[PC-BSD Commits] r17789 - pcbsd-projects/AD_4_PCBSD/scripts

svn at pcbsd.org svn at pcbsd.org
Mon Jul 16 20:58:18 PDT 2012


Author: johnh
Date: 2012-07-17 03:58:18 +0000 (Tue, 17 Jul 2012)
New Revision: 17789

Modified:
   pcbsd-projects/AD_4_PCBSD/scripts/pc-adctl
   pcbsd-projects/AD_4_PCBSD/scripts/pc-nsswitch
   pcbsd-projects/AD_4_PCBSD/scripts/pc-pam
Log:
Make PAM and NSS work.



Modified: pcbsd-projects/AD_4_PCBSD/scripts/pc-adctl
===================================================================
--- pcbsd-projects/AD_4_PCBSD/scripts/pc-adctl	2012-07-17 03:44:47 UTC (rev 17788)
+++ pcbsd-projects/AD_4_PCBSD/scripts/pc-adctl	2012-07-17 03:58:18 UTC (rev 17789)
@@ -25,7 +25,7 @@
 	then
 		ad_assert service pc-kerberos start
 		ad_assert service pc-nsswitch start
-		#service pc-pam start
+		ad_assert service pc-pam start
 		#service pc-samba start
 		#service pc-kinit start
 		#service pc-kinit status

Modified: pcbsd-projects/AD_4_PCBSD/scripts/pc-nsswitch
===================================================================
--- pcbsd-projects/AD_4_PCBSD/scripts/pc-nsswitch	2012-07-17 03:44:47 UTC (rev 17788)
+++ pcbsd-projects/AD_4_PCBSD/scripts/pc-nsswitch	2012-07-17 03:58:18 UTC (rev 17789)
@@ -12,7 +12,7 @@
 : ${PATH_NS_CONF:="/etc/nsswitch.conf"}
 : ${NSSCONF:="/usr/local/bin/nssconf"}
 
-nsswitch_conf_start()
+ad_nsswitch_conf_start()
 {
 	if checkyesno activedirectory_enable 2>/dev/null
 	then
@@ -35,7 +35,7 @@
 	return 0
 }
 
-nsswitch_conf_stop()
+ad_nsswitch_conf_stop()
 {
 	if checkyesno activedirectory_enable 2>/dev/null
 	then
@@ -59,8 +59,8 @@
 }
 
 name="pc-nsswitch"
-start_cmd='nsswitch_conf_start'
-stop_cmd='nsswitch_conf_stop'
+start_cmd='ad_nsswitch_conf_start'
+stop_cmd='ad_nsswitch_conf_stop'
         
 load_rc_config $name
 run_rc_command "$1"

Modified: pcbsd-projects/AD_4_PCBSD/scripts/pc-pam
===================================================================
--- pcbsd-projects/AD_4_PCBSD/scripts/pc-pam	2012-07-17 03:44:47 UTC (rev 17788)
+++ pcbsd-projects/AD_4_PCBSD/scripts/pc-pam	2012-07-17 03:58:18 UTC (rev 17789)
@@ -3,111 +3,148 @@
 # $FreeBSD$
 #
 
-# PROVIDE: ix-pam
+# PROVIDE: pc-pam
 # REQUIRE: root
-# REQUIRE: ix-nsswitch
+# REQUIRE: pc-nsswitch
 # BEFORE: NETWORK
 
-. /etc/rc.subr
+. /usr/local/etc/rc.AD
 
-: ${PAM_TEMPLATE_DIR:="/etc/ix/templates/pam.d"}
-: ${PAM_DIR:="/etc/pam.d"}
+: ${DEFAULT_PAM_SERVICES:="ftp login passwd sshd su telnetd"}
+: ${PAMDIR:="/etc/pam.d"}
+: ${PAMCONF:="/usr/local/bin/pamconf"}
 
-generate_pam_service_file()
+: ${active_directory_pam_services:="${DEFAULT_PAM_SERVICES}"}
+
+ad_pam_start()
 {
-	local service="${1}"
-	local winbind="${2}"
-	local ldap="${3}"
-	local template
-	local temp
-	local file
+	if checkyesno activedirectory_enable 2>/dev/null
+	then
+		local tmpdir=$(mktemp -d /tmp/pam.XXXXXX)
+		local errors=0
 
-	template="${PAM_TEMPLATE_DIR}/${service}"
-	temp="/tmp/.tmp.${service}"
-	file="${PAM_DIR}/${service}"
+		for s in ${active_directory_pam_services}
+		do
+			local tmp="${tmpdir}/${s}"
+			local sfile="${PAMDIR}/${s}"
 
-	if [ ! -f "${template}" ]
-	then
-		return 1
-	fi
+			cp "${sfile}" "${tmpdir}/${s}.orig"
+			${PAMCONF} -f "${sfile}" \
+				-m "+2auth:sufficient:/usr/local/lib/pam_winbind.so:silent:try_first_pass:krb5_auth:krb5_ccache_type=FILE" \
+				-m "+2account:sufficient:/usr/local/lib/pam_winbind.so:krb5_auth:krb5_ccache_type=FILE" \
+				-m "+session:required:/usr/local/lib/pam_mkhomedir.so" \
+				-m "+0password:sufficient:/usr/local/lib/pam_winbind.so:try_first_pass:krb5_auth krb5_ccache_type=FILE" \
+				-o "${tmp}"
 
-	awk -v ldap="${ldap}" -v winbind="${winbind}" '{
-		if (/^#.*@@LDAP@@/ && ldap) {
-			gsub("^#.*@@LDAP@@[^a-zA-Z0-9]+", "");
-			print $0;
-		} else if (/^#.*@@WINBIND@@/ && winbind) {
-			gsub("^#.*@@WINBIND@@[^a-zA-Z0-9]+", "");
-			print $0;
-		} else if (/^#.*@@MKHOMEDIR@@/ && (ldap || winbind)) {
-			gsub("^#.*@@MKHOMEDIR@@[^a-zA-Z0-9]+", "");
-			print $0;
-		} else if (/^#.*@@.*@@/) {
-		} else {
-			print $0;
-		}
-	}' < "${template}" > "${temp}"
+				if [ "$?" != "0" -o ! -s "${tmp}" ]
+				then
+					errors=1
+					break
+				fi
+		done
 
-	if [ -f "${temp}" ]
-	then
-		mv "${temp}" "${file}" >/dev/null 2>&1
-		if [ "$?" != "0" ]
+		if [ "${errors}" = "0" ]
 		then
-			rm -f "${temp}"
+			for s in $(ls ${tmpdir}|grep -v '.orig')
+			do
+				local sfile="${PAMDIR}/${s}"
+
+				mv "${tmpdir}/${s}" "${sfile}"
+				if [ "$?" != "0" ]
+				then
+					errors=1
+					break
+				fi
+			done
+		fi
+
+		if [ "${errors}" = "1" ]
+		then
+			for s in $(ls ${tmpdir}/*.orig)
+			do
+				local sfile="${PAMDIR}/$(echo ${s}|sed 's/.orig//')"
+				local orig="${tmpdir}/${s}"
+
+				mv ${orig} ${sfile}
+			done
+
+			rm -rf "${tmpdir}" >/dev/null 2>&1
 			return 1
 		fi
+
+		rm -rf "${tmpdir}" >/dev/null 2>&1
+		return 0
 	fi
 
 	return 0
 }
 
-
-generate_pam_files()
+ad_pam_stop()
 {
-	local ldap=0
-	local winbind=0
-
-	if [ ! -d "${PAM_TEMPLATE_DIR}" -o ! -d "${PAM_DIR}" ]
+	if checkyesno activedirectory_enable 2>/dev/null
 	then
-		return 1
-	fi
+		local tmpdir=$(mktemp -d /tmp/pam.XXXXXX)
+		local errors=0
 
-	while read line
-	do
-		local var=$(echo "${line}"|cut -s -f1 -d'|')
-		local val=$(echo "${line}"|cut -s -f2 -d'|')
+		for s in ${active_directory_pam_services}
+		do
+			local tmp="${tmpdir}/${s}"
+			local sfile="${PAMDIR}/${s}"
 
-		case "${var}" in
-			activedirectory) winbind="${val}" ;;
-			ldap) ldap="${val}" ;;
-		esac
+			cp "${sfile}" "${tmpdir}/${s}.orig"
+			${PAMCONF} -f "${sfile}" \
+				-m '-auth:sufficient:/usr/local/lib/pam_winbind.so' \
+				-m '-account:sufficient:/usr/local/lib/pam_winbind.so' \
+				-m '-session:required:/usr/local/lib/pam_mkhomedir.so' \
+				-m '-password:sufficient:/usr/local/lib/pam_winbind.so' \
+				-o "${tmp}"
 
-	done <<EOF
-	$(${FREENAS_SQLITE_CMD} ${FREENAS_CONFIG} "
-	SELECT
-		srv_service,
-		srv_enable
+				if [ "$?" != "0" -o ! -s "${tmp}" ]
+				then
+					errors=1
+					break
+				fi
+		done
 
-	FROM
-		services_services
+		if [ "${errors}" = "0" ]
+		then
+			for s in $(ls ${tmpdir}|grep -v '.orig')
+			do
+				local sfile="${PAMDIR}/${s}"
 
-	WHERE
-		srv_service IN (
-			'ldap',
-			'activedirectory'
-	)")
-EOF
+				mv "${tmpdir}/${s}" "${sfile}"
+				if [ "$?" != "0" ]
+				then
+					errors=1
+					break
+				fi
+			done
+		fi
 
-	for service in $(ls "${PAM_TEMPLATE_DIR}")
-	do
-		generate_pam_service_file "${service}" "${winbind}" "${ldap}"
-	done
+		if [ "${errors}" = "1" ]
+		then
+			for s in $(ls ${tmpdir}/*.orig)
+			do
+				local sfile="${PAMDIR}/$(echo ${s}|sed 's/.orig//')"
+				local orig="${tmpdir}/${s}"
 
+				mv ${orig} ${sfile}
+			done
+
+			rm -rf "${tmpdir}" >/dev/null 2>&1
+			return 1
+		fi
+
+		rm -rf "${tmpdir}" >/dev/null 2>&1
+		return 0
+	fi
+
 	return 0
 }
 
-name="ix-pam"
-start_cmd='generate_pam_files'
-stop_cmd=':'
+name="pc-pam"
+start_cmd='ad_pam_start'
+stop_cmd='ad_pam_stop'
         
 load_rc_config $name
 run_rc_command "$1"



More information about the Commits mailing list