Compare commits
5 Commits
f1cf36997e
...
e26c8577d8
Author | SHA1 | Date | |
---|---|---|---|
e26c8577d8 | |||
b456871116 | |||
24bd7132d2 | |||
3d3e488055 | |||
f066b01c60 |
13
README.md
13
README.md
@ -12,9 +12,10 @@ A working [LibreSchool][] installation is required.
|
|||||||
|
|
||||||
## Notes ##
|
## Notes ##
|
||||||
|
|
||||||
At the moment, if you run ```showmount -e [server ip] ``` on the client, you end up with an error. That's because we're ditching NFSv2 and NFSv3 in favour of NFSv4 (this will give us Kerberos integration in future) and all unneeded ports are closed.
|
At the moment, if you run ```showmount -e [server ip]``` on the client, you end up with an error. That's because we're ditching NFSv2 and NFSv3 in favour of NFSv4 (this will give us Kerberos integration in future) and all unneeded ports are closed.
|
||||||
|
|
||||||
## TODO / ideas ##
|
## TODO / ideas ##
|
||||||
|
|
||||||
- verify on a brand new install if after installation a new 'chkconfig {nfs,rpcbind} on' is needed
|
- verify on a brand new install if after installation a new 'chkconfig {nfs,rpcbind} on' is needed
|
||||||
- force Domain Controller mode (db configuration getprop smb ServerRole == PDC)
|
- force Domain Controller mode (db configuration getprop smb ServerRole == PDC)
|
||||||
- export shared folder also
|
- export shared folder also
|
||||||
@ -22,22 +23,20 @@ At the moment, if you run ```showmount -e [server ip] ``` on the client, you end
|
|||||||
- ACL on home directories
|
- ACL on home directories
|
||||||
- multiple nfs-server support
|
- multiple nfs-server support
|
||||||
|
|
||||||
|
## tested distros ##
|
||||||
|
|
||||||
|
|
||||||
## tested distos
|
|
||||||
- edubuntu 14.04: OK
|
- edubuntu 14.04: OK
|
||||||
- ubuntu 14:04: OK
|
- ubuntu 14:04: OK
|
||||||
- ubuntu 16:04: OK
|
- ubuntu 16:04: OK
|
||||||
- ubuntu 18:04: ldap can't connect... (remember to force python install on adoption)
|
- ubuntu 18:04: OK
|
||||||
|
- xubuntu 18:04: OK
|
||||||
- zorin 12: OK
|
- zorin 12: OK
|
||||||
- linuxmint: ldap can't connect...
|
- zorin 15: OK
|
||||||
|
|
||||||
|
|
||||||
## License ##
|
## License ##
|
||||||
|
|
||||||
As the rest of the LibreSchool project, libreschool-nfs is licensed under [GPLv3][] license.
|
As the rest of the LibreSchool project, libreschool-nfs is licensed under [GPLv3][] license.
|
||||||
|
|
||||||
|
|
||||||
[LibreSchool]: https://libreschool.org "LibreSchool Project Homepage"
|
[LibreSchool]: https://libreschool.org "LibreSchool Project Homepage"
|
||||||
[NethServer]: https://www.nethserver.org
|
[NethServer]: https://www.nethserver.org
|
||||||
[GPLv3]: https://www.gnu.org/licenses/gpl-3.0.html
|
[GPLv3]: https://www.gnu.org/licenses/gpl-3.0.html
|
||||||
|
@ -1,6 +1,6 @@
|
|||||||
Summary: LibreSchool NFS home profiles configuration
|
Summary: LibreSchool NFS home profiles configuration
|
||||||
Name: libreschool-nfs
|
Name: libreschool-nfs
|
||||||
Version: 1.0
|
Version: 1.0.2
|
||||||
Release: 1.ns7
|
Release: 1.ns7
|
||||||
License: GPL
|
License: GPL
|
||||||
BuildArch: noarch
|
BuildArch: noarch
|
||||||
@ -41,6 +41,7 @@ chkconfig rpcbind on
|
|||||||
/sbin/e-smith/db configuration set nfs service \
|
/sbin/e-smith/db configuration set nfs service \
|
||||||
status enabled \
|
status enabled \
|
||||||
TCPPort 2049 \
|
TCPPort 2049 \
|
||||||
|
UDPPort 2049 \
|
||||||
access private
|
access private
|
||||||
/sbin/e-smith/db configuration set rpcbind service \
|
/sbin/e-smith/db configuration set rpcbind service \
|
||||||
status enabled \
|
status enabled \
|
||||||
@ -50,7 +51,7 @@ chkconfig rpcbind on
|
|||||||
/sbin/e-smith/expand-template /etc/exports
|
/sbin/e-smith/expand-template /etc/exports
|
||||||
/sbin/e-smith/expand-template /etc/ansible/reconfigure_clients.yml
|
/sbin/e-smith/expand-template /etc/ansible/reconfigure_clients.yml
|
||||||
/usr/bin/systemctl --no-block start nfs >/dev/null 2>&1 || :
|
/usr/bin/systemctl --no-block start nfs >/dev/null 2>&1 || :
|
||||||
/usr/bin/systemctl --no-block start rpmbind >/dev/null 2>&1 || :
|
/usr/bin/systemctl --no-block start rpcbind >/dev/null 2>&1 || :
|
||||||
/usr/sbin/exportfs -r
|
/usr/sbin/exportfs -r
|
||||||
/sbin/e-smith/signal-event firewall-adjust
|
/sbin/e-smith/signal-event firewall-adjust
|
||||||
/usr/bin/ldapmodify -Y EXTERNAL -f /usr/share/libreschool-nfs/patch.ldif >/dev/null 2>&1 || :
|
/usr/bin/ldapmodify -Y EXTERNAL -f /usr/share/libreschool-nfs/patch.ldif >/dev/null 2>&1 || :
|
||||||
@ -67,5 +68,11 @@ if [ "$1" = 0 ]; then
|
|||||||
fi
|
fi
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Sat Mar 7 2020 Paolo Asperti <paolo@asperti.com> - 1.0.2-1.ns7
|
||||||
|
- Some fixes
|
||||||
|
|
||||||
|
* Mon May 6 2019 Paolo Asperti <paolo@asperti.com> - 1.0.1-1.ns7
|
||||||
|
- updated drone and ansible support
|
||||||
|
|
||||||
* Sun Apr 28 2019 Paolo Asperti <paolo@asperti.com> - 1.0-1.ns7
|
* Sun Apr 28 2019 Paolo Asperti <paolo@asperti.com> - 1.0-1.ns7
|
||||||
- First release for NethServer 7
|
- First release for NethServer 7
|
||||||
|
@ -1,8 +1,8 @@
|
|||||||
---
|
---
|
||||||
|
|
||||||
- name: Installing client packages
|
- name: Installing nfs client packages
|
||||||
apt:
|
apt:
|
||||||
name: [ 'nfs-common', 'libnss-ldap' ]
|
name: [ 'nfs-common' ]
|
||||||
state: latest
|
state: latest
|
||||||
|
|
||||||
- name: Create directory for user homes
|
- name: Create directory for user homes
|
||||||
@ -14,19 +14,149 @@
|
|||||||
src: "{{ esmith.SystemName }}.{{ esmith.DomainName }}:/var/lib/nethserver/home"
|
src: "{{ esmith.SystemName }}.{{ esmith.DomainName }}:/var/lib/nethserver/home"
|
||||||
fstype: nfs4
|
fstype: nfs4
|
||||||
opts: rw,async,_netdev
|
opts: rw,async,_netdev
|
||||||
passno: 1
|
passno: "1"
|
||||||
dump: 0
|
dump: "0"
|
||||||
state: mounted
|
state: mounted
|
||||||
|
|
||||||
# forse questo non serve
|
########################## nslcd
|
||||||
- name: Tweak idmap.conf
|
- name: Set bind DN
|
||||||
ini_file:
|
debconf:
|
||||||
path: /etc/idmapd.conf
|
name: nslcd
|
||||||
section: Translation
|
question: nslcd/ldap-binddn
|
||||||
option: Method
|
value: cn=ldapservice,dc=directory,dc=nh
|
||||||
value: nsswitch
|
vtype: string
|
||||||
mode: 0644
|
|
||||||
|
|
||||||
|
- name: Set base DN
|
||||||
|
debconf:
|
||||||
|
name: nslcd
|
||||||
|
question: nslcd/ldap-base
|
||||||
|
value: dc=directory,dc=nh
|
||||||
|
vtype: string
|
||||||
|
|
||||||
|
- name: Set LDAP server
|
||||||
|
debconf:
|
||||||
|
name: nslcd
|
||||||
|
question: nslcd/ldap-uris
|
||||||
|
value: ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/
|
||||||
|
vtype: string
|
||||||
|
|
||||||
|
- name: Set bind password
|
||||||
|
debconf:
|
||||||
|
name: nslcd
|
||||||
|
question: nslcd/ldap-bindpw
|
||||||
|
value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}"
|
||||||
|
vtype: password
|
||||||
|
|
||||||
|
########################## ldap-auth
|
||||||
|
- name: Set bind DN
|
||||||
|
debconf:
|
||||||
|
name: ldap-auth-config
|
||||||
|
question: ldap-auth-config/binddn
|
||||||
|
value: cn=ldapservice,dc=directory,dc=nh
|
||||||
|
vtype: string
|
||||||
|
|
||||||
|
- name: Set root bind DN
|
||||||
|
debconf:
|
||||||
|
name: ldap-auth-config
|
||||||
|
question: ldap-auth-config/rootbinddn
|
||||||
|
value: cn=ldapservice,dc=directory,dc=nh
|
||||||
|
vtype: string
|
||||||
|
|
||||||
|
- name: Set base DN
|
||||||
|
debconf:
|
||||||
|
name: ldap-auth-config
|
||||||
|
question: ldap-auth-config/ldapns/base-dn
|
||||||
|
value: dc=directory,dc=nh
|
||||||
|
vtype: string
|
||||||
|
|
||||||
|
- name: Set login required
|
||||||
|
debconf:
|
||||||
|
name: ldap-auth-config
|
||||||
|
question: ldap-auth-config/dblogin
|
||||||
|
value: "true"
|
||||||
|
vtype: boolean
|
||||||
|
|
||||||
|
- name: Set root login required
|
||||||
|
debconf:
|
||||||
|
name: ldap-auth-config
|
||||||
|
question: ldap-auth-config/dbrootlogin
|
||||||
|
value: "true"
|
||||||
|
vtype: boolean
|
||||||
|
|
||||||
|
- name: Set ldap override
|
||||||
|
debconf:
|
||||||
|
name: ldap-auth-config
|
||||||
|
question: ldap-auth-config/override
|
||||||
|
value: "true"
|
||||||
|
vtype: boolean
|
||||||
|
|
||||||
|
- name: Set move-to-debconf
|
||||||
|
debconf:
|
||||||
|
name: ldap-auth-config
|
||||||
|
question: ldap-auth-config/move-to-debconf
|
||||||
|
value: "true"
|
||||||
|
vtype: boolean
|
||||||
|
|
||||||
|
- name: Set pam password
|
||||||
|
debconf:
|
||||||
|
name: ldap-auth-config
|
||||||
|
question: ldap-auth-config/pam_password
|
||||||
|
value: exop
|
||||||
|
vtype: select
|
||||||
|
|
||||||
|
- name: Set LDAP server
|
||||||
|
debconf:
|
||||||
|
name: ldap-auth-config
|
||||||
|
question: ldap-auth-config/ldapns/ldap-server
|
||||||
|
value: ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/
|
||||||
|
vtype: string
|
||||||
|
|
||||||
|
- name: Set LDAP server version
|
||||||
|
debconf:
|
||||||
|
name: ldap-auth-config
|
||||||
|
question: ldap-auth-config/ldapns/ldap_version
|
||||||
|
value: "3"
|
||||||
|
vtype: select
|
||||||
|
|
||||||
|
- name: Set bind password
|
||||||
|
debconf:
|
||||||
|
name: ldap-auth-config
|
||||||
|
question: ldap-auth-config/bindpw
|
||||||
|
value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}"
|
||||||
|
vtype: password
|
||||||
|
|
||||||
|
- name: Set root bind password
|
||||||
|
debconf:
|
||||||
|
name: ldap-auth-config
|
||||||
|
question: ldap-auth-config/rootbindpw
|
||||||
|
value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}"
|
||||||
|
vtype: password
|
||||||
|
|
||||||
|
########################## libnss-ldapd
|
||||||
|
- name: Configure libnss for ldap
|
||||||
|
debconf:
|
||||||
|
name: libnss-ldapd
|
||||||
|
question: libnss-ldapd/nsswitch
|
||||||
|
value: "passwd, group, shadow"
|
||||||
|
vtype: multiselect
|
||||||
|
- name: Configure libnss for not removnig ldap configuration
|
||||||
|
debconf:
|
||||||
|
name: libnss-ldapd
|
||||||
|
question: libnss-ldapd/clean_nsswitch
|
||||||
|
value: "false"
|
||||||
|
vtype: boolean
|
||||||
|
|
||||||
|
########################## packages install
|
||||||
|
- name: Installing client packages
|
||||||
|
apt:
|
||||||
|
name: [ 'libnss-ldapd', 'ldap-auth-config' ]
|
||||||
|
state: latest
|
||||||
|
|
||||||
|
|
||||||
|
# nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,dnsmasq,games,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,statd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data
|
||||||
|
|
||||||
|
|
||||||
|
########################## nsswitch
|
||||||
- name: nsswitch settings for passwd
|
- name: nsswitch settings for passwd
|
||||||
lineinfile:
|
lineinfile:
|
||||||
path: /etc/nsswitch.conf
|
path: /etc/nsswitch.conf
|
||||||
@ -48,15 +178,16 @@
|
|||||||
regexp: '^shadow\:'
|
regexp: '^shadow\:'
|
||||||
line: 'shadow: files ldap'
|
line: 'shadow: files ldap'
|
||||||
|
|
||||||
# TODO: think about security... we should move the ldap admin password somewhere else
|
########################## idmap.conf
|
||||||
- name: ldap configuration
|
- name: Tweak idmap.conf
|
||||||
template:
|
ini_file:
|
||||||
src: 'ldap.conf'
|
path: /etc/idmapd.conf
|
||||||
dest: '/etc/ldap.conf'
|
section: Translation
|
||||||
owner: 'root'
|
option: Method
|
||||||
group: 'root'
|
value: nsswitch
|
||||||
mode: 0644
|
mode: 0644
|
||||||
|
|
||||||
|
########################## DM
|
||||||
- name: Check if lightdm is installed
|
- name: Check if lightdm is installed
|
||||||
shell: dpkg-query -W -f='${Status}' lightdm | grep 'install ok installed'
|
shell: dpkg-query -W -f='${Status}' lightdm | grep 'install ok installed'
|
||||||
register: lightdm_installed
|
register: lightdm_installed
|
||||||
|
@ -1,7 +1,6 @@
|
|||||||
dn: olcDatabase={2}hdb,cn=config
|
dn: olcDatabase={2}hdb,cn=config
|
||||||
changetype: modify
|
changetype: modify
|
||||||
replace: olcAccess
|
|
||||||
olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by * none
|
|
||||||
-
|
|
||||||
add: olcAccess
|
add: olcAccess
|
||||||
olcAccess: {1}to dn.subtree="ou=People,dc=directory,dc=nh" attrs=userPassword,shadowLastChange by self write by anonymous auth by * none
|
olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by dn="cn=libuser,dc=directory,dc=nh" write by anonymous auth by self write by * none
|
||||||
|
olcAccess: {1}to dn.base="" by * read
|
||||||
|
olcAccess: {2}to * by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by * read
|
||||||
|
Loading…
x
Reference in New Issue
Block a user