WIP: Active directory roles #431

jovial · 2024-09-04T14:43:21Z

Usage is:

Add relevant hosts to inventory groups: sssd, kerberos_client (if using kerberos), ldap_client (if using ldap)
If using kerberos, place kerberos configuration here: environments/<env>/templates/krb5.conf.j2
Define sssd config in inventory (/environments/<env>/inventory/group_vars/all/sssd.yml):

Note: This needs to be in dictionary format. E.g for LDAP:

      sssd_config:
        'sssd':
          'config_file_version': '2'
          'debug_level': '5'
          'reconnection_retries': '3'
          'services': 'nss, pam'
          'domains': 'cam'
        'domain/example':
          'auth_provider': 'ldap'
          'ldap_id_use_start_tls': 'False'
          'chpass_provider': 'ldap'
          'cache_credentials': 'True'
          'krb5_realm': 'EXAMPLE.COM'
          'ldap_search_base': "dc=example,dc=com"
          'id_provider': 'ldap'
          'ldap_uri': "ldaps://ldap.example.com"
          'krb5_kdcip': 'kerberos.example.com'
          'ldap_enumeration_refresh_timeout': '43200'
          'ldap_purge_cache_timeout': '0'
          'enumerate': 'true'

If using kerberos, you will need to join the node into AD via one of:

realm join
adcli preset-computer and adcli join.
ktadd
some other means

You can then place the kerberos keytab in the following path (one per host):

./environments/<env>/files/<inventory hostname>/krb5.keytab

There is a convenience playbook to collect these keytabs if joining on the host itself (ansible/adhoc/collect-kerberos-keytabs.yml). the workflow is:

Run site.yml
It will fail because keytab is missing
Run realm join
Collect keytabs
Re-run site.yml

jovial · 2024-09-04T14:46:52Z

ansible/bootstrap.yml

@@ -111,6 +111,22 @@
      register: sestatus

 # --- tasks after here require access to package repos ---
+- hosts: cacerts


Active directory was using a custom CA

sjpb · 2024-09-11T20:13:49Z

ansible/roles/sshd/tasks/install.yml

+---
+
+- name: Install dependencies
+  ansible.builtin.package:


can use dnf with a list for name to allow proper dependency resolution

sjpb · 2024-09-11T20:14:38Z

ansible/roles/sssd/tasks/install-RedHat.yml

We only support Rocky, how come this is here?

sjpb · 2024-09-11T20:18:15Z

ansible/roles/sssd/vars/Rocky.yml

@@ -0,0 +1,14 @@
+---
+sssd_packages:
+  - 'sssd'


On RL9, package providing sssd appears to be called sssd-common. There is no sssd package. And sssd-common, sssd-client, sssd-kcm, sssd-nfs-idmap appear to be installed by default in genericcloud image

Hmm that isn't right, both packages are available on both OS. Installing sssd installs sssd-common. However at least on RL9 installing sssd-common appears to be enough for ldap auth.

RL9: installing sssd = 49M download
RL9: installing sssd-common = 3.9M download

[root@9bb7a8d6a6a5 /]# cat /etc/redhat-release Rocky Linux release 8.9 (Green Obsidian) [root@9bb7a8d6a6a5 /]# dnf info sssd Last metadata expiration check: 0:00:35 ago on Thu Sep 12 12:58:10 2024. Available Packages Name : sssd Version : 2.9.4 Release : 4.el8_10 ... Description : Provides a set of daemons to manage access to remote directories and : authentication mechanisms. It provides an NSS and PAM interface toward : the system and a plug-gable back-end system to connect to multiple different : account sources. It is also the basis to provide client auditing and policy : services for projects like FreeIPA. : : The sssd sub-package is a meta-package that contains the daemon as well as all : the existing back ends. [root@9bb7a8d6a6a5 /]# dnf info sssd-common Last metadata expiration check: 0:00:39 ago on Thu Sep 12 12:58:10 2024. Available Packages Name : sssd-common Version : 2.9.4 Release : 4.el8_10 ... Description : Common files for the SSSD. The common package includes all the files needed : to run a particular back end, however, the back ends are packaged in separate : sub-packages such as sssd-ldap.

So:

[root@stg-login-0 rocky]# dnf whatprovides /usr/sbin/sssd Last metadata expiration check: 0:39:01 ago on Fri 13 Sep 2024 09:34:20 AM UTC. sssd-common-2.9.4-6.el9_4.1.x86_64 : Common files for the SSSD Repo : @System Matched from: Filename : /usr/sbin/sssd ... [root@stg-login-0 rocky]# dnf whatprovides /usr/lib/systemd/system/sssd.service Last metadata expiration check: 0:40:47 ago on Fri 13 Sep 2024 09:34:20 AM UTC. sssd-common-2.9.4-6.el9_4.1.x86_64 : Common files for the SSSD Repo : @System Matched from: Filename : /usr/lib/systemd/system/sssd.service ... i.e. despite the package descriptions, sssd-common is the one which provides the unit file and the daemon binary.

sjpb · 2024-09-12T11:07:17Z

ansible/roles/ldap/tasks/install.yml

+  become: true
+  with_items:
+    - sssd-ldap
+    - openldap-clients


actually a dep of sssd-ldap, doesn't need to be explicitly specified

and actually this isn't for ldap generally, only for sssd using ldap

sjpb · 2024-09-12T12:38:30Z

environments/.gitignore

Nope, don't want to gitignore these generally, deployments might want to commit these.

sjpb · 2024-09-12T12:55:49Z

ansible/roles/sssd/tasks/configure.yml

+  when: sssd_config is defined
+  notify: "Restart sssd"
+
+- name: "Check if authconfig needs to be run to configure pam/nsswitch"


@jovial do you understand what this is actually doing?

sjpb · 2024-09-12T12:56:55Z

ansible/roles/sssd/tasks/configure.yml

+  check_mode: no
+  failed_when: "authconfig_result.rc >= 2"
+
+- name: "Configure nsswitch and pam for SSSD via authconfig"


Think this is the only part of this role not provided by alternative PR (TBD)

sjpb · 2024-09-13T10:14:11Z

ansible/roles/sssd/vars/Rocky.yml

@@ -0,0 +1,14 @@
+---
+sssd_packages:
+  - 'sssd'


So:

[root@stg-login-0 rocky]# dnf whatprovides /usr/sbin/sssd Last metadata expiration check: 0:39:01 ago on Fri 13 Sep 2024 09:34:20 AM UTC. sssd-common-2.9.4-6.el9_4.1.x86_64 : Common files for the SSSD Repo : @System Matched from: Filename : /usr/sbin/sssd ... [root@stg-login-0 rocky]# dnf whatprovides /usr/lib/systemd/system/sssd.service Last metadata expiration check: 0:40:47 ago on Fri 13 Sep 2024 09:34:20 AM UTC. sssd-common-2.9.4-6.el9_4.1.x86_64 : Common files for the SSSD Repo : @System Matched from: Filename : /usr/lib/systemd/system/sssd.service ... i.e. despite the package descriptions, sssd-common is the one which provides the unit file and the daemon binary.

sjpb · 2024-09-18T14:42:37Z

environments/common/inventory/groups

+openhpc
+
+[sshd:children]


I think the default here must be to NOT add sshd configuration.

Also needs adding to the everything template, empty

sjpb · 2024-09-18T14:54:07Z

ansible/roles/sssd/tasks/configure.yml

+
+# TODO: Make idempotent
+- name: "Configure nsswitch and pam for SSSD via authconfig"
+  command: "authselect select sssd{% if sssd_enable_mkhomedir | bool %} with-mkhomedir{% endif %}"


Hmm I get:

[root@stg-login-0 rocky]# authselect select sssd with-mkhomedir [error] File [/etc/pam.d/system-auth] exists but it needs to be overwritten! [error] File [/etc/pam.d/password-auth] exists but it needs to be overwritten! [error] File [/etc/pam.d/fingerprint-auth] exists but it needs to be overwritten! [error] File [/etc/pam.d/smartcard-auth] exists but it needs to be overwritten! [error] File [/etc/pam.d/postlogin] exists but it needs to be overwritten! [error] File [/etc/nsswitch.conf] exists but it needs to be overwritten! [error] File that needs to be overwritten was found [error] Refusing to activate profile unless this file is removed or overwrite is requested.

sjpb · 2024-09-18T15:26:35Z

ansible/roles/sshd/tasks/runtime.yml

+
+- name: Disallow SSH password authentication
+  lineinfile:
+    dest: /etc/ssh/sshd_config


This doesn't work on RL9 - there's a /etc/ssh/sshd_config.d/50-cloud-init.conf which wins.

darn it - a drop in config file does sound nicer

WIP: Active directory roles

1eced5d

jovial requested a review from a team as a code owner September 4, 2024 14:43

jovial commented Sep 4, 2024

View reviewed changes

sjpb reviewed Sep 11, 2024

View reviewed changes

ansible/roles/sssd/tasks/install-RedHat.yml Outdated

Copy link

Collaborator

sjpb Sep 11, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We only support Rocky, how come this is here?

sjpb reviewed Sep 11, 2024

View reviewed changes

sjpb reviewed Sep 12, 2024

View reviewed changes

environments/.gitignore Outdated

Copy link

Collaborator

sjpb Sep 12, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nope, don't want to gitignore these generally, deployments might want to commit these.

delete empty role files and files for unsupported OSs

1196977

sjpb reviewed Sep 12, 2024

View reviewed changes

Fix home creation

23c79e5

sjpb reviewed Sep 18, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WIP: Active directory roles #431

WIP: Active directory roles #431

jovial commented Sep 4, 2024 •

edited

Loading

jovial Sep 4, 2024

sjpb Sep 11, 2024

sjpb Sep 11, 2024

sjpb Sep 11, 2024

sjpb Sep 12, 2024

sjpb Sep 13, 2024

sjpb Sep 12, 2024

sjpb Sep 12, 2024

sjpb Sep 12, 2024

sjpb Sep 12, 2024

sjpb Sep 12, 2024

sjpb Sep 13, 2024

sjpb Sep 18, 2024

sjpb Sep 18, 2024

sjpb Sep 18, 2024

sjpb Sep 18, 2024

jovial Sep 18, 2024

		openhpc

		[sshd:children]

WIP: Active directory roles #431

Are you sure you want to change the base?

WIP: Active directory roles #431

Conversation

jovial commented Sep 4, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jovial commented Sep 4, 2024 •

edited

Loading