initial commit

roles/pam_hardening/tasks/main.yml

@@ -0,0 +1,63 @@
+---
+- name: Include OS-family-specific variables
+  ansible.builtin.include_vars: "{{ item }}"
+  with_first_found:
+    - "{{ ansible_facts['os_family'] }}.yml"
+    - "default.yml"
+  tags: [pam_hardening, always]
+
+- name: Ensure pwquality library is installed
+  ansible.builtin.package:
+    name: "{{ pam_hardening_pwquality_package }}"
+    state: present
+  tags: [pam_hardening]
+
+- name: Set password complexity requirements
+  ansible.builtin.lineinfile:
+    path: /etc/security/pwquality.conf
+    regexp: "^#?\\s*{{ item.key }}\\s*="
+    line: "{{ item.key }} = {{ item.value }}"
+  loop:
+    - { key: "minlen", value: "{{ pam_pwquality_minlen }}" }
+    - { key: "dcredit", value: "{{ pam_pwquality_dcredit }}" }
+    - { key: "ucredit", value: "{{ pam_pwquality_ucredit }}" }
+    - { key: "lcredit", value: "{{ pam_pwquality_lcredit }}" }
+    - { key: "ocredit", value: "{{ pam_pwquality_ocredit }}" }
+    - { key: "retry", value: "{{ pam_pwquality_retry }}" }
+  tags: [pam_hardening]
+
+- name: Enable pam_faillock via authselect (RedHat family)
+  ansible.builtin.command: authselect enable-feature with-faillock
+  register: pam_hardening_faillock_enable
+  changed_when: "'already enabled' not in pam_hardening_faillock_enable.stderr"
+  failed_when: false
+  when: ansible_facts['os_family'] == "RedHat"
+  tags: [pam_hardening]
+
+- name: Check whether pam_faillock is already enabled (Debian family)
+  ansible.builtin.command: grep -q pam_faillock.so /etc/pam.d/common-auth
+  register: pam_hardening_faillock_check
+  changed_when: false
+  failed_when: false
+  when: ansible_facts['os_family'] == "Debian"
+  tags: [pam_hardening]
+
+- name: Enable pam_faillock via pam-auth-update (Debian family)
+  ansible.builtin.command: pam-auth-update --enable faillock
+  register: pam_hardening_faillock_debian
+  changed_when: true
+  failed_when: false
+  when:
+    - ansible_facts['os_family'] == "Debian"
+    - pam_hardening_faillock_check.rc != 0
+  tags: [pam_hardening]
+
+- name: Set account lockout thresholds
+  ansible.builtin.lineinfile:
+    path: /etc/security/faillock.conf
+    regexp: "^#?\\s*{{ item.key }}\\s*="
+    line: "{{ item.key }} = {{ item.value }}"
+  loop:
+    - { key: "deny", value: "{{ pam_faillock_deny }}" }
+    - { key: "unlock_time", value: "{{ pam_faillock_unlock_time }}" }
+  tags: [pam_hardening]