com

[toc] | [next] | [standalone]

#196778

Darren S. wrote:

> I know that when the proper configuration is triggered that the target
> files in /etc/pam.d/ are modified, but I can't figure out how to call
> into pam-auth-update from Ansible to set the profiles. I'd rather use
> the profile and avoid troublesome manual manipulation of the files
> under /etc/pam.d. So is there a way other than interactive execution
> of pam-auth-update to configure/activate the profiles as I'd like? Or
> put another way, what is the best/correct approach to achieving my
> goal?

I would say do whatever fits your needs best. There is often no correct
approach, but rather preferred.

I would just save the modified files to the ansible repository and copy them
over (perhaps let ansible make backup before copy), or alternatively use
diff and patch (assuming target files are default and same everywhere).

regards

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web