From: Ismaƫl Bouya Date: Sat, 30 Jun 2018 16:07:45 +0000 (+0200) Subject: Merge branch 'dev' X-Git-Url: https://git.immae.eu/?a=commitdiff_plain;h=54460a893b4266d88fe23eb114a5b4e8a5b79077;hp=3c1e202cf136cb7fae2860d7608cc1d077953d0b;p=perso%2FImmae%2FProjets%2FPuppet.git Merge branch 'dev' --- diff --git a/.gitmodules b/.gitmodules index d68cf4e..f8ff2b7 100644 --- a/.gitmodules +++ b/.gitmodules @@ -67,3 +67,9 @@ [submodule "external_modules/patch"] path = external_modules/patch url = git://git.immae.eu/github/tohuwabohu/puppet-patch.git +[submodule "external_modules/augeasproviders_pam"] + path = external_modules/augeasproviders_pam + url = git://git.immae.eu/github/hercules-team/augeasproviders_pam.git +[submodule "external_modules/augeasproviders_core"] + path = external_modules/augeasproviders_core + url = git://git.immae.eu/github/hercules-team/augeasproviders_core.git diff --git a/external_modules/augeasproviders_core b/external_modules/augeasproviders_core new file mode 160000 index 0000000..604680c --- /dev/null +++ b/external_modules/augeasproviders_core @@ -0,0 +1 @@ +Subproject commit 604680cb5fe7e32fd1ad1051fc34ef100a4d6923 diff --git a/external_modules/augeasproviders_pam b/external_modules/augeasproviders_pam new file mode 160000 index 0000000..e207968 --- /dev/null +++ b/external_modules/augeasproviders_pam @@ -0,0 +1 @@ +Subproject commit e20796872f094c56a201519bab7716f099c78819 diff --git a/modules/base_installation/manifests/ldap.pp b/modules/base_installation/manifests/ldap.pp index 1825700..d5d871c 100644 --- a/modules/base_installation/manifests/ldap.pp +++ b/modules/base_installation/manifests/ldap.pp @@ -21,4 +21,47 @@ class base_installation::ldap inherits base_installation { require => File['/etc/openldap'], } + $password_seed = lookup("base_installation::puppet_pass_seed") + $ldap_server = lookup("base_installation::ldap_server") + $ldap_base = lookup("base_installation::ldap_base") + $ldap_dn = lookup("base_installation::ldap_dn") + $ldap_password = generate_password(24, $password_seed, "ldap") + $ldap_attribute = "uid" + + ensure_packages(["pam_ldap", "ruby-augeas"]) + file { "/etc/pam_ldap.conf": + ensure => "present", + mode => "0400", + owner => "root", + group => "root", + content => template("base_installation/ldap/pam_ldap.conf.erb"), + } + + ["system-auth", "passwd"].each |$service| { + pam { "Allow to change ldap password via $service": + ensure => present, + service => $service, + type => "password", + control => "[success=done new_authtok_reqd=ok ignore=ignore default=bad]", + module => "pam_ldap.so", + arguments => "ignore_unknown_user", + position => 'before *[type="password" and module="pam_unix.so"]', + require => Package["ruby-augeas"], + } + } + + ["system-auth", "su", "su-l"].each |$service| { + ["auth", "account"].each |$type| { + pam { "Allow $service to $type with ldap password": + ensure => present, + service => $service, + type => $type, + control => "[success=done new_authtok_reqd=ok ignore=ignore default=bad]", + module => "pam_ldap.so", + arguments => "ignore_unknown_user", + position => "before *[type=\"$type\" and module=\"pam_unix.so\"]", + require => Package["ruby-augeas"], + } + } + } } diff --git a/modules/base_installation/templates/ldap/pam_ldap.conf.erb b/modules/base_installation/templates/ldap/pam_ldap.conf.erb new file mode 100644 index 0000000..f07490a --- /dev/null +++ b/modules/base_installation/templates/ldap/pam_ldap.conf.erb @@ -0,0 +1,7 @@ +host <%= @ldap_server %> + +base <%= @ldap_base %> +binddn <%= @ldap_dn %> +bindpw <%= @ldap_password %> +pam_login_attribute <%= @ldap_attribute %> + diff --git a/modules/profile/manifests/apache.pp b/modules/profile/manifests/apache.pp index 382633b..7187350 100644 --- a/modules/profile/manifests/apache.pp +++ b/modules/profile/manifests/apache.pp @@ -4,6 +4,8 @@ class profile::apache { root_directory_options => ["All"], default_mods => false, default_vhost => false, + user => "http", + group => "http", log_formats => { combined => '%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %p', common => '%h %l %u %t \"%r\" %>s %b', diff --git a/modules/profile/manifests/redis.pp b/modules/profile/manifests/redis.pp index 79871b1..d912c59 100644 --- a/modules/profile/manifests/redis.pp +++ b/modules/profile/manifests/redis.pp @@ -17,9 +17,8 @@ class profile::redis { notify => Service["redis"], } - package { "ruby-augeas": - ensure => installed, - } -> + ensure_packages(["ruby-augeas"]) + class { '::redis': unixsocket => "/run/redis/redis.sock", unixsocketperm => "777", @@ -28,7 +27,10 @@ class profile::redis { config_file => "/etc/redis.conf", config_file_orig => "/etc/redis.conf.puppet", port => 0, - require => File["/etc/systemd/system/redis.service.d/socket_shutdown.conf"], + require => [ + File["/etc/systemd/system/redis.service.d/socket_shutdown.conf"], + Package["ruby-augeas"] + ] } }