diff --git a/.drone.yml b/.drone.yml index 9b734e3..bf9bc24 100644 --- a/.drone.yml +++ b/.drone.yml @@ -9,6 +9,7 @@ steps: files: - root - README.md + - createlinks.pl - COPYING when: event: [ push, tag ] diff --git a/createlinks.pl b/createlinks.pl new file mode 100644 index 0000000..2463290 --- /dev/null +++ b/createlinks.pl @@ -0,0 +1,7 @@ +#!/usr/bin/perl -w + +use esmith::Build::CreateLinks qw(:all); +use File::Basename; +use File::Path; + +event_actions('password-modify', 'save-administrator-password' => 26); diff --git a/libreschool-nfs.spec b/libreschool-nfs.spec index 496c6ad..43dd2da 100644 --- a/libreschool-nfs.spec +++ b/libreschool-nfs.spec @@ -1,6 +1,6 @@ Summary: LibreSchool NFS home profiles configuration Name: libreschool-nfs -Version: 1.0.2 +Version: 1.1.0 Release: 1.ns7 License: GPL BuildArch: noarch @@ -10,7 +10,7 @@ Source1: COPYING URL: %{url_prefix}/%{name} Requires: libreschool-release Requires: libreschool-client-manager -Requires: nethserver-directory || nethserver-dc +Requires: nethserver-dc Requires: nfs-utils Requires(post): systemd Requires(preun): systemd @@ -25,6 +25,8 @@ LibreSchool NFS home profiles configuration %setup %build +%{makedocs} +perl createlinks.pl %install rm -rf $RPM_BUILD_ROOT @@ -52,9 +54,8 @@ chkconfig rpcbind on /sbin/e-smith/expand-template /etc/ansible/reconfigure_clients.yml /usr/bin/systemctl --no-block start nfs >/dev/null 2>&1 || : /usr/bin/systemctl --no-block start rpcbind >/dev/null 2>&1 || : -/usr/sbin/exportfs -r +/usr/sbin/exportfs -ra /sbin/e-smith/signal-event firewall-adjust -/usr/bin/ldapmodify -Y EXTERNAL -f /usr/share/libreschool-nfs/patch.ldif >/dev/null 2>&1 || : %postun #if [ "$1" = 1 ]; then @@ -64,10 +65,13 @@ if [ "$1" = 0 ]; then #uninstallation echo > /etc/exports /sbin/e-smith/expand-template /etc/ansible/reconfigure_clients.yml - /usr/sbin/exportfs -r + /usr/sbin/exportfs -ra fi %changelog +* Sun Apr 5 2020 Paolo Asperti - 1.1.0-1.ns7 +- Switched to Active Directory + * Sat Mar 7 2020 Paolo Asperti - 1.0.2-1.ns7 - Some fixes diff --git a/links.txt b/links.txt deleted file mode 100644 index 67fb35f..0000000 --- a/links.txt +++ /dev/null @@ -1,4 +0,0 @@ -https://www.tecmint.com/integrate-ubuntu-to-samba4-ad-dc-with-sssd-and-realm/ -https://wiki.ubuntu.com/Enterprise/Authentication/sssd -https://help.ubuntu.com/lts/serverguide/sssd-ad.html -https://github.com/NethServer/nethserver-sssd diff --git a/root/etc/ansible/roles/nfs-client/files/gnome-initial-setup-done b/root/etc/ansible/roles/nfs-client/files/gnome-initial-setup-done new file mode 100644 index 0000000..396a0ba --- /dev/null +++ b/root/etc/ansible/roles/nfs-client/files/gnome-initial-setup-done @@ -0,0 +1 @@ +yes \ No newline at end of file diff --git a/root/etc/ansible/roles/nfs-client/handlers/main.yml b/root/etc/ansible/roles/nfs-client/handlers/main.yml index bc9b3d9..94b90da 100644 --- a/root/etc/ansible/roles/nfs-client/handlers/main.yml +++ b/root/etc/ansible/roles/nfs-client/handlers/main.yml @@ -1,3 +1,13 @@ --- -- name: restart libnss-ldap - service: name=libnss-ldap state=restarted + +- name: restart lightdm + service: name=lightdm state=restarted + +- name: restart gdm3 + service: name=gdm3 state=restarted + +- name: restart sssd + service: name=sssd state=restarted + +- name: restart smbd + service: name=smbd state=restarted diff --git a/root/etc/ansible/roles/nfs-client/tasks/domain_join.yml b/root/etc/ansible/roles/nfs-client/tasks/domain_join.yml new file mode 100644 index 0000000..287e73a --- /dev/null +++ b/root/etc/ansible/roles/nfs-client/tasks/domain_join.yml @@ -0,0 +1,10 @@ +--- + + - name: Login to domain + shell: "echo -n \"{{lookup('file', '/var/lib/nethserver/secrets/administrator') }}\" | kinit administrator" + + - name: Join to domain + shell: "net ads join -k" +# shell: "net ads join --no-dns-updates -k" + + # --no-dns-updates is not present in 16.04 diff --git a/root/etc/ansible/roles/nfs-client/tasks/gdm3.yaml b/root/etc/ansible/roles/nfs-client/tasks/gdm3.yml similarity index 94% rename from root/etc/ansible/roles/nfs-client/tasks/gdm3.yaml rename to root/etc/ansible/roles/nfs-client/tasks/gdm3.yml index a8dc53a..c3eaca6 100644 --- a/root/etc/ansible/roles/nfs-client/tasks/gdm3.yaml +++ b/root/etc/ansible/roles/nfs-client/tasks/gdm3.yml @@ -14,4 +14,4 @@ value: "true" no_extra_spaces: yes when: gdm3_installed.rc == 0 - \ No newline at end of file + notify: restart gdm3 diff --git a/root/etc/ansible/roles/nfs-client/tasks/ldap-16.04.yml b/root/etc/ansible/roles/nfs-client/tasks/ldap-16.04.yml deleted file mode 100644 index be4e5aa..0000000 --- a/root/etc/ansible/roles/nfs-client/tasks/ldap-16.04.yml +++ /dev/null @@ -1,30 +0,0 @@ ---- - -########################## nslcd -- name: Set bind DN - debconf: - name: nslcd - question: nslcd/ldap-binddn - value: cn=ldapservice,dc=directory,dc=nh - vtype: string - -- name: Set base DN - debconf: - name: nslcd - question: nslcd/ldap-base - value: dc=directory,dc=nh - vtype: string - -- name: Set LDAP server - debconf: - name: nslcd - question: nslcd/ldap-uris - value: ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/ - vtype: string - -- name: Set bind password - debconf: - name: nslcd - question: nslcd/ldap-bindpw - value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}" - vtype: password diff --git a/root/etc/ansible/roles/nfs-client/tasks/ldap-bionic.yaml b/root/etc/ansible/roles/nfs-client/tasks/ldap-bionic.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/root/etc/ansible/roles/nfs-client/tasks/ldap-xenial.yaml b/root/etc/ansible/roles/nfs-client/tasks/ldap-xenial.yaml deleted file mode 100644 index 70478e2..0000000 --- a/root/etc/ansible/roles/nfs-client/tasks/ldap-xenial.yaml +++ /dev/null @@ -1,49 +0,0 @@ ---- - -- name: nsswitch settings for passwd - lineinfile: - backup: yes - path: /etc/nsswitch.conf - state: present - regexp: '^passwd\:' - line: 'passwd: compat ldap' -# line: 'passwd: files ldap' - -- name: nsswitch settings for group - lineinfile: - backup: yes - path: /etc/nsswitch.conf - state: present - regexp: '^group\:' - line: 'passwd: compat ldap' -# line: 'passwd: files ldap' - -- name: nsswitch settings for shadow - lineinfile: - backup: yes - path: /etc/nsswitch.conf - state: present - regexp: '^shadow\:' - line: 'passwd: compat ldap' -# line: 'passwd: files ldap' - -- name: ldap configuration - template: - src: 'ldap.conf' - dest: '/etc/ldap.conf' - owner: 'root' - group: 'root' - mode: 0644 - -- name: Installing client packages - apt: - name: [ 'libnss-ldap' ] - state: latest - -- name: Tweak idmap.conf - ini_file: - path: /etc/idmapd.conf - section: Translation - option: Method - value: nsswitch - mode: 0644 diff --git a/root/etc/ansible/roles/nfs-client/tasks/ldap-zorin-12asd.yml b/root/etc/ansible/roles/nfs-client/tasks/ldap-zorin-12asd.yml deleted file mode 100644 index 9334d4e..0000000 --- a/root/etc/ansible/roles/nfs-client/tasks/ldap-zorin-12asd.yml +++ /dev/null @@ -1,150 +0,0 @@ ---- - -- name: ldap configuration - template: - src: 'ldap.conf' - dest: '/etc/ldap.conf' - owner: 'root' - group: 'root' - mode: 0644 - -- name: nsswitch settings for passwd - lineinfile: - backup: yes - path: /etc/nsswitch.conf - state: present - regexp: '^passwd\:' - line: 'passwd: files ldap' - -- name: nsswitch settings for group - lineinfile: - backup: yes - path: /etc/nsswitch.conf - state: present - regexp: '^group\:' - line: 'group: files ldap' - -- name: nsswitch settings for shadow - lineinfile: - backup: yes - path: /etc/nsswitch.conf - state: present - regexp: '^shadow\:' - line: 'shadow: files ldap' - - ------------- cut here - -########################## ldap-auth -- name: Set bind DN - debconf: - name: ldap-auth-config - question: ldap-auth-config/binddn - value: cn=ldapservice,dc=directory,dc=nh - vtype: string - -- name: Set root bind DN - debconf: - name: ldap-auth-config - question: ldap-auth-config/rootbinddn - value: cn=ldapservice,dc=directory,dc=nh - vtype: string - -- name: Set base DN - debconf: - name: ldap-auth-config - question: ldap-auth-config/ldapns/base-dn - value: dc=directory,dc=nh - vtype: string - -- name: Set login required - debconf: - name: ldap-auth-config - question: ldap-auth-config/dblogin - value: "true" - vtype: boolean - -- name: Set root login required - debconf: - name: ldap-auth-config - question: ldap-auth-config/dbrootlogin - value: "true" - vtype: boolean - -- name: Set ldap override - debconf: - name: ldap-auth-config - question: ldap-auth-config/override - value: "true" - vtype: boolean - -- name: Set move-to-debconf - debconf: - name: ldap-auth-config - question: ldap-auth-config/move-to-debconf - value: "true" - vtype: boolean - -- name: Set pam password - debconf: - name: ldap-auth-config - question: ldap-auth-config/pam_password - value: exop - vtype: select - -- name: Set LDAP server - debconf: - name: ldap-auth-config - question: ldap-auth-config/ldapns/ldap-server - value: ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/ - vtype: string - -- name: Set LDAP server version - debconf: - name: ldap-auth-config - question: ldap-auth-config/ldapns/ldap_version - value: "3" - vtype: select - -- name: Set bind password - debconf: - name: ldap-auth-config - question: ldap-auth-config/bindpw - value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}" - vtype: password - -- name: Set root bind password - debconf: - name: ldap-auth-config - question: ldap-auth-config/rootbindpw - value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}" - vtype: password - -########################## libnss-ldapd -- name: Configure libnss for ldap - debconf: - name: libnss-ldapd - question: libnss-ldapd/nsswitch - value: "passwd, group, shadow" - vtype: multiselect -- name: Configure libnss for not removing ldap configuration - debconf: - name: libnss-ldapd - question: libnss-ldapd/clean_nsswitch - value: "false" - vtype: boolean - -########################## packages install -- name: Installing client packages - apt: - name: [ 'libnss-ldapd', 'ldap-auth-config' ] - state: latest - -########################## idmap.conf -- name: Tweak idmap.conf - ini_file: - path: /etc/idmapd.conf - section: Translation - option: Method - value: nsswitch - mode: 0644 \ No newline at end of file diff --git a/root/etc/ansible/roles/nfs-client/tasks/lightdm.yaml b/root/etc/ansible/roles/nfs-client/tasks/lightdm.yml similarity index 93% rename from root/etc/ansible/roles/nfs-client/tasks/lightdm.yaml rename to root/etc/ansible/roles/nfs-client/tasks/lightdm.yml index d8c1b18..0628fb1 100644 --- a/root/etc/ansible/roles/nfs-client/tasks/lightdm.yaml +++ b/root/etc/ansible/roles/nfs-client/tasks/lightdm.yml @@ -14,4 +14,4 @@ group: 'root' mode: 0644 when: lightdm_installed.rc == 0 - \ No newline at end of file + notify: restart lightdm diff --git a/root/etc/ansible/roles/nfs-client/tasks/main.yaml b/root/etc/ansible/roles/nfs-client/tasks/main.yaml deleted file mode 100644 index 46fda97..0000000 --- a/root/etc/ansible/roles/nfs-client/tasks/main.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- - -- include: nfs.yaml - -- include: ldap-xenial.yaml - when: (ansible_distribution == "Zorin OS") and (ansible_distribution_version == "12") - -# TODO: check if this is still useful in /etc/ldap.conf -# nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,dnsmasq,games,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,statd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data - -- include: gdm3.yaml - -- include: lightdm.yaml diff --git a/root/etc/ansible/roles/nfs-client/tasks/main.yml b/root/etc/ansible/roles/nfs-client/tasks/main.yml new file mode 100644 index 0000000..98fb6c2 --- /dev/null +++ b/root/etc/ansible/roles/nfs-client/tasks/main.yml @@ -0,0 +1,22 @@ +--- + +- include: nfs.yml + +- include: sssd.yml + +- include: gdm3.yml + +- include: lightdm.yml + +- name: Make sure .config directory exists in skel + file: + path: /etc/skel/.config + state: directory + +- name: Disable Gnome Initial setup for new users (after user login) + copy: + src: gnome-initial-setup-done + dest: /etc/skel/.config/gnome-initial-setup-done + owner: root + group: root + mode: '0664' diff --git a/root/etc/ansible/roles/nfs-client/tasks/nfs.yaml b/root/etc/ansible/roles/nfs-client/tasks/nfs.yml similarity index 100% rename from root/etc/ansible/roles/nfs-client/tasks/nfs.yaml rename to root/etc/ansible/roles/nfs-client/tasks/nfs.yml diff --git a/root/etc/ansible/roles/nfs-client/tasks/old.yml b/root/etc/ansible/roles/nfs-client/tasks/old.yml deleted file mode 100644 index a0d2526..0000000 --- a/root/etc/ansible/roles/nfs-client/tasks/old.yml +++ /dev/null @@ -1,116 +0,0 @@ ---- - - - ########################## ldap-auth - - name: Set bind DN - debconf: - name: ldap-auth-config - question: ldap-auth-config/binddn - value: cn=ldapservice,dc=directory,dc=nh - vtype: string - - - name: Set root bind DN - debconf: - name: ldap-auth-config - question: ldap-auth-config/rootbinddn - value: cn=ldapservice,dc=directory,dc=nh - vtype: string - - - name: Set base DN - debconf: - name: ldap-auth-config - question: ldap-auth-config/ldapns/base-dn - value: dc=directory,dc=nh - vtype: string - - - name: Set login required - debconf: - name: ldap-auth-config - question: ldap-auth-config/dblogin - value: "true" - vtype: boolean - - - name: Set root login required - debconf: - name: ldap-auth-config - question: ldap-auth-config/dbrootlogin - value: "true" - vtype: boolean - - - name: Set ldap override - debconf: - name: ldap-auth-config - question: ldap-auth-config/override - value: "true" - vtype: boolean - - - name: Set move-to-debconf - debconf: - name: ldap-auth-config - question: ldap-auth-config/move-to-debconf - value: "true" - vtype: boolean - - - name: Set pam password - debconf: - name: ldap-auth-config - question: ldap-auth-config/pam_password - value: exop - vtype: select - - - name: Set LDAP server - debconf: - name: ldap-auth-config - question: ldap-auth-config/ldapns/ldap-server - value: ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/ - vtype: string - - - name: Set LDAP server version - debconf: - name: ldap-auth-config - question: ldap-auth-config/ldapns/ldap_version - value: "3" - vtype: select - - - name: Set bind password - debconf: - name: ldap-auth-config - question: ldap-auth-config/bindpw - value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}" - vtype: password - - - name: Set root bind password - debconf: - name: ldap-auth-config - question: ldap-auth-config/rootbindpw - value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}" - vtype: password - - ########################## libnss-ldapd - - name: Configure libnss for ldap - debconf: - name: libnss-ldapd - question: libnss-ldapd/nsswitch - value: "passwd, group, shadow" - vtype: multiselect - - name: Configure libnss for not removing ldap configuration - debconf: - name: libnss-ldapd - question: libnss-ldapd/clean_nsswitch - value: "false" - vtype: boolean - - ########################## packages install - - name: Installing client packages - apt: - name: [ 'libnss-ldapd', 'ldap-auth-config' ] - state: latest - - ########################## idmap.conf - - name: Tweak idmap.conf - ini_file: - path: /etc/idmapd.conf - section: Translation - option: Method - value: nsswitch - mode: 0644 \ No newline at end of file diff --git a/root/etc/ansible/roles/nfs-client/tasks/sssd.yml b/root/etc/ansible/roles/nfs-client/tasks/sssd.yml new file mode 100644 index 0000000..0b3b01f --- /dev/null +++ b/root/etc/ansible/roles/nfs-client/tasks/sssd.yml @@ -0,0 +1,81 @@ +--- + + - name: Kerberos configuration + debconf: + name: krb5-config + question: krb5-config/default_realm + value: "AD.{{ esmith.DomainName|upper }}" + vtype: string + + - name: Samba configuration + debconf: + name: samba-common + question: samba-common/workgroup + value: "{{ esmith.sssd.Workgroup }}" + vtype: string + + - name: Samba configuration + debconf: + name: samba-common + question: samba-common/do_debconf + value: true + vtype: boolean + + - name: Samba configuration + debconf: + name: samba-common + question: samba-common/dhcp + value: true + vtype: boolean + + - name: Installing sssd required packages + apt: + name: [ 'sssd-tools', 'sssd-ad', 'samba', 'krb5-user' ] + state: latest + + - name: SSSD configuration + template: + src: 'sssd.conf' + dest: '/etc/sssd/sssd.conf' + owner: 'root' + group: 'root' + mode: 0600 + notify: restart sssd + + - name: Smb.conf + ini_file: + path: /etc/samba/smb.conf + section: global + option: "{{ item.option }}" + value: "{{ item.value }}" + no_extra_spaces: yes + with_items: + - { option: "workgroup", value: "{{ esmith.sssd.Workgroup }}" } + - { option: "client signing", value: "yes" } + - { option: "client use spnego", value: "yes" } + - { option: "kerberos method", value: "secrets and keytab" } + - { option: "realm", value: "AD.{{ esmith.DomainName|upper }}" } + - { option: "security", value: "ads" } + - { option: "interfaces", value: "{{ ansible_default_ipv4.interface }}" } + notify: restart smbd + + - name: Check if joined to domain + shell: "net rpc testjoin" + changed_when: no + ignore_errors: true + register: domain_join_status + + - name: Check for domain administrator password file + local_action: stat path=/var/lib/nethserver/secrets/administrator + register: stat_domain_admin_password_file + + - include: domain_join.yml + when: + - domain_join_status.rc != 0 + - stat_domain_admin_password_file.stat.exists + + - name: Enable home directory creation + lineinfile: + path: /etc/pam.d/common-session + state: present + line: 'session required pam_mkhomedir.so skel=/etc/skel/ umask=0077' diff --git a/root/etc/ansible/roles/nfs-client/templates/ldap.conf b/root/etc/ansible/roles/nfs-client/templates/ldap.conf deleted file mode 100644 index 8a41ca5..0000000 --- a/root/etc/ansible/roles/nfs-client/templates/ldap.conf +++ /dev/null @@ -1,9 +0,0 @@ -base dc=directory,dc=nh -uri ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/ -ldap_version 3 -binddn cn=ldapservice,dc=directory,dc=nh -bindpw {{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }} -rootbinddn cn=ldapservice,dc=directory,dc=nh -pam_password exop -#ssl start_tls -nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,dnsmasq,games,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,statd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data diff --git a/root/etc/ansible/roles/nfs-client/templates/sssd.conf b/root/etc/ansible/roles/nfs-client/templates/sssd.conf index e23c979..17e8db8 100644 --- a/root/etc/ansible/roles/nfs-client/templates/sssd.conf +++ b/root/etc/ansible/roles/nfs-client/templates/sssd.conf @@ -1,27 +1,22 @@ - [sssd] -domains = libre.school -config_file_version = 2 services = nss, pam -default_domain_suffix = libre.school +config_file_version = 2 +domains = AD.{{ esmith.DomainName|upper }} +# default_domain_suffix = {{ esmith.DomainName }} -[domain/libre.school] -use_fully_qualified_names = True +[domain/AD.{{ esmith.DomainName|upper }}] id_provider = ad access_provider = ad -ad_domain = ad.libre.school -krb5_realm = ad.libre.school -krb5_store_password_if_offline = True -ldap_id_mapping = True -ad_maximum_machine_account_password_age = 0 -ad_server = nsdc-pdc.ad.libre.school -cache_credentials = True override_homedir = /var/lib/nethserver/home/%u -default_shell = /usr/lib/openssh/sftp-server -realmd_tags = manages-system joined-with-samba - - -[nss] -filter_users = ldapservice - +enumerate = true +#use_fully_qualified_names = True +#ad_domain = ad.{{ esmith.DomainName }} +#krb5_realm = ad.{{ esmith.DomainName }} +#ldap_id_mapping = True +#ad_maximum_machine_account_password_age = 0 +#ad_server = nsdc-{{ esmith.SystemName }}.ad.{{ esmith.DomainName }} +#cache_credentials = True +#realmd_tags = manages-system joined-with-samba +#[nss] +#filter_users = ldapservice diff --git a/root/etc/e-smith/events/actions/save-administrator-password b/root/etc/e-smith/events/actions/save-administrator-password new file mode 100755 index 0000000..ca0b22a --- /dev/null +++ b/root/etc/e-smith/events/actions/save-administrator-password @@ -0,0 +1,26 @@ +#!/bin/bash + +if ! [ $# -ge 3 ]; then + echo "[ERROR] Not enough arguments." + exit 2 +fi + +EVENT=$1 +USER=$2 +FILE=$3 +DOMAIN=$(hostname -d) + +if ! [[ $USER == "administrator@${DOMAIN}" ]]; then + echo "[NOTICE] Not storing password for user ${USER}." + exit 0 +fi + +if ! [ -f "${FILE}" ]; then + echo "[ERROR] Password file not found" + exit 1 +fi + +PASSWORD="$(<$FILE)" +touch /var/lib/nethserver/secrets/administrator +chmod 600 /var/lib/nethserver/secrets/administrator +echo -n "${PASSWORD}" > /var/lib/nethserver/secrets/administrator diff --git a/root/usr/share/libreschool-nfs/patch.ldif b/root/usr/share/libreschool-nfs/patch.ldif deleted file mode 100644 index 4d0dae1..0000000 --- a/root/usr/share/libreschool-nfs/patch.ldif +++ /dev/null @@ -1,16 +0,0 @@ -dn: olcDatabase={2}hdb,cn=config -changetype: modify -add: olcAccess -olcAccess: {0}to attrs=userPassword,shadowLastChange - by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write - by dn="cn=libuser,dc=directory,dc=nh" write - by dn="cn=ldapservice,dc=directory,dc=nh" write - by anonymous auth - by self write - by * none -olcAccess: {1}to dn.base="" - by * read -olcAccess: {2}to * - by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write - by * read - by anonymous auth