Compare commits

...

No commits in common. "master" and "fa86a2d9fb673f8ec53c0efd2cff9250e03c45bc" have entirely different histories.

27 changed files with 174 additions and 324 deletions

View File

@ -1,53 +0,0 @@
kind: pipeline
name: default
steps:
- name: create_targz
image: registry.libreschool.org/libreschool-automation/rpm-pack:latest
pull: always
settings:
files:
- root
- README.md
- createlinks.pl
- COPYING
when:
event: [ push, tag ]
- name: build
image: registry.libreschool.org/libreschool-automation/rpm-build:7
pull: always
commands:
- yum-builddep -y libreschool-nfs.spec
- rpmbuild -ba libreschool-nfs.spec
- mkdir out ; mv *.rpm noarch/*.rpm out/
when:
event: [ push, tag ]
- name: sign
image: registry.libreschool.org/libreschool-automation/rpm-sign:latest
pull: always
settings:
files: out/*.rpm
gpg_key:
from_secret: gpg_key
passphrase:
from_secret: passphrase
when:
event: tag
- name: gitea_release
image: plugins/gitea-release
settings:
files: out/*.rpm
checksum:
- md5
- sha1
- sha256
- sha512
api_key:
from_secret: gitea_token
base_url: https://git.libreschool.org
file_exists: skip
when:
event: tag

View File

@ -1,7 +1,5 @@
# libreschool-nfs #
[![Build Status](https://drone.libreschool.org/api/badges/LibreSchool/libreschool-nfs/status.svg)](https://drone.libreschool.org/LibreSchool/libreschool-nfs)
This package is meant for exporting the users homes via NFS.
The NFS should give better performances, compared to samba. Real world benchmarks will follow.
This package will install nfs-utils and configure the NFS exports, configure services and ports (for the firewall)
@ -12,10 +10,9 @@ A working [LibreSchool][] installation is required.
## Notes ##
At the moment, if you run ```showmount -e [server ip]``` on the client, you end up with an error. That's because we're ditching NFSv2 and NFSv3 in favour of NFSv4 (this will give us Kerberos integration in future) and all unneeded ports are closed.
At the moment, if you run ```showmount -e [server ip] ``` on the client, you end up with an error. That's because we're ditching NFSv2 and NFSv3 in favour of NFSv4 (this will give us Kerberos integration in future) and all unneeded ports are closed.
## TODO / ideas ##
- verify on a brand new install if after installation a new 'chkconfig {nfs,rpcbind} on' is needed
- force Domain Controller mode (db configuration getprop smb ServerRole == PDC)
- export shared folder also
@ -23,20 +20,11 @@ At the moment, if you run ```showmount -e [server ip]``` on the client, you end
- ACL on home directories
- multiple nfs-server support
## tested distros ##
- edubuntu 14.04: OK
- ubuntu 14:04: OK
- ubuntu 16:04: OK
- ubuntu 18:04: OK
- xubuntu 18:04: OK
- zorin 12: OK
- zorin 15: OK
## License ##
As the rest of the LibreSchool project, libreschool-nfs is licensed under [GPLv3][] license.
[LibreSchool]: https://libreschool.org "LibreSchool Project Homepage"
[NethServer]: https://www.nethserver.org
[GPLv3]: https://www.gnu.org/licenses/gpl-3.0.html

View File

@ -1,7 +0,0 @@
#!/usr/bin/perl -w
use esmith::Build::CreateLinks qw(:all);
use File::Basename;
use File::Path;
event_actions('password-modify', 'save-administrator-password' => 26);

View File

@ -1,6 +1,6 @@
Summary: LibreSchool NFS home profiles configuration
Name: libreschool-nfs
Version: 1.1.1
Version: 1.0
Release: 1.ns7
License: GPL
BuildArch: noarch
@ -10,7 +10,7 @@ Source1: COPYING
URL: %{url_prefix}/%{name}
Requires: libreschool-release
Requires: libreschool-client-manager
Requires: nethserver-dc
Requires: nethserver-directory oppure nfs quell'altro
Requires: nfs-utils
Requires(post): systemd
Requires(preun): systemd
@ -25,8 +25,6 @@ LibreSchool NFS home profiles configuration
%setup
%build
%{makedocs}
perl createlinks.pl
%install
rm -rf $RPM_BUILD_ROOT
@ -43,7 +41,6 @@ chkconfig rpcbind on
/sbin/e-smith/db configuration set nfs service \
status enabled \
TCPPort 2049 \
UDPPort 2049 \
access private
/sbin/e-smith/db configuration set rpcbind service \
status enabled \
@ -53,9 +50,10 @@ chkconfig rpcbind on
/sbin/e-smith/expand-template /etc/exports
/sbin/e-smith/expand-template /etc/ansible/reconfigure_clients.yml
/usr/bin/systemctl --no-block start nfs >/dev/null 2>&1 || :
/usr/bin/systemctl --no-block start rpcbind >/dev/null 2>&1 || :
/usr/sbin/exportfs -ra
/usr/bin/systemctl --no-block start rpmbind >/dev/null 2>&1 || :
/usr/sbin/exportfs -r
/sbin/e-smith/signal-event firewall-adjust
/usr/bin/ldapmodify -Y EXTERNAL -f /usr/share/libreschool-nfs/patch.ldif >/dev/null 2>&1 || :
%postun
#if [ "$1" = 1 ]; then
@ -65,21 +63,9 @@ if [ "$1" = 0 ]; then
#uninstallation
echo > /etc/exports
/sbin/e-smith/expand-template /etc/ansible/reconfigure_clients.yml
/usr/sbin/exportfs -ra
/usr/sbin/exportfs -r
fi
%changelog
* Tue Apr 7 2020 Paolo Asperti <paolo@asperti.com> - 1.1.1-1.ns7
- Fix for Ubuntu 16.04
* Sun Apr 5 2020 Paolo Asperti <paolo@asperti.com> - 1.1.0-1.ns7
- Switched to Active Directory
* Sat Mar 7 2020 Paolo Asperti <paolo@asperti.com> - 1.0.2-1.ns7
- Some fixes
* Mon May 6 2019 Paolo Asperti <paolo@asperti.com> - 1.0.1-1.ns7
- updated drone and ansible support
* Sun Apr 28 2019 Paolo Asperti <paolo@asperti.com> - 1.0-1.ns7
- First release for NethServer 7

View File

@ -1,13 +1,3 @@
---
- name: restart lightdm
service: name=lightdm state=restarted
- name: restart gdm3
service: name=gdm3 state=restarted
- name: restart sssd
service: name=sssd state=restarted
- name: restart smbd
service: name=smbd state=restarted
- name: restart libnss-ldap
service: name=libnss-ldap state=restarted

View File

@ -1,10 +0,0 @@
---
- name: Login to domain
shell: "echo -n \"{{lookup('file', '/var/lib/nethserver/secrets/administrator') }}\" | kinit administrator"
- name: Join to domain
shell: "net ads join -k"
# shell: "net ads join --no-dns-updates -k"
# --no-dns-updates is not present in 16.04

View File

@ -1,17 +0,0 @@
---
- name: Check if gdm3 is installed
shell: dpkg-query -W -f='${Status}' gdm3 | grep 'install ok installed'
register: gdm3_installed
failed_when: no
changed_when: no
- name: Adjust gdm3 settings
ini_file:
path: /etc/gdm3/greeter.dconf-defaults
section: org/gnome/login-screen
option: disable-user-list
value: "true"
no_extra_spaces: yes
when: gdm3_installed.rc == 0
notify: restart gdm3

View File

@ -1,17 +0,0 @@
---
- name: Check if lightdm is installed
shell: dpkg-query -W -f='${Status}' lightdm | grep 'install ok installed'
register: lightdm_installed
failed_when: no
changed_when: no
- name: Adjusting lightdm settings
template:
src: 'lightdm.conf'
dest: '/usr/share/lightdm/lightdm.conf.d/50-libreschool.conf'
owner: 'root'
group: 'root'
mode: 0644
when: lightdm_installed.rc == 0
notify: restart lightdm

View File

@ -1,22 +1,154 @@
---
- include: nfs.yml
- name: Installing nfs client packages
apt:
name: [ 'nfs-common' ]
state: latest
- include: sssd.yml
- name: Create directory for user homes
file: path=/var/lib/nethserver/home state=directory owner=root group=root mode=0755
- include: gdm3.yml
- name: Add mount to fstab
mount:
path: /var/lib/nethserver/home
src: "{{ esmith.SystemName }}.{{ esmith.DomainName }}:/var/lib/nethserver/home"
fstype: nfs4
opts: rw,async,_netdev
passno: 1
dump: 0
state: mounted
- include: lightdm.yml
- name: Check if lightdm is installed
shell: dpkg-query -W -f='${Status}' lightdm | grep 'install ok installed'
register: lightdm_installed
failed_when: no
changed_when: no
- name: Make sure .config directory exists in skel
file:
path: /etc/skel/.config
state: directory
- name: Check if gdm3 is installed
shell: dpkg-query -W -f='${Status}' gdm3 | grep 'install ok installed'
register: gdm3_installed
failed_when: no
changed_when: no
- name: Disable Gnome Initial setup for new users (after user login)
copy:
src: gnome-initial-setup-done
dest: /etc/skel/.config/gnome-initial-setup-done
owner: root
group: root
mode: '0664'
- name: Adjusting lightdm settings
template:
src: 'lightdm.conf'
dest: '/usr/share/lightdm/lightdm.conf.d/50-libreschool.conf'
owner: 'root'
group: 'root'
mode: 0644
when: lightdm_installed.rc == 0
- name: Adjust gdm3 settings
ini_file:
path: /etc/gdm3/greeter.dconf-defaults
section: org/gnome/login-screen
option: disable-user-list
value: "true"
no_extra_spaces: yes
when: gdm3_installed.rc == 0
- name: Set bind DN
debconf:
name: ldap-auth-config
question: ldap-auth-config/binddn
value: cn=ldapservice,dc=directory,dc=nh
vtype: string
- name: Set root bind DN
debconf:
name: ldap-auth-config
question: ldap-auth-config/rootbinddn
value: cn=ldapservice,dc=directory,dc=nh
vtype: string
- name: Set base DN
debconf:
name: ldap-auth-config
question: ldap-auth-config/ldapns/base-dn
value: dc=directory,dc=nh
vtype: string
- name: Set login required
debconf:
name: ldap-auth-config
question: ldap-auth-config/dblogin
value: true
vtype: boolean
- name: Set root login required
debconf:
name: ldap-auth-config
question: ldap-auth-config/dbrootlogin
value: true
vtype: boolean
- name: Set ldap override
debconf:
name: ldap-auth-config
question: ldap-auth-config/override
value: true
vtype: boolean
- name: Set move-to-debconf
debconf:
name: ldap-auth-config
question: ldap-auth-config/move-to-debconf
value: true
vtype: boolean
- name: Set pam password
debconf:
name: ldap-auth-config
question: ldap-auth-config/pam_password
value: md5
vtype: select
# TODO: use ansible variables
- name: Set LDAP server
debconf:
name: ldap-auth-config
question: ldap-auth-config/ldapns/ldap-server
value: ldap://pdc.test.domain:389/
vtype: string
- name: Set LDAP server version
debconf:
name: ldap-auth-config
question: ldap-auth-config/ldapns/ldap_version
value: 3
vtype: select
- name: Set bind password
debconf:
name: ldap-auth-config
question: ldap-auth-config/bindpw
value: {{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}
vtype: password
- name: Set root bind password
debconf:
name: ldap-auth-config
question: ldap-auth-config/rootbindpw
value: {{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}
vtype: password
# - name: ldap configuration
# template:
# src: 'ldap.secret'
# dest: '/etc/ldap.secret'
# owner: 'root'
# group: 'root'
# mode: 0600
- name: Installing client packages
apt:
name: [ 'ldap-auth-config' ]
state: latest

View File

@ -1,19 +0,0 @@
---
- name: Installing nfs client packages
apt:
name: [ 'nfs-common' ]
state: latest
- name: Create directory for user homes
file: path=/var/lib/nethserver/home state=directory owner=root group=root mode=0755
- name: Add mount to fstab
mount:
path: /var/lib/nethserver/home
src: "{{ esmith.SystemName }}.{{ esmith.DomainName }}:/var/lib/nethserver/home"
fstype: nfs4
opts: rw,async,_netdev
passno: "1"
dump: "0"
state: mounted

View File

@ -1,81 +0,0 @@
---
- name: Kerberos configuration
debconf:
name: krb5-config
question: krb5-config/default_realm
value: "AD.{{ esmith.DomainName|upper }}"
vtype: string
- name: Samba configuration
debconf:
name: samba-common
question: samba-common/workgroup
value: "{{ esmith.sssd.Workgroup }}"
vtype: string
- name: Samba configuration
debconf:
name: samba-common
question: samba-common/do_debconf
value: true
vtype: boolean
- name: Samba configuration
debconf:
name: samba-common
question: samba-common/dhcp
value: true
vtype: boolean
- name: Installing sssd required packages
apt:
name: [ 'sssd-tools', 'sssd-ad', 'samba', 'krb5-user' ]
state: latest
- name: SSSD configuration
template:
src: 'sssd.conf'
dest: '/etc/sssd/sssd.conf'
owner: 'root'
group: 'root'
mode: 0600
notify: restart sssd
- name: Smb.conf
ini_file:
path: /etc/samba/smb.conf
section: global
option: "{{ item.option }}"
value: "{{ item.value }}"
no_extra_spaces: yes
with_items:
- { option: "workgroup", value: "{{ esmith.sssd.Workgroup }}" }
- { option: "client signing", value: "yes" }
- { option: "client use spnego", value: "yes" }
- { option: "kerberos method", value: "secrets and keytab" }
- { option: "realm", value: "AD.{{ esmith.DomainName|upper }}" }
- { option: "security", value: "ads" }
- { option: "interfaces", value: "{{ ansible_default_ipv4.interface }}" }
notify: restart smbd
- name: Check if joined to domain
shell: "net rpc testjoin"
changed_when: no
ignore_errors: true
register: domain_join_status
- name: Check for domain administrator password file
local_action: stat path=/var/lib/nethserver/secrets/administrator
register: stat_domain_admin_password_file
- include: domain_join.yml
when:
- domain_join_status.rc != 0
- stat_domain_admin_password_file.stat.exists
- name: Enable home directory creation
lineinfile:
path: /etc/pam.d/common-session
state: present
line: 'session required pam_mkhomedir.so skel=/etc/skel/ umask=0077'

View File

@ -0,0 +1,9 @@
base dc=directory,dc=nh
uri ldap://{{ esmith.SystemName }}.{{ esmith.DomainName }}:389/
ldap_version 3
binddn cn=libuser,dc=directory,dc=nh
bindpw {{ lookup('file', '/var/lib/nethserver/secrets/libuser') }}
rootbinddn cn=libuser,dc=directory,dc=nh
pam_password md5
#ssl start_tls
nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,dnsmasq,games,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,statd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data

View File

@ -0,0 +1 @@
{{ lookup('file', '/var/lib/nethserver/secrets/ldapservice') }}

View File

@ -1,22 +0,0 @@
[sssd]
services = nss, pam
config_file_version = 2
domains = AD.{{ esmith.DomainName|upper }}
# default_domain_suffix = {{ esmith.DomainName }}
[domain/AD.{{ esmith.DomainName|upper }}]
id_provider = ad
access_provider = ad
override_homedir = /var/lib/nethserver/home/%u
enumerate = true
ad_gpo_access_control = disabled
ad_domain = ad.{{ esmith.DomainName }}
krb5_realm = ad.{{ esmith.DomainName }}
ldap_id_mapping = True
ad_maximum_machine_account_password_age = 0
ad_server = nsdc-{{ esmith.SystemName }}.ad.{{ esmith.DomainName }}
cache_credentials = True
realmd_tags = manages-system joined-with-samba
#[nss]
#filter_users = ldapservice

View File

@ -1 +0,0 @@
private

View File

@ -1 +0,0 @@
enabled

View File

@ -1 +0,0 @@
service

View File

@ -1,26 +0,0 @@
#!/bin/bash
if ! [ $# -ge 3 ]; then
echo "[ERROR] Not enough arguments."
exit 2
fi
EVENT=$1
USER=$2
FILE=$3
DOMAIN=$(hostname -d)
if ! [[ $USER == "administrator@${DOMAIN}" ]]; then
echo "[NOTICE] Not storing password for user ${USER}."
exit 0
fi
if ! [ -f "${FILE}" ]; then
echo "[ERROR] Password file not found"
exit 1
fi
PASSWORD="$(<$FILE)"
touch /var/lib/nethserver/secrets/administrator
chmod 600 /var/lib/nethserver/secrets/administrator
echo -n "${PASSWORD}" > /var/lib/nethserver/secrets/administrator

View File

@ -0,0 +1,7 @@
dn: olcDatabase={2}bdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to attrs=sambaNTPassword by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by dn.exact="cn=samba,dc=directory,dc=nh" peername.ip="127.0.0.1" write by self write by * none
olcAccess:: ezF9dG8gYXR0cnM9dXNlclBhc3N3b3JkIA0KIGJ5IGRuLmV4YWN0PSJnaWROdW1iZXI9MCt1aWROdW1iZXI9MCxjbj1wZWVyY3JlZCxjbj1leHRlcm5hbCxjbj1hdXRoIiBtYW5hZ2UNCiBieSBkbi5leGFjdD0iY249cGFtLGRjPWRpcmVjdG9yeSxkYz1uaCIgcGVlcm5hbWUucGF0aD0iL3Zhci9ydW4vbGRhcGkiIHdyaXRlIA0KIGJ5IGRuLmV4YWN0PSJjbj1saWJ1c2VyLGRjPWRpcmVjdG9yeSxkYz1uaCIgcGVlcm5hbWUuaXA9IjEyNy4wLjAuMSIgd3JpdGUNCiBieSBhbm9ueW1vdXMgYXV0aCANCiBieSBzZWxmIHdyaXRlIA0KIGJ5ICogbm9uZQ==
olcAccess:: ezJ9dG8gZG4uYmFzZT0iIg0KIGJ5ICogcmVhZA==
olcAccess:: ezN9dG8gKg0KIGJ5IHNlbGYgd3JpdGUNCiBieSBkbi5leGFjdD0iZ2lkTnVtYmVyPTArdWlkTnVtYmVyPTAsY249cGVlcmNyZWQsY249ZXh0ZXJuYWwsY249YXV0aCIgbWFuYWdlDQogYnkgZG4uZXhhY3Q9ImNuPXNhbWJhLGRjPWRpcmVjdG9yeSxkYz1uaCIgcGVlcm5hbWUuaXA9IjEyNy4wLjAuMSIgd3JpdGUgDQogYnkgZG4uZXhhY3Q9ImNuPXBhbSxkYz1kaXJlY3RvcnksZGM9bmgiIHBlZXJuYW1lLnBhdGg9Ii92YXIvcnVuL2xkYXBpIiB3cml0ZSANCiBieSBkbi5leGFjdD0iY249bGlidXNlcixkYz1kaXJlY3RvcnksZGM9bmgiIHBlZXJuYW1lLmlwPSIxMjcuMC4wLjEiIHdyaXRlIA0KIGJ5IHVzZXJzIHNzZj03MSByZWFkIA0KIGJ5ICogcmVhZA==