From dc0a4250aba8511cdd5eff1f7f0e78c81a53bc1e Mon Sep 17 00:00:00 2001 From: Denis Chevalier Date: Thu, 6 Aug 2026 12:08:03 +0200 Subject: move umask to system-login --- etc.bash | 2 +- etc/pam.d/login | 8 -------- etc/pam.d/system-login | 21 +++++++++++++++++++++ 3 files changed, 22 insertions(+), 9 deletions(-) delete mode 100644 etc/pam.d/login create mode 100644 etc/pam.d/system-login diff --git a/etc.bash b/etc.bash index 282cf16..cff3c36 100755 --- a/etc.bash +++ b/etc.bash @@ -3,7 +3,7 @@ sudo cp -rv etc/keyd/* /etc/keyd/ sudo cp -v etc/pacman.conf /etc/ sudo cp -v etc/pam.d/system-local-login /etc/pam.d -sudo cp -v etc/pam.d/login /etc/pam.d +sudo cp -v etc/pam.d/system-login /etc/pam.d sudo cp -v etc/updatedb.conf /etc/ sudo cp -v etc/sysctl.d/99-security.conf /etc/sysctl.d sudo cp -v etc/sysctl.d/98-hardened-overrides.conf /etc/sysctl.d diff --git a/etc/pam.d/login b/etc/pam.d/login deleted file mode 100644 index 59a4be3..0000000 --- a/etc/pam.d/login +++ /dev/null @@ -1,8 +0,0 @@ -#%PAM-1.0 - -auth requisite pam_nologin.so -auth include system-local-login -account include system-local-login -session include system-local-login -session optional pam_umask.so umask=0077 -password include system-local-login diff --git a/etc/pam.d/system-login b/etc/pam.d/system-login new file mode 100644 index 0000000..ddab1e9 --- /dev/null +++ b/etc/pam.d/system-login @@ -0,0 +1,21 @@ +#%PAM-1.0 + +auth required pam_shells.so +auth requisite pam_nologin.so +auth include system-auth + +account required pam_access.so +account required pam_nologin.so +account include system-auth + +password include system-auth + +session optional pam_loginuid.so +session optional pam_keyinit.so force revoke +session include system-auth +session optional pam_lastlog2.so silent +session optional pam_motd.so +session optional pam_mail.so dir=/var/spool/mail standard quiet +session optional pam_umask.so umask=0077 +-session optional pam_systemd.so +session required pam_env.so -- cgit