Skip to content

Sle16 use /etc/security/faillock.conf for pam faillock configuration #14624

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
teacup-on-rockingchair wants to merge 2 commits into
base: master
Choose a base branch
from
+19 −7
Open

Sle16 use /etc/security/faillock.conf for pam faillock configuration #14624

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3a0fcff
use default /etc/security/faillock.conf for sle16.
teacup-on-rockingchair Apr 6, 2026
a999684
/etc/pam.d/password-auth and /etc/pam.d/system-auth are not used by S…
teacup-on-rockingchair Apr 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 0 additions & 5 deletions product_properties/10-pam-faillock-conf.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,2 @@
default:
pam_faillock_conf_path: "/etc/security/faillock.conf"

overrides:
{{% if product == 'sle16' %}}
pam_faillock_conf_path: "/usr/etc/security/faillock.conf"
{{% endif %}}
4 changes: 2 additions & 2 deletions shared/macros/10-ansible.jinja
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1462,7 +1462,6 @@ The following macro remediates Audit syscall rule in :code:`/etc/audit/audit.rul
{{{ ansible_remove_pam_module_option_configuration('/etc/pam.d/password-auth','auth','','pam_faillock.so',parameter, rule_title=rule_title) | indent(4) }}}
when:
- result_faillock_conf_check.stat.exists
{{%- endif %}}

- name: {{{ rule_title }}} - Ensure the pam_faillock.so {{{ parameter }}} parameter in PAM files
block:
Expand Down Expand Up @@ -1542,6 +1541,7 @@ The following macro remediates Audit syscall rule in :code:`/etc/audit/audit.rul
{{%- endif %}}
when:
- not result_faillock_conf_check.stat.exists
{{%- endif %}}
{{%- endmacro -%}}

{{#
Expand Down Expand Up @@ -2395,7 +2395,7 @@ lines will be inserted at the beginning of the profile.

{{#

Set a sshd configuration parameter to a value for system with /usr - located default config
Set a sshd configuration parameter to a value for system with /usr - located default config

:parameter msg: Message to be set as Task Title, if not set the rule's title will be used instead
:type msg: str
Expand Down
10 changes: 10 additions & 0 deletions shared/templates/pam_account_password_faillock/ansible.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,5 +3,15 @@
# strategy = restrict
# complexity = low
# disruption = low

{{% if product == 'sle16' %}}
- name: Copy faillock defaults /usr/etc/security/faillock.conf to {{{ pam_faillock_conf_path }}}
ansible.builtin.copy:
src: /usr/etc/security/faillock.conf
Copy link
Copy Markdown
Collaborator

@jan-cerny jan-cerny Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IIUC if the Ansible code is used to manage a remote host this will copy a file from the controller machine to the remote host. I assume we want to copy the file from the remote host, not from the controller. You'll need to add remote_src: yes.

dest: {{{ pam_faillock_conf_path }}}
force: no
mode: '0644'
{{% endif %}}

{{{ ansible_pam_faillock_enable(rule_title=rule_title) }}}
{{{ ansible_pam_faillock_parameter_value(PRM_NAME, EXT_VARIABLE, rule_title=rule_title) }}}
7 changes: 7 additions & 0 deletions shared/templates/pam_account_password_faillock/bash.template
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,12 @@
# platform = multi_platform_all

{{% if product == 'sle16' %}}
PAM_FAILLOCK_DEFAULTS_FILE_NAME="/usr/etc/security/faillock.conf"
if ! [ -e "{{{ pam_faillock_conf_path }}}" ] ; then
cp "${PAM_FAILLOCK_DEFAULTS_FILE_NAME}" "{{{ pam_faillock_conf_path }}}"
fi
{{% endif %}}

{{{ bash_instantiate_variables(EXT_VARIABLE) }}}

{{{ bash_pam_faillock_enable() }}}
Expand Down
Loading