Commit 4bbf52f0 authored by Hinrikus Wolf's avatar Hinrikus Wolf

Merge branch 'sssd-auth'

parents 41bca9ec 5a9e8594
Name: Create home directory during login
Default: yes
Priority: 900
Session-Type: Additional
Session:
required pam_mkhomedir.so umask=0077 skel=/etc/skel
Name: Set our default system-wide umask
Default: yes
Priority: 900
Session-Type: Additional
Session:
optional pam_umask.so
---
# file: roles/ad-auth/handlers/main.yml
- name: restart nslcd
service: name=nslcd state=restarted
- name: regenerate pam config
shell: DEBIAN_FRONTEND=noninteractive pam-auth-update --force
- name: restart nscd
service: name=nscd state=restarted
- name: clear sssd cache
command: sss_cache -E
register: result
changed_when: "result.rc == 0"
failed_when: "result.rc != 0 and result.rc != 2"
- name: clear nscd caches
command: nscd -i passwd group
- name: restart sssd
service: name=sssd state=restarted
- name: check sudo config
command: visudo -q -c -f /etc/sudoers
---
# file: roles/ad-auth/tasks/kerberos.yml
#- name: ensure kerberos is installed
# apt: name=krb5-user,krb5-clients state=latest
# tags:
# - kerberos
# - packages
#
#- name: configure kerberos
# template: src=krb5.conf.j2 dest=/etc/krb5.conf owner=root group=root mode=0644
# tags:
# - kerberos
# - config
- name: ensure kerberos is installed
apt: name=krb5-user state=installed
tags:
- kerberos
- packages
- name: ensure kerberos is configured
template: src=krb5.conf.j2 dest=/etc/krb5.conf owner=root group=root mode=0644
tags:
- kerberos
- config
---
# file: roles/ad-auth/tasks/ldap.yml
- name: ensure old libnss-ldap and libnss-pam are not installed
apt: name=libnss-ldap,libpam-ldap state=absent
tags:
- packages
- clean
- ldap
- name: ensure ldap NSS and PAM modules are installed
apt: name=libnss-ldapd,libpam-ldapd,ldap-utils state=latest
- name: ensure ldap-utils is installed
apt: name=ldap-utils state=installed
tags:
- ldap
- packages
......@@ -19,3 +12,4 @@
tags:
- ldap
- config
......@@ -3,11 +3,11 @@
- include: ldap.yml
- meta: flush_handlers
- include: nslcd.yml
- include: kerberos.yml
- meta: flush_handlers
- include: nscd.yml
- include: sssd.yml
- meta: flush_handlers
- include: kerberos.yml
- include: pam.yml
- meta: flush_handlers
- include: sudo.yml
- meta: flush_handlers
......
---
# file: roles/ad-auth/tasks/nscd.yml
- name: ensure nscd is installed
apt: name=nscd state=latest
tags:
- nscd
- packages
- name: ensure proper nscd configuration
copy: src=nsswitch.conf dest=/etc/nsswitch.conf owner=root group=root mode=0644
notify:
- restart nscd
- clear nscd caches
tags:
- nscd
- config
- name: ensure a happy nscd
file: path=/etc/netgroup state=touch
notify:
- restart nscd
- clear nscd caches
tags:
- nscd
- config
- name: ensure nscd is running
service: name=nscd state=running enabled=yes
tags:
- nscd
- service
---
# file: roles/ad-auth/tasks/nslcd.yml
- name: ensure nslcd is installed
apt: name=nslcd state=latest
tags:
- nslcd
- packages
- name: ensure proper nslcd configuration
template: src=nslcd.conf.j2 dest=/etc/nslcd.conf owner=root group=nslcd mode=0640
notify:
- restart nslcd
tags:
- nslcd
- config
- name: ensure nslcd is running and enabled
service: name=nslcd state=running enabled=yes
tags:
- nslcd
- service
---
# file: roles/ad-auth/tasks/pam.yml
- name: ensure pam applies a general umask
copy: src=pam/umask dest=/usr/share/pam-configs/umask owner=root group=root mode=0644
notify:
- regenerate pam config
tags:
- pam
- config
- name: ensure pam creates a home dir if necessary
copy: src=pam/mkhomedir dest=/usr/share/pam-configs/mkhomedir owner=root group=root mode=0644
when: "'clients' not in group_names"
notify:
- regenerate pam config
tags:
- pam
- config
---
# file: roles/ad-auth/tasks/sssd.yml
- name: ensure sssd is installed
apt: name="{{ item }}" state=installed install_recommends=no
with_items:
- sssd
- libpam-sss
- libnss-sss
- sssd-tools
- realmd
notify:
- clear sssd cache
tags:
- sssd
- packages
- name: check if our realm is configured
shell: realm list | grep "{{ domain }}"
register: current_realms
changed_when: "current_realms.rc != 0"
failed_when: "current_realms.rc != 0 and current_realms.rc != 1"
- block:
- name: discover our realm
command: realm discover -v "{{ domain }}"
- name: get a kerberos ticket
shell: echo "{{ lookup('passwordstore', 'samba-admin') }}" | kinit Administrator
when: debian_version == "jessie"
- name: ensure pexpect is installed
apt: name=python-pexpect state=installed
when: debian_version == "stretch"
- name: get a kerberos ticket
expect:
command: kinit Administrator
responses:
"Password for Administrator@{{ domain.upper() }}": "{{ lookup('passwordstore', 'samba-admin') }}"
when: debian_version == "stretch"
- name: leave any other realm
command: realm leave
register: result
until: "result.rc != 0"
retries: 9001
delay: 0
failed_when: "result.rc != 0 and result.rc != 1"
- name: join our realm
command: realm join -v "{{ domain }}"
notify:
- clear sssd cache
- restart sssd
- name: destroy kerberos ticket
command: kdestroy
when: "current_realms.rc != 0"
- name: ensure sssd is configured
template: src=sssd.conf.j2 dest=/etc/sssd/sssd.conf owner=root group=root mode=0600
notify:
- restart sssd
- clear sssd cache
tags:
- sssd
- config
- name: ensure sssd is enabled and running
service: name=sssd state=running enabled=yes
tags:
- sssd
- service
......@@ -3,12 +3,9 @@
- name: ensure users of group admin are in the sudoers
copy: src=sudo/admin dest=/etc/sudoers.d/admin owner=root group=root mode=0440
notify:
- check sudo config
tags:
- sudo
- config
- name: check whole sudo config
command: visudo -q -c -f /etc/sudoers
tags:
- sudo
- test
## TODO
[libdefaults]
default_realm = FSMPI.RWTH-AACHEN.DE
default_realm = {{ domain.upper() }}
dns_lookup_realm = false
dns_lookup_kdc = true
forwardable = true
[domain_realm]
.fsmpi.rwth-aachen.de = FSMPI.RWTH-AACHEN.DE
fsmpi.rwth-aachen.de = FSMPI.RWTH-AACHEN.DE
.{{ domain }} = {{ domain.upper() }}
{{ domain }} = {{ domain.upper() }}
......@@ -6,10 +6,14 @@
# This file should be world readable but not world writable.
BASE {{ authbase }}
URI ldaps://{{ authserver }}
URI {{ authservers | join(" ") }}
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
TLS_CACERT {{ authcacert }}
SASL_MECH GSSAPI
GSSAPI_SIGN on
GSSAPI_ENCRYPT on
# /etc/nslcd.conf
# nslcd configuration file. See nslcd.conf(5)
# for details.
# The user and group nslcd should run as.
uid nslcd
gid nslcd
# The location at which the LDAP server(s) should be reachable.
uri ldaps://{{ authserver }}
# The search base that will be used for all queries.
base {{ authbase }}
# The LDAP protocol version to use.
#ldap_version 3
# The DN to bind with for normal lookups.
#binddn cn=annonymous,dc=example,dc=net
#bindpw secret
# The DN used for password modifications by root.
#rootpwmoddn cn=admin,dc=example,dc=com
# SSL options
#ssl off
tls_cacertfile {{ authcacert }}
tls_reqcert demand
# The search scope.
#scope sub
[sssd]
domains = {{ domain }}
config_file_version = 2
services = nss, pam
[pam]
offline_credentials_expiration = 1
offline_failed_login_attempts = 3
offline_failed_login_delay = 0
[domain/{{ domain }}]
ad_domain = {{ domain }}
krb5_realm = {{ domain.upper() }}
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = False
use_fully_qualified_names = False
fallback_homedir = /home/%u
access_provider = ad
enumerate = true
ldap_user_fullname = displayName
krb5_lifetime = 48h
krb5_renewable_lifetime = 200h
krb5_renew_interval = 30m
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment