Commit 09114a76 authored by Robin Sonnabend's avatar Robin Sonnabend

Merge branch 'master' of git.fsmpi.rwth-aachen.de:infra/ansible

parents 3f0764c4 3e299b1d
Name: Create home directory during login
Default: yes
Priority: 900
Session-Type: Additional
Session:
required pam_mkhomedir.so umask=0077 skel=/etc/skel
Name: Set our default system-wide umask
Default: yes
Priority: 900
Session-Type: Additional
Session:
optional pam_umask.so
---
# file: roles/ad-auth/handlers/main.yml
- name: restart nslcd
service: name=nslcd state=restarted
- name: regenerate pam config
shell: DEBIAN_FRONTEND=noninteractive pam-auth-update --force
- name: restart nscd
service: name=nscd state=restarted
- name: clear sssd cache
command: sss_cache -E
register: result
changed_when: "result.rc == 0"
failed_when: "result.rc != 0 and result.rc != 2"
- name: clear nscd caches
command: nscd -i passwd group
- name: restart sssd
service: name=sssd state=restarted
- name: check sudo config
command: visudo -q -c -f /etc/sudoers
---
# file: roles/ad-auth/tasks/kerberos.yml
#- name: ensure kerberos is installed
# apt: name=krb5-user,krb5-clients state=latest
# tags:
# - kerberos
# - packages
#
#- name: configure kerberos
# template: src=krb5.conf.j2 dest=/etc/krb5.conf owner=root group=root mode=0644
# tags:
# - kerberos
# - config
- name: ensure kerberos is installed
apt: name=krb5-user state=installed
tags:
- kerberos
- packages
- name: ensure kerberos is configured
template: src=krb5.conf.j2 dest=/etc/krb5.conf owner=root group=root mode=0644
tags:
- kerberos
- config
---
# file: roles/ad-auth/tasks/ldap.yml
- name: ensure old libnss-ldap and libnss-pam are not installed
apt: name=libnss-ldap,libpam-ldap state=absent
tags:
- packages
- clean
- ldap
- name: ensure ldap NSS and PAM modules are installed
apt: name=libnss-ldapd,libpam-ldapd,ldap-utils state=latest
- name: ensure ldap-utils is installed
apt: name=ldap-utils state=installed
tags:
- ldap
- packages
......@@ -19,3 +12,4 @@
tags:
- ldap
- config
......@@ -3,11 +3,11 @@
- include: ldap.yml
- meta: flush_handlers
- include: nslcd.yml
- include: kerberos.yml
- meta: flush_handlers
- include: nscd.yml
- include: sssd.yml
- meta: flush_handlers
- include: kerberos.yml
- include: pam.yml
- meta: flush_handlers
- include: sudo.yml
- meta: flush_handlers
......
---
# file: roles/ad-auth/tasks/nscd.yml
- name: ensure nscd is installed
apt: name=nscd state=latest
tags:
- nscd
- packages
- name: ensure proper nscd configuration
copy: src=nsswitch.conf dest=/etc/nsswitch.conf owner=root group=root mode=0644
notify:
- restart nscd
- clear nscd caches
tags:
- nscd
- config
- name: ensure a happy nscd
file: path=/etc/netgroup state=touch
notify:
- restart nscd
- clear nscd caches
tags:
- nscd
- config
- name: ensure nscd is running
service: name=nscd state=running enabled=yes
tags:
- nscd
- service
---
# file: roles/ad-auth/tasks/nslcd.yml
- name: ensure nslcd is installed
apt: name=nslcd state=latest
tags:
- nslcd
- packages
- name: ensure proper nslcd configuration
template: src=nslcd.conf.j2 dest=/etc/nslcd.conf owner=root group=nslcd mode=0640
notify:
- restart nslcd
tags:
- nslcd
- config
- name: ensure nslcd is running and enabled
service: name=nslcd state=running enabled=yes
tags:
- nslcd
- service
---
# file: roles/ad-auth/tasks/pam.yml
- name: ensure pam applies a general umask
copy: src=pam/umask dest=/usr/share/pam-configs/umask owner=root group=root mode=0644
notify:
- regenerate pam config
tags:
- pam
- config
- name: ensure pam creates a home dir if necessary
copy: src=pam/mkhomedir dest=/usr/share/pam-configs/mkhomedir owner=root group=root mode=0644
when: "'clients' not in group_names"
notify:
- regenerate pam config
tags:
- pam
- config
---
# file: roles/ad-auth/tasks/sssd.yml
- name: ensure sssd is installed
apt: name="{{ item }}" state=installed install_recommends=no
with_items:
- sssd
- libpam-sss
- libnss-sss
- sssd-tools
- realmd
notify:
- clear sssd cache
tags:
- sssd
- packages
- name: check if our realm is configured
shell: realm list | grep "{{ domain }}"
register: current_realms
changed_when: "current_realms.rc != 0"
failed_when: "current_realms.rc != 0 and current_realms.rc != 1"
- block:
- name: discover our realm
command: realm discover -v "{{ domain }}"
- name: get a kerberos ticket
shell: echo "{{ lookup('passwordstore', 'samba-admin') }}" | kinit Administrator
when: debian_version == "jessie"
- name: ensure pexpect is installed
apt: name=python-pexpect state=installed
when: debian_version == "stretch"
- name: get a kerberos ticket
expect:
command: kinit Administrator
responses:
"Password for Administrator@{{ domain.upper() }}": "{{ lookup('passwordstore', 'samba-admin') }}"
when: debian_version == "stretch"
- name: leave any other realm
command: realm leave
register: result
until: "result.rc != 0"
retries: 9001
delay: 0
failed_when: "result.rc != 0 and result.rc != 1"
- name: join our realm
command: realm join -v "{{ domain }}"
notify:
- clear sssd cache
- restart sssd
- name: destroy kerberos ticket
command: kdestroy
when: "current_realms.rc != 0"
- name: ensure sssd is configured
template: src=sssd.conf.j2 dest=/etc/sssd/sssd.conf owner=root group=root mode=0600
notify:
- restart sssd
- clear sssd cache
tags:
- sssd
- config
- name: ensure sssd is enabled and running
service: name=sssd state=running enabled=yes
tags:
- sssd
- service
......@@ -3,12 +3,9 @@
- name: ensure users of group admin are in the sudoers
copy: src=sudo/admin dest=/etc/sudoers.d/admin owner=root group=root mode=0440
notify:
- check sudo config
tags:
- sudo
- config
- name: check whole sudo config
command: visudo -q -c -f /etc/sudoers
tags:
- sudo
- test
## TODO
[libdefaults]
default_realm = FSMPI.RWTH-AACHEN.DE
default_realm = {{ domain.upper() }}
dns_lookup_realm = false
dns_lookup_kdc = true
forwardable = true
[domain_realm]
.fsmpi.rwth-aachen.de = FSMPI.RWTH-AACHEN.DE
fsmpi.rwth-aachen.de = FSMPI.RWTH-AACHEN.DE
.{{ domain }} = {{ domain.upper() }}
{{ domain }} = {{ domain.upper() }}
......@@ -6,10 +6,14 @@
# This file should be world readable but not world writable.
BASE {{ authbase }}
URI ldaps://{{ authserver }}
URI {{ authservers | join(" ") }}
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
TLS_CACERT {{ authcacert }}
SASL_MECH GSSAPI
GSSAPI_SIGN on
GSSAPI_ENCRYPT on
# /etc/nslcd.conf
# nslcd configuration file. See nslcd.conf(5)
# for details.
# The user and group nslcd should run as.
uid nslcd
gid nslcd
# The location at which the LDAP server(s) should be reachable.
uri ldaps://{{ authserver }}
# The search base that will be used for all queries.
base {{ authbase }}
# The LDAP protocol version to use.
#ldap_version 3
# The DN to bind with for normal lookups.
#binddn cn=annonymous,dc=example,dc=net
#bindpw secret
# The DN used for password modifications by root.
#rootpwmoddn cn=admin,dc=example,dc=com
# SSL options
#ssl off
tls_cacertfile {{ authcacert }}
tls_reqcert demand
# The search scope.
#scope sub
[sssd]
domains = {{ domain }}
config_file_version = 2
services = nss, pam
[pam]
offline_credentials_expiration = 1
offline_failed_login_attempts = 3
offline_failed_login_delay = 0
[domain/{{ domain }}]
ad_domain = {{ domain }}
krb5_realm = {{ domain.upper() }}
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
use_fully_qualified_names = False
fallback_homedir = /home/%u
access_provider = ad
enumerate = true
ldap_user_fullname = displayName
krb5_lifetime = 48h
krb5_renewable_lifetime = 200h
krb5_renew_interval = 30m
#!/bin/bash
if [ ! -h /$1 ]; then
rm /$1
rmdir /$1
ln -s /net/$1 /$1
fi
options nfs nfs4_disable_idmapping=N
......@@ -7,8 +7,5 @@
- name: restart nfs-common
service: name=nfs-common state=restarted
- name: reload sysfs.conf
service: name=sysfsutils state=restarted
- name: reload sysctl
command: sysctl -p
......@@ -2,42 +2,30 @@
# file: roles/nfs-client/tasks/main.yml
- name: ensure nfs client utils are installed
apt: name=nfs-common state=latest
tags:
- nfs-client
- packages
- name: ensure CIFS utils are installed
apt: name=cifs-utils,smbclient state=latest
tags:
- nfs-client
- cifs-client
- packages
- name: ensure sysfs-utils are installed
apt: name=sysfsutils state=present
apt: name="{{ item }}" state=installed
with_items:
- nfs-common
- libgssrpc4
- librpcsecgss3
- autofs
tags:
- nfs-client
- packages
- name: ensure we use the idmapper
command: 'echo "N" > /sys/module/nfs/parameters/nfs4_disable_idmapping'
notify:
- restart nfs-common
tags:
- nfs-client
- sysfs
- config
- name: ensure we use the idmapper after a reboot
lineinfile: line="module/nfs/parameters/nfs4_disable_idmapping = N" dest=/etc/sysfs.conf create=yes
notify:
- reload sysfs.conf
- restart nfs-common
tags:
- nfs-client
- sysfs
- config
#- name: ensure we use the idmapper
# copy: content="N" dest=/sys/module/nfs/parameters/nfs4_disable_idmapping
# notify:
# - restart nfs-common
# - restart autofs
# tags:
# - nfs-client
# - config
#
#- name: ensure we use the idmapper after a reboot
# copy: src=modprobe-nfs.conf dest=/etc/modprobe.d/nfs.conf owner=root group=root mode=0644
# tags:
# - nfs-client
# - config
- name: ensure the kernel key storage quote used for idmapping is sufficiently high
sysctl: name=kernel.keys.root_maxkeys state=present value=1000 # default is 200, this quote was reached
......@@ -59,13 +47,12 @@
- sysctl
- config
# makes life much easier to have an automounter and not /etc/fstab
- name: ensure automounter is installed
apt: name=autofs state=latest
- name: ensure there is a base directory for automount
file: state=directory path=/net owner=root group=root mode=0755
notify:
- restart autofs
tags:
- nfs-client
- autofs
- packages
- name: ensure automounter is configured
copy: src=auto.master dest=/etc/auto.master owner=root group=root mode=0644
......@@ -73,39 +60,33 @@
- restart autofs
tags:
- nfs-client
- autofs
- config
- name: ensure mounts from central storage are available
template: src=auto.nfs.j2 dest=/etc/auto.nfs owner=root group=root mode=0644
notify:
- nfs-client
- restart autofs
tags:
- autofs
- nfs-client
- config
- name: ensure automounter is enabled
service: name=autofs state=running enabled=yes
tags:
- nfs-client
- autofs
- service
- name: ensure linking of home
script: create_netdir.sh home
- name: ensure linking of netdirs
file: src="/net/{{ item.netdir }}" dest="/{{ item.dest }}" state=link force=yes
with_items: "{{ nfs_shares }}"
tags:
- nfs-client
- fsmpi
- autofs
- name: ensure linking of pub
script: create_netdir.sh pub
- name: configure default umask and other user related stuff
copy: src=login.defs dest=/etc/login.defs owner=root group=root mode=0644
tags:
- nfs-client
- fsmpi
- autofs
- umask
- config
- meta: flush_handlers
- include: umask.yml
- meta: flush_handlers
---
# file: roles/client/tasks/main.yml
- name: configure default umask and other user related stuff
copy: src=login.defs dest=/etc/login.defs owner=root group=root mode=0644
tags:
- umask
- config
- name: activate pam.d session modules to set default umask
lineinfile: dest=/etc/pam.d/common-session line="session optional pam_umask.so"
tags:
- umask
- pam
- config
{% for share in nfsshares %}
{{ share }}
{% endfor %}
{%- for share in nfs_shares %}
{{ share.netdir }} -{{ share.options }} {{ share.src }}
{% endfor -%}
#
# Sample auto.master file
# This is an automounter map and it has the following format
# key [ -mount-options-separated-by-comma ] location
# For details of the format look at autofs(5).
#
#/misc /etc/auto.misc
#
# NOTE: mounts done from a hosts map will be mounted with the
# "nosuid" and "nodev" options unless the "suid" and "dev"
# options are explicitly given.
#
#/net -hosts
/net /etc/auto.nfs
#
# Include central master map if it can be found using
# nsswitch sources.
#
# Note that if there are entries for /net or /misc (as
# above) in the included master map any keys that are the
# same will not be seen as the first read key seen takes
# precedence.
#
+auto.master
#
# /etc/login.defs - Configuration control definitions for the login package.
#
# Three items must be defined: MAIL_DIR, ENV_SUPATH, and ENV_PATH.
# If unspecified, some arbitrary (and possibly incorrect) value will
# be assumed. All other items are optional - if not specified then
# the described action or option will be inhibited.
#
# Comment lines (lines beginning with "#") and blank lines are ignored.
#
# Modified for Linux. --marekm
# REQUIRED for useradd/userdel/usermod
# Directory where mailboxes reside, _or_ name of file, relative to the
# home directory. If you _do_ define MAIL_DIR and MAIL_FILE,
# MAIL_DIR takes precedence.
#
# Essentially:
# - MAIL_DIR defines the location of users mail spool files
# (for mbox use) by appending the username to MAIL_DIR as defined
# below.
# - MAIL_FILE defines the location of the users mail spool files as the
# fully-qualified filename obtained by prepending the user home
# directory before $MAIL_FILE
#
# NOTE: This is no more used for setting up users MAIL environment variable
# which is, starting from shadow 4.0.12-1 in Debian, entirely the
# job of the pam_mail PAM modules
# See default PAM configuration files provided for
# login, su, etc.
#
# This is a temporary situation: setting these variables will soon
# move to /etc/default/useradd and the variables will then be
# no more supported
MAIL_DIR /var/mail
#MAIL_FILE .mail
#
# Enable logging and display of /var/log/faillog login failure info.
# This option conflicts with the pam_tally PAM module.
#
FAILLOG_ENAB yes
#
# Enable display of unknown usernames when login failures are recorded.
#
# WARNING: Unknown usernames may become world readable.
# See #290803 and #298773 for details about how this could become a security
# concern
LOG_UNKFAIL_ENAB no
#
# Enable logging of successful logins
#
LOG_OK_LOGINS no
#
# Enable "syslog" logging of su activity - in addition to sulog file logging.
# SYSLOG_SG_ENAB does the same for newgrp and sg.
#
SYSLOG_SU_ENAB yes
SYSLOG_SG_ENAB yes
#
# If defined, all su activity is logged to this file.
#
#SULOG_FILE /var/log/sulog
#
# If defined, file which maps tty line to TERM environment parameter.
# Each line of the file is in a format something like "vt100 tty01".
#
#TTYTYPE_FILE /etc/ttytype
#
# If defined, login failures will be logged here in a utmp format
# last, when invoked as lastb, will read /var/log/btmp, so...
#
FTMP_FILE /var/log/btmp
#
# If defined, the command name to display when running "su -". For
# example, if this is defined as "su" then a "ps" will display the
# command is "-su". If not defined, then "ps" would display the
# name of the shell actually being run, e.g. something like "-sh".
#
SU_NAME su
#
# If defined, file which inhibits all the usual chatter during the login
# sequence. If a full pathname, then hushed mode will be enabled if the
# user's name or shell are found in the file. If not a full pathname, then
# hushed mode will be enabled if the file exists in the user's home directory.
#
HUSHLOGIN_FILE .hushlogin
#HUSHLOGIN_FILE /etc/hushlogins
#