Add pam_mount, /tmp and /home tmpfs mounts, and infoadmin homedir

linux_lab / bootstrap

Browse code Add pam_mount, /tmp and /home tmpfs mounts, and infoadmin homedir master
1 parent 1a06d8c commit b1944b2636a3f6e4f92f3716b7f1fe15d5a45bdf Mark George authored on 18 Feb 2021

Patch

Showing 6 changed files

Ignore Space Show notes View environments/production/modules/bootstrap/files/authentication/etc/pam.d/common-account 0 → 100644
### MANAGED BY PUPPET (base-configuration::user_session) # # /etc/pam.d/common-account - authorization settings common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of the authorization modules that define # the central access policy for use on the system. The default is to # only deny service to users whose accounts are expired in /etc/shadow. # # As of pam 1.0.1-6, this file is managed by pam-auth-update by default. # To take advantage of this, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details. # # here are the per-package modules (the "Primary" block) account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so # here's the fallback if no module succeeds account requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around account required pam_permit.so # and here are more per-package modules (the "Additional" block) account sufficient pam_localuser.so account [default=bad success=ok user_unknown=ignore] pam_sss.so # end of pam-auth-update config

Ignore Space Show notes View

environments/production/modules/bootstrap/files/authentication/etc/pam.d/common-account 0 → 100644

### MANAGED BY PUPPET (base-configuration::user_session)
#
# /etc/pam.d/common-account - authorization settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authorization modules that define
# the central access policy for use on the system.  The default is to
# only deny service to users whose accounts are expired in /etc/shadow.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.
#

# here are the per-package modules (the "Primary" block)
account	[success=1 new_authtok_reqd=done default=ignore]	pam_unix.so
# here's the fallback if no module succeeds
account	requisite			pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
account	required			pam_permit.so
# and here are more per-package modules (the "Additional" block)
account	sufficient		pam_localuser.so
account	[default=bad success=ok user_unknown=ignore]	pam_sss.so
# end of pam-auth-update config

Ignore Space Show notes View environments/production/modules/bootstrap/files/authentication/etc/pam.d/common-auth 0 → 100644
### MANAGED BY PUPPET (base-configuration::user_session) # # /etc/pam.d/common-auth - authentication settings common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of the authentication modules that define # the central authentication scheme for use on the system # (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the # traditional Unix authentication mechanisms. # # As of pam 1.0.1-6, this file is managed by pam-auth-update by default. # To take advantage of this, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details. # here are the per-package modules (the "Primary" block) auth [success=2 default=ignore] pam_unix.so nullok_secure auth [success=1 default=ignore] pam_sss.so use_first_pass # here's the fallback if no module succeeds auth requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around auth required pam_permit.so # and here are more per-package modules (the "Additional" block) auth optional pam_mount.so # end of pam-auth-update config

Ignore Space Show notes View

environments/production/modules/bootstrap/files/authentication/etc/pam.d/common-auth 0 → 100644

### MANAGED BY PUPPET (base-configuration::user_session)

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the
# traditional Unix authentication mechanisms.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
auth	[success=2 default=ignore]	pam_unix.so nullok_secure
auth	[success=1 default=ignore]	pam_sss.so use_first_pass
# here's the fallback if no module succeeds
auth	requisite			pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth	required			pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth	optional	pam_mount.so
# end of pam-auth-update config

Ignore Space Show notes View environments/production/modules/bootstrap/files/authentication/etc/pam.d/common-password 0 → 100644
### MANAGED BY PUPPET (base-configuration::user_session) # # /etc/pam.d/common-password - password-related modules common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of modules that define the services to be # used to change user passwords. The default is pam_unix. # Explanation of pam_unix options: # # The "sha512" option enables salted SHA512 passwords. Without this option, # the default is Unix crypt. Prior releases used the option "md5". # # The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in # login.defs. # # See the pam_unix manpage for other options. # As of pam 1.0.1-6, this file is managed by pam-auth-update by default. # To take advantage of this, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details. # here are the per-package modules (the "Primary" block) password [success=2 default=ignore] pam_unix.so obscure sha512 password sufficient pam_sss.so use_authtok # here's the fallback if no module succeeds password requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around password required pam_permit.so # and here are more per-package modules (the "Additional" block) password optional pam_mount.so disable_interactive password optional pam_gnome_keyring.so # end of pam-auth-update config

Ignore Space Show notes View

environments/production/modules/bootstrap/files/authentication/etc/pam.d/common-password 0 → 100644

### MANAGED BY PUPPET (base-configuration::user_session)
#
# /etc/pam.d/common-password - password-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define the services to be
# used to change user passwords.  The default is pam_unix.

# Explanation of pam_unix options:
#
# The "sha512" option enables salted SHA512 passwords.  Without this option,
# the default is Unix crypt.  Prior releases used the option "md5".
#
# The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in
# login.defs.
#
# See the pam_unix manpage for other options.

# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
password	[success=2 default=ignore]	pam_unix.so obscure sha512
password	sufficient			pam_sss.so use_authtok
# here's the fallback if no module succeeds
password	requisite			pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
password	required			pam_permit.so
# and here are more per-package modules (the "Additional" block)
password	optional	pam_mount.so disable_interactive
password	optional	pam_gnome_keyring.so 
# end of pam-auth-update config

Ignore Space Show notes View environments/production/modules/bootstrap/files/authentication/etc/pam.d/common-session 0 → 100644
### MANAGED BY PUPPET (base-configuration::user_session) # # /etc/pam.d/common-session - session-related modules common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of modules that define tasks to be performed # at the start and end of sessions of any kind (both interactive and # non-interactive). # # As of pam 1.0.1-6, this file is managed by pam-auth-update by default. # To take advantage of this, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details. # here are the per-package modules (the "Primary" block) session [default=1] pam_permit.so # here's the fallback if no module succeeds session requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around session required pam_permit.so # The pam_umask module will set the umask according to the system default in # /etc/login.defs and user settings, solving the problem of different # umask settings with different shells, display managers, remote sessions etc. # See "man pam_umask". session optional pam_umask.so # and here are more per-package modules (the "Additional" block) session required pam_unix.so session optional pam_sss.so session optional pam_mount.so session optional pam_systemd.so # end of pam-auth-update config

Ignore Space Show notes View

environments/production/modules/bootstrap/files/authentication/etc/pam.d/common-session 0 → 100644

### MANAGED BY PUPPET (base-configuration::user_session)
#
# /etc/pam.d/common-session - session-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define tasks to be performed
# at the start and end of sessions of *any* kind (both interactive and
# non-interactive).
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
session	[default=1]			pam_permit.so
# here's the fallback if no module succeeds
session	requisite			pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session	required			pam_permit.so
# The pam_umask module will set the umask according to the system default in
# /etc/login.defs and user settings, solving the problem of different
# umask settings with different shells, display managers, remote sessions etc.
# See "man pam_umask".
session optional			pam_umask.so
# and here are more per-package modules (the "Additional" block)
session	required	pam_unix.so
session	optional	pam_sss.so
session	optional	pam_mount.so
session	optional	pam_systemd.so
# end of pam-auth-update config

Ignore Space Show notes View environments/production/modules/bootstrap/files/authentication/etc/security/pam_mount.conf.xml 0 → 100644
<!-- MANAGED BY PUPPET (base-configuration::user_session) --> <!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd"> <pam_mount> <debug enable="0" /> <volume fstype="cifs" server="storage.hcs-p01.otago.ac.nz" path="infosci-lab/linux/2020_S1/%(USER)" mountpoint="/home/%(USER)" options="vers=3.0,domain=STUDENT,user=%(USER),exec,mfsymlinks,nobrl,cache=loose" > <and><not><user>infoadmin</user></not><not><user>root</user></not></and> </volume> <mntoptions require="nosuid,nodev" /> <logout wait="5" term="yes" kill="yes" /> <mkmountpoint enable="1" remove="true" /> </pam_mount>

Ignore Space Show notes View

environments/production/modules/bootstrap/files/authentication/etc/security/pam_mount.conf.xml 0 → 100644

Ignore Space Show notes View environments/production/modules/bootstrap/manifests/domain_configuration.pp
### Everything needed to join the STUDENT domain class bootstrap::domain_configuration { package { [ 'realmd', 'sssd', 'sssd-tools', 'libnss-sss', 'libpam-sss', 'krb5-user', 'adcli', 'samba-common-bin' 'cifs-utils', 'keyutils', 'smbclient', 'libpam-mount' ] : ensure => 'installed' } ### mount some filesystems as tmpfs mount { '/tmp' : ensure => 'present', device => 'none', atboot => 'true', fstype => 'tmpfs' } mount { '/home' : ensure => 'present', device => 'none', atboot => 'true', fstype => 'tmpfs' } file { '/etc/systemd/resolved.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/systemd/resolved.conf', ensure => 'present', } file { '/etc/systemd/timesyncd.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/systemd/timesyncd.conf', ensure => 'present', } file { '/etc/krb5.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/krb5.conf', ensure => 'present', require => Package['krb5-user'] } file { '/etc/sssd/sssd.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/sssd/sssd.conf', ensure => 'present', mode => '0600', require => Package['sssd'], } file { '/etc/realmd.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/realmd.conf', ensure => 'present', } file { '/etc/security/pam_mount.conf.xml' : ensure => present, source => 'puppet:///modules/bootstrap/authentication/etc/security/pam_mount.conf.xml', require => Package['libpam-mount'] } file { '/etc/pam.d/common-session' : ensure => 'present', source => 'puppet:///modules/bootstrap/authentication/etc/pam.d/common-session', require => Package['libpam-mount'] } file { '/etc/pam.d/common-auth' : ensure => 'present', source => 'puppet:///modules/bootstrap/authentication/etc/pam.d/common-auth', require => Package['libpam-mount'] } file { '/etc/pam.d/common-account' : ensure => 'present', source => 'puppet:///modules/bootstrap/authentication/etc/pam.d/common-account', require => Package['libpam-mount'] } file { '/etc/pam.d/common-password' : ensure => 'present', source => 'puppet:///modules/bootstrap/authentication/etc/pam.d/common-password', require => Package['libpam-mount'] } file { '/local-home' : ensure => 'directory', mode => '0755' } # make sure the home dir exists file { '/local-home/infoadmin' : ensure => 'directory', owner => 'infoadmin', mode => '0700', require => File['/local-home'] } user { 'infoadmin' : ensure => 'present', home => '/local-home/infoadmin', require => File['/local-home/infoadmin'] } group { 'student' : ensure => 'present', forcelocal => 'true', gid => '1277200513' } } ### Everything needed to join the STUDENT domain class bootstrap::domain_configuration { package { 'realmd' : ensure => installed } package { 'sssd' : ensure => installed } package { 'sssd-tools' : ensure => installed } package { 'libnss-sss' : ensure => installed } package { 'libpam-sss' : ensure => installed } package { 'krb5-user' : ensure => installed } package { 'adcli' : ensure => installed } package { 'samba-common-bin' : ensure => installed } package { 'keyutils' : ensure => installed } file { '/etc/systemd/resolved.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/systemd/resolved.conf', ensure => 'present', } file { '/etc/systemd/timesyncd.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/systemd/timesyncd.conf', ensure => 'present', } file { '/etc/krb5.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/krb5.conf', ensure => 'present', } file { '/etc/sssd/sssd.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/sssd/sssd.conf', ensure => 'present', mode => '0600', require => Package['sssd'], } file { '/etc/realmd.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/realmd.conf', ensure => 'present', } }

Ignore Space Show notes View

environments/production/modules/bootstrap/manifests/domain_configuration.pp

### Everything needed to join the STUDENT domain

class bootstrap::domain_configuration {

package { [
			'realmd',
			'sssd',
			'sssd-tools',
			'libnss-sss',
			'libpam-sss',
			'krb5-user',
			'adcli',
			'samba-common-bin'
			'cifs-utils',
			'keyutils',
			'smbclient',
			'libpam-mount'
		] :
		ensure => 'installed'
	}

### mount some filesystems as tmpfs

mount { '/tmp' :
		ensure => 'present',
		device => 'none',
		atboot => 'true',
		fstype => 'tmpfs'
	}

mount { '/home' :
		ensure => 'present',
		device => 'none',
		atboot => 'true',
		fstype => 'tmpfs'
	}

file { '/etc/systemd/resolved.conf' :
		source => 'puppet:///modules/bootstrap/authentication/etc/systemd/resolved.conf',
		ensure => 'present',
	}

file { '/etc/systemd/timesyncd.conf' :
		source => 'puppet:///modules/bootstrap/authentication/etc/systemd/timesyncd.conf',
		ensure => 'present',
	}

file { '/etc/krb5.conf' :
		source  => 'puppet:///modules/bootstrap/authentication/etc/krb5.conf',
		ensure  => 'present',
		require => Package['krb5-user']
	}

file { '/etc/sssd/sssd.conf' :
		source => 'puppet:///modules/bootstrap/authentication/etc/sssd/sssd.conf',
		ensure => 'present',
		mode => '0600',
		require => Package['sssd'],
	}

file { '/etc/realmd.conf' :
		source => 'puppet:///modules/bootstrap/authentication/etc/realmd.conf',
		ensure => 'present',
	}

file { '/etc/security/pam_mount.conf.xml' :
		ensure  => present,
		source  =>  'puppet:///modules/bootstrap/authentication/etc/security/pam_mount.conf.xml',
		require => Package['libpam-mount']
	}

file { '/etc/pam.d/common-session' :
		ensure => 'present',
		source => 'puppet:///modules/bootstrap/authentication/etc/pam.d/common-session',
		require => Package['libpam-mount']
	}

file { '/etc/pam.d/common-auth' :
		ensure => 'present',
		source => 'puppet:///modules/bootstrap/authentication/etc/pam.d/common-auth',
		require => Package['libpam-mount']
	}

file { '/etc/pam.d/common-account' :
		ensure => 'present',
		source => 'puppet:///modules/bootstrap/authentication/etc/pam.d/common-account',
		require => Package['libpam-mount']
	}

file { '/etc/pam.d/common-password' :
		ensure => 'present',
		source => 'puppet:///modules/bootstrap/authentication/etc/pam.d/common-password',
		require => Package['libpam-mount']
	}

file { '/local-home' :
		ensure => 'directory',
		mode => '0755'
	}

# make sure the home dir exists
	file { '/local-home/infoadmin' :
		ensure => 'directory',
		owner => 'infoadmin',
		mode => '0700',
		require => File['/local-home']
	}

user { 'infoadmin' :
		ensure => 'present',
		home => '/local-home/infoadmin',
		require => File['/local-home/infoadmin']
	}

group { 'student' :
		ensure => 'present',
		forcelocal => 'true',
		gid => '1277200513'
	}
}

### Everything needed to join the STUDENT domain

class bootstrap::domain_configuration {

package { 'realmd' : ensure => installed }
	package { 'sssd' : ensure => installed }
	package { 'sssd-tools' : ensure => installed }
	package { 'libnss-sss' : ensure => installed }
	package { 'libpam-sss' : ensure => installed }
	package { 'krb5-user' : ensure => installed }
	package { 'adcli' : ensure => installed }
	package { 'samba-common-bin' : ensure => installed }
	package { 'keyutils' : ensure => installed }

file { '/etc/systemd/resolved.conf' :
		source => 'puppet:///modules/bootstrap/authentication/etc/systemd/resolved.conf',
		ensure => 'present',
	}

file { '/etc/systemd/timesyncd.conf' :
		source => 'puppet:///modules/bootstrap/authentication/etc/systemd/timesyncd.conf',
		ensure => 'present',
	}

file { '/etc/krb5.conf' :
		source  => 'puppet:///modules/bootstrap/authentication/etc/krb5.conf',
		ensure  => 'present',
	}

file { '/etc/sssd/sssd.conf' :
		source => 'puppet:///modules/bootstrap/authentication/etc/sssd/sssd.conf',
		ensure => 'present',
		mode => '0600',
		require => Package['sssd'],
	}

file { '/etc/realmd.conf' :
		source => 'puppet:///modules/bootstrap/authentication/etc/realmd.conf',
		ensure => 'present',
	}

}

Show line notes below