wip - portare tutto su sssd

This commit is contained in:
Paolo Asperti 2020-03-23 15:11:27 +01:00
parent ce5ae70764
commit 1a1cb76179
Signed by: paspo
GPG Key ID: 06D46905D19D5182
14 changed files with 340 additions and 107 deletions

View File

@ -10,7 +10,7 @@ Source1: COPYING
URL: %{url_prefix}/%{name}
Requires: libreschool-release
Requires: libreschool-client-manager
Requires: nethserver-directory
Requires: nethserver-directory || nethserver-dc
Requires: nfs-utils
Requires(post): systemd
Requires(preun): systemd

4
links.txt Normal file
View File

@ -0,0 +1,4 @@
https://www.tecmint.com/integrate-ubuntu-to-samba4-ad-dc-with-sssd-and-realm/
https://wiki.ubuntu.com/Enterprise/Authentication/sssd
https://help.ubuntu.com/lts/serverguide/sssd-ad.html
https://github.com/NethServer/nethserver-sssd

View File

@ -0,0 +1,17 @@
---
- name: Check if gdm3 is installed
shell: dpkg-query -W -f='${Status}' gdm3 | grep 'install ok installed'
register: gdm3_installed
failed_when: no
changed_when: no
- name: Adjust gdm3 settings
ini_file:
path: /etc/gdm3/greeter.dconf-defaults
section: org/gnome/login-screen
option: disable-user-list
value: "true"
no_extra_spaces: yes
when: gdm3_installed.rc == 0

View File

@ -0,0 +1,30 @@
---
########################## nslcd
- name: Set bind DN
debconf:
name: nslcd
question: nslcd/ldap-binddn
value: cn=ldapservice,dc=directory,dc=nh
vtype: string
- name: Set base DN
debconf:
name: nslcd
question: nslcd/ldap-base
value: dc=directory,dc=nh
vtype: string
- name: Set LDAP server
debconf:
name: nslcd
question: nslcd/ldap-uris
value: ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/
vtype: string
- name: Set bind password
debconf:
name: nslcd
question: nslcd/ldap-bindpw
value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}"
vtype: password

View File

@ -0,0 +1,49 @@
---
- name: nsswitch settings for passwd
lineinfile:
backup: yes
path: /etc/nsswitch.conf
state: present
regexp: '^passwd\:'
line: 'passwd: compat ldap'
# line: 'passwd: files ldap'
- name: nsswitch settings for group
lineinfile:
backup: yes
path: /etc/nsswitch.conf
state: present
regexp: '^group\:'
line: 'passwd: compat ldap'
# line: 'passwd: files ldap'
- name: nsswitch settings for shadow
lineinfile:
backup: yes
path: /etc/nsswitch.conf
state: present
regexp: '^shadow\:'
line: 'passwd: compat ldap'
# line: 'passwd: files ldap'
- name: ldap configuration
template:
src: 'ldap.conf'
dest: '/etc/ldap.conf'
owner: 'root'
group: 'root'
mode: 0644
- name: Installing client packages
apt:
name: [ 'libnss-ldap' ]
state: latest
- name: Tweak idmap.conf
ini_file:
path: /etc/idmapd.conf
section: Translation
option: Method
value: nsswitch
mode: 0644

View File

@ -1,51 +1,39 @@
---
- name: Installing nfs client packages
apt:
name: [ 'nfs-common' ]
state: latest
- name: ldap configuration
template:
src: 'ldap.conf'
dest: '/etc/ldap.conf'
owner: 'root'
group: 'root'
mode: 0644
- name: Create directory for user homes
file: path=/var/lib/nethserver/home state=directory owner=root group=root mode=0755
- name: nsswitch settings for passwd
lineinfile:
backup: yes
path: /etc/nsswitch.conf
state: present
regexp: '^passwd\:'
line: 'passwd: files ldap'
- name: Add mount to fstab
mount:
path: /var/lib/nethserver/home
src: "{{ esmith.SystemName }}.{{ esmith.DomainName }}:/var/lib/nethserver/home"
fstype: nfs4
opts: rw,async,_netdev
passno: "1"
dump: "0"
state: mounted
- name: nsswitch settings for group
lineinfile:
backup: yes
path: /etc/nsswitch.conf
state: present
regexp: '^group\:'
line: 'group: files ldap'
########################## nslcd
- name: Set bind DN
debconf:
name: nslcd
question: nslcd/ldap-binddn
value: cn=ldapservice,dc=directory,dc=nh
vtype: string
- name: nsswitch settings for shadow
lineinfile:
backup: yes
path: /etc/nsswitch.conf
state: present
regexp: '^shadow\:'
line: 'shadow: files ldap'
- name: Set base DN
debconf:
name: nslcd
question: nslcd/ldap-base
value: dc=directory,dc=nh
vtype: string
- name: Set LDAP server
debconf:
name: nslcd
question: nslcd/ldap-uris
value: ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/
vtype: string
- name: Set bind password
debconf:
name: nslcd
question: nslcd/ldap-bindpw
value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}"
vtype: password
------------ cut here
########################## ldap-auth
- name: Set bind DN
@ -152,32 +140,6 @@
name: [ 'libnss-ldapd', 'ldap-auth-config' ]
state: latest
# nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,dnsmasq,games,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,statd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data
########################## nsswitch
- name: nsswitch settings for passwd
lineinfile:
path: /etc/nsswitch.conf
state: present
regexp: '^passwd\:'
line: 'passwd: files ldap'
- name: nsswitch settings for group
lineinfile:
path: /etc/nsswitch.conf
state: present
regexp: '^group\:'
line: 'group: files ldap'
- name: nsswitch settings for shadow
lineinfile:
path: /etc/nsswitch.conf
state: present
regexp: '^shadow\:'
line: 'shadow: files ldap'
########################## idmap.conf
- name: Tweak idmap.conf
ini_file:
@ -185,35 +147,4 @@
section: Translation
option: Method
value: nsswitch
mode: 0644
########################## DM
- name: Check if lightdm is installed
shell: dpkg-query -W -f='${Status}' lightdm | grep 'install ok installed'
register: lightdm_installed
failed_when: no
changed_when: no
- name: Check if gdm3 is installed
shell: dpkg-query -W -f='${Status}' gdm3 | grep 'install ok installed'
register: gdm3_installed
failed_when: no
changed_when: no
- name: Adjusting lightdm settings
template:
src: 'lightdm.conf'
dest: '/usr/share/lightdm/lightdm.conf.d/50-libreschool.conf'
owner: 'root'
group: 'root'
mode: 0644
when: lightdm_installed.rc == 0
- name: Adjust gdm3 settings
ini_file:
path: /etc/gdm3/greeter.dconf-defaults
section: org/gnome/login-screen
option: disable-user-list
value: "true"
no_extra_spaces: yes
when: gdm3_installed.rc == 0
mode: 0644

View File

@ -0,0 +1,17 @@
---
- name: Check if lightdm is installed
shell: dpkg-query -W -f='${Status}' lightdm | grep 'install ok installed'
register: lightdm_installed
failed_when: no
changed_when: no
- name: Adjusting lightdm settings
template:
src: 'lightdm.conf'
dest: '/usr/share/lightdm/lightdm.conf.d/50-libreschool.conf'
owner: 'root'
group: 'root'
mode: 0644
when: lightdm_installed.rc == 0

View File

@ -0,0 +1,13 @@
---
- include: nfs.yaml
- include: ldap-xenial.yaml
when: (ansible_distribution == "Zorin OS") and (ansible_distribution_version == "12")
# TODO: check if this is still useful in /etc/ldap.conf
# nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,dnsmasq,games,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,statd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data
- include: gdm3.yaml
- include: lightdm.yaml

View File

@ -0,0 +1,19 @@
---
- name: Installing nfs client packages
apt:
name: [ 'nfs-common' ]
state: latest
- name: Create directory for user homes
file: path=/var/lib/nethserver/home state=directory owner=root group=root mode=0755
- name: Add mount to fstab
mount:
path: /var/lib/nethserver/home
src: "{{ esmith.SystemName }}.{{ esmith.DomainName }}:/var/lib/nethserver/home"
fstype: nfs4
opts: rw,async,_netdev
passno: "1"
dump: "0"
state: mounted

View File

@ -0,0 +1,116 @@
---
########################## ldap-auth
- name: Set bind DN
debconf:
name: ldap-auth-config
question: ldap-auth-config/binddn
value: cn=ldapservice,dc=directory,dc=nh
vtype: string
- name: Set root bind DN
debconf:
name: ldap-auth-config
question: ldap-auth-config/rootbinddn
value: cn=ldapservice,dc=directory,dc=nh
vtype: string
- name: Set base DN
debconf:
name: ldap-auth-config
question: ldap-auth-config/ldapns/base-dn
value: dc=directory,dc=nh
vtype: string
- name: Set login required
debconf:
name: ldap-auth-config
question: ldap-auth-config/dblogin
value: "true"
vtype: boolean
- name: Set root login required
debconf:
name: ldap-auth-config
question: ldap-auth-config/dbrootlogin
value: "true"
vtype: boolean
- name: Set ldap override
debconf:
name: ldap-auth-config
question: ldap-auth-config/override
value: "true"
vtype: boolean
- name: Set move-to-debconf
debconf:
name: ldap-auth-config
question: ldap-auth-config/move-to-debconf
value: "true"
vtype: boolean
- name: Set pam password
debconf:
name: ldap-auth-config
question: ldap-auth-config/pam_password
value: exop
vtype: select
- name: Set LDAP server
debconf:
name: ldap-auth-config
question: ldap-auth-config/ldapns/ldap-server
value: ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/
vtype: string
- name: Set LDAP server version
debconf:
name: ldap-auth-config
question: ldap-auth-config/ldapns/ldap_version
value: "3"
vtype: select
- name: Set bind password
debconf:
name: ldap-auth-config
question: ldap-auth-config/bindpw
value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}"
vtype: password
- name: Set root bind password
debconf:
name: ldap-auth-config
question: ldap-auth-config/rootbindpw
value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}"
vtype: password
########################## libnss-ldapd
- name: Configure libnss for ldap
debconf:
name: libnss-ldapd
question: libnss-ldapd/nsswitch
value: "passwd, group, shadow"
vtype: multiselect
- name: Configure libnss for not removing ldap configuration
debconf:
name: libnss-ldapd
question: libnss-ldapd/clean_nsswitch
value: "false"
vtype: boolean
########################## packages install
- name: Installing client packages
apt:
name: [ 'libnss-ldapd', 'ldap-auth-config' ]
state: latest
########################## idmap.conf
- name: Tweak idmap.conf
ini_file:
path: /etc/idmapd.conf
section: Translation
option: Method
value: nsswitch
mode: 0644

View File

@ -1,9 +1,9 @@
base dc=directory,dc=nh
uri ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/
ldap_version 3
binddn cn=libuser,dc=directory,dc=nh
bindpw {{ lookup('file', '/var/lib/nethserver/secrets/libuser') }}
rootbinddn cn=libuser,dc=directory,dc=nh
pam_password md5
binddn cn=ldapservice,dc=directory,dc=nh
bindpw {{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}
rootbinddn cn=ldapservice,dc=directory,dc=nh
pam_password exop
#ssl start_tls
nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,dnsmasq,games,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,statd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data

View File

@ -0,0 +1,27 @@
[sssd]
domains = libre.school
config_file_version = 2
services = nss, pam
default_domain_suffix = libre.school
[domain/libre.school]
use_fully_qualified_names = True
id_provider = ad
access_provider = ad
ad_domain = ad.libre.school
krb5_realm = ad.libre.school
krb5_store_password_if_offline = True
ldap_id_mapping = True
ad_maximum_machine_account_password_age = 0
ad_server = nsdc-pdc.ad.libre.school
cache_credentials = True
override_homedir = /var/lib/nethserver/home/%u
default_shell = /usr/lib/openssh/sftp-server
realmd_tags = manages-system joined-with-samba
[nss]
filter_users = ldapservice

View File

@ -1,6 +1,16 @@
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by dn="cn=libuser,dc=directory,dc=nh" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by * read
olcAccess: {0}to attrs=userPassword,shadowLastChange
by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write
by dn="cn=libuser,dc=directory,dc=nh" write
by dn="cn=ldapservice,dc=directory,dc=nh" write
by anonymous auth
by self write
by * none
olcAccess: {1}to dn.base=""
by * read
olcAccess: {2}to *
by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write
by * read
by anonymous auth