# How can PAM packaged profile configuration be set with Ansible on Debian?

**URL:** <https://forum.ansible.com/t/how-can-pam-packaged-profile-configuration-be-set-with-ansible-on-debian/27691>\
**Category:** Ansible Project\
**Created:** [June 2, 2018, 11:31pm UTC](https://forum.ansible.com/t/how-can-pam-packaged-profile-configuration-be-set-with-ansible-on-debian/27691 "2018-06-02T23:31:25Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Darren\_S](https://avatars.discourse-cdn.com/v4/letter/d/59ef9b/32.png) [@Darren\_S](https://forum.ansible.com/u/Darren_S)\
**Post date:** [June 2, 2018, 11:31pm UTC](https://forum.ansible.com/t/how-can-pam-packaged-profile-configuration-be-set-with-ansible-on-debian/27691/1 "2018-06-02T23:31:25Z")

</div>

ansible 2.5.4 on OpenBSD 6.3 amd64  
&nbsp;&nbsp;config file = /etc/ansible/ansible.cfg  
&nbsp;&nbsp;configured module search path =  
[u'/home/dspruell/.ansible/plugins/modules',  
u'/usr/share/ansible/plugins/modules']  
&nbsp;&nbsp;ansible python module location =  
/home/dspruell/.local/lib/python2.7/site-packages/ansible  
&nbsp;&nbsp;executable location = /home/dspruell/.local/bin/ansible  
&nbsp;&nbsp;python version = 2.7.14 (default, Mar 27 2018, 09:57:43) [GCC 4.2.1  
Compatible OpenBSD Clang 5.0.1 (tags/RELEASE\_501/final)]

I'm working on a role to install and enable pam\_duo auth module on  
hosts and am having difficulty figuring out the simplest/most elegant  
way to enable the packaged profile in Ansible. Unless I'm mistaken the  
correct procedure in standard (manual) case is to install the package  
(libpam-duo) and then use pam-auth-update(8) to invoke a debconf  
dialog to select the Duo auth module. This then modifies  
/etc/pam.d/common-auth correctly to add pam\_duo.so in correctly. For  
what it's worth this is what the selection dialog looks like when not  
enabled:

&nbsp;&nbsp;&nbsp;&nbsp;PAM profiles to enable:

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[\*] Unix authentication  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Duo Security two-factor authentication

When the desired change is made (disabling Unix auth, enabling Duo  
two-factor) this is the resulting change to debconf selections:

-libpam-runtime libpam-runtime/profiles multiselect unix  
+libpam-runtime libpam-runtime/profiles multiselect duo-unix

I've tried using the debconf module to set the selections for  
libpam-runtime package, and while I can confirm that it sets the  
selections correctly, they aren't applied.... that seems to require  
running pam-auth-update(8) afterward to actually activate them.

- name: pam\_duo - set package configuration to enable pam\_duo auth  
module  
&nbsp;&nbsp;debconf:  
&nbsp;&nbsp;&nbsp;&nbsp;name: libpam-runtime  
&nbsp;&nbsp;&nbsp;&nbsp;question: libpam-runtime/profiles  
&nbsp;&nbsp;&nbsp;&nbsp;vtype: multiselect  
&nbsp;&nbsp;&nbsp;&nbsp;value: duo-unix  
&nbsp;&nbsp;tags: [duo]

After execution of this task, the selections reflect correctly:

$ sudo debconf-get-selections |egrep ^libpam-runtime  
libpam-runtime libpam-runtime/profiles multiselect duo-unix  
libpam-runtime libpam-runtime/override boolean false  
libpam-runtime libpam-runtime/no\_profiles\_chosen error  
libpam-runtime libpam-runtime/conflicts error

...but running pam-auth-update suggests that the change is not applied:

PAM profiles to enable:

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[\*] Unix authentication  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Duo Security two-factor authentication

The target files in /etc/pam.d/ also not modified, until  
pam-auth-update is used to set the profiles. So is there a way other  
than interactive execution of pam-auth-update to configure/activate  
the profiles as I'd like?

I know I'm fundamentally misunderstanding something but not sure what,  
thanks in advance for help.