aboutsummaryrefslogtreecommitdiffstats
path: root/meta-openstack
diff options
context:
space:
mode:
authorAmy Fong <amy.fong@windriver.com>2014-07-22 09:55:30 -0400
committerBruce Ashfield <bruce.ashfield@windriver.com>2014-07-31 15:15:31 -0400
commita139fb7c0e26373d4ce8505e4ff75a9231e01bd4 (patch)
tree0cf23fbfc140207a8fb38ece33f9874e85784763 /meta-openstack
parentd8ee201909e93a3ae5fabce1eeb61a75873ea9f4 (diff)
downloadmeta-cloud-services-a139fb7c0e26373d4ce8505e4ff75a9231e01bd4.tar.gz
meta-cloud-services-a139fb7c0e26373d4ce8505e4ff75a9231e01bd4.tar.bz2
meta-cloud-services-a139fb7c0e26373d4ce8505e4ff75a9231e01bd4.zip
ldap/pam: enable pam/ldap authentication
- modify pam configuration files to use ldap - modify sshd to enable pam - modify nsswitch.conf to use ldap Signed-off-by: Amy Fong <amy.fong@windriver.com>
Diffstat (limited to 'meta-openstack')
-rwxr-xr-xmeta-openstack/recipes-connectivity/openssh/files/mcs-sshd33
-rw-r--r--meta-openstack/recipes-connectivity/openssh/files/mcs-sshd_config120
-rw-r--r--meta-openstack/recipes-connectivity/openssh/openssh_6.0p1.bbappend13
-rw-r--r--meta-openstack/recipes-core/base-files/base-files_3.0.14.bbappend15
-rw-r--r--meta-openstack/recipes-core/base-files/files/nsswitch.conf19
-rw-r--r--meta-openstack/recipes-extended/libpam/files/common-account26
-rw-r--r--meta-openstack/recipes-extended/libpam/files/common-auth21
-rw-r--r--meta-openstack/recipes-extended/libpam/files/common-password28
-rw-r--r--meta-openstack/recipes-extended/libpam/files/common-session22
-rw-r--r--meta-openstack/recipes-extended/libpam/files/common-session-noninteractive21
-rw-r--r--meta-openstack/recipes-extended/libpam/libpam_1.1.5.bbappend23
11 files changed, 341 insertions, 0 deletions
diff --git a/meta-openstack/recipes-connectivity/openssh/files/mcs-sshd b/meta-openstack/recipes-connectivity/openssh/files/mcs-sshd
new file mode 100755
index 00000000..3420bd24
--- /dev/null
+++ b/meta-openstack/recipes-connectivity/openssh/files/mcs-sshd
@@ -0,0 +1,33 @@
+# PAM configuration for the Secure Shell service
+
+# Standard Un*x authentication.
+auth include common-auth
+
+# Disallow non-root logins when /etc/nologin exists.
+account required pam_nologin.so
+
+# Uncomment and edit /etc/security/access.conf if you need to set complex
+# access limits that are hard to express in sshd_config.
+# account required pam_access.so
+
+# Standard Un*x authorization.
+account include common-account
+
+# Set the loginuid process attribute.
+session required pam_loginuid.so
+
+# Create a new session keyring.
+session optional pam_keyinit.so force revoke
+
+# Standard Un*x session setup and teardown.
+session include common-session
+
+# Set up user limits from /etc/security/limits.conf.
+session required pam_limits.so
+
+# Read environment variables from /etc/environment and
+# /etc/security/pam_env.conf.
+session required pam_env.so # [1]
+
+# Standard Un*x password updating.
+password include common-password
diff --git a/meta-openstack/recipes-connectivity/openssh/files/mcs-sshd_config b/meta-openstack/recipes-connectivity/openssh/files/mcs-sshd_config
new file mode 100644
index 00000000..7c2c7d9d
--- /dev/null
+++ b/meta-openstack/recipes-connectivity/openssh/files/mcs-sshd_config
@@ -0,0 +1,120 @@
+# $OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $
+
+# This is the sshd server system-wide configuration file. See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented. Uncommented options change a
+# default value.
+
+#Port 22
+#AddressFamily any
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+
+# Disable legacy (protocol version 1) support in the server for new
+# installations. In future the default will change to require explicit
+# activation of protocol 1
+Protocol 2
+
+# HostKey for protocol version 1
+#HostKey /etc/ssh/ssh_host_key
+# HostKeys for protocol version 2
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_dsa_key
+
+# Lifetime and size of ephemeral version 1 server key
+#KeyRegenerationInterval 1h
+#ServerKeyBits 1024
+
+# Logging
+# obsoletes QuietMode and FascistLogging
+#SyslogFacility AUTH
+#LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+#PermitRootLogin yes
+#StrictModes yes
+#MaxAuthTries 6
+#MaxSessions 10
+
+#RSAAuthentication yes
+#PubkeyAuthentication yes
+#AuthorizedKeysFile .ssh/authorized_keys
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+#RhostsRSAAuthentication no
+# similar for protocol version 2
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# RhostsRSAAuthentication and HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+
+# To disable tunneled clear text passwords, change to no here!
+#PasswordAuthentication yes
+PermitEmptyPasswords yes
+
+# Change to no to disable s/key passwords
+#ChallengeResponseAuthentication yes
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication. Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+#UsePAM no
+UsePAM yes
+
+#AllowAgentForwarding yes
+#AllowTcpForwarding yes
+#GatewayPorts no
+#X11Forwarding no
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PrintMotd yes
+#PrintLastLog yes
+#TCPKeepAlive yes
+#UseLogin no
+UsePrivilegeSeparation yes
+#PermitUserEnvironment no
+Compression no
+ClientAliveInterval 15
+ClientAliveCountMax 4
+#UseDNS yes
+#PidFile /var/run/sshd.pid
+#MaxStartups 10
+#PermitTunnel no
+#ChrootDirectory none
+
+# no default banner path
+#Banner none
+
+# override default of no subsystems
+Subsystem sftp /usr/libexec/sftp-server
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+# X11Forwarding no
+# AllowTcpForwarding no
+# ForceCommand cvs server
diff --git a/meta-openstack/recipes-connectivity/openssh/openssh_6.0p1.bbappend b/meta-openstack/recipes-connectivity/openssh/openssh_6.0p1.bbappend
new file mode 100644
index 00000000..ad7e2327
--- /dev/null
+++ b/meta-openstack/recipes-connectivity/openssh/openssh_6.0p1.bbappend
@@ -0,0 +1,13 @@
+PRINC = "1"
+
+FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
+
+SRC_URI += "file://mcs-sshd"
+SRC_URI += "file://mcs-sshd_config"
+
+do_install_append() {
+ if ${@base_contains('DISTRO_FEATURES', 'OpenLDAP', 'true', 'false', d)}; then
+ install -D -m 644 ${WORKDIR}/mcs-sshd ${D}/etc/pam.d/sshd
+ install -D -m 644 ${WORKDIR}/mcs-sshd_config ${D}/etc/ssh/sshd_config
+ fi
+}
diff --git a/meta-openstack/recipes-core/base-files/base-files_3.0.14.bbappend b/meta-openstack/recipes-core/base-files/base-files_3.0.14.bbappend
new file mode 100644
index 00000000..a24bc7f4
--- /dev/null
+++ b/meta-openstack/recipes-core/base-files/base-files_3.0.14.bbappend
@@ -0,0 +1,15 @@
+PRINC = "1"
+
+FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
+
+SRC_URI += "file://nsswitch.conf"
+
+PACKAGECONFIG ?= "${@base_contains('DISTRO_FEATURES', 'OpenLDAP', 'OpenLDAP', '', d)}"
+PACKAGECONFIG[OpenLDAP] = ",,,nss-pam-ldapd"
+
+do_install_append() {
+ if ${@base_contains('DISTRO_FEATURES', 'OpenLDAP', 'true', 'false', d)}; then
+ install -m 755 -d ${D}/etc/
+ install -m 644 ${WORKDIR}/nsswitch.conf ${D}/etc/
+ fi
+}
diff --git a/meta-openstack/recipes-core/base-files/files/nsswitch.conf b/meta-openstack/recipes-core/base-files/files/nsswitch.conf
new file mode 100644
index 00000000..0bc04be3
--- /dev/null
+++ b/meta-openstack/recipes-core/base-files/files/nsswitch.conf
@@ -0,0 +1,19 @@
+# /etc/nsswitch.conf
+#
+# Example configuration of GNU Name Service Switch functionality.
+# If you have the `glibc-doc' and `info' packages installed, try:
+# `info libc "Name Service Switch"' for information about this file.
+
+passwd: compat ldap
+group: compat ldap
+shadow: compat ldap
+
+hosts: files dns
+networks: files
+
+protocols: db files
+services: db files
+ethers: db files
+rpc: db files
+
+netgroup: nis
diff --git a/meta-openstack/recipes-extended/libpam/files/common-account b/meta-openstack/recipes-extended/libpam/files/common-account
new file mode 100644
index 00000000..66cc62c1
--- /dev/null
+++ b/meta-openstack/recipes-extended/libpam/files/common-account
@@ -0,0 +1,26 @@
+#
+# /etc/pam.d/common-account - authorization settings common to all services
+#
+# This file is included from other service-specific PAM config files,
+# and should contain a list of the authorization modules that define
+# the central access policy for use on the system. The default is to
+# only deny service to users whose accounts are expired in /etc/shadow.
+#
+# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
+# To take advantage of this, it is recommended that you configure any
+# local modules either before or after the default block, and use
+# pam-auth-update to manage selection of other modules. See
+# pam-auth-update(8) for details.
+#
+
+# here are the per-package modules (the "Primary" block)
+account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so
+# here's the fallback if no module succeeds
+account requisite pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+account required pam_permit.so
+# and here are more per-package modules (the "Additional" block)
+account [success=ok new_authtok_reqd=done ignore=ignore user_unknown=ignore authinfo_unavail=ignore default=bad] pam_ldap.so minimum_uid=1000
+# end of pam-auth-update config
diff --git a/meta-openstack/recipes-extended/libpam/files/common-auth b/meta-openstack/recipes-extended/libpam/files/common-auth
new file mode 100644
index 00000000..e5b429da
--- /dev/null
+++ b/meta-openstack/recipes-extended/libpam/files/common-auth
@@ -0,0 +1,21 @@
+#
+# /etc/pam.d/common-auth - authentication settings common to all services
+#
+# This file is included from other service-specific PAM config files,
+# and should contain a list of the authentication modules that define
+# the central authentication scheme for use on the system
+# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
+# traditional Unix authentication mechanisms.
+
+# here are the per-package modules (the "Primary" block)
+auth [success=2 default=ignore] pam_unix.so nullok_secure
+auth [success=1 default=ignore] pam_ldap.so minimum_uid=1000 use_first_pass
+# here's the fallback if no module succeeds
+auth requisite pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+auth required pam_permit.so
+# and here are more per-package modules (the "Additional" block)
+auth optional pam_cap.so
+# end of pam-auth-update config
diff --git a/meta-openstack/recipes-extended/libpam/files/common-password b/meta-openstack/recipes-extended/libpam/files/common-password
new file mode 100644
index 00000000..f9bbecca
--- /dev/null
+++ b/meta-openstack/recipes-extended/libpam/files/common-password
@@ -0,0 +1,28 @@
+#
+# /etc/pam.d/common-password - password-related modules common to all services
+#
+# This file is included from other service-specific PAM config files,
+# and should contain a list of modules that define the services to be
+# used to change user passwords. The default is pam_unix.
+
+# Explanation of pam_unix options:
+#
+# The "sha512" option enables salted SHA512 passwords. Without this option,
+# the default is Unix crypt. Prior releases used the option "md5".
+#
+# The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in
+# login.defs.
+#
+# See the pam_unix manpage for other options.
+
+# here are the per-package modules (the "Primary" block)
+password [success=2 default=ignore] pam_unix.so obscure sha512
+password [success=1 default=ignore] pam_ldap.so minimum_uid=1000 try_first_pass
+# here's the fallback if no module succeeds
+password requisite pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+password required pam_permit.so
+# and here are more per-package modules (the "Additional" block)
+# end of pam-auth-update config
diff --git a/meta-openstack/recipes-extended/libpam/files/common-session b/meta-openstack/recipes-extended/libpam/files/common-session
new file mode 100644
index 00000000..7f950989
--- /dev/null
+++ b/meta-openstack/recipes-extended/libpam/files/common-session
@@ -0,0 +1,22 @@
+#
+# /etc/pam.d/common-session - session-related modules common to all services
+#
+# This file is included from other service-specific PAM config files,
+# and should contain a list of modules that define tasks to be performed
+# at the start and end of sessions of *any* kind (both interactive and
+# non-interactive).
+#
+
+# here are the per-package modules (the "Primary" block)
+session [default=1] pam_permit.so
+# here's the fallback if no module succeeds
+session requisite pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+session required pam_permit.so
+# and here are more per-package modules (the "Additional" block)
+session required pam_unix.so
+session [success=ok default=ignore] pam_ldap.so minimum_uid=1000
+session required pam_mkhomedir.so skel=/etc/skel umask=0022
+# end of pam-auth-update config
diff --git a/meta-openstack/recipes-extended/libpam/files/common-session-noninteractive b/meta-openstack/recipes-extended/libpam/files/common-session-noninteractive
new file mode 100644
index 00000000..f7f83ed3
--- /dev/null
+++ b/meta-openstack/recipes-extended/libpam/files/common-session-noninteractive
@@ -0,0 +1,21 @@
+#
+# /etc/pam.d/common-session-noninteractive - session-related modules
+# common to all non-interactive services
+#
+# This file is included from other service-specific PAM config files,
+# and should contain a list of modules that define tasks to be performed
+# at the start and end of all non-interactive sessions.
+#
+
+# here are the per-package modules (the "Primary" block)
+session [default=1] pam_permit.so
+# here's the fallback if no module succeeds
+session requisite pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+session required pam_permit.so
+# and here are more per-package modules (the "Additional" block)
+session required pam_unix.so
+session [success=ok default=ignore] pam_ldap.so minimum_uid=1000
+# end of pam-auth-update config
diff --git a/meta-openstack/recipes-extended/libpam/libpam_1.1.5.bbappend b/meta-openstack/recipes-extended/libpam/libpam_1.1.5.bbappend
new file mode 100644
index 00000000..dc32cc93
--- /dev/null
+++ b/meta-openstack/recipes-extended/libpam/libpam_1.1.5.bbappend
@@ -0,0 +1,23 @@
+PRINC = "1"
+
+FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
+
+SRC_URI += "file://common-account"
+SRC_URI += "file://common-auth"
+SRC_URI += "file://common-password"
+SRC_URI += "file://common-session"
+SRC_URI += "file://common-session-noninteractive"
+
+PACKAGECONFIG ?= "${@base_contains('DISTRO_FEATURES', 'OpenLDAP', 'OpenLDAP', '', d)}"
+PACKAGECONFIG[OpenLDAP] = ",,,pam-plugin-mkhomedir nss-pam-ldapd"
+
+do_install_append() {
+ if ${@base_contains('DISTRO_FEATURES', 'OpenLDAP', 'true', 'false', d)}; then
+ install -m 755 -d ${D}/etc/pam.d/
+ install -m 644 ${WORKDIR}/common-account ${D}/etc/pam.d/
+ install -m 644 ${WORKDIR}/common-auth ${D}/etc/pam.d/
+ install -m 644 ${WORKDIR}/common-password ${D}/etc/pam.d/
+ install -m 644 ${WORKDIR}/common-session ${D}/etc/pam.d/
+ install -m 644 ${WORKDIR}/common-session-noninteractive ${D}/etc/pam.d/
+ fi
+}