infrastructure/ansible
1
0
Fork 0
Code Pull requests 7 Activity Actions

Disable the password: fallback on token failure

Browse source 
There is nothing in system-auth that we don't have in the pam module,
so this should allow us to remove pam_unix just fine.
Currently only for stg.

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
This commit is contained in:
Patrick Uiterwijk 2016-07-05 06:26:17 +00:00
parent 0a9e60db32
commit ffdb64f327
1 changed files with 3 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
files/2fa/sudo.pam
View file

@ -4,7 +4,10 @@ auth sufficient pam_url.so config=/etc/pam_url.conf
auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_deny.so
{% if env == "production" %}
auth include system-auth
{% endif %}
account include system-auth
password include system-auth
session optional pam_keyinit.so revoke