Compare commits
No commits in common. "e26c8577d87355c0afb5adb19f7991001d4fb2dc" and "f1cf36997edde5e0bf9f67ca6619493c889bc9e0" have entirely different histories.
e26c8577d8
...
f1cf36997e
13
README.md
13
README.md
@ -12,10 +12,9 @@ A working [LibreSchool][] installation is required.
|
||||
|
||||
## Notes ##
|
||||
|
||||
At the moment, if you run ```showmount -e [server ip]``` on the client, you end up with an error. That's because we're ditching NFSv2 and NFSv3 in favour of NFSv4 (this will give us Kerberos integration in future) and all unneeded ports are closed.
|
||||
At the moment, if you run ```showmount -e [server ip] ``` on the client, you end up with an error. That's because we're ditching NFSv2 and NFSv3 in favour of NFSv4 (this will give us Kerberos integration in future) and all unneeded ports are closed.
|
||||
|
||||
## TODO / ideas ##
|
||||
|
||||
- verify on a brand new install if after installation a new 'chkconfig {nfs,rpcbind} on' is needed
|
||||
- force Domain Controller mode (db configuration getprop smb ServerRole == PDC)
|
||||
- export shared folder also
|
||||
@ -23,20 +22,22 @@ At the moment, if you run ```showmount -e [server ip]``` on the client, you end
|
||||
- ACL on home directories
|
||||
- multiple nfs-server support
|
||||
|
||||
## tested distros ##
|
||||
|
||||
|
||||
## tested distos
|
||||
- edubuntu 14.04: OK
|
||||
- ubuntu 14:04: OK
|
||||
- ubuntu 16:04: OK
|
||||
- ubuntu 18:04: OK
|
||||
- xubuntu 18:04: OK
|
||||
- ubuntu 18:04: ldap can't connect... (remember to force python install on adoption)
|
||||
- zorin 12: OK
|
||||
- zorin 15: OK
|
||||
- linuxmint: ldap can't connect...
|
||||
|
||||
|
||||
## License ##
|
||||
|
||||
As the rest of the LibreSchool project, libreschool-nfs is licensed under [GPLv3][] license.
|
||||
|
||||
|
||||
[LibreSchool]: https://libreschool.org "LibreSchool Project Homepage"
|
||||
[NethServer]: https://www.nethserver.org
|
||||
[GPLv3]: https://www.gnu.org/licenses/gpl-3.0.html
|
||||
|
@ -1,6 +1,6 @@
|
||||
Summary: LibreSchool NFS home profiles configuration
|
||||
Name: libreschool-nfs
|
||||
Version: 1.0.2
|
||||
Version: 1.0
|
||||
Release: 1.ns7
|
||||
License: GPL
|
||||
BuildArch: noarch
|
||||
@ -41,7 +41,6 @@ chkconfig rpcbind on
|
||||
/sbin/e-smith/db configuration set nfs service \
|
||||
status enabled \
|
||||
TCPPort 2049 \
|
||||
UDPPort 2049 \
|
||||
access private
|
||||
/sbin/e-smith/db configuration set rpcbind service \
|
||||
status enabled \
|
||||
@ -51,7 +50,7 @@ chkconfig rpcbind on
|
||||
/sbin/e-smith/expand-template /etc/exports
|
||||
/sbin/e-smith/expand-template /etc/ansible/reconfigure_clients.yml
|
||||
/usr/bin/systemctl --no-block start nfs >/dev/null 2>&1 || :
|
||||
/usr/bin/systemctl --no-block start rpcbind >/dev/null 2>&1 || :
|
||||
/usr/bin/systemctl --no-block start rpmbind >/dev/null 2>&1 || :
|
||||
/usr/sbin/exportfs -r
|
||||
/sbin/e-smith/signal-event firewall-adjust
|
||||
/usr/bin/ldapmodify -Y EXTERNAL -f /usr/share/libreschool-nfs/patch.ldif >/dev/null 2>&1 || :
|
||||
@ -68,11 +67,5 @@ if [ "$1" = 0 ]; then
|
||||
fi
|
||||
|
||||
%changelog
|
||||
* Sat Mar 7 2020 Paolo Asperti <paolo@asperti.com> - 1.0.2-1.ns7
|
||||
- Some fixes
|
||||
|
||||
* Mon May 6 2019 Paolo Asperti <paolo@asperti.com> - 1.0.1-1.ns7
|
||||
- updated drone and ansible support
|
||||
|
||||
* Sun Apr 28 2019 Paolo Asperti <paolo@asperti.com> - 1.0-1.ns7
|
||||
- First release for NethServer 7
|
||||
|
@ -1,8 +1,8 @@
|
||||
---
|
||||
|
||||
- name: Installing nfs client packages
|
||||
- name: Installing client packages
|
||||
apt:
|
||||
name: [ 'nfs-common' ]
|
||||
name: [ 'nfs-common', 'libnss-ldap' ]
|
||||
state: latest
|
||||
|
||||
- name: Create directory for user homes
|
||||
@ -14,149 +14,19 @@
|
||||
src: "{{ esmith.SystemName }}.{{ esmith.DomainName }}:/var/lib/nethserver/home"
|
||||
fstype: nfs4
|
||||
opts: rw,async,_netdev
|
||||
passno: "1"
|
||||
dump: "0"
|
||||
passno: 1
|
||||
dump: 0
|
||||
state: mounted
|
||||
|
||||
########################## nslcd
|
||||
- name: Set bind DN
|
||||
debconf:
|
||||
name: nslcd
|
||||
question: nslcd/ldap-binddn
|
||||
value: cn=ldapservice,dc=directory,dc=nh
|
||||
vtype: string
|
||||
# forse questo non serve
|
||||
- name: Tweak idmap.conf
|
||||
ini_file:
|
||||
path: /etc/idmapd.conf
|
||||
section: Translation
|
||||
option: Method
|
||||
value: nsswitch
|
||||
mode: 0644
|
||||
|
||||
- name: Set base DN
|
||||
debconf:
|
||||
name: nslcd
|
||||
question: nslcd/ldap-base
|
||||
value: dc=directory,dc=nh
|
||||
vtype: string
|
||||
|
||||
- name: Set LDAP server
|
||||
debconf:
|
||||
name: nslcd
|
||||
question: nslcd/ldap-uris
|
||||
value: ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/
|
||||
vtype: string
|
||||
|
||||
- name: Set bind password
|
||||
debconf:
|
||||
name: nslcd
|
||||
question: nslcd/ldap-bindpw
|
||||
value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}"
|
||||
vtype: password
|
||||
|
||||
########################## ldap-auth
|
||||
- name: Set bind DN
|
||||
debconf:
|
||||
name: ldap-auth-config
|
||||
question: ldap-auth-config/binddn
|
||||
value: cn=ldapservice,dc=directory,dc=nh
|
||||
vtype: string
|
||||
|
||||
- name: Set root bind DN
|
||||
debconf:
|
||||
name: ldap-auth-config
|
||||
question: ldap-auth-config/rootbinddn
|
||||
value: cn=ldapservice,dc=directory,dc=nh
|
||||
vtype: string
|
||||
|
||||
- name: Set base DN
|
||||
debconf:
|
||||
name: ldap-auth-config
|
||||
question: ldap-auth-config/ldapns/base-dn
|
||||
value: dc=directory,dc=nh
|
||||
vtype: string
|
||||
|
||||
- name: Set login required
|
||||
debconf:
|
||||
name: ldap-auth-config
|
||||
question: ldap-auth-config/dblogin
|
||||
value: "true"
|
||||
vtype: boolean
|
||||
|
||||
- name: Set root login required
|
||||
debconf:
|
||||
name: ldap-auth-config
|
||||
question: ldap-auth-config/dbrootlogin
|
||||
value: "true"
|
||||
vtype: boolean
|
||||
|
||||
- name: Set ldap override
|
||||
debconf:
|
||||
name: ldap-auth-config
|
||||
question: ldap-auth-config/override
|
||||
value: "true"
|
||||
vtype: boolean
|
||||
|
||||
- name: Set move-to-debconf
|
||||
debconf:
|
||||
name: ldap-auth-config
|
||||
question: ldap-auth-config/move-to-debconf
|
||||
value: "true"
|
||||
vtype: boolean
|
||||
|
||||
- name: Set pam password
|
||||
debconf:
|
||||
name: ldap-auth-config
|
||||
question: ldap-auth-config/pam_password
|
||||
value: exop
|
||||
vtype: select
|
||||
|
||||
- name: Set LDAP server
|
||||
debconf:
|
||||
name: ldap-auth-config
|
||||
question: ldap-auth-config/ldapns/ldap-server
|
||||
value: ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/
|
||||
vtype: string
|
||||
|
||||
- name: Set LDAP server version
|
||||
debconf:
|
||||
name: ldap-auth-config
|
||||
question: ldap-auth-config/ldapns/ldap_version
|
||||
value: "3"
|
||||
vtype: select
|
||||
|
||||
- name: Set bind password
|
||||
debconf:
|
||||
name: ldap-auth-config
|
||||
question: ldap-auth-config/bindpw
|
||||
value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}"
|
||||
vtype: password
|
||||
|
||||
- name: Set root bind password
|
||||
debconf:
|
||||
name: ldap-auth-config
|
||||
question: ldap-auth-config/rootbindpw
|
||||
value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}"
|
||||
vtype: password
|
||||
|
||||
########################## libnss-ldapd
|
||||
- name: Configure libnss for ldap
|
||||
debconf:
|
||||
name: libnss-ldapd
|
||||
question: libnss-ldapd/nsswitch
|
||||
value: "passwd, group, shadow"
|
||||
vtype: multiselect
|
||||
- name: Configure libnss for not removnig ldap configuration
|
||||
debconf:
|
||||
name: libnss-ldapd
|
||||
question: libnss-ldapd/clean_nsswitch
|
||||
value: "false"
|
||||
vtype: boolean
|
||||
|
||||
########################## packages install
|
||||
- name: Installing client packages
|
||||
apt:
|
||||
name: [ 'libnss-ldapd', 'ldap-auth-config' ]
|
||||
state: latest
|
||||
|
||||
|
||||
# nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,dnsmasq,games,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,statd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data
|
||||
|
||||
|
||||
########################## nsswitch
|
||||
- name: nsswitch settings for passwd
|
||||
lineinfile:
|
||||
path: /etc/nsswitch.conf
|
||||
@ -178,16 +48,15 @@
|
||||
regexp: '^shadow\:'
|
||||
line: 'shadow: files ldap'
|
||||
|
||||
########################## idmap.conf
|
||||
- name: Tweak idmap.conf
|
||||
ini_file:
|
||||
path: /etc/idmapd.conf
|
||||
section: Translation
|
||||
option: Method
|
||||
value: nsswitch
|
||||
# TODO: think about security... we should move the ldap admin password somewhere else
|
||||
- name: ldap configuration
|
||||
template:
|
||||
src: 'ldap.conf'
|
||||
dest: '/etc/ldap.conf'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
mode: 0644
|
||||
|
||||
########################## DM
|
||||
- name: Check if lightdm is installed
|
||||
shell: dpkg-query -W -f='${Status}' lightdm | grep 'install ok installed'
|
||||
register: lightdm_installed
|
||||
|
@ -1,6 +1,7 @@
|
||||
dn: olcDatabase={2}hdb,cn=config
|
||||
changetype: modify
|
||||
replace: olcAccess
|
||||
olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by * none
|
||||
-
|
||||
add: olcAccess
|
||||
olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by dn="cn=libuser,dc=directory,dc=nh" write by anonymous auth by self write by * none
|
||||
olcAccess: {1}to dn.base="" by * read
|
||||
olcAccess: {2}to * by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by * read
|
||||
olcAccess: {1}to dn.subtree="ou=People,dc=directory,dc=nh" attrs=userPassword,shadowLastChange by self write by anonymous auth by * none
|
||||
|
Loading…
x
Reference in New Issue
Block a user