Cleanup some "LDAP for admin auth"-related config
This commit is contained in:
parent
7212154fbb
commit
dc7f868ed2
8 changed files with 17 additions and 4132 deletions
File diff suppressed because it is too large
Load diff
|
|
@ -1,326 +0,0 @@
|
|||
# Filename: /etc/skel/.zshrc
|
||||
# Purpose: config file for zsh (z shell)
|
||||
# Authors: (c) grml-team (grml.org)
|
||||
# Bug-Reports: see http://grml.org/bugs/
|
||||
# License: This file is licensed under the GPL v2 or any later version.
|
||||
################################################################################
|
||||
# Nowadays, grml's zsh setup lives in only *one* zshrc file.
|
||||
# That is the global one: /etc/zsh/zshrc (from grml-etc-core).
|
||||
# It is best to leave *this* file untouched and do personal changes to
|
||||
# your zsh setup via ${HOME}/.zshrc.local which is loaded at the end of
|
||||
# the global zshrc.
|
||||
#
|
||||
# That way, we enable people on other operating systems to use our
|
||||
# setup, too, just by copying our global zshrc to their ${HOME}/.zshrc.
|
||||
# Adjustments would still go to the .zshrc.local file.
|
||||
################################################################################
|
||||
|
||||
## Aurore host color and white user
|
||||
zstyle ':prompt:grml:left:items:host' pre '%B%F{red}'
|
||||
zstyle ':prompt:grml:left:items:host' post '%f%b'
|
||||
zstyle ':prompt:grml:left:items:user' pre '%B'
|
||||
zstyle ':prompt:grml:left:items:user' post '%b'
|
||||
|
||||
## Settings for umask
|
||||
#if (( EUID == 0 )); then
|
||||
# umask 002
|
||||
#else
|
||||
# umask 022
|
||||
#fi
|
||||
|
||||
## Now, we'll give a few examples of what you might want to use in your
|
||||
## .zshrc.local file (just copy'n'paste and uncomment it there):
|
||||
|
||||
## Prompt theme extension ##
|
||||
|
||||
# Virtualenv support
|
||||
|
||||
#function virtual_env_prompt () {
|
||||
# REPLY=${VIRTUAL_ENV+(${VIRTUAL_ENV:t}) }
|
||||
#}
|
||||
#grml_theme_add_token virtual-env -f virtual_env_prompt '%F{magenta}' '%f'
|
||||
#zstyle ':prompt:grml:left:setup' items rc virtual-env change-root user at host path vcs percent
|
||||
|
||||
## ZLE tweaks ##
|
||||
|
||||
## use the vi navigation keys (hjkl) besides cursor keys in menu completion
|
||||
#bindkey -M menuselect 'h' vi-backward-char # left
|
||||
#bindkey -M menuselect 'k' vi-up-line-or-history # up
|
||||
#bindkey -M menuselect 'l' vi-forward-char # right
|
||||
#bindkey -M menuselect 'j' vi-down-line-or-history # bottom
|
||||
|
||||
## set command prediction from history, see 'man 1 zshcontrib'
|
||||
#is4 && zrcautoload predict-on && \
|
||||
#zle -N predict-on && \
|
||||
#zle -N predict-off && \
|
||||
#bindkey "^X^Z" predict-on && \
|
||||
#bindkey "^Z" predict-off
|
||||
|
||||
## press ctrl-q to quote line:
|
||||
#mquote () {
|
||||
# zle beginning-of-line
|
||||
# zle forward-word
|
||||
# # RBUFFER="'$RBUFFER'"
|
||||
# RBUFFER=${(q)RBUFFER}
|
||||
# zle end-of-line
|
||||
#}
|
||||
#zle -N mquote && bindkey '^q' mquote
|
||||
|
||||
## define word separators (for stuff like backward-word, forward-word, backward-kill-word,..)
|
||||
#WORDCHARS='*?_-.[]~=/&;!#$%^(){}<>' # the default
|
||||
#WORDCHARS=.
|
||||
#WORDCHARS='*?_[]~=&;!#$%^(){}'
|
||||
#WORDCHARS='${WORDCHARS:s@/@}'
|
||||
|
||||
# just type '...' to get '../..'
|
||||
#rationalise-dot() {
|
||||
#local MATCH
|
||||
#if [[ $LBUFFER =~ '(^|/| | |'$'\n''|\||;|&)\.\.$' ]]; then
|
||||
# LBUFFER+=/
|
||||
# zle self-insert
|
||||
# zle self-insert
|
||||
#else
|
||||
# zle self-insert
|
||||
#fi
|
||||
#}
|
||||
#zle -N rationalise-dot
|
||||
#bindkey . rationalise-dot
|
||||
## without this, typing a . aborts incremental history search
|
||||
#bindkey -M isearch . self-insert
|
||||
|
||||
#bindkey '\eq' push-line-or-edit
|
||||
|
||||
## some popular options ##
|
||||
|
||||
## add `|' to output redirections in the history
|
||||
#setopt histallowclobber
|
||||
|
||||
## try to avoid the 'zsh: no matches found...'
|
||||
#setopt nonomatch
|
||||
|
||||
## warning if file exists ('cat /dev/null > ~/.zshrc')
|
||||
#setopt NO_clobber
|
||||
|
||||
## don't warn me about bg processes when exiting
|
||||
#setopt nocheckjobs
|
||||
|
||||
## alert me if something failed
|
||||
#setopt printexitvalue
|
||||
|
||||
## with spelling correction, assume dvorak kb
|
||||
#setopt dvorak
|
||||
|
||||
## Allow comments even in interactive shells
|
||||
#setopt interactivecomments
|
||||
|
||||
|
||||
## compsys related snippets ##
|
||||
|
||||
## changed completer settings
|
||||
#zstyle ':completion:*' completer _complete _correct _approximate
|
||||
#zstyle ':completion:*' expand prefix suffix
|
||||
|
||||
## another different completer setting: expand shell aliases
|
||||
#zstyle ':completion:*' completer _expand_alias _complete _approximate
|
||||
|
||||
## to have more convenient account completion, specify your logins:
|
||||
#my_accounts=(
|
||||
# {grml,grml1}@foo.invalid
|
||||
# grml-devel@bar.invalid
|
||||
#)
|
||||
#other_accounts=(
|
||||
# {fred,root}@foo.invalid
|
||||
# vera@bar.invalid
|
||||
#)
|
||||
#zstyle ':completion:*:my-accounts' users-hosts $my_accounts
|
||||
#zstyle ':completion:*:other-accounts' users-hosts $other_accounts
|
||||
|
||||
## add grml.org to your list of hosts
|
||||
#hosts+=(grml.org)
|
||||
#zstyle ':completion:*:hosts' hosts $hosts
|
||||
|
||||
## telnet on non-default ports? ...well:
|
||||
## specify specific port/service settings:
|
||||
#telnet_users_hosts_ports=(
|
||||
# user1@host1:
|
||||
# user2@host2:
|
||||
# @mail-server:{smtp,pop3}
|
||||
# @news-server:nntp
|
||||
# @proxy-server:8000
|
||||
#)
|
||||
#zstyle ':completion:*:*:telnet:*' users-hosts-ports $telnet_users_hosts_ports
|
||||
|
||||
## the default grml setup provides '..' as a completion. it does not provide
|
||||
## '.' though. If you want that too, use the following line:
|
||||
#zstyle ':completion:*' special-dirs true
|
||||
|
||||
## aliases ##
|
||||
|
||||
## translate
|
||||
#alias u='translate -i'
|
||||
|
||||
## ignore ~/.ssh/known_hosts entries
|
||||
#alias insecssh='ssh -o "StrictHostKeyChecking=no" -o "UserKnownHostsFile=/dev/null" -o "PreferredAuthentications=keyboard-interactive"'
|
||||
|
||||
|
||||
## global aliases (for those who like them) ##
|
||||
|
||||
#alias -g '...'='../..'
|
||||
#alias -g '....'='../../..'
|
||||
#alias -g BG='& exit'
|
||||
#alias -g C='|wc -l'
|
||||
#alias -g G='|grep'
|
||||
#alias -g H='|head'
|
||||
#alias -g Hl=' --help |& less -r'
|
||||
#alias -g K='|keep'
|
||||
#alias -g L='|less'
|
||||
#alias -g LL='|& less -r'
|
||||
#alias -g M='|most'
|
||||
#alias -g N='&>/dev/null'
|
||||
#alias -g R='| tr A-z N-za-m'
|
||||
#alias -g SL='| sort | less'
|
||||
#alias -g S='| sort'
|
||||
#alias -g T='|tail'
|
||||
#alias -g V='| vim -'
|
||||
|
||||
## instead of global aliase it might be better to use grmls $abk assoc array, whose contents are expanded after pressing ,.
|
||||
#$abk[SnL]="| sort -n | less"
|
||||
|
||||
## get top 10 shell commands:
|
||||
#alias top10='print -l ${(o)history%% *} | uniq -c | sort -nr | head -n 10'
|
||||
|
||||
## Execute \kbd{./configure}
|
||||
#alias CO="./configure"
|
||||
|
||||
## Execute \kbd{./configure --help}
|
||||
#alias CH="./configure --help"
|
||||
|
||||
## miscellaneous code ##
|
||||
|
||||
## Use a default width of 80 for manpages for more convenient reading
|
||||
#export MANWIDTH=${MANWIDTH:-80}
|
||||
|
||||
## Set a search path for the cd builtin
|
||||
#cdpath=(.. ~)
|
||||
|
||||
## variation of our manzsh() function; pick you poison:
|
||||
#manzsh() { /usr/bin/man zshall | most +/"$1" ; }
|
||||
|
||||
## Switching shell safely and efficiently? http://www.zsh.org/mla/workers/2001/msg02410.html
|
||||
#bash() {
|
||||
# NO_SWITCH="yes" command bash "$@"
|
||||
#}
|
||||
#restart () {
|
||||
# exec $SHELL $SHELL_ARGS "$@"
|
||||
#}
|
||||
|
||||
## Handy functions for use with the (e::) globbing qualifier (like nt)
|
||||
#contains() { grep -q "$*" $REPLY }
|
||||
#sameas() { diff -q "$*" $REPLY &>/dev/null }
|
||||
#ot () { [[ $REPLY -ot ${~1} ]] }
|
||||
|
||||
## get_ic() - queries imap servers for capabilities; real simple. no imaps
|
||||
#ic_get() {
|
||||
# emulate -L zsh
|
||||
# local port
|
||||
# if [[ ! -z $1 ]] ; then
|
||||
# port=${2:-143}
|
||||
# print "querying imap server on $1:${port}...\n";
|
||||
# print "a1 capability\na2 logout\n" | nc $1 ${port}
|
||||
# else
|
||||
# print "usage:\n $0 <imap-server> [port]"
|
||||
# fi
|
||||
#}
|
||||
|
||||
## List all occurrences of programm in current PATH
|
||||
#plap() {
|
||||
# emulate -L zsh
|
||||
# if [[ $# = 0 ]] ; then
|
||||
# echo "Usage: $0 program"
|
||||
# echo "Example: $0 zsh"
|
||||
# echo "Lists all occurrences of program in the current PATH."
|
||||
# else
|
||||
# ls -l ${^path}/*$1*(*N)
|
||||
# fi
|
||||
#}
|
||||
|
||||
## Find out which libs define a symbol
|
||||
#lcheck() {
|
||||
# if [[ -n "$1" ]] ; then
|
||||
# nm -go /usr/lib/lib*.a 2>/dev/null | grep ":[[:xdigit:]]\{8\} . .*$1"
|
||||
# else
|
||||
# echo "Usage: lcheck <function>" >&2
|
||||
# fi
|
||||
#}
|
||||
|
||||
## Download a file and display it locally
|
||||
#uopen() {
|
||||
# emulate -L zsh
|
||||
# if ! [[ -n "$1" ]] ; then
|
||||
# print "Usage: uopen \$URL/\$file">&2
|
||||
# return 1
|
||||
# else
|
||||
# FILE=$1
|
||||
# MIME=$(curl --head $FILE | \
|
||||
# grep Content-Type | \
|
||||
# cut -d ' ' -f 2 | \
|
||||
# cut -d\; -f 1)
|
||||
# MIME=${MIME%$'\r'}
|
||||
# curl $FILE | see ${MIME}:-
|
||||
# fi
|
||||
#}
|
||||
|
||||
## Memory overview
|
||||
#memusage() {
|
||||
# ps aux | awk '{if (NR > 1) print $5;
|
||||
# if (NR > 2) print "+"}
|
||||
# END { print "p" }' | dc
|
||||
#}
|
||||
|
||||
## print hex value of a number
|
||||
#hex() {
|
||||
# emulate -L zsh
|
||||
# if [[ -n "$1" ]]; then
|
||||
# printf "%x\n" $1
|
||||
# else
|
||||
# print 'Usage: hex <number-to-convert>'
|
||||
# return 1
|
||||
# fi
|
||||
#}
|
||||
|
||||
## log out? set timeout in seconds...
|
||||
## ...and do not log out in some specific terminals:
|
||||
#if [[ "${TERM}" == ([Exa]term*|rxvt|dtterm|screen*) ]] ; then
|
||||
# unset TMOUT
|
||||
#else
|
||||
# TMOUT=1800
|
||||
#fi
|
||||
|
||||
## associate types and extensions (be aware with perl scripts and anwanted behaviour!)
|
||||
#check_com zsh-mime-setup || { autoload zsh-mime-setup && zsh-mime-setup }
|
||||
#alias -s pl='perl -S'
|
||||
|
||||
## ctrl-s will no longer freeze the terminal.
|
||||
#stty erase "^?"
|
||||
|
||||
## you want to automatically use a bigger font on big terminals?
|
||||
#if [[ "$TERM" == "xterm" ]] && [[ "$LINES" -ge 50 ]] && [[ "$COLUMNS" -ge 100 ]] && [[ -z "$SSH_CONNECTION" ]] ; then
|
||||
# large
|
||||
#fi
|
||||
|
||||
## Some quick Perl-hacks aka /useful/ oneliner
|
||||
#bew() { perl -le 'print unpack "B*","'$1'"' }
|
||||
#web() { perl -le 'print pack "B*","'$1'"' }
|
||||
#hew() { perl -le 'print unpack "H*","'$1'"' }
|
||||
#weh() { perl -le 'print pack "H*","'$1'"' }
|
||||
#pversion() { perl -M$1 -le "print $1->VERSION" } # i. e."pversion LWP -> 5.79"
|
||||
#getlinks () { perl -ne 'while ( m/"((www|ftp|http):\/\/.*?)"/gc ) { print $1, "\n"; }' $* }
|
||||
#gethrefs () { perl -ne 'while ( m/href="([^"]*)"/gc ) { print $1, "\n"; }' $* }
|
||||
#getanames () { perl -ne 'while ( m/a name="([^"]*)"/gc ) { print $1, "\n"; }' $* }
|
||||
#getforms () { perl -ne 'while ( m:(\</?(input|form|select|option).*?\>):gic ) { print $1, "\n"; }' $* }
|
||||
#getstrings () { perl -ne 'while ( m/"(.*?)"/gc ) { print $1, "\n"; }' $*}
|
||||
#showINC () { perl -e 'for (@INC) { printf "%d %s\n", $i++, $_ }' }
|
||||
#vimpm () { vim `perldoc -l $1 | sed -e 's/pod$/pm/'` }
|
||||
#vimhelp () { vim -c "help $1" -c on -c "au! VimEnter *" }
|
||||
|
||||
## END OF FILE #################################################################
|
||||
|
|
@ -60,16 +60,6 @@
|
|||
# APT Unattended upgrades
|
||||
- include_tasks: apt-unattended.yml
|
||||
|
||||
# User skeleton
|
||||
- name: Configure user skeleton
|
||||
copy:
|
||||
src: "skel/dot_{{ item }}"
|
||||
dest: "/etc/skel/.{{ item }}"
|
||||
mode: 0644
|
||||
loop:
|
||||
- zshrc
|
||||
- zshrc.local
|
||||
|
||||
- name: Configure resolvconf
|
||||
template:
|
||||
src: resolv.conf
|
||||
|
|
|
|||
|
|
@ -3,8 +3,3 @@
|
|||
service:
|
||||
name: sshd
|
||||
state: restarted
|
||||
|
||||
- name: Restart fail2ban service
|
||||
service:
|
||||
name: fail2ban
|
||||
state: restarted
|
||||
|
|
|
|||
|
|
@ -24,21 +24,6 @@
|
|||
- /bin/umount # Only root should umount
|
||||
ignore_errors: true # Sometimes file won't exist
|
||||
|
||||
# Only SSH keys to log on root
|
||||
- name: Prohibit root SSH with password
|
||||
lineinfile:
|
||||
dest: /etc/ssh/sshd_config
|
||||
regexp: '^{{ item.0 }}'
|
||||
insertafter: '^#{{ item.0 }}'
|
||||
line: '{{ item.0 }} {{ item.1 }}'
|
||||
loop:
|
||||
- ["PermitRootLogin", "prohibit-password"]
|
||||
- ["AllowAgentForwarding", "no"]
|
||||
- ["X11Forwarding", "no"]
|
||||
- ["TCPKeepAlive", "yes"]
|
||||
notify: Restart sshd service
|
||||
|
||||
# See banned client with `fail2ban-client status sshd`
|
||||
- name: Install fail2ban
|
||||
apt:
|
||||
name: fail2ban
|
||||
|
|
|
|||
|
|
@ -1,13 +1,4 @@
|
|||
---
|
||||
# Filter SSH on groups
|
||||
- name: Filter SSH on groups
|
||||
when: ansible_facts['hostname'] != "camelot" # Camelot is accessible for everyone
|
||||
lineinfile:
|
||||
dest: /etc/ssh/sshd_config
|
||||
regexp: ^AllowGroups
|
||||
line: AllowGroups root sudoldap aurore ssh
|
||||
state: present
|
||||
|
||||
# To gain root access with ldap rights
|
||||
- name: Install SUDO package
|
||||
package:
|
||||
|
|
|
|||
|
|
@ -2,9 +2,6 @@
|
|||
# Install and configure main LDAP tools
|
||||
- include_tasks: install_ldap.yml
|
||||
|
||||
# Filter who can access server and sudo on groups
|
||||
- include_tasks: 1_group_security.yml
|
||||
|
||||
# Some userland scripts specific to LDAP install
|
||||
- include_tasks: 2_userland_scripts.yml
|
||||
|
||||
|
|
@ -14,11 +11,3 @@
|
|||
dest: /etc/pam.d/common-account
|
||||
regexp: 'pam_mkhomedir\.so'
|
||||
line: "session required pam_mkhomedir.so skel=/etc/skel/ umask=0077"
|
||||
|
||||
# If LDAP crashes
|
||||
- name: Install SSH keys for root account
|
||||
authorized_key:
|
||||
user: root
|
||||
key: "{{ ssh_pub_keys }}"
|
||||
state: present
|
||||
exclusive: true
|
||||
|
|
|
|||
17
roles/ulogd2/templates/ulogd.conf.j2
Normal file
17
roles/ulogd2/templates/ulogd.conf.j2
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
{{ ansible_managed | comment }}
|
||||
|
||||
[global]
|
||||
logfile="syslog"
|
||||
loglevel=3
|
||||
plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_inpflow_NFCT.so"
|
||||
plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_filter_IP2STR.so"
|
||||
plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_filter_PRINTFLOW.so"
|
||||
plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_output_SYSLOG.so"
|
||||
stack=ct:NFCT,ip2str:IP2STR,print:PRINTFLOW,sys:SYSLOG
|
||||
|
||||
[ct]
|
||||
#reliable=1
|
||||
hash_enable=0
|
||||
|
||||
[sys]
|
||||
facility=LOG_LOCAL2
|
||||
Loading…
Reference in a new issue