??????????????
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 173
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 174
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 175
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 176
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 177
Warning: Cannot modify header information - headers already sent by (output started at /home/mybf1/public_html/mentol.bf1.my/SS1.php:4) in /home/mybf1/public_html/mentol.bf1.my/SS1.php on line 178
ó
àUdac @` sv d d l m Z m Z m Z e Z i d d 6d g d 6d d 6Z d Z d Z d
Z d d l
m Z d d l Z d d l
Z
d d
l m Z d d l m Z e
j d e
j ƒ Z e
j d ƒ Z d d d d d d d d g Z d e f d „ ƒ YZ d e f d „ ƒ YZ d e f d „ ƒ YZ d e f d „ ƒ YZ d! e f d" „ ƒ YZ d# „ Z d$ „ Z e d% k rre ƒ n d S(& i ( t absolute_importt divisiont print_functions 1.1t metadata_versiont previewt statust communityt supported_bysM
module: pamd
author:
- Kenneth D. Evensen (@kevensen)
short_description: Manage PAM Modules
description:
- Edit PAM service's type, control, module path and module arguments.
- In order for a PAM rule to be modified, the type, control and
module_path must match an existing rule. See man(5) pam.d for details.
version_added: "2.3"
options:
name:
description:
- The name generally refers to the PAM service file to
change, for example system-auth.
type: str
required: true
type:
description:
- The type of the PAM rule being modified.
- The C(type), C(control) and C(module_path) all must match a rule to be modified.
type: str
required: true
choices: [ account, -account, auth, -auth, password, -password, session, -session ]
control:
description:
- The control of the PAM rule being modified.
- This may be a complicated control with brackets. If this is the case, be
sure to put "[bracketed controls]" in quotes.
- The C(type), C(control) and C(module_path) all must match a rule to be modified.
type: str
required: true
module_path:
description:
- The module path of the PAM rule being modified.
- The C(type), C(control) and C(module_path) all must match a rule to be modified.
type: str
required: true
new_type:
description:
- The new type to assign to the new rule.
type: str
choices: [ account, -account, auth, -auth, password, -password, session, -session ]
new_control:
description:
- The new control to assign to the new rule.
type: str
new_module_path:
description:
- The new module path to be assigned to the new rule.
type: str
module_arguments:
description:
- When state is C(updated), the module_arguments will replace existing module_arguments.
- When state is C(args_absent) args matching those listed in module_arguments will be removed.
- When state is C(args_present) any args listed in module_arguments are added if
missing from the existing rule.
- Furthermore, if the module argument takes a value denoted by C(=),
the value will be changed to that specified in module_arguments.
type: list
state:
description:
- The default of C(updated) will modify an existing rule if type,
control and module_path all match an existing rule.
- With C(before), the new rule will be inserted before a rule matching type,
control and module_path.
- Similarly, with C(after), the new rule will be inserted after an existing rulematching type,
control and module_path.
- With either C(before) or C(after) new_type, new_control, and new_module_path must all be specified.
- If state is C(args_absent) or C(args_present), new_type, new_control, and new_module_path will be ignored.
- State C(absent) will remove the rule. The 'absent' state was added in Ansible 2.4.
type: str
choices: [ absent, before, after, args_absent, args_present, updated ]
default: updated
path:
description:
- This is the path to the PAM service files.
type: path
default: /etc/pam.d
backup:
description:
- Create a backup file including the timestamp information so you can
get the original file back if you somehow clobbered it incorrectly.
type: bool
default: no
version_added: '2.6'
s—
- name: Update pamd rule's control in /etc/pam.d/system-auth
pamd:
name: system-auth
type: auth
control: required
module_path: pam_faillock.so
new_control: sufficient
- name: Update pamd rule's complex control in /etc/pam.d/system-auth
pamd:
name: system-auth
type: session
control: '[success=1 default=ignore]'
module_path: pam_succeed_if.so
new_control: '[success=2 default=ignore]'
- name: Insert a new rule before an existing rule
pamd:
name: system-auth
type: auth
control: required
module_path: pam_faillock.so
new_type: auth
new_control: sufficient
new_module_path: pam_faillock.so
state: before
- name: Insert a new rule pam_wheel.so with argument 'use_uid' after an \
existing rule pam_rootok.so
pamd:
name: su
type: auth
control: sufficient
module_path: pam_rootok.so
new_type: auth
new_control: required
new_module_path: pam_wheel.so
module_arguments: 'use_uid'
state: after
- name: Remove module arguments from an existing rule
pamd:
name: system-auth
type: auth
control: required
module_path: pam_faillock.so
module_arguments: ''
state: updated
- name: Replace all module arguments in an existing rule
pamd:
name: system-auth
type: auth
control: required
module_path: pam_faillock.so
module_arguments: 'preauth
silent
deny=3
unlock_time=604800
fail_interval=900'
state: updated
- name: Remove specific arguments from a rule
pamd:
name: system-auth
type: session
control: '[success=1 default=ignore]'
module_path: pam_succeed_if.so
module_arguments: crond,quiet
state: args_absent
- name: Ensure specific arguments are present in a rule
pamd:
name: system-auth
type: session
control: '[success=1 default=ignore]'
module_path: pam_succeed_if.so
module_arguments: crond,quiet
state: args_present
- name: Ensure specific arguments are present in a rule (alternative)
pamd:
name: system-auth
type: session
control: '[success=1 default=ignore]'
module_path: pam_succeed_if.so
module_arguments:
- crond
- quiet
state: args_present
- name: Module arguments requiring commas must be listed as a Yaml list
pamd:
name: special-module
type: account
control: required
module_path: pam_access.so
module_arguments:
- listsep=,
state: args_present
- name: Update specific argument value in a rule
pamd:
name: system-auth
type: auth
control: required
module_path: pam_faillock.so
module_arguments: 'fail_interval=300'
state: args_present
- name: Add pam common-auth rule for duo
pamd:
name: common-auth
new_type: auth
new_control: '[success=1 default=ignore]'
new_module_path: '/lib64/security/pam_duo.so'
state: after
type: auth
module_path: pam_sss.so
control: 'requisite'
su
change_count:
description: How many rules were changed.
type: int
sample: 1
returned: success
version_added: 2.4
new_rule:
description: The changes to the rule. This was available in Ansible 2.4 and Ansible 2.5. It was removed in Ansible 2.6.
type: str
sample: None None None sha512 shadow try_first_pass use_authtok
returned: success
version_added: 2.4
updated_rule_(n):
description: The rule(s) that was/were changed. This is only available in
Ansible 2.4 and was removed in Ansible 2.5.
type: str
sample:
- password sufficient pam_unix.so sha512 shadow try_first_pass
use_authtok
returned: success
version_added: 2.4
action:
description:
- "That action that was taken and is one of: update_rule,
insert_before_rule, insert_after_rule, args_present, args_absent,
absent. This was available in Ansible 2.4 and removed in Ansible 2.8"
returned: always
type: str
sample: "update_rule"
version_added: 2.4
dest:
description:
- "Path to pam.d service that was changed. This is only available in
Ansible 2.3 and was removed in Ansible 2.4."
returned: success
type: str
sample: "/etc/pam.d/system-auth"
backupdest:
description:
- "The file name of the backup file, if created."
returned: success
type: str
version_added: 2.6
...
( t
AnsibleModuleN( t NamedTemporaryFile( t datetimes¹ (?P-?(?:auth|account|session|password))\s+
(?P\[.*\]|\S*)\s+
(?P\S*)\s*
(?P.*)\s*s (\[.*\]|\S*)t accounts -accountt auths -autht passwords -passwordt sessions -sessiont PamdLinec B` s> e Z d „ Z e d „ ƒ Z d „ Z d d „ Z d „ Z RS( c C` s | | _ d | _ d | _ d S( N( t linet Nonet prevt next( t selfR ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyt __init__& s c C` s | j d k r t St S( Nt ( R t Truet False( R ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyt is_valid+ s c C` s+ | j s t d | j f St d | j f S( Ns Rule is not valid s Rule is valid ( R R R R ( R ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyt validate1 s c C` s t S( N( R ( R t rule_typet rule_controlt rule_patht rule_args( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyt matches7 s c C` s
t | j ƒ S( N( t strR ( R ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyt __str__: s N( t __name__t
__module__R t propertyR R R R R! ( ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR $ s
t PamdCommentc B` s e Z d „ Z e d „ ƒ Z RS( c C` s t t | ƒ j | ƒ d S( N( t superR% R ( R R ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR @ s c C` s | j j d ƒ r t St S( Nt #( R t
startswithR R ( R ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR C s ( R" R# R R$ R ( ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR% > s t PamdIncludec B` s e Z d „ Z e d „ ƒ Z RS( c C` s t t | ƒ j | ƒ d S( N( R& R) R ( R R ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR K s c C` s | j j d ƒ r t St S( Ns @include( R R( R R ( R ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR N s ( R" R# R R$ R ( ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR) J s t PamdRulec ! B` sL e Z d d d d d d d g Z d d d d
d d d
d d d d d d d d d d d d d d d d d d d d! d" d# d$ d% d& d' g! Z d d( d) d* d+ d, g Z d9 d- „ Z d9 d. „ Z e d/ „ ƒ Z d0 „ Z
e d1 „ ƒ Z e j
d2 „ ƒ Z e d3 „ ƒ Z e j
d4 „ ƒ Z e d5 „ ƒ Z e d6 „ ƒ Z e d7 „ ƒ Z d8 „ Z RS(: t requiredt requisitet
sufficientt optionalt includet substackt
definitivet successt open_errt
symbol_errt service_errt
system_errt buf_errt perm_deniedt auth_errt cred_insufficientt authinfo_unavailt user_unknownt maxtriest new_authtok_reqdt acct_expiredt session_errt cred_unavailt cred_expiredt cred_errt no_module_datat conv_errt authtok_errt authtok_recover_errt authtok_lock_busyt authtok_disable_agingt try_againt ignoret abortt authtok_expiredt module_unknownt bad_itemt
conv_againt
incompletet defaultt badt diet okt donet resetc C` sL d | _ d | _ d | _ d | _ | | _ | | _ | | _ | | _ d S( N( R R R t _controlt _argsR R R R ( R R R R R ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR a s c C` s5 | | j k r1 | | j k r1 | | j k r1 t St S( N( R R R R R ( R R R R R ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR m s
c C` sR t j | ƒ } t | j d ƒ ƒ } | | j d ƒ | j d ƒ | j d ƒ | ƒ S( Nt argsR t controlt path( t
RULE_REGEXt searcht parse_module_argumentst group( t clsR t
rule_matchR ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyt rule_from_stringt s c C` sP | j r4 d j | j | j | j d j | j ƒ ƒ Sd j | j | j | j ƒ S( Ns {0: <11}{1} {2} {3}t s {0: <11}{1} {2}( R t formatR R R t join( R ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR! z s +c C` s1 t | j t ƒ r* d d j | j ƒ d S| j S( Nt [Rd t ]( t
isinstanceRX t listRf ( R ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR s c C` s[ | j d ƒ rN | j d d ƒ j d d ƒ j d d ƒ } | j d ƒ | _ n | | _ d S( NRg s = t =R Rh Rd ( R( t replacet splitRX ( R R[ ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR … s *c C` s | j s
g S| j S( N( RY ( R ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR s c C` s t | ƒ | _ d S( N( R_ RY ( R RZ ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR “ s c C` s
t | ƒ S( N( R ( R ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR — s c C` s? d } y t | ƒ } Wn t k
r* t SX| d k r; t St S( Ni ( t intt
ValueErrorR R ( Ra t
string_numt number( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyt is_action_unsigned_int› s
c C` s | j ƒ d S( Ni ( R ( R ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR § s c C` s | j t k r+ t d | j d | j f St | j t ƒ rk | j t j k rk t d | j d | j f St | j t
ƒ r x‰ | j D]{ } | j d ƒ \ } } | t j k rÊ t d | d | j f S| t j
k r‡ t j | ƒ r‡ t d | d | j f Sq‡ Wn t d | j f S( Ns Rule type, s , is not valid in rule s Rule control, Rk s Rule control value, s Rule control action, s Rule is valid ( R t VALID_TYPESR R Ri RX R R R* t valid_simple_controlsRj Rm t valid_control_valuest valid_control_actionsRr R ( R R[ t valuet action( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR « s $ N( R" R# Rt Ru Rv R R R t classmethodRc R! R$ R t setterR R Rr R R ( ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR* U s* t PamdServicec B` s˜ e Z d „ Z d „ Z d „ Z d „ Z d „ Z d d d d d „ Z d d d d d „ Z d d d d d „ Z
d „ Z d „ Z d
„ Z
d „ Z RS(
c C` s¬ d | _ d | _ x“ | j ƒ D]… } | j ƒ j d ƒ rI t | ƒ } nN | j ƒ j d ƒ rm t | ƒ } n* | d k rˆ t | ƒ } n t j
| ƒ } | j | ƒ q Wd S( NR' s @includeR ( R t _headt _tailt
splitlinest lstripR( R% R) R R* Rc t append( R t contentR t pamd_line( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR Ã s c C` sP | j d k r" | | _ | _ n* | j | _ d | _ | | j _ | | _ d S( N( R| R R} R R ( R R‚ ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR€ Ò s c C` s« | j } d } x• | d k r¦ | j | | | ƒ rš | j d k ru | j | j _ | j d k r | j | j _ q n | j | _ d | j _ | d 7} n | j } q W| S( Ni i ( R| R R R R ( R R R R t current_linet changed( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyt removeÛ s
c C` sc g } | j } xM | d k r^ t | t ƒ rR | j | | | ƒ rR | j | ƒ n | j } q W| S( N( R| R Ri R* R R€ R ( R R R R t linesRƒ ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyt getí s $
c C` s | j | | | ƒ r t St S( N( R‡ R R ( R R R R ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyt has_ruleù s c C` sý | j | | | ƒ } t | ƒ } d } xÏ | D]Ç }
t } | rd |
j | k rd t } | |
_ qd n | rŽ |
j | k rŽ t } | |
_ qŽ n | r¸ |
j | k r¸ t } | |
_ q¸ n | râ |
j | k râ t } | |
_ qâ n | r. | d 7} q. q. W| S( Ni i ( R‡ R_ R R R R R R ( R R R R t new_typet new_controlt new_patht new_argst
rules_to_findt changest current_rulet rule_changed( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyt update_ruleþ s0
c
C` s* | j | | | ƒ } d } x| D] }
t | | | | ƒ } |
j } x( | d k rp t | t ƒ rp | j } qI W| d k rÄ | j | | | ƒ rÄ | | _ | | _ |
| _ | |
_ | d 7} q" | d k r" |
j d k rë | | _ n | |
j _ |
j | _ |
| _ | |
_ | d 7} q" q" W| S( Ni i ( R‡ R* R R Ri R% R R R| (
R R R R R‰ RŠ R‹ RŒ R RŽ R t new_rulet
previous_rule( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyt
insert_before s,
"
c
C` s | j | | | ƒ } d } xö | D]î }
|
j } x( | d k r[ t | t ƒ r[ | j } q4 Wt | | | | ƒ } | d k rÄ | j | | | ƒ rÄ | | _ | | _ |
| _ | |
_ | d 7} q" | d k r" | j | _ d | _ | | j _ | | _ | |
_ | d 7} q" q" W| S( Ni i ( R‡ R R Ri R% R* R R R} (
R R R R R‰ RŠ R‹ RŒ R RŽ R t next_ruleR’ ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyt insert_afterN s*
"
c C` s | j | | | ƒ } t | ƒ } d } xS| D]K} t } t ƒ } t ƒ }
x^ | D]V } | j d ƒ rn qS qS d | k rœ | j d ƒ \ } }
|
|
| | j ƒ d s2 | j ƒ S| j } q Wt d f S( Ni s Module is valid( R| R R R R ( R Rƒ ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR Ø s
c C` s’ g } | j } x, | d k r= | j t | ƒ ƒ | j } q W| d j d ƒ ra | j d ƒ n | j d d t j ƒ j
ƒ ƒ d j | ƒ d S( Ni s # Updated by Ansibles # Updated by Ansible - s
( R| R R€ R R R( t popt insertR
t nowt isoformatRf ( R R† Rƒ ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR! á s
N( R" R# R R€ R… R‡ Rˆ R R‘ R” R– R¨ Rª R R! ( ( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR{ Á s 0+ E c C` sÈ | s
g St | t ƒ r: t | ƒ d k r: | d r: g St | t ƒ sU | g } n t ƒ } xc | D][ } xR t d t j | ƒ ƒ D]8 } | j d ƒ s¯ t j d d | ƒ n | j
| ƒ q„ Wqe W| S( Ni i Rg s \s*=\s*Rk ( Ri Rj t lent filterR t RULE_ARG_REGEXt findallR( t ret subR€ ( t module_argumentst parsed_argsR t item( ( s? /usr/lib/python2.7/site-packages/ansible/modules/system/pamd.pyR_ ñ s ,
c C` sŠ t d t d t d d d t ƒ d t d d d t d t ƒ d t d d d t ƒ d t d d d t ƒ d t d d d t ƒ d
t d d ƒ d t d d ƒ d t d d
ƒ d t d d d d d d d d d d d g ƒ d t d d d d ƒ d t d d d t ƒ ƒ d t d d d d g f d d d g f d d d
g f d d d g f d d d g f d d d
g f d d d g f d d d g f g ƒ } t ƒ } t j j | j d | j d ƒ } y( t
| d ƒ } | j ƒ } Wd QXWn3 t k
r} | j
d d | t | ƒ f ƒ n Xt | ƒ } | j d } d } | d k r“| j | j d | j d | j d | j d | j d
| j d | j d ƒ } nÉ| d k rô| j | j d | j d | j d | j d | j d
| j d | j d ƒ } nh| d k rU| j | j d | j d | j d | j d | j d
| j d | j d ƒ } n| d k r˜| j | j d | j d | j d | j d ƒ } nÄ | d k r#g t | j d ƒ D] } | j d ƒ r¸| ^ q¸rì| j
d d! ƒ n | j | j d | j d | j d | j d ƒ } n9 | d k r\| j | j d | j d | j d ƒ } n | j ƒ \ } }
| s‡| j
d |
ƒ n t d" | d k d# | d$ d% ƒ } | j ry| d" ry| j d rß| j | ƒ | d$ s4
Y{/ lÿ 1 i