mrcharles
703053430c
Port Modules/Security/secharden-2fa.sh. Configures TOTP two-factor authentication via Google Authenticator for: - SSH (publickey + keyboard-interactive) - Cockpit web interface (PAM with Google Authenticator) - Webmin (if installed, TOTP provider enabled) Includes: - Backup of existing SSH, PAM, and Cockpit configs before changes - PAM sshd and cockpit config deployment - Per-user enrollment scaffolding (setup script + instructions for root and localuser) - SSH service validation before restart 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush <crush@charm.land>
21 lines
663 B
Plaintext
21 lines
663 B
Plaintext
# PAM configuration for Cockpit with 2FA
|
|
# Managed by KNELIAC (roles/security_2fa) — do not edit by hand.
|
|
auth requisite pam_nologin.so
|
|
auth required pam_env.so
|
|
auth required pam_faillock.so preauth
|
|
auth sufficient pam_unix.so try_first_pass
|
|
auth required pam_google_authenticator.so nullok
|
|
auth required pam_faillock.so authfail
|
|
auth required pam_deny.so
|
|
|
|
account required pam_nologin.so
|
|
account include system-auth
|
|
account required pam_faillock.so
|
|
|
|
session required pam_selinux.so close
|
|
session required pam_loginuid.so
|
|
session optional pam_keyinit.so force revoke
|
|
session include system-auth
|
|
session required pam_selinux.so open
|
|
session optional pam_motd.so
|