1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
|
# Copyright (c) 2010 - OpenSLX GmbH
#
# This program/file is free software distributed under the GPL version 2.
# See http://openslx.org/COPYING
#
# If you have any feedback please consult http://openslx.org/feedback and
# send your feedback to feedback@openslx.org
#
# General information about OpenSLX can be found at http://openslx.org
#
# script is included from init via the "." load function - thus it has all
# variables and functions available
# check if the configuration file is available
if [ -e /initramfs/plugin-conf/auth.conf ]; then
. /etc/openslx.conf
ETCDIR=/mnt/${OPENSLX_DEFAULT_CONFDIR}
PLUGINCONFDIR=${ETCDIR}/plugins/auth
BINDIR=/mnt/${OPENSLX_DEFAULT_BINDIR}
PLUGINDIR=/mnt/${OPENSLX_DEFAULT_DIR}/plugin-repo/auth
VIRTDIR=/mnt/${OPENSLX_DEFAULT_VIRTDIR}
# load needed variables
. /initramfs/plugin-conf/auth.conf
# get distribution info; has also version if needed...
. /etc/slxsystem.conf
distro=$slxconf_distro_name
distro_version=$slxconf_distro_ver
# Test if this plugin is activated... more or less useless with the
# new plugin system
if [ $auth_active -ne 0 ]; then
[ $DEBUGLEVEL -gt 0 ] && echo "executing the 'auth' os-plugin ...";
# load general configuration
. /initramfs/machine-setup
# Passwd: todo: move somewhere else
chown root:shadow /mnt/etc/shadow
chmod 0640 /mnt/etc/shadow
chown root:root /mnt/etc/paswd
chmod 0644 /mnt/etc/passwd
#sed -i 's/auth_rootpwd.*/auth_rootpwd=*********/' $PLUGINCONFDIR/auth.conf
# set authentication to passwd and group which is default
sed -i 's/^passwd:.*/passwd: files/' /mnt/etc/nsswitch.conf
sed -i 's/^group:.*/group: files/' /mnt/etc/nsswitch.conf
# general requirement
rllinker "nscd" 16 8
######
# LDAP
######
if [ $auth_ldap -eq 1 ]; then
cp ${PLUGINDIR}/ldap.conf.slx /mnt/etc/ldap.conf
ln -sf /etc/ldap.conf /mnt/etc/openldap/ldap.conf # required for openSUSE 11.4
# even if their syntax can differ, we copy them
# (and hope no nss_* attributes where used)
echo "# Created by XX_auth.sh (auth-plugin) for compatibility reasons" \
> /mnt/etc/nslcd.conf
cat ${PLUGINDIR}/ldap.conf.slx >> /mnt/etc/nslcd.conf # required for openSUSE 11.4
ln -sf /etc/ldap.conf /mnt/etc/ldap/ldap.conf
# PAM: add ldap conf before pam_unix(2).so; SuSE: ...-pc
sed -i \
'/^account.*req.*pam_unix/ s/^/account sufficient pam_ldap.so\n/' \
/mnt/etc/pam.d/common-account /mnt/etc/pam.d/common-account-pc
sed -i \
'/^auth.*req.*pam_unix/ s/^/auth sufficient pam_ldap.so\n/' \
/mnt/etc/pam.d/common-auth /mnt/etc/pam.d/common-auth-pc
sed -i 's/^\(passwd:.*\)/\1 ldap/' /mnt/etc/nsswitch.conf
sed -i 's/^\(group:.*\)/\1 ldap/' /mnt/etc/nsswitch.conf
case "$distro" in
suse)
rllinker "nslcd" 20 8 # req. with OpenSuSE 11.4
;;
esac
# just to be on the save side... usually nslcd isn't used.
sed -i "s/^\(nss_.*\)/#XX_auth.sh#\1/" /mnt/etc/nslcd.conf
# hack. if we want to have totally custom ldap.conf files...
if [ -f ${PLUGINDIR}/ldap.conf ]; then
echo "# copied from auth::files (default: /root/auth-plugin)" \
> /mnt/etc/ldap.conf
cat ${PLUGINDIR}/ldap.conf >> /mnt/etc/ldap.conf
fi
# similiar to ldap.conf, but just similiar
if [ -f ${PLUGINDIR}/nslcd.conf ]; then
echo "# copied from auth::files (default: /root/auth-plugin)" \
> /mnt/etc/nslcd.conf
cat ${PLUGINDIR}/nslcd.conf >> /mnt/etc/nslcd.conf # openSUSE 11.4
fi
fi
########################
# AUTOMOUNT, NFS partial
########################
if [ $auth_automount -eq 1 ]; then
cp ${PLUGINDIR}/auto.master /mnt/etc
cp ${PLUGINDIR}/auto.slx /mnt/etc
if [! -d /mnt/$auth_automnt_dir ]; then
mkdir -p /mnt/$auth_automnt_dir
fi
# config_portmap # distro specific configuration :(
# config_automount # distro specific configuration :(
# config_nfs # distro specific config... activates gssd and idmapd
# ubuntu
case $distro in
ubuntu)
sed -e 's,start on ,start on filesystem #,' \
-i /mnt/etc/init/statd.conf
echo -e "alias autofs autofs4" >>/mnt/etc/modprobe.d/aliases.conf
# no nfs-common initscirpt at 10.04, but other ones
# statd not required for NFSv4..
sed -i 's/^NEED_STATD=.*/NEED_STATD=yes/' /mnt/etc/default/nfs-common
# optional, but helps in the future to move stuff out of OpenSLX to distri-tools
rllinker "portmap" 12 8 # required 10.04+11.04 with nfs to start rpc.statd
rllinker "portmap-wait" 12 8 # required 10.04+11.04 with nfs to start rpc.statd
rllinker "rpc_pipefs" 14 8
rllinker "statd" 13 8 #fails
rllinker "autofs" 14 8
# workaround for not starting statd. 10.04 affected, 11.04 not affected!?!
echo " # auth-plugin: workaround for statd
#mount -t rpc_pipefs rpc_pipefs /var/lib/nfs/rpc_pipefs
rpc.statd -L" \
>> /mnt/etc/init.d/boot.slx
rllinker "boot.slx" 2 20
;;
suse)
# enable generall nfs support
sed -i 's/^NFS_START_SERVICES.*/NFS_START_SERVICES="yes"/' /mnt/etc/sysconfig/nfs
rllinker "rpcbind" 4 21
rllinker "nfs" 14 20
rllinker "autofs" 18 4
;;
esac
fi
#######
# NFSv4
#######
if [ $auth_nfs4 -eq 1 ]; then
# /etc/init-hell
case "$distro" in
suse)
# for idmap
sed -i 's/^NFS_START_SERVICES.*/NFS_START_SERVICES="yes"/' /mnt/etc/sysconfig/nfs
# optional, but may help in the future to move stuff out of OpenSLX to distri-tools
rllinker "rpcbind" 4 21
rllinker "nfs" 14 8 # handles idmap & gssd
;;
ubuntu)
# nfs-common: somewhere before 10.04, not available with 10.04ff
rllinker "nfs-common" 16 8
# enable idmapd
sed -i 's/^NEED_IDMAPD=.*/NEED_IDMAPD=yes/' /mnt/etc/default/nfs-common
# rpc_pipefs, portmap and idmap rllinker are optional
# but may help in the future to move stuff out of OpenSLX to distri-tools
rllinker "rpc_pipefs" 13 8 #doenst work somehow. could be mount/not mounted quirks
rllinker "portmap" 14 8
# optional, but helps in the future to move stuff out of OpenSLX to distri-tools
rllinker "idmapd" 17 8
# somehow idmapd doesnt want to start, because rpc_pipefs, even if enabled, doesn't
# mount the required path. happend with a cloned ubuntu 10.04. therefore a workaround
echo " # auth-plugin: workaround for idmapd
mount -t rpc_pipefs rpc_pipefs /var/lib/nfs/rpc_pipefs
# doesn't matter if already running
echo \"start idmapd (again)\"
service idmapd start" \
>> /mnt/etc/init.d/boot.slx
rllinker "boot.slx" 2 20
;;
esac
sed -i \
"s/^Domain.*/Domain = ${auth_idmap_domain}/" \
/mnt/etc/idmapd.conf
fi
# configure automnt_script
if [ $auth_automnt_script ]; then
chmod 700 /mnt/${OPENSLX_DEFAULT_DIR}/plugin-repo/auth/$auth_automnt_script
sed -i -e '/^\/home.*$/d' /mnt/etc/auto.master
echo "/home program:${OPENSLX_DEFAULT_DIR}/plugin-repo/auth/$auth_automnt_script" \
>> /mnt/etc/auto.master
fi
# configure KerberOS
if [ $auth_krb -eq 1 ]; then
echo "# copied from auth::files (default: /root/auth-plugin)" \
> /mnt/etc/krb5.conf
cat ${PLUGINDIR}/krb5.conf >> /mnt/etc/krb5.conf
# PAM: add krb conf after pam_unix(2).so; SuSE: ...-pc
sed -i \
'/^account.*req.*pam_unix/ s/^/account [success=ok new_authtok_reqd=ok ignore=ignore default=bad user_unknown=ignore] pam_krb5.so use_first_pass\n/' \
/mnt/etc/pam.d/common-account /mnt/etc/pam.d/common-account-pc
sed -i \
'/^account.*req.*pam_unix/ s/^/auth sufficient pam_krb5.so use_first_pass\n/' \
/mnt/etc/pam.d/common-account /mnt/etc/pam.d/common-auth-pc
echo "session optional pam_krb5.so" >> /mnt/etc/pam.d/common-session
echo "session optional pam_krb5.so" >> /mnt/etc/pam.d/common-session-pc
# script to get keytab or do other magic things
if [ -n $auth_krbscript ]; then
echo "# auth-plugin: start custom kerberOS script
echo "Start krbscript"
/${OPENSLX_DEFAULT_DIR}/plugin-repo/auth/$auth_krbscript
chmod 600 /etc/krb5.keytab # if a user forget to change it the $auth_krbscript" \
>> /mnt/etc/init.d/boot.slx
chmod 700 /mnt/${OPENSLX_DEFAULT_DIR}/plugin-repo/auth/$auth_krbscript
# just krb5.conf perm
rllinker "boot.slx" 2 20
fi
# maybe not needed in every case. depends how $HOME gets mounted... but required for nfs & automount at least with nfsv4
case "$distro" in
ubuntu)
sed -i 's/^NEED_GSSD.*/NEED_GSSD=yes/' /mnt/etc/default/nfs-common
# optional, but wont hurt if the previous fails
rllinker "gssd" 16 8
;;
suse)
# for idmap and gss
sed -i 's/^NFS_START_SERVICES.*/NFS_START_SERVICES="yes"/' /mnt/etc/sysconfig/nfs
sed -i 's/^NFS_SECURITY_GSS.*/NFS_SECURITY_GSS="yes"/' /mnt/etc/sysconfig/nfs
;;
esac
fi
fi
# hack. if we want to have totally custom pam-files...
if [ -d ${PLUGINDIR}/pam.d/ ]; then
cp ${PLUGINDIR}/pam.d/* /mnt/etc/pam.d/
fi
# hack. if we want to have totally custom nsswitch.conf file...
if [ -f ${PLUGINDIR}/nsswitch.conf ]; then
echo "# copied from auth::files (default: /root/auth-plugin)" \
> /mnt/etc/nsswitch.conf
cat ${PLUGINDIR}/nsswitch.conf >> /mnt/etc/nsswitch.conf
fi
else
[ $DEBUGLEVEL -gt 0 ] && echo " * Configuration of auth plugin failed"
fi
|
