Puppet Class: lsys::hardening::shadow_utils

Inherits:
lsys::hardening::params
Defined in:
manifests/hardening/shadow_utils.pp

Summary

Configuration file for shadow-utils component

Overview

Configuration file to control the behavior of the tools from the shadow-utils component

Examples:

include lsys::hardening::shadow_utils

Parameters:

  • pass_max_days (Integer) (defaults to: 180)
  • pass_min_days (Integer) (defaults to: 0)
  • pass_min_len (Integer) (defaults to: 8)
  • pass_warn_age (Integer) (defaults to: 14)
  • uid_min (Integer) (defaults to: $lsys::hardening::params::uid_min)
  • gid_min (Integer) (defaults to: $lsys::hardening::params::gid_min)
  • system_accounts (Boolean) (defaults to: $lsys::hardening::params::system_accounts)
  • enable_hardening (Boolean) (defaults to: false) 


18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
 
# File 'manifests/hardening/shadow_utils.pp', line 18

class lsys::hardening::shadow_utils (
  Integer $pass_max_days = 180,
  Integer $pass_min_days = 0,
  Integer $pass_min_len = 8,
  Integer $pass_warn_age = 14,
  Integer $uid_min = $lsys::hardening::params::uid_min,
  Integer $gid_min = $lsys::hardening::params::gid_min,
  Boolean $system_accounts = $lsys::hardening::params::system_accounts,
  Boolean $enable_hardening = false,
) inherits lsys::hardening::params {
  file { '/etc/login.defs':
    content => template('lsys/shadow_utils/login.defs.erb'),
    group   => 'root',
    mode    => '0600',
    owner   => 'root',
  }

  if $enable_hardening {
    file {
      default:
        mode => 'o=';
      '/usr/bin/chage': ;
      '/usr/bin/gpasswd': ;
      '/usr/bin/lastlog': ;
      '/usr/bin/newgidmap': ;
      '/usr/bin/newgrp': ;
      '/usr/bin/newuidmap': ;
      '/usr/sbin/chgpasswd': ;
      '/usr/sbin/chpasswd': ;
      '/usr/sbin/groupadd': ;
      '/usr/sbin/groupdel': ;
      '/usr/sbin/groupmems': ;
      '/usr/sbin/groupmod': ;
      '/usr/sbin/grpck': ;
      '/usr/sbin/grpconv': ;
      '/usr/sbin/grpunconv': ;
      '/usr/sbin/newusers': ;
      '/usr/sbin/pwck': ;
      '/usr/sbin/pwconv': ;
      '/usr/sbin/pwunconv': ;
      '/usr/sbin/useradd': ;
      '/usr/sbin/userdel': ;
      '/usr/sbin/usermod': ;
      '/usr/sbin/vipw': ;
    }
  }
}