From 1bb448839addbb1d66ee81141d21d08b1e925faf Mon Sep 17 00:00:00 2001 From: =?utf8?q?Isma=C3=ABl=20Bouya?= Date: Fri, 22 Feb 2019 21:09:52 +0100 Subject: [PATCH] Add ldap Fixes https://git.immae.eu/mantisbt/view.php?id=78 --- nixops/modules/databases/default.nix | 69 +++++++++++- nixops/modules/databases/immae.schema | 155 ++++++++++++++++++++++++++ 2 files changed, 223 insertions(+), 1 deletion(-) create mode 100644 nixops/modules/databases/immae.schema diff --git a/nixops/modules/databases/default.nix b/nixops/modules/databases/default.nix index 1115a29..1940b62 100644 --- a/nixops/modules/databases/default.nix +++ b/nixops/modules/databases/default.nix @@ -30,6 +30,15 @@ in { type = lib.types.bool; }; }; + + ldap = { + enable = lib.mkOption { + default = cfg.enable; + example = true; + description = "Whether to enable ldap"; + type = lib.types.bool; + }; + }; }; config = lib.mkIf cfg.enable { @@ -55,7 +64,7 @@ in { }); }; - networking.firewall.allowedTCPPorts = [ 3306 5432 ]; + networking.firewall.allowedTCPPorts = [ 3306 5432 636 389 ]; # for adminer, ssl is implemented with mysqli only, which is # currently disabled because it’s not compatible with pam. @@ -94,6 +103,16 @@ in { ''; }; + security.acme.certs."ldap" = config.services.myCertificates.certConfig // { + user = "openldap"; + group = "openldap"; + plugins = [ "fullchain.pem" "key.pem" "cert.pem" "account_key.json" ]; + domain = "ldap.immae.eu"; + postRun = '' + systemctl restart openldap.service + ''; + }; + system.activationScripts.postgresql = '' install -m 0755 -o postgres -g postgres -d ${myconfig.env.databases.postgresql.socket} ''; @@ -202,5 +221,53 @@ in { mkdir -p $(dirname ${myconfig.env.databases.redis.socket}) chown redis $(dirname ${myconfig.env.databases.redis.socket}) ''; + + services.openldap = let + kerberosSchema = pkgs.fetchurl { + url = "https://raw.githubusercontent.com/krb5/krb5/master/src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema"; + sha256 = "17fnkkf6s3lznsl7wp6914pqsc78d038rh38l638big8z608ksww"; + }; + puppetSchema = pkgs.fetchurl { + url = "https://raw.githubusercontent.com/puppetlabs/puppet/master/ext/ldap/puppet.schema"; + sha256 = "11bjf5zfvqlim7p9vddcafs0wiq3v8ys77x8h6fbp9c6bdfh0awh"; + }; + in { + enable = config.services.myDatabases.ldap.enable; + dataDir = "/var/lib/openldap"; + urlList = [ "ldap://" "ldaps://" ]; + extraConfig = '' + include ${pkgs.openldap}/etc/schema/core.schema + include ${pkgs.openldap}/etc/schema/cosine.schema + include ${pkgs.openldap}/etc/schema/inetorgperson.schema + include ${pkgs.openldap}/etc/schema/nis.schema + include ${puppetSchema} + include ${kerberosSchema} + include ${./immae.schema} + + pidfile /run/slapd/slapd.pid + argsfile /run/slapd/slapd.args + + moduleload back_hdb + backend hdb + + moduleload memberof + database hdb + suffix "${myconfig.env.ldap.base}" + rootdn "${myconfig.env.ldap.root_dn}" + rootpw ${myconfig.env.ldap.root_pw} + directory /var/lib/openldap + overlay memberof + + TLSCertificateFile /var/lib/acme/ldap/cert.pem + TLSCertificateKeyFile /var/lib/acme/ldap/key.pem + TLSCACertificateFile /var/lib/acme/ldap/fullchain.pem + TLSCACertificatePath ${pkgs.cacert.unbundled}/etc/ssl/certs/ + #This makes openldap crash + #TLSCipherSuite DEFAULT + + sasl-host kerberos.immae.eu + ${builtins.readFile "${myconfig.privateFiles}/ldap.conf"} + ''; + }; }; } diff --git a/nixops/modules/databases/immae.schema b/nixops/modules/databases/immae.schema new file mode 100644 index 0000000..f0e12bc --- /dev/null +++ b/nixops/modules/databases/immae.schema @@ -0,0 +1,155 @@ +# vim: set filetype=slapd: +objectIdentifier Immaeroot 1.3.6.1.4.1.50071 + +objectIdentifier Immae Immaeroot:2 +objectIdentifier ImmaeattributeType Immae:3 +objectIdentifier ImmaeobjectClass Immae:4 + +# TT-RSS +attributetype ( ImmaeattributeType:1 NAME 'immaeTtrssLogin' + DESC 'login for TTRSS' + EQUALITY caseIgnoreMatch + SUBSTR caseIgnoreSubstringsMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) + +objectclass ( ImmaeobjectClass:1 NAME 'immaeTtrssClass' + DESC 'Expansion of the existing object classes for ttrss' + SUP top AUXILIARY + MUST ( immaeTtrssLogin ) ) + +# FTP +attributetype ( ImmaeattributeType:2 NAME 'immaeFtpDirectory' + DESC 'home directory for ftp' + EQUALITY caseExactIA5Match + SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) + +attributetype ( ImmaeattributeType:3 NAME 'immaeFtpUid' + DESC 'user id for ftp' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) + +attributetype ( ImmaeattributeType:4 NAME 'immaeFtpGid' + DESC 'group id for ftp' + EQUALITY integerMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) + +objectclass ( ImmaeobjectClass:2 NAME 'immaeFtpClass' + DESC 'Expansion of the existing object classes for ftp' + SUP top AUXILIARY + MUST ( immaeFtpDirectory $ immaeFtpGid $ immaeFtpUid ) ) + + +# SSH keys +attributetype ( ImmaeattributeType:5 NAME 'immaeSshKey' + DESC 'OpenSSH Public key' + EQUALITY octetStringMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 ) + +objectClass ( ImmaeobjectClass:3 NAME 'immaeSshClass' + DESC 'OpenSSH class' + SUP top AUXILIARY + MAy ( immaeSSHKey ) ) + +# Specific access +attributetype (ImmaeattributeType:6 NAME 'immaeAccessDn' + EQUALITY distinguishedNameMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 ) + +attributetype (ImmaeattributeType:17 NAME 'immaeAccessWriteDn' + EQUALITY distinguishedNameMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 ) + +attributetype (ImmaeattributeType:18 NAME 'immaeAccessReadSubtree' + EQUALITY distinguishedNameMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 ) + +objectClass ( ImmaeobjectClass:4 NAME 'immaeAccessClass' + DESC 'Access class' + SUP top AUXILIARY + MAY ( immaeAccessDn $ immaeAccessWriteDn $ immaeAccessReadSubtree ) ) + +# Xmpp uid +attributetype ( ImmaeattributeType:7 NAME 'immaeXmppUid' + DESC 'user part for Xmpp' + EQUALITY caseIgnoreMatch + SUBSTR caseIgnoreSubstringsMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) + +objectclass ( ImmaeobjectClass:5 NAME 'immaeXmppClass' + DESC 'Expansion of the existing object classes for XMPP' + SUP top AUXILIARY + MUST ( immaeXmppUid ) ) + +# Postfix accounts +attributetype ( ImmaeattributeType:8 NAME 'immaePostfixAddress' + DESC 'the dovecot address to match as username' + EQUALITY caseIgnoreIA5Match + SUBSTR caseIgnoreIA5SubstringsMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) + +attributetype ( ImmaeattributeType:9 NAME 'immaePostfixHome' + DESC 'the postfix home directory' + EQUALITY caseExactIA5Match + SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) + +attributetype ( ImmaeattributeType:10 NAME 'immaePostfixMail' + DESC 'the dovecot mail location' + EQUALITY caseExactIA5Match + SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) + +attributetype ( ImmaeattributeType:11 NAME 'immaePostfixUid' + DESC 'the dovecot uid' + EQUALITY caseExactIA5Match + SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) + +attributetype ( ImmaeattributeType:12 NAME 'immaePostfixGid' + DESC 'the dovecot gid' + EQUALITY caseExactIA5Match + SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) + +objectclass ( ImmaeobjectClass:6 NAME 'immaePostfixClass' + DESC 'Expansion of the existing object classes for Postfix' + SUP top AUXILIARY + MUST ( immaePostfixAddress $ immaePostfixHome $ + immaePostfixMail $ immaePostfixUid $ immaePostfixGid ) + ) + +# Tinc informations +# Domaine = une classe a part ou une partie du dn ? +# attributetype ( ImmaeattributeType:13 NAME 'immaeTincIpSegment' +# DESC 'the internal ip segment in tinc' +# EQUALITY caseIgnoreIA5Match +# SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) +# +# attributetype ( ImmaeattributeType:14 NAME 'immaeTincSubdomain' +# DESC 'the host subdomain' +# EQUALITY caseIgnoreIA5Match +# SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) +# +# attributetype ( ImmaeattributeType:15 NAME 'immaeTincHostname' +# DESC 'the host name' +# EQUALITY caseIgnoreIA5Match +# SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} ) +# +# objectclass ( ImmaeobjectClass:7 NAME 'immaeTincHostClass' +# DESC 'Expansion of the existing object classes for Tinc' +# SUP top AUXILIARY +# MUST ( immaeTincInternalIp $ immaeTincSubdomain $ +# immaeTincHostname ) +# ) + +attributetype (ImmaeattributeType:16 NAME 'immaePuppetJson' + DESC 'Puppet hiera json' + EQUALITY octetStringMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 ) + +objectclass ( ImmaeobjectClass:8 NAME 'immaePuppetClass' + DESC 'Expansion of the existing object classes for Puppet' + SUP top AUXILIARY + MUST ( immaePuppetJson ) + ) + +# Last: +# attributetype (ImmaeattributeType:18 NAME 'immaeAccessReadSubtree' +# objectclass ( ImmaeobjectClass:8 NAME 'immaePuppetClass' + -- 2.41.0