Add keyutils, use override instead of fallback for homedir

linux_lab / bootstrap

Browse code Add keyutils, use override instead of fallback for homedir master
1 parent 3165cf1 commit d01ddf7fd06df88244e51bd0f59db17f26b2b630 Mark George authored on 18 Feb 2021

Patch

Showing 2 changed files

Ignore Space Show notes View environments/production/modules/bootstrap/files/authentication/etc/sssd/sssd.conf
### MANAGED BY PUPPET (base-configuration::authentication) [sssd] domains = student.otago.ac.nz config_file_version = 2 services = nss, pam [domain/student.otago.ac.nz] ad_domain = student.otago.ac.nz krb5_realm = STUDENT.OTAGO.AC.NZ realmd_tags = joined-with-adcli cache_credentials = True id_provider = ad krb5_store_password_if_offline = True ldap_id_mapping = True default_shell = /bin/bash # the following worked for 18.04 LTS, but not 20.04 LTS #fallback_homedir = /home/%u # the following does work in 20.04 LTS override_homedir = /home/%u # use simple names rather than student@student.otago.ac.nz use_fully_qualified_names = False # create private groups for users auto_private_groups = True # only retrieve the "domain user" group (the rest are useless to us) ldap_use_tokengroups = False ldap_group_search_base = CN=Users,DC=win,DC=trust,DC=test?sub?(\|(cn=domain users)) # don't manage sudo via SSSD sudo_provider = None # the following significantly speeds up login (we don't need to validate group memberships) ignore_group_members = True ### MANAGED BY PUPPET (base-configuration::authentication) [sssd] domains = student.otago.ac.nz config_file_version = 2 services = nss, pam [domain/student.otago.ac.nz] ad_domain = student.otago.ac.nz krb5_realm = STUDENT.OTAGO.AC.NZ realmd_tags = joined-with-adcli cache_credentials = True id_provider = ad krb5_store_password_if_offline = True default_shell = /bin/bash ldap_id_mapping = True use_fully_qualified_names = False fallback_homedir = /home/%u # create private groups for users auto_private_groups = True # only retrieve the "domain user" group (the rest are useless to us) ldap_use_tokengroups = False ldap_group_search_base = CN=Users,DC=win,DC=trust,DC=test?sub?(\|(cn=domain users)) # don't manage sudo via SSSD sudo_provider = None # the following significantly speeds up login (we don't need to validate group memberships) ignore_group_members = True

Ignore Space Show notes View

environments/production/modules/bootstrap/files/authentication/etc/sssd/sssd.conf

### MANAGED BY PUPPET (base-configuration::authentication)

[sssd]
domains = student.otago.ac.nz
config_file_version = 2
services = nss, pam

[domain/student.otago.ac.nz]
ad_domain = student.otago.ac.nz
krb5_realm = STUDENT.OTAGO.AC.NZ
realmd_tags = joined-with-adcli 
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
ldap_id_mapping = True
default_shell = /bin/bash

# the following worked for 18.04 LTS, but not 20.04 LTS
#fallback_homedir = /home/%u

# the following does work in 20.04 LTS
override_homedir = /home/%u

# use simple names rather than student@student.otago.ac.nz
use_fully_qualified_names = False

# create private groups for users
auto_private_groups = True

# only retrieve the "domain user" group (the rest are useless to us)
ldap_use_tokengroups = False
ldap_group_search_base = CN=Users,DC=win,DC=trust,DC=test?sub?(|(cn=domain users))

# don't manage sudo via SSSD
sudo_provider = None

# the following *significantly* speeds up login (we don't need to validate group memberships)
ignore_group_members = True

Ignore Space Show notes View environments/production/modules/bootstrap/manifests/domain_configuration.pp
### Everything needed to join the STUDENT domain class bootstrap::domain_configuration { package { 'realmd' : ensure => installed } package { 'sssd' : ensure => installed } package { 'sssd-tools' : ensure => installed } package { 'libnss-sss' : ensure => installed } package { 'libpam-sss' : ensure => installed } package { 'krb5-user' : ensure => installed } package { 'adcli' : ensure => installed } package { 'samba-common-bin' : ensure => installed } package { 'keyutils' : ensure => installed } file { '/etc/systemd/resolved.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/systemd/resolved.conf', ensure => 'present', } file { '/etc/systemd/timesyncd.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/systemd/timesyncd.conf', ensure => 'present', } file { '/etc/krb5.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/krb5.conf', ensure => 'present', } file { '/etc/sssd/sssd.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/sssd/sssd.conf', ensure => 'present', mode => '0600', require => Package['sssd'], } file { '/etc/realmd.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/realmd.conf', ensure => 'present', } } ### Everything needed to join the STUDENT domain class bootstrap::domain_configuration { package { 'realmd' : ensure => installed } package { 'sssd' : ensure => installed } package { 'sssd-tools' : ensure => installed } package { 'libnss-sss' : ensure => installed } package { 'libpam-sss' : ensure => installed } package { 'krb5-user' : ensure => installed } package { 'adcli' : ensure => installed } package { 'samba-common-bin' : ensure => installed } file { '/etc/systemd/resolved.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/systemd/resolved.conf', ensure => 'present', } file { '/etc/systemd/timesyncd.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/systemd/timesyncd.conf', ensure => 'present', } file { '/etc/krb5.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/krb5.conf', ensure => 'present', } file { '/etc/sssd/sssd.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/sssd/sssd.conf', ensure => 'present', mode => '0600', require => Package['sssd'], } file { '/etc/realmd.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/realmd.conf', ensure => 'present', } }

Ignore Space Show notes View

environments/production/modules/bootstrap/manifests/domain_configuration.pp

### Everything needed to join the STUDENT domain

class bootstrap::domain_configuration {

package { 'realmd' : ensure => installed }
	package { 'sssd' : ensure => installed }
	package { 'sssd-tools' : ensure => installed }
	package { 'libnss-sss' : ensure => installed }
	package { 'libpam-sss' : ensure => installed }
	package { 'krb5-user' : ensure => installed }
	package { 'adcli' : ensure => installed }
	package { 'samba-common-bin' : ensure => installed }
	package { 'keyutils' : ensure => installed }

file { '/etc/systemd/resolved.conf' :
		source => 'puppet:///modules/bootstrap/authentication/etc/systemd/resolved.conf',
		ensure => 'present',
	}

file { '/etc/systemd/timesyncd.conf' :
		source => 'puppet:///modules/bootstrap/authentication/etc/systemd/timesyncd.conf',
		ensure => 'present',
	}

file { '/etc/krb5.conf' :
		source  => 'puppet:///modules/bootstrap/authentication/etc/krb5.conf',
		ensure  => 'present',
	}

file { '/etc/sssd/sssd.conf' :
		source => 'puppet:///modules/bootstrap/authentication/etc/sssd/sssd.conf',
		ensure => 'present',
		mode => '0600',
		require => Package['sssd'],
	}

file { '/etc/realmd.conf' :
		source => 'puppet:///modules/bootstrap/authentication/etc/realmd.conf',
		ensure => 'present',
	}

}