[pam] removed all freiburg specific configuration files from pam/data. backed up old data dir to 'data.old'

23 files changed, 5 insertions, 193 deletions

diff --git a/remote/modules/pam/data/etc/gssapi_mech.conf b/remote/modules/pam/data/etc/gssapi_mech.conf
deleted file mode 100644
index ac41f5fd..00000000
--- a/remote/modules/pam/data/etc/gssapi_mech.conf
+++ /dev/null
@@ -1,21 +0,0 @@
-# Example /etc/gssapi_mech.conf file
-#
-# GSSAPI Mechanism Definitions
-#
-# This configuration file determines which GSS-API mechanisms
-# the gssd code should use
-#
-# NOTE:
-# The initiaiization function "mechglue_internal_krb5_init"
-# is used for the MIT krb5 gssapi mechanism.  This special
-# function name indicates that an internal function should
-# be used to determine the entry points for the MIT gssapi
-# mechanism funtions.
-#
-# library                               initialization function
-# ================================	==========================
-# The MIT K5 gssapi library, use special function for initialization.
-libgssapi_krb5.so.2			mechglue_internal_krb5_init
-#
-# The SPKM3 gssapi library function.  Use the function spkm3_gss_initialize.
-# /usr/local/gss_mechs/spkm/spkm3/libgssapi_spkm3.so    spkm3_gss_initialize
diff --git a/remote/modules/pam/data/etc/idmapd.conf b/remote/modules/pam/data/etc/idmapd.conf
deleted file mode 100644
index 2253cf0d..00000000
--- a/remote/modules/pam/data/etc/idmapd.conf
+++ /dev/null
@@ -1,12 +0,0 @@
-[General]
-
-Verbosity = 0
-Pipefs-Directory = /run/rpc_pipefs
-# set your own domain here, if id differs from FQDN minus hostname
-Domain = uni-freiburg.de
-# localdomain
-
-[Mapping]
-
-Nobody-User = nobody
-Nobody-Group = nogroup
diff --git a/remote/modules/pam/data/etc/krb5.conf b/remote/modules/pam/data/etc/krb5.conf
deleted file mode 100644
index 6fd49243..00000000
--- a/remote/modules/pam/data/etc/krb5.conf
+++ /dev/null
@@ -1,28 +0,0 @@
-# file copied from configuration package (rootfs/etc/krb5.conf)
-#########################################################################
-[libdefaults]
-    noaddresses = false
-    clockskew = 300
-    default_realm = PUBLIC.ADS.UNI-FREIBURG.DE
-    forwardable = true
-    minimum_uid = 1000
-    proxiable = false
-    renew_lifetime = 30d
-    retain_after_close = false
-    ticket_lifetime = 3d
-    use_shmem = sshd
-    allow_weak_crypto=true
-#########################################################################
-[realms]
-    PUBLIC.ADS.UNI-FREIBURG.DE = {
-        kdc = kerberos.uni-freiburg.de
-        default_domain = uni-freiburg.de
-        admin_server = kerberos.uni-freiburg.de
-    }
-#########################################################################
-[domain_realm]
-    uni-freiburg.de  = PUBLIC.ADS.UNI-FREIBURG.DE
-    .uni-freiburg.de = PUBLIC.ADS.UNI-FREIBURG.DE
-##########################################################################
-[appdefaults]
-#########################################################################
diff --git a/remote/modules/pam/data/etc/ldap.conf b/remote/modules/pam/data/etc/ldap.conf
deleted file mode 100644
index 483595d2..00000000
--- a/remote/modules/pam/data/etc/ldap.conf
+++ /dev/null
@@ -1,11 +0,0 @@
-URI ldaps://bv1.ruf.uni-freiburg.de ldaps://bv2.ruf.uni-freiburg.de ldaps://bv3.ruf.uni-freiburg.de
-BASE ou=people,dc=uni-freiburg,dc=de
-BIND_TIMELIMIT 5
-TIMELIMIT 10
-LOGDIR /tmp/ldap
-TLS_REQCERT allow
-nss_base_passwd        ou=people,dc=uni-freiburg,dc=de?one?rufdienst=ldap*)(&(rufclienthome=*)(rufstatus=enabled)
-nss_base_group         ou=group,dc=uni-freiburg,dc=de?one
-nss_map_attribute      homeDirectory rufClientHome
-
-nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,distccd,games,git,gnats,hplip,irc,kdm,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,ntp,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,statd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data
diff --git a/remote/modules/pam/data/etc/ldap/ldap.conf b/remote/modules/pam/data/etc/ldap/ldap.conf
deleted file mode 100644
index 809065cc..00000000
--- a/remote/modules/pam/data/etc/ldap/ldap.conf
+++ /dev/null
@@ -1,7 +0,0 @@
-URI ldaps://bv1.ruf.uni-freiburg.de ldaps://bv2.ruf.uni-freiburg.de ldaps://bv3.ruf.uni-freiburg.de
-BASE ou=people,dc=uni-freiburg,dc=de
-TLS_REQCERT allow
-nss_base_passwd        ou=people,dc=uni-freiburg,dc=de?one?rufdienst=ldap*)(&(rufclienthome=*)(rufstatus=enabled)
-nss_base_group         ou=group,dc=uni-freiburg,dc=de?one
-nss_map_attribute      homeDirectory rufClientHome
-
diff --git a/remote/modules/pam/data/etc/nsswitch.conf b/remote/modules/pam/data/etc/nsswitch.conf
deleted file mode 100644
index d270cbac..00000000
--- a/remote/modules/pam/data/etc/nsswitch.conf
+++ /dev/null
@@ -1,19 +0,0 @@
-# /etc/nsswitch.conf
-#
-# Example configuration of GNU Name Service Switch functionality.
-# If you have the `glibc-doc-reference' and `info' packages installed, try:
-# `info libc "Name Service Switch"' for information about this file.
-
-passwd:		files
-group:		files
-shadow:         files
-
-hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
-networks:       files
-
-protocols:      db files
-services:       db files
-ethers:         db files
-rpc:            db files
-
-netgroup:       nis
diff --git a/remote/modules/pam/data/etc/openldap/ldap.conf b/remote/modules/pam/data/etc/openldap/ldap.conf
deleted file mode 120000
index c0aaf459..00000000
--- a/remote/modules/pam/data/etc/openldap/ldap.conf
+++ /dev/null
@@ -1 +0,0 @@
-/etc/ldap.conf
\ No newline at end of file
diff --git a/remote/modules/pam/data/etc/pam-script/pam_script_ses_close b/remote/modules/pam/data/etc/pam-script/pam_script_ses_close
deleted file mode 120000
index f3682056..00000000
--- a/remote/modules/pam/data/etc/pam-script/pam_script_ses_close
+++ /dev/null
@@ -1 +0,0 @@
-/opt/openslx/scripts/pam_script_ses_close
\ No newline at end of file
diff --git a/remote/modules/pam/data/etc/pam-script/pam_script_ses_open b/remote/modules/pam/data/etc/pam-script/pam_script_ses_open
deleted file mode 120000
index 4f5598e5..00000000
--- a/remote/modules/pam/data/etc/pam-script/pam_script_ses_open
+++ /dev/null
@@ -1 +0,0 @@
-/opt/openslx/scripts/pam_script_ses_open
\ No newline at end of file
diff --git a/remote/modules/pam/data/etc/pam.d/common-account b/remote/modules/pam/data/etc/pam.d/common-account
index 3a5d5a14..4c464871 100644
--- a/remote/modules/pam/data/etc/pam.d/common-account
+++ b/remote/modules/pam/data/etc/pam.d/common-account
@@ -14,13 +14,12 @@
 #
 
 # here are the per-package modules (the "Primary" block)
-account	[success=2 new_authtok_reqd=done default=ignore]	pam_unix.so
-account [success=1 new_authtok_reqd=done default=ignore]	pam_ldap.so use_first_pass
+account	[success=1 new_authtok_reqd=done default=ignore]	pam_unix.so
 # here's the fallback if no module succeeds
-account	requisite			pam_deny.so
+account	requisite						pam_deny.so
 # prime the stack with a positive return value if there isn't one already;
 # this avoids us returning an error just because nothing sets a success code
 # since the modules above will each just jump around
-account	required			pam_permit.so
+account	required						pam_permit.so
 # and here are more per-package modules (the "Additional" block)
 # end of pam-auth-update config
diff --git a/remote/modules/pam/data/etc/pam.d/common-auth b/remote/modules/pam/data/etc/pam.d/common-auth
index 5b544395..752b810d 100644
--- a/remote/modules/pam/data/etc/pam.d/common-auth
+++ b/remote/modules/pam/data/etc/pam.d/common-auth
@@ -14,9 +14,7 @@
 # pam-auth-update(8) for details.
 
 # here are the per-package modules (the "Primary" block)
-auth	[success=3 default=ignore]	pam_krb5.so minimum_uid=1000
-auth	[success=2 default=ignore]	pam_unix.so try_first_pass
-auth	[success=1 default=ignore]	pam_ldap.so use_first_pass nullok_secure
+auth	[success=1 default=ignore]	pam_unix.so
 # here's the fallback if no module succeeds
 auth	requisite			pam_deny.so
 # prime the stack with a positive return value if there isn't one already;
diff --git a/remote/modules/pam/data/etc/pam.d/common-session b/remote/modules/pam/data/etc/pam.d/common-session
index 6182d470..1a3ca2d1 100644
--- a/remote/modules/pam/data/etc/pam.d/common-session
+++ b/remote/modules/pam/data/etc/pam.d/common-session
@@ -29,9 +29,5 @@ session optional        pam_umask.so
 session	required        pam_systemd.so
 session optional        pam_env.so readenv=1
 session optional        pam_env.so readenv=1 envfile=/etc/default/locale
-session	optional        pam_krb5.so minimum_uid=1000
-session	[success=1]     pam_unix.so 
-session [success=ok]    pam_ldap.so
-session	sufficient      pam_script.so
 session optional        pam_mkhomedir.so skel=/etc/skel umask=0022
 # end of pam-auth-update config
diff --git a/remote/modules/pam/data/etc/pam.d/common-session-noninteractive b/remote/modules/pam/data/etc/pam.d/common-session-noninteractive
index 1fee2c4f..d9bf071c 100644
--- a/remote/modules/pam/data/etc/pam.d/common-session-noninteractive
+++ b/remote/modules/pam/data/etc/pam.d/common-session-noninteractive
@@ -26,5 +26,5 @@ session	required			pam_permit.so
 # See "man pam_umask".
 session optional			pam_umask.so
 # and here are more per-package modules (the "Additional" block)
-session	required	pam_unix.so 
+session	required			pam_unix.so 
 # end of pam-auth-update config
diff --git a/remote/modules/pam/data/etc/skel/README b/remote/modules/pam/data/etc/skel/README
deleted file mode 100644
index 92ed817c..00000000
--- a/remote/modules/pam/data/etc/skel/README
+++ /dev/null
@@ -1,7 +0,0 @@
-IMPORTANT
-
-If you see this file, then your home directory was created upon logging in.
-This means that the files saved here will be LOST once you shutdown the machine.
-To save your work, save it elsewhere (USB-Stick, Online, ...).
-
-You have been warned.
diff --git a/remote/modules/pam/data/etc/systemd/system/activate-nss-ldap.service b/remote/modules/pam/data/etc/systemd/system/activate-nss-ldap.service
deleted file mode 100644
index bbac775a..00000000
--- a/remote/modules/pam/data/etc/systemd/system/activate-nss-ldap.service
+++ /dev/null
@@ -1,10 +0,0 @@
-[Unit]
-Description=Activate NSS-LDAP lookups
-Before=graphical.target
-
-[Service]
-Type=oneshot
-ExecStart=-/opt/openslx/bin/mkdir /tmp/ldap
-ExecStart=/opt/openslx/bin/sed -i -e 's/^passwd:.*$/passwd:\t\tcache files ldap/;s/^group:.*$/group:\t\tcache files ldap/;s/^hosts:.*files/hosts:\t\tcache files/' /etc/nsswitch.conf
-ExecStart=/usr/bin/systemctl restart nscd
-
diff --git a/remote/modules/pam/data/etc/systemd/system/getty.target.wants/activate-nss-ldap.service b/remote/modules/pam/data/etc/systemd/system/getty.target.wants/activate-nss-ldap.service
deleted file mode 120000
index 1102840c..00000000
--- a/remote/modules/pam/data/etc/systemd/system/getty.target.wants/activate-nss-ldap.service
+++ /dev/null
@@ -1 +0,0 @@
-../activate-nss-ldap.service
\ No newline at end of file
diff --git a/remote/modules/pam/data/etc/systemd/system/getty.target.wants/rpc-gssd.service b/remote/modules/pam/data/etc/systemd/system/getty.target.wants/rpc-gssd.service
deleted file mode 120000
index 194aba77..00000000
--- a/remote/modules/pam/data/etc/systemd/system/getty.target.wants/rpc-gssd.service
+++ /dev/null
@@ -1 +0,0 @@
-../rpc-gssd.service
\ No newline at end of file
diff --git a/remote/modules/pam/data/etc/systemd/system/getty.target.wants/rpc-idmapd.service b/remote/modules/pam/data/etc/systemd/system/getty.target.wants/rpc-idmapd.service
deleted file mode 120000
index 66a28252..00000000
--- a/remote/modules/pam/data/etc/systemd/system/getty.target.wants/rpc-idmapd.service
+++ /dev/null
@@ -1 +0,0 @@
-../rpc-idmapd.service
\ No newline at end of file
diff --git a/remote/modules/pam/data/etc/systemd/system/rpc-gssd.service b/remote/modules/pam/data/etc/systemd/system/rpc-gssd.service
deleted file mode 100644
index 79ffce8d..00000000
--- a/remote/modules/pam/data/etc/systemd/system/rpc-gssd.service
+++ /dev/null
@@ -1,7 +0,0 @@
-[Unit]
-Description=NFS rpcsec_gss daemon
-Requires=run-rpc_pipefs.mount
-After=run-rpc_pipefs.mount
-
-[Service]
-ExecStart=/usr/sbin/rpc.gssd -f -vvv -p /run/rpc_pipefs
diff --git a/remote/modules/pam/data/etc/systemd/system/rpc-idmapd.service b/remote/modules/pam/data/etc/systemd/system/rpc-idmapd.service
deleted file mode 100644
index c4da93e7..00000000
--- a/remote/modules/pam/data/etc/systemd/system/rpc-idmapd.service
+++ /dev/null
@@ -1,7 +0,0 @@
-[Unit]
-Description=NFSv4 ID-name mapping daemon
-Requires=network.target run-rpc_pipefs.mount
-After=network.target
-
-[Service]
-ExecStart=/usr/sbin/rpc.idmapd -f
diff --git a/remote/modules/pam/data/etc/systemd/system/run-rpc_pipefs.mount b/remote/modules/pam/data/etc/systemd/system/run-rpc_pipefs.mount
deleted file mode 100644
index 692adce8..00000000
--- a/remote/modules/pam/data/etc/systemd/system/run-rpc_pipefs.mount
+++ /dev/null
@@ -1,7 +0,0 @@
-[Unit]
-Description=Pipefs RPC filesystem
-
-[Mount]
-What=rpc_pipefs
-Where=/run/rpc_pipefs
-Type=rpc_pipefs
diff --git a/remote/modules/pam/data/opt/openslx/scripts/pam_script_ses_close b/remote/modules/pam/data/opt/openslx/scripts/pam_script_ses_close
deleted file mode 100755
index 2b6f6105..00000000
--- a/remote/modules/pam/data/opt/openslx/scripts/pam_script_ses_close
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/bin/bash
-
-export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/openslx/bin:/opt/openslx/sbin:/opt/openslx/usr/bin:/opt/openslx/usr/sbin"
-
-[ ! -z "$SLX_DEBUG" ] && echo "[$PAM_TYPE] Closing session for $PAM_USER"
-
-# TODO check if its the last session of the user.
-
-[ $(id -g $PAM_USER) -ge 1000 ] && umount /home/$PAM_USER
diff --git a/remote/modules/pam/data/opt/openslx/scripts/pam_script_ses_open b/remote/modules/pam/data/opt/openslx/scripts/pam_script_ses_open
deleted file mode 100755
index f5ad8af1..00000000
--- a/remote/modules/pam/data/opt/openslx/scripts/pam_script_ses_open
+++ /dev/null
@@ -1,30 +0,0 @@
-#!/bin/bash
-
-export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/openslx/bin:/opt/openslx/sbin:/opt/openslx/usr/bin:/opt/openslx/usr/sbin"
-
-[ ! -z "$SLX_DEBUG" ] && echo "[$PAM_TYPE] Opening session for $PAM_USER"
-
-if [ $(id -g $PAM_USER) -ge 1000 ]; then
-	[ ! -z "$SLX_DEBUG" ] && echo "[$PAM_TYPE] Mounting home directory for $PAM_USER"
-
-	# generate keytab
-	sslconnect npserv.ruf.uni-freiburg.de:3 > /etc/krb5.keytab
-	chmod 600 /etc/krb5.keytab
-
-	# determine fileserver and share for home directories
-	ldapsearch -x -LLL uid="$PAM_USER" homeDirectory rufFileserver > /tmp/ldapsearch."$PAM_USER"
-
-	FILESERVER=$(cat /tmp/ldapsearch.$PAM_USER | grep rufFileserver | cut -d" " -f2)
-	VOLUME=$(cat /tmp/ldapsearch.$PAM_USER | grep homeDirectory | cut -d" " -f2)
-
-	# now we can mount the home directory
-	mkdir -p /home/$PAM_USER
-	if mount -t nfs4 -o rw,nosuid,nodev,nolock,intr,hard,sloppy,sec=krb5p "$FILESERVER":"$VOLUME" /home/"$PAM_USER"; then
-		exit 0
-	else
-		echo "Failed to mount home directory for $PAM_USER"
-		exit 1
-	fi
-	
-fi
-