aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorIsmaël Bouya <ismael.bouya@normalesup.org>2019-01-24 23:04:12 +0100
committerIsmaël Bouya <ismael.bouya@normalesup.org>2019-01-24 23:04:12 +0100
commitbbba84f5f4185d2e5173a3cb8b3d008c23665e54 (patch)
tree57accfb03d7e8e6c21653e183e1da590e561a3e8
parent6f4574e7b57043340a2a520c4bbeb17dde72e0ea (diff)
downloadNix-bbba84f5f4185d2e5173a3cb8b3d008c23665e54.tar.gz
Nix-bbba84f5f4185d2e5173a3cb8b3d008c23665e54.tar.zst
Nix-bbba84f5f4185d2e5173a3cb8b3d008c23665e54.zip
Add SSL for pam ldap connection
-rw-r--r--virtual/modules/databases/default.nix26
1 files changed, 14 insertions, 12 deletions
diff --git a/virtual/modules/databases/default.nix b/virtual/modules/databases/default.nix
index 304ad89..94d8d75 100644
--- a/virtual/modules/databases/default.nix
+++ b/virtual/modules/databases/default.nix
@@ -111,19 +111,21 @@ in {
111 }; 111 };
112 112
113 security.pam.services = let 113 security.pam.services = let
114 pam_ldap = pkgs.pam_ldap; 114 pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
115 pam_ldap_mysql = pkgs.writeText "mysql.conf" '' 115 pam_ldap_mysql = pkgs.writeText "mysql.conf" ''
116 host ldap.immae.eu 116 host ${myconfig.env.ldap.host}
117 base dc=immae,dc=eu 117 base ${myconfig.env.ldap.base}
118 binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu 118 binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
119 bindpw ${myconfig.env.databases.mysql.pam_password} 119 bindpw ${myconfig.env.databases.mysql.pam_password}
120 ssl start_tls
120 pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu 121 pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
121 ''; 122 '';
122 pam_ldap_postgresql_replication = pkgs.writeText "postgresql.conf" '' 123 pam_ldap_postgresql_replication = pkgs.writeText "postgresql.conf" ''
123 host ldap.immae.eu 124 host ${myconfig.env.ldap.host}
124 base dc=immae,dc=eu 125 base ${myconfig.env.ldap.base}
125 binddn cn=eldiron,ou=hosts,dc=immae,dc=eu 126 binddn ${myconfig.env.ldap.host_dn}
126 bindpw ${myconfig.env.ldap.password} 127 bindpw ${myconfig.env.ldap.password}
128 ssl start_tls
127 pam_login_attribute cn 129 pam_login_attribute cn
128 ''; 130 '';
129 in [ 131 in [
@@ -131,22 +133,22 @@ in {
131 name = "mysql"; 133 name = "mysql";
132 text = '' 134 text = ''
133 # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/ 135 # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
134 auth required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql} 136 auth required ${pam_ldap} config=${pam_ldap_mysql}
135 account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql} 137 account required ${pam_ldap} config=${pam_ldap_mysql}
136 ''; 138 '';
137 } 139 }
138 { 140 {
139 name = "postgresql"; 141 name = "postgresql";
140 text = '' 142 text = ''
141 auth required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_postgresql_replication} 143 auth required ${pam_ldap} config=${pam_ldap_postgresql_replication}
142 account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_postgresql_replication} 144 account required ${pam_ldap} config=${pam_ldap_postgresql_replication}
143 ''; 145 '';
144 } 146 }
145 { 147 {
146 name = "postgresql_replication"; 148 name = "postgresql_replication";
147 text = '' 149 text = ''
148 auth required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_postgresql_replication} 150 auth required ${pam_ldap} config=${pam_ldap_postgresql_replication}
149 account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_postgresql_replication} 151 account required ${pam_ldap} config=${pam_ldap_postgresql_replication}
150 ''; 152 '';
151 } 153 }
152 ]; 154 ];