Compare commits

...

7 Commits

Author SHA1 Message Date
Paolo Asperti 8ce0965701
Fix for Ubuntu 16.04
continuous-integration/drone/push Build is passing Details
continuous-integration/drone/tag Build is passing Details
2020-04-07 22:15:11 +02:00
Paolo Asperti a105f3020c
Switched to Active Directory
continuous-integration/drone/push Build is passing Details
continuous-integration/drone/tag Build is passing Details
2020-04-06 11:09:12 +02:00
Paolo Asperti d514b09360
missing db configuration 2020-03-25 14:11:25 +01:00
Paolo Asperti 1a1cb76179
wip - portare tutto su sssd 2020-03-23 15:11:27 +01:00
Paolo Asperti ce5ae70764
better db configuration 2020-03-08 23:08:11 +01:00
Paolo Asperti 2363f795f6
typo 2020-03-08 19:37:11 +01:00
Paolo Asperti 507a622272
drone doesn't publish directly anymore
continuous-integration/drone/push Build is passing Details
2020-03-08 11:21:29 +01:00
25 changed files with 250 additions and 264 deletions

View File

@ -9,6 +9,7 @@ steps:
files:
- root
- README.md
- createlinks.pl
- COPYING
when:
event: [ push, tag ]
@ -50,33 +51,3 @@ steps:
file_exists: skip
when:
event: tag
- name: repo_upload
image: appleboy/drone-scp
settings:
source: out/*.noarch.rpm
target: /vhosts/repo.libreschool.org/https/nethserver/7/devel/x86_64/Packages/
host: repo.libreschool.org
strip_components: 1
username:
from_secret: ssh_username
key:
from_secret: ssh_key
when:
event: tag
repo: LibreSchool/libreschool-nfs
- name: repo_upload_srpms
image: appleboy/drone-scp
settings:
source: out/*.src.rpm
target: /vhosts/repo.libreschool.org/https/nethserver/7/devel/Source/SPackages/
host: repo.libreschool.org
strip_components: 1
username:
from_secret: ssh_username
key:
from_secret: ssh_key
when:
event: tag
repo: LibreSchool/libreschool-nfs

7
createlinks.pl Normal file
View File

@ -0,0 +1,7 @@
#!/usr/bin/perl -w
use esmith::Build::CreateLinks qw(:all);
use File::Basename;
use File::Path;
event_actions('password-modify', 'save-administrator-password' => 26);

View File

@ -1,6 +1,6 @@
Summary: LibreSchool NFS home profiles configuration
Name: libreschool-nfs
Version: 1.0.2
Version: 1.1.1
Release: 1.ns7
License: GPL
BuildArch: noarch
@ -10,7 +10,7 @@ Source1: COPYING
URL: %{url_prefix}/%{name}
Requires: libreschool-release
Requires: libreschool-client-manager
Requires: nethserver-directory
Requires: nethserver-dc
Requires: nfs-utils
Requires(post): systemd
Requires(preun): systemd
@ -25,6 +25,8 @@ LibreSchool NFS home profiles configuration
%setup
%build
%{makedocs}
perl createlinks.pl
%install
rm -rf $RPM_BUILD_ROOT
@ -52,9 +54,8 @@ chkconfig rpcbind on
/sbin/e-smith/expand-template /etc/ansible/reconfigure_clients.yml
/usr/bin/systemctl --no-block start nfs >/dev/null 2>&1 || :
/usr/bin/systemctl --no-block start rpcbind >/dev/null 2>&1 || :
/usr/sbin/exportfs -r
/usr/sbin/exportfs -ra
/sbin/e-smith/signal-event firewall-adjust
/usr/bin/ldapmodify -Y EXTERNAL -f /usr/share/libreschool-nfs/patch.ldif >/dev/null 2>&1 || :
%postun
#if [ "$1" = 1 ]; then
@ -64,10 +65,16 @@ if [ "$1" = 0 ]; then
#uninstallation
echo > /etc/exports
/sbin/e-smith/expand-template /etc/ansible/reconfigure_clients.yml
/usr/sbin/exportfs -r
/usr/sbin/exportfs -ra
fi
%changelog
* Tue Apr 7 2020 Paolo Asperti <paolo@asperti.com> - 1.1.1-1.ns7
- Fix for Ubuntu 16.04
* Sun Apr 5 2020 Paolo Asperti <paolo@asperti.com> - 1.1.0-1.ns7
- Switched to Active Directory
* Sat Mar 7 2020 Paolo Asperti <paolo@asperti.com> - 1.0.2-1.ns7
- Some fixes

View File

@ -0,0 +1 @@
yes

View File

@ -1,3 +1,13 @@
---
- name: restart libnss-ldap
service: name=libnss-ldap state=restarted
- name: restart lightdm
service: name=lightdm state=restarted
- name: restart gdm3
service: name=gdm3 state=restarted
- name: restart sssd
service: name=sssd state=restarted
- name: restart smbd
service: name=smbd state=restarted

View File

@ -0,0 +1,10 @@
---
- name: Login to domain
shell: "echo -n \"{{lookup('file', '/var/lib/nethserver/secrets/administrator') }}\" | kinit administrator"
- name: Join to domain
shell: "net ads join -k"
# shell: "net ads join --no-dns-updates -k"
# --no-dns-updates is not present in 16.04

View File

@ -0,0 +1,17 @@
---
- name: Check if gdm3 is installed
shell: dpkg-query -W -f='${Status}' gdm3 | grep 'install ok installed'
register: gdm3_installed
failed_when: no
changed_when: no
- name: Adjust gdm3 settings
ini_file:
path: /etc/gdm3/greeter.dconf-defaults
section: org/gnome/login-screen
option: disable-user-list
value: "true"
no_extra_spaces: yes
when: gdm3_installed.rc == 0
notify: restart gdm3

View File

@ -0,0 +1,17 @@
---
- name: Check if lightdm is installed
shell: dpkg-query -W -f='${Status}' lightdm | grep 'install ok installed'
register: lightdm_installed
failed_when: no
changed_when: no
- name: Adjusting lightdm settings
template:
src: 'lightdm.conf'
dest: '/usr/share/lightdm/lightdm.conf.d/50-libreschool.conf'
owner: 'root'
group: 'root'
mode: 0644
when: lightdm_installed.rc == 0
notify: restart lightdm

View File

@ -1,219 +1,22 @@
---
- name: Installing nfs client packages
apt:
name: [ 'nfs-common' ]
state: latest
- include: nfs.yml
- name: Create directory for user homes
file: path=/var/lib/nethserver/home state=directory owner=root group=root mode=0755
- include: sssd.yml
- name: Add mount to fstab
mount:
path: /var/lib/nethserver/home
src: "{{ esmith.SystemName }}.{{ esmith.DomainName }}:/var/lib/nethserver/home"
fstype: nfs4
opts: rw,async,_netdev
passno: "1"
dump: "0"
state: mounted
- include: gdm3.yml
########################## nslcd
- name: Set bind DN
debconf:
name: nslcd
question: nslcd/ldap-binddn
value: cn=ldapservice,dc=directory,dc=nh
vtype: string
- include: lightdm.yml
- name: Set base DN
debconf:
name: nslcd
question: nslcd/ldap-base
value: dc=directory,dc=nh
vtype: string
- name: Make sure .config directory exists in skel
file:
path: /etc/skel/.config
state: directory
- name: Set LDAP server
debconf:
name: nslcd
question: nslcd/ldap-uris
value: ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/
vtype: string
- name: Set bind password
debconf:
name: nslcd
question: nslcd/ldap-bindpw
value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}"
vtype: password
########################## ldap-auth
- name: Set bind DN
debconf:
name: ldap-auth-config
question: ldap-auth-config/binddn
value: cn=ldapservice,dc=directory,dc=nh
vtype: string
- name: Set root bind DN
debconf:
name: ldap-auth-config
question: ldap-auth-config/rootbinddn
value: cn=ldapservice,dc=directory,dc=nh
vtype: string
- name: Set base DN
debconf:
name: ldap-auth-config
question: ldap-auth-config/ldapns/base-dn
value: dc=directory,dc=nh
vtype: string
- name: Set login required
debconf:
name: ldap-auth-config
question: ldap-auth-config/dblogin
value: "true"
vtype: boolean
- name: Set root login required
debconf:
name: ldap-auth-config
question: ldap-auth-config/dbrootlogin
value: "true"
vtype: boolean
- name: Set ldap override
debconf:
name: ldap-auth-config
question: ldap-auth-config/override
value: "true"
vtype: boolean
- name: Set move-to-debconf
debconf:
name: ldap-auth-config
question: ldap-auth-config/move-to-debconf
value: "true"
vtype: boolean
- name: Set pam password
debconf:
name: ldap-auth-config
question: ldap-auth-config/pam_password
value: exop
vtype: select
- name: Set LDAP server
debconf:
name: ldap-auth-config
question: ldap-auth-config/ldapns/ldap-server
value: ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/
vtype: string
- name: Set LDAP server version
debconf:
name: ldap-auth-config
question: ldap-auth-config/ldapns/ldap_version
value: "3"
vtype: select
- name: Set bind password
debconf:
name: ldap-auth-config
question: ldap-auth-config/bindpw
value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}"
vtype: password
- name: Set root bind password
debconf:
name: ldap-auth-config
question: ldap-auth-config/rootbindpw
value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}"
vtype: password
########################## libnss-ldapd
- name: Configure libnss for ldap
debconf:
name: libnss-ldapd
question: libnss-ldapd/nsswitch
value: "passwd, group, shadow"
vtype: multiselect
- name: Configure libnss for not removnig ldap configuration
debconf:
name: libnss-ldapd
question: libnss-ldapd/clean_nsswitch
value: "false"
vtype: boolean
########################## packages install
- name: Installing client packages
apt:
name: [ 'libnss-ldapd', 'ldap-auth-config' ]
state: latest
# nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,dnsmasq,games,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,statd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data
########################## nsswitch
- name: nsswitch settings for passwd
lineinfile:
path: /etc/nsswitch.conf
state: present
regexp: '^passwd\:'
line: 'passwd: files ldap'
- name: nsswitch settings for group
lineinfile:
path: /etc/nsswitch.conf
state: present
regexp: '^group\:'
line: 'group: files ldap'
- name: nsswitch settings for shadow
lineinfile:
path: /etc/nsswitch.conf
state: present
regexp: '^shadow\:'
line: 'shadow: files ldap'
########################## idmap.conf
- name: Tweak idmap.conf
ini_file:
path: /etc/idmapd.conf
section: Translation
option: Method
value: nsswitch
mode: 0644
########################## DM
- name: Check if lightdm is installed
shell: dpkg-query -W -f='${Status}' lightdm | grep 'install ok installed'
register: lightdm_installed
failed_when: no
changed_when: no
- name: Check if gdm3 is installed
shell: dpkg-query -W -f='${Status}' gdm3 | grep 'install ok installed'
register: gdm3_installed
failed_when: no
changed_when: no
- name: Adjusting lightdm settings
template:
src: 'lightdm.conf'
dest: '/usr/share/lightdm/lightdm.conf.d/50-libreschool.conf'
owner: 'root'
group: 'root'
mode: 0644
when: lightdm_installed.rc == 0
- name: Adjust gdm3 settings
ini_file:
path: /etc/gdm3/greeter.dconf-defaults
section: org/gnome/login-screen
option: disable-user-list
value: "true"
no_extra_spaces: yes
when: gdm3_installed.rc == 0
- name: Disable Gnome Initial setup for new users (after user login)
copy:
src: gnome-initial-setup-done
dest: /etc/skel/.config/gnome-initial-setup-done
owner: root
group: root
mode: '0664'

View File

@ -0,0 +1,19 @@
---
- name: Installing nfs client packages
apt:
name: [ 'nfs-common' ]
state: latest
- name: Create directory for user homes
file: path=/var/lib/nethserver/home state=directory owner=root group=root mode=0755
- name: Add mount to fstab
mount:
path: /var/lib/nethserver/home
src: "{{ esmith.SystemName }}.{{ esmith.DomainName }}:/var/lib/nethserver/home"
fstype: nfs4
opts: rw,async,_netdev
passno: "1"
dump: "0"
state: mounted

View File

@ -0,0 +1,81 @@
---
- name: Kerberos configuration
debconf:
name: krb5-config
question: krb5-config/default_realm
value: "AD.{{ esmith.DomainName|upper }}"
vtype: string
- name: Samba configuration
debconf:
name: samba-common
question: samba-common/workgroup
value: "{{ esmith.sssd.Workgroup }}"
vtype: string
- name: Samba configuration
debconf:
name: samba-common
question: samba-common/do_debconf
value: true
vtype: boolean
- name: Samba configuration
debconf:
name: samba-common
question: samba-common/dhcp
value: true
vtype: boolean
- name: Installing sssd required packages
apt:
name: [ 'sssd-tools', 'sssd-ad', 'samba', 'krb5-user' ]
state: latest
- name: SSSD configuration
template:
src: 'sssd.conf'
dest: '/etc/sssd/sssd.conf'
owner: 'root'
group: 'root'
mode: 0600
notify: restart sssd
- name: Smb.conf
ini_file:
path: /etc/samba/smb.conf
section: global
option: "{{ item.option }}"
value: "{{ item.value }}"
no_extra_spaces: yes
with_items:
- { option: "workgroup", value: "{{ esmith.sssd.Workgroup }}" }
- { option: "client signing", value: "yes" }
- { option: "client use spnego", value: "yes" }
- { option: "kerberos method", value: "secrets and keytab" }
- { option: "realm", value: "AD.{{ esmith.DomainName|upper }}" }
- { option: "security", value: "ads" }
- { option: "interfaces", value: "{{ ansible_default_ipv4.interface }}" }
notify: restart smbd
- name: Check if joined to domain
shell: "net rpc testjoin"
changed_when: no
ignore_errors: true
register: domain_join_status
- name: Check for domain administrator password file
local_action: stat path=/var/lib/nethserver/secrets/administrator
register: stat_domain_admin_password_file
- include: domain_join.yml
when:
- domain_join_status.rc != 0
- stat_domain_admin_password_file.stat.exists
- name: Enable home directory creation
lineinfile:
path: /etc/pam.d/common-session
state: present
line: 'session required pam_mkhomedir.so skel=/etc/skel/ umask=0077'

View File

@ -1,9 +0,0 @@
base dc=directory,dc=nh
uri ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/
ldap_version 3
binddn cn=libuser,dc=directory,dc=nh
bindpw {{ lookup('file', '/var/lib/nethserver/secrets/libuser') }}
rootbinddn cn=libuser,dc=directory,dc=nh
pam_password md5
#ssl start_tls
nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,dnsmasq,games,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,statd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data

View File

@ -0,0 +1,22 @@
[sssd]
services = nss, pam
config_file_version = 2
domains = AD.{{ esmith.DomainName|upper }}
# default_domain_suffix = {{ esmith.DomainName }}
[domain/AD.{{ esmith.DomainName|upper }}]
id_provider = ad
access_provider = ad
override_homedir = /var/lib/nethserver/home/%u
enumerate = true
ad_gpo_access_control = disabled
ad_domain = ad.{{ esmith.DomainName }}
krb5_realm = ad.{{ esmith.DomainName }}
ldap_id_mapping = True
ad_maximum_machine_account_password_age = 0
ad_server = nsdc-{{ esmith.SystemName }}.ad.{{ esmith.DomainName }}
cache_credentials = True
realmd_tags = manages-system joined-with-samba
#[nss]
#filter_users = ldapservice

View File

@ -0,0 +1 @@
2049

View File

@ -0,0 +1 @@
2049

View File

@ -0,0 +1 @@
private

View File

@ -0,0 +1 @@
enabled

View File

@ -0,0 +1 @@
service

View File

@ -0,0 +1 @@
111

View File

@ -0,0 +1 @@
111

View File

@ -0,0 +1 @@
private

View File

@ -0,0 +1 @@
enabled

View File

@ -0,0 +1 @@
service

View File

@ -0,0 +1,26 @@
#!/bin/bash
if ! [ $# -ge 3 ]; then
echo "[ERROR] Not enough arguments."
exit 2
fi
EVENT=$1
USER=$2
FILE=$3
DOMAIN=$(hostname -d)
if ! [[ $USER == "administrator@${DOMAIN}" ]]; then
echo "[NOTICE] Not storing password for user ${USER}."
exit 0
fi
if ! [ -f "${FILE}" ]; then
echo "[ERROR] Password file not found"
exit 1
fi
PASSWORD="$(<$FILE)"
touch /var/lib/nethserver/secrets/administrator
chmod 600 /var/lib/nethserver/secrets/administrator
echo -n "${PASSWORD}" > /var/lib/nethserver/secrets/administrator

View File

@ -1,6 +0,0 @@
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by dn="cn=libuser,dc=directory,dc=nh" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by * read