diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_commented_values.fail.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_commented_values.fail.sh deleted file mode 100644 index 01648c77fc4f..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_commented_values.fail.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/bash -# platform = multi_platform_ubuntu - -source ubuntu_common.sh - -sed -i 's/\(^.*pam_faillock\.so.*\)/# \1/' /etc/pam.d/common-auth -sed -i 's/\(^.*pam_faillock\.so.*\)/# \1/' /etc/pam.d/common-account - -echo "#fail_interval=900" > /etc/security/faillock.conf diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_common.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_common.sh deleted file mode 100644 index e64fb3528e8f..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_common.sh +++ /dev/null @@ -1,50 +0,0 @@ -#!/bin/bash - -# Create passing pam.d files based on defaults from a clean installation of Ubuntu 22.04 LTS -# Extra comments and whitespaces were added to test for edge cases - -cat >/etc/pam.d/common-auth </etc/pam.d/common-account < /etc/security/faillock.conf diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_correct_pamd.pass.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_correct_pamd.pass.sh deleted file mode 100644 index 4c9241b52679..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_correct_pamd.pass.sh +++ /dev/null @@ -1,7 +0,0 @@ -#!/bin/bash -# platform = multi_platform_ubuntu - -source ubuntu_common.sh - -sed -i 's/\(.*pam_faillock.so.*\)/\1 fail_interval=900/g' /etc/pam.d/common-auth - diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_empty_faillock_conf.fail.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_empty_faillock_conf.fail.sh deleted file mode 100644 index 05bac86bef02..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_empty_faillock_conf.fail.sh +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/bash -# platform = multi_platform_ubuntu - -# This test should fail because neither pam.d or faillock.conf have fail_interval defined - -source ubuntu_common.sh - -echo > /etc/security/faillock.conf diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_missing_pamd.fail.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_missing_pamd.fail.sh deleted file mode 100644 index 0d6ccea0a3f8..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_missing_pamd.fail.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/bash -# platform = multi_platform_ubuntu - -source ubuntu_common.sh - -sed -i '/pam_faillock\.so/d' /etc/pam.d/common-auth -sed -i '/pam_faillock\.so/d' /etc/pam.d/common-account - -echo "fail_interval=900" > /etc/security/faillock.conf diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_multiple_pam_unix.fail.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_multiple_pam_unix.fail.sh deleted file mode 100644 index 23be5083c6ff..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_multiple_pam_unix.fail.sh +++ /dev/null @@ -1,11 +0,0 @@ -#!/bin/bash -# platform = multi_platform_ubuntu -# remediation = none - -# Multiple instances of pam_unix.so in auth section may, intentionally or not, interfere -# in the expected behaviour of pam_faillock.so. Remediation does not solve this automatically -# in order to preserve intentional changes. - -source ubuntu_common.sh - -echo "auth sufficient pam_unix.so" >> /etc/pam.d/common-auth diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_wrong_value.fail.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_wrong_value.fail.sh deleted file mode 100644 index 0de402a7213c..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/tests/ubuntu_wrong_value.fail.sh +++ /dev/null @@ -1,6 +0,0 @@ -#!/bin/bash -# platform = multi_platform_ubuntu - -source ubuntu_common.sh - -echo "fail_interval=100" > /etc/security/faillock.conf diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/tests/ubuntu_commented_values.fail.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/tests/ubuntu_commented_values.fail.sh deleted file mode 100644 index cc08ec1cf44a..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/tests/ubuntu_commented_values.fail.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/bash -# platform = multi_platform_ubuntu - -source ubuntu_common.sh - -sed -i 's/\(^.*pam_faillock\.so.*\)/# \1/' /etc/pam.d/common-auth -sed -i 's/\(^.*pam_faillock\.so.*\)/# \1/' /etc/pam.d/common-account - -echo "#unlock_time=1000" > /etc/security/faillock.conf diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/tests/ubuntu_common.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/tests/ubuntu_common.sh deleted file mode 100644 index e64fb3528e8f..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/tests/ubuntu_common.sh +++ /dev/null @@ -1,50 +0,0 @@ -#!/bin/bash - -# Create passing pam.d files based on defaults from a clean installation of Ubuntu 22.04 LTS -# Extra comments and whitespaces were added to test for edge cases - -cat >/etc/pam.d/common-auth </etc/pam.d/common-account < /etc/security/faillock.conf diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/tests/ubuntu_correct_pamd.pass.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/tests/ubuntu_correct_pamd.pass.sh deleted file mode 100644 index 741bea844afa..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/tests/ubuntu_correct_pamd.pass.sh +++ /dev/null @@ -1,7 +0,0 @@ -#!/bin/bash -# platform = multi_platform_ubuntu - -source ubuntu_common.sh - -sed -i 's/\(.*pam_faillock.so.*\)/\1 unlock_time=1000/g' /etc/pam.d/common-auth - diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/tests/ubuntu_empty_faillock_conf.fail.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/tests/ubuntu_empty_faillock_conf.fail.sh deleted file mode 100644 index b36740fb97c5..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/tests/ubuntu_empty_faillock_conf.fail.sh +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/bash -# platform = multi_platform_ubuntu - -# This test should fail because neither pam.d or faillock.conf have unlock_time defined - -source ubuntu_common.sh - -echo > /etc/security/faillock.conf diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/tests/ubuntu_missing_pamd.fail.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/tests/ubuntu_missing_pamd.fail.sh deleted file mode 100644 index 9ef68330d39f..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/tests/ubuntu_missing_pamd.fail.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/bash -# platform = multi_platform_ubuntu - -source ubuntu_common.sh - -sed -i '/pam_faillock\.so/d' /etc/pam.d/common-auth -sed -i '/pam_faillock\.so/d' /etc/pam.d/common-account - -echo "unlock_time=1000" > /etc/security/faillock.conf diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/tests/ubuntu_multiple_pam_unix.fail.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/tests/ubuntu_multiple_pam_unix.fail.sh deleted file mode 100644 index 23be5083c6ff..000000000000 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/tests/ubuntu_multiple_pam_unix.fail.sh +++ /dev/null @@ -1,11 +0,0 @@ -#!/bin/bash -# platform = multi_platform_ubuntu -# remediation = none - -# Multiple instances of pam_unix.so in auth section may, intentionally or not, interfere -# in the expected behaviour of pam_faillock.so. Remediation does not solve this automatically -# in order to preserve intentional changes. - -source ubuntu_common.sh - -echo "auth sufficient pam_unix.so" >> /etc/pam.d/common-auth diff --git a/shared/templates/pam_account_password_faillock/tests/ubuntu_commented_values.fail.sh b/shared/templates/pam_account_password_faillock/tests/ubuntu_commented_values.fail.sh index 59eaf65f5265..05d364ebde11 100644 --- a/shared/templates/pam_account_password_faillock/tests/ubuntu_commented_values.fail.sh +++ b/shared/templates/pam_account_password_faillock/tests/ubuntu_commented_values.fail.sh @@ -1,4 +1,14 @@ #!/bin/bash # platform = multi_platform_ubuntu -echo "#{{{ PRM_NAME }}}={{{ CORRECT_VALUE }}}" > /etc/security/faillock.conf +{{% if PRM_NAME == "fail_interval"%}} +# variables = var_accounts_passwords_pam_faillock_fail_interval=5 +VALUE=6 +{{% elif PRM_NAME == "unlock_time" %}} +# variables = var_accounts_passwords_pam_faillock_unlock_time=5 +VALUE=6 +{{% else %}} +VALUE=1 +{{% endif %}} + +echo "#{{{ PRM_NAME }}}=$VALUE" > /etc/security/faillock.conf diff --git a/shared/templates/pam_account_password_faillock/tests/ubuntu_correct.pass.sh b/shared/templates/pam_account_password_faillock/tests/ubuntu_correct.pass.sh index 6b42ea4a7170..09f2b8d16dba 100644 --- a/shared/templates/pam_account_password_faillock/tests/ubuntu_correct.pass.sh +++ b/shared/templates/pam_account_password_faillock/tests/ubuntu_correct.pass.sh @@ -1,5 +1,15 @@ #!/bin/bash # platform = multi_platform_ubuntu +{{% if PRM_NAME == "fail_interval"%}} +# variables = var_accounts_passwords_pam_faillock_fail_interval=5 +VALUE=6 +{{% elif PRM_NAME == "unlock_time" %}} +# variables = var_accounts_passwords_pam_faillock_unlock_time=5 +VALUE=6 +{{% else %}} +VALUE=1 +{{% endif %}} + {{{ bash_enable_pam_faillock_directly_in_pam_files() }}} -echo "{{{ PRM_NAME }}}={{{ CORRECT_VALUE }}}" > /etc/security/faillock.conf +echo "{{{ PRM_NAME }}}=$VALUE" > /etc/security/faillock.conf diff --git a/shared/templates/pam_account_password_faillock/tests/ubuntu_correct_pamd.pass.sh b/shared/templates/pam_account_password_faillock/tests/ubuntu_correct_pamd.pass.sh index 1305e206725e..20fff680ad84 100644 --- a/shared/templates/pam_account_password_faillock/tests/ubuntu_correct_pamd.pass.sh +++ b/shared/templates/pam_account_password_faillock/tests/ubuntu_correct_pamd.pass.sh @@ -1,13 +1,23 @@ #!/bin/bash # platform = multi_platform_ubuntu +{{% if PRM_NAME == "fail_interval"%}} +# variables = var_accounts_passwords_pam_faillock_fail_interval=5 +VALUE=6 +{{% elif PRM_NAME == "unlock_time" %}} +# variables = var_accounts_passwords_pam_faillock_unlock_time=5 +VALUE=6 +{{% else %}} +VALUE=1 +{{% endif %}} + cat << EOF > /usr/share/pam-configs/faillock Name: Enable pam_faillock to deny access Default: yes Priority: 0 Auth-Type: Primary Auth: - [default=die] pam_faillock.so authfail {{{ PRM_NAME }}}={{{ CORRECT_VALUE }}} + [default=die] pam_faillock.so authfail {{{ PRM_NAME }}}=$VALUE EOF cat << EOF > /usr/share/pam-configs/faillock_notify @@ -16,7 +26,7 @@ Default: yes Priority: 1024 Auth-Type: Primary Auth: - requisite pam_faillock.so preauth {{{ PRM_NAME }}}={{{ CORRECT_VALUE }}} + requisite pam_faillock.so preauth {{{ PRM_NAME }}}=$VALUE Account-Type: Primary Account: required pam_faillock.so diff --git a/shared/templates/pam_account_password_faillock/tests/ubuntu_missing_pamd.fail.sh b/shared/templates/pam_account_password_faillock/tests/ubuntu_missing_pamd.fail.sh index 236faba78feb..c51fc3592590 100644 --- a/shared/templates/pam_account_password_faillock/tests/ubuntu_missing_pamd.fail.sh +++ b/shared/templates/pam_account_password_faillock/tests/ubuntu_missing_pamd.fail.sh @@ -1,4 +1,14 @@ #!/bin/bash # platform = multi_platform_ubuntu -echo "{{{ PRM_NAME }}}={{{ CORRECT_VALUE }}}" > /etc/security/faillock.conf +{{% if PRM_NAME == "fail_interval"%}} +# variables = var_accounts_passwords_pam_faillock_fail_interval=5 +VALUE=6 +{{% elif PRM_NAME == "unlock_time" %}} +# variables = var_accounts_passwords_pam_faillock_unlock_time=5 +VALUE=6 +{{% else %}} +VALUE=1 +{{% endif %}} + +echo "{{{ PRM_NAME }}}=$VALUE" > /etc/security/faillock.conf diff --git a/shared/templates/pam_account_password_faillock/tests/ubuntu_wrong_value.fail.sh b/shared/templates/pam_account_password_faillock/tests/ubuntu_wrong_value.fail.sh index e686cf5e5605..2f1a549c71b0 100644 --- a/shared/templates/pam_account_password_faillock/tests/ubuntu_wrong_value.fail.sh +++ b/shared/templates/pam_account_password_faillock/tests/ubuntu_wrong_value.fail.sh @@ -1,5 +1,16 @@ #!/bin/bash # platform = multi_platform_ubuntu +{{% if PRM_NAME == "fail_interval"%}} +# variables = var_accounts_passwords_pam_faillock_fail_interval=5 +VALUE=4 +{{% elif PRM_NAME == "unlock_time" %}} +# variables = var_accounts_passwords_pam_faillock_unlock_time=5 +VALUE=4 +{{% else %}} +# variables = var_accounts_passwords_pam_faillock_deny=5 +VALUE=6 +{{% endif %}} + {{{ bash_enable_pam_faillock_directly_in_pam_files() }}} -echo "{{{ PRM_NAME }}}={{{ WRONG_VALUE }}}" > /etc/security/faillock.conf +echo "{{{ PRM_NAME }}}=$VALUE" > /etc/security/faillock.conf