Compare commits

...

5 Commits

Author SHA1 Message Date
Paolo Asperti e26c8577d8
version bump
continuous-integration/drone/push Build is passing Details
2020-03-08 11:18:20 +01:00
Paolo Asperti b456871116
a lot of fixes for better OS support 2020-03-08 10:56:22 +01:00
Paolo Asperti 24bd7132d2
updated readme 2020-03-08 10:55:19 +01:00
Paolo Asperti 3d3e488055
fix typo 2020-03-07 14:46:45 +01:00
Paolo Asperti f066b01c60
fix nfs port 2020-03-07 14:46:35 +01:00
4 changed files with 168 additions and 32 deletions

View File

@ -12,9 +12,10 @@ A working [LibreSchool][] installation is required.
## Notes ##
At the moment, if you run ```showmount -e [server ip] ``` on the client, you end up with an error. That's because we're ditching NFSv2 and NFSv3 in favour of NFSv4 (this will give us Kerberos integration in future) and all unneeded ports are closed.
At the moment, if you run ```showmount -e [server ip]``` on the client, you end up with an error. That's because we're ditching NFSv2 and NFSv3 in favour of NFSv4 (this will give us Kerberos integration in future) and all unneeded ports are closed.
## TODO / ideas ##
- verify on a brand new install if after installation a new 'chkconfig {nfs,rpcbind} on' is needed
- force Domain Controller mode (db configuration getprop smb ServerRole == PDC)
- export shared folder also
@ -22,22 +23,20 @@ At the moment, if you run ```showmount -e [server ip] ``` on the client, you end
- ACL on home directories
- multiple nfs-server support
## tested distros ##
## tested distos
- edubuntu 14.04: OK
- ubuntu 14:04: OK
- ubuntu 16:04: OK
- ubuntu 18:04: ldap can't connect... (remember to force python install on adoption)
- ubuntu 18:04: OK
- xubuntu 18:04: OK
- zorin 12: OK
- linuxmint: ldap can't connect...
- zorin 15: OK
## License ##
As the rest of the LibreSchool project, libreschool-nfs is licensed under [GPLv3][] license.
[LibreSchool]: https://libreschool.org "LibreSchool Project Homepage"
[NethServer]: https://www.nethserver.org
[GPLv3]: https://www.gnu.org/licenses/gpl-3.0.html

View File

@ -1,6 +1,6 @@
Summary: LibreSchool NFS home profiles configuration
Name: libreschool-nfs
Version: 1.0
Version: 1.0.2
Release: 1.ns7
License: GPL
BuildArch: noarch
@ -41,6 +41,7 @@ chkconfig rpcbind on
/sbin/e-smith/db configuration set nfs service \
status enabled \
TCPPort 2049 \
UDPPort 2049 \
access private
/sbin/e-smith/db configuration set rpcbind service \
status enabled \
@ -50,7 +51,7 @@ chkconfig rpcbind on
/sbin/e-smith/expand-template /etc/exports
/sbin/e-smith/expand-template /etc/ansible/reconfigure_clients.yml
/usr/bin/systemctl --no-block start nfs >/dev/null 2>&1 || :
/usr/bin/systemctl --no-block start rpmbind >/dev/null 2>&1 || :
/usr/bin/systemctl --no-block start rpcbind >/dev/null 2>&1 || :
/usr/sbin/exportfs -r
/sbin/e-smith/signal-event firewall-adjust
/usr/bin/ldapmodify -Y EXTERNAL -f /usr/share/libreschool-nfs/patch.ldif >/dev/null 2>&1 || :
@ -67,5 +68,11 @@ if [ "$1" = 0 ]; then
fi
%changelog
* Sat Mar 7 2020 Paolo Asperti <paolo@asperti.com> - 1.0.2-1.ns7
- Some fixes
* Mon May 6 2019 Paolo Asperti <paolo@asperti.com> - 1.0.1-1.ns7
- updated drone and ansible support
* Sun Apr 28 2019 Paolo Asperti <paolo@asperti.com> - 1.0-1.ns7
- First release for NethServer 7

View File

@ -1,8 +1,8 @@
---
- name: Installing client packages
- name: Installing nfs client packages
apt:
name: [ 'nfs-common', 'libnss-ldap' ]
name: [ 'nfs-common' ]
state: latest
- name: Create directory for user homes
@ -14,19 +14,149 @@
src: "{{ esmith.SystemName }}.{{ esmith.DomainName }}:/var/lib/nethserver/home"
fstype: nfs4
opts: rw,async,_netdev
passno: 1
dump: 0
passno: "1"
dump: "0"
state: mounted
# forse questo non serve
- name: Tweak idmap.conf
ini_file:
path: /etc/idmapd.conf
section: Translation
option: Method
value: nsswitch
mode: 0644
########################## nslcd
- name: Set bind DN
debconf:
name: nslcd
question: nslcd/ldap-binddn
value: cn=ldapservice,dc=directory,dc=nh
vtype: string
- name: Set base DN
debconf:
name: nslcd
question: nslcd/ldap-base
value: dc=directory,dc=nh
vtype: string
- name: Set LDAP server
debconf:
name: nslcd
question: nslcd/ldap-uris
value: ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/
vtype: string
- name: Set bind password
debconf:
name: nslcd
question: nslcd/ldap-bindpw
value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}"
vtype: password
########################## ldap-auth
- name: Set bind DN
debconf:
name: ldap-auth-config
question: ldap-auth-config/binddn
value: cn=ldapservice,dc=directory,dc=nh
vtype: string
- name: Set root bind DN
debconf:
name: ldap-auth-config
question: ldap-auth-config/rootbinddn
value: cn=ldapservice,dc=directory,dc=nh
vtype: string
- name: Set base DN
debconf:
name: ldap-auth-config
question: ldap-auth-config/ldapns/base-dn
value: dc=directory,dc=nh
vtype: string
- name: Set login required
debconf:
name: ldap-auth-config
question: ldap-auth-config/dblogin
value: "true"
vtype: boolean
- name: Set root login required
debconf:
name: ldap-auth-config
question: ldap-auth-config/dbrootlogin
value: "true"
vtype: boolean
- name: Set ldap override
debconf:
name: ldap-auth-config
question: ldap-auth-config/override
value: "true"
vtype: boolean
- name: Set move-to-debconf
debconf:
name: ldap-auth-config
question: ldap-auth-config/move-to-debconf
value: "true"
vtype: boolean
- name: Set pam password
debconf:
name: ldap-auth-config
question: ldap-auth-config/pam_password
value: exop
vtype: select
- name: Set LDAP server
debconf:
name: ldap-auth-config
question: ldap-auth-config/ldapns/ldap-server
value: ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/
vtype: string
- name: Set LDAP server version
debconf:
name: ldap-auth-config
question: ldap-auth-config/ldapns/ldap_version
value: "3"
vtype: select
- name: Set bind password
debconf:
name: ldap-auth-config
question: ldap-auth-config/bindpw
value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}"
vtype: password
- name: Set root bind password
debconf:
name: ldap-auth-config
question: ldap-auth-config/rootbindpw
value: "{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}"
vtype: password
########################## libnss-ldapd
- name: Configure libnss for ldap
debconf:
name: libnss-ldapd
question: libnss-ldapd/nsswitch
value: "passwd, group, shadow"
vtype: multiselect
- name: Configure libnss for not removnig ldap configuration
debconf:
name: libnss-ldapd
question: libnss-ldapd/clean_nsswitch
value: "false"
vtype: boolean
########################## packages install
- name: Installing client packages
apt:
name: [ 'libnss-ldapd', 'ldap-auth-config' ]
state: latest
# nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,dnsmasq,games,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,statd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data
########################## nsswitch
- name: nsswitch settings for passwd
lineinfile:
path: /etc/nsswitch.conf
@ -48,15 +178,16 @@
regexp: '^shadow\:'
line: 'shadow: files ldap'
# TODO: think about security... we should move the ldap admin password somewhere else
- name: ldap configuration
template:
src: 'ldap.conf'
dest: '/etc/ldap.conf'
owner: 'root'
group: 'root'
########################## idmap.conf
- name: Tweak idmap.conf
ini_file:
path: /etc/idmapd.conf
section: Translation
option: Method
value: nsswitch
mode: 0644
########################## DM
- name: Check if lightdm is installed
shell: dpkg-query -W -f='${Status}' lightdm | grep 'install ok installed'
register: lightdm_installed

View File

@ -1,7 +1,6 @@
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by * none
-
add: olcAccess
olcAccess: {1}to dn.subtree="ou=People,dc=directory,dc=nh" attrs=userPassword,shadowLastChange by self write by anonymous auth by * none
olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by dn="cn=libuser,dc=directory,dc=nh" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by dn="cn=domain admins,ou=Groups,dc=directory,dc=nh" write by * read