Init
Signed-off-by: Georg <georg@lysergic.dev>
This commit is contained in:
commit
7f00c9f2eb
GPG Key ID:
1DAF57F49F8E8F22
1
README.md
Normal file
1
README.md
Normal file
@ -0,0 +1 @@
|
|||||||
|
This houses exports of my Confluence Space: https://confluence.psyched.dev/x/dYBR.
|
||||||
121
georg/389_Directory_Server_+_CA.md
Normal file
121
georg/389_Directory_Server_+_CA.md
Normal file
@ -0,0 +1,121 @@
|
|||||||
|
# 389 Directory Server + CA
|
||||||
|
|
||||||
|
<div class="code panel pdl" style="border-width: 1px;">
|
||||||
|
|
||||||
|
<div class="codeContent panelContent pdl">
|
||||||
|
|
||||||
|
``` bash
|
||||||
|
# install
|
||||||
|
zypper in 389-ds openldap2-client
|
||||||
|
|
||||||
|
# base config
|
||||||
|
cat <<'EOF' >instance.inf
|
||||||
|
[general]
|
||||||
|
config_version = 2
|
||||||
|
|
||||||
|
[slapd]
|
||||||
|
instance_name = syscid
|
||||||
|
root_password = J0TMD8GdS5cNJD1jxg16WBtzr9SWWFVHzOpUoCn4QSlXkwKT
|
||||||
|
|
||||||
|
[backend-userroot]
|
||||||
|
create_suffix_entry = True
|
||||||
|
sample_entries = True
|
||||||
|
suffix = dc=syscid,dc=com
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# init
|
||||||
|
dscreate from-file instance.inf
|
||||||
|
|
||||||
|
# stop
|
||||||
|
dsctl syscid stop
|
||||||
|
|
||||||
|
# modify /etc/ssl/openssl.cnf
|
||||||
|
...
|
||||||
|
[ policy_match ]
|
||||||
|
countryName = optional
|
||||||
|
stateOrProvinceName = optional
|
||||||
|
organizationName = optional
|
||||||
|
...
|
||||||
|
database = index.txt
|
||||||
|
serial = serial
|
||||||
|
...
|
||||||
|
|
||||||
|
# create CA
|
||||||
|
|
||||||
|
mkdir /etc/pki/CA
|
||||||
|
cd /etc/pki/CA
|
||||||
|
|
||||||
|
# init first CA
|
||||||
|
touch index.txt
|
||||||
|
echo 01 > serial
|
||||||
|
|
||||||
|
# generate CA key
|
||||||
|
openssl genrsa -out ca.key 4096
|
||||||
|
|
||||||
|
# generate CA certificate
|
||||||
|
openssl req -new -x509 -days 365 -key ca.key -out ca.crt
|
||||||
|
|
||||||
|
# create extension config (for SANs)
|
||||||
|
cat <<'EOF' >server_cert_ext.cnf
|
||||||
|
[v3_ca]
|
||||||
|
basicConstraints = CA:FALSE
|
||||||
|
nsCertType = server
|
||||||
|
nsComment = "LDAP01 Server Certificate"
|
||||||
|
subjectKeyIdentifier = hash
|
||||||
|
authorityKeyIdentifier = keyid,issuer:always
|
||||||
|
keyUsage = critical, digitalSignature, keyEncipherment
|
||||||
|
extendedKeyUsage = serverAuth
|
||||||
|
subjectAltName = @alt_names
|
||||||
|
[ alt_names ]
|
||||||
|
DNS.1 = ldap.syscid.com
|
||||||
|
DNS.2 = ldap01.syscid.com
|
||||||
|
DNS.3 = dir.syscid.com
|
||||||
|
DNS.4 = dir01.syscid.com
|
||||||
|
DNS.5 = gaia.syscid.com
|
||||||
|
EOF
|
||||||
|
|
||||||
|
#
|
||||||
|
mkdir private
|
||||||
|
cd private/
|
||||||
|
|
||||||
|
# generate server key
|
||||||
|
openssl genrsa -out ldap.syscid.com.key 4096
|
||||||
|
|
||||||
|
# generate CSR
|
||||||
|
openssl req -new -key ldap.syscid.com.key -out ldap.syscid.com.csr
|
||||||
|
|
||||||
|
# generate server certificate
|
||||||
|
openssl ca -keyfile ca.key -cert ca.crt -in private/ldap.syscid.com.csr -out private/ldap.syscid.com.crt -extensions v3_ca -extfile server_cert_ext.cnf -outdir .
|
||||||
|
|
||||||
|
# wipe existing SLAPD NSS certificate database
|
||||||
|
rm /etc/dirsrv/slapd-syscid/*.db
|
||||||
|
certutil -d /etc/dirsrv/slapd-syscid/ -N
|
||||||
|
|
||||||
|
# export server certificate and server key to P12 bundle
|
||||||
|
openssl pkcs12 -export -in private/ldap.syscid.com.crt -inkey private/ldap.syscid.com.key -out /etc/dirsrv/slapd-syscid/ldap.syscid.com.p12 -name Server-Cert
|
||||||
|
|
||||||
|
# install server certificate in SLAPD certstore
|
||||||
|
pk12util -i /etc/dirsrv/slapd-syscid/ldap.syscid.com.p12 -d /etc/dirsrv/slapd-syscid/ -n Server-Cert
|
||||||
|
|
||||||
|
# install CA in SLAPD certstore
|
||||||
|
certutil -d /etc/dirsrv/slapd-syscid/ -A -n "SysCid CA" -t CT,, -a -i ca.crt
|
||||||
|
|
||||||
|
# check SLAPD certstore
|
||||||
|
# should show Server-Cert and Syscid CA (the comments assigned in the above two imports)
|
||||||
|
certutil -d /etc/dirsrv/slapd-syscid/ -L
|
||||||
|
|
||||||
|
# install CA locally
|
||||||
|
ln -s /etc/pki/CA/ca.crt /etc/pki/trust/anchors/syscid-ca.crt
|
||||||
|
update-ca-certificates
|
||||||
|
|
||||||
|
# start
|
||||||
|
# asks for NSS DB store password if one was set
|
||||||
|
dsctl syscid start
|
||||||
|
|
||||||
|
# check
|
||||||
|
dsctl syscid status
|
||||||
|
```
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
1
georg/Drafts.md
Normal file
1
georg/Drafts.md
Normal file
@ -0,0 +1 @@
|
|||||||
|
# Drafts
|
||||||
339
georg/Georg’s_Home.md
Normal file
339
georg/Georg’s_Home.md
Normal file
@ -0,0 +1,339 @@
|
|||||||
|
# Georg’s Home
|
||||||
|
|
||||||
|
<div class="contentLayout2">
|
||||||
|
|
||||||
|
<div class="columnLayout single" layout="single">
|
||||||
|
|
||||||
|
<div class="cell normal" data-type="normal">
|
||||||
|
|
||||||
|
<div class="innerCell">
|
||||||
|
|
||||||
|
Contact: georg@lysergic.dev
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="columnLayout two-right-sidebar" layout="two-right-sidebar">
|
||||||
|
|
||||||
|
<div class="cell normal" data-type="normal">
|
||||||
|
|
||||||
|
<div class="innerCell">
|
||||||
|
|
||||||
|
<div class="recently-updated recently-updated-concise">
|
||||||
|
|
||||||
|
## Recently Updated
|
||||||
|
|
||||||
|
<div class="hidden parameters">
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="results-container">
|
||||||
|
|
||||||
|
- <div class="update-item-icon">
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="update-item-content">
|
||||||
|
|
||||||
|
[Leon: Apache Reverse Proxy](Leon_Apache_Reverse_Proxy "Georg")
|
||||||
|
<div class="update-item-meta">
|
||||||
|
|
||||||
|
yesterday at 11:35 PM • updated by
|
||||||
|
<a href="/display/~georg" class="url fn">Georg</a> •
|
||||||
|
<a href="../georg/Leon_Apache_Reverse_Proxy" class="changes-link">view change</a>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
- <div class="update-item-icon">
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="update-item-content">
|
||||||
|
|
||||||
|
[Drafts](Drafts "Georg")
|
||||||
|
<div class="update-item-meta">
|
||||||
|
|
||||||
|
yesterday at 11:24 PM • created by
|
||||||
|
<a href="/display/~georg" class="url fn">Georg</a>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
- <div class="update-item-icon">
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="update-item-content">
|
||||||
|
|
||||||
|
[Georg’s Home](Georg’s_Home "Georg")
|
||||||
|
<div class="update-item-meta">
|
||||||
|
|
||||||
|
yesterday at 11:24 PM • updated by
|
||||||
|
<a href="/display/~georg" class="url fn">Georg</a> •
|
||||||
|
<a href="../georg/Georg’s_Home" class="changes-link">view change</a>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
- <div class="update-item-icon">
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="update-item-content">
|
||||||
|
|
||||||
|
[sudoers2ldif.pl](/display/~georg/LDAP%3A+Sudo?preview=%2F5341350%2F5341355%2Fsudoers2ldif.pl)
|
||||||
|
<div class="update-item-meta">
|
||||||
|
|
||||||
|
yesterday at 11:16 PM • attached by
|
||||||
|
<a href="/display/~georg" class="url fn">Georg</a>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
- <div class="update-item-icon">
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="update-item-content">
|
||||||
|
|
||||||
|
[LDAP: Sudo](LDAP_Sudo "Georg")
|
||||||
|
<div class="update-item-meta">
|
||||||
|
|
||||||
|
yesterday at 11:16 PM • updated by
|
||||||
|
<a href="/display/~georg" class="url fn">Georg</a> •
|
||||||
|
<a href="../georg/LDAP_Sudo" class="changes-link">view change</a>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
- <div class="update-item-icon">
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="update-item-content">
|
||||||
|
|
||||||
|
[SUDOers_OU.png](/display/~georg/LDAP%3A+Sudo?preview=%2F5341350%2F5341353%2FSUDOers_OU.png)
|
||||||
|
<div class="update-item-meta">
|
||||||
|
|
||||||
|
yesterday at 11:15 PM • attached by
|
||||||
|
<a href="/display/~georg" class="url fn">Georg</a>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
- <div class="update-item-icon">
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="update-item-content">
|
||||||
|
|
||||||
|
[SUDOers_Defaults.png](/display/~georg/LDAP%3A+Sudo?preview=%2F5341350%2F5341352%2FSUDOers_Defaults.png)
|
||||||
|
<div class="update-item-meta">
|
||||||
|
|
||||||
|
yesterday at 11:15 PM • attached by
|
||||||
|
<a href="/display/~georg" class="url fn">Georg</a>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
- <div class="update-item-icon">
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="update-item-content">
|
||||||
|
|
||||||
|
[389 Directory Server + CA](389_Directory_Server_+_CA "Georg")
|
||||||
|
<div class="update-item-meta">
|
||||||
|
|
||||||
|
yesterday at 2:54 AM • updated by
|
||||||
|
<a href="/display/~georg" class="url fn">Georg</a> •
|
||||||
|
<a href="../georg/389_Directory_Server_+_CA" class="changes-link">view change</a>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
- <div class="update-item-icon">
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="update-item-content">
|
||||||
|
|
||||||
|
[Notes](/display/~georg/Notes?focusedCommentId=5341309#comment-5341309)
|
||||||
|
<div class="update-item-meta">
|
||||||
|
|
||||||
|
Aug 04, 2021 • commented by
|
||||||
|
<a href="/display/~georg" class="url fn">Georg</a>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
- <div class="update-item-icon">
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="update-item-content">
|
||||||
|
|
||||||
|
[Notes](Notes "Georg")
|
||||||
|
<div class="update-item-meta">
|
||||||
|
|
||||||
|
Aug 04, 2021 • created by
|
||||||
|
<a href="/display/~georg" class="url fn">Georg</a>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
- <div class="update-item-icon">
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="update-item-content">
|
||||||
|
|
||||||
|
[Georg’s Home](../georg/Georg’s_Home)
|
||||||
|
<div class="update-item-meta">
|
||||||
|
|
||||||
|
Aug 04, 2021 • commented by
|
||||||
|
<a href="/display/~georg" class="url fn">Georg</a>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
- <div class="update-item-icon">
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="update-item-content">
|
||||||
|
|
||||||
|
[Georg’s Home](../georg/Georg’s_Home)
|
||||||
|
<div class="update-item-meta">
|
||||||
|
|
||||||
|
Aug 04, 2021 • commented by
|
||||||
|
<a href="/display/~georg" class="url fn">Georg</a>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
- <div class="update-item-icon">
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="update-item-content">
|
||||||
|
|
||||||
|
[Georg’s Home](../georg/Georg’s_Home)
|
||||||
|
<div class="update-item-meta">
|
||||||
|
|
||||||
|
Aug 04, 2021 • commented by
|
||||||
|
<a href="/display/~georg" class="url fn">Georg</a>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
- <div class="update-item-icon">
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="update-item-content">
|
||||||
|
|
||||||
|
[Georg](index "Georg")
|
||||||
|
<div class="update-item-meta">
|
||||||
|
|
||||||
|
Aug 04, 2021 • created by
|
||||||
|
<a href="/display/~georg" class="url fn">Georg</a>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="cell aside" data-type="aside">
|
||||||
|
|
||||||
|
<div class="innerCell">
|
||||||
|
|
||||||
|
## Navigate space
|
||||||
|
|
||||||
|
<div id="pagetreesearch">
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="plugin_pagetree">
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="columnLayout single" layout="single">
|
||||||
|
|
||||||
|
<div class="cell normal" data-type="normal">
|
||||||
|
|
||||||
|
<div class="innerCell">
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="pageSectionHeader">
|
||||||
|
|
||||||
|
## Comments:
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<table data-border="0" width="100%">
|
||||||
|
<colgroup>
|
||||||
|
<col style="width: 100%" />
|
||||||
|
</colgroup>
|
||||||
|
<tbody>
|
||||||
|
<tr class="odd">
|
||||||
|
<td><p>blabla</p>
|
||||||
|
<div class="smallfont" data-align="left" style="color: #666666; width: 98%; margin-bottom: 10px;">
|
||||||
|
<img src="images/icons/contenttypes/comment_16.png" width="16" height="16" /> Posted by georg at Aug 04, 2021 01:08
|
||||||
|
</div></td>
|
||||||
|
</tr>
|
||||||
|
<tr class="even">
|
||||||
|
<td style="border-top: 1px dashed #666666"><p>test</p>
|
||||||
|
<div class="smallfont" data-align="left" style="color: #666666; width: 98%; margin-bottom: 10px;">
|
||||||
|
<img src="images/icons/contenttypes/comment_16.png" width="16" height="16" /> Posted by georg at Aug 04, 2021 01:18
|
||||||
|
</div></td>
|
||||||
|
</tr>
|
||||||
|
<tr class="odd">
|
||||||
|
<td style="border-top: 1px dashed #666666"><p>test</p>
|
||||||
|
<div class="smallfont" data-align="left" style="color: #666666; width: 98%; margin-bottom: 10px;">
|
||||||
|
<img src="images/icons/contenttypes/comment_16.png" width="16" height="16" /> Posted by georg at Aug 04, 2021 01:58
|
||||||
|
</div></td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
140
georg/LDAP_Sudo.md
Normal file
140
georg/LDAP_Sudo.md
Normal file
@ -0,0 +1,140 @@
|
|||||||
|
# LDAP: Sudo
|
||||||
|
|
||||||
|
Prerequisites:
|
||||||
|
|
||||||
|
- 389 DS server
|
||||||
|
- LDAP Directory Manager (or equivalent) permissions
|
||||||
|
- SSSD client
|
||||||
|
- Client root (or equivalent) permissions - ideally not only \`sudo\`
|
||||||
|
permissions, in case you lock yourself out of \`sudo\`
|
||||||
|
|
||||||
|
### Verify the sudo schema is installed:
|
||||||
|
|
||||||
|
<div class="code panel pdl" style="border-width: 1px;">
|
||||||
|
|
||||||
|
<div class="codeContent panelContent pdl">
|
||||||
|
|
||||||
|
``` bash
|
||||||
|
# file (locate 60sudo.ldif)
|
||||||
|
/usr/share/dirsrv/schema/60sudo.ldif: ASCII text
|
||||||
|
```
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### Create OU:
|
||||||
|
|
||||||
|
Create an organizational unit to house SUDOers settings using a GUI or
|
||||||
|
using ldapadd/ldapmodify. This is not documented here, but the LDIF
|
||||||
|
query should look something like this:
|
||||||
|
|
||||||
|
<div class="code panel pdl" style="border-width: 1px;">
|
||||||
|
|
||||||
|
<div class="codeContent panelContent pdl">
|
||||||
|
|
||||||
|
``` java
|
||||||
|
dn: ou=SUDOers,ou=syscid-system,dc=syscid,dc=com
|
||||||
|
changetype: add
|
||||||
|
ou: SUDOers
|
||||||
|
objectClass: organizationalUnit
|
||||||
|
objectClass: top
|
||||||
|
```
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### Convert existing, local, sudoers to LDIF:
|
||||||
|
|
||||||
|
Convert an existing, local, sudoers file to an LDAP importable LDIF. Old
|
||||||
|
articles suggest the Perl script used for this should be included in the
|
||||||
|
\`sudo\` package, however that does not seem to be the case on the SUSE
|
||||||
|
systems I worked with - I dug the script out of deep parts of the
|
||||||
|
internet and attached it here - whether it is "original" I cannot tell.
|
||||||
|
|
||||||
|
Note that the SUDOERS_BASE environment variable needs to be filled with
|
||||||
|
the DN of the OU created above.
|
||||||
|
|
||||||
|
<div class="code panel pdl" style="border-width: 1px;">
|
||||||
|
|
||||||
|
<div class="codeContent panelContent pdl">
|
||||||
|
|
||||||
|
``` bash
|
||||||
|
# export SUDOERS_BASE=ou=SUDOers,ou=syscid-system,dc=syscid,dc=com
|
||||||
|
# echo $SUDOERS_BASE
|
||||||
|
ou=SUDOers,ou=syscid-system,dc=syscid,dc=com
|
||||||
|
# perl sudoers2ldif.pl /etc/sudoers | tee sudoers-389.ldif
|
||||||
|
# file sudoers-389.ldif
|
||||||
|
sudoers-389.ldif: ASCII text
|
||||||
|
```
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
#### Inspect the file for faulty lines:
|
||||||
|
|
||||||
|
In the `sudoers-389.ldif` file generated above, look for failed lines,
|
||||||
|
which may look similar to the following:
|
||||||
|
|
||||||
|
`parse error: Defaults!/usr/bin/sudoreplay !log_output`
|
||||||
|
|
||||||
|
`parse error: Defaults!REBOOT !log_output`
|
||||||
|
|
||||||
|
Remove them, in order to have a valid LDIF.
|
||||||
|
|
||||||
|
If the lines seem crucial to you, either correct the input sudoers file,
|
||||||
|
and run the script again, or try to manually add the settings in your OU
|
||||||
|
after the import.
|
||||||
|
|
||||||
|
### Import the LDIF:
|
||||||
|
|
||||||
|
<div class="code panel pdl" style="border-width: 1px;">
|
||||||
|
|
||||||
|
<div class="codeContent panelContent pdl">
|
||||||
|
|
||||||
|
``` bash
|
||||||
|
# ldapadd -xWD 'cn=Directory Manager' -f sudoers-389.ldif
|
||||||
|
```
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
### Verify the result:
|
||||||
|
|
||||||
|
<img src="attachments/5341350/5341353.png" height="150" /><img src="attachments/5341350/5341352.png" height="150" />
|
||||||
|
|
||||||
|
### Configure a client:
|
||||||
|
|
||||||
|
Add to / modify in `/etc/nsswitch.conf`:
|
||||||
|
|
||||||
|
sudoers: sss
|
||||||
|
|
||||||
|
Add to / modify in /etc/sssd/sssd.conf:
|
||||||
|
|
||||||
|
sudo_provider = ldap ldap_sudo_search_base =
|
||||||
|
ou=SUDOers,ou=syscid-system,dc=syscid,dc=com
|
||||||
|
|
||||||
|
I read that a \`service\` entry should no longer be necessary, but am
|
||||||
|
adding it to my existing services for good measure:
|
||||||
|
|
||||||
|
services = nss, pam, ssh, sudo
|
||||||
|
|
||||||
|
<div class="pageSectionHeader">
|
||||||
|
|
||||||
|
## Attachments:
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="greybox" align="left">
|
||||||
|
|
||||||
|
<img src="images/icons/bullet_blue.gif" width="8" height="8" />
|
||||||
|
[SUDOers_Defaults.png](attachments/5341350/5341352.png) (image/png)
|
||||||
|
<img src="images/icons/bullet_blue.gif" width="8" height="8" />
|
||||||
|
[SUDOers_OU.png](attachments/5341350/5341353.png) (image/png)
|
||||||
|
<img src="images/icons/bullet_blue.gif" width="8" height="8" />
|
||||||
|
[sudoers2ldif.pl](attachments/5341350/5341355.pl) (application/x-perl)
|
||||||
|
|
||||||
|
</div>
|
||||||
97
georg/Leon_Apache_Reverse_Proxy.md
Normal file
97
georg/Leon_Apache_Reverse_Proxy.md
Normal file
@ -0,0 +1,97 @@
|
|||||||
|
# Leon: Apache Reverse Proxy
|
||||||
|
|
||||||
|
<https://github.com/leon-ai/>
|
||||||
|
|
||||||
|
# Reverse Proxy Setup
|
||||||
|
|
||||||
|
## Apache2
|
||||||
|
|
||||||
|
This allows you to access the Leon web app using an Apache virtual host.
|
||||||
|
|
||||||
|
## Prerequisites
|
||||||
|
|
||||||
|
- **A domain**
|
||||||
|
|
||||||
|
> DNS A (and/or AAAA) records have to point to your webserver.
|
||||||
|
|
||||||
|
- **SSL certificate**
|
||||||
|
|
||||||
|
> A valid SSL certificate.
|
||||||
|
|
||||||
|
> The setup is possible without SSL, though using HTTPS is highly
|
||||||
|
> recommended. The following configuration examples apply to a HTTPS
|
||||||
|
> enforced site.
|
||||||
|
|
||||||
|
- **An operating system**
|
||||||
|
|
||||||
|
> Obvious.
|
||||||
|
|
||||||
|
- **Apache2 / HTTPD**
|
||||||
|
|
||||||
|
> Apache2 needs to be installed, and the modules `mod_ssl`, `mod_proxy`
|
||||||
|
> as well as `mod_wstunnel` need to be loaded.
|
||||||
|
> Refer to the Apache documentation specific to your operating system to
|
||||||
|
> find the correct procedure on how to install and load modules as well
|
||||||
|
> as on how and where to define virtual hosts.
|
||||||
|
|
||||||
|
- **Firewall**
|
||||||
|
|
||||||
|
> If a firewall is in place, the ports 80 and 443 need to be opened
|
||||||
|
> and/or forwarded accordingly.
|
||||||
|
> If Leon resides on a different machine, the configured `LEON_PORT`
|
||||||
|
> needs to be reachable by the webserver.
|
||||||
|
|
||||||
|
- **Leon**
|
||||||
|
|
||||||
|
> A working Leon installation. It is recommended to test if Leon works
|
||||||
|
> as expected before attempting to troubleshoot issues with the reverse
|
||||||
|
> proxy.
|
||||||
|
|
||||||
|
> Warning - As of writing this document, the following configuration
|
||||||
|
> examples only apply to the DEVELOPMENT branch of Leon.
|
||||||
|
> Since this branch is deemed stable enough by the author, the complex
|
||||||
|
> procedure for setting a reverse proxy up with Leon from the Master
|
||||||
|
> branch (it involves tampering with the source files) will not be
|
||||||
|
> explained.
|
||||||
|
|
||||||
|
## Leon configuration (.env)
|
||||||
|
|
||||||
|
# Server
|
||||||
|
LEON_HOST=https://leon.example.com
|
||||||
|
LEON_PORT=1337
|
||||||
|
|
||||||
|
## Apache virtual host (leon.conf)
|
||||||
|
|
||||||
|
`leon.example.com` is the domain we will use to reach the Leon web app.
|
||||||
|
|
||||||
|
`localhost` is where the web server reach the Leon backend. If Leon
|
||||||
|
resides on a different machine, replace this with the hostname or IP
|
||||||
|
address of that machine.
|
||||||
|
|
||||||
|
`:1337` is the port the Leon backend listens on (you specified it above
|
||||||
|
with `LEON_PORT`).
|
||||||
|
|
||||||
|
<VirtualHost *:80>
|
||||||
|
ServerName leon.example.com
|
||||||
|
|
||||||
|
RewriteEngine On
|
||||||
|
RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]
|
||||||
|
</VirtualHost>
|
||||||
|
<VirtualHost *:443>
|
||||||
|
ServerName leon.example.com
|
||||||
|
|
||||||
|
SSLEngine On
|
||||||
|
SSLCertificateFile "/path/to/fullchain.pem"
|
||||||
|
SSLCertificateKeyFile "/path/to/privkey.pem
|
||||||
|
|
||||||
|
ProxyPreserveHost Off
|
||||||
|
ProxyPass / http://127.0.0.1:1337/
|
||||||
|
ProxyPassReverse / http://127.0.0.1:1337/
|
||||||
|
|
||||||
|
RewriteEngine On
|
||||||
|
RewriteCond %{HTTP:Upgrade} websocket [NC]
|
||||||
|
RewriteCond %{HTTP:Connection} upgrade [NC]
|
||||||
|
RewriteRule ^/?(.*) "ws://127.0.0.1:1337/$1" [P,L]
|
||||||
|
</VirtualHost>
|
||||||
|
|
||||||
|
That's it!
|
||||||
23
georg/Notes.md
Normal file
23
georg/Notes.md
Normal file
@ -0,0 +1,23 @@
|
|||||||
|
# Notes
|
||||||
|
|
||||||
|
WIP
|
||||||
|
|
||||||
|
<div class="pageSectionHeader">
|
||||||
|
|
||||||
|
## Comments:
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<table data-border="0" width="100%">
|
||||||
|
<colgroup>
|
||||||
|
<col style="width: 100%" />
|
||||||
|
</colgroup>
|
||||||
|
<tbody>
|
||||||
|
<tr class="odd">
|
||||||
|
<td><p>so cool</p>
|
||||||
|
<div class="smallfont" data-align="left" style="color: #666666; width: 98%; margin-bottom: 10px;">
|
||||||
|
<img src="images/icons/contenttypes/comment_16.png" width="16" height="16" /> Posted by georg at Aug 04, 2021 02:10
|
||||||
|
</div></td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
BIN
georg/attachments/5341350/5341352.png
Normal file
BIN
georg/attachments/5341350/5341352.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 52 KiB |
BIN
georg/attachments/5341350/5341353.png
Normal file
BIN
georg/attachments/5341350/5341353.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 12 KiB |
153
georg/attachments/5341350/5341355.pl
Normal file
153
georg/attachments/5341350/5341355.pl
Normal file
@ -0,0 +1,153 @@
|
|||||||
|
#!/usr/bin/env perl
|
||||||
|
#
|
||||||
|
# Copyright (c) 2007, 2010-2011, 2013 Todd C. Miller <Todd.Miller@courtesan.com>
|
||||||
|
#
|
||||||
|
# Permission to use, copy, modify, and distribute this software for any
|
||||||
|
# purpose with or without fee is hereby granted, provided that the above
|
||||||
|
# copyright notice and this permission notice appear in all copies.
|
||||||
|
#
|
||||||
|
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
||||||
|
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
||||||
|
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
||||||
|
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
||||||
|
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
||||||
|
# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||||
|
# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||||
|
#
|
||||||
|
|
||||||
|
use strict;
|
||||||
|
|
||||||
|
#
|
||||||
|
# Converts a sudoers file to LDIF format in prepration for loading into
|
||||||
|
# the LDAP server.
|
||||||
|
#
|
||||||
|
|
||||||
|
# BUGS:
|
||||||
|
# Does not yet handle multiple lines with : in them
|
||||||
|
# Does not yet remove quotation marks from options
|
||||||
|
# Does not yet escape + at the beginning of a dn
|
||||||
|
# Does not yet handle line wraps correctly
|
||||||
|
# Does not yet handle multiple roles with same name (needs tiebreaker)
|
||||||
|
#
|
||||||
|
# CAVEATS:
|
||||||
|
# Sudoers entries can have multiple RunAs entries that override former ones,
|
||||||
|
# with LDAP sudoRunAs{Group,User} applies to all commands in a sudoRole
|
||||||
|
|
||||||
|
my %RA;
|
||||||
|
my %UA;
|
||||||
|
my %HA;
|
||||||
|
my %CA;
|
||||||
|
my $base=$ENV{SUDOERS_BASE} or die "$0: Container SUDOERS_BASE undefined\n";
|
||||||
|
my @options=();
|
||||||
|
|
||||||
|
my $did_defaults=0;
|
||||||
|
my $order = 0;
|
||||||
|
|
||||||
|
# parse sudoers one line at a time
|
||||||
|
while (<>){
|
||||||
|
|
||||||
|
# remove comment
|
||||||
|
s/#.*//;
|
||||||
|
|
||||||
|
# line continuation
|
||||||
|
$_.=<> while s/\\\s*$//s;
|
||||||
|
|
||||||
|
# cleanup newline
|
||||||
|
chomp;
|
||||||
|
|
||||||
|
# ignore blank lines
|
||||||
|
next if /^\s*$/;
|
||||||
|
|
||||||
|
if (/^Defaults\s+/i) {
|
||||||
|
my $opt=$';
|
||||||
|
$opt=~s/\s+$//; # remove trailing whitespace
|
||||||
|
push @options,$opt;
|
||||||
|
} elsif (/^(\S+)\s+([^=]+)=\s*(.*)/) {
|
||||||
|
|
||||||
|
# Aliases or Definitions
|
||||||
|
my ($p1,$p2,$p3)=($1,$2,$3);
|
||||||
|
$p2=~s/\s+$//; # remove trailing whitespace
|
||||||
|
$p3=~s/\s+$//; # remove trailing whitespace
|
||||||
|
|
||||||
|
if ($p1 eq "User_Alias") {
|
||||||
|
$UA{$p2}=$p3;
|
||||||
|
} elsif ($p1 eq "Runas_Alias") {
|
||||||
|
$RA{$p2}=$p3;
|
||||||
|
} elsif ($p1 eq "Host_Alias") {
|
||||||
|
$HA{$p2}=$p3;
|
||||||
|
} elsif ($p1 eq "Cmnd_Alias") {
|
||||||
|
$CA{$p2}=$p3;
|
||||||
|
} else {
|
||||||
|
if (!$did_defaults++){
|
||||||
|
# do this once
|
||||||
|
print "dn: cn=defaults,$base\n";
|
||||||
|
print "objectClass: top\n";
|
||||||
|
print "objectClass: sudoRole\n";
|
||||||
|
print "cn: defaults\n";
|
||||||
|
print "description: Default sudoOption's go here\n";
|
||||||
|
print "sudoOption: $_\n" foreach @options;
|
||||||
|
printf "sudoOrder: %d\n", ++$order;
|
||||||
|
print "\n";
|
||||||
|
}
|
||||||
|
# Definition
|
||||||
|
my @users=split /\s*,\s*/,$p1;
|
||||||
|
my @hosts=split /\s*,\s*/,$p2;
|
||||||
|
my @cmds= split /\s*,\s*/,$p3;
|
||||||
|
@options=();
|
||||||
|
print "dn: cn=$users[0],$base\n";
|
||||||
|
print "objectClass: top\n";
|
||||||
|
print "objectClass: sudoRole\n";
|
||||||
|
print "cn: $users[0]\n";
|
||||||
|
# will clobber options
|
||||||
|
print "sudoUser: $_\n" foreach expand(\%UA,@users);
|
||||||
|
print "sudoHost: $_\n" foreach expand(\%HA,@hosts);
|
||||||
|
foreach (@cmds) {
|
||||||
|
if (s/^\(([^\)]+)\)\s*//) {
|
||||||
|
my @runas = split(/:\s*/, $1);
|
||||||
|
if (defined($runas[0])) {
|
||||||
|
print "sudoRunAsUser: $_\n" foreach expand(\%RA, split(/,\s*/, $runas[0]));
|
||||||
|
}
|
||||||
|
if (defined($runas[1])) {
|
||||||
|
print "sudoRunAsGroup: $_\n" foreach expand(\%RA, split(/,\s*/, $runas[1]));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
print "sudoCommand: $_\n" foreach expand(\%CA,@cmds);
|
||||||
|
print "sudoOption: $_\n" foreach @options;
|
||||||
|
printf "sudoOrder: %d\n", ++$order;
|
||||||
|
print "\n";
|
||||||
|
}
|
||||||
|
|
||||||
|
} else {
|
||||||
|
print "parse error: $_\n";
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
#
|
||||||
|
# recursively expand hash elements
|
||||||
|
sub expand{
|
||||||
|
my $ref=shift;
|
||||||
|
my @a=();
|
||||||
|
|
||||||
|
# preen the line a little
|
||||||
|
foreach (@_){
|
||||||
|
# if NOPASSWD: directive found, mark entire entry as not requiring
|
||||||
|
s/NOPASSWD:\s*// && push @options,"!authenticate";
|
||||||
|
s/PASSWD:\s*// && push @options,"authenticate";
|
||||||
|
s/NOEXEC:\s*// && push @options,"noexec";
|
||||||
|
s/EXEC:\s*// && push @options,"!noexec";
|
||||||
|
s/SETENV:\s*// && push @options,"setenv";
|
||||||
|
s/NOSETENV:\s*// && push @options,"!setenv";
|
||||||
|
s/LOG_INPUT:\s*// && push @options,"log_input";
|
||||||
|
s/NOLOG_INPUT:\s*// && push @options,"!log_input";
|
||||||
|
s/LOG_OUTPUT:\s*// && push @options,"log_output";
|
||||||
|
s/NOLOG_OUTPUT:\s*// && push @options,"!log_output";
|
||||||
|
s/[[:upper:]]+://; # silently remove other tags
|
||||||
|
s/\s+$//; # right trim
|
||||||
|
}
|
||||||
|
|
||||||
|
# do the expanding
|
||||||
|
push @a,$ref->{$_} ? expand($ref,split /\s*,\s*/,$ref->{$_}):$_ foreach @_;
|
||||||
|
@a;
|
||||||
|
}
|
||||||
BIN
georg/images/icons/bullet_blue.gif
Normal file
BIN
georg/images/icons/bullet_blue.gif
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 60 B |
BIN
georg/images/icons/contenttypes/comment_16.png
Normal file
BIN
georg/images/icons/contenttypes/comment_16.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 400 B |
BIN
georg/images/icons/contenttypes/home_page_16.png
Normal file
BIN
georg/images/icons/contenttypes/home_page_16.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 272 B |
35
georg/index.md
Normal file
35
georg/index.md
Normal file
@ -0,0 +1,35 @@
|
|||||||
|
# \~georg (Georg)
|
||||||
|
|
||||||
|
<div id="main-content" class="pageSection">
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
<div class="pageSection">
|
||||||
|
|
||||||
|
<div class="pageSectionHeader">
|
||||||
|
|
||||||
|
## Available Pages:
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
- [Georg’s Home](Georg’s_Home)
|
||||||
|
<img src="images/icons/contenttypes/home_page_16.png" width="16" height="16" />
|
||||||
|
- [389 Directory Server + CA](389_Directory_Server_+_CA)
|
||||||
|
|
||||||
|
<!-- -->
|
||||||
|
|
||||||
|
- [LDAP: Sudo](LDAP_Sudo)
|
||||||
|
|
||||||
|
<!-- -->
|
||||||
|
|
||||||
|
- [Drafts](Drafts)
|
||||||
|
- [Notes](Notes)
|
||||||
|
|
||||||
|
<!-- -->
|
||||||
|
|
||||||
|
- [Leon: Apache Reverse Proxy](Leon_Apache_Reverse_Proxy)
|
||||||
|
|
||||||
|
</div>
|
||||||
Loading…
Reference in New Issue
Block a user