diff --git a/usr/lib/security-misc/pam_tally2-info b/usr/lib/security-misc/pam_tally2-info index 8b6ae52..4bcbdf6 100755 --- a/usr/lib/security-misc/pam_tally2-info +++ b/usr/lib/security-misc/pam_tally2-info @@ -5,28 +5,37 @@ grep_result="$(grep "accessfile=/etc/security/access-security-misc.conf" /etc/pam.d/common-account 2>/dev/null)" -if ! echo "$grep_result" | grep -q "#" ; then - ## https://forums.whonix.org/t/etc-security-hardening-console-lockdown/8592 +## Check if grep matched something. +if [ ! "$grep_result" = "" ]; then + ## Yes, grep matched. - if id --name --groups --zero "$PAM_USER" | grep --quiet --null-data --line-regexp --fixed-strings "console"; then - console_allowed=true - fi - if id --name --groups --zero "$PAM_USER" | grep --quiet --null-data --line-regexp --fixed-strings "console-unrestricted"; then - console_allowed=true - fi - if [ ! "$console_allowed" = "true" ]; then - echo "$0: ERROR: PAM_USER: '$PAM_USER' is not a member of group 'console'" >&2 - echo "$0: To unlock, run the following command as superuser:" >&2 - echo "$0: (If you still have a sudo/root shell somewhere.)" >&2 - echo "" >&2 - echo "addgroup $PAM_USER console" >&2 - echo "" >&2 - echo "$0: However, possibly unlock procedure is required." >&2 - echo "$0: First boot into recovery mode at grub boot menu and then run above command." >&2 - echo "$0: See also:" >&2 - echo "https://www.whonix.org/wiki/root#console" >&2 - echo "" >&2 - exit 0 + ## Check if not out commented. + if ! echo "$grep_result" | grep -q "#" ; then + ## Not out commented indeed. + + ## https://forums.whonix.org/t/etc-security-hardening-console-lockdown/8592 + + if id --name --groups --zero "$PAM_USER" | grep --quiet --null-data --line-regexp --fixed-strings "console"; then + console_allowed=true + fi + if id --name --groups --zero "$PAM_USER" | grep --quiet --null-data --line-regexp --fixed-strings "console-unrestricted"; then + console_allowed=true + fi + + if [ ! "$console_allowed" = "true" ]; then + echo "$0: ERROR: PAM_USER: '$PAM_USER' is not a member of group 'console'" >&2 + echo "$0: To unlock, run the following command as superuser:" >&2 + echo "$0: (If you still have a sudo/root shell somewhere.)" >&2 + echo "" >&2 + echo "addgroup $PAM_USER console" >&2 + echo "" >&2 + echo "$0: However, possibly unlock procedure is required." >&2 + echo "$0: First boot into recovery mode at grub boot menu and then run above command." >&2 + echo "$0: See also:" >&2 + echo "https://www.whonix.org/wiki/root#console" >&2 + echo "" >&2 + exit 0 + fi fi fi