Skip to content

Commit a34cfdb

Browse files
author
Ben Rockwood
committed
Initial commit
0 parents  commit a34cfdb

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

64 files changed

+5989
-0
lines changed

‎DirectoryBuilder/Makefile

+69
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
include ../Makefile.config
2+
3+
4+
DOMAIN= $(DIT_SUFFIX)
5+
################################################################################
6+
7+
8+
all: templates
9+
10+
11+
12+
templates:
13+
/bin/sed s/__DOMAIN__/$(DOMAIN)/g autofs.template > autofs.ldif
14+
/bin/sed s/__DOMAIN__/$(DOMAIN)/g dit-base.template \
15+
| /bin/sed s/__NISDOMAIN__/$(NISDOMAIN)/g > dit-base.ldif
16+
/bin/sed s/__DOMAIN__/$(DOMAIN)/g dua.template \
17+
| /bin/sed s/__LDAPSERVERS__/$(SERVERS)/ \
18+
| /bin/sed s/__PREFSERVERS__/$(PREFSERVERS)/ > dua.ldif
19+
/bin/sed s/__DOMAIN__/$(DOMAIN)/g proxyAgent.template \
20+
| /bin/sed s/__PROXYPASS__/$(PROXY_PASS_SSHA)/ > proxyAgent.ldif
21+
/bin/sed s/__DOMAIN__/$(DOMAIN)/g rbac.template > rbac.ldif
22+
23+
/bin/sed s/__DOMAIN__/$(DOMAIN)/g mirrormode.template \
24+
| /bin/sed s/__MIRRORMODE_PASS__/$(MIRROR_PASS_SSHA)/ > mirrormode.ldif
25+
26+
mkdir groups
27+
/bin/sed s/__DOMAIN__/$(DOMAIN)/g group.template > groups/group.copyme
28+
mkdir users
29+
/bin/sed s/__DOMAIN__/$(DOMAIN)/g user.template > users/user.copyme
30+
mkdir hosts
31+
/bin/sed s/__DOMAIN__/$(DOMAIN)/g host.template > hosts/host.copyme
32+
mkdir projects
33+
/bin/sed s/__DOMAIN__/$(DOMAIN)/g project.template > projects/project.copyme
34+
mkdir netgroups
35+
/bin/sed s/__DOMAIN__/$(DOMAIN)/g netgroup.template > netgroups/netgroup.copyme
36+
mkdir aliases
37+
/bin/sed s/__DOMAIN__/$(DOMAIN)/g aliases.template > aliases/aliases.copyme
38+
39+
mkdir template
40+
mv *.template template
41+
#
42+
# Now start modifying LDIF's, namely DUA, proxyAgent, and mirrormode.
43+
#
44+
45+
clean-all:
46+
rm -f autofs.ldif dit-base.ldif dua.ldif proxyAgent.ldif \
47+
mirrormode.ldif rbac.ldif
48+
rm -rf groups users hosts projects netgroups aliases
49+
mv template/*.template .
50+
rmdir template
51+
52+
53+
54+
backup:
55+
mkdir backups
56+
cp *.ldif backups
57+
58+
59+
addbase:
60+
cp /etc/openldap/DB_CONFIG.example /var/openldap/DB_CONFIG
61+
chown root:openldap /var/openldap/DB_CONFIG
62+
chmod 440 /var/openldap/DB_CONFIG
63+
64+
slapadd -l dit-base.ldif
65+
slapadd -l dua.ldif
66+
slapadd -l proxyAgent.ldif
67+
slapadd -l rbac.ldif
68+
slapadd -l mirrormode.ldif
69+
# Now add custom LDIF's, such as users, groups, hosts, projects, etc.

‎DirectoryBuilder/aliases.template

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
dn: cn=operator,ou=aliases,__DOMAIN__
2+
objectClass: mailGroup
3+
objectClass: top
4+
mail: operator
5+
mgrpRFC822MailMember:: CXJvb3Q=
6+
cn: operator

‎DirectoryBuilder/autofs.template

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
dn: automountKey=/net,automountMapName=auto_master,__DOMAIN__
2+
objectClass: automount
3+
objectClass: top
4+
automountKey: /net
5+
automountInformation: -hosts -nosuid,nobrowse
6+
7+
dn: automountKey=/home,automountMapName=auto_master,__DOMAIN__
8+
objectClass: automount
9+
objectClass: top
10+
automountKey: /home
11+
automountInformation: auto_home -nobrowse

‎DirectoryBuilder/dit-base.template

+119
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
dn: __DOMAIN__
2+
objectClass: domain
3+
objectClass: top
4+
objectClass: nisDomainObject
5+
dc: __NISDC__
6+
nisDomain: __NISDOMAIN__
7+
8+
## DIT Structure: ######################################
9+
10+
dn: ou=people,__DOMAIN__
11+
ou: people
12+
objectClass: top
13+
objectClass: organizationalUnit
14+
15+
dn: ou=group,__DOMAIN__
16+
ou: group
17+
objectClass: top
18+
objectClass: organizationalUnit
19+
20+
dn: ou=rpc,__DOMAIN__
21+
ou: rpc
22+
objectClass: top
23+
objectClass: organizationalUnit
24+
25+
dn: ou=protocols,__DOMAIN__
26+
ou: protocols
27+
objectClass: top
28+
objectClass: organizationalUnit
29+
30+
dn: ou=networks,__DOMAIN__
31+
ou: networks
32+
objectClass: top
33+
objectClass: organizationalUnit
34+
35+
dn: ou=netgroup,__DOMAIN__
36+
ou: netgroup
37+
objectClass: top
38+
objectClass: organizationalUnit
39+
40+
dn: ou=aliases,__DOMAIN__
41+
ou: aliases
42+
objectClass: top
43+
objectClass: organizationalUnit
44+
45+
dn: ou=hosts,__DOMAIN__
46+
ou: hosts
47+
objectClass: top
48+
objectClass: organizationalUnit
49+
50+
dn: ou=services,__DOMAIN__
51+
ou: services
52+
objectClass: top
53+
objectClass: organizationalUnit
54+
55+
dn: ou=ethers,__DOMAIN__
56+
ou: ethers
57+
objectClass: top
58+
objectClass: organizationalUnit
59+
60+
dn: ou=profile,__DOMAIN__
61+
ou: profile
62+
objectClass: top
63+
objectClass: organizationalUnit
64+
65+
dn: ou=printers,__DOMAIN__
66+
ou: printers
67+
objectClass: top
68+
objectClass: organizationalUnit
69+
70+
dn: ou=projects,__DOMAIN__
71+
ou: projects
72+
objectClass: top
73+
objectClass: organizationalUnit
74+
75+
dn: ou=SolarisAuthAttr,__DOMAIN__
76+
ou: SolarisAuthAttr
77+
objectClass: top
78+
objectClass: organizationalUnit
79+
80+
dn: ou=SolarisProfAttr,__DOMAIN__
81+
ou: SolarisProfAttr
82+
objectClass: top
83+
objectClass: organizationalUnit
84+
85+
dn: ou=Timezone,__DOMAIN__
86+
ou: Timezone
87+
objectClass: top
88+
objectClass: organizationalUnit
89+
90+
dn: ou=ipTnet,__DOMAIN__
91+
ou: ipTnet
92+
objectClass: top
93+
objectClass: organizationalUnit
94+
95+
####### NFS AUTOMOUNT #####################################
96+
97+
### auto_home
98+
dn: automountMapName=auto_home,__DOMAIN__
99+
automountMapName: auto_home
100+
objectClass: top
101+
objectClass: automountMap
102+
103+
### auto_direct
104+
dn: automountMapName=auto_direct,__DOMAIN__
105+
automountMapName: auto_direct
106+
objectClass: top
107+
objectClass: automountMap
108+
109+
### auto_master
110+
dn: automountMapName=auto_master,__DOMAIN__
111+
automountMapName: auto_master
112+
objectClass: top
113+
objectClass: automountMap
114+
115+
### auto_shared
116+
dn: automountMapName=auto_shared,__DOMAIN__
117+
automountMapName: auto_shared
118+
objectClass: top
119+
objectClass: automountMap

‎DirectoryBuilder/dua.template

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
### Used by 'ldapclient' to configure the client per RFC 2307 (DUA = Directory User Agent)
2+
###
3+
dn: cn=default,ou=profile,__DOMAIN__
4+
objectClass: top
5+
objectClass: DUAConfigProfile
6+
cn: default
7+
defaultServerList: __LDAPSERVERS__
8+
preferredServerList: __PREFSERVERS__
9+
defaultSearchBase: __DOMAIN__
10+
followReferrals: FALSE
11+
defaultSearchScope: one
12+
searchTimeLimit: 30
13+
profileTTL: 43200
14+
credentialLevel: proxy
15+
bindTimeLimit: 10

‎DirectoryBuilder/group.template

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
dn: cn=family,ou=group,__DOMAIN__
2+
objectClass: posixGroup
3+
objectClass: top
4+
cn: family
5+
gidNumber: 100
6+
description: Family Group
7+
memberUid: benr
8+
memberUid: nova

‎DirectoryBuilder/host.template

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
dn: cn=quadra.cuddlelabs.com+ipHostNumber=10.0.0.18,ou=Hosts,__DOMAIN__
2+
objectClass: ipHost
3+
objectClass: device
4+
objectClass: top
5+
cn: quadra.cuddlelabs.com
6+
cn: quadra
7+
ipHostNumber: 10.0.0.18

‎DirectoryBuilder/mirrormode.template

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# userPassword should match the password in slapd.conf (use "slappasswd")
2+
dn: cn=mirrormode,__DOMAIN__
3+
objectClass: top
4+
objectClass: person
5+
cn: mirrormode
6+
sn: mirrormode
7+
userPassword: __MIRRORMODE_PASS__

‎DirectoryBuilder/netgroup.template

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
dn: cn=admins,ou=netgroup,__DOMAIN__
2+
objectClass: nisNetgroup
3+
objectClass: top
4+
cn: admins
5+
nisNetgroupTriple: (machine1,user1,domain1)
6+
nisNetgroupTriple: (machine2,user2,domain2)
7+
memberNisNetgroup: anotherNetGroup
8+
description: Sampe Admin NetGroup

‎DirectoryBuilder/ppolicy.template

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
dn: ou=policies,__DOMAIN__
2+
objectClass: organizationalUnit
3+
objectClass: top
4+
ou: policies
5+
6+
dn: cn=default,ou=policies,__DOMAIN__
7+
cn: default
8+
objectClass: pwdPolicy
9+
objectClass: person
10+
objectClass: top
11+
pwdAllowUserChange: TRUE
12+
pwdAttribute: userPassword
13+
pwdCheckQuality: 2
14+
pwdExpireWarning: 600
15+
pwdFailureCountInterval: 30
16+
pwdGraceAuthNLimit: 5
17+
pwdInHistory: 5
18+
pwdLockout: TRUE
19+
pwdLockoutDuration: 0
20+
pwdMaxAge: 0
21+
pwdMaxFailure: 5
22+
pwdMinAge: 0
23+
pwdMinLength: 5
24+
pwdMustChange: FALSE
25+
pwdSafeModify: FALSE
26+
sn: PPolicy

‎DirectoryBuilder/project.template

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
dn: SolarisProjectName=apache,ou=projects,__DOMAIN__
2+
objectClass: SolarisProject
3+
objectClass: top
4+
SolarisProjectName: apache
5+
SolarisProjectID: 103
6+
description: Apache Web Server
7+
SolarisProjectAttr: project.max-lwps=(priv,1000,deny);project.cpu-shares=(priv,100,none);project.cpu-cap=(priv,150,deny)
8+
memberUid: www

‎DirectoryBuilder/proxyAgent.template

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
dn: cn=proxyagent,ou=profile,__DOMAIN__
2+
objectClass: top
3+
objectClass: person
4+
cn: proxyagent
5+
sn: proxyagent
6+
userPassword: __PROXYPASS__

‎DirectoryBuilder/rbac.template

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# Example RBAC Profile (/etc/security/prof_attr)
2+
dn: cn=xVM Management,ou=SolarisProfAttr,__DOMAIN__
3+
objectClass: SolarisProfAttr
4+
objectClass: top
5+
cn: xVM Management
6+
SolarisAttrKeyValue: help=RtxvmMngmnt.html
7+
SolarisAttrLongDesc: xVM Administration
8+
9+
# Put Primary Administrator in LDAP, just in case its not present on a nodes local file.
10+
dn: cn=Primary Administrator,ou=SolarisProfAttr,__DOMAIN__
11+
objectClass: SolarisProfAttr
12+
objectClass: top
13+
cn: Primary Administrator
14+
SolarisAttrKeyValue: auths=solaris.*,solaris.grant;help=RtPriAdmin.html
15+
SolarisAttrLongDesc: Can perform all administrative tasks
16+
17+
dn: cn=Primary Administrator+SolarisKernelSecurityPolicy=suser+SolarisProfileType=cmd+SolarisProfileId=*,ou=SolarisProfAttr,__DOMAIN__
18+
objectClass: SolarisExecAttr
19+
objectClass: SolarisProfAttr
20+
objectClass: top
21+
cn: Primary Administrator
22+
SolarisKernelSecurityPolicy: suser
23+
SolarisProfileType: cmd
24+
SolarisProfileId: *
25+
SolarisAttrKeyValue: uid=0;gid=0
26+
27+
# Example of a RBAC Meta-Profile (Profile of Profiles)
28+
dn: cn=Joyent Level 1,ou=SolarisProfAttr,__DOMAIN__
29+
objectClass: SolarisProfAttr
30+
objectClass: top
31+
cn: Joyent Level 1
32+
SolarisAttrKeyValue: profiles=Zone Management,xVM Administration;help=RtJoyentLvl1.html
33+
SolarisAttrLongDesc: Joyent General Staff
34+
35+
dn: cn=Joyent Level 2,ou=SolarisProfAttr,__DOMAIN__
36+
objectClass: SolarisProfAttr
37+
objectClass: top
38+
cn: Joyent Level 2
39+
SolarisAttrKeyValue: profiles=Network Management,Network Management,Process Management,ZFS File System Management,Zone Management,Cron Management,File System Management,Maintenance and Repair,xVM Administration,Service Management;help=RtJoyentLvl2.html
40+
SolarisAttrLongDesc: Joyent Intermediate Engineers
41+
42+
dn: cn=Joyent Level 3,ou=SolarisProfAttr,__DOMAIN__
43+
objectClass: SolarisProfAttr
44+
objectClass: top
45+
cn: Joyent Level 3
46+
SolarisAttrKeyValue: profiles=Primary Administrator;auths=solaris.*,solaris.grant;help=RtJoyentLvl2.html
47+
SolarisAttrLongDesc: Joyent Senior Engineers
48+
49+
# Example of RBAC Exec (give UID=0 to "xVM Management" profile calling "xm")
50+
dn: cn=xVM Management+SolarisKernelSecurityPolicy=solaris+SolarisProfileType=cmd+SolarisProfileId=/usr/sbin/xm,ou=SolarisProfAttr,__DOMAIN__
51+
objectClass: SolarisExecAttr
52+
objectClass: SolarisProfAttr
53+
objectClass: top
54+
cn: xVM Management
55+
SolarisKernelSecurityPolicy: solaris
56+
SolarisProfileType: cmd
57+
SolarisProfileId: /usr/sbin/xm
58+
SolarisAttrKeyValue: uid=0
59+
60+
# Example of RBAC Exec (give UID=0 to "xVM Management" profile calling "virsh")
61+
dn: cn=xVM Management+SolarisKernelSecurityPolicy=solaris+SolarisProfileType=cmd+SolarisProfileId=/bin/virsh,ou=SolarisProfAttr,__DOMAIN__
62+
objectClass: SolarisExecAttr
63+
objectClass: SolarisProfAttr
64+
objectClass: top
65+
cn: xVM Management
66+
SolarisKernelSecurityPolicy: solaris
67+
SolarisProfileType: cmd
68+
SolarisProfileId: /bin/virsh
69+
SolarisAttrKeyValue: uid=0
70+
71+
# Example of RBAC Exec (give UID=0 to "xVM Management" profile calling "virt-install")
72+
dn: cn=xVM Management+SolarisKernelSecurityPolicy=solaris+SolarisProfileType=cmd+SolarisProfileId=/bin/virt-install,ou=SolarisProfAttr,__DOMAIN__
73+
objectClass: SolarisExecAttr
74+
objectClass: SolarisProfAttr
75+
objectClass: top
76+
cn: xVM Management
77+
SolarisKernelSecurityPolicy: solaris
78+
SolarisProfileType: cmd
79+
SolarisProfileId: /bin/virt-install
80+
SolarisAttrKeyValue: uid=0
81+
82+

0 commit comments

Comments
 (0)