diff --git a/Modulefile b/Modulefile index 53c07c4..199c8ff 100644 --- a/Modulefile +++ b/Modulefile @@ -1,5 +1,5 @@ name 'duosecurity-duo_unix' -version '0.3.1' +version '0.3.2' source 'git://github.com/duosecurity/puppet-duo_unix' author 'Duo Security' license 'GPLv2' diff --git a/manifests/generic.pp b/manifests/generic.pp index 73072a6..162ca6e 100644 --- a/manifests/generic.pp +++ b/manifests/generic.pp @@ -29,5 +29,4 @@ enable => true; } } - } diff --git a/manifests/init.pp b/manifests/init.pp index 0d21b5e..e687f0b 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -21,51 +21,23 @@ $accept_env_factor = 'no', $manage_ssh = true, $pam_unix_control = 'requisite', + $pam_primary_module = 'pam_unix.so', $package_version = 'installed', ) { if $ikey == '' or $skey == '' or $host == '' { fail('ikey, skey, and host must all be defined.') } - - if $usage != 'login' and $usage != 'pam' { - fail('You must configure a usage of duo_unix, either login or pam.') - } - - case $::osfamily { - 'RedHat': { + case $::operatingsystem { + 'Amazon': { $duo_package = 'duo_unix' $ssh_service = 'sshd' - $gpg_file = '/etc/pki/rpm-gpg/RPM-GPG-KEY-DUO' - - $pam_file = $::operatingsystemrelease ? { - /^5/ => '/etc/pam.d/system-auth', - /^(6|7|2014)/ => '/etc/pam.d/password-auth' - } - - $pam_module = $::architecture ? { - i386 => '/lib/security/pam_duo.so', - i686 => '/lib/security/pam_duo.so', - x86_64 => '/lib64/security/pam_duo.so' - } + $gpg_file = '/etc/pki/rpm-gpg/RPM-GPG-KEY-DUO' + $pam_file = '/etc/pam.d/password-auth' + $pam_module = '/lib64/security/pam_duo.so' include duo_unix::yum include duo_unix::generic } - 'Debian': { - $duo_package = 'duo-unix' - $ssh_service = 'ssh' - $gpg_file = '/etc/apt/DEB-GPG-KEY-DUO' - $pam_file = '/etc/pam.d/common-auth' - - $pam_module = $::architecture ? { - i386 => '/lib/security/pam_duo.so', - i686 => '/lib/security/pam_duo.so', - amd64 => '/lib64/security/pam_duo.so' - } - - include duo_unix::apt - include duo_unix::generic - } default: { fail("Module ${module_name} does not support ${::operatingsystem}") } @@ -73,7 +45,9 @@ if $usage == 'login' { include duo_unix::login - } else { + } elsif $usage == 'pam' { include duo_unix::pam + } else { + fail('You must configure a usage of duo_unix, either login or pam.') } } diff --git a/manifests/login.pp b/manifests/login.pp index 2c458d9..6047274 100644 --- a/manifests/login.pp +++ b/manifests/login.pp @@ -28,5 +28,4 @@ notify => Service[$duo_unix::ssh_service]; } } - } diff --git a/manifests/pam.pp b/manifests/pam.pp index e93feaa..d574d33 100644 --- a/manifests/pam.pp +++ b/manifests/pam.pp @@ -34,8 +34,8 @@ if $::osfamily == 'RedHat' { augeas { 'PAM Configuration': changes => [ - "set ${aug_pam_path}/2/control ${duo_unix::pam_unix_control}", - "ins 100 after ${aug_pam_path}/2", + "set ${aug_pam_path}/*[type = 'auth'][module = '${duo_unix::pam_primary_module}'][last()]/control ${duo_unix::pam_unix_control}", + "ins 100 after ${aug_pam_path}/*[type = 'auth'][module = '${duo_unix::pam_primary_module}']", "set ${aug_pam_path}/100/type auth", "set ${aug_pam_path}/100/control sufficient", "set ${aug_pam_path}/100/module ${duo_unix::pam_module}" @@ -57,5 +57,4 @@ onlyif => "match ${aug_match} size == 0"; } } - } diff --git a/manifests/yum.pp b/manifests/yum.pp index 2e53bd7..b65481c 100644 --- a/manifests/yum.pp +++ b/manifests/yum.pp @@ -8,23 +8,9 @@ # class duo_unix::yum { $repo_uri = 'http://pkg.duosecurity.com' - $package_state = $::duo_unix::package_version - - # Map Amazon Linux to RedHat equivalent releases - # Map RedHat 5 to CentOS 5 equivalent releases - if $::operatingsystem == 'Amazon' { - $releasever = $::operatingsystemmajrelease ? { - '2014' => '6Server', - default => undef, - } - $os = $::operatingsystem - } elsif ( $::operatingsystem == 'RedHat' and $::operatingsystemmajrelease == 5 ) { - $os = 'CentOS' - $releasever = '$releasever' - } else { - $os = $::operatingsystem - $releasever = '$releasever' - } + $version = $::duo_unix::package_version + $releasever = '6Server' + $os = 'RedHat' yumrepo { 'duosecurity': descr => 'Duo Security Repository', @@ -40,8 +26,8 @@ } } - package { $duo_unix::duo_package: - ensure => $package_state, + package { $duo_unix::duo_package: + ensure => $version, require => [ Yumrepo['duosecurity'], Exec['Duo Security GPG Import'] ]; } @@ -49,6 +35,4 @@ command => '/bin/rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-DUO', unless => '/bin/rpm -qi gpg-pubkey | grep Duo > /dev/null 2>&1' } - } -