* Re: [isar-cip-core] security-customizations/postinst:Add configuration for MFA
[not found] <20220707103331.3912839-1-Shreyas.Karmahe@toshiba-tsip.com>
@ 2022-07-07 10:55 ` Jan Kiszka
2022-07-08 11:41 ` Jan Kiszka
0 siblings, 1 reply; 2+ messages in thread
From: Jan Kiszka @ 2022-07-07 10:55 UTC (permalink / raw)
To: Shreyas.Karmahe, cip-dev; +Cc: dinesh.kumar, venkata.pyla, kazuhiro3.hayashi
On 07.07.22 12:33, Shreyas.Karmahe@toshiba-tsip.com wrote:
> From: Shreyas Karmahe <Shreyas.Karmahe@toshiba-tsip.com>
>
> It configures libpam-google-authenticator for achieving the IEC requirement
> for Multi-Factor Authentication.
>
> Signed-off-by: Shreyas Karmahe <Shreyas.Karmahe@toshiba-tsip.com>
> ---
> recipes-core/security-customizations/files/postinst | 11 +++++++++++
> 1 file changed, 11 insertions(+)
>
> diff --git a/recipes-core/security-customizations/files/postinst b/recipes-core/security-customizations/files/postinst
> index 3699ba2..9ba8540 100644
> --- a/recipes-core/security-customizations/files/postinst
> +++ b/recipes-core/security-customizations/files/postinst
> @@ -49,3 +49,14 @@ sed -i 's/admin_space_left_action = .*/admin_space_left_action = SYSLOG/' $AUDIT
>
> # CR2.10: Response to audit processing failures
> sed -i 's/disk_error_action = .*/disk_error_action = SYSLOG/' $AUDIT_CONF_FILE
> +
> +# CR2.11: Enable Mutli Factor Authentication for Local and Remote Session
> +SSHD_AUTH_CONFIG="/etc/pam.d/common-auth"
> +google_authenticator="auth required pam_google_authenticator.so nullok"
> +if grep -c "pam_google_authenticator.so" "${SSHD_AUTH_CONFIG}";then
> + sed -i '/pam_google_authenticator.so/ s/^#*/#/' "${SSHD_AUTH_CONFIG}"
> +fi
> +echo "auth required pam_google_authenticator.so nullok" | tee -a "${SSHD_AUTH_CONFIG}"
> +# Enable PAM configuration for Remote Session
> +sed -i 's/ChallengeResponseAuthentication no/ChallengeResponseAuthentication yes/g' "${SSHD_CONFIG}"
> +echo "AuthenticationMethods keyboard-interactive" | tee -a "${SSHD_CONFIG}"
Applied, thanks!
Jan
--
Siemens AG, Technology
Competence Center Embedded Linux
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [isar-cip-core] security-customizations/postinst:Add configuration for MFA
2022-07-07 10:55 ` [isar-cip-core] security-customizations/postinst:Add configuration for MFA Jan Kiszka
@ 2022-07-08 11:41 ` Jan Kiszka
0 siblings, 0 replies; 2+ messages in thread
From: Jan Kiszka @ 2022-07-08 11:41 UTC (permalink / raw)
To: Shreyas.Karmahe, cip-dev; +Cc: dinesh.kumar, venkata.pyla, kazuhiro3.hayashi
On 07.07.22 12:55, Jan Kiszka wrote:
> On 07.07.22 12:33, Shreyas.Karmahe@toshiba-tsip.com wrote:
>> From: Shreyas Karmahe <Shreyas.Karmahe@toshiba-tsip.com>
>>
>> It configures libpam-google-authenticator for achieving the IEC requirement
>> for Multi-Factor Authentication.
>>
>> Signed-off-by: Shreyas Karmahe <Shreyas.Karmahe@toshiba-tsip.com>
>> ---
>> recipes-core/security-customizations/files/postinst | 11 +++++++++++
>> 1 file changed, 11 insertions(+)
>>
>> diff --git a/recipes-core/security-customizations/files/postinst b/recipes-core/security-customizations/files/postinst
>> index 3699ba2..9ba8540 100644
>> --- a/recipes-core/security-customizations/files/postinst
>> +++ b/recipes-core/security-customizations/files/postinst
>> @@ -49,3 +49,14 @@ sed -i 's/admin_space_left_action = .*/admin_space_left_action = SYSLOG/' $AUDIT
>>
>> # CR2.10: Response to audit processing failures
>> sed -i 's/disk_error_action = .*/disk_error_action = SYSLOG/' $AUDIT_CONF_FILE
>> +
>> +# CR2.11: Enable Mutli Factor Authentication for Local and Remote Session
>> +SSHD_AUTH_CONFIG="/etc/pam.d/common-auth"
>> +google_authenticator="auth required pam_google_authenticator.so nullok"
>> +if grep -c "pam_google_authenticator.so" "${SSHD_AUTH_CONFIG}";then
>> + sed -i '/pam_google_authenticator.so/ s/^#*/#/' "${SSHD_AUTH_CONFIG}"
>> +fi
>> +echo "auth required pam_google_authenticator.so nullok" | tee -a "${SSHD_AUTH_CONFIG}"
>> +# Enable PAM configuration for Remote Session
>> +sed -i 's/ChallengeResponseAuthentication no/ChallengeResponseAuthentication yes/g' "${SSHD_CONFIG}"
>> +echo "AuthenticationMethods keyboard-interactive" | tee -a "${SSHD_CONFIG}"
>
> Applied, thanks!
>
As discussed in the other thread: This one is missing a DEBIAN_DEPENDS
for libpam-google-authenticator. I'm dropping this again (was only in
next) so that you can send a v3.
Jan
--
Siemens AG, Technology
Competence Center Embedded Linux
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-07-08 11:41 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <20220707103331.3912839-1-Shreyas.Karmahe@toshiba-tsip.com>
2022-07-07 10:55 ` [isar-cip-core] security-customizations/postinst:Add configuration for MFA Jan Kiszka
2022-07-08 11:41 ` Jan Kiszka
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.