msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m3s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-09-14 11:37:12 +02:00
parent 6b6f9c7146
commit d004db7120
1 changed files with 24 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
func/cdi_4500_user/4520_accounts_setup.sh
View File

@@ -100,23 +100,30 @@ accounts_setup() {
pam_access_sync_login_sshd pam_access_sync_login_sshd
### 3) A) 2) Ensure 'pam_securetty' in the auth phase; requisite causes immediate fail for disallowed ttys. ### 3) A) 2) Ensure 'pam_securetty' in the auth phase; requisite causes immediate fail for disallowed ttys.
chroot_script "${TARGET}" " chroot_stdin "${TARGET}" "__payload__" <<'EOF'
if ! grep -Eq '^[[:space:]]*auth[[:space:]]+requisite[[:space:]]+pam_securetty\.so' /etc/pam.d/login; then export LC_ALL=C
if ! grep -Eq '^[[:space:]]*auth[[:space:]]+requisite[[:space:]]+pam_securetty[.]so([[:space:]]|$)' /etc/pam.d/login; then
tmp="$(mktemp /etc/pam.d/login.XXXXXX)"
awk ' awk '
BEGIN { ins=0 } BEGIN { ins=0 }
{ {
if(!ins && $0 ~ /^[[:space:]]*auth[[:space:]]+.*pam_unix\.so/){ if (!ins && $0 ~ /^[[:space:]]*auth[[:space:]]+.*pam_unix[.]so/) {
print \"auth requisite pam_securetty.so\" print "auth requisite pam_securetty.so"
ins=1 ins=1
} }
print print
} }
END { END {
if(!ins) print \"auth requisite pam_securetty.so\" if (!ins) print "auth requisite pam_securetty.so"
} }
' /etc/pam.d/login >| /etc/pam.d/login.new && mv -f /etc/pam.d/login.new /etc/pam.d/login ' /etc/pam.d/login >| "${tmp}"
test -s "${tmp}"
mv -f "${tmp}" /etc/pam.d/login
rm -f -- "${tmp}"
fi fi
" :
EOF
### 3) A) 3) Disallow all local access for root in '/etc/security/access.conf'. ### 3) A) 3) Disallow all local access for root in '/etc/security/access.conf'.
printf -- '-: root:ALL\n' >> "${TARGET}/etc/security/access.conf" printf -- '-: root:ALL\n' >> "${TARGET}/etc/security/access.conf"