Compare commits

...

5 Commits

Author SHA1 Message Date
e26c8577d8
version bump
Some checks failed
continuous-integration/drone/push Build is passing
continuous-integration/drone/tag Build is failing
2020-03-08 11:18:20 +01:00
b456871116
a lot of fixes for better OS support 2020-03-08 10:56:22 +01:00
24bd7132d2
updated readme 2020-03-08 10:55:19 +01:00
3d3e488055
fix typo 2020-03-07 14:46:45 +01:00
f066b01c60
fix nfs port 2020-03-07 14:46:35 +01:00
4 changed files with 168 additions and 32 deletions

View File

@ -12,9 +12,10 @@ A working [LibreSchool][] installation is required.
## Notes ## ## Notes ##
At the moment, if you run ```showmount -e [server ip] ``` on the client, you end up with an error. That's because we're ditching NFSv2 and NFSv3 in favour of NFSv4 (this will give us Kerberos integration in future) and all unneeded ports are closed. At the moment, if you run ```showmount -e [server ip]``` on the client, you end up with an error. That's because we're ditching NFSv2 and NFSv3 in favour of NFSv4 (this will give us Kerberos integration in future) and all unneeded ports are closed.
## TODO / ideas ## ## TODO / ideas ##
- verify on a brand new install if after installation a new 'chkconfig {nfs,rpcbind} on' is needed - verify on a brand new install if after installation a new 'chkconfig {nfs,rpcbind} on' is needed
- force Domain Controller mode (db configuration getprop smb ServerRole == PDC) - force Domain Controller mode (db configuration getprop smb ServerRole == PDC)
- export shared folder also - export shared folder also
@ -22,22 +23,20 @@ At the moment, if you run ```showmount -e [server ip] ``` on the client, you end
- ACL on home directories - ACL on home directories
- multiple nfs-server support - multiple nfs-server support
## tested distros ##
## tested distos
- edubuntu 14.04: OK - edubuntu 14.04: OK
- ubuntu 14:04: OK - ubuntu 14:04: OK
- ubuntu 16:04: OK - ubuntu 16:04: OK
- ubuntu 18:04: ldap can't connect... (remember to force python install on adoption) - ubuntu 18:04: OK
- xubuntu 18:04: OK
- zorin 12: OK - zorin 12: OK
- linuxmint: ldap can't connect... - zorin 15: OK
## License ## ## License ##
As the rest of the LibreSchool project, libreschool-nfs is licensed under [GPLv3][] license. As the rest of the LibreSchool project, libreschool-nfs is licensed under [GPLv3][] license.
[LibreSchool]: https://libreschool.org "LibreSchool Project Homepage" [LibreSchool]: https://libreschool.org "LibreSchool Project Homepage"
[NethServer]: https://www.nethserver.org [NethServer]: https://www.nethserver.org
[GPLv3]: https://www.gnu.org/licenses/gpl-3.0.html [GPLv3]: https://www.gnu.org/licenses/gpl-3.0.html

View File

@ -1,6 +1,6 @@
Summary: LibreSchool NFS home profiles configuration Summary: LibreSchool NFS home profiles configuration
Name: libreschool-nfs Name: libreschool-nfs
Version: 1.0 Version: 1.0.2
Release: 1.ns7 Release: 1.ns7
License: GPL License: GPL
BuildArch: noarch BuildArch: noarch
@ -41,6 +41,7 @@ chkconfig rpcbind on
/sbin/e-smith/db configuration set nfs service \ /sbin/e-smith/db configuration set nfs service \
status enabled \ status enabled \
TCPPort 2049 \ TCPPort 2049 \
UDPPort 2049 \
access private access private
/sbin/e-smith/db configuration set rpcbind service \ /sbin/e-smith/db configuration set rpcbind service \
status enabled \ status enabled \
@ -50,7 +51,7 @@ chkconfig rpcbind on
/sbin/e-smith/expand-template /etc/exports /sbin/e-smith/expand-template /etc/exports
/sbin/e-smith/expand-template /etc/ansible/reconfigure_clients.yml /sbin/e-smith/expand-template /etc/ansible/reconfigure_clients.yml
/usr/bin/systemctl --no-block start nfs >/dev/null 2>&1 || : /usr/bin/systemctl --no-block start nfs >/dev/null 2>&1 || :
/usr/bin/systemctl --no-block start rpmbind >/dev/null 2>&1 || : /usr/bin/systemctl --no-block start rpcbind >/dev/null 2>&1 || :
/usr/sbin/exportfs -r /usr/sbin/exportfs -r
/sbin/e-smith/signal-event firewall-adjust /sbin/e-smith/signal-event firewall-adjust
/usr/bin/ldapmodify -Y EXTERNAL -f /usr/share/libreschool-nfs/patch.ldif >/dev/null 2>&1 || : /usr/bin/ldapmodify -Y EXTERNAL -f /usr/share/libreschool-nfs/patch.ldif >/dev/null 2>&1 || :
@ -67,5 +68,11 @@ if [ "$1" = 0 ]; then
fi fi
%changelog %changelog
* Sat Mar 7 2020 Paolo Asperti <paolo@asperti.com> - 1.0.2-1.ns7
- Some fixes
* Mon May 6 2019 Paolo Asperti <paolo@asperti.com> - 1.0.1-1.ns7
- updated drone and ansible support
* Sun Apr 28 2019 Paolo Asperti <paolo@asperti.com> - 1.0-1.ns7 * Sun Apr 28 2019 Paolo Asperti <paolo@asperti.com> - 1.0-1.ns7
- First release for NethServer 7 - First release for NethServer 7

View File

@ -1,8 +1,8 @@
--- ---
- name: Installing client packages - name: Installing nfs client packages
apt: apt:
name: [ 'nfs-common', 'libnss-ldap' ] name: [ 'nfs-common' ]
state: latest state: latest
- name: Create directory for user homes - name: Create directory for user homes
@ -14,19 +14,149 @@
src: "{{ esmith.SystemName }}.{{ esmith.DomainName }}:/var/lib/nethserver/home" src: "{{ esmith.SystemName }}.{{ esmith.DomainName }}:/var/lib/nethserver/home"
fstype: nfs4 fstype: nfs4
opts: rw,async,_netdev opts: rw,async,_netdev
passno: 1 passno: "1"
dump: 0 dump: "0"
state: mounted state: mounted
# forse questo non serve ########################## nslcd
- name: Tweak idmap.conf - name: Set bind DN
ini_file: debconf:
path: /etc/idmapd.conf name: nslcd
section: Translation question: nslcd/ldap-binddn
option: Method value: cn=ldapservice,dc=directory,dc=nh
value: nsswitch vtype: string
mode: 0644
- name: Set base DN
debconf:
name: nslcd
question: nslcd/ldap-base
value: dc=directory,dc=nh
vtype: string
- name: Set LDAP server
debconf:
name: nslcd
question: nslcd/ldap-uris
value: ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/
vtype: string
- name: Set bind password
debconf:
name: nslcd
question: nslcd/ldap-bindpw
value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}"
vtype: password
########################## ldap-auth
- name: Set bind DN
debconf:
name: ldap-auth-config
question: ldap-auth-config/binddn
value: cn=ldapservice,dc=directory,dc=nh
vtype: string
- name: Set root bind DN
debconf:
name: ldap-auth-config
question: ldap-auth-config/rootbinddn
value: cn=ldapservice,dc=directory,dc=nh
vtype: string
- name: Set base DN
debconf:
name: ldap-auth-config
question: ldap-auth-config/ldapns/base-dn
value: dc=directory,dc=nh
vtype: string
- name: Set login required
debconf:
name: ldap-auth-config
question: ldap-auth-config/dblogin
value: "true"
vtype: boolean
- name: Set root login required
debconf:
name: ldap-auth-config
question: ldap-auth-config/dbrootlogin
value: "true"
vtype: boolean
- name: Set ldap override
debconf:
name: ldap-auth-config
question: ldap-auth-config/override
value: "true"
vtype: boolean
- name: Set move-to-debconf
debconf:
name: ldap-auth-config
question: ldap-auth-config/move-to-debconf
value: "true"
vtype: boolean
- name: Set pam password
debconf:
name: ldap-auth-config
question: ldap-auth-config/pam_password
value: exop
vtype: select
- name: Set LDAP server
debconf:
name: ldap-auth-config
question: ldap-auth-config/ldapns/ldap-server
value: ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/
vtype: string
- name: Set LDAP server version
debconf:
name: ldap-auth-config
question: ldap-auth-config/ldapns/ldap_version
value: "3"
vtype: select
- name: Set bind password
debconf:
name: ldap-auth-config
question: ldap-auth-config/bindpw
value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}"
vtype: password
- name: Set root bind password
debconf:
name: ldap-auth-config
question: ldap-auth-config/rootbindpw
value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}"
vtype: password
########################## libnss-ldapd
- name: Configure libnss for ldap
debconf:
name: libnss-ldapd
question: libnss-ldapd/nsswitch
value: "passwd, group, shadow"
vtype: multiselect
- name: Configure libnss for not removnig ldap configuration
debconf:
name: libnss-ldapd
question: libnss-ldapd/clean_nsswitch
value: "false"
vtype: boolean
########################## packages install
- name: Installing client packages
apt:
name: [ 'libnss-ldapd', 'ldap-auth-config' ]
state: latest
# nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,dnsmasq,games,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,statd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data
########################## nsswitch
- name: nsswitch settings for passwd - name: nsswitch settings for passwd
lineinfile: lineinfile:
path: /etc/nsswitch.conf path: /etc/nsswitch.conf
@ -48,15 +178,16 @@
regexp: '^shadow\:' regexp: '^shadow\:'
line: 'shadow: files ldap' line: 'shadow: files ldap'
# TODO: think about security... we should move the ldap admin password somewhere else ########################## idmap.conf
- name: ldap configuration - name: Tweak idmap.conf
template: ini_file:
src: 'ldap.conf' path: /etc/idmapd.conf
dest: '/etc/ldap.conf' section: Translation
owner: 'root' option: Method
group: 'root' value: nsswitch
mode: 0644 mode: 0644
########################## DM
- name: Check if lightdm is installed - name: Check if lightdm is installed
shell: dpkg-query -W -f='${Status}' lightdm | grep 'install ok installed' shell: dpkg-query -W -f='${Status}' lightdm | grep 'install ok installed'
register: lightdm_installed register: lightdm_installed

View File

@ -1,7 +1,6 @@
dn: olcDatabase={2}hdb,cn=config dn: olcDatabase={2}hdb,cn=config
changetype: modify changetype: modify
replace: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by * none
-
add: olcAccess add: olcAccess
olcAccess: {1}to dn.subtree="ou=People,dc=directory,dc=nh" attrs=userPassword,shadowLastChange by self write by anonymous auth by * none olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by dn="cn=libuser,dc=directory,dc=nh" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by * read