diff --git a/files/etc/authselect/custom/sssd-rocky/CentOS-10-nsswitch.conf b/files/etc/authselect/custom/sssd-rocky/CentOS-10-nsswitch.conf new file mode 120000 index 0000000..e4fe758 --- /dev/null +++ b/files/etc/authselect/custom/sssd-rocky/CentOS-10-nsswitch.conf @@ -0,0 +1 @@ +RedHat-10-nsswitch.conf \ No newline at end of file diff --git a/files/etc/authselect/custom/sssd-rocky/CentOS-10-system-auth b/files/etc/authselect/custom/sssd-rocky/CentOS-10-system-auth new file mode 120000 index 0000000..246b140 --- /dev/null +++ b/files/etc/authselect/custom/sssd-rocky/CentOS-10-system-auth @@ -0,0 +1 @@ +RedHat-10-system-auth \ No newline at end of file diff --git a/files/etc/authselect/custom/sssd-rocky/RedHat-10-nsswitch.conf b/files/etc/authselect/custom/sssd-rocky/RedHat-10-nsswitch.conf new file mode 100644 index 0000000..40ea3ae --- /dev/null +++ b/files/etc/authselect/custom/sssd-rocky/RedHat-10-nsswitch.conf @@ -0,0 +1,18 @@ +# In order of likelihood of use to accelerate lookup. +passwd: {if "with-tlog":sss }files {if "with-altfiles":altfiles }{if not "with-tlog":sss }systemd +shadow: files +group: {if "with-tlog":sss [SUCCESS=merge] }files [SUCCESS=merge] {if "with-altfiles":altfiles [SUCCESS=merge] }{if not "with-tlog":sss [SUCCESS=merge] }systemd +hosts: files {if "with-libvirt":libvirt libvirt_guest }{if "with-mdns4" and "with-mdns6":mdns_minimal [NOTFOUND=return] }{if "with-mdns4" and not "with-mdns6":mdns4_minimal [NOTFOUND=return] }{if not "with-mdns4" and "with-mdns6":mdns6_minimal [NOTFOUND=return] } dns myhostname +services: files sss +netgroup: files sss +sudoers: files sss {include if "with-sudo"} +automount: files sss +subid: sss {include if "with-subid"} + +aliases: files +ethers: files +gshadow: files +networks: files dns +protocols: files +publickey: files +rpc: files diff --git a/files/etc/authselect/custom/sssd-rocky/RedHat-10-system-auth b/files/etc/authselect/custom/sssd-rocky/RedHat-10-system-auth new file mode 100644 index 0000000..fc56718 --- /dev/null +++ b/files/etc/authselect/custom/sssd-rocky/RedHat-10-system-auth @@ -0,0 +1,46 @@ +{imply "with-smartcard" if "with-smartcard-required"} +auth required pam_env.so +auth required pam_faildelay.so delay=2000000 +auth required pam_faillock.so preauth silent {include if "with-faillock"} +auth [success=1 default=ignore] pam_succeed_if.so service notin login:gdm:xdm:kdm:kde:xscreensaver:gnome-screensaver:kscreensaver quiet use_uid {include if "with-smartcard-required"} +auth [success=done ignore=ignore default=die] pam_sss.so require_cert_auth ignore_authinfo_unavail {include if "with-smartcard-required"} +auth sufficient pam_fprintd.so {include if "with-fingerprint"} +auth sufficient pam_u2f.so cue {include if "with-pam-u2f"} +auth required pam_u2f.so cue {if not "without-pam-u2f-nouserok":nouserok} {include if "with-pam-u2f-2fa"} +auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular +auth [default=1 ignore=ignore success=ok] pam_localuser.so {exclude if "with-smartcard"} +auth [default=2 ignore=ignore success=ok] pam_localuser.so {include if "with-smartcard"} +auth [success=done authinfo_unavail=ignore user_unknown=ignore ignore=ignore default=die] pam_sss.so try_cert_auth {include if "with-smartcard"} +auth sufficient pam_unix.so {if not "without-nullok":nullok} +auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular {include if "with-gssapi"} +auth sufficient pam_sss_gss.so {include if "with-gssapi"} +auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular +auth sufficient pam_sss.so forward_pass +auth required pam_faillock.so authfail {include if "with-faillock"} +auth optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"} +auth required pam_deny.so + +account required pam_access.so {include if "with-pamaccess"} +account required pam_faillock.so {include if "with-faillock"} +account required pam_unix.so +account sufficient pam_localuser.so {exclude if "with-files-access-provider"} +account sufficient pam_usertype.so issystem +account [default=bad success=ok user_unknown=ignore] pam_sss.so +account required pam_permit.so + +password requisite pam_pwquality.so local_users_only +password [default=1 ignore=ignore success=ok] pam_localuser.so {include if "with-pwhistory"} +password requisite pam_pwhistory.so use_authtok remember=5 {include if "with-pwhistory"} +password sufficient pam_unix.so yescrypt shadow {if not "without-nullok":nullok} use_authtok +password [success=1 default=ignore] pam_localuser.so +password sufficient pam_sss.so use_authtok +password required pam_deny.so + +session optional pam_keyinit.so revoke +session required pam_limits.so +-session optional pam_systemd.so +session optional pam_oddjob_mkhomedir.so umask=0077 {include if "with-mkhomedir"} +session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid +session required pam_unix.so +session optional pam_sss.so +session optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"} diff --git a/files/etc/authselect/custom/sssd-rocky/Rocky-10-nsswitch.conf b/files/etc/authselect/custom/sssd-rocky/Rocky-10-nsswitch.conf new file mode 120000 index 0000000..e4fe758 --- /dev/null +++ b/files/etc/authselect/custom/sssd-rocky/Rocky-10-nsswitch.conf @@ -0,0 +1 @@ +RedHat-10-nsswitch.conf \ No newline at end of file diff --git a/files/etc/authselect/custom/sssd-rocky/Rocky-10-system-auth b/files/etc/authselect/custom/sssd-rocky/Rocky-10-system-auth new file mode 120000 index 0000000..246b140 --- /dev/null +++ b/files/etc/authselect/custom/sssd-rocky/Rocky-10-system-auth @@ -0,0 +1 @@ +RedHat-10-system-auth \ No newline at end of file