1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
|
#! /bin/bash
#
# Configure NSS for PostGreSQL for GForge
# Christian Bayle, Roland Mas
# Initially written for debian-sf (Sourceforge for Debian)
# Adapted as time went by for Gforge then for FusionForge
set -e
if [ "$GFORGEDEBUG" != 1 ] ; then
DEVNULL12="> /dev/null 2>&1"
DEVNULL2="2> /dev/null"
else
set -x
fi
if [ $(id -u) != 0 -a "x$1" != "xlist" ] ; then
echo "You must be root to run this, please enter passwd"
exec su -c "$0 $1"
fi
PATH=$PATH:/usr/sbin
setup_vars() {
db_name=$(forge_get_config database_name)
db_user=$(forge_get_config database_user)
db_host=$(forge_get_config database_host)
# homedir_prefix, e.g. /home/users/ (with trailing slash)
homedir_prefix=$(forge_get_config homedir_prefix | sed -e 's:[^/]$:&/:')
db_user_nss=${db_user}_nss
tmpfile_pattern=/tmp/$(basename $0).XXXXXX
}
# Should I do something for /etc/pam_pgsql.conf ?
modify_pam_pgsql(){
echo -n
# echo "Nothing to do"
}
# Check/Modify /etc/libnss-pgsql.conf
configure_libnss_pgsql(){
hostconf=''
case "$db_host" in
127.*|localhost.*|localhost) ;; # 'local'
*) hostconf="host=$db_host" ;; # 'host'
esac
cat > /etc/nss-pgsql.conf.gforge-new <<EOF
### NSS Configuration for Gforge
#----------------- DB connection
# Use 'trust' authentication, cf. https://bugs.debian.org/551389
connectionstring = user=$db_user_nss dbname=$db_name $hostconf
#----------------- NSS queries
getpwnam = SELECT login AS username,passwd,gecos,('$homedir_prefix' || login) AS homedir,shell,uid,gid FROM nss_passwd WHERE login = \$1
getpwuid = SELECT login AS username,passwd,gecos,('$homedir_prefix' || login) AS homedir,shell,uid,gid FROM nss_passwd WHERE uid = \$1
#allusers = SELECT login AS username,passwd,gecos,('$homedir_prefix' || login) AS homedir,shell,uid,gid FROM nss_passwd
getgroupmembersbygid = SELECT login AS username FROM nss_passwd WHERE gid = \$1
getgrnam = SELECT name AS groupname,'x',gid,ARRAY(SELECT user_name FROM nss_usergroups WHERE nss_usergroups.gid = nss_groups.gid) AS members FROM nss_groups WHERE name = \$1
getgrgid = SELECT name AS groupname,'x',gid,ARRAY(SELECT user_name FROM nss_usergroups WHERE nss_usergroups.gid = nss_groups.gid) AS members FROM nss_groups WHERE gid = \$1
#allgroups = SELECT name AS groupname,'x',gid,ARRAY(SELECT user_name FROM nss_usergroups WHERE nss_usergroups.gid = nss_groups.gid) AS members FROM nss_groups
groups_dyn = SELECT ug.gid FROM nss_usergroups ug, nss_passwd p WHERE ug.uid = p.uid AND p.login = \$1 AND ug.gid <> \$2
EOF
cat > /etc/nss-pgsql-root.conf.gforge-new <<EOF
### NSS Configuration for Gforge
#----------------- DB connection
shadowconnectionstring = user=$db_user_nss dbname=$db_name $hostconf
#----------------- NSS queries
shadowbyname = SELECT login AS shadow_name, passwd AS shadow_passwd, 14087 AS shadow_lstchg, 0 AS shadow_min, 99999 AS shadow_max, 7 AS shadow_warn, '' AS shadow_inact, '' AS shadow_expire, '' AS shadow_flag FROM nss_passwd WHERE login = \$1
shadow = SELECT login AS shadow_name, passwd AS shadow_passwd, 14087 AS shadow_lstchg, 0 AS shadow_min, 99999 AS shadow_max, 7 AS shadow_warn, '' AS shadow_inact, '' AS shadow_expire, '' AS shadow_flag FROM nss_passwd
EOF
chmod 644 /etc/nss-pgsql.conf.gforge-new
chmod 600 /etc/nss-pgsql-root.conf.gforge-new
chown root:root /etc/nss-pgsql-root.conf.gforge-new
}
# Purge /etc/nss-pgsql.conf
purge_libnss_pgsql(){
echo -n > /etc/nss-pgsql.conf.gforge-new
echo -n > /etc/nss-pgsql-root.conf.gforge-new
}
# Modify /etc/nsswitch.conf
configure_nsswitch()
{
cp -a /etc/nsswitch.conf /etc/nsswitch.conf.gforge-new
# This is sensitive file
# By security i let priority to files
# Should maybe enhance this to take in account nis
# Maybe ask the order db/files/nis/pgsql
if ! grep -q '^passwd:.*pgsql' /etc/nsswitch.conf.gforge-new ; then
perl -pi -e "s/^(passwd:[^#\n]*)([^\n]*)/\1 pgsql \2#Added by GForge install\n#Comment by GForge install#\1\2/gs" /etc/nsswitch.conf.gforge-new
fi
if ! grep -q '^group:.*pgsql' /etc/nsswitch.conf.gforge-new ; then
perl -pi -e "s/^(group:[^#\n]*)([^\n]*)/\1 pgsql \2#Added by GForge install\n#Comment by GForge install#\1\2/gs" /etc/nsswitch.conf.gforge-new
fi
if ! grep -q '^shadow:.*pgsql' /etc/nsswitch.conf.gforge-new ; then
perl -pi -e "s/^(shadow:[^#\n]*)([^\n]*)/\1 pgsql \2#Added by GForge install\n#Comment by GForge install#\1\2/gs" /etc/nsswitch.conf.gforge-new
fi
}
# Purge /etc/nsswitch.conf
purge_nsswitch()
{
cp -a /etc/nsswitch.conf /etc/nsswitch.conf.gforge-new
perl -pi -e "s/^[^\n]*#Added by GForge install\n//" /etc/nsswitch.conf.gforge-new
perl -pi -e "s/#Comment by GForge install#//" /etc/nsswitch.conf.gforge-new
}
# Main
case "$1" in
configure-files)
setup_vars
# echo "Modifying /etc/nss-pgsql.conf and /etc/nss-pgsql-root.conf"
configure_libnss_pgsql
# echo "Modifying /etc/nsswitch.conf"
configure_nsswitch
;;
configure)
;;
purge-files)
setup_vars
# echo "Purging /etc/nsswitch.conf"
purge_nsswitch
# echo "Purging /etc/nss-pgsql.conf and /etc/nss-pgsql-root.conf"
purge_libnss_pgsql
;;
test|check)
setup_vars
check_server
;;
setup)
$0 configure-files
$0 configure
if [ -f /etc/nss-pgsql.conf ] ; then
cp /etc/nss-pgsql.conf /etc/nss-pgsql.conf.gforge-old
fi
if [ -f /etc/nss-pgsql-root.conf ] ; then
cp /etc/nss-pgsql-root.conf /etc/nss-pgsql-root.conf.gforge-old
fi
if [ -f /etc/nsswitch.conf ] ; then
cp /etc/nsswitch.conf /etc/nsswitch.conf.gforge-old
fi
mv /etc/nss-pgsql.conf.gforge-new /etc/nss-pgsql.conf
mv /etc/nss-pgsql-root.conf.gforge-new /etc/nss-pgsql-root.conf
mv /etc/nsswitch.conf.gforge-new /etc/nsswitch.conf
;;
cleanup)
$0 purge-files
cp /etc/nss-pgsql.conf /etc/nss-pgsql.conf.gforge-old
cp /etc/nss-pgsql-root.conf /etc/nss-pgsql-root.conf.gforge-old
cp /etc/nsswitch.conf.gforge /etc/nsswitch.conf.gforge-old
mv /etc/nss-pgsql.conf.gforge-new /etc/nss-pgsql.conf
mv /etc/nss-pgsql-root.conf.gforge-new /etc/nss-pgsql-root.conf
mv /etc/nsswitch.conf.gforge-new /etc/nsswitch.conf
;;
*)
echo "Usage: $0 {configure|configure-files|purge-files|test|setup|cleanup}"
exit 1
;;
esac
|
