path: root/src/os-plugins/plugins/auth/XX_auth.sh

# Copyright (c) 2010 - OpenSLX GmbH
#
# This program/file is free software distributed under the GPL version 2.
# See http://openslx.org/COPYING
#
# If you have any feedback please consult http://openslx.org/feedback and
# send your feedback to feedback@openslx.org
#
# General information about OpenSLX can be found at http://openslx.org
#
# script is included from init via the "." load function - thus it has all
# variables and functions available

# check if the configuration file is available
if [ -e /initramfs/plugin-conf/auth.conf ]; then

  . /etc/openslx.conf
  ETCDIR=/mnt/${OPENSLX_DEFAULT_CONFDIR}
  PLUGINCONFDIR=${ETCDIR}/plugins/auth
  BINDIR=/mnt/${OPENSLX_DEFAULT_BINDIR}
  PLUGINDIR=/mnt/${OPENSLX_DEFAULT_DIR}/plugin-repo/auth
  VIRTDIR=/mnt/${OPENSLX_DEFAULT_VIRTDIR}

  # load needed variables
  . /initramfs/plugin-conf/auth.conf

  # get distribution info; has also version if needed...
  . /etc/slxsystem.conf
  distro=$slxconf_distro_name
  distro_version=$slxconf_distro_ver

  # Test if this plugin is activated... more or less useless with the
  # new plugin system
  if [ $auth_active -ne 0 ]; then
    [ $DEBUGLEVEL -gt 0 ] && echo "executing the 'auth' os-plugin ...";
    # load general configuration
    . /initramfs/machine-setup

    # Passwd: todo: move somewhere else
    chown root:shadow /mnt/etc/shadow
    chmod 0640 /mnt/etc/shadow
    chown root:root /mnt/etc/paswd
    chmod 0644 /mnt/etc/passwd
    #sed -i 's/auth_rootpwd.*/auth_rootpwd=*********/' $PLUGINCONFDIR/auth.conf

    # set authentication to passwd and group which is default
    sed -i  's/^passwd:.*/passwd: files/' /mnt/etc/nsswitch.conf
    sed -i  's/^group:.*/group: files/' /mnt/etc/nsswitch.conf

    # general requirement
    rllinker "nscd" 16 8

    ######
    # LDAP
    ######
    if [ $auth_ldap -eq 1 ]; then
      cp ${PLUGINDIR}/ldap.conf.slx /mnt/etc/ldap.conf
      ln -sf /etc/ldap.conf /mnt/etc/openldap/ldap.conf # required for openSUSE 11.4
      # even if their syntax can differ, we copy them
      #   (and hope no nss_* attributes where used)
      echo "# Created by XX_auth.sh (auth-plugin) for compatibility reasons" \
        > /mnt/etc/nslcd.conf
      cat ${PLUGINDIR}/ldap.conf.slx >> /mnt/etc/nslcd.conf # required for openSUSE 11.4
      ln -sf /etc/ldap.conf /mnt/etc/ldap/ldap.conf

      # PAM: add ldap conf before pam_unix(2).so; SuSE: ...-pc
      sed -i \
        '/^account.*req.*pam_unix/ s/^/account sufficient pam_ldap.so\n/' \
        /mnt/etc/pam.d/common-account /mnt/etc/pam.d/common-account-pc
      sed -i \
        '/^auth.*req.*pam_unix/ s/^/auth sufficient pam_ldap.so\n/' \
        /mnt/etc/pam.d/common-auth /mnt/etc/pam.d/common-auth-pc

      sed -i  's/^\(passwd:.*\)/\1 ldap/' /mnt/etc/nsswitch.conf
      sed -i  's/^\(group:.*\)/\1 ldap/' /mnt/etc/nsswitch.conf

      case "$distro" in
        suse)
          rllinker "nslcd" 20 8  # req. with OpenSuSE 11.4
          ;;
      esac

      # just to be on the save side... usually nslcd isn't used.
      sed -i "s/^\(nss_.*\)/#XX_auth.sh#\1/" /mnt/etc/nslcd.conf
        
      # hack. if we want to have totally custom ldap.conf files...
      if [ -f ${PLUGINDIR}/ldap.conf ]; then
        echo "# copied from auth::files (default: /root/auth-plugin)" \
          > /mnt/etc/ldap.conf
        cat ${PLUGINDIR}/ldap.conf >> /mnt/etc/ldap.conf
      fi
      # similiar to ldap.conf, but just similiar
      if [ -f ${PLUGINDIR}/nslcd.conf ]; then
        echo "# copied from auth::files (default: /root/auth-plugin)" \
          > /mnt/etc/nslcd.conf
        cat ${PLUGINDIR}/nslcd.conf >> /mnt/etc/nslcd.conf # openSUSE 11.4
      fi

    fi

    ########################
    # AUTOMOUNT, NFS partial
    ########################
    if [ $auth_automount -eq 1 ]; then
      cp ${PLUGINDIR}/auto.master /mnt/etc
      cp ${PLUGINDIR}/auto.slx /mnt/etc
      if [! -d /mnt/$auth_automnt_dir ]; then
        mkdir -p /mnt/$auth_automnt_dir
      fi

#      config_portmap # distro specific configuration :(
#      config_automount # distro specific configuration :(
#      config_nfs # distro specific config... activates gssd and idmapd

      # ubuntu
      case $distro in
        ubuntu)
          sed -e 's,start on ,start on filesystem #,' \
            -i /mnt/etc/init/statd.conf
          echo -e "alias autofs autofs4" >>/mnt/etc/modprobe.d/aliases.conf
          # no nfs-common initscirpt  at 10.04, but other ones
          # statd not required for NFSv4..
          sed -i 's/^NEED_STATD=.*/NEED_STATD=yes/' /mnt/etc/default/nfs-common
          # optional, but helps in the future to move stuff out of OpenSLX to distri-tools
          rllinker "portmap" 12 8 # required 10.04+11.04 with nfs to start rpc.statd
          rllinker "portmap-wait" 12 8 # required 10.04+11.04 with nfs to start rpc.statd
          rllinker "rpc_pipefs" 14 8
          rllinker "statd" 13 8 #fails
          rllinker "autofs" 14 8
          # workaround for not starting statd. 10.04 affected, 11.04 not affected!?!
          echo "                  # auth-plugin: workaround for statd
                 #mount -t rpc_pipefs rpc_pipefs /var/lib/nfs/rpc_pipefs
                 rpc.statd -L" \
               >> /mnt/etc/init.d/boot.slx
          rllinker "boot.slx" 2 20
          ;;
        suse)
          # enable generall nfs support
          sed -i 's/^NFS_START_SERVICES.*/NFS_START_SERVICES="yes"/' /mnt/etc/sysconfig/nfs
          rllinker "rpcbind" 4 21
          rllinker "nfs" 14 20
          rllinker "autofs" 18 4
          ;;
      esac
    fi

    #######
    # NFSv4
    #######
    if [ $auth_nfs4 -eq 1 ]; then

      # /etc/init-hell
      case "$distro" in
        suse)
          # for idmap 
          sed -i 's/^NFS_START_SERVICES.*/NFS_START_SERVICES="yes"/' /mnt/etc/sysconfig/nfs
          # optional, but may help in the future to move stuff out of OpenSLX to distri-tools
          rllinker "rpcbind" 4 21
          rllinker "nfs" 14 8  # handles idmap & gssd
          ;;
        ubuntu)
          # nfs-common: somewhere before 10.04, not available with 10.04ff
          rllinker "nfs-common" 16 8
          # enable idmapd
          sed -i 's/^NEED_IDMAPD=.*/NEED_IDMAPD=yes/' /mnt/etc/default/nfs-common
          # rpc_pipefs, portmap and idmap rllinker are optional
          # but may help in the future to move stuff out of OpenSLX to distri-tools
          rllinker "rpc_pipefs" 13 8  #doenst work somehow. could be mount/not mounted quirks
          rllinker "portmap" 14 8
          # optional, but helps in the future to move stuff out of OpenSLX to distri-tools
          rllinker "idmapd" 17 8
          # somehow idmapd doesnt want to start, because rpc_pipefs, even if enabled, doesn't
          # mount the required path. happend with a cloned ubuntu 10.04. therefore a workaround
          echo "                  # auth-plugin: workaround for idmapd
                  mount -t rpc_pipefs rpc_pipefs /var/lib/nfs/rpc_pipefs
                  # doesn't matter if already running
                  echo \"start idmapd (again)\"
                  service idmapd start" \
              >> /mnt/etc/init.d/boot.slx
          rllinker "boot.slx" 2 20
          ;;
      esac

      sed -i \
        "s/^Domain.*/Domain = ${auth_idmap_domain}/" \
        /mnt/etc/idmapd.conf
    fi

    # configure automnt_script
    if [ $auth_automnt_script ]; then
      chmod 700 /mnt/${OPENSLX_DEFAULT_DIR}/plugin-repo/auth/$auth_automnt_script
      sed -i -e '/^\/home.*$/d' /mnt/etc/auto.master
      echo "/home program:${OPENSLX_DEFAULT_DIR}/plugin-repo/auth/$auth_automnt_script" \
         >> /mnt/etc/auto.master
    fi
   
    # configure KerberOS
    if [ $auth_krb -eq 1 ]; then
      echo "# copied from auth::files (default: /root/auth-plugin)" \
        > /mnt/etc/krb5.conf
      cat ${PLUGINDIR}/krb5.conf >> /mnt/etc/krb5.conf
      
      # PAM: add krb conf after pam_unix(2).so; SuSE: ...-pc
      sed -i \
        '/^account.*req.*pam_unix/ s/^/account [success=ok new_authtok_reqd=ok ignore=ignore default=bad user_unknown=ignore]  pam_krb5.so     use_first_pass\n/' \
        /mnt/etc/pam.d/common-account /mnt/etc/pam.d/common-account-pc
      sed -i \
        '/^account.*req.*pam_unix/ s/^/auth    sufficient      pam_krb5.so     use_first_pass\n/' \
        /mnt/etc/pam.d/common-account /mnt/etc/pam.d/common-auth-pc
      echo "session optional        pam_krb5.so" >>  /mnt/etc/pam.d/common-session
      echo "session optional        pam_krb5.so" >>  /mnt/etc/pam.d/common-session-pc

      # script to get keytab or do other magic things
      if [ -n $auth_krbscript ]; then
        echo "# auth-plugin: start custom kerberOS script
          echo "Start krbscript"
          /${OPENSLX_DEFAULT_DIR}/plugin-repo/auth/$auth_krbscript
          chmod 600 /etc/krb5.keytab # if a user forget to change it the $auth_krbscript" \
          >>  /mnt/etc/init.d/boot.slx
        chmod 700 /mnt/${OPENSLX_DEFAULT_DIR}/plugin-repo/auth/$auth_krbscript
        # just krb5.conf perm
        rllinker "boot.slx" 2 20
      fi

      # maybe not needed in every case. depends how $HOME gets mounted... but required for nfs & automount at least with nfsv4
      case "$distro" in
          ubuntu)
            sed -i 's/^NEED_GSSD.*/NEED_GSSD=yes/' /mnt/etc/default/nfs-common
            # optional, but wont hurt if the previous fails
            rllinker "gssd" 16 8
            ;;
          suse)
            # for idmap and gss
            sed -i 's/^NFS_START_SERVICES.*/NFS_START_SERVICES="yes"/' /mnt/etc/sysconfig/nfs
            sed -i 's/^NFS_SECURITY_GSS.*/NFS_SECURITY_GSS="yes"/' /mnt/etc/sysconfig/nfs
            ;;
      esac

    fi

  fi
  
  # hack. if we want to have totally custom pam-files...
  if [ -d ${PLUGINDIR}/pam.d/ ]; then
    cp ${PLUGINDIR}/pam.d/* /mnt/etc/pam.d/
  fi
  
  # hack. if we want to have totally custom nsswitch.conf file...
  if [ -f ${PLUGINDIR}/nsswitch.conf ]; then
    echo "# copied from auth::files (default: /root/auth-plugin)" \
      > /mnt/etc/nsswitch.conf
    cat ${PLUGINDIR}/nsswitch.conf >> /mnt/etc/nsswitch.conf
  fi

else
  [ $DEBUGLEVEL -gt 0 ] && echo "  * Configuration of auth plugin failed"
fi