mrcharles
703053430c
Port Modules/Security/secharden-2fa.sh. Configures TOTP two-factor authentication via Google Authenticator for: - SSH (publickey + keyboard-interactive) - Cockpit web interface (PAM with Google Authenticator) - Webmin (if installed, TOTP provider enabled) Includes: - Backup of existing SSH, PAM, and Cockpit configs before changes - PAM sshd and cockpit config deployment - Per-user enrollment scaffolding (setup script + instructions for root and localuser) - SSH service validation before restart 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush <crush@charm.land>
34 lines
950 B
Plaintext
34 lines
950 B
Plaintext
# PAM configuration for SSH with 2FA
|
|
# Managed by KNELIAC (roles/security_2fa) — do not edit by hand.
|
|
# Standard Un*x authentication
|
|
@include common-auth
|
|
|
|
# Google Authenticator 2FA
|
|
auth required pam_google_authenticator.so nullok
|
|
|
|
# Standard Un*x authorization
|
|
@include common-account
|
|
|
|
# SELinux needs to be the first session rule
|
|
session required pam_selinux.so close
|
|
session required pam_loginuid.so
|
|
|
|
# Standard Un*x session setup and teardown
|
|
@include common-session
|
|
|
|
# Print the message of the day upon successful login
|
|
session optional pam_motd.so motd=/run/motd.dynamic
|
|
session optional pam_motd.so noupdate
|
|
|
|
# Print the status of the user's mailbox upon successful login
|
|
session optional pam_mail.so standard noenv
|
|
|
|
# Set up user limits from /etc/security/limits.conf
|
|
session required pam_limits.so
|
|
|
|
# SELinux needs to intervene at login time
|
|
session required pam_selinux.so open
|
|
|
|
# Standard Un*x password updating
|
|
@include common-password
|