systemd/factory/etc/pam.d/system-auth

# This file is part of systemd.

# You really want to adjust this to your local distribution. If you use this
# unmodified you are not building systems safely and securely.

auth     sufficient pam_unix.so nullok try_first_pass
auth     required   pam_deny.so

account  required   pam_nologin.so
account  sufficient pam_unix.so
account  required   pam_permit.so

password sufficient pam_unix.so nullok sha512 shadow try_first_pass try_authtok
password required   pam_deny.so

-session optional   pam_keyinit.so revoke
-session optional   pam_loginuid.so
-session optional   pam_systemd.so
session  sufficient pam_unix.so
login: update systemd-user PAM configuration file 2014-07-29 15:01:51 +04:00			`# This file is part of systemd.`

factory: add comment to PAM file, explaining that the defaults are not useful 2019-07-12 13:20:11 +03:00			`# You really want to adjust this to your local distribution. If you use this`
			`# unmodified you are not building systems safely and securely.`

login: update systemd-user PAM configuration file 2014-07-29 15:01:51 +04:00			`auth sufficient pam_unix.so nullok try_first_pass`
factory: tighten PAM configuration Apparently PAM reacts differently on different systems (?) and if no authoritative matching module is found might either succeed/fail, depending on the system. Let's lock this down explicitly, by hooking in pam_deny.so. Of course, these PAM files are just examples, and no distro in its right mind would ship these unmodified, but let's default to something safe. Fixes: #12950 2019-07-12 13:17:12 +03:00			`auth required pam_deny.so`
login: update systemd-user PAM configuration file 2014-07-29 15:01:51 +04:00
			`account required pam_nologin.so`
			`account sufficient pam_unix.so`
factory: tighten PAM configuration Apparently PAM reacts differently on different systems (?) and if no authoritative matching module is found might either succeed/fail, depending on the system. Let's lock this down explicitly, by hooking in pam_deny.so. Of course, these PAM files are just examples, and no distro in its right mind would ship these unmodified, but let's default to something safe. Fixes: #12950 2019-07-12 13:17:12 +03:00			`account required pam_permit.so`
login: update systemd-user PAM configuration file 2014-07-29 15:01:51 +04:00
			`password sufficient pam_unix.so nullok sha512 shadow try_first_pass try_authtok`
factory: tighten PAM configuration Apparently PAM reacts differently on different systems (?) and if no authoritative matching module is found might either succeed/fail, depending on the system. Let's lock this down explicitly, by hooking in pam_deny.so. Of course, these PAM files are just examples, and no distro in its right mind would ship these unmodified, but let's default to something safe. Fixes: #12950 2019-07-12 13:17:12 +03:00			`password required pam_deny.so`
login: update systemd-user PAM configuration file 2014-07-29 15:01:51 +04:00
factory: include pam_keyinit.so in PAM factory configuration We use the keyring, so let's make sure it gets properly initialized for sessions in factory reset mode. 2019-07-12 13:48:51 +03:00			`-session optional pam_keyinit.so revoke`
login: update systemd-user PAM configuration file 2014-07-29 15:01:51 +04:00			`-session optional pam_loginuid.so`
			`-session optional pam_systemd.so`
			`session sufficient pam_unix.so`