52 lines
1.8 KiB
Bash
52 lines
1.8 KiB
Bash
#!/usr/bin/env bash
|
|
# policy: dev_no-local-users — lock local account passwords so only FreeIPA accounts can auth.
|
|
# Applied when host is member of dev_no-local-users host-group.
|
|
# Revert: unlocks every account that was locked by this policy.
|
|
|
|
NO_LOCAL_USERS_STATE="$STATE_DIR/no-local-users"
|
|
|
|
_apply_no_local_users() {
|
|
log "Applying no_local_users policy — locking local account passwords"
|
|
[[ -f "$NO_LOCAL_USERS_STATE" ]] || touch "$NO_LOCAL_USERS_STATE"
|
|
|
|
while IFS=: read -r uname _ uid _; do
|
|
[[ "$uid" =~ ^[0-9]+$ ]] || continue
|
|
{ [[ "$uid" == "0" ]] || [[ "$uid" -ge 1000 ]]; } || continue
|
|
|
|
grep -qxF "$uname" "$NO_LOCAL_USERS_STATE" 2>/dev/null && continue
|
|
|
|
local hash
|
|
hash=$(getent shadow "$uname" 2>/dev/null | cut -d: -f2 || true)
|
|
[[ -z "$hash" || "$hash" == '!'* || "$hash" == '*'* ]] && continue
|
|
|
|
if passwd -l "$uname" &>/dev/null; then
|
|
echo "$uname" >> "$NO_LOCAL_USERS_STATE"
|
|
log "Locked local account: $uname"
|
|
else
|
|
warn "Failed to lock local account: $uname"
|
|
fi
|
|
done < /etc/passwd
|
|
}
|
|
|
|
_revert_no_local_users() {
|
|
[[ -f "$NO_LOCAL_USERS_STATE" ]] || return 0
|
|
log "Reverting no_local_users policy — unlocking previously locked accounts"
|
|
while IFS= read -r uname; do
|
|
[[ -z "$uname" ]] && continue
|
|
if passwd -u "$uname" &>/dev/null; then
|
|
log "Unlocked local account: $uname"
|
|
else
|
|
warn "Failed to unlock local account: $uname (may have been removed)"
|
|
fi
|
|
done < "$NO_LOCAL_USERS_STATE"
|
|
> "$NO_LOCAL_USERS_STATE"
|
|
}
|
|
|
|
if [[ "$WANT_NO_LOCAL_USERS" == true ]]; then
|
|
_apply_no_local_users
|
|
else
|
|
if [[ -f "$NO_LOCAL_USERS_STATE" ]] && [[ -s "$NO_LOCAL_USERS_STATE" ]]; then
|
|
_revert_no_local_users
|
|
fi
|
|
fi
|