Does anyone have a good example of controlling authentication rules with PAM for Red Hat Enterprise Linux 8 using SCE Linux? I have what I believe is the correct code but it is not working as expected so I must be missing something. I found this config but it is for Oracle linux and do not see the same controls in forge for RHEL. I can also open a support ticket but wanted to check here first.

Hi there, I’m one of the engineers of the team behind sce_linux. It looks like the config that you linked is a bit outdated. Sce_linux manages pam related control through using the utility class

sce_linux::utils::password_creation_requirement

. You can check the Reference.md on the Forge to see the configuration parameters related to the mentioned utility class and the controls that use it. https://forge.puppet.com/modules/puppetlabs/sce_linux/reference

Hi Tu...thanks for replying! The config I linked was just an example of what I found in the documentation for sce_linux 2.3.0 (interesting it is out of date since that seems the latest version of sce) but it is for oracle linux and we needed it for RHEL 8/9. I have the controls from forge configured in my yaml file (and double-checked) but they aren't working on our test system. That's why I was asking if there was an example out there somewhere to compare. I probably missed an all important configuration line or something....

I’ll bring it up to the team to update our documentation so thank you for letting us know. As for the configuration, may I see what you have in yaml?

Sure and thank you!!...this is for a specific host. I've renamed it to a generic name (not our fqdn). If this test was successful, we'd add the controls into our RedHat8 yaml file for all nodes.

The yaml looks about right. An example of what the node configuration yaml I usually do is something along the line of this (I specify the benchmark and its profile/level but it’s fine if you don’t since it has default settings)

---
sce_linux::benchmark: 'cis'
sce_linux::set_grub2_password: true
sce_linux::regenerate_grub2_config: true
sce_linux::grub2_superuser: grub2su
sce_linux::config:
  profile: 'server'
  level: '2'
  control_configs:
    ensure_system_wide_crypto_policy_is_future_or_fips:
      system_crypto_policy: 'DEFAULT'

Did you by any chance apply the module to the node? Anything strange in the debug log or the console output that indicate sce_linux did anything?