Am 16.05.2022 um 19:16 schrieb Richard Megginson:
[...]
> Another consideration: what if you want to remove all of your previous
> settings and restore the pam configuration to the system defaults?
> As a system administrator, I am inheriting a set of heterogeneous machines,
> and I don't know the state of pam password settings on those machines, and
> I need them all to be the same.
>
> In that use case, it would be nice to be able to revert the settings to the
> system default, then apply the given settings, to ensure that all machines
> are configured identically.
I've spent some time thinking about how to do that. And I find it pretty
hard to accomplish. The PAM stack is very complex. My role only
configures a small part of it (pam_pwquality and pam_faillock). Would I
only restore the settings from these two to the systems default settings
it could lead to a misunderstanding when speaking of system default.
Other settings could have been changed I don't be aware of.
Probably it would be best if the role supports all possible PAM options,
like the system role for sshd. But I have to admit that's beyond my
capabilities. I would like to focus on the aspect of password quality. I
even think about removing the pam_faillock functionality entirely,
because it has nothing to do with the password quality and I couldn't
answer the question why would I prefer pam_faillock over pam_faildelay
for example.
Well, currently I'm unsure how to proceed.
[...]
> The last part is more complicated than it seems. One simple way would be
> to replace all config files with the system defaults, then apply your
> changes, which would ensure that the system is in the exact end state you
> desire. However, the role would report changes always and would not be
> idempotent. What you really want to know is - What will be the end state
> of the system if I apply these changes, and is that state the same state
> that currently exists?
>
As I wrote above, I don't control the whole PAM configuration, only a
small well defined part of it. So it's true in my case I won't know the
exact state of the PAM stack. Maybe that's an unusual case where I only
control defined aspects of a systems configuration while other 'roots'
have control about all config options instead those which are delegated
to me.
I understand that there are a lot more details I have to think about
when it comes to using this outside of my own environment. I'll have to
think about it to figure out if I have the time and ability to do that.
Joerg