Finalise

linux_lab / bootstrap

Browse code Finalise master
1 parent b0146a3 commit e0e609ac53e9b8f9190103668d5ee36a9f6830ac Mark George authored on 23 Feb 2021

Patch

Showing 14 changed files

Ignore Space Show notes View bootstrap.sh
#!/usr/bin/env bash # Author: MG BASE_PATH=$(pwd) CURRENT_USER=$(whoami) if [[ ${CURRENT_USER} != root ]]; then echo "You need to run this script as root. Aborting." exit fi cd /tmp echo "## Purging annoying crap... ##" snap remove lxd snap remove core18 apt purge cloud-init apt autopurge echo "## Cloning bootstrap repo ##" git clone https://isgb.otago.ac.nz/infosci/git/linux_lab/bootstrap.git cd bootstrap echo echo -n "Enter hostname: " read hostname echo ${hostname} echo echo "About to set hostname to ${hostname} and run bootstrap." echo "Press Enter to continue or Ctrl+c to abort" read echo echo "## Setting hostname to ${hostname} ... ##" hostnamectl set-hostname ${hostname} echo echo "## Running bootstrap via puppet... ##" PUPPET_ROOT=/tmp/bootstrap/environments/production MODULE_PATH=${PUPPET_ROOT}/modules SITE_PATH=${PUPPET_ROOT}/manifests/site.pp RUBYOPT='-W0' puppet apply --modulepath ${MODULE_PATH} ${SITE_PATH} echo echo "## Cleaning up... ##" cd .. rm -rf /tmp/bootstrap echo echo "## Done. ##" exit user=$(sed -n 1p ${BASE_PATH}/domain_sekrit) domain=$(sed -n 2p ${BASE_PATH}/domain_sekrit) pass=$(sed -n 3p ${BASE_PATH}/domain_sekrit) echo echo "## Leaving domain... ##" echo ${pass} \| realm leave --verbose --user=${user} ${domain} echo echo "## Joining domain... ##" echo ${pass} \| realm join --verbose --user=${user} ${domain} echo #echo "## Running bootstrap via puppet again (to correct changes made as a result of domain join) ... ##" # RUBYOPT='-W0' puppet apply --modulepath ${MODULE_PATH} ${SITE_PATH} echo echo "## Cleaning up... ##" #cd .. #rm -rf /tmp/bootstrap echo echo "## Done. ##" #!/usr/bin/env bash # Author: MG BASE_PATH=$(pwd) CURRENT_USER=$(whoami) if [[ ${CURRENT_USER} != root ]]; then echo "You need to run this script as root. Aborting." exit fi cd /tmp echo "## Cloning bootstrap repo ##" git clone https://isgb.otago.ac.nz/infosci/git/linux_lab/bootstrap.git cd bootstrap echo echo -n "Enter hostname: " read hostname echo ${hostname} echo echo "About to join domain as ${hostname}" echo "Press Enter to continue or Ctrl+c to abort" read echo echo "## Setting hostname to ${hostname} ... ##" hostnamectl set-hostname ${hostname} echo echo "## Running bootstrap via puppet... ##" PUPPET_ROOT=/tmp/bootstrap/environments/production MODULE_PATH=${PUPPET_ROOT}/modules SITE_PATH=${PUPPET_ROOT}/manifests/site.pp RUBYOPT='-W0' puppet apply --modulepath ${MODULE_PATH} ${SITE_PATH} user=$(sed -n 1p ${BASE_PATH}/domain_sekrit) domain=$(sed -n 2p ${BASE_PATH}/domain_sekrit) pass=$(sed -n 3p ${BASE_PATH}/domain_sekrit) echo echo "## Leaving domain... ##" echo ${pass} \| realm leave --verbose --user=${user} ${domain} echo echo "## Joining domain... ##" echo ${pass} \| realm join --verbose --user=${user} ${domain} echo echo "## Running bootstrap via puppet again (to correct changes made as a result of domain join) ... ##" RUBYOPT='-W0' puppet apply --modulepath ${MODULE_PATH} ${SITE_PATH} echo echo "## Cleaning up... ##" cd .. rm -rf /tmp/bootstrap echo echo "## Done. ##"

Ignore Space Show notes View

bootstrap.sh

#!/usr/bin/env bash

# Author: MG

BASE_PATH=$(pwd)

CURRENT_USER=$(whoami)

if [[ ${CURRENT_USER} != root ]];
then
	echo "You need to run this script as root. Aborting."
	exit
fi

cd /tmp

echo "## Purging annoying crap... ##"

snap remove lxd
snap remove core18
apt purge cloud-init
apt autopurge

echo "## Cloning bootstrap repo ##"
git clone https://isgb.otago.ac.nz/infosci/git/linux_lab/bootstrap.git

cd bootstrap

echo
echo -n "Enter hostname: "
read hostname
echo ${hostname}

echo
echo "About to set hostname to ${hostname} and run bootstrap."

echo "Press Enter to continue or Ctrl+c to abort"

read

echo
echo "## Setting hostname to ${hostname} ... ##"
hostnamectl set-hostname ${hostname}

echo
echo "## Running bootstrap via puppet... ##"
PUPPET_ROOT=/tmp/bootstrap/environments/production
MODULE_PATH=${PUPPET_ROOT}/modules
SITE_PATH=${PUPPET_ROOT}/manifests/site.pp

RUBYOPT='-W0' puppet apply --modulepath ${MODULE_PATH} ${SITE_PATH}

echo
echo "## Cleaning up... ##"

cd ..
rm -rf /tmp/bootstrap

echo
echo "## Done. ##"

exit

user=$(sed -n 1p ${BASE_PATH}/domain_sekrit)
domain=$(sed -n 2p ${BASE_PATH}/domain_sekrit)
pass=$(sed -n 3p ${BASE_PATH}/domain_sekrit)

echo
echo "## Leaving domain... ##"
echo ${pass} | realm leave --verbose --user=${user} ${domain}

echo
echo "## Joining domain... ##"
echo ${pass} | realm join --verbose --user=${user} ${domain}

echo
#echo "## Running bootstrap via puppet again (to correct changes made as a result of domain join) ... ##"
# RUBYOPT='-W0' puppet apply --modulepath ${MODULE_PATH} ${SITE_PATH}

echo
echo "## Cleaning up... ##"

#cd ..
#rm -rf /tmp/bootstrap

echo
echo "## Done. ##"

#!/usr/bin/env bash

# Author: MG

BASE_PATH=$(pwd)

CURRENT_USER=$(whoami)

if [[ ${CURRENT_USER} != root ]];
then
	echo "You need to run this script as root. Aborting."
	exit
fi

cd /tmp

echo "## Cloning bootstrap repo ##"
git clone https://isgb.otago.ac.nz/infosci/git/linux_lab/bootstrap.git

cd bootstrap

echo
echo -n "Enter hostname: "
read hostname
echo ${hostname}

echo
echo "About to join domain as ${hostname}"

echo "Press Enter to continue or Ctrl+c to abort"

read

echo
echo "## Setting hostname to ${hostname} ... ##"
hostnamectl set-hostname ${hostname}

echo
echo "## Running bootstrap via puppet... ##"
PUPPET_ROOT=/tmp/bootstrap/environments/production
MODULE_PATH=${PUPPET_ROOT}/modules
SITE_PATH=${PUPPET_ROOT}/manifests/site.pp

RUBYOPT='-W0' puppet apply --modulepath ${MODULE_PATH} ${SITE_PATH}

user=$(sed -n 1p ${BASE_PATH}/domain_sekrit)
domain=$(sed -n 2p ${BASE_PATH}/domain_sekrit)
pass=$(sed -n 3p ${BASE_PATH}/domain_sekrit)

echo
echo "## Leaving domain... ##"
echo ${pass} | realm leave --verbose --user=${user} ${domain}

echo
echo "## Joining domain... ##"
echo ${pass} | realm join --verbose --user=${user} ${domain}

echo
echo "## Running bootstrap via puppet again (to correct changes made as a result of domain join) ... ##"
RUBYOPT='-W0' puppet apply --modulepath ${MODULE_PATH} ${SITE_PATH}

echo
echo "## Cleaning up... ##"

cd ..
rm -rf /tmp/bootstrap

echo
echo "## Done. ##"

Ignore Space Show notes View environments/production/manifests/site.pp
File { mode => '0644', owner => 'root', group => 'root', backup => 'false' } node default { include bootstrap } #include apt # infosci-packages repository #apt::source { 'infosci_packages' : # ensure => 'present', # architecture => 'amd64', # location => 'http://sbis-puppet.uod.otago.ac.nz/infosci-packages', # release => 'bionic', # key => { # id => '14F3429313B01C17B76AB80A749166DCE8B8C41C', # source => 'http://sbis-puppet.uod.otago.ac.nz/infosci-packages/infosci-packages.key' # } #} #file { 'Puppet Deployment Directory' : # ensure => directory, # path => '/usr/local/puppet-deploy' #} # #-> file { 'Puppet Lock Directory' : # ensure => directory, # path => '/usr/local/puppet-deploy/locks' #} # File defaults File { mode => '0644', owner => 'root', group => 'root', backup => 'false' } ### Node definitions node default { include bootstrap # include base_configuration # include teaching_software # include hoao }

Ignore Space Show notes View

environments/production/manifests/site.pp

Show notes View environments/production/modules/bootstrap/files/authentication/etc/krb5.conf 100644 → 0
### MANAGED BY PUPPET (base-configuration::authentication) [libdefaults] default_realm = STUDENT.OTAGO.AC.NZ dns_lookup_realm = true dns_lookup_kdc = true

Show notes View environments/production/modules/bootstrap/files/authentication/etc/pam.d/common-account 100644 → 0
### MANAGED BY PUPPET (base-configuration::user_session) # # /etc/pam.d/common-account - authorization settings common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of the authorization modules that define # the central access policy for use on the system. The default is to # only deny service to users whose accounts are expired in /etc/shadow. # # As of pam 1.0.1-6, this file is managed by pam-auth-update by default. # To take advantage of this, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details. # # here are the per-package modules (the "Primary" block) account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so # here's the fallback if no module succeeds account requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around account required pam_permit.so # and here are more per-package modules (the "Additional" block) account sufficient pam_localuser.so account [default=bad success=ok user_unknown=ignore] pam_sss.so # end of pam-auth-update config

Show notes View

environments/production/modules/bootstrap/files/authentication/etc/pam.d/common-account 100644 → 0

### MANAGED BY PUPPET (base-configuration::user_session)
#
# /etc/pam.d/common-account - authorization settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authorization modules that define
# the central access policy for use on the system.  The default is to
# only deny service to users whose accounts are expired in /etc/shadow.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.
#

# here are the per-package modules (the "Primary" block)
account	[success=1 new_authtok_reqd=done default=ignore]	pam_unix.so
# here's the fallback if no module succeeds
account	requisite			pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
account	required			pam_permit.so
# and here are more per-package modules (the "Additional" block)
account	sufficient		pam_localuser.so
account	[default=bad success=ok user_unknown=ignore]	pam_sss.so
# end of pam-auth-update config

Show notes View environments/production/modules/bootstrap/files/authentication/etc/pam.d/common-auth 100644 → 0
### MANAGED BY PUPPET (base-configuration::user_session) # # /etc/pam.d/common-auth - authentication settings common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of the authentication modules that define # the central authentication scheme for use on the system # (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the # traditional Unix authentication mechanisms. # # As of pam 1.0.1-6, this file is managed by pam-auth-update by default. # To take advantage of this, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details. # here are the per-package modules (the "Primary" block) auth [success=2 default=ignore] pam_unix.so nullok_secure auth [success=1 default=ignore] pam_sss.so use_first_pass # here's the fallback if no module succeeds auth requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around auth required pam_permit.so # and here are more per-package modules (the "Additional" block) auth optional pam_mount.so # end of pam-auth-update config

Show notes View

environments/production/modules/bootstrap/files/authentication/etc/pam.d/common-auth 100644 → 0

### MANAGED BY PUPPET (base-configuration::user_session)

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the
# traditional Unix authentication mechanisms.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
auth	[success=2 default=ignore]	pam_unix.so nullok_secure
auth	[success=1 default=ignore]	pam_sss.so use_first_pass
# here's the fallback if no module succeeds
auth	requisite			pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth	required			pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth	optional	pam_mount.so
# end of pam-auth-update config

Show notes View environments/production/modules/bootstrap/files/authentication/etc/pam.d/common-password 100644 → 0
### MANAGED BY PUPPET (base-configuration::user_session) # # /etc/pam.d/common-password - password-related modules common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of modules that define the services to be # used to change user passwords. The default is pam_unix. # Explanation of pam_unix options: # # The "sha512" option enables salted SHA512 passwords. Without this option, # the default is Unix crypt. Prior releases used the option "md5". # # The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in # login.defs. # # See the pam_unix manpage for other options. # As of pam 1.0.1-6, this file is managed by pam-auth-update by default. # To take advantage of this, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details. # here are the per-package modules (the "Primary" block) password [success=2 default=ignore] pam_unix.so obscure sha512 password sufficient pam_sss.so use_authtok # here's the fallback if no module succeeds password requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around password required pam_permit.so # and here are more per-package modules (the "Additional" block) password optional pam_mount.so disable_interactive password optional pam_gnome_keyring.so # end of pam-auth-update config

Show notes View

environments/production/modules/bootstrap/files/authentication/etc/pam.d/common-password 100644 → 0

### MANAGED BY PUPPET (base-configuration::user_session)
#
# /etc/pam.d/common-password - password-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define the services to be
# used to change user passwords.  The default is pam_unix.

# Explanation of pam_unix options:
#
# The "sha512" option enables salted SHA512 passwords.  Without this option,
# the default is Unix crypt.  Prior releases used the option "md5".
#
# The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in
# login.defs.
#
# See the pam_unix manpage for other options.

# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
password	[success=2 default=ignore]	pam_unix.so obscure sha512
password	sufficient			pam_sss.so use_authtok
# here's the fallback if no module succeeds
password	requisite			pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
password	required			pam_permit.so
# and here are more per-package modules (the "Additional" block)
password	optional	pam_mount.so disable_interactive
password	optional	pam_gnome_keyring.so 
# end of pam-auth-update config

Show notes View environments/production/modules/bootstrap/files/authentication/etc/pam.d/common-session 100644 → 0
### MANAGED BY PUPPET (base-configuration::user_session) # # /etc/pam.d/common-session - session-related modules common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of modules that define tasks to be performed # at the start and end of sessions of any kind (both interactive and # non-interactive). # # As of pam 1.0.1-6, this file is managed by pam-auth-update by default. # To take advantage of this, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details. # here are the per-package modules (the "Primary" block) session [default=1] pam_permit.so # here's the fallback if no module succeeds session requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around session required pam_permit.so # The pam_umask module will set the umask according to the system default in # /etc/login.defs and user settings, solving the problem of different # umask settings with different shells, display managers, remote sessions etc. # See "man pam_umask". session optional pam_umask.so # and here are more per-package modules (the "Additional" block) session required pam_unix.so session optional pam_sss.so session optional pam_mount.so session optional pam_systemd.so # end of pam-auth-update config

Show notes View

environments/production/modules/bootstrap/files/authentication/etc/pam.d/common-session 100644 → 0

### MANAGED BY PUPPET (base-configuration::user_session)
#
# /etc/pam.d/common-session - session-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define tasks to be performed
# at the start and end of sessions of *any* kind (both interactive and
# non-interactive).
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
session	[default=1]			pam_permit.so
# here's the fallback if no module succeeds
session	requisite			pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session	required			pam_permit.so
# The pam_umask module will set the umask according to the system default in
# /etc/login.defs and user settings, solving the problem of different
# umask settings with different shells, display managers, remote sessions etc.
# See "man pam_umask".
session optional			pam_umask.so
# and here are more per-package modules (the "Additional" block)
session	required	pam_unix.so
session	optional	pam_sss.so
session	optional	pam_mount.so
session	optional	pam_systemd.so
# end of pam-auth-update config

Show notes View environments/production/modules/bootstrap/files/authentication/etc/realmd.conf 100644 → 0
### MANAGED BY PUPPET (base-configuration::authentication) [users] default-home = /home/%U default-shell = /bin/bash [active-directory] default-client = sssd os-name = Ubuntu Desktop os-version = 20.04 [service] # disable package-kit installs automatic-install = no [student.otago.ac.nz] # don't require fully qualified usernames fully-qualified-names = no automatic-id-mapping = yes # don't use domain policy for authorisation manage-system = no

Show notes View

environments/production/modules/bootstrap/files/authentication/etc/realmd.conf 100644 → 0

Show notes View environments/production/modules/bootstrap/files/authentication/etc/security/pam_mount.conf.xml 100644 → 0
<!-- MANAGED BY PUPPET (base-configuration::user_session) --> <!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd"> <pam_mount> <debug enable="0" /> <volume fstype="cifs" server="storage.hcs-p01.otago.ac.nz" path="infosci-lab/linux/2020_S1/%(USER)" mountpoint="/home/%(USER)" options="vers=3.0,domain=STUDENT,user=%(USER),exec,mfsymlinks,nobrl,cache=loose" > <and><not><user>infoadmin</user></not><not><user>root</user></not></and> </volume> <mntoptions require="nosuid,nodev" /> <logout wait="5" term="yes" kill="yes" /> <mkmountpoint enable="1" remove="true" /> </pam_mount>

Show notes View

environments/production/modules/bootstrap/files/authentication/etc/security/pam_mount.conf.xml 100644 → 0

Show notes View environments/production/modules/bootstrap/files/authentication/etc/sssd/sssd.conf 100644 → 0
### MANAGED BY PUPPET (base-configuration::authentication) [sssd] domains = student.otago.ac.nz config_file_version = 2 services = nss, pam [domain/student.otago.ac.nz] ad_domain = student.otago.ac.nz krb5_realm = STUDENT.OTAGO.AC.NZ realmd_tags = joined-with-adcli cache_credentials = True id_provider = ad krb5_store_password_if_offline = True ldap_id_mapping = True default_shell = /bin/bash # the following worked for 18.04 LTS, but not 20.04 LTS #fallback_homedir = /home/%u # the following does work in 20.04 LTS override_homedir = /home/%u # use simple names rather than student@student.otago.ac.nz use_fully_qualified_names = False # create private groups for users auto_private_groups = True # only retrieve the "domain user" group (the rest are useless to us) ldap_use_tokengroups = False ldap_group_search_base = CN=Users,DC=win,DC=trust,DC=test?sub?(\|(cn=domain users)) # don't manage sudo via SSSD sudo_provider = None # the following significantly speeds up login (we don't need to validate group memberships) ignore_group_members = True

Show notes View

environments/production/modules/bootstrap/files/authentication/etc/sssd/sssd.conf 100644 → 0

### MANAGED BY PUPPET (base-configuration::authentication)

[sssd]
domains = student.otago.ac.nz
config_file_version = 2
services = nss, pam

[domain/student.otago.ac.nz]
ad_domain = student.otago.ac.nz
krb5_realm = STUDENT.OTAGO.AC.NZ
realmd_tags = joined-with-adcli 
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
ldap_id_mapping = True
default_shell = /bin/bash

# the following worked for 18.04 LTS, but not 20.04 LTS
#fallback_homedir = /home/%u

# the following does work in 20.04 LTS
override_homedir = /home/%u

# use simple names rather than student@student.otago.ac.nz
use_fully_qualified_names = False

# create private groups for users
auto_private_groups = True

# only retrieve the "domain user" group (the rest are useless to us)
ldap_use_tokengroups = False
ldap_group_search_base = CN=Users,DC=win,DC=trust,DC=test?sub?(|(cn=domain users))

# don't manage sudo via SSSD
sudo_provider = None

# the following *significantly* speeds up login (we don't need to validate group memberships)
ignore_group_members = True

Show notes View environments/production/modules/bootstrap/files/authentication/etc/systemd/resolved.conf 100644 → 0
### MANAGED BY PUPPET (base-configuration::authentication) [Resolve] DNS=10.64.0.112 10.64.0.232 Domains=staff.uod.otago.ac.nz uod.otago.ac.nz otago.ac.nz Cache=yes

Show notes View environments/production/modules/bootstrap/files/authentication/etc/systemd/timesyncd.conf 100644 → 0
### MANAGED BY PUPPET (base-configuration::authentication) [Time] NTP=student.otago.ac.nz

Show notes View environments/production/modules/bootstrap/manifests/domain_configuration.pp 100644 → 0
### Everything needed to join the STUDENT domain class bootstrap::domain_configuration { package { [ 'realmd', 'sssd-ad', 'sssd-tools', 'libnss-sss', 'libpam-sss', 'krb5-user', 'adcli', 'samba-common-bin', 'cifs-utils', 'keyutils', 'smbclient', 'libpam-mount' ] : ensure => 'installed' } ### mount some filesystems as tmpfs mount { '/tmp' : ensure => 'present', device => 'none', atboot => 'true', fstype => 'tmpfs' } mount { '/home' : ensure => 'present', device => 'none', atboot => 'true', fstype => 'tmpfs' } file { '/etc/systemd/resolved.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/systemd/resolved.conf', ensure => 'present', } file { '/etc/systemd/timesyncd.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/systemd/timesyncd.conf', ensure => 'present', } file { '/etc/krb5.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/krb5.conf', ensure => 'present', require => Package['krb5-user'] } file { '/etc/sssd/sssd.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/sssd/sssd.conf', ensure => 'present', mode => '0600', require => Package['sssd'], } file { '/etc/realmd.conf' : source => 'puppet:///modules/bootstrap/authentication/etc/realmd.conf', ensure => 'present', } file { '/etc/security/pam_mount.conf.xml' : ensure => present, source => 'puppet:///modules/bootstrap/authentication/etc/security/pam_mount.conf.xml', require => Package['libpam-mount'] } file { '/etc/pam.d/common-session' : ensure => 'present', source => 'puppet:///modules/bootstrap/authentication/etc/pam.d/common-session', require => Package['libpam-mount'] } file { '/etc/pam.d/common-auth' : ensure => 'present', source => 'puppet:///modules/bootstrap/authentication/etc/pam.d/common-auth', require => Package['libpam-mount'] } file { '/etc/pam.d/common-account' : ensure => 'present', source => 'puppet:///modules/bootstrap/authentication/etc/pam.d/common-account', require => Package['libpam-mount'] } file { '/etc/pam.d/common-password' : ensure => 'present', source => 'puppet:///modules/bootstrap/authentication/etc/pam.d/common-password', require => Package['libpam-mount'] } file { '/local-home' : ensure => 'directory', mode => '0755' } # make sure the home dir exists file { '/local-home/infoadmin' : ensure => 'directory', owner => 'infoadmin', mode => '0700', require => File['/local-home'] } user { 'infoadmin' : ensure => 'present', home => '/local-home/infoadmin', require => File['/local-home/infoadmin'] } group { 'student' : ensure => 'present', forcelocal => 'true', gid => '1277200513' } }

Show notes View

environments/production/modules/bootstrap/manifests/domain_configuration.pp 100644 → 0

### Everything needed to join the STUDENT domain

class bootstrap::domain_configuration {

package { [
			'realmd',
			'sssd-ad',
			'sssd-tools',
			'libnss-sss',
			'libpam-sss',
			'krb5-user',
			'adcli',
			'samba-common-bin',
			'cifs-utils',
			'keyutils',
			'smbclient',
			'libpam-mount'
		] :
		ensure => 'installed'
	}

### mount some filesystems as tmpfs

mount { '/tmp' :
		ensure => 'present',
		device => 'none',
		atboot => 'true',
		fstype => 'tmpfs'
	}

mount { '/home' :
		ensure => 'present',
		device => 'none',
		atboot => 'true',
		fstype => 'tmpfs'
	}

file { '/etc/systemd/resolved.conf' :
		source => 'puppet:///modules/bootstrap/authentication/etc/systemd/resolved.conf',
		ensure => 'present',
	}

file { '/etc/systemd/timesyncd.conf' :
		source => 'puppet:///modules/bootstrap/authentication/etc/systemd/timesyncd.conf',
		ensure => 'present',
	}

file { '/etc/krb5.conf' :
		source  => 'puppet:///modules/bootstrap/authentication/etc/krb5.conf',
		ensure  => 'present',
		require => Package['krb5-user']
	}

file { '/etc/sssd/sssd.conf' :
		source => 'puppet:///modules/bootstrap/authentication/etc/sssd/sssd.conf',
		ensure => 'present',
		mode => '0600',
		require => Package['sssd'],
	}

file { '/etc/realmd.conf' :
		source => 'puppet:///modules/bootstrap/authentication/etc/realmd.conf',
		ensure => 'present',
	}

file { '/etc/security/pam_mount.conf.xml' :
		ensure  => present,
		source  =>  'puppet:///modules/bootstrap/authentication/etc/security/pam_mount.conf.xml',
		require => Package['libpam-mount']
	}

file { '/etc/pam.d/common-session' :
		ensure => 'present',
		source => 'puppet:///modules/bootstrap/authentication/etc/pam.d/common-session',
		require => Package['libpam-mount']
	}

file { '/etc/pam.d/common-auth' :
		ensure => 'present',
		source => 'puppet:///modules/bootstrap/authentication/etc/pam.d/common-auth',
		require => Package['libpam-mount']
	}

file { '/etc/pam.d/common-account' :
		ensure => 'present',
		source => 'puppet:///modules/bootstrap/authentication/etc/pam.d/common-account',
		require => Package['libpam-mount']
	}

file { '/etc/pam.d/common-password' :
		ensure => 'present',
		source => 'puppet:///modules/bootstrap/authentication/etc/pam.d/common-password',
		require => Package['libpam-mount']
	}

file { '/local-home' :
		ensure => 'directory',
		mode => '0755'
	}

# make sure the home dir exists
	file { '/local-home/infoadmin' :
		ensure => 'directory',
		owner => 'infoadmin',
		mode => '0700',
		require => File['/local-home']
	}

user { 'infoadmin' :
		ensure => 'present',
		home => '/local-home/infoadmin',
		require => File['/local-home/infoadmin']
	}

group { 'student' :
		ensure => 'present',
		forcelocal => 'true',
		gid => '1277200513'
	}
}

Ignore Space Show notes View environments/production/modules/bootstrap/manifests/init.pp
class bootstrap { include bootstrap::puppet_agent } ### Get the machine into a state where puppet can reliably take over the remainder of the installation ### ### This includes: ### * Configuring SSSD and realmd in preparation for joining the student domain (lots of stuff breaks if SSSD is only partially configured, so get this out of the way early) ### * Configuring the puppet agent class bootstrap { # include bootstrap::domain_configuration include bootstrap::puppet_agent }

Ignore Space Show notes View

environments/production/modules/bootstrap/manifests/init.pp

Show line notes below