diff --git a/libreschool-nfs.spec b/libreschool-nfs.spec index 20ba823..496c6ad 100644 --- a/libreschool-nfs.spec +++ b/libreschool-nfs.spec @@ -10,7 +10,7 @@ Source1: COPYING URL: %{url_prefix}/%{name} Requires: libreschool-release Requires: libreschool-client-manager -Requires: nethserver-directory +Requires: nethserver-directory || nethserver-dc Requires: nfs-utils Requires(post): systemd Requires(preun): systemd diff --git a/links.txt b/links.txt new file mode 100644 index 0000000..67fb35f --- /dev/null +++ b/links.txt @@ -0,0 +1,4 @@ +https://www.tecmint.com/integrate-ubuntu-to-samba4-ad-dc-with-sssd-and-realm/ +https://wiki.ubuntu.com/Enterprise/Authentication/sssd +https://help.ubuntu.com/lts/serverguide/sssd-ad.html +https://github.com/NethServer/nethserver-sssd diff --git a/root/etc/ansible/roles/nfs-client/tasks/gdm3.yaml b/root/etc/ansible/roles/nfs-client/tasks/gdm3.yaml new file mode 100644 index 0000000..a8dc53a --- /dev/null +++ b/root/etc/ansible/roles/nfs-client/tasks/gdm3.yaml @@ -0,0 +1,17 @@ +--- + + - name: Check if gdm3 is installed + shell: dpkg-query -W -f='${Status}' gdm3 | grep 'install ok installed' + register: gdm3_installed + failed_when: no + changed_when: no + + - name: Adjust gdm3 settings + ini_file: + path: /etc/gdm3/greeter.dconf-defaults + section: org/gnome/login-screen + option: disable-user-list + value: "true" + no_extra_spaces: yes + when: gdm3_installed.rc == 0 + \ No newline at end of file diff --git a/root/etc/ansible/roles/nfs-client/tasks/ldap-16.04.yml b/root/etc/ansible/roles/nfs-client/tasks/ldap-16.04.yml new file mode 100644 index 0000000..be4e5aa --- /dev/null +++ b/root/etc/ansible/roles/nfs-client/tasks/ldap-16.04.yml @@ -0,0 +1,30 @@ +--- + +########################## nslcd +- name: Set bind DN + debconf: + name: nslcd + question: nslcd/ldap-binddn + value: cn=ldapservice,dc=directory,dc=nh + vtype: string + +- name: Set base DN + debconf: + name: nslcd + question: nslcd/ldap-base + value: dc=directory,dc=nh + vtype: string + +- name: Set LDAP server + debconf: + name: nslcd + question: nslcd/ldap-uris + value: ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/ + vtype: string + +- name: Set bind password + debconf: + name: nslcd + question: nslcd/ldap-bindpw + value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}" + vtype: password diff --git a/root/etc/ansible/roles/nfs-client/tasks/ldap-bionic.yaml b/root/etc/ansible/roles/nfs-client/tasks/ldap-bionic.yaml new file mode 100644 index 0000000..e69de29 diff --git a/root/etc/ansible/roles/nfs-client/tasks/ldap-xenial.yaml b/root/etc/ansible/roles/nfs-client/tasks/ldap-xenial.yaml new file mode 100644 index 0000000..70478e2 --- /dev/null +++ b/root/etc/ansible/roles/nfs-client/tasks/ldap-xenial.yaml @@ -0,0 +1,49 @@ +--- + +- name: nsswitch settings for passwd + lineinfile: + backup: yes + path: /etc/nsswitch.conf + state: present + regexp: '^passwd\:' + line: 'passwd: compat ldap' +# line: 'passwd: files ldap' + +- name: nsswitch settings for group + lineinfile: + backup: yes + path: /etc/nsswitch.conf + state: present + regexp: '^group\:' + line: 'passwd: compat ldap' +# line: 'passwd: files ldap' + +- name: nsswitch settings for shadow + lineinfile: + backup: yes + path: /etc/nsswitch.conf + state: present + regexp: '^shadow\:' + line: 'passwd: compat ldap' +# line: 'passwd: files ldap' + +- name: ldap configuration + template: + src: 'ldap.conf' + dest: '/etc/ldap.conf' + owner: 'root' + group: 'root' + mode: 0644 + +- name: Installing client packages + apt: + name: [ 'libnss-ldap' ] + state: latest + +- name: Tweak idmap.conf + ini_file: + path: /etc/idmapd.conf + section: Translation + option: Method + value: nsswitch + mode: 0644 diff --git a/root/etc/ansible/roles/nfs-client/tasks/main.yml b/root/etc/ansible/roles/nfs-client/tasks/ldap-zorin-12asd.yml similarity index 58% rename from root/etc/ansible/roles/nfs-client/tasks/main.yml rename to root/etc/ansible/roles/nfs-client/tasks/ldap-zorin-12asd.yml index 9a70b8c..9334d4e 100644 --- a/root/etc/ansible/roles/nfs-client/tasks/main.yml +++ b/root/etc/ansible/roles/nfs-client/tasks/ldap-zorin-12asd.yml @@ -1,51 +1,39 @@ --- -- name: Installing nfs client packages - apt: - name: [ 'nfs-common' ] - state: latest +- name: ldap configuration + template: + src: 'ldap.conf' + dest: '/etc/ldap.conf' + owner: 'root' + group: 'root' + mode: 0644 -- name: Create directory for user homes - file: path=/var/lib/nethserver/home state=directory owner=root group=root mode=0755 +- name: nsswitch settings for passwd + lineinfile: + backup: yes + path: /etc/nsswitch.conf + state: present + regexp: '^passwd\:' + line: 'passwd: files ldap' -- name: Add mount to fstab - mount: - path: /var/lib/nethserver/home - src: "{{ esmith.SystemName }}.{{ esmith.DomainName }}:/var/lib/nethserver/home" - fstype: nfs4 - opts: rw,async,_netdev - passno: "1" - dump: "0" - state: mounted +- name: nsswitch settings for group + lineinfile: + backup: yes + path: /etc/nsswitch.conf + state: present + regexp: '^group\:' + line: 'group: files ldap' -########################## nslcd -- name: Set bind DN - debconf: - name: nslcd - question: nslcd/ldap-binddn - value: cn=ldapservice,dc=directory,dc=nh - vtype: string +- name: nsswitch settings for shadow + lineinfile: + backup: yes + path: /etc/nsswitch.conf + state: present + regexp: '^shadow\:' + line: 'shadow: files ldap' -- name: Set base DN - debconf: - name: nslcd - question: nslcd/ldap-base - value: dc=directory,dc=nh - vtype: string -- name: Set LDAP server - debconf: - name: nslcd - question: nslcd/ldap-uris - value: ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/ - vtype: string - -- name: Set bind password - debconf: - name: nslcd - question: nslcd/ldap-bindpw - value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}" - vtype: password +------------ cut here ########################## ldap-auth - name: Set bind DN @@ -152,32 +140,6 @@ name: [ 'libnss-ldapd', 'ldap-auth-config' ] state: latest - -# nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,dnsmasq,games,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,statd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data - - -########################## nsswitch -- name: nsswitch settings for passwd - lineinfile: - path: /etc/nsswitch.conf - state: present - regexp: '^passwd\:' - line: 'passwd: files ldap' - -- name: nsswitch settings for group - lineinfile: - path: /etc/nsswitch.conf - state: present - regexp: '^group\:' - line: 'group: files ldap' - -- name: nsswitch settings for shadow - lineinfile: - path: /etc/nsswitch.conf - state: present - regexp: '^shadow\:' - line: 'shadow: files ldap' - ########################## idmap.conf - name: Tweak idmap.conf ini_file: @@ -185,35 +147,4 @@ section: Translation option: Method value: nsswitch - mode: 0644 - -########################## DM -- name: Check if lightdm is installed - shell: dpkg-query -W -f='${Status}' lightdm | grep 'install ok installed' - register: lightdm_installed - failed_when: no - changed_when: no - -- name: Check if gdm3 is installed - shell: dpkg-query -W -f='${Status}' gdm3 | grep 'install ok installed' - register: gdm3_installed - failed_when: no - changed_when: no - -- name: Adjusting lightdm settings - template: - src: 'lightdm.conf' - dest: '/usr/share/lightdm/lightdm.conf.d/50-libreschool.conf' - owner: 'root' - group: 'root' - mode: 0644 - when: lightdm_installed.rc == 0 - -- name: Adjust gdm3 settings - ini_file: - path: /etc/gdm3/greeter.dconf-defaults - section: org/gnome/login-screen - option: disable-user-list - value: "true" - no_extra_spaces: yes - when: gdm3_installed.rc == 0 + mode: 0644 \ No newline at end of file diff --git a/root/etc/ansible/roles/nfs-client/tasks/lightdm.yaml b/root/etc/ansible/roles/nfs-client/tasks/lightdm.yaml new file mode 100644 index 0000000..d8c1b18 --- /dev/null +++ b/root/etc/ansible/roles/nfs-client/tasks/lightdm.yaml @@ -0,0 +1,17 @@ +--- + + - name: Check if lightdm is installed + shell: dpkg-query -W -f='${Status}' lightdm | grep 'install ok installed' + register: lightdm_installed + failed_when: no + changed_when: no + + - name: Adjusting lightdm settings + template: + src: 'lightdm.conf' + dest: '/usr/share/lightdm/lightdm.conf.d/50-libreschool.conf' + owner: 'root' + group: 'root' + mode: 0644 + when: lightdm_installed.rc == 0 + \ No newline at end of file diff --git a/root/etc/ansible/roles/nfs-client/tasks/main.yaml b/root/etc/ansible/roles/nfs-client/tasks/main.yaml new file mode 100644 index 0000000..46fda97 --- /dev/null +++ b/root/etc/ansible/roles/nfs-client/tasks/main.yaml @@ -0,0 +1,13 @@ +--- + +- include: nfs.yaml + +- include: ldap-xenial.yaml + when: (ansible_distribution == "Zorin OS") and (ansible_distribution_version == "12") + +# TODO: check if this is still useful in /etc/ldap.conf +# nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,dnsmasq,games,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,statd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data + +- include: gdm3.yaml + +- include: lightdm.yaml diff --git a/root/etc/ansible/roles/nfs-client/tasks/nfs.yaml b/root/etc/ansible/roles/nfs-client/tasks/nfs.yaml new file mode 100644 index 0000000..3e120de --- /dev/null +++ b/root/etc/ansible/roles/nfs-client/tasks/nfs.yaml @@ -0,0 +1,19 @@ +--- + +- name: Installing nfs client packages + apt: + name: [ 'nfs-common' ] + state: latest + +- name: Create directory for user homes + file: path=/var/lib/nethserver/home state=directory owner=root group=root mode=0755 + +- name: Add mount to fstab + mount: + path: /var/lib/nethserver/home + src: "{{ esmith.SystemName }}.{{ esmith.DomainName }}:/var/lib/nethserver/home" + fstype: nfs4 + opts: rw,async,_netdev + passno: "1" + dump: "0" + state: mounted \ No newline at end of file diff --git a/root/etc/ansible/roles/nfs-client/tasks/old.yml b/root/etc/ansible/roles/nfs-client/tasks/old.yml new file mode 100644 index 0000000..a0d2526 --- /dev/null +++ b/root/etc/ansible/roles/nfs-client/tasks/old.yml @@ -0,0 +1,116 @@ +--- + + + ########################## ldap-auth + - name: Set bind DN + debconf: + name: ldap-auth-config + question: ldap-auth-config/binddn + value: cn=ldapservice,dc=directory,dc=nh + vtype: string + + - name: Set root bind DN + debconf: + name: ldap-auth-config + question: ldap-auth-config/rootbinddn + value: cn=ldapservice,dc=directory,dc=nh + vtype: string + + - name: Set base DN + debconf: + name: ldap-auth-config + question: ldap-auth-config/ldapns/base-dn + value: dc=directory,dc=nh + vtype: string + + - name: Set login required + debconf: + name: ldap-auth-config + question: ldap-auth-config/dblogin + value: "true" + vtype: boolean + + - name: Set root login required + debconf: + name: ldap-auth-config + question: ldap-auth-config/dbrootlogin + value: "true" + vtype: boolean + + - name: Set ldap override + debconf: + name: ldap-auth-config + question: ldap-auth-config/override + value: "true" + vtype: boolean + + - name: Set move-to-debconf + debconf: + name: ldap-auth-config + question: ldap-auth-config/move-to-debconf + value: "true" + vtype: boolean + + - name: Set pam password + debconf: + name: ldap-auth-config + question: ldap-auth-config/pam_password + value: exop + vtype: select + + - name: Set LDAP server + debconf: + name: ldap-auth-config + question: ldap-auth-config/ldapns/ldap-server + value: ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/ + vtype: string + + - name: Set LDAP server version + debconf: + name: ldap-auth-config + question: ldap-auth-config/ldapns/ldap_version + value: "3" + vtype: select + + - name: Set bind password + debconf: + name: ldap-auth-config + question: ldap-auth-config/bindpw + value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}" + vtype: password + + - name: Set root bind password + debconf: + name: ldap-auth-config + question: ldap-auth-config/rootbindpw + value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}" + vtype: password + + ########################## libnss-ldapd + - name: Configure libnss for ldap + debconf: + name: libnss-ldapd + question: libnss-ldapd/nsswitch + value: "passwd, group, shadow" + vtype: multiselect + - name: Configure libnss for not removing ldap configuration + debconf: + name: libnss-ldapd + question: libnss-ldapd/clean_nsswitch + value: "false" + vtype: boolean + + ########################## packages install + - name: Installing client packages + apt: + name: [ 'libnss-ldapd', 'ldap-auth-config' ] + state: latest + + ########################## idmap.conf + - name: Tweak idmap.conf + ini_file: + path: /etc/idmapd.conf + section: Translation + option: Method + value: nsswitch + mode: 0644 \ No newline at end of file diff --git a/root/etc/ansible/roles/nfs-client/templates/ldap.conf b/root/etc/ansible/roles/nfs-client/templates/ldap.conf index 4cbe7b5..8a41ca5 100644 --- a/root/etc/ansible/roles/nfs-client/templates/ldap.conf +++ b/root/etc/ansible/roles/nfs-client/templates/ldap.conf @@ -1,9 +1,9 @@ base dc=directory,dc=nh uri ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/ ldap_version 3 -binddn cn=libuser,dc=directory,dc=nh -bindpw {{ lookup('file', '/var/lib/nethserver/secrets/libuser') }} -rootbinddn cn=libuser,dc=directory,dc=nh -pam_password md5 +binddn cn=ldapservice,dc=directory,dc=nh +bindpw {{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }} +rootbinddn cn=ldapservice,dc=directory,dc=nh +pam_password exop #ssl start_tls nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,dnsmasq,games,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,statd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data diff --git a/root/etc/ansible/roles/nfs-client/templates/sssd.conf b/root/etc/ansible/roles/nfs-client/templates/sssd.conf new file mode 100644 index 0000000..e23c979 --- /dev/null +++ b/root/etc/ansible/roles/nfs-client/templates/sssd.conf @@ -0,0 +1,27 @@ + +[sssd] +domains = libre.school +config_file_version = 2 +services = nss, pam +default_domain_suffix = libre.school + +[domain/libre.school] +use_fully_qualified_names = True +id_provider = ad +access_provider = ad +ad_domain = ad.libre.school +krb5_realm = ad.libre.school +krb5_store_password_if_offline = True +ldap_id_mapping = True +ad_maximum_machine_account_password_age = 0 +ad_server = nsdc-pdc.ad.libre.school +cache_credentials = True +override_homedir = /var/lib/nethserver/home/%u +default_shell = /usr/lib/openssh/sftp-server +realmd_tags = manages-system joined-with-samba + + +[nss] +filter_users = ldapservice + + diff --git a/root/usr/share/libreschool-nfs/patch.ldif b/root/usr/share/libreschool-nfs/patch.ldif index ff0f5d2..4d0dae1 100644 --- a/root/usr/share/libreschool-nfs/patch.ldif +++ b/root/usr/share/libreschool-nfs/patch.ldif @@ -1,6 +1,16 @@ dn: olcDatabase={2}hdb,cn=config changetype: modify add: olcAccess -olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by dn="cn=libuser,dc=directory,dc=nh" write by anonymous auth by self write by * none -olcAccess: {1}to dn.base="" by * read -olcAccess: {2}to * by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by * read +olcAccess: {0}to attrs=userPassword,shadowLastChange + by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write + by dn="cn=libuser,dc=directory,dc=nh" write + by dn="cn=ldapservice,dc=directory,dc=nh" write + by anonymous auth + by self write + by * none +olcAccess: {1}to dn.base="" + by * read +olcAccess: {2}to * + by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write + by * read + by anonymous auth