1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
|
#! /bin/bash
#
# $Id: install-nsspgsql.sh 5857 2006-11-09 20:29:51Z lo-lan-do $
#
# Configure LDAP for GForge
# Christian Bayle, Roland Mas
# Initially written for debian-sf (Sourceforge for Debian)
# Adapted as time went by for Gforge
set -e
if [ "$GFORGEDEBUG" != 1 ] ; then
DEVNULL12="> /dev/null 2>&1"
DEVNULL2="2> /dev/null"
else
set -x
fi
if [ $(id -u) != 0 -a "x$1" != "xlist" ] ; then
echo "You must be root to run this, please enter passwd"
exec su -c "$0 $1"
fi
PATH=$PATH:/usr/sbin
setup_vars() {
db_host=$(grep ^db_host= /etc/gforge/gforge.conf | cut -d= -f2-)
db_name=$(grep ^db_name= /etc/gforge/gforge.conf | cut -d= -f2-)
db_user=$(grep ^db_user= /etc/gforge/gforge.conf | cut -d= -f2-)
db_password=$(grep ^db_password= /etc/gforge/gforge.conf | cut -d= -f2-)
pam_db_user=$(grep ^pam_db_user= /etc/gforge/gforge.conf | cut -d= -f2-)
pam_db_pw=$(grep ^pam_db_pw= /etc/gforge/gforge.conf | cut -d= -f2-)
tmpfile_pattern=/tmp/$(basename $0).XXXXXX
}
show_vars() {
echo "slapd_base_dn = '$slapd_base_dn'"
echo "gforge_base_dn = '$gforge_base_dn'"
echo "slapd_admin_dn = '$slapd_admin_dn'"
echo "slapd_admin_passwd = '$slapd_admin_passwd'"
echo "cryptedpasswd = '$cryptedpasswd'"
echo "tmpfile_pattern = '$tmpfile_pattern'"
}
# Should I do something for /etc/pam_pgsql.conf ?
configure_pam_pgsql(){
if [ ! -e /etc/pam_pgsql.conf ] ; then
touch /etc/pam_pgsql.conf
fi
echo -n > /etc/pam_pgsql.conf.gforge-new
chmod 600 /etc/pam_pgsql.conf.gforge-new
cat > /etc/pam_pgsql.conf.gforge-new <<EOF
host = $db_host
database = $db_name
user = $pam_db_user
password = $pam_db_pw
table = nss_shadow
user_column = login
pwd_column = passwd
pw_type = crypt
expired_column = expired
newtok_column = pwchange
EOF
if ! grep -q auth[[:space:]]\\+sufficient[[:space:]]\\+pam_pgsql.so /etc/pam.d/common-auth ; then
cp -a /etc/pam.d/common-auth /etc/pam.d/common-auth.gforge-new
perl -pi -e 's/(auth\s+required\s+pam_unix.so.*)/auth sufficient pam_pgsql.so #Added by GForge install\n$1 use_first_pass #Added by GForge install\n#Comment by GForge install#$1/g' /etc/pam.d/common-auth.gforge-new
fi
if ! grep -q account[[:space:]]\\+sufficient[[:space:]]\\+pam_pgsql.so /etc/pam.d/common-account ; then
cp -a /etc/pam.d/common-account /etc/pam.d/common-account.gforge-new
perl -pi -e 's/(account\s+required\s+pam_unix.so.*)/account sufficient pam_pgsql.so #Added by GForge install\n$1 try_first_pass #Added by GForge install\n#Comment by GForge install#$1/g' /etc/pam.d/common-account.gforge-new
fi
}
purge_pam_pgsql(){
if grep -q '#Added by GForge install' /etc/pam.d/common-auth ; then
cp -a /etc/pam.d/common-auth /etc/pam.d/common-auth.gforge-new
perl -pi -e "s/^[^\n]*#Added by GForge install\n//" /etc/pam.d/common-auth.gforge-new
perl -pi -e "s/#Comment by GForge install#//" /etc/pam.d/common-auth.gforge-new
fi
if grep -q '#Added by GForge install' /etc/pam.d/common-account ; then
cp -a /etc/pam.d/common-account /etc/pam.d/common-account.gforge-new
perl -pi -e "s/^[^\n]*#Added by GForge install\n//" /etc/pam.d/common-account.gforge-new
perl -pi -e "s/#Comment by GForge install#//" /etc/pam.d/common-account.gforge-new
fi
}
# Check/Modify /etc/libnss-pgsql.conf
configure_libnss_pgsql(){
# All users can see ldap stored gid/uid
# cat > /etc/nss-pgsql.conf.gforge-new <<EOF
#host = $db_host
#port = 5432
#database = $db_name
#login = gforge_nss
#passwd = ''
#passwdtable = nss_passwd
#grouptable = nss_groups
#groupmembertable = nss_passwd JOIN nss_usergroups ON nss_passwd.uid=nss_usergroups.uid JOIN nss_groups ON nss_usergroups.gid=nss_groups.gid
#
#passwd_name = login
#passwd_passwd = passwd
#passwd_uid = uid
#passwd_dir = homedir
#passwd_shell = shell
#passwd_gecos = gecos
#passwd_gid = gid
#
#group_name = name
#group_passwd = passwd
#group_gid = gid
#group_member = login
#EOF
cat > /etc/nss-pgsql.conf.gforge-new <<EOF
#----------------- DB connection
host = $db_host
# For socket give the directory to put the socket
#host = /tmp
port = 5432
database = gforge
login = gforge_nss
passwd = ''
#----------------- New possibility including the query directly here ------------------#
# query
# return the passwd array
querypasswd = SELECT login,passwd,uid,gid,gecos,('/var/lib/gforge/chroot/home/users/' || login),shell FROM nss_passwd
# return the group array whithout list of members
querygroup = SELECT name,'x',gid FROM nss_groups
# return an array of users that are member of a group with gid %d
querymembers = SELECT user_name FROM nss_usergroups WHERE gid = %d
# return an array of numeric gid a user %s is member of except his own gid %d
queryids = SELECT gid FROM nss_usergroups WHERE user_name = '%s' AND gid != %d
#----------------- Only the following tables map are necessary ------------------------#
# passwd
passwd_name = login
passwd_uid = uid
# group
group_name = name
group_gid = gid
#--------------------------------------------------------------------------------------#
#----------------- Old Method ------------------#
# tables
#passwdtable = nss_passwd
#grouptable = nss_groups
#groupmembertable = nss_passwd JOIN nss_usergroups ON nss_passwd.uid=nss_usergroups.uid JOIN nss_groups ON nss_usergroups.gid=nss_groups.gid
# passwd
#passwd_name = login
#passwd_passwd = passwd
#passwd_uid = uid
#passwd_gid = gid
#passwd_gecos = gecos
#passwd_dir = homedir
# New extention that allow concatenation
#passwd_dir = ('/home/users/' || login)
#passwd_shell = shell
# group
#group_name = name
#group_passwd = passwd
#group_gid = gid
#group_member = login
EOF
chmod 644 /etc/nss-pgsql.conf.gforge-new
}
# Purge /etc/nss-pgsql.conf
purge_libnss_pgsql(){
cp -a /etc/nss-pgsql.conf /etc/nss-pgsql.conf.gforge-new
perl -pi -e "s/^# Next line added by GForge install\n/#SF#/g" /etc/nss-pgsql.conf.gforge-new
perl -pi -e "s/^#SF#.*\n//g" /etc/nss-pgsql.conf.gforge-new
}
# Modify /etc/nsswitch.conf
configure_nsswitch()
{
cp -a /etc/nsswitch.conf /etc/nsswitch.conf.gforge-new
# This is sensitive file
# By security i let priority to files
# Should maybe enhance this to take in account nis
# Maybe ask the order db/files/nis/pgsql
if ! grep -q '^passwd:.*pgsql' /etc/nsswitch.conf.gforge-new ; then
perl -pi -e "s/^(passwd:[^#\n]*)([^\n]*)/\1 pgsql \2#Added by GForge install\n#Comment by GForge install#\1\2/gs" /etc/nsswitch.conf.gforge-new
fi
if ! grep -q '^group:.*pgsql' /etc/nsswitch.conf.gforge-new ; then
perl -pi -e "s/^(group:[^#\n]*)([^\n]*)/\1 pgsql \2#Added by GForge install\n#Comment by GForge install#\1\2/gs" /etc/nsswitch.conf.gforge-new
fi
if ! grep -q '^shadow:.*pgsql' /etc/nsswitch.conf.gforge-new ; then
perl -pi -e "s/^(shadow:[^#\n]*)([^\n]*)/\1 pgsql \2#Added by GForge install\n#Comment by GForge install#\1\2/gs" /etc/nsswitch.conf.gforge-new
fi
}
# Purge /etc/nsswitch.conf
purge_nsswitch()
{
cp -a /etc/nsswitch.conf /etc/nsswitch.conf.gforge-new
perl -pi -e "s/^[^\n]*#Added by GForge install\n//" /etc/nsswitch.conf.gforge-new
perl -pi -e "s/#Comment by GForge install#//" /etc/nsswitch.conf.gforge-new
}
# Main
case "$1" in
configure-files)
setup_vars
# echo "Modifying /etc/nss-pgsql.conf"
configure_libnss_pgsql
# echo "Modifying /etc/pam_pgsql.conf"
configure_pam_pgsql
# echo "Modifying /etc/nsswitch.conf"
configure_nsswitch
;;
configure)
;;
purge-files)
setup_vars
# echo "Purging /etc/nsswitch.conf"
purge_nsswitch
# echo "Modifying /etc/pam_pgsql.conf"
purge_pam_pgsql
# echo "Purging /etc/nss-pgsql.conf"
purge_libnss_pgsql
;;
test|check)
setup_vars
show_vars
check_server
;;
setup)
$0 configure-files
$0 configure
cp /etc/nss-pgsql.conf /etc/nss-pgsql.conf.gforge-old
cp /etc/nsswitch.conf.gforge /etc/nsswitch.conf.gforge-old
mv /etc/nss-pgsql.conf.gforge-new /etc/nss-pgsql.conf
mv /etc/nsswitch.conf.gforge-new /etc/nsswitch.conf
;;
cleanup)
$0 purge-files
cp /etc/nss-pgsql.conf /etc/nss-pgsql.conf.gforge-old
cp /etc/nsswitch.conf.gforge /etc/nsswitch.conf.gforge-old
mv /etc/nss-pgsql.conf.gforge-new /etc/nss-pgsql.conf
mv /etc/nsswitch.conf.gforge-new /etc/nsswitch.conf
;;
*)
echo "Usage: $0 {configure|configure-files|purge-files|test|setup|cleanup}"
exit 1
;;
esac
|
