diff options
author | Luke Shumaker <lukeshu@lukeshu.com> | 2018-08-26 14:35:46 -0400 |
---|---|---|
committer | Luke Shumaker <lukeshu@lukeshu.com> | 2018-08-26 14:35:46 -0400 |
commit | 0c2bf8bec3ff0f558785b29980c193b054c3b529 (patch) | |
tree | 13b9885d67ede3e33863264cee8d46d22bed735c /config-parabola-mgmt-nshd.PKGBUILD | |
parent | d6801ddd960843ca9c503acb937e7b807852bcf8 (diff) |
Rename everything from config-* to config-parabola-*
Diffstat (limited to 'config-parabola-mgmt-nshd.PKGBUILD')
-rw-r--r-- | config-parabola-mgmt-nshd.PKGBUILD | 92 |
1 files changed, 92 insertions, 0 deletions
diff --git a/config-parabola-mgmt-nshd.PKGBUILD b/config-parabola-mgmt-nshd.PKGBUILD new file mode 100644 index 0000000..3e918d0 --- /dev/null +++ b/config-parabola-mgmt-nshd.PKGBUILD @@ -0,0 +1,92 @@ +. ${BUILDFILE%/*}/common.sh +pkgver=20180826 + +package() { +preamble +# #### Parabola hackers + +depends=(parabola-hackers-nshd openssh config-mgmt-nshd-updater) + +# sshd is configured to force the use of keys (no password-based +# login), and to use [parabola-hackers][] `ssh-list-authorized-keys` +# in addition to checking `~/.ssh/authorized_keys`. +# `ssh-list-authorized-keys` returns the authorized keys from the +# [hackers.git][] checkout in `/var/lib/hackers-git` (the path to the +# checkout is configured in `/etc/parabola-hackers.yml`). +# +# [parabola-hackers]: https://www.parabola.nu/packages/libre/x86_64/parabola-hackers/ +# [hackers.git]: https://git.parabola.nu/hackers.git/ +add-file -m755 usr/share/holo/files/10-"$pkgname"/etc/ssh/sshd_config.holoscript <<EOF +#!/bin/sh +{ + sed -e '/^#AuthorizedKeysCommand\s/ aAuthorizedKeysCommand /usr/lib/parabola-hackers/ssh-list-authorized-keys' \\ + -e '/^#AuthorizedKeysCommandUser\s/ aAuthorizedKeysCommandUser nshd' \\ + -e '/^#PasswordAuthentication\s/ aPasswordAuthentication no' +} | awk '\$0==""||!x[\$0]++' +EOF + +# NSS and PAM have been configured to use the ldap modules that are +# part of [nss-pam-ldapd][]. +# +# [nss-pam-ldapd]: https://www.parabola.nu/packages/community/x86_64/nss-pam-ldapd/ +add-file -m755 usr/share/holo/files/10-"$pkgname"/etc/nsswitch.conf.holoscript <<EOF +#!/bin/sh +sed 's/ ldap//' | sed -r '/^(passwd|group|shadow):/s/(files|compat)/files ldap/' +EOF +add-file -m755 usr/share/holo/files/10-"$pkgname"/etc/pam.d/passwd.holoscript <<EOF +#!/bin/sh +sed -e '/ldap/d' | +sed -e 's/^password required pam_unix[.]so/#&/' \\ + -e '\$apassword required pam_ldap.so minimum_uid=1000' +EOF + +# However, instead of running the normal `nslcd` LDAP client daemon, +# the system has ben configured to run the [parabola-hackers-nshd][] +# `nshd` daemon, which reads user infomation from the same +# `hackers.git` checkout (configured the same way). This way we dn't +# have to worry about keeping `/etc/passwd` in sync with +# `hackers.git`. +# +# [parabola-hackers-nshd]: https://www.parabola.nu/packages/libre/x86_64/parabola-hackers-nshd/ +add-unit etc/systemd/system/sockets.target.wants/nshd.socket +add-unit etc/systemd/system/dbus.service.wants/nshd.service # (temporary [systemd bug workaround][]) +# +# [sytemd bug workaround][]: https://projects.parabola.nu/packages/parabola-hackers.git/tree/nshd.service.in#n19 + +# To this end, PAM has also been configured to create a users home +# directory when they log in if it doesn't already exist. +add-file -m755 usr/share/holo/files/10-"$pkgname"/etc/pam.d/system-login.holoscript <<EOF +#!/bin/sh +sed '/pam_mkhomedir/d' +echo 'session required pam_mkhomedir.so skel=/etc/skel umask=0077' +EOF + +# Because `hackers.git` doesn't store any password information, `nshd` +# stores password hashes in `/etc/nshd/shadow`. + +# Now, we'll configure _updating_ it separately, but we need to ensure +# that the checkout of hackers.git that nshd will be using exists when +# nshd runs. +add-file etc/systemd/system/hackers-init.service <<EOF +[Unit] +Description=Initialize hackers.git +Wants=network-online.target +After=network-online.target +ConditionPathExists=|!/var/lib/hackers-git/.git +ConditionPathExistsGlob=|!/var/lib/hackers-git/users/*.yml + +[Service] +ExecStart=/bin/sh -c 'install --directory --owner=git --group=git /var/lib/hackers-git && sudo -u git git clone git://git.parabola.nu/hackers.git /var/lib/hackers-git' +Type=oneshot +RemainAfterExit=yes +EOF +add-unit etc/systemd/system/nshd.service.wants/hackers-init.service + +add-file -m755 etc/parabola-hackers/hooks/10-nshd <<EOF +#!/usr/bin/env bash +echo '==> Reloading nshd...' +systemctl reload nshd.service +EOF + +postamble +} |