diff options
| author | Simon Rettberg | 2018-03-09 11:48:27 +0100 |
|---|---|---|
| committer | Simon Rettberg | 2018-03-09 11:48:27 +0100 |
| commit | 9b33230f3c6235990335fa73c071ff53e89dcfd8 (patch) | |
| tree | b8402ad0a60d5ceda5408302a215623685d4647a /core/modules/run-virt/data/opt/openslx/scripts | |
| parent | [pam-slx-plug] Handle sssd.conf generation (diff) | |
| download | mltk-9b33230f3c6235990335fa73c071ff53e89dcfd8.tar.gz mltk-9b33230f3c6235990335fa73c071ff53e89dcfd8.tar.xz mltk-9b33230f3c6235990335fa73c071ff53e89dcfd8.zip | |
[run-virt] pwdaemon now drops privs, no more su hack; support pam-slx-plug
If usage of pam-slx-plug is detected, we'll use the approprivate environment
variables to detect the mount domain, not the global /opt/openslx/inc/shares
Diffstat (limited to 'core/modules/run-virt/data/opt/openslx/scripts')
| -rw-r--r-- | core/modules/run-virt/data/opt/openslx/scripts/pam_script_auth.d/99-run_virt_credentials | 64 |
1 files changed, 43 insertions, 21 deletions
diff --git a/core/modules/run-virt/data/opt/openslx/scripts/pam_script_auth.d/99-run_virt_credentials b/core/modules/run-virt/data/opt/openslx/scripts/pam_script_auth.d/99-run_virt_credentials index 941f0047..211f780e 100644 --- a/core/modules/run-virt/data/opt/openslx/scripts/pam_script_auth.d/99-run_virt_credentials +++ b/core/modules/run-virt/data/opt/openslx/scripts/pam_script_auth.d/99-run_virt_credentials @@ -12,38 +12,60 @@ if [ -n "$TEMP_HOME_DIR" ]; then echo "${PERSISTENT_NETPATH}" > "${TEMP_HOME_DIR}/.home" chmod 0644 "${TEMP_HOME_DIR}/.home" fi + # pwdaemon + # Figure out username XUSER="${REAL_ACCOUNT}" [ -z "$XUSER" ] && XUSER="${PAM_USER}" # Figure out domain XDOMAIN= - # Take explicitly configured domain - if [ -s "/opt/openslx/inc/shares" ]; then - . /opt/openslx/inc/shares - XDOMAIN="${SHARE_DOMAIN}" - fi - if [ "x$XDOMAIN" != "x#" ]; then - # Guess domain - if [ -z "$XDOMAIN" ] && [ -n "$PERSISTENT_HOME_DIR" ]; then - XDOMAIN=$(grep -F " ${PERSISTENT_HOME_DIR} " "/proc/mounts" | grep -m1 -F 'domain=' | sed -r 's/^.*[ ,]domain=([^ ,]*)[ ,].*$/\1/g') - fi - if [ -z "$XDOMAIN" ]; then - XDOMAIN=$(<"/etc/ldap.conf" grep -m1 -i '^BASE\s.*DC=' | grep -o -E -i 'DC=([^,;]+)' | head -n 1 | cut -c 4-) + + if [ -d "/opt/openslx/pam/slx-ldap.d" ]; then + # New pretty approach - modular with multiple auth sources + if [ -n "$LDAP_DOMAIN_OVERRIDE" ]; then + [ "x$LDAP_DOMAIN_OVERRIDE" != "x#" ] && XDOMAIN="$LDAP_DOMAIN_OVERRIDE" + else + if [ -z "$XDOMAIN" ] && [ -n "$PERSISTENT_HOME_DIR" ]; then + XDOMAIN=$(grep -F " ${PERSISTENT_HOME_DIR} " "/proc/mounts" | grep -m1 -F 'domain=' | sed -r 's/^.*[ ,]domain=([^ ,]*)[ ,].*$/\1/g') + fi + if [ -z "$XDOMAIN" ] && [ -n "$USER_DN" ]; then + XDOMAIN=$(echo "$USER_DN" | grep -o -E -i 'DC=([^,;]+)' | head -n 1 | cut -c 4-) + fi + if [ -z "$XDOMAIN" ] && [ -n "$LDAP_BASE" ]; then + XDOMAIN=$(echo "$LDAP_BASE" | grep -o -E -i 'DC=([^,;]+)' | head -n 1 | cut -c 4-) + fi + if [ -z "$XDOMAIN" ]; then + XDOMAIN="WORKGROUP" + fi fi - if [ -z "$XDOMAIN" ]; then - XDOMAIN=$(<"/etc/sssd/sssd.conf" grep -m1 -i '^ldap_search_base\s*=.*DC=' | grep -o -E -i 'DC=[^,;]+' | head -n 1 | cut -c 4-) + else + # Old approach - just one global config + # Take explicitly configured domain + if [ -s "/opt/openslx/inc/shares" ]; then + . /opt/openslx/inc/shares + XDOMAIN="${SHARE_DOMAIN}" fi - if [ -n "$XDOMAIN" ]; then - XDOMAIN=$(echo "$XDOMAIN" | tr '[a-z]' '[A-Z]') + if [ "x$XDOMAIN" = "x#" ]; then + XDOMAIN= else - XDOMAIN="WORKGROUP" + # Guess domain + if [ -z "$XDOMAIN" ] && [ -n "$PERSISTENT_HOME_DIR" ]; then + XDOMAIN=$(grep -F " ${PERSISTENT_HOME_DIR} " "/proc/mounts" | grep -m1 -F 'domain=' | sed -r 's/^.*[ ,]domain=([^ ,]*)[ ,].*$/\1/g') + fi + if [ -z "$XDOMAIN" ]; then + XDOMAIN=$(<"/etc/ldap.conf" grep -m1 -i '^BASE\s.*DC=' | grep -o -E -i 'DC=([^,;]+)' | head -n 1 | cut -c 4-) + fi + if [ -z "$XDOMAIN" ]; then + XDOMAIN=$(<"/etc/sssd/sssd.conf" grep -m1 -i '^ldap_search_base\s*=.*DC=' | grep -o -E -i 'DC=[^,;]+' | head -n 1 | cut -c 4-) + fi + if [ -z "$XDOMAIN" ]; then + XDOMAIN="WORKGROUP" + fi fi - XDOMAIN="${XDOMAIN}\\" - else - XDOMAIN= fi - USERNAME="${XDOMAIN}${XUSER}" PASSWORD="$PAM_AUTHTOK" PWSOCKET="${TEMP_HOME_DIR}/.pwsocket" su -c 'pwdaemon --daemon &' "${PAM_USER}" & + [ -n "$XDOMAIN" ] && XDOMAIN="$(echo "$XDOMAIN" | tr '[a-z]' '[A-Z]')\\" + USERNAME="${XDOMAIN}${XUSER}" PASSWORD="$PAM_AUTHTOK" PWSOCKET="${TEMP_HOME_DIR}/.pwsocket" pwdaemon --daemon "${USER_UID}" unset XUSER XDOMAIN fi fi |