Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-08-01 08:56:06 -04:00
Code Issues Projects Releases Packages Wiki Activity

PAM: abort on locked password

Browse source 
to avoid needlessly bumping pam_tally2 counter

https://forums.whonix.org/t/restrict-root-access/7658/1
This commit is contained in:
Patrick Schleizer 2019-08-17 10:33:47 +00:00
parent e0e25364e2
commit 41b2819ec8
No known key found for this signature in database
GPG key ID: CB8D50BB77BB3C48
4 changed files with 26 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

19
usr/lib/security-misc/pam-abort-on-locked-password Executable file
View file

@ -0,0 +1,19 @@
#!/bin/bash
if [ "$(passwd -S "$PAM_USER" | cut -d ' ' -f 2)" = "P" ]; then
true "INFO: Password not locked."
else
echo "$0: ERROR: Password for user \"$PAM_USER\" is locked." >&2
if [ -f /usr/share/whonix/marker ] || [ -f /usr/share/kicksecure/marker ]; then
if [ "$PAM_USER" = "root" ]; then
echo "$0: ERROR: root account is locked by default. See:" >&2
echo "https://www.whonix.org/wiki/root" >&2
echo "" >&2
fi
fi
exit 1
fi
exit 0

12
usr/lib/security-misc/pam_tally2-info
View file

@ -1,17 +1,5 @@
#!/bin/bash
if [ "$(passwd -S "$PAM_USER" | cut -d ' ' -f 2)" = "P" ]; then
true "INFO: Password not locked."
else
echo "$0: ERROR: Password for user \"$PAM_USER\" is locked." >&2
if [ "$PAM_USER" = "root" ]; then
echo "$0: ERROR: root account is locked by default. See:" >&2
echo "https://www.whonix.org/wiki/root" >&2
echo "" >&2
fi
exit 0
fi
pam_tally2_output="$(pam_tally2 --user "$PAM_USER")"
if [ "$pam_tally2_output" = "" ]; then