V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/cdi_4500_user/4520_accounts_setup.sh

@@ -606,26 +606,49 @@ pam_access_sync_login_sshd() {
   fi
 
   ### 1) If the 'pam_access' line is commented in '/etc/pam.d/login', uncomment exactly one occurrence.
-  chroot_script "${TARGET}" "
+  # shellcheck disable=SC2155
-    LC_ALL=C awk '
+  declare     var_payload="$(
-      BEGIN { done=0 }
+    cat <<'CISS'
-        {
+tmp="$(mktemp /etc/pam.d/login.XXXXXX)"
-          if (!done) {
+LC_ALL=C awk '
-            tmp=\$0
+BEGIN { done=0 }
-            # Strip a leading comment marker plus following spaces (but only once)
+{
-            sub(/^[[:space:]]*#+[[:space:]]*/, \"\", tmp)
+  if (!done) {
-            # Match the pam_access.so line after decommenting attempt
+    line=$0
-              if (tmp ~ /^[[:space:]]*account[[:space:]]+required[[:space:]]+pam_access[.]so([[:space:]]|$)/) {
+    sub(/^[[:space:]]*#+[[:space:]]*/, "", line)
-              print tmp
+    if (line ~ /^[[:space:]]*account[[:space:]]+required[[:space:]]+pam_access[.]so([[:space:]]|$)/) {
-              done=1
+      print line; done=1; next
-              next
+    }
-            }
+  }
-          }
+  print
-        print
+}
-        }
+' /etc/pam.d/login >| "${tmp}"
-      ' /etc/pam.d/login >| /etc/pam.d/login.new
+
-      mv -f /etc/pam.d/login.new /etc/pam.d/login
+test -s "${tmp}"
-    "
+mv -f "${tmp}" /etc/pam.d/login
+CISS
+  )"
+
+  chroot_script "${TARGET}" "${var_payload}"
+
+  #chroot_script "${TARGET}" "
+  #  LC_ALL=C awk '
+  #    BEGIN { done=0 }
+  #      {
+  #        if (!done) {
+  #          tmp=\$0
+  #          sub(/^[[:space:]]*#+[[:space:]]*/, \"\", tmp)
+  #            if (tmp ~ /^[[:space:]]*account[[:space:]]+required[[:space:]]+pam_access[.]so([[:space:]]|$)/) {
+  #            print tmp
+  #            done=1
+  #            next
+  #          }
+  #        }
+  #      print
+  #      }
+  #    ' /etc/pam.d/login >| /etc/pam.d/login.new
+  #    mv -f /etc/pam.d/login.new /etc/pam.d/login
+  #  "
 
   ### 2) If '/etc/pam.d/login' now has an active pam_access line, ensure '/etc/pam.d/sshd' pam_access line(s) are commented out.
   chroot_script "${TARGET}" "