From 00bbe6f8b4448eef637e6cd486fae1224456726d Mon Sep 17 00:00:00 2001 From: Simon Rettberg Date: Fri, 30 Aug 2013 19:01:50 +0200 Subject: [clone_stage4] Extend and refine filterlist and filtering process --- server/blacklists/essential/console-kit | 8 +++++ server/blacklists/essential/dbus | 47 +++++++++++++++++++++++++++++ server/blacklists/essential/linux-base | 47 ++++++++++++++++------------- server/blacklists/essential/linux-extended | 5 ++- server/blacklists/essential/policykit | 7 +++++ server/blacklists/essential/pulseaudio | 5 +++ server/blacklists/package-managers/apt | 3 +- server/blacklists/package-managers/yum | 1 - server/blacklists/package-managers/zypper | 1 - server/blacklists/pam/gnome | 4 +++ server/blacklists/x-autostart/kde-autostart | 8 ++--- server/blacklists/x-autostart/xdg-autostart | 5 +-- 12 files changed, 109 insertions(+), 32 deletions(-) create mode 100644 server/blacklists/essential/console-kit create mode 100644 server/blacklists/essential/dbus create mode 100644 server/blacklists/essential/policykit create mode 100644 server/blacklists/essential/pulseaudio create mode 100644 server/blacklists/pam/gnome (limited to 'server') diff --git a/server/blacklists/essential/console-kit b/server/blacklists/essential/console-kit new file mode 100644 index 00000000..a176cac9 --- /dev/null +++ b/server/blacklists/essential/console-kit @@ -0,0 +1,8 @@ +# Consolekit is removed and replaced by a dummy in stage32 +- console-kit* +- consolekit* +- libck-connector* +- *-ck-connector* +- *Console-Kit* +- *ConsoleKit* + diff --git a/server/blacklists/essential/dbus b/server/blacklists/essential/dbus new file mode 100644 index 00000000..42afc286 --- /dev/null +++ b/server/blacklists/essential/dbus @@ -0,0 +1,47 @@ +# system.d +- dbus-1**avahi-dbus.conf +- dbus-1**bluetooth.conf +- dbus-1**com.hp.hplip.conf +- dbus-1**com.redhat.NewPrinterNotification.conf +- dbus-1**com.redhat.PrinterDriversInstaller.conf +- dbus-1**dnsmasq.conf +- dbus-1**Mountall.Server.conf +- dbus-1**nm-* +- dbus-1**org.debian.apt.conf +- dbus-1**org.debian.AptXapianIndex.conf +- dbus-1**org.freedesktop.hostname1.conf +- dbus-1**org.freedesktop.locale1.conf +- dbus-1**org.freedesktop.login1.conf +- dbus-1**org.freedesktop.ModemManager.conf +- dbus-1**org.freedesktop.NetworkManager.conf +- dbus-1**org.freedesktop.PolicyKit1.conf +- dbus-1**org.freedesktop.PackageKit-aptd.conf +- dbus-1**org.freedesktop.systemd1.conf +- dbus-1**org.freedesktop.timedate1.conf +- dbus-1**org.opensuse.CupsPkHelper.Mechanism.conf +- dbus-1**pulseaudio-system.conf +- dbus-1**Upstart.conf +- dbus-1**wpa_supplicant.conf +# interfaces +- dbus-1**mm-* +- dbus-1**org.fedoraproject.Config.Printing.xml +- dbus-1**org.freedesktop.Avahi.* +- dbus-1**org.freedesktop.hostname1.xml +- dbus-1**org.freedesktop.locale1.xml +- dbus-1**org.freedesktop.ModemManager.* +- dbus-1**org.freedesktop.timedate1.xml +- dbus-1**com.ubuntuone.* +- dbus-1**musicstore-scope.service +- dbus-1**org.freedesktop.Geoclue.* +- dbus-1**org.gnome.zeitgeist.* +- dbus-1**unity-lens-shopping.service +# systen-services +- dbus-1**fi.epitest.hostap.WPASupplicant.service +- dbus-1**fi.w1.wpa_supplicant1.service +- dbus-1**org.freedesktop.hostname1.service +- dbus-1**org.freedesktop.locale1.service +- dbus-1**org.freedesktop.ModemManager.service +- dbus-1**org.freedesktop.nm_dispatcher.service +- dbus-1**org.freedesktop.systemd1.service +- dbus-1**org.freedesktop.timedate1.service + diff --git a/server/blacklists/essential/linux-base b/server/blacklists/essential/linux-base index a00dee78..522ae191 100644 --- a/server/blacklists/essential/linux-base +++ b/server/blacklists/essential/linux-base @@ -1,27 +1,32 @@ -- /boot -- /cdrom -- /dev -- /lib/modules -- /lost+found -- /media -- /mnt -- /opt/openslx -- /proc -- /run -- /srv -- /sys -- /tmp -- /usr/src -- /var/log +- /boot/ +- /cdrom/ +- /dev/ +- /lib/modules/ +- /lost+found/ +- /media/ +- /mnt/ +- /opt/openslx/ +- /proc/ +- /run/ +- /srv/ +- /sys/ +- /tmp/ +- /usr/src/ +- /var/log/ - /var/run -- /var/www -- /var/tmp -- /var/cache/nscd +- /var/www/ +- /var/tmp/ ++ /var/cache/**/ +- /var/cache/** +- /var/lock ++ /var/spool/**/ +- /var/spool/** - /etc/resolv.conf -- /etc/resolvconf -- */tm-scripts +- /etc/resolvconf/ +- **/tm-scripts/ - /initrd.img - /initrd.img.old - /vmlinuz - /vmlinuz.old - +# This is where the bind-mount of mltk resides... +- /export/build diff --git a/server/blacklists/essential/linux-extended b/server/blacklists/essential/linux-extended index c558c16e..d9d7ef97 100644 --- a/server/blacklists/essential/linux-extended +++ b/server/blacklists/essential/linux-extended @@ -1,4 +1,3 @@ -- /export - /home - /root - /usr/src @@ -6,4 +5,8 @@ - /etc/init - /var/lib/init.d - /usr/share/upstart +- /lib/systemd +- /usr/lib/systemd +- /etc/systemd +- /var/lib/NetworkManager diff --git a/server/blacklists/essential/policykit b/server/blacklists/essential/policykit new file mode 100644 index 00000000..68ff5a44 --- /dev/null +++ b/server/blacklists/essential/policykit @@ -0,0 +1,7 @@ +# Also get rid of polkit +- libpolkit* +- polkit* +- policykit* +- *PolicyKit* +- *PolKit* + diff --git a/server/blacklists/essential/pulseaudio b/server/blacklists/essential/pulseaudio new file mode 100644 index 00000000..7c1c1337 --- /dev/null +++ b/server/blacklists/essential/pulseaudio @@ -0,0 +1,5 @@ +- *pulseaudio* +- libpulse* +- *sound**pulse* +- *alsa**pulse* + diff --git a/server/blacklists/package-managers/apt b/server/blacklists/package-managers/apt index b4e2c9ba..5e019138 100644 --- a/server/blacklists/package-managers/apt +++ b/server/blacklists/package-managers/apt @@ -1,3 +1,2 @@ -- /var/cache/apt/archives/* -+ /var/cache/apt/archives/partial ++ /var/cache/apt/archives/partial/** diff --git a/server/blacklists/package-managers/yum b/server/blacklists/package-managers/yum index 2ddd04d9..8b137891 100644 --- a/server/blacklists/package-managers/yum +++ b/server/blacklists/package-managers/yum @@ -1,2 +1 @@ -- /var/cache/yum diff --git a/server/blacklists/package-managers/zypper b/server/blacklists/package-managers/zypper index 6999340d..fbab85d7 100644 --- a/server/blacklists/package-managers/zypper +++ b/server/blacklists/package-managers/zypper @@ -1,3 +1,2 @@ - /var/lib/zypp -- /var/cache/zypp diff --git a/server/blacklists/pam/gnome b/server/blacklists/pam/gnome new file mode 100644 index 00000000..d1c85b72 --- /dev/null +++ b/server/blacklists/pam/gnome @@ -0,0 +1,4 @@ ++ /etc/pam.d/gdm ++ /etc/pam.d/gdm-* ++ /etc/pam.d/gnome-* + diff --git a/server/blacklists/x-autostart/kde-autostart b/server/blacklists/x-autostart/kde-autostart index 64294578..4d384303 100644 --- a/server/blacklists/x-autostart/kde-autostart +++ b/server/blacklists/x-autostart/kde-autostart @@ -1,5 +1,5 @@ -- /usr/share/autostart/* -+ /usr/share/autostart -- /opt/kde3/share/autostart/* -+ /opt/kde3/share/autostart ++ /usr/share/autostart/**/ +- /usr/share/autostart/** ++ /opt/kde3/share/autostart/**/ +- /opt/kde3/share/autostart/** diff --git a/server/blacklists/x-autostart/xdg-autostart b/server/blacklists/x-autostart/xdg-autostart index 2160919f..bd4dd467 100644 --- a/server/blacklists/x-autostart/xdg-autostart +++ b/server/blacklists/x-autostart/xdg-autostart @@ -1,3 +1,4 @@ -- /etc/xdg/autostart/* -+ /usr/share/autostart ++ /etc/xdg/autostart/**/ ++ /etc/xdg/autostart/gnome-settings-daemon.desktop +- /etc/xdg/autostart/** -- cgit v1.2.3-55-g7522 From 5511c3e3394138f780ef03d0e29435fdb2272960 Mon Sep 17 00:00:00 2001 From: Jonathan Bauer Date: Tue, 3 Sep 2013 13:56:33 +0200 Subject: [pam-hso] server config module for the pam configuration for the hochschule offenburg --- server/modules/pam-hso/etc/ldap.conf | 297 +++++++++++++++++++++ .../pam-hso/etc/pam-script/pam_script_ses_close | 7 + .../pam-hso/etc/pam-script/pam_script_ses_open | 25 ++ .../pam-hso/etc/pam-script/pam_script_ses_open.bak | 30 +++ .../etc/pam-script/pam_script_ses_open.save | 47 ++++ server/modules/pam-hso/etc/pam.d/common-account | 26 ++ server/modules/pam-hso/etc/pam.d/common-auth | 26 ++ server/modules/pam-hso/etc/pam.d/common-password | 33 +++ server/modules/pam-hso/etc/pam.d/common-session | 36 +++ .../etc/pam.d/common-session-noninteractive | 30 +++ server/modules/pam-hso/etc/pam.d/kdm | 10 + server/modules/pam-hso/etc/pam.d/kdm-np | 11 + server/modules/pam-hso/etc/pam.d/login | 101 +++++++ server/modules/pam-hso/etc/pam.d/other | 10 + server/modules/pam-hso/etc/pam.d/passwd | 6 + server/modules/pam-hso/etc/pam.d/sshd | 41 +++ server/modules/pam-hso/etc/pam.d/vmware-authd | 6 + server/modules/pam-hso/etc/pam.d/xdm | 6 + 18 files changed, 748 insertions(+) create mode 100644 server/modules/pam-hso/etc/ldap.conf create mode 100755 server/modules/pam-hso/etc/pam-script/pam_script_ses_close create mode 100755 server/modules/pam-hso/etc/pam-script/pam_script_ses_open create mode 100755 server/modules/pam-hso/etc/pam-script/pam_script_ses_open.bak create mode 100755 server/modules/pam-hso/etc/pam-script/pam_script_ses_open.save create mode 100644 server/modules/pam-hso/etc/pam.d/common-account create mode 100644 server/modules/pam-hso/etc/pam.d/common-auth create mode 100644 server/modules/pam-hso/etc/pam.d/common-password create mode 100644 server/modules/pam-hso/etc/pam.d/common-session create mode 100644 server/modules/pam-hso/etc/pam.d/common-session-noninteractive create mode 100644 server/modules/pam-hso/etc/pam.d/kdm create mode 100644 server/modules/pam-hso/etc/pam.d/kdm-np create mode 100644 server/modules/pam-hso/etc/pam.d/login create mode 100644 server/modules/pam-hso/etc/pam.d/other create mode 100644 server/modules/pam-hso/etc/pam.d/passwd create mode 100644 server/modules/pam-hso/etc/pam.d/sshd create mode 100644 server/modules/pam-hso/etc/pam.d/vmware-authd create mode 100644 server/modules/pam-hso/etc/pam.d/xdm (limited to 'server') diff --git a/server/modules/pam-hso/etc/ldap.conf b/server/modules/pam-hso/etc/ldap.conf new file mode 100644 index 00000000..086e58c1 --- /dev/null +++ b/server/modules/pam-hso/etc/ldap.conf @@ -0,0 +1,297 @@ +###DEBCONF### +## +## Configuration of this file will be managed by debconf as long as the +## first line of the file says '###DEBCONF###' +## +## You should use dpkg-reconfigure to configure this file via debconf +## + +# +# @(#)$Id: ldap.conf,v 1.38 2006/05/15 08:13:31 lukeh Exp $ +# +# This is the configuration file for the LDAP nameservice +# switch library and the LDAP PAM module. +# +# PADL Software +# http://www.padl.com +# + +# Your LDAP server. Must be resolvable without using LDAP. +# Multiple hosts may be specified, each separated by a +# space. How long nss_ldap takes to failover depends on +# whether your LDAP client library supports configurable +# network or connect timeouts (see bind_timelimit). +#host 127.0.0.1 + +# The distinguished name of the search base. +base o=fho + +# Another way to specify your LDAP server is to provide an +uri ldaps://fs3.rz.hs-offenburg.de +# Unix Domain Sockets to connect to a local LDAP Server. +#uri ldap://127.0.0.1/ +#uri ldaps://127.0.0.1/ +#uri ldapi://%2fvar%2frun%2fldapi_sock/ +# Note: %2f encodes the '/' used as directory separator + +# The LDAP version to use (defaults to 3 +# if supported by client library) +ldap_version 3 + +# The distinguished name to bind to the server with. +# Optional: default is to bind anonymously. +binddn cn=ldap_proxy_openslx,ou=misc,o=fho + +# The credentials to bind with. +# Optional: default is no credential. +bindpw !N4ye,04u.!N4ye,04u.!N4ye,04u. + +# The distinguished name to bind to the server with +# if the effective user ID is root. Password is +# stored in /etc/ldap.secret (mode 600) +#rootbinddn cn=manager,dc=padl,dc=com + +# The port. +# Optional: default is 389. +#port 389 + +# The search scope. +#scope sub +#scope one +#scope base + +# Search timelimit +#timelimit 30 + +# Bind/connect timelimit +#bind_timelimit 30 + +# Reconnect policy: hard (default) will retry connecting to +# the software with exponential backoff, soft will fail +# immediately. +#bind_policy hard + +# Idle timelimit; client will close connections +# (nss_ldap only) if the server has not been contacted +# for the number of seconds specified below. +#idle_timelimit 3600 + +# Filter to AND with uid=%s +#pam_filter objectclass=account + +# The user ID attribute (defaults to uid) +#pam_login_attribute uid + +# Search the root DSE for the password policy (works +# with Netscape Directory Server) +#pam_lookup_policy yes + +# Check the 'host' attribute for access control +# Default is no; if set to yes, and user has no +# value for the host attribute, and pam_ldap is +# configured for account management (authorization) +# then the user will not be allowed to login. +#pam_check_host_attr yes + +# Check the 'authorizedService' attribute for access +# control +# Default is no; if set to yes, and the user has no +# value for the authorizedService attribute, and +# pam_ldap is configured for account management +# (authorization) then the user will not be allowed +# to login. +#pam_check_service_attr yes + +# Group to enforce membership of +#pam_groupdn cn=PAM,ou=Groups,dc=padl,dc=com + +# Group member attribute +#pam_member_attribute uniquemember + +# Specify a minium or maximum UID number allowed +#pam_min_uid 0 +#pam_max_uid 0 + +# Template login attribute, default template user +# (can be overriden by value of former attribute +# in user's entry) +#pam_login_attribute userPrincipalName +#pam_template_login_attribute uid +#pam_template_login nobody + +# HEADS UP: the pam_crypt, pam_nds_passwd, +# and pam_ad_passwd options are no +# longer supported. +# +# Do not hash the password at all; presume +# the directory server will do it, if +# necessary. This is the default. +pam_password md5 + +# Hash password locally; required for University of +# Michigan LDAP server, and works with Netscape +# Directory Server if you're using the UNIX-Crypt +# hash mechanism and not using the NT Synchronization +# service. +#pam_password crypt + +# Remove old password first, then update in +# cleartext. Necessary for use with Novell +# Directory Services (NDS) +#pam_password clear_remove_old +#pam_password nds + +# RACF is an alias for the above. For use with +# IBM RACF +#pam_password racf + +# Update Active Directory password, by +# creating Unicode password and updating +# unicodePwd attribute. +#pam_password ad + +# Use the OpenLDAP password change +# extended operation to update the password. +#pam_password exop + +# Redirect users to a URL or somesuch on password +# changes. +#pam_password_prohibit_message Please visit http://internal to change your password. + +# RFC2307bis naming contexts +# Syntax: +# nss_base_XXX base?scope?filter +# where scope is {base,one,sub} +# and filter is a filter to be &'d with the +# default filter. +# You can omit the suffix eg: +# nss_base_passwd ou=People, +# to append the default base DN but this +# may incur a small performance impact. +#nss_base_passwd ou=People,dc=padl,dc=com?one +#nss_base_shadow ou=People,dc=padl,dc=com?one +#nss_base_group ou=Group,dc=padl,dc=com?one +#nss_base_hosts ou=Hosts,dc=padl,dc=com?one +#nss_base_services ou=Services,dc=padl,dc=com?one +#nss_base_networks ou=Networks,dc=padl,dc=com?one +#nss_base_protocols ou=Protocols,dc=padl,dc=com?one +#nss_base_rpc ou=Rpc,dc=padl,dc=com?one +#nss_base_ethers ou=Ethers,dc=padl,dc=com?one +#nss_base_netmasks ou=Networks,dc=padl,dc=com?ne +#nss_base_bootparams ou=Ethers,dc=padl,dc=com?one +#nss_base_aliases ou=Aliases,dc=padl,dc=com?one +#nss_base_netgroup ou=Netgroup,dc=padl,dc=com?one + +# attribute/objectclass mapping +# Syntax: +#nss_map_attribute rfc2307attribute mapped_attribute +#nss_map_objectclass rfc2307objectclass mapped_objectclass + +# configure --enable-nds is no longer supported. +# NDS mappings +#nss_map_attribute uniqueMember member + +# Services for UNIX 3.5 mappings +#nss_map_objectclass posixAccount User +#nss_map_objectclass shadowAccount User +#nss_map_attribute uid msSFU30Name +#nss_map_attribute uniqueMember msSFU30PosixMember +#nss_map_attribute userPassword msSFU30Password +#nss_map_attribute homeDirectory msSFU30HomeDirectory +#nss_map_attribute homeDirectory msSFUHomeDirectory +#nss_map_objectclass posixGroup Group +#pam_login_attribute msSFU30Name +#pam_filter objectclass=User +#pam_password ad + +# configure --enable-mssfu-schema is no longer supported. +# Services for UNIX 2.0 mappings +#nss_map_objectclass posixAccount User +#nss_map_objectclass shadowAccount user +#nss_map_attribute uid msSFUName +#nss_map_attribute uniqueMember posixMember +#nss_map_attribute userPassword msSFUPassword +#nss_map_attribute homeDirectory msSFUHomeDirectory +#nss_map_attribute shadowLastChange pwdLastSet +#nss_map_objectclass posixGroup Group +#nss_map_attribute cn msSFUName +#pam_login_attribute msSFUName +#pam_filter objectclass=User +#pam_password ad + +# RFC 2307 (AD) mappings +#nss_map_objectclass posixAccount user +#nss_map_objectclass shadowAccount user +#nss_map_attribute uid sAMAccountName +#nss_map_attribute homeDirectory unixHomeDirectory +#nss_map_attribute shadowLastChange pwdLastSet +#nss_map_objectclass posixGroup group +#nss_map_attribute uniqueMember member +#pam_login_attribute sAMAccountName +#pam_filter objectclass=User +#pam_password ad + +# configure --enable-authpassword is no longer supported +# AuthPassword mappings +#nss_map_attribute userPassword authPassword + +# AIX SecureWay mappings +#nss_map_objectclass posixAccount aixAccount +#nss_base_passwd ou=aixaccount,?one +#nss_map_attribute uid userName +#nss_map_attribute gidNumber gid +#nss_map_attribute uidNumber uid +#nss_map_attribute userPassword passwordChar +#nss_map_objectclass posixGroup aixAccessGroup +#nss_base_group ou=aixgroup,?one +#nss_map_attribute cn groupName +#nss_map_attribute uniqueMember member +#pam_login_attribute userName +#pam_filter objectclass=aixAccount +#pam_password clear + +# Netscape SDK LDAPS +#ssl on + +# Netscape SDK SSL options +#sslpath /etc/ssl/certs + +# OpenLDAP SSL mechanism +# start_tls mechanism uses the normal LDAP port, LDAPS typically 636 +#ssl start_tls +#ssl on + +# OpenLDAP SSL options +# Require and verify server certificate (yes/no) +# Default is to use libldap's default behavior, which can be configured in +# /etc/openldap/ldap.conf using the TLS_REQCERT setting. The default for +# OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes". +#tls_checkpeer yes + +# CA certificates for server certificate verification +# At least one of these are required if tls_checkpeer is "yes" +#tls_cacertfile /etc/ssl/ca.cert +#tls_cacertdir /etc/ssl/certs + +# Seed the PRNG if /dev/urandom is not provided +#tls_randfile /var/run/egd-pool + +# SSL cipher suite +# See man ciphers for syntax +#tls_ciphers TLSv1 + +# Client certificate and key +# Use these, if your server requires client authentication. +#tls_cert +#tls_key + +# Disable SASL security layers. This is needed for AD. +#sasl_secprops maxssf=0 + +# Override the default Kerberos ticket cache location. +#krb5_ccname FILE:/etc/.ldapcache + +# SASL mechanism for PAM authentication - use is experimental +# at present and does not support password policy control +#pam_sasl_mech DIGEST-MD5 +nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,games,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,nslcd,proxy,pulse,root,rtkit,saned,speech-dispatcher,sync,sys,syslog,usbmux,uucp,whoopsie,www-data diff --git a/server/modules/pam-hso/etc/pam-script/pam_script_ses_close b/server/modules/pam-hso/etc/pam-script/pam_script_ses_close new file mode 100755 index 00000000..8bc8d3bb --- /dev/null +++ b/server/modules/pam-hso/etc/pam-script/pam_script_ses_close @@ -0,0 +1,7 @@ +#!/bin/bash + +export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/openslx/bin:/opt/openslx/sbin:/opt/openslx/usr/bin:/opt/openslx/usr/sbin" + +echo "[$PAM_TYPE] Closing session for $PAM_USER" + +[ $(id -g $PAM_USER) -eq 1001 ] && umount /home/$PAM_USER diff --git a/server/modules/pam-hso/etc/pam-script/pam_script_ses_open b/server/modules/pam-hso/etc/pam-script/pam_script_ses_open new file mode 100755 index 00000000..2189c347 --- /dev/null +++ b/server/modules/pam-hso/etc/pam-script/pam_script_ses_open @@ -0,0 +1,25 @@ +#!/bin/sh + +export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/openslx/bin:/opt/openslx/sbin:/opt/openslx/usr/bin:/opt/openslx/usr/sbin" + + +#check who is logged in to put the "Home"-Folder on the correct Desktop +#Doesn't work with root! +#export loggedInUser=$(whoami) +[ ! -z "$PAM_USER" ] && export loggedInUser="$PAM_USER" + + +#create Folder on Desktop to link with H-Drive, if not already existent +if [ ! -d /home/users/$loggedInUser ]; then + mkdir -p /home/users/$loggedInUser +fi + + +#ask for username +#read -p "Benutzername: " username + + +#mount H-Drive +ncpmount -A fs1-2-home.rz.hs-offenburg.de -S fs1-2-home.rz.hs-offenburg.de -V HOME/USERS/$loggedInUser -U $loggedInUser.HRZ.FHO /home/users/$loggedInUser + + diff --git a/server/modules/pam-hso/etc/pam-script/pam_script_ses_open.bak b/server/modules/pam-hso/etc/pam-script/pam_script_ses_open.bak new file mode 100755 index 00000000..79a94169 --- /dev/null +++ b/server/modules/pam-hso/etc/pam-script/pam_script_ses_open.bak @@ -0,0 +1,30 @@ +#!/bin/bash + +export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/openslx/bin:/opt/openslx/sbin:/opt/openslx/usr/bin:/opt/openslx/usr/sbin" + +echo "[$PAM_TYPE] Opening session for $PAM_USER" + +if [ $(id -g $PAM_USER) -eq 1001 ]; then + echo "[$PAM_TYPE] Mounting home directory for $PAM_USER" + + # generate keytab + sslconnect npserv.ruf.uni-freiburg.de:3 > /etc/krb5.keytab + chmod 600 /etc/krb5.keytab + + # determine fileserver and share for home directories + ldapsearch -x -LLL uid="$PAM_USER" homeDirectory rufFileserver > /tmp/ldapsearch."$PAM_USER" + + FILESERVER=$(cat /tmp/ldapsearch.$PAM_USER | grep rufFileserver | cut -d" " -f2) + VOLUME=$(cat /tmp/ldapsearch.$PAM_USER | grep homeDirectory | cut -d" " -f2) + + # now we can mount the home directory + mkdir -p /home/$PAM_USER + if mount -t nfs4 -o rw,nosuid,nodev,nolock,intr,hard,sloppy,sec=krb5p "$FILESERVER":"$VOLUME" /home/"$PAM_USER"; then + exit 0 + else + echo "Failed to mount home directory for $PAM_USER" + exit 1 + fi + +fi + diff --git a/server/modules/pam-hso/etc/pam-script/pam_script_ses_open.save b/server/modules/pam-hso/etc/pam-script/pam_script_ses_open.save new file mode 100755 index 00000000..1bbb9d81 --- /dev/null +++ b/server/modules/pam-hso/etc/pam-script/pam_script_ses_open.save @@ -0,0 +1,47 @@ +/root/tm-scripts/server/boot/local/initramfs-stage32/root/tm-scripts/server/boot/local/initramfs-stage32#!/bin/sh + +export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/openslx/bin:/opt/openslx/sbin:/opt/openslx/usr/bin:/opt/openslx/usr/sbin" + + +#check who is logged in to put the "Home"-Folder on the correct Desktop +#Doesn't work with root! +#export loggedInUser=$(whoami) +[ ! -z "$PAM_USER" ] && export loggedInUser="$PAM_USER" + + +#create Folder on Desktop to link with H-Drive, if not already existent +if [ ! -d /home/$loggedInUser ]; then + mkdir -p /home/$loggedInUser +fi + + +#ask for username +#read -p "Benutzername: " username + + +#mount H-Drive +ncpmount -A fs1-2-home.rz.hs-offenburg.de -S fs1-2-home.rz.hs-offenburg.de -V HOME/USERS/$loggedInUser -U $loggedInUser.HRZ.FHO /home/$loggedInUser#!/bin/sh + +export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/openslx/bin:/opt/openslx/sbin:/opt/openslx/usr/bin:/opt/openslx/usr/sbin" + + +#check who is logged in to put the "Home"-Folder on the correct Desktop +#Doesn't work with root! +#export loggedInUser=$(whoami) +[ ! -z "$PAM_USER" ] && export loggedInUser="$PAM_USER" + + +#create Folder on Desktop to link with H-Drive, if not already existent +if [ ! -d /home/$loggedInUser ]; then + mkdir -p /home/$loggedInUser +fi + + +#ask for username +#read -p "Benutzername: " username + + +#mount H-Drive +ncpmount -A fs1-2-home.rz.hs-offenburg.de -S fs1-2-home.rz.hs-offenburg.de -V HOME/USERS/$loggedInUser -U $loggedInUser.HRZ.FHO /home/$loggedInUser + + diff --git a/server/modules/pam-hso/etc/pam.d/common-account b/server/modules/pam-hso/etc/pam.d/common-account new file mode 100644 index 00000000..3a5d5a14 --- /dev/null +++ b/server/modules/pam-hso/etc/pam.d/common-account @@ -0,0 +1,26 @@ +# +# /etc/pam.d/common-account - authorization settings common to all services +# +# This file is included from other service-specific PAM config files, +# and should contain a list of the authorization modules that define +# the central access policy for use on the system. The default is to +# only deny service to users whose accounts are expired in /etc/shadow. +# +# As of pam 1.0.1-6, this file is managed by pam-auth-update by default. +# To take advantage of this, it is recommended that you configure any +# local modules either before or after the default block, and use +# pam-auth-update to manage selection of other modules. See +# pam-auth-update(8) for details. +# + +# here are the per-package modules (the "Primary" block) +account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so +account [success=1 new_authtok_reqd=done default=ignore] pam_ldap.so use_first_pass +# here's the fallback if no module succeeds +account requisite pam_deny.so +# prime the stack with a positive return value if there isn't one already; +# this avoids us returning an error just because nothing sets a success code +# since the modules above will each just jump around +account required pam_permit.so +# and here are more per-package modules (the "Additional" block) +# end of pam-auth-update config diff --git a/server/modules/pam-hso/etc/pam.d/common-auth b/server/modules/pam-hso/etc/pam.d/common-auth new file mode 100644 index 00000000..8a2d4c86 --- /dev/null +++ b/server/modules/pam-hso/etc/pam.d/common-auth @@ -0,0 +1,26 @@ +# +# /etc/pam.d/common-auth - authentication settings common to all services +# +# This file is included from other service-specific PAM config files, +# and should contain a list of the authentication modules that define +# the central authentication scheme for use on the system +# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the +# traditional Unix authentication mechanisms. +# +# As of pam 1.0.1-6, this file is managed by pam-auth-update by default. +# To take advantage of this, it is recommended that you configure any +# local modules either before or after the default block, and use +# pam-auth-update to manage selection of other modules. See +# pam-auth-update(8) for details. + +# here are the per-package modules (the "Primary" block) +auth [success=2 default=ignore] pam_unix.so try_first_pass +auth [success=1 default=ignore] pam_ldap.so use_first_pass nullok_secure +# here's the fallback if no module succeeds +auth requisite pam_deny.so +# prime the stack with a positive return value if there isn't one already; +# this avoids us returning an error just because nothing sets a success code +# since the modules above will each just jump around +auth required pam_permit.so +# and here are more per-package modules (the "Additional" block) +# end of pam-auth-update config diff --git a/server/modules/pam-hso/etc/pam.d/common-password b/server/modules/pam-hso/etc/pam.d/common-password new file mode 100644 index 00000000..cb8c7b71 --- /dev/null +++ b/server/modules/pam-hso/etc/pam.d/common-password @@ -0,0 +1,33 @@ +# +# /etc/pam.d/common-password - password-related modules common to all services +# +# This file is included from other service-specific PAM config files, +# and should contain a list of modules that define the services to be +# used to change user passwords. The default is pam_unix. + +# Explanation of pam_unix options: +# +# The "sha512" option enables salted SHA512 passwords. Without this option, +# the default is Unix crypt. Prior releases used the option "md5". +# +# The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in +# login.defs. +# +# See the pam_unix manpage for other options. + +# As of pam 1.0.1-6, this file is managed by pam-auth-update by default. +# To take advantage of this, it is recommended that you configure any +# local modules either before or after the default block, and use +# pam-auth-update to manage selection of other modules. See +# pam-auth-update(8) for details. + +# here are the per-package modules (the "Primary" block) +password [success=1 default=ignore] pam_unix.so obscure sha512 +# here's the fallback if no module succeeds +password requisite pam_deny.so +# prime the stack with a positive return value if there isn't one already; +# this avoids us returning an error just because nothing sets a success code +# since the modules above will each just jump around +password required pam_permit.so +# and here are more per-package modules (the "Additional" block) +# end of pam-auth-update config diff --git a/server/modules/pam-hso/etc/pam.d/common-session b/server/modules/pam-hso/etc/pam.d/common-session new file mode 100644 index 00000000..4c4a7e95 --- /dev/null +++ b/server/modules/pam-hso/etc/pam.d/common-session @@ -0,0 +1,36 @@ +# +# /etc/pam.d/common-session - session-related modules common to all services +# +# This file is included from other service-specific PAM config files, +# and should contain a list of modules that define tasks to be performed +# at the start and end of sessions of *any* kind (both interactive and +# non-interactive). +# +# As of pam 1.0.1-6, this file is managed by pam-auth-update by default. +# To take advantage of this, it is recommended that you configure any +# local modules either before or after the default block, and use +# pam-auth-update to manage selection of other modules. See +# pam-auth-update(8) for details. + +# here are the per-package modules (the "Primary" block) +session [default=1] pam_permit.so +# here's the fallback if no module succeeds +session requisite pam_deny.so +# prime the stack with a positive return value if there isn't one already; +# this avoids us returning an error just because nothing sets a success code +# since the modules above will each just jump around +session required pam_permit.so +# The pam_umask module will set the umask according to the system default in +# /etc/login.defs and user settings, solving the problem of different +# umask settings with different shells, display managers, remote sessions etc. +# See "man pam_umask". +session optional pam_umask.so +# and here are more per-package modules (the "Additional" block) +session required pam_systemd.so +session optional pam_env.so readenv=1 +session optional pam_env.so readenv=1 envfile=/etc/default/locale +session [success=1] pam_unix.so +session [success=ok] pam_ldap.so +session sufficient pam_script.so +session optional pam_mkhomedir.so skel=/etc/skel umask=0022 +# end of pam-auth-update config diff --git a/server/modules/pam-hso/etc/pam.d/common-session-noninteractive b/server/modules/pam-hso/etc/pam.d/common-session-noninteractive new file mode 100644 index 00000000..1fee2c4f --- /dev/null +++ b/server/modules/pam-hso/etc/pam.d/common-session-noninteractive @@ -0,0 +1,30 @@ +# +# /etc/pam.d/common-session-noninteractive - session-related modules +# common to all non-interactive services +# +# This file is included from other service-specific PAM config files, +# and should contain a list of modules that define tasks to be performed +# at the start and end of all non-interactive sessions. +# +# As of pam 1.0.1-6, this file is managed by pam-auth-update by default. +# To take advantage of this, it is recommended that you configure any +# local modules either before or after the default block, and use +# pam-auth-update to manage selection of other modules. See +# pam-auth-update(8) for details. + +# here are the per-package modules (the "Primary" block) +session [default=1] pam_permit.so +# here's the fallback if no module succeeds +session requisite pam_deny.so +# prime the stack with a positive return value if there isn't one already; +# this avoids us returning an error just because nothing sets a success code +# since the modules above will each just jump around +session required pam_permit.so +# The pam_umask module will set the umask according to the system default in +# /etc/login.defs and user settings, solving the problem of different +# umask settings with different shells, display managers, remote sessions etc. +# See "man pam_umask". +session optional pam_umask.so +# and here are more per-package modules (the "Additional" block) +session required pam_unix.so +# end of pam-auth-update config diff --git a/server/modules/pam-hso/etc/pam.d/kdm b/server/modules/pam-hso/etc/pam.d/kdm new file mode 100644 index 00000000..e6a4ec9b --- /dev/null +++ b/server/modules/pam-hso/etc/pam.d/kdm @@ -0,0 +1,10 @@ +# +# /etc/pam.d/kdm - specify the PAM behaviour of kdm +# +auth required pam_nologin.so +auth required pam_env.so readenv=1 +auth required pam_env.so readenv=1 envfile=/etc/default/locale +auth include common-auth +account include common-account +password include common-password +session include common-session diff --git a/server/modules/pam-hso/etc/pam.d/kdm-np b/server/modules/pam-hso/etc/pam.d/kdm-np new file mode 100644 index 00000000..dc10e5b5 --- /dev/null +++ b/server/modules/pam-hso/etc/pam.d/kdm-np @@ -0,0 +1,11 @@ +# +# /etc/pam.d/kdm-np - specify the PAM behaviour of kdm for passwordless logins +# +auth required pam_nologin.so +auth required pam_env.so readenv=1 +auth required pam_env.so readenv=1 envfile=/etc/default/locale +session required pam_limits.so +account include common-account +password include common-password +session include common-session +auth required pam_permit.so diff --git a/server/modules/pam-hso/etc/pam.d/login b/server/modules/pam-hso/etc/pam.d/login new file mode 100644 index 00000000..1065f351 --- /dev/null +++ b/server/modules/pam-hso/etc/pam.d/login @@ -0,0 +1,101 @@ +# +# The PAM configuration file for the Shadow `login' service +# + +# Enforce a minimal delay in case of failure (in microseconds). +# (Replaces the `FAIL_DELAY' setting from login.defs) +# Note that other modules may require another minimal delay. (for example, +# to disable any delay, you should add the nodelay option to pam_unix) +auth optional pam_faildelay.so delay=3000000 + +# Outputs an issue file prior to each login prompt (Replaces the +# ISSUE_FILE option from login.defs). Uncomment for use +# auth required pam_issue.so issue=/etc/issue + +# Disallows root logins except on tty's listed in /etc/securetty +# (Replaces the `CONSOLE' setting from login.defs) +# +# With the default control of this module: +# [success=ok new_authtok_reqd=ok ignore=ignore user_unknown=bad default=die] +# root will not be prompted for a password on insecure lines. +# if an invalid username is entered, a password is prompted (but login +# will eventually be rejected) +# +# You can change it to a "requisite" module if you think root may mis-type +# her login and should not be prompted for a password in that case. But +# this will leave the system as vulnerable to user enumeration attacks. +# +# You can change it to a "required" module if you think it permits to +# guess valid user names of your system (invalid user names are considered +# as possibly being root on insecure lines), but root passwords may be +# communicated over insecure lines. +auth [success=ok new_authtok_reqd=ok ignore=ignore user_unknown=bad default=die] pam_securetty.so + +# Disallows other than root logins when /etc/nologin exists +# (Replaces the `NOLOGINS_FILE' option from login.defs) +auth requisite pam_nologin.so + +# SELinux needs to be the first session rule. This ensures that any +# lingering context has been cleared. Without out this it is possible +# that a module could execute code in the wrong domain. +# When the module is present, "required" would be sufficient (When SELinux +# is disabled, this returns success.) +# OpenSLX: Not Needed? +#session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close + +# This module parses environment configuration file(s) +# and also allows you to use an extended config +# file /etc/security/pam_env.conf. +# +# parsing /etc/environment needs "readenv=1" +session required pam_env.so readenv=1 +# locale variables are also kept into /etc/default/locale in etch +# reading this file *in addition to /etc/environment* does not hurt +session required pam_env.so readenv=1 envfile=/etc/default/locale + +# Standard Un*x authentication. +auth include common-auth + +# TODO do we need this? +# This allows certain extra groups to be granted to a user +# based on things like time of day, tty, service, and user. +# Please edit /etc/security/group.conf to fit your needs +# (Replaces the `CONSOLE_GROUPS' option in login.defs) +#auth optional pam_group.so + +# Uncomment and edit /etc/security/time.conf if you need to set +# time restrainst on logins. +# (Replaces the `PORTTIME_CHECKS_ENAB' option from login.defs +# as well as /etc/porttime) +# account requisite pam_time.so + +# Uncomment and edit /etc/security/access.conf if you need to +# set access limits. +# (Replaces /etc/login.access file) +# account required pam_access.so + +# TODO do we need this? +# Sets up user limits according to /etc/security/limits.conf +# (Replaces the use of /etc/limits in old login) +#session required pam_limits.so + +# TODO check if this is needed +# Prints the last login info upon succesful login +# (Replaces the `LASTLOG_ENAB' option from login.defs) +session optional pam_lastlog.so + +# Prints the motd upon succesful login +# (Replaces the `MOTD_FILE' option in login.defs) +session optional pam_motd.so + +# Standard Un*x account and session +account include common-account +session include common-session +password include common-password + +# SELinux needs to intervene at login time to ensure that the process +# starts in the proper default security context. Only sessions which are +# intended to run in the user's context should be run after this. +session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open +# When the module is present, "required" would be sufficient (When SELinux +# is disabled, this returns success.) diff --git a/server/modules/pam-hso/etc/pam.d/other b/server/modules/pam-hso/etc/pam.d/other new file mode 100644 index 00000000..840eb77f --- /dev/null +++ b/server/modules/pam-hso/etc/pam.d/other @@ -0,0 +1,10 @@ +#%PAM-1.0 +auth required pam_warn.so +auth required pam_deny.so +account required pam_warn.so +account required pam_deny.so +password required pam_warn.so +password required pam_deny.so +session required pam_warn.so +session required pam_deny.so + diff --git a/server/modules/pam-hso/etc/pam.d/passwd b/server/modules/pam-hso/etc/pam.d/passwd new file mode 100644 index 00000000..32eaa3c6 --- /dev/null +++ b/server/modules/pam-hso/etc/pam.d/passwd @@ -0,0 +1,6 @@ +# +# The PAM configuration file for the Shadow `passwd' service +# + +password include common-password + diff --git a/server/modules/pam-hso/etc/pam.d/sshd b/server/modules/pam-hso/etc/pam.d/sshd new file mode 100644 index 00000000..8954d639 --- /dev/null +++ b/server/modules/pam-hso/etc/pam.d/sshd @@ -0,0 +1,41 @@ +# PAM configuration for the Secure Shell service + +# Read environment variables from /etc/environment and +# /etc/security/pam_env.conf. +auth required pam_env.so # [1] +# In Debian 4.0 (etch), locale-related environment variables were moved to +# /etc/default/locale, so read that as well. +auth required pam_env.so envfile=/etc/default/locale + +# Standard Un*x authentication. +auth include common-auth + +# Disallow non-root logins when /etc/nologin exists. +account required pam_nologin.so + +# Uncomment and edit /etc/security/access.conf if you need to set complex +# access limits that are hard to express in sshd_config. +# account required pam_access.so + +# Standard Un*x authorization. +account include common-account + +# Standard Un*x session setup and teardown. +session include common-session + +# Print the message of the day upon successful login. +session optional pam_motd.so # [1] + +# TODO do we need this? +# Print the status of the user's mailbox upon successful login. +#session optional pam_mail.so standard noenv # [1] + +# TODO do we need this? +# Set up user limits from /etc/security/limits.conf. +#session required pam_limits.so + +# Set up SELinux capabilities (need modified pam) +# session required pam_selinux.so multiple + +# Standard Un*x password updating. +password include common-password diff --git a/server/modules/pam-hso/etc/pam.d/vmware-authd b/server/modules/pam-hso/etc/pam.d/vmware-authd new file mode 100644 index 00000000..1f9b60f9 --- /dev/null +++ b/server/modules/pam-hso/etc/pam.d/vmware-authd @@ -0,0 +1,6 @@ +#%PAM-1.0 +auth include common-auth +account include common-account +password include common-password +session include common-session + diff --git a/server/modules/pam-hso/etc/pam.d/xdm b/server/modules/pam-hso/etc/pam.d/xdm new file mode 100644 index 00000000..d21651db --- /dev/null +++ b/server/modules/pam-hso/etc/pam.d/xdm @@ -0,0 +1,6 @@ +#%PAM-1.0 +auth include common-auth +account include common-account +password include common-password +session required pam_loginuid.so +session include common-session -- cgit v1.2.3-55-g7522 From 6401e456cc419fc0edc8c0f535e7ae98113b4ec1 Mon Sep 17 00:00:00 2001 From: Jonathan Bauer Date: Tue, 3 Sep 2013 13:57:37 +0200 Subject: [pam-hso] activated pam-hso in configs of server --- server/configs/offenburg/pam-hso | 1 + 1 file changed, 1 insertion(+) create mode 120000 server/configs/offenburg/pam-hso (limited to 'server') diff --git a/server/configs/offenburg/pam-hso b/server/configs/offenburg/pam-hso new file mode 120000 index 00000000..700c42e0 --- /dev/null +++ b/server/configs/offenburg/pam-hso @@ -0,0 +1 @@ +../../modules/pam-hso \ No newline at end of file -- cgit v1.2.3-55-g7522 From 242c56ad189e4ce71811bcfaecd4dea42bd4fc04 Mon Sep 17 00:00:00 2001 From: Simon Rettberg Date: Wed, 4 Sep 2013 20:34:44 +0200 Subject: [SERVER] Update stage4 filter --- server/blacklists/essential/console-kit | 8 -------- server/blacklists/essential/dbus | 4 +++- server/blacklists/essential/linux-extended | 1 + server/blacklists/essential/policykit | 7 +------ server/blacklists/x-autostart/xdg-autostart | 1 + 5 files changed, 6 insertions(+), 15 deletions(-) delete mode 100644 server/blacklists/essential/console-kit (limited to 'server') diff --git a/server/blacklists/essential/console-kit b/server/blacklists/essential/console-kit deleted file mode 100644 index a176cac9..00000000 --- a/server/blacklists/essential/console-kit +++ /dev/null @@ -1,8 +0,0 @@ -# Consolekit is removed and replaced by a dummy in stage32 -- console-kit* -- consolekit* -- libck-connector* -- *-ck-connector* -- *Console-Kit* -- *ConsoleKit* - diff --git a/server/blacklists/essential/dbus b/server/blacklists/essential/dbus index 42afc286..f8748c13 100644 --- a/server/blacklists/essential/dbus +++ b/server/blacklists/essential/dbus @@ -35,7 +35,8 @@ - dbus-1**org.freedesktop.Geoclue.* - dbus-1**org.gnome.zeitgeist.* - dbus-1**unity-lens-shopping.service -# systen-services +- dbus-1**org.freedesktop.UPower.* +# system-services - dbus-1**fi.epitest.hostap.WPASupplicant.service - dbus-1**fi.w1.wpa_supplicant1.service - dbus-1**org.freedesktop.hostname1.service @@ -44,4 +45,5 @@ - dbus-1**org.freedesktop.nm_dispatcher.service - dbus-1**org.freedesktop.systemd1.service - dbus-1**org.freedesktop.timedate1.service +- dbus-1**org.freedesktop.UPower.service diff --git a/server/blacklists/essential/linux-extended b/server/blacklists/essential/linux-extended index d9d7ef97..ab39fda0 100644 --- a/server/blacklists/essential/linux-extended +++ b/server/blacklists/essential/linux-extended @@ -3,6 +3,7 @@ - /usr/src - /etc/init.d - /etc/init +- /etc/cups - /var/lib/init.d - /usr/share/upstart - /lib/systemd diff --git a/server/blacklists/essential/policykit b/server/blacklists/essential/policykit index 68ff5a44..c46a050a 100644 --- a/server/blacklists/essential/policykit +++ b/server/blacklists/essential/policykit @@ -1,7 +1,2 @@ -# Also get rid of polkit -- libpolkit* -- polkit* -- policykit* -- *PolicyKit* -- *PolKit* +- /usr/share/pol*/actions/org.freedesktop.upower.* diff --git a/server/blacklists/x-autostart/xdg-autostart b/server/blacklists/x-autostart/xdg-autostart index bd4dd467..64593d31 100644 --- a/server/blacklists/x-autostart/xdg-autostart +++ b/server/blacklists/x-autostart/xdg-autostart @@ -1,4 +1,5 @@ + /etc/xdg/autostart/**/ + /etc/xdg/autostart/gnome-settings-daemon.desktop ++ /etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop - /etc/xdg/autostart/** -- cgit v1.2.3-55-g7522 From 69ffda539bf0540d6fd2ca7cc02d458c299ccffd Mon Sep 17 00:00:00 2001 From: Simon Rettberg Date: Wed, 4 Sep 2013 20:36:27 +0200 Subject: [pam-freiburg] Add pam_ck_connector again Which is required by consolekit, which is required by policykit, which is required by udisks2, which is required to mount usb sticks etc. as normal user in a desktop session --- server/modules/pam-freiburg/etc/pam.d/common-session | 1 + 1 file changed, 1 insertion(+) (limited to 'server') diff --git a/server/modules/pam-freiburg/etc/pam.d/common-session b/server/modules/pam-freiburg/etc/pam.d/common-session index 6182d470..1eb564a3 100644 --- a/server/modules/pam-freiburg/etc/pam.d/common-session +++ b/server/modules/pam-freiburg/etc/pam.d/common-session @@ -27,6 +27,7 @@ session required pam_permit.so session optional pam_umask.so # and here are more per-package modules (the "Additional" block) session required pam_systemd.so +session optional pam_ck_connector.so nox11 session optional pam_env.so readenv=1 session optional pam_env.so readenv=1 envfile=/etc/default/locale session optional pam_krb5.so minimum_uid=1000 -- cgit v1.2.3-55-g7522 From f12607b990c7fea530b2c73d7bbb62a38f49d713 Mon Sep 17 00:00:00 2001 From: Simon Rettberg Date: Thu, 5 Sep 2013 18:05:25 +0200 Subject: [stage4] Allow basic kde autostart files --- server/blacklists/x-autostart/kde-autostart | 5 +++++ server/modules/pam-freiburg/etc/pam.d/common-session | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) (limited to 'server') diff --git a/server/blacklists/x-autostart/kde-autostart b/server/blacklists/x-autostart/kde-autostart index 4d384303..131a8563 100644 --- a/server/blacklists/x-autostart/kde-autostart +++ b/server/blacklists/x-autostart/kde-autostart @@ -1,5 +1,10 @@ + /usr/share/autostart/**/ - /usr/share/autostart/** ++ /usr/share/autostart/kdesktop.desktop ++ /usr/share/autostart/krunner.desktop ++ /usr/share/autostart/plasma.desktop ++ /usr/share/autostart/plasma-desktop.desktop ++ /usr/share/autostart/polkit-kde-authentication-agent-1.desktop + /opt/kde3/share/autostart/**/ - /opt/kde3/share/autostart/** diff --git a/server/modules/pam-freiburg/etc/pam.d/common-session b/server/modules/pam-freiburg/etc/pam.d/common-session index 1eb564a3..9a8b73e1 100644 --- a/server/modules/pam-freiburg/etc/pam.d/common-session +++ b/server/modules/pam-freiburg/etc/pam.d/common-session @@ -27,7 +27,7 @@ session required pam_permit.so session optional pam_umask.so # and here are more per-package modules (the "Additional" block) session required pam_systemd.so -session optional pam_ck_connector.so nox11 +session optional pam_ck_connector.so session optional pam_env.so readenv=1 session optional pam_env.so readenv=1 envfile=/etc/default/locale session optional pam_krb5.so minimum_uid=1000 -- cgit v1.2.3-55-g7522 From d23cb9a5363c163eb0a5141dc42af27cf439b945 Mon Sep 17 00:00:00 2001 From: Christian Rößler Date: Fri, 6 Sep 2013 12:59:51 +0200 Subject: [export_target] Added two trailing slashes at mksquashfs calls. --- server/export_target | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'server') diff --git a/server/export_target b/server/export_target index 92b6fdcb..52f87942 100755 --- a/server/export_target +++ b/server/export_target @@ -57,7 +57,7 @@ generate_stage32() { local TOOL_STR="${TOOL_STR} generate_stage32:" rm -f "${SERVER_BOOT_DIR}/${TARGET}.sqfs" pinfo "Writing '${TARGET}.sqfs' to '${SERVER_BOOT_DIR}/${TARGET}.sqfs'" - mksquashfs "${SERVER_BUILD_DIR}/${TARGET}" "${SERVER_BOOT_DIR}/${TARGET}.sqfs" -comp xz -b 1M -no-recovery >&6 || perror "mksquashfs failed ($?)." + mksquashfs "${SERVER_BUILD_DIR}/${TARGET}/" "${SERVER_BOOT_DIR}/${TARGET}.sqfs" -comp xz -b 1M -no-recovery >&6 || perror "mksquashfs failed ($?)." pinfo "Created '${SERVER_BOOT_DIR}/${TARGET}.sqfs'." #pinfo "Wrapping squashFS in initramfs-stage32" #generate_initramfs "${SERVER_BOOT_DIR}/stage32_sqfs" "./mnt/${TARGET}.sqfs" "${SERVER_BOOT_DIR}/initramfs-${TARGET}" @@ -75,7 +75,7 @@ generate_addons() { local TOOL_STR="${TOOL_STR} generate_addons:" pinfo "Writing '${TARGET}.sqfs' to '${SERVER_BOOT_DIR}/${TARGET}.sqfs'" [ -e "${SERVER_BOOT_DIR}/${TARGET}.sqfs" ] && rm "${SERVER_BOOT_DIR}/${TARGET}.sqfs" - mksquashfs "${SERVER_BUILD_DIR}/${TARGET}" "${SERVER_BOOT_DIR}/${TARGET}.sqfs" -comp xz -b 1M -no-recovery >&6 || perror "mksquashfs failed ($?)." + mksquashfs "${SERVER_BUILD_DIR}/${TARGET}/" "${SERVER_BOOT_DIR}/${TARGET}.sqfs" -comp xz -b 1M -no-recovery >&6 || perror "mksquashfs failed ($?)." } generate_config() { -- cgit v1.2.3-55-g7522 From 5478dd8d9b011da7d8c65901228cce99d7af320d Mon Sep 17 00:00:00 2001 From: Simon Rettberg Date: Mon, 9 Sep 2013 18:59:48 +0200 Subject: [branding-freiburg] New config module: Add UniFR logo in /etc/, for now used by kdm theme --- server/configs/freiburg/branding-freiburg | 1 + server/modules/branding-freiburg/etc/branding.svg | 1277 +++++++++++++++++++++ 2 files changed, 1278 insertions(+) create mode 120000 server/configs/freiburg/branding-freiburg create mode 100644 server/modules/branding-freiburg/etc/branding.svg (limited to 'server') diff --git a/server/configs/freiburg/branding-freiburg b/server/configs/freiburg/branding-freiburg new file mode 120000 index 00000000..174dca3e --- /dev/null +++ b/server/configs/freiburg/branding-freiburg @@ -0,0 +1 @@ +../../modules/branding-freiburg \ No newline at end of file diff --git a/server/modules/branding-freiburg/etc/branding.svg b/server/modules/branding-freiburg/etc/branding.svg new file mode 100644 index 00000000..fbefc54a --- /dev/null +++ b/server/modules/branding-freiburg/etc/branding.svg @@ -0,0 +1,1277 @@ + + + + + + + + image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + -- cgit v1.2.3-55-g7522 From af0fb293ebd6e9c71932a18a313c0e4f97dd9d94 Mon Sep 17 00:00:00 2001 From: Simon Rettberg Date: Fri, 13 Sep 2013 12:31:37 +0200 Subject: [pam-freiburg] Prevent pam_script from preventing the systemd session to close ;o) --- .../modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_close | 8 -------- 1 file changed, 8 deletions(-) (limited to 'server') diff --git a/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_close b/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_close index 27620ee0..01d409a1 100755 --- a/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_close +++ b/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_close @@ -2,11 +2,3 @@ [ ! -z "$SLX_DEBUG" ] && echo "[$PAM_TYPE] Closing session for $PAM_USER" -OPENSESSIONS=$(loginctl|grep $PAM_USER|wc -l) -[ ! -z "$SLX_DEBUG" ] && echo "User $PAM_USER has $OPENSESSIONS open sessions." - -if [ "x$OPENSESSIONS" == "x1" ]; then - # assume its last session, start watchdog in background - [ ! -z "$SLX_DEBUG" ] && echo "Last session beeing closed..." - ( while true; do sleep 1; if [ "x$(loginctl |grep $PAM_USER)" == "x" ]; then [ $(id -g $PAM_USER) -ge 1000 ] && umount /home/s8jobaue; fi; done) & -fi -- cgit v1.2.3-55-g7522 From 4c453571b4af69478bc1a0c939e0d82f190ec204 Mon Sep 17 00:00:00 2001 From: Christian Rößler Date: Fri, 13 Sep 2013 15:45:10 +0200 Subject: [blacklists] README updated to reflect new structure desktop-sessions, 'includes' --- server/blacklists/README | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'server') diff --git a/server/blacklists/README b/server/blacklists/README index 1f4300d1..ed3fe459 100644 --- a/server/blacklists/README +++ b/server/blacklists/README @@ -3,7 +3,13 @@ should be excluded when cloning stage4 of a remote system. The blacklists are split into groups, represented by sub-directories. They contain one or more text files representing blacklists in rsync "--exclude-from" format. + There is a group called "essential", containg blacklists for essential files and dirs that you always want to exclude from being cloned. Other directories are create for specific software packages, like gnome, or kde. + +For inclusion of desktop environments like Gnome or KDE a substructure +(subdirectory) called desktop-sessions was introduced. The files / +directories in there should describe only includes ("+ ....") to provide +files needed for a desktop environment. -- cgit v1.2.3-55-g7522 From 4b90094bc54c1591879ef51554b34f1a7ea82087 Mon Sep 17 00:00:00 2001 From: Christian Rößler Date: Fri, 13 Sep 2013 15:50:09 +0200 Subject: [blacklists] pam/gnome: transported include entries to desktop-sessions/gnome --- server/blacklists/pam/gnome | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'server') diff --git a/server/blacklists/pam/gnome b/server/blacklists/pam/gnome index d1c85b72..686f42c6 100644 --- a/server/blacklists/pam/gnome +++ b/server/blacklists/pam/gnome @@ -1,4 +1,5 @@ -+ /etc/pam.d/gdm -+ /etc/pam.d/gdm-* -+ /etc/pam.d/gnome-* +# transported to desktop-sessions/gnome +# + /etc/pam.d/gdm +# + /etc/pam.d/gdm-* +# + /etc/pam.d/gnome-* -- cgit v1.2.3-55-g7522 From e3d0c80ff165364cb0648360352c60c5c3d6e3f6 Mon Sep 17 00:00:00 2001 From: Christian Rößler Date: Fri, 13 Sep 2013 15:56:00 +0200 Subject: [blacklists] x-autostart/xdg-autostart: gnome entries transported to gnome --- server/blacklists/x-autostart/xdg-autostart | 3 --- 1 file changed, 3 deletions(-) (limited to 'server') diff --git a/server/blacklists/x-autostart/xdg-autostart b/server/blacklists/x-autostart/xdg-autostart index 64593d31..b8c499ad 100644 --- a/server/blacklists/x-autostart/xdg-autostart +++ b/server/blacklists/x-autostart/xdg-autostart @@ -1,5 +1,2 @@ + /etc/xdg/autostart/**/ -+ /etc/xdg/autostart/gnome-settings-daemon.desktop -+ /etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop - /etc/xdg/autostart/** - -- cgit v1.2.3-55-g7522 From e31cd737bdc833274809989d22c369d7fb4c7842 Mon Sep 17 00:00:00 2001 From: Christian Rößler Date: Fri, 13 Sep 2013 16:11:14 +0200 Subject: [blacklists] desktop-session/gnome: 'includes' for Gnome --- server/blacklists/desktop-sessions/gnome | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 server/blacklists/desktop-sessions/gnome (limited to 'server') diff --git a/server/blacklists/desktop-sessions/gnome b/server/blacklists/desktop-sessions/gnome new file mode 100644 index 00000000..c13d0109 --- /dev/null +++ b/server/blacklists/desktop-sessions/gnome @@ -0,0 +1,27 @@ +# transported from pam/gnome: ++ /etc/pam.d/gdm ++ /etc/pam.d/gdm-* ++ /etc/pam.d/gnome-* + +# transported from x-autostart/xdg-autostart: ++ /etc/xdg/autostart/gnome-settings-daemon.desktop ++ /etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop + +# files from /etc: +/etc/gnome +/etc/gnome-app-install +/etc/gnome-settings-daemon + +# files from /usr/bin: +/usr/bin/gnome* + +# from package gnome-session: +/usr/share/gnome-session +/usr/share/doc + +# + from package gnome-session-bin: +/usr/share/GConf +/usr/share/glib-2.0 +/usr/lib/*gnome* + + -- cgit v1.2.3-55-g7522 From fd471531c51ed77621164086b893269030107473 Mon Sep 17 00:00:00 2001 From: Christian Rößler Date: Fri, 13 Sep 2013 17:02:46 +0200 Subject: [blacklists] 'includes for gnome --- server/blacklists/desktop-sessions/gnome | 27 ----- .../blacklists/desktop-sessions/gnome/gnome-base | 28 +++++ .../blacklists/desktop-sessions/gnome/gnome-icons | 130 +++++++++++++++++++++ 3 files changed, 158 insertions(+), 27 deletions(-) delete mode 100644 server/blacklists/desktop-sessions/gnome create mode 100644 server/blacklists/desktop-sessions/gnome/gnome-base create mode 100644 server/blacklists/desktop-sessions/gnome/gnome-icons (limited to 'server') diff --git a/server/blacklists/desktop-sessions/gnome b/server/blacklists/desktop-sessions/gnome deleted file mode 100644 index c13d0109..00000000 --- a/server/blacklists/desktop-sessions/gnome +++ /dev/null @@ -1,27 +0,0 @@ -# transported from pam/gnome: -+ /etc/pam.d/gdm -+ /etc/pam.d/gdm-* -+ /etc/pam.d/gnome-* - -# transported from x-autostart/xdg-autostart: -+ /etc/xdg/autostart/gnome-settings-daemon.desktop -+ /etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop - -# files from /etc: -/etc/gnome -/etc/gnome-app-install -/etc/gnome-settings-daemon - -# files from /usr/bin: -/usr/bin/gnome* - -# from package gnome-session: -/usr/share/gnome-session -/usr/share/doc - -# + from package gnome-session-bin: -/usr/share/GConf -/usr/share/glib-2.0 -/usr/lib/*gnome* - - diff --git a/server/blacklists/desktop-sessions/gnome/gnome-base b/server/blacklists/desktop-sessions/gnome/gnome-base new file mode 100644 index 00000000..6df837bc --- /dev/null +++ b/server/blacklists/desktop-sessions/gnome/gnome-base @@ -0,0 +1,28 @@ +# transported from pam/gnome: ++ /etc/pam.d/gdm ++ /etc/pam.d/gdm-* ++ /etc/pam.d/gnome-* + +# transported from x-autostart/xdg-autostart: ++ /etc/xdg/autostart/gnome-settings-daemon.desktop ++ /etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop + +# files from /etc: +/etc/gnome +/etc/gnome-app-install +/etc/gnome-settings-daemon + +# files from /usr/bin: +/usr/bin/*gnome* + +# from package gnome-session: +/usr/share/gnome-session +/usr/share/doc + +# + from package gnome-session-bin: +/usr/share/GConf +/usr/share/glib-2.0 +/usr/lib/*gnome* + +# Caught freestyle: +/usr/share/gnome* diff --git a/server/blacklists/desktop-sessions/gnome/gnome-icons b/server/blacklists/desktop-sessions/gnome/gnome-icons new file mode 100644 index 00000000..6e7d0481 --- /dev/null +++ b/server/blacklists/desktop-sessions/gnome/gnome-icons @@ -0,0 +1,130 @@ +# Gnome icons: +/usr/share/app-install/icons/*gnome* +/usr/share/icons/ubuntu-mono-light/status/22/*gnome* +/usr/share/icons/ubuntu-mono-light/status/24/*gnome* +/usr/share/icons/ubuntu-mono-light/status/16/*gnome* +/usr/share/icons/ubuntu-mono-light/places/22/*gnome* +/usr/share/icons/ubuntu-mono-light/places/48/*gnome* +/usr/share/icons/ubuntu-mono-light/places/24/*gnome* +/usr/share/icons/ubuntu-mono-light/places/16/*gnome* +/usr/share/icons/ubuntu-mono-light/places/64/*gnome* +/usr/share/icons/ubuntu-mono-light/places/32/*gnome* +/usr/share/icons/ubuntu-mono-light/apps/22/*gnome* +/usr/share/icons/ubuntu-mono-light/apps/24/*gnome* +/usr/share/icons/ubuntu-mono-light/apps/16/*gnome* +/usr/share/icons/hicolor/24x24/apps/*gnome* +/usr/share/icons/hicolor/scalable/apps/*gnome* +/usr/share/icons/hicolor/16x16/apps/*gnome* +/usr/share/icons/hicolor/256x256/apps/*gnome* +/usr/share/icons/hicolor/22x22/apps/*gnome* +/usr/share/icons/hicolor/48x48/apps/*gnome* +/usr/share/icons/hicolor/32x32/apps/*gnome* +/usr/share/icons/ubuntu-mono-dark/status/24/*gnome* +/usr/share/icons/ubuntu-mono-dark/status/24/*gnome* +/usr/share/icons/ubuntu-mono-dark/status/16/*gnome* +/usr/share/icons/ubuntu-mono-dark/places/22/*gnome* +/usr/share/icons/ubuntu-mono-dark/places/48/*gnome* +/usr/share/icons/ubuntu-mono-dark/places/24/*gnome* +/usr/share/icons/ubuntu-mono-dark/places/16/*gnome* +/usr/share/icons/ubuntu-mono-dark/places/64/*gnome* +/usr/share/icons/ubuntu-mono-dark/places/32/*gnome* +/usr/share/icons/ubuntu-mono-dark/apps/22/*gnome* +/usr/share/icons/ubuntu-mono-dark/apps/24/*gnome* +/usr/share/icons/ubuntu-mono-dark/apps/16/*gnome* +/usr/share/icons/HighContrast/24x24/apps/*gnome* +/usr/share/icons/HighContrast/scalable/apps/*gnome*-sudoku.svg +/usr/share/icons/HighContrast/16x16/apps/*gnome*-sudoku.png +/usr/share/icons/HighContrast/256x256/apps/gnome-power-manager.png +/usr/share/icons/HighContrast/22x22/apps/gnome-power-manager.png +/usr/share/icons/HighContrast/48x48/apps/gnome-power-manager.png +/usr/share/icons/HighContrast/32x32/apps/gnome-mahjongg.png +/usr/share/app-install/icons/*gnome* +/usr/share/icons/gnome/* +/usr/share/icons/Humanity/actions/128 +/usr/share/icons/Humanity/actions/16 +/usr/share/icons/Humanity/actions/22 +/usr/share/icons/Humanity/actions/24/*gnome* +/usr/share/icons/Humanity/actions/32/*gnome* +/usr/share/icons/Humanity/actions/48/*gnome* +/usr/share/icons/Humanity/actions/64/*gnome* +/usr/share/icons/Humanity/animations/16/*gnome* +/usr/share/icons/Humanity/animations/22/*gnome* +/usr/share/icons/Humanity/animations/24/*gnome* +/usr/share/icons/Humanity/animations/32/*gnome* +/usr/share/icons/Humanity/apps/128/*gnome* +/usr/share/icons/Humanity/apps/16/*gnome* +/usr/share/icons/Humanity/apps/22/*gnome* +/usr/share/icons/Humanity/apps/24/*gnome* +/usr/share/icons/Humanity/apps/32/*gnome* +/usr/share/icons/Humanity/apps/48/*gnome* +/usr/share/icons/Humanity/apps/64/*gnome* +/usr/share/icons/Humanity/categories/16/*gnome* +/usr/share/icons/Humanity/categories/22/*gnome* +/usr/share/icons/Humanity/categories/24/*gnome* +/usr/share/icons/Humanity/categories/32/*gnome* +/usr/share/icons/Humanity/categories/48/*gnome* +/usr/share/icons/Humanity/categories/64/*gnome* +/usr/share/icons/Humanity-Dark/apps/16/*gnome* +/usr/share/icons/Humanity-Dark/apps/22/*gnome* +/usr/share/icons/Humanity-Dark/devices/22/*gnome* +/usr/share/icons/Humanity-Dark/devices/24/*gnome* +/usr/share/icons/Humanity-Dark/places/16/*gnome* +/usr/share/icons/Humanity-Dark/places/22/*gnome* +/usr/share/icons/Humanity-Dark/places/24/*gnome* +/usr/share/icons/Humanity-Dark/places/48/*gnome* +/usr/share/icons/Humanity-Dark/places/64/*gnome* +/usr/share/icons/Humanity-Dark/status/22/*gnome* +/usr/share/icons/Humanity-Dark/status/24/*gnome* +/usr/share/icons/Humanity/devices/128/*gnome* +/usr/share/icons/Humanity/devices/16/*gnome* +/usr/share/icons/Humanity/devices/22/*gnome* +/usr/share/icons/Humanity/devices/24/*gnome* +/usr/share/icons/Humanity/devices/32/*gnome* +/usr/share/icons/Humanity/devices/48/*gnome* +/usr/share/icons/Humanity/devices/64/*gnome* +/usr/share/icons/Humanity/mimes/128/*gnome* +/usr/share/icons/Humanity/mimes/16/*gnome* +/usr/share/icons/Humanity/mimes/22/*gnome* +/usr/share/icons/Humanity/mimes/24/*gnome* +/usr/share/icons/Humanity/mimes/32/*gnome* +/usr/share/icons/Humanity/mimes/48/*gnome* +/usr/share/icons/Humanity/mimes/64/*gnome* +/usr/share/icons/Humanity/places/128/*gnome* +/usr/share/icons/Humanity/places/16/*gnome* +/usr/share/icons/Humanity/places/22/*gnome* +/usr/share/icons/Humanity/places/24/*gnome* +/usr/share/icons/Humanity/places/32/*gnome* +/usr/share/icons/Humanity/places/48/*gnome* +/usr/share/icons/Humanity/places/64/*gnome* +/usr/share/icons/Humanity/status/128/*gnome* +/usr/share/icons/Humanity/status/16/*gnome* +/usr/share/icons/Humanity/status/22/*gnome* +/usr/share/icons/Humanity/status/24/*gnome* +/usr/share/icons/Humanity/status/32/*gnome* +/usr/share/icons/Humanity/status/48/*gnome* +/usr/share/icons/Humanity/status/64/*gnome* +/usr/share/icons/ubuntu-mono-dark/apps/16/*gnome* +/usr/share/icons/ubuntu-mono-dark/apps/22/*gnome* +/usr/share/icons/ubuntu-mono-dark/apps/24/*gnome* +/usr/share/icons/ubuntu-mono-dark/places/16/*gnome* +/usr/share/icons/ubuntu-mono-dark/places/22/*gnome* +/usr/share/icons/ubuntu-mono-dark/places/24/*gnome* +/usr/share/icons/ubuntu-mono-dark/places/32/*gnome* +/usr/share/icons/ubuntu-mono-dark/places/48/*gnome* +/usr/share/icons/ubuntu-mono-dark/places/64/*gnome* +/usr/share/icons/ubuntu-mono-dark/status/16/*gnome* +/usr/share/icons/ubuntu-mono-dark/status/22/*gnome* +/usr/share/icons/ubuntu-mono-dark/status/24/*gnome* +/usr/share/icons/ubuntu-mono-light/apps/16/*gnome* +/usr/share/icons/ubuntu-mono-light/apps/22/*gnome* +/usr/share/icons/ubuntu-mono-light/apps/24/*gnome* +/usr/share/icons/ubuntu-mono-light/places/16/*gnome* +/usr/share/icons/ubuntu-mono-light/places/22/*gnome* +/usr/share/icons/ubuntu-mono-light/places/24/*gnome* +/usr/share/icons/ubuntu-mono-light/places/32/*gnome* +/usr/share/icons/ubuntu-mono-light/places/48/*gnome* +/usr/share/icons/ubuntu-mono-light/places/64/*gnome* +/usr/share/icons/ubuntu-mono-light/status/16/*gnome* +/usr/share/icons/ubuntu-mono-light/status/22/*gnome* +/usr/share/icons/ubuntu-mono-light/status/24/*gnome* +/usr/share/notify-osd/icons/*gnome* -- cgit v1.2.3-55-g7522 From da4eaf0c4335a4a7786f339680500463f69a8b9a Mon Sep 17 00:00:00 2001 From: Christian Rößler Date: Fri, 13 Sep 2013 17:07:07 +0200 Subject: [blacklists] gnome includes: '+ ' added --- .../blacklists/desktop-sessions/gnome/gnome-base | 48 ++-- .../blacklists/desktop-sessions/gnome/gnome-icons | 258 ++++++++++----------- 2 files changed, 163 insertions(+), 143 deletions(-) (limited to 'server') diff --git a/server/blacklists/desktop-sessions/gnome/gnome-base b/server/blacklists/desktop-sessions/gnome/gnome-base index 6df837bc..98bf8d60 100644 --- a/server/blacklists/desktop-sessions/gnome/gnome-base +++ b/server/blacklists/desktop-sessions/gnome/gnome-base @@ -8,21 +8,41 @@ + /etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop # files from /etc: -/etc/gnome -/etc/gnome-app-install -/etc/gnome-settings-daemon - ++ /etc/gnome ++ /etc/gnome-app-install ++ /etc/gnome-settings-daemon ++ # files from /usr/bin: -/usr/bin/*gnome* - ++ /usr/bin/*gnome* ++ # from package gnome-session: -/usr/share/gnome-session -/usr/share/doc - ++ /usr/share/gnome-session ++ /usr/share/doc ++ # + from package gnome-session-bin: -/usr/share/GConf -/usr/share/glib-2.0 -/usr/lib/*gnome* - ++ /usr/share/GConf ++ /usr/share/glib-2.0 ++ /usr/lib/*gnome* + # Caught freestyle: -/usr/share/gnome* ++ /usr/share/gnome* ++ /usr/lib/python3/dist-packages/orca/scripts/apps/*gnome* + +# gnome keyring libs: ++ /usr/lib/x86_64-linux-gnu/*gnome* + ++ /usr/lib/x86_64-linux-gnu/pkcs11 ++ /usr/lib/x86_64-linux-gnu/gio/modules ++ /usr/lib/x86_64-linux-gnu/libproxy/0.4.11/modules + ++ /usr/sbin/*gnome* + ++ /usr/lib/libvte-2.90-9/*gnome* ++ /usr/lib/openssh/*gnome* + ++ /usr/share/dbus-1/services/*gnome* ++ /usr/share/locale-langpack/de/LC_MESSAGES/*gnome* + ++ /usr/share/polkit-1/actions/*gnome* ++ /usr/share/polkit-1/rules.d/*gnome* ++ /usr/share/dbus-1/services/*gnome* diff --git a/server/blacklists/desktop-sessions/gnome/gnome-icons b/server/blacklists/desktop-sessions/gnome/gnome-icons index 6e7d0481..cca0c045 100644 --- a/server/blacklists/desktop-sessions/gnome/gnome-icons +++ b/server/blacklists/desktop-sessions/gnome/gnome-icons @@ -1,130 +1,130 @@ # Gnome icons: -/usr/share/app-install/icons/*gnome* -/usr/share/icons/ubuntu-mono-light/status/22/*gnome* -/usr/share/icons/ubuntu-mono-light/status/24/*gnome* -/usr/share/icons/ubuntu-mono-light/status/16/*gnome* -/usr/share/icons/ubuntu-mono-light/places/22/*gnome* -/usr/share/icons/ubuntu-mono-light/places/48/*gnome* -/usr/share/icons/ubuntu-mono-light/places/24/*gnome* -/usr/share/icons/ubuntu-mono-light/places/16/*gnome* -/usr/share/icons/ubuntu-mono-light/places/64/*gnome* -/usr/share/icons/ubuntu-mono-light/places/32/*gnome* -/usr/share/icons/ubuntu-mono-light/apps/22/*gnome* -/usr/share/icons/ubuntu-mono-light/apps/24/*gnome* -/usr/share/icons/ubuntu-mono-light/apps/16/*gnome* -/usr/share/icons/hicolor/24x24/apps/*gnome* -/usr/share/icons/hicolor/scalable/apps/*gnome* -/usr/share/icons/hicolor/16x16/apps/*gnome* -/usr/share/icons/hicolor/256x256/apps/*gnome* -/usr/share/icons/hicolor/22x22/apps/*gnome* -/usr/share/icons/hicolor/48x48/apps/*gnome* -/usr/share/icons/hicolor/32x32/apps/*gnome* -/usr/share/icons/ubuntu-mono-dark/status/24/*gnome* -/usr/share/icons/ubuntu-mono-dark/status/24/*gnome* -/usr/share/icons/ubuntu-mono-dark/status/16/*gnome* -/usr/share/icons/ubuntu-mono-dark/places/22/*gnome* -/usr/share/icons/ubuntu-mono-dark/places/48/*gnome* -/usr/share/icons/ubuntu-mono-dark/places/24/*gnome* -/usr/share/icons/ubuntu-mono-dark/places/16/*gnome* -/usr/share/icons/ubuntu-mono-dark/places/64/*gnome* -/usr/share/icons/ubuntu-mono-dark/places/32/*gnome* -/usr/share/icons/ubuntu-mono-dark/apps/22/*gnome* -/usr/share/icons/ubuntu-mono-dark/apps/24/*gnome* -/usr/share/icons/ubuntu-mono-dark/apps/16/*gnome* -/usr/share/icons/HighContrast/24x24/apps/*gnome* -/usr/share/icons/HighContrast/scalable/apps/*gnome*-sudoku.svg -/usr/share/icons/HighContrast/16x16/apps/*gnome*-sudoku.png -/usr/share/icons/HighContrast/256x256/apps/gnome-power-manager.png -/usr/share/icons/HighContrast/22x22/apps/gnome-power-manager.png -/usr/share/icons/HighContrast/48x48/apps/gnome-power-manager.png -/usr/share/icons/HighContrast/32x32/apps/gnome-mahjongg.png -/usr/share/app-install/icons/*gnome* -/usr/share/icons/gnome/* -/usr/share/icons/Humanity/actions/128 -/usr/share/icons/Humanity/actions/16 -/usr/share/icons/Humanity/actions/22 -/usr/share/icons/Humanity/actions/24/*gnome* -/usr/share/icons/Humanity/actions/32/*gnome* -/usr/share/icons/Humanity/actions/48/*gnome* -/usr/share/icons/Humanity/actions/64/*gnome* -/usr/share/icons/Humanity/animations/16/*gnome* -/usr/share/icons/Humanity/animations/22/*gnome* -/usr/share/icons/Humanity/animations/24/*gnome* -/usr/share/icons/Humanity/animations/32/*gnome* -/usr/share/icons/Humanity/apps/128/*gnome* -/usr/share/icons/Humanity/apps/16/*gnome* -/usr/share/icons/Humanity/apps/22/*gnome* -/usr/share/icons/Humanity/apps/24/*gnome* -/usr/share/icons/Humanity/apps/32/*gnome* -/usr/share/icons/Humanity/apps/48/*gnome* -/usr/share/icons/Humanity/apps/64/*gnome* -/usr/share/icons/Humanity/categories/16/*gnome* -/usr/share/icons/Humanity/categories/22/*gnome* -/usr/share/icons/Humanity/categories/24/*gnome* -/usr/share/icons/Humanity/categories/32/*gnome* -/usr/share/icons/Humanity/categories/48/*gnome* -/usr/share/icons/Humanity/categories/64/*gnome* -/usr/share/icons/Humanity-Dark/apps/16/*gnome* -/usr/share/icons/Humanity-Dark/apps/22/*gnome* -/usr/share/icons/Humanity-Dark/devices/22/*gnome* -/usr/share/icons/Humanity-Dark/devices/24/*gnome* -/usr/share/icons/Humanity-Dark/places/16/*gnome* -/usr/share/icons/Humanity-Dark/places/22/*gnome* -/usr/share/icons/Humanity-Dark/places/24/*gnome* -/usr/share/icons/Humanity-Dark/places/48/*gnome* -/usr/share/icons/Humanity-Dark/places/64/*gnome* -/usr/share/icons/Humanity-Dark/status/22/*gnome* -/usr/share/icons/Humanity-Dark/status/24/*gnome* -/usr/share/icons/Humanity/devices/128/*gnome* -/usr/share/icons/Humanity/devices/16/*gnome* -/usr/share/icons/Humanity/devices/22/*gnome* -/usr/share/icons/Humanity/devices/24/*gnome* -/usr/share/icons/Humanity/devices/32/*gnome* -/usr/share/icons/Humanity/devices/48/*gnome* -/usr/share/icons/Humanity/devices/64/*gnome* -/usr/share/icons/Humanity/mimes/128/*gnome* -/usr/share/icons/Humanity/mimes/16/*gnome* -/usr/share/icons/Humanity/mimes/22/*gnome* -/usr/share/icons/Humanity/mimes/24/*gnome* -/usr/share/icons/Humanity/mimes/32/*gnome* -/usr/share/icons/Humanity/mimes/48/*gnome* -/usr/share/icons/Humanity/mimes/64/*gnome* -/usr/share/icons/Humanity/places/128/*gnome* -/usr/share/icons/Humanity/places/16/*gnome* -/usr/share/icons/Humanity/places/22/*gnome* -/usr/share/icons/Humanity/places/24/*gnome* -/usr/share/icons/Humanity/places/32/*gnome* -/usr/share/icons/Humanity/places/48/*gnome* -/usr/share/icons/Humanity/places/64/*gnome* -/usr/share/icons/Humanity/status/128/*gnome* -/usr/share/icons/Humanity/status/16/*gnome* -/usr/share/icons/Humanity/status/22/*gnome* -/usr/share/icons/Humanity/status/24/*gnome* -/usr/share/icons/Humanity/status/32/*gnome* -/usr/share/icons/Humanity/status/48/*gnome* -/usr/share/icons/Humanity/status/64/*gnome* -/usr/share/icons/ubuntu-mono-dark/apps/16/*gnome* -/usr/share/icons/ubuntu-mono-dark/apps/22/*gnome* -/usr/share/icons/ubuntu-mono-dark/apps/24/*gnome* -/usr/share/icons/ubuntu-mono-dark/places/16/*gnome* -/usr/share/icons/ubuntu-mono-dark/places/22/*gnome* -/usr/share/icons/ubuntu-mono-dark/places/24/*gnome* -/usr/share/icons/ubuntu-mono-dark/places/32/*gnome* -/usr/share/icons/ubuntu-mono-dark/places/48/*gnome* -/usr/share/icons/ubuntu-mono-dark/places/64/*gnome* -/usr/share/icons/ubuntu-mono-dark/status/16/*gnome* -/usr/share/icons/ubuntu-mono-dark/status/22/*gnome* -/usr/share/icons/ubuntu-mono-dark/status/24/*gnome* -/usr/share/icons/ubuntu-mono-light/apps/16/*gnome* -/usr/share/icons/ubuntu-mono-light/apps/22/*gnome* -/usr/share/icons/ubuntu-mono-light/apps/24/*gnome* -/usr/share/icons/ubuntu-mono-light/places/16/*gnome* -/usr/share/icons/ubuntu-mono-light/places/22/*gnome* -/usr/share/icons/ubuntu-mono-light/places/24/*gnome* -/usr/share/icons/ubuntu-mono-light/places/32/*gnome* -/usr/share/icons/ubuntu-mono-light/places/48/*gnome* -/usr/share/icons/ubuntu-mono-light/places/64/*gnome* -/usr/share/icons/ubuntu-mono-light/status/16/*gnome* -/usr/share/icons/ubuntu-mono-light/status/22/*gnome* -/usr/share/icons/ubuntu-mono-light/status/24/*gnome* -/usr/share/notify-osd/icons/*gnome* ++ /usr/share/app-install/icons/*gnome* ++ /usr/share/icons/ubuntu-mono-light/status/22/*gnome* ++ /usr/share/icons/ubuntu-mono-light/status/24/*gnome* ++ /usr/share/icons/ubuntu-mono-light/status/16/*gnome* ++ /usr/share/icons/ubuntu-mono-light/places/22/*gnome* ++ /usr/share/icons/ubuntu-mono-light/places/48/*gnome* ++ /usr/share/icons/ubuntu-mono-light/places/24/*gnome* ++ /usr/share/icons/ubuntu-mono-light/places/16/*gnome* ++ /usr/share/icons/ubuntu-mono-light/places/64/*gnome* ++ /usr/share/icons/ubuntu-mono-light/places/32/*gnome* ++ /usr/share/icons/ubuntu-mono-light/apps/22/*gnome* ++ /usr/share/icons/ubuntu-mono-light/apps/24/*gnome* ++ /usr/share/icons/ubuntu-mono-light/apps/16/*gnome* ++ /usr/share/icons/hicolor/24x24/apps/*gnome* ++ /usr/share/icons/hicolor/scalable/apps/*gnome* ++ /usr/share/icons/hicolor/16x16/apps/*gnome* ++ /usr/share/icons/hicolor/256x256/apps/*gnome* ++ /usr/share/icons/hicolor/22x22/apps/*gnome* ++ /usr/share/icons/hicolor/48x48/apps/*gnome* ++ /usr/share/icons/hicolor/32x32/apps/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/status/24/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/status/24/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/status/16/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/places/22/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/places/48/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/places/24/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/places/16/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/places/64/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/places/32/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/apps/22/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/apps/24/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/apps/16/*gnome* ++ /usr/share/icons/HighContrast/24x24/apps/*gnome* ++ /usr/share/icons/HighContrast/scalable/apps/*gnome*-sudoku.svg ++ /usr/share/icons/HighContrast/16x16/apps/*gnome*-sudoku.png ++ /usr/share/icons/HighContrast/256x256/apps/gnome-power-manager.png ++ /usr/share/icons/HighContrast/22x22/apps/gnome-power-manager.png ++ /usr/share/icons/HighContrast/48x48/apps/gnome-power-manager.png ++ /usr/share/icons/HighContrast/32x32/apps/gnome-mahjongg.png ++ /usr/share/app-install/icons/*gnome* ++ /usr/share/icons/gnome/* ++ /usr/share/icons/Humanity/actions/128 ++ /usr/share/icons/Humanity/actions/16 ++ /usr/share/icons/Humanity/actions/22 ++ /usr/share/icons/Humanity/actions/24/*gnome* ++ /usr/share/icons/Humanity/actions/32/*gnome* ++ /usr/share/icons/Humanity/actions/48/*gnome* ++ /usr/share/icons/Humanity/actions/64/*gnome* ++ /usr/share/icons/Humanity/animations/16/*gnome* ++ /usr/share/icons/Humanity/animations/22/*gnome* ++ /usr/share/icons/Humanity/animations/24/*gnome* ++ /usr/share/icons/Humanity/animations/32/*gnome* ++ /usr/share/icons/Humanity/apps/128/*gnome* ++ /usr/share/icons/Humanity/apps/16/*gnome* ++ /usr/share/icons/Humanity/apps/22/*gnome* ++ /usr/share/icons/Humanity/apps/24/*gnome* ++ /usr/share/icons/Humanity/apps/32/*gnome* ++ /usr/share/icons/Humanity/apps/48/*gnome* ++ /usr/share/icons/Humanity/apps/64/*gnome* ++ /usr/share/icons/Humanity/categories/16/*gnome* ++ /usr/share/icons/Humanity/categories/22/*gnome* ++ /usr/share/icons/Humanity/categories/24/*gnome* ++ /usr/share/icons/Humanity/categories/32/*gnome* ++ /usr/share/icons/Humanity/categories/48/*gnome* ++ /usr/share/icons/Humanity/categories/64/*gnome* ++ /usr/share/icons/Humanity-Dark/apps/16/*gnome* ++ /usr/share/icons/Humanity-Dark/apps/22/*gnome* ++ /usr/share/icons/Humanity-Dark/devices/22/*gnome* ++ /usr/share/icons/Humanity-Dark/devices/24/*gnome* ++ /usr/share/icons/Humanity-Dark/places/16/*gnome* ++ /usr/share/icons/Humanity-Dark/places/22/*gnome* ++ /usr/share/icons/Humanity-Dark/places/24/*gnome* ++ /usr/share/icons/Humanity-Dark/places/48/*gnome* ++ /usr/share/icons/Humanity-Dark/places/64/*gnome* ++ /usr/share/icons/Humanity-Dark/status/22/*gnome* ++ /usr/share/icons/Humanity-Dark/status/24/*gnome* ++ /usr/share/icons/Humanity/devices/128/*gnome* ++ /usr/share/icons/Humanity/devices/16/*gnome* ++ /usr/share/icons/Humanity/devices/22/*gnome* ++ /usr/share/icons/Humanity/devices/24/*gnome* ++ /usr/share/icons/Humanity/devices/32/*gnome* ++ /usr/share/icons/Humanity/devices/48/*gnome* ++ /usr/share/icons/Humanity/devices/64/*gnome* ++ /usr/share/icons/Humanity/mimes/128/*gnome* ++ /usr/share/icons/Humanity/mimes/16/*gnome* ++ /usr/share/icons/Humanity/mimes/22/*gnome* ++ /usr/share/icons/Humanity/mimes/24/*gnome* ++ /usr/share/icons/Humanity/mimes/32/*gnome* ++ /usr/share/icons/Humanity/mimes/48/*gnome* ++ /usr/share/icons/Humanity/mimes/64/*gnome* ++ /usr/share/icons/Humanity/places/128/*gnome* ++ /usr/share/icons/Humanity/places/16/*gnome* ++ /usr/share/icons/Humanity/places/22/*gnome* ++ /usr/share/icons/Humanity/places/24/*gnome* ++ /usr/share/icons/Humanity/places/32/*gnome* ++ /usr/share/icons/Humanity/places/48/*gnome* ++ /usr/share/icons/Humanity/places/64/*gnome* ++ /usr/share/icons/Humanity/status/128/*gnome* ++ /usr/share/icons/Humanity/status/16/*gnome* ++ /usr/share/icons/Humanity/status/22/*gnome* ++ /usr/share/icons/Humanity/status/24/*gnome* ++ /usr/share/icons/Humanity/status/32/*gnome* ++ /usr/share/icons/Humanity/status/48/*gnome* ++ /usr/share/icons/Humanity/status/64/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/apps/16/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/apps/22/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/apps/24/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/places/16/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/places/22/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/places/24/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/places/32/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/places/48/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/places/64/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/status/16/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/status/22/*gnome* ++ /usr/share/icons/ubuntu-mono-dark/status/24/*gnome* ++ /usr/share/icons/ubuntu-mono-light/apps/16/*gnome* ++ /usr/share/icons/ubuntu-mono-light/apps/22/*gnome* ++ /usr/share/icons/ubuntu-mono-light/apps/24/*gnome* ++ /usr/share/icons/ubuntu-mono-light/places/16/*gnome* ++ /usr/share/icons/ubuntu-mono-light/places/22/*gnome* ++ /usr/share/icons/ubuntu-mono-light/places/24/*gnome* ++ /usr/share/icons/ubuntu-mono-light/places/32/*gnome* ++ /usr/share/icons/ubuntu-mono-light/places/48/*gnome* ++ /usr/share/icons/ubuntu-mono-light/places/64/*gnome* ++ /usr/share/icons/ubuntu-mono-light/status/16/*gnome* ++ /usr/share/icons/ubuntu-mono-light/status/22/*gnome* ++ /usr/share/icons/ubuntu-mono-light/status/24/*gnome* ++ /usr/share/notify-osd/icons/*gnome* -- cgit v1.2.3-55-g7522 From bfffe952daaea241a753204d333fe698825c89d3 Mon Sep 17 00:00:00 2001 From: Christian Rößler Date: Fri, 13 Sep 2013 17:08:29 +0200 Subject: [blacklists] Sorry, forgot something: '+ ' in empty lines. --- server/blacklists/desktop-sessions/gnome/gnome-base | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'server') diff --git a/server/blacklists/desktop-sessions/gnome/gnome-base b/server/blacklists/desktop-sessions/gnome/gnome-base index 98bf8d60..aec31026 100644 --- a/server/blacklists/desktop-sessions/gnome/gnome-base +++ b/server/blacklists/desktop-sessions/gnome/gnome-base @@ -11,14 +11,14 @@ + /etc/gnome + /etc/gnome-app-install + /etc/gnome-settings-daemon -+ + # files from /usr/bin: + /usr/bin/*gnome* -+ + # from package gnome-session: + /usr/share/gnome-session + /usr/share/doc -+ + # + from package gnome-session-bin: + /usr/share/GConf + /usr/share/glib-2.0 -- cgit v1.2.3-55-g7522 From 5ef291ccd91aff5cbe86f37b68b8f72139f22bbe Mon Sep 17 00:00:00 2001 From: Simon Rettberg Date: Fri, 13 Sep 2013 17:28:33 +0200 Subject: [pam-freiburg] nscd is not configured to cache hostnames, so don't patch nsswitch.conf to use it --- .../modules/pam-freiburg/etc/systemd/system/activate-nss-ldap.service | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'server') diff --git a/server/modules/pam-freiburg/etc/systemd/system/activate-nss-ldap.service b/server/modules/pam-freiburg/etc/systemd/system/activate-nss-ldap.service index bbac775a..664f7dd7 100644 --- a/server/modules/pam-freiburg/etc/systemd/system/activate-nss-ldap.service +++ b/server/modules/pam-freiburg/etc/systemd/system/activate-nss-ldap.service @@ -5,6 +5,6 @@ Before=graphical.target [Service] Type=oneshot ExecStart=-/opt/openslx/bin/mkdir /tmp/ldap -ExecStart=/opt/openslx/bin/sed -i -e 's/^passwd:.*$/passwd:\t\tcache files ldap/;s/^group:.*$/group:\t\tcache files ldap/;s/^hosts:.*files/hosts:\t\tcache files/' /etc/nsswitch.conf +ExecStart=/opt/openslx/bin/sed -i -e 's/^passwd:.*$/passwd:\t\tcache files ldap/;s/^group:.*$/group:\t\tcache files ldap/' /etc/nsswitch.conf ExecStart=/usr/bin/systemctl restart nscd -- cgit v1.2.3-55-g7522 From 35a5d92aba95ed1242ebf6a9eec71eb05864014c Mon Sep 17 00:00:00 2001 From: Christian Rößler Date: Fri, 13 Sep 2013 18:13:35 +0200 Subject: [blacklists] gnome-base: nautilus-autostart for backgrounds etc., some other gnome-autostarts also. --- server/blacklists/desktop-sessions/gnome/gnome-base | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'server') diff --git a/server/blacklists/desktop-sessions/gnome/gnome-base b/server/blacklists/desktop-sessions/gnome/gnome-base index aec31026..f760cfa4 100644 --- a/server/blacklists/desktop-sessions/gnome/gnome-base +++ b/server/blacklists/desktop-sessions/gnome/gnome-base @@ -4,8 +4,12 @@ + /etc/pam.d/gnome-* # transported from x-autostart/xdg-autostart: -+ /etc/xdg/autostart/gnome-settings-daemon.desktop -+ /etc/xdg/autostart/polkit-gnome-authentication-agent-1.desktop +# (obsolete entries, left here to match comment in +# x-autostart/xdg-autostart), now matched in more 'x-autostart stuff'. + +# more x-autostart stuff: ++ /etc/xdg/autostart/*gnome* ++ /etc/xdg/autostart/nautilus-autostart.desktop # files from /etc: + /etc/gnome -- cgit v1.2.3-55-g7522 From 6e54ced220d6452e1384c6dac48d52422b52df6e Mon Sep 17 00:00:00 2001 From: Christian Rößler Date: Tue, 17 Sep 2013 18:31:04 +0200 Subject: [blacklists] Remaining gnome stuff (Ubuntu) --- server/blacklists/desktop-sessions/gnome/gnome-base | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) (limited to 'server') diff --git a/server/blacklists/desktop-sessions/gnome/gnome-base b/server/blacklists/desktop-sessions/gnome/gnome-base index f760cfa4..fd7b73d7 100644 --- a/server/blacklists/desktop-sessions/gnome/gnome-base +++ b/server/blacklists/desktop-sessions/gnome/gnome-base @@ -34,11 +34,27 @@ # gnome keyring libs: + /usr/lib/x86_64-linux-gnu/*gnome* - + /usr/lib/x86_64-linux-gnu/pkcs11 + /usr/lib/x86_64-linux-gnu/gio/modules + /usr/lib/x86_64-linux-gnu/libproxy/0.4.11/modules - + +# gnome seems to need accountdaemon for screensaver login +# (if not found 30sec timeout) +# + /usr/lib/systemd/system/accounts-daemon.service +# Suse version: ++ /usr/lib/accounts-daemon +# Ubuntu version: ++ /usr/lib/accountsservice/accounts-daemon + +# sonstiges für accountservice: ++ /etc/dbus-1/system.d/org.freedesktop.Accounts.conf ++ /usr/share/dbus-1/interfaces/org.freedesktop.Accounts.User.xml ++ /usr/share/dbus-1/interfaces/org.freedesktop.Accounts.xml ++ /usr/share/dbus-1/system-services/org.freedesktop.Accounts.service ++ /usr/share/polkit-1/actions/org.freedesktop.accounts.policy ++ /usr/share/language-tools + + + /usr/sbin/*gnome* + /usr/lib/libvte-2.90-9/*gnome* -- cgit v1.2.3-55-g7522 From 6c2d70ce4a721a6432aa3ad6c68baa5d48bbaf8d Mon Sep 17 00:00:00 2001 From: Christian Rößler Date: Wed, 18 Sep 2013 15:45:42 +0200 Subject: [blacklists] Modifications for accounts-daemon.service --- server/blacklists/desktop-sessions/gnome/gnome-base | 4 +++- server/blacklists/essential/linux-extended | 1 + 2 files changed, 4 insertions(+), 1 deletion(-) (limited to 'server') diff --git a/server/blacklists/desktop-sessions/gnome/gnome-base b/server/blacklists/desktop-sessions/gnome/gnome-base index fd7b73d7..b5e25eee 100644 --- a/server/blacklists/desktop-sessions/gnome/gnome-base +++ b/server/blacklists/desktop-sessions/gnome/gnome-base @@ -40,7 +40,9 @@ # gnome seems to need accountdaemon for screensaver login # (if not found 30sec timeout) -# + /usr/lib/systemd/system/accounts-daemon.service ++ /usr/lib/systemd/ ++ /usr/lib/systemd/system/ ++ /usr/lib/systemd/system/accounts-daemon.service # Suse version: + /usr/lib/accounts-daemon # Ubuntu version: diff --git a/server/blacklists/essential/linux-extended b/server/blacklists/essential/linux-extended index ab39fda0..54f500ed 100644 --- a/server/blacklists/essential/linux-extended +++ b/server/blacklists/essential/linux-extended @@ -8,6 +8,7 @@ - /usr/share/upstart - /lib/systemd - /usr/lib/systemd +- /usr/lib/systemd/** - /etc/systemd - /var/lib/NetworkManager -- cgit v1.2.3-55-g7522 From d12f1bedbccc3b19999cc84c14a836166bb43d18 Mon Sep 17 00:00:00 2001 From: Jonathan Bauer Date: Fri, 20 Sep 2013 16:59:55 +0200 Subject: [pam-hso] fix permissions for pam scripts mouting homes. --- .../pam-hso/etc/pam-script/pam_script_ses_close | 1 + .../pam-hso/etc/pam-script/pam_script_ses_open | 1 - .../pam-hso/etc/pam-script/pam_script_ses_open.bak | 30 -------------- .../etc/pam-script/pam_script_ses_open.save | 47 ---------------------- 4 files changed, 1 insertion(+), 78 deletions(-) delete mode 100755 server/modules/pam-hso/etc/pam-script/pam_script_ses_open.bak delete mode 100755 server/modules/pam-hso/etc/pam-script/pam_script_ses_open.save (limited to 'server') diff --git a/server/modules/pam-hso/etc/pam-script/pam_script_ses_close b/server/modules/pam-hso/etc/pam-script/pam_script_ses_close index 8bc8d3bb..dc7b5bd7 100755 --- a/server/modules/pam-hso/etc/pam-script/pam_script_ses_close +++ b/server/modules/pam-hso/etc/pam-script/pam_script_ses_close @@ -5,3 +5,4 @@ export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/o echo "[$PAM_TYPE] Closing session for $PAM_USER" [ $(id -g $PAM_USER) -eq 1001 ] && umount /home/$PAM_USER + diff --git a/server/modules/pam-hso/etc/pam-script/pam_script_ses_open b/server/modules/pam-hso/etc/pam-script/pam_script_ses_open index 2189c347..4cf6bf58 100755 --- a/server/modules/pam-hso/etc/pam-script/pam_script_ses_open +++ b/server/modules/pam-hso/etc/pam-script/pam_script_ses_open @@ -22,4 +22,3 @@ fi #mount H-Drive ncpmount -A fs1-2-home.rz.hs-offenburg.de -S fs1-2-home.rz.hs-offenburg.de -V HOME/USERS/$loggedInUser -U $loggedInUser.HRZ.FHO /home/users/$loggedInUser - diff --git a/server/modules/pam-hso/etc/pam-script/pam_script_ses_open.bak b/server/modules/pam-hso/etc/pam-script/pam_script_ses_open.bak deleted file mode 100755 index 79a94169..00000000 --- a/server/modules/pam-hso/etc/pam-script/pam_script_ses_open.bak +++ /dev/null @@ -1,30 +0,0 @@ -#!/bin/bash - -export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/openslx/bin:/opt/openslx/sbin:/opt/openslx/usr/bin:/opt/openslx/usr/sbin" - -echo "[$PAM_TYPE] Opening session for $PAM_USER" - -if [ $(id -g $PAM_USER) -eq 1001 ]; then - echo "[$PAM_TYPE] Mounting home directory for $PAM_USER" - - # generate keytab - sslconnect npserv.ruf.uni-freiburg.de:3 > /etc/krb5.keytab - chmod 600 /etc/krb5.keytab - - # determine fileserver and share for home directories - ldapsearch -x -LLL uid="$PAM_USER" homeDirectory rufFileserver > /tmp/ldapsearch."$PAM_USER" - - FILESERVER=$(cat /tmp/ldapsearch.$PAM_USER | grep rufFileserver | cut -d" " -f2) - VOLUME=$(cat /tmp/ldapsearch.$PAM_USER | grep homeDirectory | cut -d" " -f2) - - # now we can mount the home directory - mkdir -p /home/$PAM_USER - if mount -t nfs4 -o rw,nosuid,nodev,nolock,intr,hard,sloppy,sec=krb5p "$FILESERVER":"$VOLUME" /home/"$PAM_USER"; then - exit 0 - else - echo "Failed to mount home directory for $PAM_USER" - exit 1 - fi - -fi - diff --git a/server/modules/pam-hso/etc/pam-script/pam_script_ses_open.save b/server/modules/pam-hso/etc/pam-script/pam_script_ses_open.save deleted file mode 100755 index 1bbb9d81..00000000 --- a/server/modules/pam-hso/etc/pam-script/pam_script_ses_open.save +++ /dev/null @@ -1,47 +0,0 @@ -/root/tm-scripts/server/boot/local/initramfs-stage32/root/tm-scripts/server/boot/local/initramfs-stage32#!/bin/sh - -export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/openslx/bin:/opt/openslx/sbin:/opt/openslx/usr/bin:/opt/openslx/usr/sbin" - - -#check who is logged in to put the "Home"-Folder on the correct Desktop -#Doesn't work with root! -#export loggedInUser=$(whoami) -[ ! -z "$PAM_USER" ] && export loggedInUser="$PAM_USER" - - -#create Folder on Desktop to link with H-Drive, if not already existent -if [ ! -d /home/$loggedInUser ]; then - mkdir -p /home/$loggedInUser -fi - - -#ask for username -#read -p "Benutzername: " username - - -#mount H-Drive -ncpmount -A fs1-2-home.rz.hs-offenburg.de -S fs1-2-home.rz.hs-offenburg.de -V HOME/USERS/$loggedInUser -U $loggedInUser.HRZ.FHO /home/$loggedInUser#!/bin/sh - -export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/openslx/bin:/opt/openslx/sbin:/opt/openslx/usr/bin:/opt/openslx/usr/sbin" - - -#check who is logged in to put the "Home"-Folder on the correct Desktop -#Doesn't work with root! -#export loggedInUser=$(whoami) -[ ! -z "$PAM_USER" ] && export loggedInUser="$PAM_USER" - - -#create Folder on Desktop to link with H-Drive, if not already existent -if [ ! -d /home/$loggedInUser ]; then - mkdir -p /home/$loggedInUser -fi - - -#ask for username -#read -p "Benutzername: " username - - -#mount H-Drive -ncpmount -A fs1-2-home.rz.hs-offenburg.de -S fs1-2-home.rz.hs-offenburg.de -V HOME/USERS/$loggedInUser -U $loggedInUser.HRZ.FHO /home/$loggedInUser - - -- cgit v1.2.3-55-g7522 From 0c87185a27c83431e50a528f67be1cbd7411d1c0 Mon Sep 17 00:00:00 2001 From: Jonathan Bauer Date: Fri, 20 Sep 2013 17:01:22 +0200 Subject: [pam-freiburg] fix permission --- server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_close | 1 + server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_open | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) (limited to 'server') diff --git a/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_close b/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_close index 01d409a1..44dcd418 100755 --- a/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_close +++ b/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_close @@ -2,3 +2,4 @@ [ ! -z "$SLX_DEBUG" ] && echo "[$PAM_TYPE] Closing session for $PAM_USER" + diff --git a/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_open b/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_open index 9af51e7f..205090b6 100755 --- a/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_open +++ b/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_open @@ -22,7 +22,7 @@ if [ $(id -g $PAM_USER) -ge 1000 ]; then FILESERVER=$(cat /tmp/ldapsearch.$PAM_USER | grep rufFileserver | cut -d" " -f2) VOLUME=$(cat /tmp/ldapsearch.$PAM_USER | grep homeDirectory | cut -d" " -f2) - # now we can mount the home directory + # now we can mount the home directory! mkdir -p /home/$PAM_USER if mount -t nfs4 -o rw,nosuid,nodev,nolock,intr,hard,sloppy,sec=krb5p "$FILESERVER":"$VOLUME" /home/"$PAM_USER"; then exit 0 -- cgit v1.2.3-55-g7522 From 7ca042135c5ba849db405bbe44e1ccf0fb88f9bf Mon Sep 17 00:00:00 2001 From: Jonathan Bauer Date: Fri, 20 Sep 2013 17:02:07 +0200 Subject: [export_target] set owner and group of config files to root, always --- server/export_target | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'server') diff --git a/server/export_target b/server/export_target index 52f87942..4dbf2aae 100755 --- a/server/export_target +++ b/server/export_target @@ -128,7 +128,7 @@ generate_config() { done # no conflict, add file to archive - tar cf "${TARGET_CONFIG_BUILD_DIR}/${MODULE_CONFIG}.tar" $(ls) + tar --owner=root --group=root -c -f "${TARGET_CONFIG_BUILD_DIR}/${MODULE_CONFIG}.tar" $(ls) RET=$? [ "x$RET" != "x0" ] && perror "\tCould not create '${TARGET_CONFIG_BUILD_DIR}/${MODULE_CONFIG}.tar'" done -- cgit v1.2.3-55-g7522 From 5f45473ac132f529d1c986103b2f034ddbab45fe Mon Sep 17 00:00:00 2001 From: Jonathan Bauer Date: Fri, 20 Sep 2013 17:06:59 +0200 Subject: workaround for permissions fix not working. .. --- server/modules/pam-freiburg/etc/gssapi_mech.conf | 21 ----- server/modules/pam-freiburg/etc/idmapd.conf | 12 --- server/modules/pam-freiburg/etc/krb5.conf | 28 ------ server/modules/pam-freiburg/etc/ldap.conf | 11 --- server/modules/pam-freiburg/etc/ldap/ldap.conf | 7 -- server/modules/pam-freiburg/etc/openldap/ldap.conf | 1 - .../etc/pam-script/pam_script_ses_close | 1 - .../etc/pam-script/pam_script_ses_open | 1 - .../modules/pam-freiburg/etc/pam.d/common-account | 26 ------ server/modules/pam-freiburg/etc/pam.d/common-auth | 27 ------ .../modules/pam-freiburg/etc/pam.d/common-password | 33 ------- .../modules/pam-freiburg/etc/pam.d/common-session | 38 -------- .../etc/pam.d/common-session-noninteractive | 30 ------ server/modules/pam-freiburg/etc/pam.d/kdm | 10 -- server/modules/pam-freiburg/etc/pam.d/kdm-np | 11 --- server/modules/pam-freiburg/etc/pam.d/login | 101 --------------------- server/modules/pam-freiburg/etc/pam.d/other | 10 -- server/modules/pam-freiburg/etc/pam.d/passwd | 6 -- server/modules/pam-freiburg/etc/pam.d/sshd | 41 --------- server/modules/pam-freiburg/etc/pam.d/vmware-authd | 6 -- server/modules/pam-freiburg/etc/pam.d/xdm | 6 -- .../etc/systemd/system/activate-nss-ldap.service | 10 -- .../getty.target.wants/activate-nss-ldap.service | 1 - .../system/getty.target.wants/rpc-gssd.service | 1 - .../system/getty.target.wants/rpc-idmapd.service | 1 - .../etc/systemd/system/rpc-gssd.service | 7 -- .../etc/systemd/system/rpc-idmapd.service | 7 -- .../etc/systemd/system/run-rpc_pipefs.mount | 7 -- .../opt/openslx/scripts/pam_script_ses_close | 5 - .../opt/openslx/scripts/pam_script_ses_open | 35 ------- 30 files changed, 501 deletions(-) delete mode 100644 server/modules/pam-freiburg/etc/gssapi_mech.conf delete mode 100644 server/modules/pam-freiburg/etc/idmapd.conf delete mode 100644 server/modules/pam-freiburg/etc/krb5.conf delete mode 100644 server/modules/pam-freiburg/etc/ldap.conf delete mode 100644 server/modules/pam-freiburg/etc/ldap/ldap.conf delete mode 120000 server/modules/pam-freiburg/etc/openldap/ldap.conf delete mode 120000 server/modules/pam-freiburg/etc/pam-script/pam_script_ses_close delete mode 120000 server/modules/pam-freiburg/etc/pam-script/pam_script_ses_open delete mode 100644 server/modules/pam-freiburg/etc/pam.d/common-account delete mode 100644 server/modules/pam-freiburg/etc/pam.d/common-auth delete mode 100644 server/modules/pam-freiburg/etc/pam.d/common-password delete mode 100644 server/modules/pam-freiburg/etc/pam.d/common-session delete mode 100644 server/modules/pam-freiburg/etc/pam.d/common-session-noninteractive delete mode 100644 server/modules/pam-freiburg/etc/pam.d/kdm delete mode 100644 server/modules/pam-freiburg/etc/pam.d/kdm-np delete mode 100644 server/modules/pam-freiburg/etc/pam.d/login delete mode 100644 server/modules/pam-freiburg/etc/pam.d/other delete mode 100644 server/modules/pam-freiburg/etc/pam.d/passwd delete mode 100644 server/modules/pam-freiburg/etc/pam.d/sshd delete mode 100644 server/modules/pam-freiburg/etc/pam.d/vmware-authd delete mode 100644 server/modules/pam-freiburg/etc/pam.d/xdm delete mode 100644 server/modules/pam-freiburg/etc/systemd/system/activate-nss-ldap.service delete mode 120000 server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/activate-nss-ldap.service delete mode 120000 server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/rpc-gssd.service delete mode 120000 server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/rpc-idmapd.service delete mode 100644 server/modules/pam-freiburg/etc/systemd/system/rpc-gssd.service delete mode 100644 server/modules/pam-freiburg/etc/systemd/system/rpc-idmapd.service delete mode 100644 server/modules/pam-freiburg/etc/systemd/system/run-rpc_pipefs.mount delete mode 100755 server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_close delete mode 100755 server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_open (limited to 'server') diff --git a/server/modules/pam-freiburg/etc/gssapi_mech.conf b/server/modules/pam-freiburg/etc/gssapi_mech.conf deleted file mode 100644 index ac41f5fd..00000000 --- a/server/modules/pam-freiburg/etc/gssapi_mech.conf +++ /dev/null @@ -1,21 +0,0 @@ -# Example /etc/gssapi_mech.conf file -# -# GSSAPI Mechanism Definitions -# -# This configuration file determines which GSS-API mechanisms -# the gssd code should use -# -# NOTE: -# The initiaiization function "mechglue_internal_krb5_init" -# is used for the MIT krb5 gssapi mechanism. This special -# function name indicates that an internal function should -# be used to determine the entry points for the MIT gssapi -# mechanism funtions. -# -# library initialization function -# ================================ ========================== -# The MIT K5 gssapi library, use special function for initialization. -libgssapi_krb5.so.2 mechglue_internal_krb5_init -# -# The SPKM3 gssapi library function. Use the function spkm3_gss_initialize. -# /usr/local/gss_mechs/spkm/spkm3/libgssapi_spkm3.so spkm3_gss_initialize diff --git a/server/modules/pam-freiburg/etc/idmapd.conf b/server/modules/pam-freiburg/etc/idmapd.conf deleted file mode 100644 index 2253cf0d..00000000 --- a/server/modules/pam-freiburg/etc/idmapd.conf +++ /dev/null @@ -1,12 +0,0 @@ -[General] - -Verbosity = 0 -Pipefs-Directory = /run/rpc_pipefs -# set your own domain here, if id differs from FQDN minus hostname -Domain = uni-freiburg.de -# localdomain - -[Mapping] - -Nobody-User = nobody -Nobody-Group = nogroup diff --git a/server/modules/pam-freiburg/etc/krb5.conf b/server/modules/pam-freiburg/etc/krb5.conf deleted file mode 100644 index 6fd49243..00000000 --- a/server/modules/pam-freiburg/etc/krb5.conf +++ /dev/null @@ -1,28 +0,0 @@ -# file copied from configuration package (rootfs/etc/krb5.conf) -######################################################################### -[libdefaults] - noaddresses = false - clockskew = 300 - default_realm = PUBLIC.ADS.UNI-FREIBURG.DE - forwardable = true - minimum_uid = 1000 - proxiable = false - renew_lifetime = 30d - retain_after_close = false - ticket_lifetime = 3d - use_shmem = sshd - allow_weak_crypto=true -######################################################################### -[realms] - PUBLIC.ADS.UNI-FREIBURG.DE = { - kdc = kerberos.uni-freiburg.de - default_domain = uni-freiburg.de - admin_server = kerberos.uni-freiburg.de - } -######################################################################### -[domain_realm] - uni-freiburg.de = PUBLIC.ADS.UNI-FREIBURG.DE - .uni-freiburg.de = PUBLIC.ADS.UNI-FREIBURG.DE -########################################################################## -[appdefaults] -######################################################################### diff --git a/server/modules/pam-freiburg/etc/ldap.conf b/server/modules/pam-freiburg/etc/ldap.conf deleted file mode 100644 index 483595d2..00000000 --- a/server/modules/pam-freiburg/etc/ldap.conf +++ /dev/null @@ -1,11 +0,0 @@ -URI ldaps://bv1.ruf.uni-freiburg.de ldaps://bv2.ruf.uni-freiburg.de ldaps://bv3.ruf.uni-freiburg.de -BASE ou=people,dc=uni-freiburg,dc=de -BIND_TIMELIMIT 5 -TIMELIMIT 10 -LOGDIR /tmp/ldap -TLS_REQCERT allow -nss_base_passwd ou=people,dc=uni-freiburg,dc=de?one?rufdienst=ldap*)(&(rufclienthome=*)(rufstatus=enabled) -nss_base_group ou=group,dc=uni-freiburg,dc=de?one -nss_map_attribute homeDirectory rufClientHome - -nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,distccd,games,git,gnats,hplip,irc,kdm,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,ntp,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,statd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data diff --git a/server/modules/pam-freiburg/etc/ldap/ldap.conf b/server/modules/pam-freiburg/etc/ldap/ldap.conf deleted file mode 100644 index 809065cc..00000000 --- a/server/modules/pam-freiburg/etc/ldap/ldap.conf +++ /dev/null @@ -1,7 +0,0 @@ -URI ldaps://bv1.ruf.uni-freiburg.de ldaps://bv2.ruf.uni-freiburg.de ldaps://bv3.ruf.uni-freiburg.de -BASE ou=people,dc=uni-freiburg,dc=de -TLS_REQCERT allow -nss_base_passwd ou=people,dc=uni-freiburg,dc=de?one?rufdienst=ldap*)(&(rufclienthome=*)(rufstatus=enabled) -nss_base_group ou=group,dc=uni-freiburg,dc=de?one -nss_map_attribute homeDirectory rufClientHome - diff --git a/server/modules/pam-freiburg/etc/openldap/ldap.conf b/server/modules/pam-freiburg/etc/openldap/ldap.conf deleted file mode 120000 index c0aaf459..00000000 --- a/server/modules/pam-freiburg/etc/openldap/ldap.conf +++ /dev/null @@ -1 +0,0 @@ -/etc/ldap.conf \ No newline at end of file diff --git a/server/modules/pam-freiburg/etc/pam-script/pam_script_ses_close b/server/modules/pam-freiburg/etc/pam-script/pam_script_ses_close deleted file mode 120000 index f3682056..00000000 --- a/server/modules/pam-freiburg/etc/pam-script/pam_script_ses_close +++ /dev/null @@ -1 +0,0 @@ -/opt/openslx/scripts/pam_script_ses_close \ No newline at end of file diff --git a/server/modules/pam-freiburg/etc/pam-script/pam_script_ses_open b/server/modules/pam-freiburg/etc/pam-script/pam_script_ses_open deleted file mode 120000 index 4f5598e5..00000000 --- a/server/modules/pam-freiburg/etc/pam-script/pam_script_ses_open +++ /dev/null @@ -1 +0,0 @@ -/opt/openslx/scripts/pam_script_ses_open \ No newline at end of file diff --git a/server/modules/pam-freiburg/etc/pam.d/common-account b/server/modules/pam-freiburg/etc/pam.d/common-account deleted file mode 100644 index 3a5d5a14..00000000 --- a/server/modules/pam-freiburg/etc/pam.d/common-account +++ /dev/null @@ -1,26 +0,0 @@ -# -# /etc/pam.d/common-account - authorization settings common to all services -# -# This file is included from other service-specific PAM config files, -# and should contain a list of the authorization modules that define -# the central access policy for use on the system. The default is to -# only deny service to users whose accounts are expired in /etc/shadow. -# -# As of pam 1.0.1-6, this file is managed by pam-auth-update by default. -# To take advantage of this, it is recommended that you configure any -# local modules either before or after the default block, and use -# pam-auth-update to manage selection of other modules. See -# pam-auth-update(8) for details. -# - -# here are the per-package modules (the "Primary" block) -account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so -account [success=1 new_authtok_reqd=done default=ignore] pam_ldap.so use_first_pass -# here's the fallback if no module succeeds -account requisite pam_deny.so -# prime the stack with a positive return value if there isn't one already; -# this avoids us returning an error just because nothing sets a success code -# since the modules above will each just jump around -account required pam_permit.so -# and here are more per-package modules (the "Additional" block) -# end of pam-auth-update config diff --git a/server/modules/pam-freiburg/etc/pam.d/common-auth b/server/modules/pam-freiburg/etc/pam.d/common-auth deleted file mode 100644 index 790afa1d..00000000 --- a/server/modules/pam-freiburg/etc/pam.d/common-auth +++ /dev/null @@ -1,27 +0,0 @@ -# -# /etc/pam.d/common-auth - authentication settings common to all services -# -# This file is included from other service-specific PAM config files, -# and should contain a list of the authentication modules that define -# the central authentication scheme for use on the system -# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the -# traditional Unix authentication mechanisms. -# -# As of pam 1.0.1-6, this file is managed by pam-auth-update by default. -# To take advantage of this, it is recommended that you configure any -# local modules either before or after the default block, and use -# pam-auth-update to manage selection of other modules. See -# pam-auth-update(8) for details. - -# here are the per-package modules (the "Primary" block) -auth [success=3 default=ignore] pam_krb5.so minimum_uid=1000 -auth [success=2 default=ignore] pam_unix.so try_first_pass -auth [success=1 default=ignore] pam_ldap.so use_first_pass -# here's the fallback if no module succeeds -auth requisite pam_deny.so -# prime the stack with a positive return value if there isn't one already; -# this avoids us returning an error just because nothing sets a success code -# since the modules above will each just jump around -auth required pam_permit.so -# and here are more per-package modules (the "Additional" block) -# end of pam-auth-update config diff --git a/server/modules/pam-freiburg/etc/pam.d/common-password b/server/modules/pam-freiburg/etc/pam.d/common-password deleted file mode 100644 index cb8c7b71..00000000 --- a/server/modules/pam-freiburg/etc/pam.d/common-password +++ /dev/null @@ -1,33 +0,0 @@ -# -# /etc/pam.d/common-password - password-related modules common to all services -# -# This file is included from other service-specific PAM config files, -# and should contain a list of modules that define the services to be -# used to change user passwords. The default is pam_unix. - -# Explanation of pam_unix options: -# -# The "sha512" option enables salted SHA512 passwords. Without this option, -# the default is Unix crypt. Prior releases used the option "md5". -# -# The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in -# login.defs. -# -# See the pam_unix manpage for other options. - -# As of pam 1.0.1-6, this file is managed by pam-auth-update by default. -# To take advantage of this, it is recommended that you configure any -# local modules either before or after the default block, and use -# pam-auth-update to manage selection of other modules. See -# pam-auth-update(8) for details. - -# here are the per-package modules (the "Primary" block) -password [success=1 default=ignore] pam_unix.so obscure sha512 -# here's the fallback if no module succeeds -password requisite pam_deny.so -# prime the stack with a positive return value if there isn't one already; -# this avoids us returning an error just because nothing sets a success code -# since the modules above will each just jump around -password required pam_permit.so -# and here are more per-package modules (the "Additional" block) -# end of pam-auth-update config diff --git a/server/modules/pam-freiburg/etc/pam.d/common-session b/server/modules/pam-freiburg/etc/pam.d/common-session deleted file mode 100644 index 9a8b73e1..00000000 --- a/server/modules/pam-freiburg/etc/pam.d/common-session +++ /dev/null @@ -1,38 +0,0 @@ -# -# /etc/pam.d/common-session - session-related modules common to all services -# -# This file is included from other service-specific PAM config files, -# and should contain a list of modules that define tasks to be performed -# at the start and end of sessions of *any* kind (both interactive and -# non-interactive). -# -# As of pam 1.0.1-6, this file is managed by pam-auth-update by default. -# To take advantage of this, it is recommended that you configure any -# local modules either before or after the default block, and use -# pam-auth-update to manage selection of other modules. See -# pam-auth-update(8) for details. - -# here are the per-package modules (the "Primary" block) -session [default=1] pam_permit.so -# here's the fallback if no module succeeds -session requisite pam_deny.so -# prime the stack with a positive return value if there isn't one already; -# this avoids us returning an error just because nothing sets a success code -# since the modules above will each just jump around -session required pam_permit.so -# The pam_umask module will set the umask according to the system default in -# /etc/login.defs and user settings, solving the problem of different -# umask settings with different shells, display managers, remote sessions etc. -# See "man pam_umask". -session optional pam_umask.so -# and here are more per-package modules (the "Additional" block) -session required pam_systemd.so -session optional pam_ck_connector.so -session optional pam_env.so readenv=1 -session optional pam_env.so readenv=1 envfile=/etc/default/locale -session optional pam_krb5.so minimum_uid=1000 -session [success=1] pam_unix.so -session [success=ok] pam_ldap.so -session sufficient pam_script.so -session optional pam_mkhomedir.so skel=/etc/skel umask=0022 -# end of pam-auth-update config diff --git a/server/modules/pam-freiburg/etc/pam.d/common-session-noninteractive b/server/modules/pam-freiburg/etc/pam.d/common-session-noninteractive deleted file mode 100644 index 1fee2c4f..00000000 --- a/server/modules/pam-freiburg/etc/pam.d/common-session-noninteractive +++ /dev/null @@ -1,30 +0,0 @@ -# -# /etc/pam.d/common-session-noninteractive - session-related modules -# common to all non-interactive services -# -# This file is included from other service-specific PAM config files, -# and should contain a list of modules that define tasks to be performed -# at the start and end of all non-interactive sessions. -# -# As of pam 1.0.1-6, this file is managed by pam-auth-update by default. -# To take advantage of this, it is recommended that you configure any -# local modules either before or after the default block, and use -# pam-auth-update to manage selection of other modules. See -# pam-auth-update(8) for details. - -# here are the per-package modules (the "Primary" block) -session [default=1] pam_permit.so -# here's the fallback if no module succeeds -session requisite pam_deny.so -# prime the stack with a positive return value if there isn't one already; -# this avoids us returning an error just because nothing sets a success code -# since the modules above will each just jump around -session required pam_permit.so -# The pam_umask module will set the umask according to the system default in -# /etc/login.defs and user settings, solving the problem of different -# umask settings with different shells, display managers, remote sessions etc. -# See "man pam_umask". -session optional pam_umask.so -# and here are more per-package modules (the "Additional" block) -session required pam_unix.so -# end of pam-auth-update config diff --git a/server/modules/pam-freiburg/etc/pam.d/kdm b/server/modules/pam-freiburg/etc/pam.d/kdm deleted file mode 100644 index e6a4ec9b..00000000 --- a/server/modules/pam-freiburg/etc/pam.d/kdm +++ /dev/null @@ -1,10 +0,0 @@ -# -# /etc/pam.d/kdm - specify the PAM behaviour of kdm -# -auth required pam_nologin.so -auth required pam_env.so readenv=1 -auth required pam_env.so readenv=1 envfile=/etc/default/locale -auth include common-auth -account include common-account -password include common-password -session include common-session diff --git a/server/modules/pam-freiburg/etc/pam.d/kdm-np b/server/modules/pam-freiburg/etc/pam.d/kdm-np deleted file mode 100644 index dc10e5b5..00000000 --- a/server/modules/pam-freiburg/etc/pam.d/kdm-np +++ /dev/null @@ -1,11 +0,0 @@ -# -# /etc/pam.d/kdm-np - specify the PAM behaviour of kdm for passwordless logins -# -auth required pam_nologin.so -auth required pam_env.so readenv=1 -auth required pam_env.so readenv=1 envfile=/etc/default/locale -session required pam_limits.so -account include common-account -password include common-password -session include common-session -auth required pam_permit.so diff --git a/server/modules/pam-freiburg/etc/pam.d/login b/server/modules/pam-freiburg/etc/pam.d/login deleted file mode 100644 index 1065f351..00000000 --- a/server/modules/pam-freiburg/etc/pam.d/login +++ /dev/null @@ -1,101 +0,0 @@ -# -# The PAM configuration file for the Shadow `login' service -# - -# Enforce a minimal delay in case of failure (in microseconds). -# (Replaces the `FAIL_DELAY' setting from login.defs) -# Note that other modules may require another minimal delay. (for example, -# to disable any delay, you should add the nodelay option to pam_unix) -auth optional pam_faildelay.so delay=3000000 - -# Outputs an issue file prior to each login prompt (Replaces the -# ISSUE_FILE option from login.defs). Uncomment for use -# auth required pam_issue.so issue=/etc/issue - -# Disallows root logins except on tty's listed in /etc/securetty -# (Replaces the `CONSOLE' setting from login.defs) -# -# With the default control of this module: -# [success=ok new_authtok_reqd=ok ignore=ignore user_unknown=bad default=die] -# root will not be prompted for a password on insecure lines. -# if an invalid username is entered, a password is prompted (but login -# will eventually be rejected) -# -# You can change it to a "requisite" module if you think root may mis-type -# her login and should not be prompted for a password in that case. But -# this will leave the system as vulnerable to user enumeration attacks. -# -# You can change it to a "required" module if you think it permits to -# guess valid user names of your system (invalid user names are considered -# as possibly being root on insecure lines), but root passwords may be -# communicated over insecure lines. -auth [success=ok new_authtok_reqd=ok ignore=ignore user_unknown=bad default=die] pam_securetty.so - -# Disallows other than root logins when /etc/nologin exists -# (Replaces the `NOLOGINS_FILE' option from login.defs) -auth requisite pam_nologin.so - -# SELinux needs to be the first session rule. This ensures that any -# lingering context has been cleared. Without out this it is possible -# that a module could execute code in the wrong domain. -# When the module is present, "required" would be sufficient (When SELinux -# is disabled, this returns success.) -# OpenSLX: Not Needed? -#session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close - -# This module parses environment configuration file(s) -# and also allows you to use an extended config -# file /etc/security/pam_env.conf. -# -# parsing /etc/environment needs "readenv=1" -session required pam_env.so readenv=1 -# locale variables are also kept into /etc/default/locale in etch -# reading this file *in addition to /etc/environment* does not hurt -session required pam_env.so readenv=1 envfile=/etc/default/locale - -# Standard Un*x authentication. -auth include common-auth - -# TODO do we need this? -# This allows certain extra groups to be granted to a user -# based on things like time of day, tty, service, and user. -# Please edit /etc/security/group.conf to fit your needs -# (Replaces the `CONSOLE_GROUPS' option in login.defs) -#auth optional pam_group.so - -# Uncomment and edit /etc/security/time.conf if you need to set -# time restrainst on logins. -# (Replaces the `PORTTIME_CHECKS_ENAB' option from login.defs -# as well as /etc/porttime) -# account requisite pam_time.so - -# Uncomment and edit /etc/security/access.conf if you need to -# set access limits. -# (Replaces /etc/login.access file) -# account required pam_access.so - -# TODO do we need this? -# Sets up user limits according to /etc/security/limits.conf -# (Replaces the use of /etc/limits in old login) -#session required pam_limits.so - -# TODO check if this is needed -# Prints the last login info upon succesful login -# (Replaces the `LASTLOG_ENAB' option from login.defs) -session optional pam_lastlog.so - -# Prints the motd upon succesful login -# (Replaces the `MOTD_FILE' option in login.defs) -session optional pam_motd.so - -# Standard Un*x account and session -account include common-account -session include common-session -password include common-password - -# SELinux needs to intervene at login time to ensure that the process -# starts in the proper default security context. Only sessions which are -# intended to run in the user's context should be run after this. -session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open -# When the module is present, "required" would be sufficient (When SELinux -# is disabled, this returns success.) diff --git a/server/modules/pam-freiburg/etc/pam.d/other b/server/modules/pam-freiburg/etc/pam.d/other deleted file mode 100644 index 840eb77f..00000000 --- a/server/modules/pam-freiburg/etc/pam.d/other +++ /dev/null @@ -1,10 +0,0 @@ -#%PAM-1.0 -auth required pam_warn.so -auth required pam_deny.so -account required pam_warn.so -account required pam_deny.so -password required pam_warn.so -password required pam_deny.so -session required pam_warn.so -session required pam_deny.so - diff --git a/server/modules/pam-freiburg/etc/pam.d/passwd b/server/modules/pam-freiburg/etc/pam.d/passwd deleted file mode 100644 index 32eaa3c6..00000000 --- a/server/modules/pam-freiburg/etc/pam.d/passwd +++ /dev/null @@ -1,6 +0,0 @@ -# -# The PAM configuration file for the Shadow `passwd' service -# - -password include common-password - diff --git a/server/modules/pam-freiburg/etc/pam.d/sshd b/server/modules/pam-freiburg/etc/pam.d/sshd deleted file mode 100644 index 8954d639..00000000 --- a/server/modules/pam-freiburg/etc/pam.d/sshd +++ /dev/null @@ -1,41 +0,0 @@ -# PAM configuration for the Secure Shell service - -# Read environment variables from /etc/environment and -# /etc/security/pam_env.conf. -auth required pam_env.so # [1] -# In Debian 4.0 (etch), locale-related environment variables were moved to -# /etc/default/locale, so read that as well. -auth required pam_env.so envfile=/etc/default/locale - -# Standard Un*x authentication. -auth include common-auth - -# Disallow non-root logins when /etc/nologin exists. -account required pam_nologin.so - -# Uncomment and edit /etc/security/access.conf if you need to set complex -# access limits that are hard to express in sshd_config. -# account required pam_access.so - -# Standard Un*x authorization. -account include common-account - -# Standard Un*x session setup and teardown. -session include common-session - -# Print the message of the day upon successful login. -session optional pam_motd.so # [1] - -# TODO do we need this? -# Print the status of the user's mailbox upon successful login. -#session optional pam_mail.so standard noenv # [1] - -# TODO do we need this? -# Set up user limits from /etc/security/limits.conf. -#session required pam_limits.so - -# Set up SELinux capabilities (need modified pam) -# session required pam_selinux.so multiple - -# Standard Un*x password updating. -password include common-password diff --git a/server/modules/pam-freiburg/etc/pam.d/vmware-authd b/server/modules/pam-freiburg/etc/pam.d/vmware-authd deleted file mode 100644 index 1f9b60f9..00000000 --- a/server/modules/pam-freiburg/etc/pam.d/vmware-authd +++ /dev/null @@ -1,6 +0,0 @@ -#%PAM-1.0 -auth include common-auth -account include common-account -password include common-password -session include common-session - diff --git a/server/modules/pam-freiburg/etc/pam.d/xdm b/server/modules/pam-freiburg/etc/pam.d/xdm deleted file mode 100644 index d21651db..00000000 --- a/server/modules/pam-freiburg/etc/pam.d/xdm +++ /dev/null @@ -1,6 +0,0 @@ -#%PAM-1.0 -auth include common-auth -account include common-account -password include common-password -session required pam_loginuid.so -session include common-session diff --git a/server/modules/pam-freiburg/etc/systemd/system/activate-nss-ldap.service b/server/modules/pam-freiburg/etc/systemd/system/activate-nss-ldap.service deleted file mode 100644 index 664f7dd7..00000000 --- a/server/modules/pam-freiburg/etc/systemd/system/activate-nss-ldap.service +++ /dev/null @@ -1,10 +0,0 @@ -[Unit] -Description=Activate NSS-LDAP lookups -Before=graphical.target - -[Service] -Type=oneshot -ExecStart=-/opt/openslx/bin/mkdir /tmp/ldap -ExecStart=/opt/openslx/bin/sed -i -e 's/^passwd:.*$/passwd:\t\tcache files ldap/;s/^group:.*$/group:\t\tcache files ldap/' /etc/nsswitch.conf -ExecStart=/usr/bin/systemctl restart nscd - diff --git a/server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/activate-nss-ldap.service b/server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/activate-nss-ldap.service deleted file mode 120000 index 1102840c..00000000 --- a/server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/activate-nss-ldap.service +++ /dev/null @@ -1 +0,0 @@ -../activate-nss-ldap.service \ No newline at end of file diff --git a/server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/rpc-gssd.service b/server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/rpc-gssd.service deleted file mode 120000 index 194aba77..00000000 --- a/server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/rpc-gssd.service +++ /dev/null @@ -1 +0,0 @@ -../rpc-gssd.service \ No newline at end of file diff --git a/server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/rpc-idmapd.service b/server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/rpc-idmapd.service deleted file mode 120000 index 66a28252..00000000 --- a/server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/rpc-idmapd.service +++ /dev/null @@ -1 +0,0 @@ -../rpc-idmapd.service \ No newline at end of file diff --git a/server/modules/pam-freiburg/etc/systemd/system/rpc-gssd.service b/server/modules/pam-freiburg/etc/systemd/system/rpc-gssd.service deleted file mode 100644 index 79ffce8d..00000000 --- a/server/modules/pam-freiburg/etc/systemd/system/rpc-gssd.service +++ /dev/null @@ -1,7 +0,0 @@ -[Unit] -Description=NFS rpcsec_gss daemon -Requires=run-rpc_pipefs.mount -After=run-rpc_pipefs.mount - -[Service] -ExecStart=/usr/sbin/rpc.gssd -f -vvv -p /run/rpc_pipefs diff --git a/server/modules/pam-freiburg/etc/systemd/system/rpc-idmapd.service b/server/modules/pam-freiburg/etc/systemd/system/rpc-idmapd.service deleted file mode 100644 index c4da93e7..00000000 --- a/server/modules/pam-freiburg/etc/systemd/system/rpc-idmapd.service +++ /dev/null @@ -1,7 +0,0 @@ -[Unit] -Description=NFSv4 ID-name mapping daemon -Requires=network.target run-rpc_pipefs.mount -After=network.target - -[Service] -ExecStart=/usr/sbin/rpc.idmapd -f diff --git a/server/modules/pam-freiburg/etc/systemd/system/run-rpc_pipefs.mount b/server/modules/pam-freiburg/etc/systemd/system/run-rpc_pipefs.mount deleted file mode 100644 index 692adce8..00000000 --- a/server/modules/pam-freiburg/etc/systemd/system/run-rpc_pipefs.mount +++ /dev/null @@ -1,7 +0,0 @@ -[Unit] -Description=Pipefs RPC filesystem - -[Mount] -What=rpc_pipefs -Where=/run/rpc_pipefs -Type=rpc_pipefs diff --git a/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_close b/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_close deleted file mode 100755 index 44dcd418..00000000 --- a/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_close +++ /dev/null @@ -1,5 +0,0 @@ -#!/bin/bash - -[ ! -z "$SLX_DEBUG" ] && echo "[$PAM_TYPE] Closing session for $PAM_USER" - - diff --git a/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_open b/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_open deleted file mode 100755 index 205090b6..00000000 --- a/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_open +++ /dev/null @@ -1,35 +0,0 @@ -#!/bin/bash - -export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/openslx/bin:/opt/openslx/sbin:/opt/openslx/usr/bin:/opt/openslx/usr/sbin" - -[ ! -z "$SLX_DEBUG" ] && echo "[$PAM_TYPE] Opening session for $PAM_USER" - -if [ ! -z "$(mount|grep $PAM_USER)" ]; then - [ ! -z "$SLX_DEBUG" ] && echo "[$PAM_TYPE] Home directory of '$PAM_USER' is already mounted." - exit 0 -fi - -if [ $(id -g $PAM_USER) -ge 1000 ]; then - [ ! -z "$SLX_DEBUG" ] && echo "[$PAM_TYPE] Mounting home directory for $PAM_USER" - - # generate keytab - sslconnect npserv.ruf.uni-freiburg.de:3 > /etc/krb5.keytab - chmod 600 /etc/krb5.keytab - - # determine fileserver and share for home directories - ldapsearch -x -LLL uid="$PAM_USER" homeDirectory rufFileserver > /tmp/ldapsearch."$PAM_USER" - - FILESERVER=$(cat /tmp/ldapsearch.$PAM_USER | grep rufFileserver | cut -d" " -f2) - VOLUME=$(cat /tmp/ldapsearch.$PAM_USER | grep homeDirectory | cut -d" " -f2) - - # now we can mount the home directory! - mkdir -p /home/$PAM_USER - if mount -t nfs4 -o rw,nosuid,nodev,nolock,intr,hard,sloppy,sec=krb5p "$FILESERVER":"$VOLUME" /home/"$PAM_USER"; then - exit 0 - else - echo "Failed to mount home directory for $PAM_USER" - exit 1 - fi - -fi - -- cgit v1.2.3-55-g7522 From 16f8a9a10308a4dfaf8d1652a14b35bc7133299d Mon Sep 17 00:00:00 2001 From: Jonathan Bauer Date: Fri, 20 Sep 2013 17:07:41 +0200 Subject: workaround part 2 --- server/modules/pam-freiburg/etc/gssapi_mech.conf | 21 +++++ server/modules/pam-freiburg/etc/idmapd.conf | 12 +++ server/modules/pam-freiburg/etc/krb5.conf | 28 ++++++ server/modules/pam-freiburg/etc/ldap.conf | 11 +++ server/modules/pam-freiburg/etc/ldap/ldap.conf | 7 ++ server/modules/pam-freiburg/etc/openldap/ldap.conf | 1 + .../etc/pam-script/pam_script_ses_close | 1 + .../etc/pam-script/pam_script_ses_open | 1 + .../modules/pam-freiburg/etc/pam.d/common-account | 26 ++++++ server/modules/pam-freiburg/etc/pam.d/common-auth | 27 ++++++ .../modules/pam-freiburg/etc/pam.d/common-password | 33 +++++++ .../modules/pam-freiburg/etc/pam.d/common-session | 38 ++++++++ .../etc/pam.d/common-session-noninteractive | 30 ++++++ server/modules/pam-freiburg/etc/pam.d/kdm | 10 ++ server/modules/pam-freiburg/etc/pam.d/kdm-np | 11 +++ server/modules/pam-freiburg/etc/pam.d/login | 101 +++++++++++++++++++++ server/modules/pam-freiburg/etc/pam.d/other | 10 ++ server/modules/pam-freiburg/etc/pam.d/passwd | 6 ++ server/modules/pam-freiburg/etc/pam.d/sshd | 41 +++++++++ server/modules/pam-freiburg/etc/pam.d/vmware-authd | 6 ++ server/modules/pam-freiburg/etc/pam.d/xdm | 6 ++ .../etc/systemd/system/activate-nss-ldap.service | 10 ++ .../getty.target.wants/activate-nss-ldap.service | 1 + .../system/getty.target.wants/rpc-gssd.service | 1 + .../system/getty.target.wants/rpc-idmapd.service | 1 + .../etc/systemd/system/rpc-gssd.service | 7 ++ .../etc/systemd/system/rpc-idmapd.service | 7 ++ .../etc/systemd/system/run-rpc_pipefs.mount | 7 ++ .../opt/openslx/scripts/pam_script_ses_close | 5 + .../opt/openslx/scripts/pam_script_ses_open | 35 +++++++ 30 files changed, 501 insertions(+) create mode 100644 server/modules/pam-freiburg/etc/gssapi_mech.conf create mode 100644 server/modules/pam-freiburg/etc/idmapd.conf create mode 100644 server/modules/pam-freiburg/etc/krb5.conf create mode 100644 server/modules/pam-freiburg/etc/ldap.conf create mode 100644 server/modules/pam-freiburg/etc/ldap/ldap.conf create mode 120000 server/modules/pam-freiburg/etc/openldap/ldap.conf create mode 120000 server/modules/pam-freiburg/etc/pam-script/pam_script_ses_close create mode 120000 server/modules/pam-freiburg/etc/pam-script/pam_script_ses_open create mode 100644 server/modules/pam-freiburg/etc/pam.d/common-account create mode 100644 server/modules/pam-freiburg/etc/pam.d/common-auth create mode 100644 server/modules/pam-freiburg/etc/pam.d/common-password create mode 100644 server/modules/pam-freiburg/etc/pam.d/common-session create mode 100644 server/modules/pam-freiburg/etc/pam.d/common-session-noninteractive create mode 100644 server/modules/pam-freiburg/etc/pam.d/kdm create mode 100644 server/modules/pam-freiburg/etc/pam.d/kdm-np create mode 100644 server/modules/pam-freiburg/etc/pam.d/login create mode 100644 server/modules/pam-freiburg/etc/pam.d/other create mode 100644 server/modules/pam-freiburg/etc/pam.d/passwd create mode 100644 server/modules/pam-freiburg/etc/pam.d/sshd create mode 100644 server/modules/pam-freiburg/etc/pam.d/vmware-authd create mode 100644 server/modules/pam-freiburg/etc/pam.d/xdm create mode 100644 server/modules/pam-freiburg/etc/systemd/system/activate-nss-ldap.service create mode 120000 server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/activate-nss-ldap.service create mode 120000 server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/rpc-gssd.service create mode 120000 server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/rpc-idmapd.service create mode 100644 server/modules/pam-freiburg/etc/systemd/system/rpc-gssd.service create mode 100644 server/modules/pam-freiburg/etc/systemd/system/rpc-idmapd.service create mode 100644 server/modules/pam-freiburg/etc/systemd/system/run-rpc_pipefs.mount create mode 100755 server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_close create mode 100755 server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_open (limited to 'server') diff --git a/server/modules/pam-freiburg/etc/gssapi_mech.conf b/server/modules/pam-freiburg/etc/gssapi_mech.conf new file mode 100644 index 00000000..ac41f5fd --- /dev/null +++ b/server/modules/pam-freiburg/etc/gssapi_mech.conf @@ -0,0 +1,21 @@ +# Example /etc/gssapi_mech.conf file +# +# GSSAPI Mechanism Definitions +# +# This configuration file determines which GSS-API mechanisms +# the gssd code should use +# +# NOTE: +# The initiaiization function "mechglue_internal_krb5_init" +# is used for the MIT krb5 gssapi mechanism. This special +# function name indicates that an internal function should +# be used to determine the entry points for the MIT gssapi +# mechanism funtions. +# +# library initialization function +# ================================ ========================== +# The MIT K5 gssapi library, use special function for initialization. +libgssapi_krb5.so.2 mechglue_internal_krb5_init +# +# The SPKM3 gssapi library function. Use the function spkm3_gss_initialize. +# /usr/local/gss_mechs/spkm/spkm3/libgssapi_spkm3.so spkm3_gss_initialize diff --git a/server/modules/pam-freiburg/etc/idmapd.conf b/server/modules/pam-freiburg/etc/idmapd.conf new file mode 100644 index 00000000..2253cf0d --- /dev/null +++ b/server/modules/pam-freiburg/etc/idmapd.conf @@ -0,0 +1,12 @@ +[General] + +Verbosity = 0 +Pipefs-Directory = /run/rpc_pipefs +# set your own domain here, if id differs from FQDN minus hostname +Domain = uni-freiburg.de +# localdomain + +[Mapping] + +Nobody-User = nobody +Nobody-Group = nogroup diff --git a/server/modules/pam-freiburg/etc/krb5.conf b/server/modules/pam-freiburg/etc/krb5.conf new file mode 100644 index 00000000..6fd49243 --- /dev/null +++ b/server/modules/pam-freiburg/etc/krb5.conf @@ -0,0 +1,28 @@ +# file copied from configuration package (rootfs/etc/krb5.conf) +######################################################################### +[libdefaults] + noaddresses = false + clockskew = 300 + default_realm = PUBLIC.ADS.UNI-FREIBURG.DE + forwardable = true + minimum_uid = 1000 + proxiable = false + renew_lifetime = 30d + retain_after_close = false + ticket_lifetime = 3d + use_shmem = sshd + allow_weak_crypto=true +######################################################################### +[realms] + PUBLIC.ADS.UNI-FREIBURG.DE = { + kdc = kerberos.uni-freiburg.de + default_domain = uni-freiburg.de + admin_server = kerberos.uni-freiburg.de + } +######################################################################### +[domain_realm] + uni-freiburg.de = PUBLIC.ADS.UNI-FREIBURG.DE + .uni-freiburg.de = PUBLIC.ADS.UNI-FREIBURG.DE +########################################################################## +[appdefaults] +######################################################################### diff --git a/server/modules/pam-freiburg/etc/ldap.conf b/server/modules/pam-freiburg/etc/ldap.conf new file mode 100644 index 00000000..483595d2 --- /dev/null +++ b/server/modules/pam-freiburg/etc/ldap.conf @@ -0,0 +1,11 @@ +URI ldaps://bv1.ruf.uni-freiburg.de ldaps://bv2.ruf.uni-freiburg.de ldaps://bv3.ruf.uni-freiburg.de +BASE ou=people,dc=uni-freiburg,dc=de +BIND_TIMELIMIT 5 +TIMELIMIT 10 +LOGDIR /tmp/ldap +TLS_REQCERT allow +nss_base_passwd ou=people,dc=uni-freiburg,dc=de?one?rufdienst=ldap*)(&(rufclienthome=*)(rufstatus=enabled) +nss_base_group ou=group,dc=uni-freiburg,dc=de?one +nss_map_attribute homeDirectory rufClientHome + +nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,distccd,games,git,gnats,hplip,irc,kdm,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,ntp,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,statd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data diff --git a/server/modules/pam-freiburg/etc/ldap/ldap.conf b/server/modules/pam-freiburg/etc/ldap/ldap.conf new file mode 100644 index 00000000..809065cc --- /dev/null +++ b/server/modules/pam-freiburg/etc/ldap/ldap.conf @@ -0,0 +1,7 @@ +URI ldaps://bv1.ruf.uni-freiburg.de ldaps://bv2.ruf.uni-freiburg.de ldaps://bv3.ruf.uni-freiburg.de +BASE ou=people,dc=uni-freiburg,dc=de +TLS_REQCERT allow +nss_base_passwd ou=people,dc=uni-freiburg,dc=de?one?rufdienst=ldap*)(&(rufclienthome=*)(rufstatus=enabled) +nss_base_group ou=group,dc=uni-freiburg,dc=de?one +nss_map_attribute homeDirectory rufClientHome + diff --git a/server/modules/pam-freiburg/etc/openldap/ldap.conf b/server/modules/pam-freiburg/etc/openldap/ldap.conf new file mode 120000 index 00000000..c0aaf459 --- /dev/null +++ b/server/modules/pam-freiburg/etc/openldap/ldap.conf @@ -0,0 +1 @@ +/etc/ldap.conf \ No newline at end of file diff --git a/server/modules/pam-freiburg/etc/pam-script/pam_script_ses_close b/server/modules/pam-freiburg/etc/pam-script/pam_script_ses_close new file mode 120000 index 00000000..f3682056 --- /dev/null +++ b/server/modules/pam-freiburg/etc/pam-script/pam_script_ses_close @@ -0,0 +1 @@ +/opt/openslx/scripts/pam_script_ses_close \ No newline at end of file diff --git a/server/modules/pam-freiburg/etc/pam-script/pam_script_ses_open b/server/modules/pam-freiburg/etc/pam-script/pam_script_ses_open new file mode 120000 index 00000000..4f5598e5 --- /dev/null +++ b/server/modules/pam-freiburg/etc/pam-script/pam_script_ses_open @@ -0,0 +1 @@ +/opt/openslx/scripts/pam_script_ses_open \ No newline at end of file diff --git a/server/modules/pam-freiburg/etc/pam.d/common-account b/server/modules/pam-freiburg/etc/pam.d/common-account new file mode 100644 index 00000000..3a5d5a14 --- /dev/null +++ b/server/modules/pam-freiburg/etc/pam.d/common-account @@ -0,0 +1,26 @@ +# +# /etc/pam.d/common-account - authorization settings common to all services +# +# This file is included from other service-specific PAM config files, +# and should contain a list of the authorization modules that define +# the central access policy for use on the system. The default is to +# only deny service to users whose accounts are expired in /etc/shadow. +# +# As of pam 1.0.1-6, this file is managed by pam-auth-update by default. +# To take advantage of this, it is recommended that you configure any +# local modules either before or after the default block, and use +# pam-auth-update to manage selection of other modules. See +# pam-auth-update(8) for details. +# + +# here are the per-package modules (the "Primary" block) +account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so +account [success=1 new_authtok_reqd=done default=ignore] pam_ldap.so use_first_pass +# here's the fallback if no module succeeds +account requisite pam_deny.so +# prime the stack with a positive return value if there isn't one already; +# this avoids us returning an error just because nothing sets a success code +# since the modules above will each just jump around +account required pam_permit.so +# and here are more per-package modules (the "Additional" block) +# end of pam-auth-update config diff --git a/server/modules/pam-freiburg/etc/pam.d/common-auth b/server/modules/pam-freiburg/etc/pam.d/common-auth new file mode 100644 index 00000000..790afa1d --- /dev/null +++ b/server/modules/pam-freiburg/etc/pam.d/common-auth @@ -0,0 +1,27 @@ +# +# /etc/pam.d/common-auth - authentication settings common to all services +# +# This file is included from other service-specific PAM config files, +# and should contain a list of the authentication modules that define +# the central authentication scheme for use on the system +# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the +# traditional Unix authentication mechanisms. +# +# As of pam 1.0.1-6, this file is managed by pam-auth-update by default. +# To take advantage of this, it is recommended that you configure any +# local modules either before or after the default block, and use +# pam-auth-update to manage selection of other modules. See +# pam-auth-update(8) for details. + +# here are the per-package modules (the "Primary" block) +auth [success=3 default=ignore] pam_krb5.so minimum_uid=1000 +auth [success=2 default=ignore] pam_unix.so try_first_pass +auth [success=1 default=ignore] pam_ldap.so use_first_pass +# here's the fallback if no module succeeds +auth requisite pam_deny.so +# prime the stack with a positive return value if there isn't one already; +# this avoids us returning an error just because nothing sets a success code +# since the modules above will each just jump around +auth required pam_permit.so +# and here are more per-package modules (the "Additional" block) +# end of pam-auth-update config diff --git a/server/modules/pam-freiburg/etc/pam.d/common-password b/server/modules/pam-freiburg/etc/pam.d/common-password new file mode 100644 index 00000000..cb8c7b71 --- /dev/null +++ b/server/modules/pam-freiburg/etc/pam.d/common-password @@ -0,0 +1,33 @@ +# +# /etc/pam.d/common-password - password-related modules common to all services +# +# This file is included from other service-specific PAM config files, +# and should contain a list of modules that define the services to be +# used to change user passwords. The default is pam_unix. + +# Explanation of pam_unix options: +# +# The "sha512" option enables salted SHA512 passwords. Without this option, +# the default is Unix crypt. Prior releases used the option "md5". +# +# The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in +# login.defs. +# +# See the pam_unix manpage for other options. + +# As of pam 1.0.1-6, this file is managed by pam-auth-update by default. +# To take advantage of this, it is recommended that you configure any +# local modules either before or after the default block, and use +# pam-auth-update to manage selection of other modules. See +# pam-auth-update(8) for details. + +# here are the per-package modules (the "Primary" block) +password [success=1 default=ignore] pam_unix.so obscure sha512 +# here's the fallback if no module succeeds +password requisite pam_deny.so +# prime the stack with a positive return value if there isn't one already; +# this avoids us returning an error just because nothing sets a success code +# since the modules above will each just jump around +password required pam_permit.so +# and here are more per-package modules (the "Additional" block) +# end of pam-auth-update config diff --git a/server/modules/pam-freiburg/etc/pam.d/common-session b/server/modules/pam-freiburg/etc/pam.d/common-session new file mode 100644 index 00000000..9a8b73e1 --- /dev/null +++ b/server/modules/pam-freiburg/etc/pam.d/common-session @@ -0,0 +1,38 @@ +# +# /etc/pam.d/common-session - session-related modules common to all services +# +# This file is included from other service-specific PAM config files, +# and should contain a list of modules that define tasks to be performed +# at the start and end of sessions of *any* kind (both interactive and +# non-interactive). +# +# As of pam 1.0.1-6, this file is managed by pam-auth-update by default. +# To take advantage of this, it is recommended that you configure any +# local modules either before or after the default block, and use +# pam-auth-update to manage selection of other modules. See +# pam-auth-update(8) for details. + +# here are the per-package modules (the "Primary" block) +session [default=1] pam_permit.so +# here's the fallback if no module succeeds +session requisite pam_deny.so +# prime the stack with a positive return value if there isn't one already; +# this avoids us returning an error just because nothing sets a success code +# since the modules above will each just jump around +session required pam_permit.so +# The pam_umask module will set the umask according to the system default in +# /etc/login.defs and user settings, solving the problem of different +# umask settings with different shells, display managers, remote sessions etc. +# See "man pam_umask". +session optional pam_umask.so +# and here are more per-package modules (the "Additional" block) +session required pam_systemd.so +session optional pam_ck_connector.so +session optional pam_env.so readenv=1 +session optional pam_env.so readenv=1 envfile=/etc/default/locale +session optional pam_krb5.so minimum_uid=1000 +session [success=1] pam_unix.so +session [success=ok] pam_ldap.so +session sufficient pam_script.so +session optional pam_mkhomedir.so skel=/etc/skel umask=0022 +# end of pam-auth-update config diff --git a/server/modules/pam-freiburg/etc/pam.d/common-session-noninteractive b/server/modules/pam-freiburg/etc/pam.d/common-session-noninteractive new file mode 100644 index 00000000..1fee2c4f --- /dev/null +++ b/server/modules/pam-freiburg/etc/pam.d/common-session-noninteractive @@ -0,0 +1,30 @@ +# +# /etc/pam.d/common-session-noninteractive - session-related modules +# common to all non-interactive services +# +# This file is included from other service-specific PAM config files, +# and should contain a list of modules that define tasks to be performed +# at the start and end of all non-interactive sessions. +# +# As of pam 1.0.1-6, this file is managed by pam-auth-update by default. +# To take advantage of this, it is recommended that you configure any +# local modules either before or after the default block, and use +# pam-auth-update to manage selection of other modules. See +# pam-auth-update(8) for details. + +# here are the per-package modules (the "Primary" block) +session [default=1] pam_permit.so +# here's the fallback if no module succeeds +session requisite pam_deny.so +# prime the stack with a positive return value if there isn't one already; +# this avoids us returning an error just because nothing sets a success code +# since the modules above will each just jump around +session required pam_permit.so +# The pam_umask module will set the umask according to the system default in +# /etc/login.defs and user settings, solving the problem of different +# umask settings with different shells, display managers, remote sessions etc. +# See "man pam_umask". +session optional pam_umask.so +# and here are more per-package modules (the "Additional" block) +session required pam_unix.so +# end of pam-auth-update config diff --git a/server/modules/pam-freiburg/etc/pam.d/kdm b/server/modules/pam-freiburg/etc/pam.d/kdm new file mode 100644 index 00000000..e6a4ec9b --- /dev/null +++ b/server/modules/pam-freiburg/etc/pam.d/kdm @@ -0,0 +1,10 @@ +# +# /etc/pam.d/kdm - specify the PAM behaviour of kdm +# +auth required pam_nologin.so +auth required pam_env.so readenv=1 +auth required pam_env.so readenv=1 envfile=/etc/default/locale +auth include common-auth +account include common-account +password include common-password +session include common-session diff --git a/server/modules/pam-freiburg/etc/pam.d/kdm-np b/server/modules/pam-freiburg/etc/pam.d/kdm-np new file mode 100644 index 00000000..dc10e5b5 --- /dev/null +++ b/server/modules/pam-freiburg/etc/pam.d/kdm-np @@ -0,0 +1,11 @@ +# +# /etc/pam.d/kdm-np - specify the PAM behaviour of kdm for passwordless logins +# +auth required pam_nologin.so +auth required pam_env.so readenv=1 +auth required pam_env.so readenv=1 envfile=/etc/default/locale +session required pam_limits.so +account include common-account +password include common-password +session include common-session +auth required pam_permit.so diff --git a/server/modules/pam-freiburg/etc/pam.d/login b/server/modules/pam-freiburg/etc/pam.d/login new file mode 100644 index 00000000..1065f351 --- /dev/null +++ b/server/modules/pam-freiburg/etc/pam.d/login @@ -0,0 +1,101 @@ +# +# The PAM configuration file for the Shadow `login' service +# + +# Enforce a minimal delay in case of failure (in microseconds). +# (Replaces the `FAIL_DELAY' setting from login.defs) +# Note that other modules may require another minimal delay. (for example, +# to disable any delay, you should add the nodelay option to pam_unix) +auth optional pam_faildelay.so delay=3000000 + +# Outputs an issue file prior to each login prompt (Replaces the +# ISSUE_FILE option from login.defs). Uncomment for use +# auth required pam_issue.so issue=/etc/issue + +# Disallows root logins except on tty's listed in /etc/securetty +# (Replaces the `CONSOLE' setting from login.defs) +# +# With the default control of this module: +# [success=ok new_authtok_reqd=ok ignore=ignore user_unknown=bad default=die] +# root will not be prompted for a password on insecure lines. +# if an invalid username is entered, a password is prompted (but login +# will eventually be rejected) +# +# You can change it to a "requisite" module if you think root may mis-type +# her login and should not be prompted for a password in that case. But +# this will leave the system as vulnerable to user enumeration attacks. +# +# You can change it to a "required" module if you think it permits to +# guess valid user names of your system (invalid user names are considered +# as possibly being root on insecure lines), but root passwords may be +# communicated over insecure lines. +auth [success=ok new_authtok_reqd=ok ignore=ignore user_unknown=bad default=die] pam_securetty.so + +# Disallows other than root logins when /etc/nologin exists +# (Replaces the `NOLOGINS_FILE' option from login.defs) +auth requisite pam_nologin.so + +# SELinux needs to be the first session rule. This ensures that any +# lingering context has been cleared. Without out this it is possible +# that a module could execute code in the wrong domain. +# When the module is present, "required" would be sufficient (When SELinux +# is disabled, this returns success.) +# OpenSLX: Not Needed? +#session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close + +# This module parses environment configuration file(s) +# and also allows you to use an extended config +# file /etc/security/pam_env.conf. +# +# parsing /etc/environment needs "readenv=1" +session required pam_env.so readenv=1 +# locale variables are also kept into /etc/default/locale in etch +# reading this file *in addition to /etc/environment* does not hurt +session required pam_env.so readenv=1 envfile=/etc/default/locale + +# Standard Un*x authentication. +auth include common-auth + +# TODO do we need this? +# This allows certain extra groups to be granted to a user +# based on things like time of day, tty, service, and user. +# Please edit /etc/security/group.conf to fit your needs +# (Replaces the `CONSOLE_GROUPS' option in login.defs) +#auth optional pam_group.so + +# Uncomment and edit /etc/security/time.conf if you need to set +# time restrainst on logins. +# (Replaces the `PORTTIME_CHECKS_ENAB' option from login.defs +# as well as /etc/porttime) +# account requisite pam_time.so + +# Uncomment and edit /etc/security/access.conf if you need to +# set access limits. +# (Replaces /etc/login.access file) +# account required pam_access.so + +# TODO do we need this? +# Sets up user limits according to /etc/security/limits.conf +# (Replaces the use of /etc/limits in old login) +#session required pam_limits.so + +# TODO check if this is needed +# Prints the last login info upon succesful login +# (Replaces the `LASTLOG_ENAB' option from login.defs) +session optional pam_lastlog.so + +# Prints the motd upon succesful login +# (Replaces the `MOTD_FILE' option in login.defs) +session optional pam_motd.so + +# Standard Un*x account and session +account include common-account +session include common-session +password include common-password + +# SELinux needs to intervene at login time to ensure that the process +# starts in the proper default security context. Only sessions which are +# intended to run in the user's context should be run after this. +session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open +# When the module is present, "required" would be sufficient (When SELinux +# is disabled, this returns success.) diff --git a/server/modules/pam-freiburg/etc/pam.d/other b/server/modules/pam-freiburg/etc/pam.d/other new file mode 100644 index 00000000..840eb77f --- /dev/null +++ b/server/modules/pam-freiburg/etc/pam.d/other @@ -0,0 +1,10 @@ +#%PAM-1.0 +auth required pam_warn.so +auth required pam_deny.so +account required pam_warn.so +account required pam_deny.so +password required pam_warn.so +password required pam_deny.so +session required pam_warn.so +session required pam_deny.so + diff --git a/server/modules/pam-freiburg/etc/pam.d/passwd b/server/modules/pam-freiburg/etc/pam.d/passwd new file mode 100644 index 00000000..32eaa3c6 --- /dev/null +++ b/server/modules/pam-freiburg/etc/pam.d/passwd @@ -0,0 +1,6 @@ +# +# The PAM configuration file for the Shadow `passwd' service +# + +password include common-password + diff --git a/server/modules/pam-freiburg/etc/pam.d/sshd b/server/modules/pam-freiburg/etc/pam.d/sshd new file mode 100644 index 00000000..8954d639 --- /dev/null +++ b/server/modules/pam-freiburg/etc/pam.d/sshd @@ -0,0 +1,41 @@ +# PAM configuration for the Secure Shell service + +# Read environment variables from /etc/environment and +# /etc/security/pam_env.conf. +auth required pam_env.so # [1] +# In Debian 4.0 (etch), locale-related environment variables were moved to +# /etc/default/locale, so read that as well. +auth required pam_env.so envfile=/etc/default/locale + +# Standard Un*x authentication. +auth include common-auth + +# Disallow non-root logins when /etc/nologin exists. +account required pam_nologin.so + +# Uncomment and edit /etc/security/access.conf if you need to set complex +# access limits that are hard to express in sshd_config. +# account required pam_access.so + +# Standard Un*x authorization. +account include common-account + +# Standard Un*x session setup and teardown. +session include common-session + +# Print the message of the day upon successful login. +session optional pam_motd.so # [1] + +# TODO do we need this? +# Print the status of the user's mailbox upon successful login. +#session optional pam_mail.so standard noenv # [1] + +# TODO do we need this? +# Set up user limits from /etc/security/limits.conf. +#session required pam_limits.so + +# Set up SELinux capabilities (need modified pam) +# session required pam_selinux.so multiple + +# Standard Un*x password updating. +password include common-password diff --git a/server/modules/pam-freiburg/etc/pam.d/vmware-authd b/server/modules/pam-freiburg/etc/pam.d/vmware-authd new file mode 100644 index 00000000..1f9b60f9 --- /dev/null +++ b/server/modules/pam-freiburg/etc/pam.d/vmware-authd @@ -0,0 +1,6 @@ +#%PAM-1.0 +auth include common-auth +account include common-account +password include common-password +session include common-session + diff --git a/server/modules/pam-freiburg/etc/pam.d/xdm b/server/modules/pam-freiburg/etc/pam.d/xdm new file mode 100644 index 00000000..d21651db --- /dev/null +++ b/server/modules/pam-freiburg/etc/pam.d/xdm @@ -0,0 +1,6 @@ +#%PAM-1.0 +auth include common-auth +account include common-account +password include common-password +session required pam_loginuid.so +session include common-session diff --git a/server/modules/pam-freiburg/etc/systemd/system/activate-nss-ldap.service b/server/modules/pam-freiburg/etc/systemd/system/activate-nss-ldap.service new file mode 100644 index 00000000..664f7dd7 --- /dev/null +++ b/server/modules/pam-freiburg/etc/systemd/system/activate-nss-ldap.service @@ -0,0 +1,10 @@ +[Unit] +Description=Activate NSS-LDAP lookups +Before=graphical.target + +[Service] +Type=oneshot +ExecStart=-/opt/openslx/bin/mkdir /tmp/ldap +ExecStart=/opt/openslx/bin/sed -i -e 's/^passwd:.*$/passwd:\t\tcache files ldap/;s/^group:.*$/group:\t\tcache files ldap/' /etc/nsswitch.conf +ExecStart=/usr/bin/systemctl restart nscd + diff --git a/server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/activate-nss-ldap.service b/server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/activate-nss-ldap.service new file mode 120000 index 00000000..1102840c --- /dev/null +++ b/server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/activate-nss-ldap.service @@ -0,0 +1 @@ +../activate-nss-ldap.service \ No newline at end of file diff --git a/server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/rpc-gssd.service b/server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/rpc-gssd.service new file mode 120000 index 00000000..194aba77 --- /dev/null +++ b/server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/rpc-gssd.service @@ -0,0 +1 @@ +../rpc-gssd.service \ No newline at end of file diff --git a/server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/rpc-idmapd.service b/server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/rpc-idmapd.service new file mode 120000 index 00000000..66a28252 --- /dev/null +++ b/server/modules/pam-freiburg/etc/systemd/system/getty.target.wants/rpc-idmapd.service @@ -0,0 +1 @@ +../rpc-idmapd.service \ No newline at end of file diff --git a/server/modules/pam-freiburg/etc/systemd/system/rpc-gssd.service b/server/modules/pam-freiburg/etc/systemd/system/rpc-gssd.service new file mode 100644 index 00000000..79ffce8d --- /dev/null +++ b/server/modules/pam-freiburg/etc/systemd/system/rpc-gssd.service @@ -0,0 +1,7 @@ +[Unit] +Description=NFS rpcsec_gss daemon +Requires=run-rpc_pipefs.mount +After=run-rpc_pipefs.mount + +[Service] +ExecStart=/usr/sbin/rpc.gssd -f -vvv -p /run/rpc_pipefs diff --git a/server/modules/pam-freiburg/etc/systemd/system/rpc-idmapd.service b/server/modules/pam-freiburg/etc/systemd/system/rpc-idmapd.service new file mode 100644 index 00000000..c4da93e7 --- /dev/null +++ b/server/modules/pam-freiburg/etc/systemd/system/rpc-idmapd.service @@ -0,0 +1,7 @@ +[Unit] +Description=NFSv4 ID-name mapping daemon +Requires=network.target run-rpc_pipefs.mount +After=network.target + +[Service] +ExecStart=/usr/sbin/rpc.idmapd -f diff --git a/server/modules/pam-freiburg/etc/systemd/system/run-rpc_pipefs.mount b/server/modules/pam-freiburg/etc/systemd/system/run-rpc_pipefs.mount new file mode 100644 index 00000000..692adce8 --- /dev/null +++ b/server/modules/pam-freiburg/etc/systemd/system/run-rpc_pipefs.mount @@ -0,0 +1,7 @@ +[Unit] +Description=Pipefs RPC filesystem + +[Mount] +What=rpc_pipefs +Where=/run/rpc_pipefs +Type=rpc_pipefs diff --git a/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_close b/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_close new file mode 100755 index 00000000..44dcd418 --- /dev/null +++ b/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_close @@ -0,0 +1,5 @@ +#!/bin/bash + +[ ! -z "$SLX_DEBUG" ] && echo "[$PAM_TYPE] Closing session for $PAM_USER" + + diff --git a/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_open b/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_open new file mode 100755 index 00000000..205090b6 --- /dev/null +++ b/server/modules/pam-freiburg/opt/openslx/scripts/pam_script_ses_open @@ -0,0 +1,35 @@ +#!/bin/bash + +export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/openslx/bin:/opt/openslx/sbin:/opt/openslx/usr/bin:/opt/openslx/usr/sbin" + +[ ! -z "$SLX_DEBUG" ] && echo "[$PAM_TYPE] Opening session for $PAM_USER" + +if [ ! -z "$(mount|grep $PAM_USER)" ]; then + [ ! -z "$SLX_DEBUG" ] && echo "[$PAM_TYPE] Home directory of '$PAM_USER' is already mounted." + exit 0 +fi + +if [ $(id -g $PAM_USER) -ge 1000 ]; then + [ ! -z "$SLX_DEBUG" ] && echo "[$PAM_TYPE] Mounting home directory for $PAM_USER" + + # generate keytab + sslconnect npserv.ruf.uni-freiburg.de:3 > /etc/krb5.keytab + chmod 600 /etc/krb5.keytab + + # determine fileserver and share for home directories + ldapsearch -x -LLL uid="$PAM_USER" homeDirectory rufFileserver > /tmp/ldapsearch."$PAM_USER" + + FILESERVER=$(cat /tmp/ldapsearch.$PAM_USER | grep rufFileserver | cut -d" " -f2) + VOLUME=$(cat /tmp/ldapsearch.$PAM_USER | grep homeDirectory | cut -d" " -f2) + + # now we can mount the home directory! + mkdir -p /home/$PAM_USER + if mount -t nfs4 -o rw,nosuid,nodev,nolock,intr,hard,sloppy,sec=krb5p "$FILESERVER":"$VOLUME" /home/"$PAM_USER"; then + exit 0 + else + echo "Failed to mount home directory for $PAM_USER" + exit 1 + fi + +fi + -- cgit v1.2.3-55-g7522