From b45687111665093bb1281a0b9321c250dbd8ef37 Mon Sep 17 00:00:00 2001 From: Paolo Asperti Date: Sun, 8 Mar 2020 10:56:22 +0100 Subject: [PATCH] a lot of fixes for better OS support --- .../ansible/roles/nfs-client/tasks/main.yml | 168 ++++++++++++++++-- 1 file changed, 149 insertions(+), 19 deletions(-) diff --git a/root/etc/ansible/roles/nfs-client/tasks/main.yml b/root/etc/ansible/roles/nfs-client/tasks/main.yml index 54b9702..bac5769 100644 --- a/root/etc/ansible/roles/nfs-client/tasks/main.yml +++ b/root/etc/ansible/roles/nfs-client/tasks/main.yml @@ -1,8 +1,8 @@ --- -- name: Installing client packages +- name: Installing nfs client packages apt: - name: [ 'nfs-common', 'libnss-ldap' ] + name: [ 'nfs-common' ] state: latest - name: Create directory for user homes @@ -14,19 +14,148 @@ src: "{{ esmith.SystemName }}.{{ esmith.DomainName }}:/var/lib/nethserver/home" fstype: nfs4 opts: rw,async,_netdev - passno: 1 - dump: 0 + passno: "1" + dump: "0" state: mounted -# forse questo non serve -- name: Tweak idmap.conf - ini_file: - path: /etc/idmapd.conf - section: Translation - option: Method - value: nsswitch - mode: 0644 +########################## nslcd +- name: Set bind DN + debconf: + name: nslcd + question: nslcd/ldap-binddn + value: cn=ldapservice,dc=directory,dc=nh + vtype: string +- name: Set base DN + debconf: + name: nslcd + question: nslcd/ldap-base + value: dc=directory,dc=nh + vtype: string + +- name: Set LDAP server + debconf: + name: nslcd + question: nslcd/ldap-uris + value: ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/ + vtype: string + +- name: Set bind password + debconf: + name: nslcd + question: nslcd/ldap-bindpw + value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}" + vtype: password + +########################## ldap-auth +- name: Set bind DN + debconf: + name: ldap-auth-config + question: ldap-auth-config/binddn + value: cn=ldapservice,dc=directory,dc=nh + vtype: string + +- name: Set root bind DN + debconf: + name: ldap-auth-config + question: ldap-auth-config/rootbinddn + value: cn=ldapservice,dc=directory,dc=nh + vtype: string + +- name: Set base DN + debconf: + name: ldap-auth-config + question: ldap-auth-config/ldapns/base-dn + value: dc=directory,dc=nh + vtype: string + +- name: Set login required + debconf: + name: ldap-auth-config + question: ldap-auth-config/dblogin + value: "true" + vtype: boolean + +- name: Set root login required + debconf: + name: ldap-auth-config + question: ldap-auth-config/dbrootlogin + value: "true" + vtype: boolean + +- name: Set ldap override + debconf: + name: ldap-auth-config + question: ldap-auth-config/override + value: "true" + vtype: boolean + +- name: Set move-to-debconf + debconf: + name: ldap-auth-config + question: ldap-auth-config/move-to-debconf + value: "true" + vtype: boolean + +- name: Set pam password + debconf: + name: ldap-auth-config + question: ldap-auth-config/pam_password + value: exop + vtype: select + +- name: Set LDAP server + debconf: + name: ldap-auth-config + question: ldap-auth-config/ldapns/ldap-server + value: ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/ + vtype: string + +- name: Set LDAP server version + debconf: + name: ldap-auth-config + question: ldap-auth-config/ldapns/ldap_version + value: "3" + vtype: select + +- name: Set bind password + debconf: + name: ldap-auth-config + question: ldap-auth-config/bindpw + value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}" + vtype: password + +- name: Set root bind password + debconf: + name: ldap-auth-config + question: ldap-auth-config/rootbindpw + value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}" + vtype: password + +- name: Configure libnss for ldap + debconf: + name: libnss-ldapd + question: libnss-ldapd/nsswitch + value: "passwd, group, shadow" + vtype: multiselect +- name: Configure libnss for not removnig ldap configuration + debconf: + name: libnss-ldapd + question: libnss-ldapd/clean_nsswitch + value: "false" + vtype: boolean + +########################## packages install +- name: Installing client packages + apt: + name: [ 'libnss-ldapd', 'ldap-auth-config' ] + state: latest + + +# nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,dnsmasq,games,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,statd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data + + +########################## nsswitch - name: nsswitch settings for passwd lineinfile: path: /etc/nsswitch.conf @@ -48,15 +177,16 @@ regexp: '^shadow\:' line: 'shadow: files ldap' -# TODO: think about security... we should move the ldap admin password somewhere else -- name: ldap configuration - template: - src: 'ldap.conf' - dest: '/etc/ldap.conf' - owner: 'root' - group: 'root' +########################## idmap.conf +- name: Tweak idmap.conf + ini_file: + path: /etc/idmapd.conf + section: Translation + option: Method + value: nsswitch mode: 0644 +########################## DM - name: Check if lightdm is installed shell: dpkg-query -W -f='${Status}' lightdm | grep 'install ok installed' register: lightdm_installed