PAM Password Policy System role?

[richm]

What do we need for a pam password policy role? Something like https://github.com/Tronde/pam_pwd ?

[richm]

I think the main thing that is missing is tests - we need some tests for the various features of the role.

There are some minor cleanup issues e.g. things like

variable: >
  "string that is quoted that should not be quoted"

Using > means you don't need additional quoting

There may be some other yamllint, ansible-lint, and ansible-test issues.

[Tronde]

Hi @richm,
I would like to give you an update on https://github.com/Tronde/pam_pwd.

I've applied the role to several testing servers in the environment at our data center. My colleagues are testing the implementation by using and working with these machines. From what I've heard so far they are satisfied with the role and what it does. While the role seems to be a good fit for our environment it lacks some features that are IMHO needed before it will be ready for public use. These are i.e.:

• Create a custom profile from the sssd profile currently in use. Currently only a state where no profile is used is covert (see Issue 4).
• Revert changes made by the role.

The latter we discussed in an email thread with subject "Best practice to revert/disable settings made by a role?" with last reply from 2022-05-18.

I still like to work on it. However I have a problem with time. With the role complying with our requirements I don't get the time (from my boss) to put further time and work into it. So I would have to do it in my spare time which is very rare at the moment.

In case you find it useful and would like to help, your help would be much appreciated. I would love to see this become a linux system role.

[richm]

Yes, this looks useful. I have added it as a system role - https://github.com/linux-system-roles/pam_pwd

[Tronde]

Thanks for adding it! I'll do my best to improve it.