Description
In roles/os_hardening/tasks/pam_rhel.yml all pam service configurations are written with
mode: "0640". This makes the pam services unreadable by e.g. Screensavers running as user accounts such as swaylock or xscreensaver, locking out users in consequence.
Is it really necessary to keep the pam.d configuration from being read?
Reproduction steps
Current Behavior
...
Expected Behavior
...
OS / Environment
Provide all relevant information below, e.g. target OS versions, network device firmware, etc.
Ansible Version
Paste verbatim output from "ansible --version" between quotes. This will be automatically formatted into code, so no need for backticks.
Collection Version
Paste version of the collection. This will be automatically formatted into code, so no need for backticks.
Additional information
...
Description
In
roles/os_hardening/tasks/pam_rhel.ymlall pam service configurations are written withmode: "0640". This makes the pam services unreadable by e.g. Screensavers running as user accounts such as swaylock or xscreensaver, locking out users in consequence.Is it really necessary to keep the pam.d configuration from being read?
Reproduction steps
Current Behavior
...
Expected Behavior
...
OS / Environment
Provide all relevant information below, e.g. target OS versions, network device firmware, etc.
Ansible Version
Collection Version
Paste version of the collection. This will be automatically formatted into code, so no need for backticks.Additional information
...