Fix stig over hardening of kiosk account

diskless.pkr.hcl

@@ -354,6 +354,10 @@ build {
       # Install the staged unit, weston config, and session wrapper.
       "install -D -m0755 /tmp/kiosk/kiosk-session /usr/local/bin/kiosk-session",
       "install -D -m0644 /tmp/kiosk/kiosk.service /etc/systemd/system/kiosk.service",
+      # Dedicated PAM stack for the autologin session (PAMName=kiosk). Decouples
+      # the passwordless kiosk user from the STIG-hardened login/system-auth
+      # account phase (faillock + aging) that would otherwise deny the session.
+      "install -D -m0644 /tmp/kiosk/kiosk.pam /etc/pam.d/kiosk",
       "install -D -m0644 /tmp/kiosk/weston.ini /etc/xdg/weston/weston.ini",
       # Chromium managed policy: stops the browser phoning home to Google
       # (sign-in, variations, optimization-guide, component/auto update, metrics,
@@ -368,7 +372,7 @@ build {
       "printf 'KIOSK_URL=%s\\n' \"$KIOSK_URL\" > /etc/kiosk/kiosk.env",
       "chmod 0644 /etc/kiosk/kiosk.env",
       # Label the new files so they survive into the enforcing erofs.
-      "restorecon -R /usr/local/bin/kiosk-session /etc/systemd/system/kiosk.service /etc/xdg/weston /etc/kiosk /etc/chromium /etc/chromium-browser",
+      "restorecon -R /usr/local/bin/kiosk-session /etc/systemd/system/kiosk.service /etc/pam.d/kiosk /etc/xdg/weston /etc/kiosk /etc/chromium /etc/chromium-browser",
       # Boot graphical and start the kiosk (replaces the tty1 getty).
       "systemctl enable kiosk.service",
       "systemctl set-default graphical.target",
@@ -483,6 +487,43 @@ build {
     destination = "${var.artifact_dir}/${var.image_version}/stig-arf.xml"
   }
 
+  # --- 2c-STIG-postfix. Keep the key-only APPLIANCE ACCOUNTS usable after STIG.
+  # STIG turns on pam_faillock (account phase) + password aging/inactivity
+  # (account_disable_post_pw_expiration, accounts_*_age_*). The kiosk autologin
+  # user and the fleet admin are PASSWORDLESS / key-only, so the hardened account
+  # phase rejects them: the kiosk PAM session never opens (getty keeps tty1), and
+  # sshd denies the otherwise-valid key as "Permission denied (publickey)" (key
+  # auth succeeds, then pam_acct_mgmt fails). Runs AFTER remediation so STIG can't
+  # re-break it. Justified in docs/stig-deviations.md (#10, appliance accounts).
+  provisioner "shell" {
+    environment_vars = [
+      "ENABLE_STIG=${var.enable_stig}",
+      "ADMIN_USER=${var.admin_user}",
+    ]
+    inline = [
+      "set -e",
+      "if [ \"$ENABLE_STIG\" != \"true\" ]; then echo '2c-STIG-postfix: enable_stig=false -> nothing to undo.'; exit 0; fi",
+      # Exempt each appliance account from password aging/inactivity/expiry and
+      # clear any faillock tally (these accounts have NO password to age).
+      "for u in \"$ADMIN_USER\" kiosk; do",
+      "  { [ -n \"$u\" ] && id \"$u\" >/dev/null 2>&1; } || continue",
+      "  echo \"==> exempting key-only account '$u' from STIG password aging + faillock\"",
+      "  chage -M -1 -m 0 -I -1 -E -1 \"$u\"",
+      "  chage -d \"$(date +%Y-%m-%d)\" \"$u\"",
+      "  command -v faillock >/dev/null 2>&1 && faillock --user \"$u\" --reset || true",
+      "  { [ -d \"/home/$u/.ssh\" ] && restorecon -R \"/home/$u/.ssh\"; } || true",
+      "done",
+      # sshd: bypass the hardened ACCOUNT stack (faillock/aging) for the key-only
+      # admin only, inserted as the FIRST account rule so a valid key can't be
+      # denied by pam_acct_mgmt. Other users keep the full STIG account policy.
+      "if [ -n \"$ADMIN_USER\" ] && id \"$ADMIN_USER\" >/dev/null 2>&1; then",
+      "  grep -q \"pam_succeed_if.so user = $ADMIN_USER\" /etc/pam.d/sshd || sed -i \"0,/^account/ s//account     sufficient  pam_succeed_if.so user = $ADMIN_USER quiet\\n&/\" /etc/pam.d/sshd",
+      "  restorecon /etc/pam.d/sshd",
+      "  echo \"==> /etc/pam.d/sshd: account-stack bypass ensured for $ADMIN_USER\"",
+      "fi",
+    ]
+  }
+
   # --- 2d. Final image hygiene: strip caches/logs after the LAST dnf step --
   # MUST be the last provisioner. The `dnf clean all` in step 2 runs BEFORE the
   # kiosk (2b) and admin (2c) provisioners, and 2b enables EPEL + installs