diff --git a/.drone.yml b/.drone.yml index c06a9dd..99bdb86 100644 --- a/.drone.yml +++ b/.drone.yml @@ -15,6 +15,16 @@ steps: - pip install -r requirements.txt - pip install -r dev-requirements.txt - cd ceo_common/krb5 && python krb5_build.py && cd ../.. + # lint - flake8 - # add more! + + # unit + integration tests + - .drone/phosphoric-acid-setup.sh + - pytest -v + +services: + - name: auth1 + image: debian:buster + commands: + - .drone/auth1-setup.sh diff --git a/.drone/auth1-setup.sh b/.drone/auth1-setup.sh new file mode 100755 index 0000000..79721ac --- /dev/null +++ b/.drone/auth1-setup.sh @@ -0,0 +1,83 @@ +#!/bin/bash + +set -ex + +add_fqdn_to_hosts() { + hostname=$1 + ip_addr=$(getent hosts $hostname | cut -d' ' -f1) + sed -E "/${ip_addr}.*\\b${hostname}\\b/d" /etc/hosts > /tmp/hosts + cat /tmp/hosts > /etc/hosts + rm /tmp/hosts + echo "$ip_addr $hostname.csclub.internal $hostname" >> /etc/hosts +} + +# set FQDN in /etc/hosts +add_fqdn_to_hosts auth1 + +export DEBIAN_FRONTEND=noninteractive +apt update +apt install -y psmisc + +# LDAP +apt install -y --no-install-recommends slapd ldap-utils libnss-ldapd sudo-ldap +# `service slapd stop` doesn't seem to work +killall slapd || true +service nslcd stop || true +rm -rf /etc/ldap/slapd.d +rm /var/lib/ldap/* +cp /usr/share/slapd/DB_CONFIG /var/lib/ldap/DB_CONFIG +cp .drone/slapd.conf /etc/ldap/slapd.conf +cp .drone/ldap.conf /etc/ldap/ldap.conf +cp /usr/share/doc/sudo-ldap/schema.OpenLDAP /etc/ldap/schema/sudo.schema +cp .drone/rfc2307bis.schema /etc/ldap/schema/ +cp .drone/csc.schema /etc/ldap/schema/ +chown -R openldap:openldap /etc/ldap/schema/ /var/lib/ldap/ /etc/ldap/ +sleep 0.5 && service slapd start +grep -Eq '^map group member uniqueMember$' /etc/nslcd.conf || \ + echo 'map group member uniqueMember' >> /etc/nslcd.conf +sed -E -i 's/^uri .*$/uri ldap:\/\/auth1.csclub.internal/' /etc/nslcd.conf +sed -E -i 's/^base .*$/base dc=csclub,dc=internal/' /etc/nslcd.conf +cp .drone/nsswitch.conf /etc/nsswitch.conf +service nslcd start +ldapadd -c -f .drone/data.ldif -Y EXTERNAL -H ldapi:/// + +# KERBEROS +apt install -y krb5-admin-server krb5-user libpam-krb5 libsasl2-modules-gssapi-mit sasl2-bin +service krb5-admin-server stop || true +service krb5-kdc stop || true +service saslauthd stop || true +cp .drone/krb5.conf /etc/krb5.conf +cp .drone/kdc.conf /etc/krb5kdc.conf +echo '*/admin *' > /etc/krb5kdc/kadm5.acl +rm -f /var/lib/krb5kdc/* +echo -e 'krb5\nkrb5' | krb5_newrealm +service krb5-kdc start +service krb5-admin-server start +rm -f /etc/krb5.keytab +cat < /usr/lib/sasl2/slapd.conf +mech_list: plain login gssapi external +pwcheck_method: saslauthd +EOF +sed -E -i 's/^START=.*$/START=yes/' /etc/default/saslauthd +sed -E -i 's/^MECHANISMS=.*$/MECHANISMS="kerberos5"/' /etc/default/saslauthd +service saslauthd start +killall slapd && sleep 0.5 && service slapd start + +# sync with phosphoric-acid +apt install -y netcat-openbsd +nc -l 0.0.0.0 9000 diff --git a/.drone/csc.schema b/.drone/csc.schema new file mode 100644 index 0000000..e104398 --- /dev/null +++ b/.drone/csc.schema @@ -0,0 +1,35 @@ +# CSC Member Information Schema + +attributetype ( 1.3.6.1.4.1.27934.1.1.1 NAME 'term' + EQUALITY caseIgnoreIA5Match + SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{5} ) + +attributetype ( 1.3.6.1.4.1.27934.1.1.2 NAME 'program' + EQUALITY caseIgnoreIA5Match + SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{1024} SINGLE-VALUE ) + +attributetype ( 1.3.6.1.4.1.27934.1.1.3 NAME 'studentid' + EQUALITY caseIgnoreIA5Match + SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{8} SINGLE-VALUE ) + +attributetype ( 1.3.6.1.4.1.27934.1.1.4 NAME 'position' + EQUALITY caseIgnoreIA5Match + SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} ) + +attributetype ( 1.3.6.1.4.1.27934.1.1.5 NAME 'nonMemberTerm' + EQUALITY caseIgnoreIA5Match + SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{5} ) + +objectclass ( 1.3.6.1.4.1.27934.1.2.1 NAME 'member' + SUP top AUXILIARY + MUST ( cn $ uid ) + MAY ( studentid $ program $ term $ nonMemberTerm $ description $ position ) ) + +objectclass ( 1.3.6.1.4.1.27934.1.2.2 NAME 'club' + SUP top AUXILIARY + MUST ( cn $ uid ) ) + +objectclass ( 1.3.6.1.4.1.27934.1.2.3 NAME 'group' + SUP top STRUCTURAL + MUST ( cn ) + MAY ( uniqueMember ) ) diff --git a/.drone/data.ldif b/.drone/data.ldif new file mode 100644 index 0000000..8b57ee7 --- /dev/null +++ b/.drone/data.ldif @@ -0,0 +1,125 @@ +dn: dc=csclub,dc=internal +objectClass: top +objectClass: dcObject +objectClass: organization +dc: csclub +o: Computer Science Club + +dn: ou=People,dc=csclub,dc=internal +objectClass: organizationalUnit +ou: People + +dn: ou=Group,dc=csclub,dc=internal +objectClass: organizationalUnit +ou: Group + +dn: ou=SUDOers,dc=csclub,dc=internal +objectClass: top +objectClass: organizationalUnit +ou: SUDOers + +dn: cn=defaults,ou=SUDOers,dc=csclub,dc=internal +objectClass: top +objectClass: sudoRole +cn: defaults +sudoOption: !insults +sudoOption: !lecture +sudoOption: env_reset +sudoOption: listpw=never +sudoOption: shell_noargs +sudoOption: !mail_badpass + +dn: cn=syscom,ou=Group,dc=csclub,dc=internal +objectClass: top +objectClass: group +objectClass: posixGroup +cn: syscom +gidNumber: 10001 +uniqueMember: uid=ctdalek,ou=People,dc=csclub,dc=internal + +dn: cn=%syscom,ou=SUDOers,dc=csclub,dc=internal +objectClass: top +objectClass: sudoRole +cn: %syscom +sudoUser: %syscom +sudoHost: ALL +sudoCommand: ALL +sudoRunAsUser: ALL + +dn: cn=adm,ou=Group,dc=csclub,dc=internal +objectClass: top +objectClass: group +objectClass: posixGroup +gidNumber: 4 +cn: adm +uniqueMember: uid=ctdalek,ou=People,dc=csclub,dc=internal + +dn: cn=office,ou=Group,dc=csclub,dc=internal +objectClass: top +objectClass: group +objectClass: posixGroup +gidNumber: 10003 +cn: office +uniqueMember: uid=ctdalek,ou=People,dc=csclub,dc=internal + +dn: cn=src,ou=Group,dc=csclub,dc=internal +objectClass: top +objectClass: group +objectClass: posixGroup +gidNumber: 40 +cn: src +uniqueMember: uid=ctdalek,ou=People,dc=csclub,dc=internal + +dn: cn=staff,ou=Group,dc=csclub,dc=internal +objectClass: top +objectClass: group +objectClass: posixGroup +gidNumber: 50 +cn: staff +uniqueMember: uid=ctdalek,ou=People,dc=csclub,dc=internal + +dn: uid=ctdalek,ou=People,dc=csclub,dc=internal +cn: Calum Dalek +userPassword: {SASL}ctdalek@CSCLUB.INTERNAL +loginShell: /bin/bash +homeDirectory: /users/ctdalek +uid: ctdalek +uidNumber: 20001 +gidNumber: 20001 +objectClass: top +objectClass: account +objectClass: posixAccount +objectClass: shadowAccount +objectClass: member +program: MAT/Mathematics Computer Science +term: s2021 + +dn: cn=ctdalek,ou=Group,dc=csclub,dc=internal +objectClass: top +objectClass: group +objectClass: posixGroup +cn: ctdalek +gidNumber: 20001 + +dn: uid=regular1,ou=People,dc=csclub,dc=internal +cn: Regular One +userPassword: {SASL}regular1@CSCLUB.INTERNAL +loginShell: /bin/bash +homeDirectory: /users/regular1 +uid: regular1 +uidNumber: 20002 +gidNumber: 20002 +objectClass: top +objectClass: account +objectClass: posixAccount +objectClass: shadowAccount +objectClass: member +program: MAT/Mathematics Computer Science +term: s2021 + +dn: cn=regular1,ou=Group,dc=csclub,dc=internal +objectClass: top +objectClass: group +objectClass: posixGroup +cn: regular1 +gidNumber: 20002 diff --git a/.drone/kdc.conf b/.drone/kdc.conf new file mode 100644 index 0000000..f7f2e25 --- /dev/null +++ b/.drone/kdc.conf @@ -0,0 +1,19 @@ +[kdcdefaults] + kdc_ports = 88 + +[realms] + CSCLUB.INTERNAL = { + database_name = /var/lib/krb5kdc/principal + admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab + acl_file = /etc/krb5kdc/kadm5.acl + key_stash_file = /etc/krb5kdc/stash + kdc_ports = 88 + max_life = 10h 0m 0s + max_renewable_life = 7d 0h 0m 0s + master_key_type = des3-hmac-sha1 + supported_enctypes = aes256-cts:normal arcfour-hmac:normal des3-hmac-sha1:normal des3-cbc-sha1:normal des-cbc-crc:normal des:normal des:v4 des:norealm des:onlyrealm des:afs3 + default_principal_flags = +preauth + iprop_enable = true + iprop_slave_poll = 2m + iprop_port = 750 + } diff --git a/.drone/krb5.conf b/.drone/krb5.conf new file mode 100644 index 0000000..1e93442 --- /dev/null +++ b/.drone/krb5.conf @@ -0,0 +1,27 @@ +[libdefaults] + default_realm = CSCLUB.INTERNAL + + kdc_timesync = 1 + ccache_type = 4 + forwardable = true + proxiable = true + + dns_lookup_kdc = false + dns_lookup_realm = false + + allow_weak_crypto = true + +[realms] + CSCLUB.INTERNAL = { + kdc = auth1.csclub.internal + admin_server = auth1.csclub.internal + } + +[domain_realm] + .csclub.internal = CSCLUB.INTERNAL + csclub.internal = CSCLUB.INTERNAL + +[logging] + kdc = SYSLOG:INFO:AUTH + admin_server = SYSLOG:INFO:AUTH + default = SYSLOG:INFO:AUTH diff --git a/.drone/ldap.conf b/.drone/ldap.conf new file mode 100644 index 0000000..090efb9 --- /dev/null +++ b/.drone/ldap.conf @@ -0,0 +1,3 @@ +BASE dc=csclub,dc=internal +URI ldap://auth1.csclub.internal +SUDOERS_BASE ou=SUDOers,dc=csclub,dc=internal diff --git a/.drone/nsswitch.conf b/.drone/nsswitch.conf new file mode 100644 index 0000000..6f49e62 --- /dev/null +++ b/.drone/nsswitch.conf @@ -0,0 +1,20 @@ +# /etc/nsswitch.conf +# +# Example configuration of GNU Name Service Switch functionality. +# If you have the `glibc-doc-reference' and `info' packages installed, try: +# `info libc "Name Service Switch"' for information about this file. + +passwd: files ldap +group: files ldap +shadow: files ldap + +hosts: files dns +networks: files + +protocols: db files +services: db files +ethers: db files +rpc: db files + +netgroup: nis +sudoers: files ldap diff --git a/.drone/phosphoric-acid-setup.sh b/.drone/phosphoric-acid-setup.sh new file mode 100755 index 0000000..7e10fae --- /dev/null +++ b/.drone/phosphoric-acid-setup.sh @@ -0,0 +1,63 @@ +#!/bin/bash + +set -ex + +add_fqdn_to_hosts() { + hostname=$1 + ip_addr=$(getent hosts $hostname | cut -d' ' -f1) + sed -E "/${ip_addr}.*\\b${hostname}\\b/d" /etc/hosts > /tmp/hosts + cat /tmp/hosts > /etc/hosts + rm /tmp/hosts + echo "$ip_addr $hostname.csclub.internal $hostname" >> /etc/hosts +} + +# set FQDN in /etc/hosts +add_fqdn_to_hosts phosphoric-acid +add_fqdn_to_hosts auth1 + +export DEBIAN_FRONTEND=noninteractive +apt update + +# LDAP +apt install -y --no-install-recommends libnss-ldapd +service nslcd stop || true +cp .drone/ldap.conf /etc/ldap/ldap.conf +grep -Eq '^map group member uniqueMember$' /etc/nslcd.conf || \ + echo 'map group member uniqueMember' >> /etc/nslcd.conf +sed -E -i 's/^uri .*$/uri ldap:\/\/auth1.csclub.internal/' /etc/nslcd.conf +sed -E -i 's/^base .*$/base dc=csclub,dc=internal/' /etc/nslcd.conf +cp .drone/nsswitch.conf /etc/nsswitch.conf + +# KERBEROS +apt install -y krb5-user libpam-krb5 libsasl2-modules-gssapi-mit +cp .drone/krb5.conf /etc/krb5.conf + +# sync with auth1 +apt install -y netcat-openbsd +synced=false +# give it 5 minutes +for i in {1..60}; do + if nc -vz auth1 9000 ; then + synced=true + break + fi + sleep 5 +done +test $synced = true + +rm -f /etc/krb5.keytab +cat <