Ryan Hughes
26bcbb7dd8
Each script's static-file write moves to omarchy-settings. The scripts keep only the runtime side: reload systemd, restart dirmngr, sysctl --system, or (for lockout-limit) the PAM seds that have to stay scripted because /etc/pam.d/system-auth and /etc/pam.d/sddm-autologin are upstream-owned and need targeted line edits rather than a full-file override. faillock.conf's deny=10 (formerly inside increase-sudo-tries.sh sed) now rides through the etc-overrides dance in omarchy-settings.
13 lines
842 B
Bash
13 lines
842 B
Bash
# The faillock.conf side ships via the omarchy-settings etc-overrides
|
|
# (deny = 10). The two PAM file edits below remain a script because
|
|
# /etc/pam.d/system-auth and /etc/pam.d/sddm-autologin are upstream-owned
|
|
# and the changes are insertions, not full-file overrides.
|
|
|
|
# Increase lockout limit to 10 and decrease timeout to 2 minutes
|
|
sudo sed -i 's|^\(auth\s\+required\s\+pam_faillock.so\)\s\+preauth.*$|\1 preauth silent deny=10 unlock_time=120|' "/etc/pam.d/system-auth"
|
|
sudo sed -i 's|^\(auth\s\+\[default=die\]\s\+pam_faillock.so\)\s\+authfail.*$|\1 authfail deny=10 unlock_time=120|' "/etc/pam.d/system-auth"
|
|
|
|
# Ensure lockout limit is reset on restart
|
|
sudo sed -i '/pam_faillock\.so preauth/d' /etc/pam.d/sddm-autologin
|
|
sudo sed -i '/auth.*pam_permit\.so/a auth required pam_faillock.so authsucc' /etc/pam.d/sddm-autologin
|