diff --git a/ad-auth/tasks/sssd.yml b/ad-auth/tasks/sssd.yml
index ecc41bc936121b570a1f4555b5578c0b2d5e3fa5..35926a722e5209c560d55b9c26e41ae10cdd4b3c 100644
--- a/ad-auth/tasks/sssd.yml
+++ b/ad-auth/tasks/sssd.yml
@@ -9,6 +9,9 @@
- libnss-sss
- sssd-tools
- realmd
+ - policykit-1 # this is required for realm to discover realms...
+ - adcli # this is required for realm to join realms...
+ - packagekit # this is required for realm to i don't know and don't even care anymore...
notify:
- clear sssd cache
tags:
@@ -34,7 +37,7 @@
expect:
command: kinit Administrator
responses:
- "Password for Administrator@{{ domain.upper() }}": "{{ lookup('passwordstore', 'samba-admin') }}"
+ "Password for Administrator.*": "{{ lookup('passwordstore', 'samba-admin') }}"
when: debian_version == "stretch"
- name: leave any other realm
command: realm leave
diff --git a/ad-server/tasks/main.yml b/ad-server/tasks/main.yml
index 8c2cd44382d9492ffced35ab938d0b0167ac6a82..1322f314b33ac1f9f8255ed188f9316621542ea2 100644
--- a/ad-server/tasks/main.yml
+++ b/ad-server/tasks/main.yml
@@ -8,7 +8,7 @@
- ad-server
- name: ensure winbind is for some reasons installed
- apt: name=samba state=latest
+ apt: name=winbind state=latest
tags:
- packages
- ad-server
@@ -42,7 +42,7 @@
# TODO: Evaluate if internal DNS-backend is powerful enough for usecase otherwise bind9 is needed
- name: ensure domain is provisioned
- shell: samba-tool domain provision --use-rfc2307 --domain={{ smb_domain }} --server-role=dc --host-name={{ ansible_hostname }} --realm={{ REALM }} --dns-backend=None --adminpass={{ adminpass.password }} 2> /root/smb-provision.log
+ shell: samba-tool domain provision --use-rfc2307 --domain={{ smb_domain }} --server-role=dc --host-name={{ ansible_hostname }} --realm={{ REALM }} --dns-backend=NONE --adminpass={{ adminpass.password }} 2> /root/smb-provision.log
when: domain_provisioned.stat.exists == False
tags:
- ad-server
diff --git a/ad-server/templates/smb.conf.j2 b/ad-server/templates/smb.conf.j2
index 28331af0e2ae7250d2e302c7fbb5b530c0054c80..3bd4725fd8292b4444a31f1eec4bd6c4fea4f8ab 100644
--- a/ad-server/templates/smb.conf.j2
+++ b/ad-server/templates/smb.conf.j2
@@ -19,6 +19,7 @@
kdc:renewal lifetime = {{ renewal_lifetime }}
tls enabled = yes
+ tls cafile = /etc/ssl/certs/rwth_chain.pem
tls keyfile = {{smb_tls_key}}
tls certfile = {{smb_tls_cert}}
diff --git a/nfs-client/files/nfs-common b/nfs-client/files/nfs-common
new file mode 100644
index 0000000000000000000000000000000000000000..3ff29b2e6c2531f5b6fc8a856f4f8e1cc44d2d8d
--- /dev/null
+++ b/nfs-client/files/nfs-common
@@ -0,0 +1,19 @@
+# If you do not set values for the NEED_ options, they will be attempted
+# autodetected; this should be sufficient for most people. Valid alternatives
+# for the NEED_ options are "yes" and "no".
+
+# Do you want to start the statd daemon? It is not needed for NFSv4.
+NEED_STATD=no
+
+# Options for rpc.statd.
+# Should rpc.statd listen on a specific port? This is especially useful
+# when you have a port-based firewall. To use a fixed port, set this
+# this variable to a statd argument like: "--port 4000 --outgoing-port 4001".
+# For more information, see rpc.statd(8) or http://wiki.debian.org/SecuringNFS
+STATDOPTS=
+
+# Do you want to start the idmapd daemon? It is only needed for NFSv4.
+NEED_IDMAPD=yes
+
+# Do you want to start the gssd daemon? It is required for Kerberos mounts.
+NEED_GSSD=yes
diff --git a/nfs-client/tasks/main.yml b/nfs-client/tasks/main.yml
index 7835528b64bccee5ef6ef111101191ee0ac42c4a..b11c6c3a013910af6e68e0a51e9e5284edbd0ee6 100644
--- a/nfs-client/tasks/main.yml
+++ b/nfs-client/tasks/main.yml
@@ -12,20 +12,29 @@
- nfs-client
- packages
-#- name: ensure we use the idmapper
-# copy: content="N" dest=/sys/module/nfs/parameters/nfs4_disable_idmapping
-# notify:
-# - restart nfs-common
-# - restart autofs
-# tags:
-# - nfs-client
-# - config
-#
-#- name: ensure we use the idmapper after a reboot
-# copy: src=modprobe-nfs.conf dest=/etc/modprobe.d/nfs.conf owner=root group=root mode=0644
-# tags:
-# - nfs-client
-# - config
+- name: ensure the nfs-common service is configured for nfs4
+ copy: src=nfs-common dest=/etc/default/nfs-common owner=root group=root mode=0644
+ notify:
+ - restart nfs-common
+ - restart autofs
+ tags:
+ - nfs-client
+ - config
+
+- name: ensure we use the idmapper
+ shell: echo "N" > /sys/module/nfs/parameters/nfs4_disable_idmapping
+ notify:
+ - restart nfs-common
+ - restart autofs
+ tags:
+ - nfs-client
+ - config
+
+- name: ensure we use the idmapper after a reboot
+ copy: src=modprobe-nfs.conf dest=/etc/modprobe.d/nfs.conf owner=root group=root mode=0644
+ tags:
+ - nfs-client
+ - config
- name: ensure the kernel key storage quote used for idmapping is sufficiently high
sysctl: name=kernel.keys.root_maxkeys state=present value=1000 # default is 200, this quote was reached
@@ -47,6 +56,12 @@
- sysctl
- config
+- name: ensure nfs-common is enabled
+ service: name=nfs-common state=running enabled=yes
+ tags:
+ - nfs-client
+ - service
+
- name: ensure there is a base directory for automount
file: state=directory path=/net owner=root group=root mode=0755
notify:
diff --git a/nfs-server/files/auto.master b/nfs-server/files/auto.master
deleted file mode 100644
index aef7888b76e0fd5d8292e0f4dea827125e370cc2..0000000000000000000000000000000000000000
--- a/nfs-server/files/auto.master
+++ /dev/null
@@ -1,24 +0,0 @@
-#
-# Sample auto.master file
-# This is an automounter map and it has the following format
-# key [ -mount-options-separated-by-comma ] location
-# For details of the format look at autofs(5).
-#
-#/misc /etc/auto.misc
-#
-# NOTE: mounts done from a hosts map will be mounted with the
-# "nosuid" and "nodev" options unless the "suid" and "dev"
-# options are explicitly given.
-#
-#/net -hosts
-/net /etc/auto.nfs
-#
-# Include central master map if it can be found using
-# nsswitch sources.
-#
-# Note that if there are entries for /net or /misc (as
-# above) in the included master map any keys that are the
-# same will not be seen as the first read key seen takes
-# precedence.
-#
-+auto.master
diff --git a/nfs-server/files/modprobe-nfs.conf b/nfs-server/files/modprobe-nfs.conf
deleted file mode 100644
index 2f7e4b40072674549df590ae915fb89d2f959986..0000000000000000000000000000000000000000
--- a/nfs-server/files/modprobe-nfs.conf
+++ /dev/null
@@ -1 +0,0 @@
-options nfs nfs4_disable_idmapping=N
diff --git a/nfs-server/files/nfs-common b/nfs-server/files/nfs-common
new file mode 100644
index 0000000000000000000000000000000000000000..606ae9d46092b41505b8ad7a4ece88735f42d323
--- /dev/null
+++ b/nfs-server/files/nfs-common
@@ -0,0 +1,19 @@
+# If you do not set values for the NEED_ options, they will be attempted
+# autodetected; this should be sufficient for most people. Valid alternatives
+# for the NEED_ options are "yes" and "no".
+
+# Do you want to start the statd daemon? It is not needed for NFSv4.
+NEED_STATD=
+
+# Options for rpc.statd.
+# Should rpc.statd listen on a specific port? This is especially useful
+# when you have a port-based firewall. To use a fixed port, set this
+# this variable to a statd argument like: "--port 4000 --outgoing-port 4001".
+# For more information, see rpc.statd(8) or http://wiki.debian.org/SecuringNFS
+STATDOPTS=
+
+# Do you want to start the idmapd daemon? It is only needed for NFSv4.
+NEED_IDMAPD=yes
+
+# Do you want to start the gssd daemon? It is required for Kerberos mounts.
+NEED_GSSD=yes
diff --git a/nfs-server/files/nfs-kernel-server b/nfs-server/files/nfs-kernel-server
new file mode 100644
index 0000000000000000000000000000000000000000..5ba0009ace54562e558b0f99e7c76dbbde3cbc87
--- /dev/null
+++ b/nfs-server/files/nfs-kernel-server
@@ -0,0 +1,19 @@
+# Number of servers to start up
+RPCNFSDCOUNT=8
+
+# Runtime priority of server (see nice(1))
+RPCNFSDPRIORITY=0
+
+# Options for rpc.mountd.
+# If you have a port-based firewall, you might want to set up
+# a fixed port here using the --port option. For more information,
+# see rpc.mountd(8) or http://wiki.debian.org/SecuringNFS
+# To disable NFSv4 on the server, specify '--no-nfs-version 4' here
+RPCMOUNTDOPTS="--manage-gids"
+
+# Do you want to start the svcgssd daemon? It is only required for Kerberos
+# exports. Valid alternatives are "yes" and "no"; the default is "no".
+NEED_SVCGSSD="yes"
+
+# Options for rpc.svcgssd.
+RPCSVCGSSDOPTS="-vvv"
diff --git a/nfs-server/handlers/main.yml b/nfs-server/handlers/main.yml
index 7944169d8c6f1aad07261147e7e16f3f0addb958..ae1b1b6bc351a3f4a726be681a87fc5f4fd849f7 100644
--- a/nfs-server/handlers/main.yml
+++ b/nfs-server/handlers/main.yml
@@ -1,11 +1,6 @@
---
-# file: roles/nfs-client/handlers/main.yml
+# file: roles/nfs-server/handlers/main.yml
-- name: restart autofs
- service: name=autofs state=restarted
+- name: restart nfs-server
+ service: name=nfs-server state=restarted
-- name: restart nfs-common
- service: name=nfs-common state=restarted
-
-- name: reload sysctl
- command: sysctl -p
diff --git a/nfs-server/tasks/main.yml b/nfs-server/tasks/main.yml
index 38154e34b2e1b8e22745affcc6443f097f13865a..73787781a653fabd80428af5c29830c16892f6de 100644
--- a/nfs-server/tasks/main.yml
+++ b/nfs-server/tasks/main.yml
@@ -6,7 +6,7 @@
with_items:
- nfs-common
- nfs-kernel-server
- - msktutils
+ - msktutil
- librpcsecgss3
- libgssrpc4
tags:
@@ -51,13 +51,13 @@
- service
- name: ensure that there is a keytab available
- file: path=/etc/krb5.keytab state=present
+ file: path=/etc/krb5.keytab state=file
tags:
- nfs-server
- service-principal
- name: check that we have a valid service principal
- shell: klist -k /etc/krb5.keytab | grep nfs/{{ ansible_fqdn }}
+ shell: klist -k /etc/krb5.keytab | grep "nfs/{{ ansible_fqdn }}"
register: principal
failed_when: False
tags:
@@ -69,7 +69,7 @@
shell: samba-tool user list | grep nfs-user
register: nfsuser
failed_when: False
- delegate_to: "{{ authservers[0] }}"
+ delegate_to: "{{ hostvars[groups['ad-server'][0]]['ansible_host'] }}"
tags:
- nfs-server
- service-principal
@@ -77,22 +77,23 @@
- name: ensure there is a nfs-user account
command: samba-tool user create nfs-user --random-password
when: nfsuser.rc == 1
- delegate_to: "{{ authservers[0] }}"
+ delegate_to: "{{ hostvars[groups['ad-server'][0]]['ansible_host'] }}"
tags:
- nfs-server
- service-principal
- name: create service principal
- command: "samba-tool spn add nfs/{{ ansible_fqdn }} nfs-user"
- delegate_to: "{{ authservers[0] }}"
+ command: samba-tool spn add "nfs/{{ ansible_fqdn }}" nfs-user
+ delegate_to: "{{ hostvars[groups['ad-server'][0]]['ansible_host'] }}"
tags:
- nfs-server
- service-principal
- name: export keytab
- command: "samba-tool domain exportkeytab /root/{{ ansible_fqdn }}.keytab --principal nfs/{{ ansible_fqdn }}"
+ command: samba-tool domain exportkeytab "/root/{{ ansible_fqdn }}.keytab" --principal "nfs/{{ ansible_fqdn }}"
+ args:
creates: "/root/{{ ansible_fqdn }}.keytab"
- delegate_to: "{{ authservers[0] }}"
+ delegate_to: "{{ hostvars[groups['ad-server'][0]]['ansible_host'] }}"
tags:
- nfs-server
- service-principal
@@ -100,8 +101,8 @@
- name: copy keytab
synchronize:
src: "/root/{{ ansible_fqdn }}.keytab"
- dest: "{{ ansible_fqdn }}:/root/{{ ansible_fqdn }}.keytab"
- delegate_to: "{{ authservers[0] }}"
+ dest: "/root/{{ ansible_fqdn }}.keytab"
+ delegate_to: "{{ hostvars[groups['ad-server'][0]]['ansible_host'] }}"
tags:
- nfs-server
- service-principal
@@ -113,14 +114,14 @@
- service-principal
- name: merge keytabs
- - expect:
- command: ktutil
- responses:
- ktutil(.*):
- - rkt /etc/krb5.keytab
- - "rkt /root/{{ ansible_fqdn }}.keytab"
- - wkt /etc/krb5.keytab
- - exit
+ expect:
+ command: ktutil
+ responses:
+ ktutil(.*):
+ - rkt /etc/krb5.keytab
+ - "rkt /root/{{ ansible_fqdn }}.keytab"
+ - wkt /etc/krb5.keytab
+ - exit
notify:
- restart nfs-server
tags:
@@ -129,7 +130,7 @@
- name: remove keytab at kdc
file: path="/root/{{ ansible_fqdn }}.keytab" state=absent
- delegate_to: "{{ authservers[0] }}"
+ delegate_to: "{{ hostvars[groups['ad-server'][0]]['ansible_host'] }}"
tags:
- nfs-server
- service-principal
diff --git a/nfs-server/templates/auto.nfs.j2 b/nfs-server/templates/auto.nfs.j2
deleted file mode 100644
index f60b42fdba4b1f5364781799c9847f6a18388cc4..0000000000000000000000000000000000000000
--- a/nfs-server/templates/auto.nfs.j2
+++ /dev/null
@@ -1,3 +0,0 @@
-{%- for share in nfs_shares %}
-{{ share.netdir }} -{{ share.options }} {{ share.src }}
-{% endfor -%}
diff --git a/nfs-server/templates/exports.j2 b/nfs-server/templates/exports.j2
new file mode 100644
index 0000000000000000000000000000000000000000..f39eb7395bcd4d0617eb19a58242c3e874a8d399
--- /dev/null
+++ b/nfs-server/templates/exports.j2
@@ -0,0 +1,16 @@
+# /etc/exports: the access control list for filesystems which may be exported
+# to NFS clients. See exports(5).
+#
+# Example for NFSv2 and NFSv3:
+# /srv/homes hostname1(rw,sync,no_subtree_check) hostname2(ro,sync,no_subtree_check)
+#
+# Example for NFSv4:
+# /srv/nfs4 gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check)
+# /srv/nfs4/homes gss/krb5i(rw,sync,no_subtree_check)
+#
+
+{%- for export in nfs_exports %}
+{{ export.src }} {{ export.dest }}({{ export.options }})
+{% endfor -%}
+
+