Cleanup some "LDAP for admin auth"-related config
This commit is contained in:
parent
7212154fbb
commit
dc7f868ed2
8 changed files with 17 additions and 4132 deletions
File diff suppressed because it is too large
Load diff
|
|
@ -1,326 +0,0 @@
|
||||||
# Filename: /etc/skel/.zshrc
|
|
||||||
# Purpose: config file for zsh (z shell)
|
|
||||||
# Authors: (c) grml-team (grml.org)
|
|
||||||
# Bug-Reports: see http://grml.org/bugs/
|
|
||||||
# License: This file is licensed under the GPL v2 or any later version.
|
|
||||||
################################################################################
|
|
||||||
# Nowadays, grml's zsh setup lives in only *one* zshrc file.
|
|
||||||
# That is the global one: /etc/zsh/zshrc (from grml-etc-core).
|
|
||||||
# It is best to leave *this* file untouched and do personal changes to
|
|
||||||
# your zsh setup via ${HOME}/.zshrc.local which is loaded at the end of
|
|
||||||
# the global zshrc.
|
|
||||||
#
|
|
||||||
# That way, we enable people on other operating systems to use our
|
|
||||||
# setup, too, just by copying our global zshrc to their ${HOME}/.zshrc.
|
|
||||||
# Adjustments would still go to the .zshrc.local file.
|
|
||||||
################################################################################
|
|
||||||
|
|
||||||
## Aurore host color and white user
|
|
||||||
zstyle ':prompt:grml:left:items:host' pre '%B%F{red}'
|
|
||||||
zstyle ':prompt:grml:left:items:host' post '%f%b'
|
|
||||||
zstyle ':prompt:grml:left:items:user' pre '%B'
|
|
||||||
zstyle ':prompt:grml:left:items:user' post '%b'
|
|
||||||
|
|
||||||
## Settings for umask
|
|
||||||
#if (( EUID == 0 )); then
|
|
||||||
# umask 002
|
|
||||||
#else
|
|
||||||
# umask 022
|
|
||||||
#fi
|
|
||||||
|
|
||||||
## Now, we'll give a few examples of what you might want to use in your
|
|
||||||
## .zshrc.local file (just copy'n'paste and uncomment it there):
|
|
||||||
|
|
||||||
## Prompt theme extension ##
|
|
||||||
|
|
||||||
# Virtualenv support
|
|
||||||
|
|
||||||
#function virtual_env_prompt () {
|
|
||||||
# REPLY=${VIRTUAL_ENV+(${VIRTUAL_ENV:t}) }
|
|
||||||
#}
|
|
||||||
#grml_theme_add_token virtual-env -f virtual_env_prompt '%F{magenta}' '%f'
|
|
||||||
#zstyle ':prompt:grml:left:setup' items rc virtual-env change-root user at host path vcs percent
|
|
||||||
|
|
||||||
## ZLE tweaks ##
|
|
||||||
|
|
||||||
## use the vi navigation keys (hjkl) besides cursor keys in menu completion
|
|
||||||
#bindkey -M menuselect 'h' vi-backward-char # left
|
|
||||||
#bindkey -M menuselect 'k' vi-up-line-or-history # up
|
|
||||||
#bindkey -M menuselect 'l' vi-forward-char # right
|
|
||||||
#bindkey -M menuselect 'j' vi-down-line-or-history # bottom
|
|
||||||
|
|
||||||
## set command prediction from history, see 'man 1 zshcontrib'
|
|
||||||
#is4 && zrcautoload predict-on && \
|
|
||||||
#zle -N predict-on && \
|
|
||||||
#zle -N predict-off && \
|
|
||||||
#bindkey "^X^Z" predict-on && \
|
|
||||||
#bindkey "^Z" predict-off
|
|
||||||
|
|
||||||
## press ctrl-q to quote line:
|
|
||||||
#mquote () {
|
|
||||||
# zle beginning-of-line
|
|
||||||
# zle forward-word
|
|
||||||
# # RBUFFER="'$RBUFFER'"
|
|
||||||
# RBUFFER=${(q)RBUFFER}
|
|
||||||
# zle end-of-line
|
|
||||||
#}
|
|
||||||
#zle -N mquote && bindkey '^q' mquote
|
|
||||||
|
|
||||||
## define word separators (for stuff like backward-word, forward-word, backward-kill-word,..)
|
|
||||||
#WORDCHARS='*?_-.[]~=/&;!#$%^(){}<>' # the default
|
|
||||||
#WORDCHARS=.
|
|
||||||
#WORDCHARS='*?_[]~=&;!#$%^(){}'
|
|
||||||
#WORDCHARS='${WORDCHARS:s@/@}'
|
|
||||||
|
|
||||||
# just type '...' to get '../..'
|
|
||||||
#rationalise-dot() {
|
|
||||||
#local MATCH
|
|
||||||
#if [[ $LBUFFER =~ '(^|/| | |'$'\n''|\||;|&)\.\.$' ]]; then
|
|
||||||
# LBUFFER+=/
|
|
||||||
# zle self-insert
|
|
||||||
# zle self-insert
|
|
||||||
#else
|
|
||||||
# zle self-insert
|
|
||||||
#fi
|
|
||||||
#}
|
|
||||||
#zle -N rationalise-dot
|
|
||||||
#bindkey . rationalise-dot
|
|
||||||
## without this, typing a . aborts incremental history search
|
|
||||||
#bindkey -M isearch . self-insert
|
|
||||||
|
|
||||||
#bindkey '\eq' push-line-or-edit
|
|
||||||
|
|
||||||
## some popular options ##
|
|
||||||
|
|
||||||
## add `|' to output redirections in the history
|
|
||||||
#setopt histallowclobber
|
|
||||||
|
|
||||||
## try to avoid the 'zsh: no matches found...'
|
|
||||||
#setopt nonomatch
|
|
||||||
|
|
||||||
## warning if file exists ('cat /dev/null > ~/.zshrc')
|
|
||||||
#setopt NO_clobber
|
|
||||||
|
|
||||||
## don't warn me about bg processes when exiting
|
|
||||||
#setopt nocheckjobs
|
|
||||||
|
|
||||||
## alert me if something failed
|
|
||||||
#setopt printexitvalue
|
|
||||||
|
|
||||||
## with spelling correction, assume dvorak kb
|
|
||||||
#setopt dvorak
|
|
||||||
|
|
||||||
## Allow comments even in interactive shells
|
|
||||||
#setopt interactivecomments
|
|
||||||
|
|
||||||
|
|
||||||
## compsys related snippets ##
|
|
||||||
|
|
||||||
## changed completer settings
|
|
||||||
#zstyle ':completion:*' completer _complete _correct _approximate
|
|
||||||
#zstyle ':completion:*' expand prefix suffix
|
|
||||||
|
|
||||||
## another different completer setting: expand shell aliases
|
|
||||||
#zstyle ':completion:*' completer _expand_alias _complete _approximate
|
|
||||||
|
|
||||||
## to have more convenient account completion, specify your logins:
|
|
||||||
#my_accounts=(
|
|
||||||
# {grml,grml1}@foo.invalid
|
|
||||||
# grml-devel@bar.invalid
|
|
||||||
#)
|
|
||||||
#other_accounts=(
|
|
||||||
# {fred,root}@foo.invalid
|
|
||||||
# vera@bar.invalid
|
|
||||||
#)
|
|
||||||
#zstyle ':completion:*:my-accounts' users-hosts $my_accounts
|
|
||||||
#zstyle ':completion:*:other-accounts' users-hosts $other_accounts
|
|
||||||
|
|
||||||
## add grml.org to your list of hosts
|
|
||||||
#hosts+=(grml.org)
|
|
||||||
#zstyle ':completion:*:hosts' hosts $hosts
|
|
||||||
|
|
||||||
## telnet on non-default ports? ...well:
|
|
||||||
## specify specific port/service settings:
|
|
||||||
#telnet_users_hosts_ports=(
|
|
||||||
# user1@host1:
|
|
||||||
# user2@host2:
|
|
||||||
# @mail-server:{smtp,pop3}
|
|
||||||
# @news-server:nntp
|
|
||||||
# @proxy-server:8000
|
|
||||||
#)
|
|
||||||
#zstyle ':completion:*:*:telnet:*' users-hosts-ports $telnet_users_hosts_ports
|
|
||||||
|
|
||||||
## the default grml setup provides '..' as a completion. it does not provide
|
|
||||||
## '.' though. If you want that too, use the following line:
|
|
||||||
#zstyle ':completion:*' special-dirs true
|
|
||||||
|
|
||||||
## aliases ##
|
|
||||||
|
|
||||||
## translate
|
|
||||||
#alias u='translate -i'
|
|
||||||
|
|
||||||
## ignore ~/.ssh/known_hosts entries
|
|
||||||
#alias insecssh='ssh -o "StrictHostKeyChecking=no" -o "UserKnownHostsFile=/dev/null" -o "PreferredAuthentications=keyboard-interactive"'
|
|
||||||
|
|
||||||
|
|
||||||
## global aliases (for those who like them) ##
|
|
||||||
|
|
||||||
#alias -g '...'='../..'
|
|
||||||
#alias -g '....'='../../..'
|
|
||||||
#alias -g BG='& exit'
|
|
||||||
#alias -g C='|wc -l'
|
|
||||||
#alias -g G='|grep'
|
|
||||||
#alias -g H='|head'
|
|
||||||
#alias -g Hl=' --help |& less -r'
|
|
||||||
#alias -g K='|keep'
|
|
||||||
#alias -g L='|less'
|
|
||||||
#alias -g LL='|& less -r'
|
|
||||||
#alias -g M='|most'
|
|
||||||
#alias -g N='&>/dev/null'
|
|
||||||
#alias -g R='| tr A-z N-za-m'
|
|
||||||
#alias -g SL='| sort | less'
|
|
||||||
#alias -g S='| sort'
|
|
||||||
#alias -g T='|tail'
|
|
||||||
#alias -g V='| vim -'
|
|
||||||
|
|
||||||
## instead of global aliase it might be better to use grmls $abk assoc array, whose contents are expanded after pressing ,.
|
|
||||||
#$abk[SnL]="| sort -n | less"
|
|
||||||
|
|
||||||
## get top 10 shell commands:
|
|
||||||
#alias top10='print -l ${(o)history%% *} | uniq -c | sort -nr | head -n 10'
|
|
||||||
|
|
||||||
## Execute \kbd{./configure}
|
|
||||||
#alias CO="./configure"
|
|
||||||
|
|
||||||
## Execute \kbd{./configure --help}
|
|
||||||
#alias CH="./configure --help"
|
|
||||||
|
|
||||||
## miscellaneous code ##
|
|
||||||
|
|
||||||
## Use a default width of 80 for manpages for more convenient reading
|
|
||||||
#export MANWIDTH=${MANWIDTH:-80}
|
|
||||||
|
|
||||||
## Set a search path for the cd builtin
|
|
||||||
#cdpath=(.. ~)
|
|
||||||
|
|
||||||
## variation of our manzsh() function; pick you poison:
|
|
||||||
#manzsh() { /usr/bin/man zshall | most +/"$1" ; }
|
|
||||||
|
|
||||||
## Switching shell safely and efficiently? http://www.zsh.org/mla/workers/2001/msg02410.html
|
|
||||||
#bash() {
|
|
||||||
# NO_SWITCH="yes" command bash "$@"
|
|
||||||
#}
|
|
||||||
#restart () {
|
|
||||||
# exec $SHELL $SHELL_ARGS "$@"
|
|
||||||
#}
|
|
||||||
|
|
||||||
## Handy functions for use with the (e::) globbing qualifier (like nt)
|
|
||||||
#contains() { grep -q "$*" $REPLY }
|
|
||||||
#sameas() { diff -q "$*" $REPLY &>/dev/null }
|
|
||||||
#ot () { [[ $REPLY -ot ${~1} ]] }
|
|
||||||
|
|
||||||
## get_ic() - queries imap servers for capabilities; real simple. no imaps
|
|
||||||
#ic_get() {
|
|
||||||
# emulate -L zsh
|
|
||||||
# local port
|
|
||||||
# if [[ ! -z $1 ]] ; then
|
|
||||||
# port=${2:-143}
|
|
||||||
# print "querying imap server on $1:${port}...\n";
|
|
||||||
# print "a1 capability\na2 logout\n" | nc $1 ${port}
|
|
||||||
# else
|
|
||||||
# print "usage:\n $0 <imap-server> [port]"
|
|
||||||
# fi
|
|
||||||
#}
|
|
||||||
|
|
||||||
## List all occurrences of programm in current PATH
|
|
||||||
#plap() {
|
|
||||||
# emulate -L zsh
|
|
||||||
# if [[ $# = 0 ]] ; then
|
|
||||||
# echo "Usage: $0 program"
|
|
||||||
# echo "Example: $0 zsh"
|
|
||||||
# echo "Lists all occurrences of program in the current PATH."
|
|
||||||
# else
|
|
||||||
# ls -l ${^path}/*$1*(*N)
|
|
||||||
# fi
|
|
||||||
#}
|
|
||||||
|
|
||||||
## Find out which libs define a symbol
|
|
||||||
#lcheck() {
|
|
||||||
# if [[ -n "$1" ]] ; then
|
|
||||||
# nm -go /usr/lib/lib*.a 2>/dev/null | grep ":[[:xdigit:]]\{8\} . .*$1"
|
|
||||||
# else
|
|
||||||
# echo "Usage: lcheck <function>" >&2
|
|
||||||
# fi
|
|
||||||
#}
|
|
||||||
|
|
||||||
## Download a file and display it locally
|
|
||||||
#uopen() {
|
|
||||||
# emulate -L zsh
|
|
||||||
# if ! [[ -n "$1" ]] ; then
|
|
||||||
# print "Usage: uopen \$URL/\$file">&2
|
|
||||||
# return 1
|
|
||||||
# else
|
|
||||||
# FILE=$1
|
|
||||||
# MIME=$(curl --head $FILE | \
|
|
||||||
# grep Content-Type | \
|
|
||||||
# cut -d ' ' -f 2 | \
|
|
||||||
# cut -d\; -f 1)
|
|
||||||
# MIME=${MIME%$'\r'}
|
|
||||||
# curl $FILE | see ${MIME}:-
|
|
||||||
# fi
|
|
||||||
#}
|
|
||||||
|
|
||||||
## Memory overview
|
|
||||||
#memusage() {
|
|
||||||
# ps aux | awk '{if (NR > 1) print $5;
|
|
||||||
# if (NR > 2) print "+"}
|
|
||||||
# END { print "p" }' | dc
|
|
||||||
#}
|
|
||||||
|
|
||||||
## print hex value of a number
|
|
||||||
#hex() {
|
|
||||||
# emulate -L zsh
|
|
||||||
# if [[ -n "$1" ]]; then
|
|
||||||
# printf "%x\n" $1
|
|
||||||
# else
|
|
||||||
# print 'Usage: hex <number-to-convert>'
|
|
||||||
# return 1
|
|
||||||
# fi
|
|
||||||
#}
|
|
||||||
|
|
||||||
## log out? set timeout in seconds...
|
|
||||||
## ...and do not log out in some specific terminals:
|
|
||||||
#if [[ "${TERM}" == ([Exa]term*|rxvt|dtterm|screen*) ]] ; then
|
|
||||||
# unset TMOUT
|
|
||||||
#else
|
|
||||||
# TMOUT=1800
|
|
||||||
#fi
|
|
||||||
|
|
||||||
## associate types and extensions (be aware with perl scripts and anwanted behaviour!)
|
|
||||||
#check_com zsh-mime-setup || { autoload zsh-mime-setup && zsh-mime-setup }
|
|
||||||
#alias -s pl='perl -S'
|
|
||||||
|
|
||||||
## ctrl-s will no longer freeze the terminal.
|
|
||||||
#stty erase "^?"
|
|
||||||
|
|
||||||
## you want to automatically use a bigger font on big terminals?
|
|
||||||
#if [[ "$TERM" == "xterm" ]] && [[ "$LINES" -ge 50 ]] && [[ "$COLUMNS" -ge 100 ]] && [[ -z "$SSH_CONNECTION" ]] ; then
|
|
||||||
# large
|
|
||||||
#fi
|
|
||||||
|
|
||||||
## Some quick Perl-hacks aka /useful/ oneliner
|
|
||||||
#bew() { perl -le 'print unpack "B*","'$1'"' }
|
|
||||||
#web() { perl -le 'print pack "B*","'$1'"' }
|
|
||||||
#hew() { perl -le 'print unpack "H*","'$1'"' }
|
|
||||||
#weh() { perl -le 'print pack "H*","'$1'"' }
|
|
||||||
#pversion() { perl -M$1 -le "print $1->VERSION" } # i. e."pversion LWP -> 5.79"
|
|
||||||
#getlinks () { perl -ne 'while ( m/"((www|ftp|http):\/\/.*?)"/gc ) { print $1, "\n"; }' $* }
|
|
||||||
#gethrefs () { perl -ne 'while ( m/href="([^"]*)"/gc ) { print $1, "\n"; }' $* }
|
|
||||||
#getanames () { perl -ne 'while ( m/a name="([^"]*)"/gc ) { print $1, "\n"; }' $* }
|
|
||||||
#getforms () { perl -ne 'while ( m:(\</?(input|form|select|option).*?\>):gic ) { print $1, "\n"; }' $* }
|
|
||||||
#getstrings () { perl -ne 'while ( m/"(.*?)"/gc ) { print $1, "\n"; }' $*}
|
|
||||||
#showINC () { perl -e 'for (@INC) { printf "%d %s\n", $i++, $_ }' }
|
|
||||||
#vimpm () { vim `perldoc -l $1 | sed -e 's/pod$/pm/'` }
|
|
||||||
#vimhelp () { vim -c "help $1" -c on -c "au! VimEnter *" }
|
|
||||||
|
|
||||||
## END OF FILE #################################################################
|
|
||||||
|
|
@ -60,16 +60,6 @@
|
||||||
# APT Unattended upgrades
|
# APT Unattended upgrades
|
||||||
- include_tasks: apt-unattended.yml
|
- include_tasks: apt-unattended.yml
|
||||||
|
|
||||||
# User skeleton
|
|
||||||
- name: Configure user skeleton
|
|
||||||
copy:
|
|
||||||
src: "skel/dot_{{ item }}"
|
|
||||||
dest: "/etc/skel/.{{ item }}"
|
|
||||||
mode: 0644
|
|
||||||
loop:
|
|
||||||
- zshrc
|
|
||||||
- zshrc.local
|
|
||||||
|
|
||||||
- name: Configure resolvconf
|
- name: Configure resolvconf
|
||||||
template:
|
template:
|
||||||
src: resolv.conf
|
src: resolv.conf
|
||||||
|
|
|
||||||
|
|
@ -3,8 +3,3 @@
|
||||||
service:
|
service:
|
||||||
name: sshd
|
name: sshd
|
||||||
state: restarted
|
state: restarted
|
||||||
|
|
||||||
- name: Restart fail2ban service
|
|
||||||
service:
|
|
||||||
name: fail2ban
|
|
||||||
state: restarted
|
|
||||||
|
|
|
||||||
|
|
@ -24,21 +24,6 @@
|
||||||
- /bin/umount # Only root should umount
|
- /bin/umount # Only root should umount
|
||||||
ignore_errors: true # Sometimes file won't exist
|
ignore_errors: true # Sometimes file won't exist
|
||||||
|
|
||||||
# Only SSH keys to log on root
|
|
||||||
- name: Prohibit root SSH with password
|
|
||||||
lineinfile:
|
|
||||||
dest: /etc/ssh/sshd_config
|
|
||||||
regexp: '^{{ item.0 }}'
|
|
||||||
insertafter: '^#{{ item.0 }}'
|
|
||||||
line: '{{ item.0 }} {{ item.1 }}'
|
|
||||||
loop:
|
|
||||||
- ["PermitRootLogin", "prohibit-password"]
|
|
||||||
- ["AllowAgentForwarding", "no"]
|
|
||||||
- ["X11Forwarding", "no"]
|
|
||||||
- ["TCPKeepAlive", "yes"]
|
|
||||||
notify: Restart sshd service
|
|
||||||
|
|
||||||
# See banned client with `fail2ban-client status sshd`
|
|
||||||
- name: Install fail2ban
|
- name: Install fail2ban
|
||||||
apt:
|
apt:
|
||||||
name: fail2ban
|
name: fail2ban
|
||||||
|
|
|
||||||
|
|
@ -1,13 +1,4 @@
|
||||||
---
|
---
|
||||||
# Filter SSH on groups
|
|
||||||
- name: Filter SSH on groups
|
|
||||||
when: ansible_facts['hostname'] != "camelot" # Camelot is accessible for everyone
|
|
||||||
lineinfile:
|
|
||||||
dest: /etc/ssh/sshd_config
|
|
||||||
regexp: ^AllowGroups
|
|
||||||
line: AllowGroups root sudoldap aurore ssh
|
|
||||||
state: present
|
|
||||||
|
|
||||||
# To gain root access with ldap rights
|
# To gain root access with ldap rights
|
||||||
- name: Install SUDO package
|
- name: Install SUDO package
|
||||||
package:
|
package:
|
||||||
|
|
|
||||||
|
|
@ -2,9 +2,6 @@
|
||||||
# Install and configure main LDAP tools
|
# Install and configure main LDAP tools
|
||||||
- include_tasks: install_ldap.yml
|
- include_tasks: install_ldap.yml
|
||||||
|
|
||||||
# Filter who can access server and sudo on groups
|
|
||||||
- include_tasks: 1_group_security.yml
|
|
||||||
|
|
||||||
# Some userland scripts specific to LDAP install
|
# Some userland scripts specific to LDAP install
|
||||||
- include_tasks: 2_userland_scripts.yml
|
- include_tasks: 2_userland_scripts.yml
|
||||||
|
|
||||||
|
|
@ -14,11 +11,3 @@
|
||||||
dest: /etc/pam.d/common-account
|
dest: /etc/pam.d/common-account
|
||||||
regexp: 'pam_mkhomedir\.so'
|
regexp: 'pam_mkhomedir\.so'
|
||||||
line: "session required pam_mkhomedir.so skel=/etc/skel/ umask=0077"
|
line: "session required pam_mkhomedir.so skel=/etc/skel/ umask=0077"
|
||||||
|
|
||||||
# If LDAP crashes
|
|
||||||
- name: Install SSH keys for root account
|
|
||||||
authorized_key:
|
|
||||||
user: root
|
|
||||||
key: "{{ ssh_pub_keys }}"
|
|
||||||
state: present
|
|
||||||
exclusive: true
|
|
||||||
|
|
|
||||||
17
roles/ulogd2/templates/ulogd.conf.j2
Normal file
17
roles/ulogd2/templates/ulogd.conf.j2
Normal file
|
|
@ -0,0 +1,17 @@
|
||||||
|
{{ ansible_managed | comment }}
|
||||||
|
|
||||||
|
[global]
|
||||||
|
logfile="syslog"
|
||||||
|
loglevel=3
|
||||||
|
plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_inpflow_NFCT.so"
|
||||||
|
plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_filter_IP2STR.so"
|
||||||
|
plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_filter_PRINTFLOW.so"
|
||||||
|
plugin="/usr/lib/x86_64-linux-gnu/ulogd/ulogd_output_SYSLOG.so"
|
||||||
|
stack=ct:NFCT,ip2str:IP2STR,print:PRINTFLOW,sys:SYSLOG
|
||||||
|
|
||||||
|
[ct]
|
||||||
|
#reliable=1
|
||||||
|
hash_enable=0
|
||||||
|
|
||||||
|
[sys]
|
||||||
|
facility=LOG_LOCAL2
|
||||||
Loading…
Reference in a new issue