feat: add amtmann openldap server
This commit is contained in:
parent
ba09656909
commit
e564a04f87
8 changed files with 406 additions and 2 deletions
|
|
@ -29,6 +29,7 @@
|
|||
hosts = {
|
||||
telefonmann = { system = "x86_64-linux"; targetHost = "telefonmann"; };
|
||||
kameramann = { system = "x86_64-linux"; targetHost = "kameramann"; };
|
||||
amtmann = { system = "x86_64-linux"; targetHost = "amtmann"; };
|
||||
};
|
||||
|
||||
systems = nixpkgs.lib.unique (nixpkgs.lib.mapAttrsToList (_: cfg: cfg.system) hosts);
|
||||
|
|
|
|||
10
hosts/amtmann/default.nix
Normal file
10
hosts/amtmann/default.nix
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
{ ... }: {
|
||||
imports = [
|
||||
./hardware.nix
|
||||
./disko.nix
|
||||
./ldap.nix
|
||||
];
|
||||
|
||||
networking.hostName = "amtmann";
|
||||
networking.useDHCP = true;
|
||||
}
|
||||
33
hosts/amtmann/disko.nix
Normal file
33
hosts/amtmann/disko.nix
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
{ ... }: {
|
||||
disko.devices = {
|
||||
disk = {
|
||||
main = {
|
||||
type = "disk";
|
||||
device = "/dev/sda";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
ESP = {
|
||||
size = "512M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [ "umask=0077" ];
|
||||
};
|
||||
};
|
||||
root = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
13
hosts/amtmann/hardware.nix
Normal file
13
hosts/amtmann/hardware.nix
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
{ ... }: {
|
||||
services.qemuGuest.enable = true;
|
||||
boot.loader = {
|
||||
systemd-boot.enable = true;
|
||||
efi.canTouchEfiVariables = true;
|
||||
};
|
||||
boot.initrd.availableKernelModules = [
|
||||
"virtio_pci"
|
||||
"virtio_scsi"
|
||||
"ahci"
|
||||
"sd_mod"
|
||||
];
|
||||
}
|
||||
113
hosts/amtmann/ldap.nix
Normal file
113
hosts/amtmann/ldap.nix
Normal file
|
|
@ -0,0 +1,113 @@
|
|||
{ config, pkgs, ... }:
|
||||
{
|
||||
age.secrets."ldap-root-password" = {
|
||||
file = ../../secrets/ldap-root-password.age;
|
||||
owner = "openldap";
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /var/lib/openldap/data 0700 openldap openldap -"
|
||||
];
|
||||
|
||||
services.openldap = {
|
||||
enable = true;
|
||||
urlList = [ "ldap:///" "ldapi:///" ];
|
||||
|
||||
settings = {
|
||||
attrs = {
|
||||
olcLogLevel = "stats";
|
||||
olcPasswordCryptSaltFormat = "$6$%.8s";
|
||||
olcDisallows = "bind_anon";
|
||||
olcRequires = "authc";
|
||||
olcIdleTimeout = "60";
|
||||
};
|
||||
|
||||
children = {
|
||||
"cn=schema".includes = [
|
||||
"${pkgs.openldap}/etc/schema/core.ldif"
|
||||
"${pkgs.openldap}/etc/schema/cosine.ldif"
|
||||
"${pkgs.openldap}/etc/schema/inetorgperson.ldif"
|
||||
"${pkgs.openldap}/etc/schema/nis.ldif"
|
||||
"${./samba.ldif}"
|
||||
];
|
||||
|
||||
"olcDatabase={-1}frontend" = {
|
||||
attrs = {
|
||||
objectClass = [ "olcDatabaseConfig" "olcFrontendConfig" ];
|
||||
olcDatabase = "{-1}frontend";
|
||||
olcSizeLimit = "unlimited";
|
||||
olcPasswordHash = "{CRYPT}";
|
||||
};
|
||||
};
|
||||
|
||||
# Access only via: ldapmodify -Y EXTERNAL -H ldapi:/// (as root)
|
||||
"olcDatabase={0}config" = {
|
||||
attrs = {
|
||||
objectClass = "olcDatabaseConfig";
|
||||
olcDatabase = "{0}config";
|
||||
olcAccess = [
|
||||
''to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none''
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
"olcDatabase={1}mdb" = {
|
||||
attrs = {
|
||||
objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
|
||||
olcDatabase = "{1}mdb";
|
||||
olcDbDirectory = "/var/lib/openldap/data";
|
||||
olcSuffix = "dc=baubs,dc=net";
|
||||
olcRootDN = "uid=root,cn=users,dc=baubs,dc=net";
|
||||
olcRootPW.path = config.age.secrets."ldap-root-password".path;
|
||||
olcDbIndex = [
|
||||
"objectClass eq"
|
||||
"cn pres,eq,sub"
|
||||
"uid pres,eq,sub"
|
||||
"uidNumber pres,eq"
|
||||
"gidNumber pres,eq"
|
||||
"memberUid eq"
|
||||
"member eq"
|
||||
"sambaDomainName eq"
|
||||
"sambaSID eq"
|
||||
"entryCSN eq"
|
||||
"entryUUID eq"
|
||||
];
|
||||
olcAccess = [
|
||||
''to dn.base="" by * read''
|
||||
''to dn.base="cn=Subschema" by * read''
|
||||
''to attrs=userPassword by self write by set="[cn=Directory Operators,cn=groups,dc=baubs,dc=net]/member* & user" =w by set="[cn=Directory Consumers,cn=groups,dc=baubs,dc=net]/member* & user" read by anonymous auth''
|
||||
''to attrs=sambaLMPassword,sambaNTPassword by self write by set="[cn=Directory Operators,cn=groups,dc=baubs,dc=net]/member* & user" write by set="[cn=Directory Consumers,cn=groups,dc=baubs,dc=net]/member* & user" read by set="[cn=Directory Clients,cn=groups,dc=baubs,dc=net]/member* & user" read''
|
||||
''to attrs=shadowLastChange,sambaPwdLastSet by self write by set="[cn=Directory Operators,cn=groups,dc=baubs,dc=net]/member* & user" write by users read''
|
||||
''to attrs=homeDirectory,uid,cn,uidNumber,gidNumber by set="[cn=Directory Operators,cn=groups,dc=baubs,dc=net]/member* & user" write by * read''
|
||||
''to attrs=gecos,@inetOrgPerson by self write by set="[cn=Directory Operators,cn=groups,dc=baubs,dc=net]/member* & user" write by * read''
|
||||
''to * by set="[cn=Directory Operators,cn=groups,dc=baubs,dc=net]/member* & user" write by * read''
|
||||
];
|
||||
};
|
||||
|
||||
children = {
|
||||
"olcOverlay={0}memberof" = {
|
||||
attrs = {
|
||||
objectClass = [ "olcOverlayConfig" "olcMemberOf" ];
|
||||
olcOverlay = "{0}memberof";
|
||||
olcMemberOfDangling = "ignore";
|
||||
olcMemberOfRefInt = "FALSE";
|
||||
olcMemberOfGroupOC = "posixGroup";
|
||||
};
|
||||
};
|
||||
"olcOverlay={1}ppolicy" = {
|
||||
attrs = {
|
||||
objectClass = [ "olcOverlayConfig" "olcPPolicyConfig" ];
|
||||
olcOverlay = "{1}ppolicy";
|
||||
olcPPolicyDefault = "cn=default,ou=pwpolicies,dc=baubs,dc=net";
|
||||
olcPPolicyHashCleartext = "FALSE";
|
||||
olcPPolicyUseLockout = "FALSE";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 389 636 ];
|
||||
}
|
||||
224
hosts/amtmann/samba.ldif
Normal file
224
hosts/amtmann/samba.ldif
Normal file
|
|
@ -0,0 +1,224 @@
|
|||
dn: cn=samba,cn=schema,cn=config
|
||||
objectClass: olcSchemaConfig
|
||||
cn: samba
|
||||
olcAttributeTypes: {0}( 1.3.6.1.4.1.7165.2.1.24 NAME 'sambaLMPassword' DESC 'L
|
||||
anManager Password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.1
|
||||
21.1.26{32} SINGLE-VALUE )
|
||||
olcAttributeTypes: {1}( 1.3.6.1.4.1.7165.2.1.25 NAME 'sambaNTPassword' DESC 'M
|
||||
D4 hash of the unicode password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4
|
||||
.1.1466.115.121.1.26{32} SINGLE-VALUE )
|
||||
olcAttributeTypes: {2}( 1.3.6.1.4.1.7165.2.1.26 NAME 'sambaAcctFlags' DESC 'Ac
|
||||
count Flags' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
|
||||
{16} SINGLE-VALUE )
|
||||
olcAttributeTypes: {3}( 1.3.6.1.4.1.7165.2.1.27 NAME 'sambaPwdLastSet' DESC 'T
|
||||
imestamp of the last password update' EQUALITY integerMatch SYNTAX 1.3.6.1.4.
|
||||
1.1466.115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {4}( 1.3.6.1.4.1.7165.2.1.28 NAME 'sambaPwdCanChange' DESC
|
||||
'Timestamp of when the user is allowed to update the password' EQUALITY integ
|
||||
erMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {5}( 1.3.6.1.4.1.7165.2.1.29 NAME 'sambaPwdMustChange' DESC
|
||||
'Timestamp of when the password will expire' EQUALITY integerMatch SYNTAX 1.
|
||||
3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {6}( 1.3.6.1.4.1.7165.2.1.30 NAME 'sambaLogonTime' DESC 'Ti
|
||||
mestamp of last logon' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
|
||||
1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {7}( 1.3.6.1.4.1.7165.2.1.31 NAME 'sambaLogoffTime' DESC 'T
|
||||
imestamp of last logoff' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.12
|
||||
1.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {8}( 1.3.6.1.4.1.7165.2.1.32 NAME 'sambaKickoffTime' DESC '
|
||||
Timestamp of when the user will be logged off automatically' EQUALITY integer
|
||||
Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {9}( 1.3.6.1.4.1.7165.2.1.48 NAME 'sambaBadPasswordCount' D
|
||||
ESC 'Bad password attempt count' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.146
|
||||
6.115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {10}( 1.3.6.1.4.1.7165.2.1.49 NAME 'sambaBadPasswordTime' D
|
||||
ESC 'Time of the last bad password attempt' EQUALITY integerMatch SYNTAX 1.3.
|
||||
6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {11}( 1.3.6.1.4.1.7165.2.1.55 NAME 'sambaLogonHours' DESC '
|
||||
Logon Hours' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
|
||||
{42} SINGLE-VALUE )
|
||||
olcAttributeTypes: {12}( 1.3.6.1.4.1.7165.2.1.33 NAME 'sambaHomeDrive' DESC 'D
|
||||
river letter of home directory mapping' EQUALITY caseIgnoreIA5Match SYNTAX 1.
|
||||
3.6.1.4.1.1466.115.121.1.26{4} SINGLE-VALUE )
|
||||
olcAttributeTypes: {13}( 1.3.6.1.4.1.7165.2.1.34 NAME 'sambaLogonScript' DESC
|
||||
'Logon script path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
|
||||
1.15{255} SINGLE-VALUE )
|
||||
olcAttributeTypes: {14}( 1.3.6.1.4.1.7165.2.1.35 NAME 'sambaProfilePath' DESC
|
||||
'Roaming profile path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.1
|
||||
21.1.15{255} SINGLE-VALUE )
|
||||
olcAttributeTypes: {15}( 1.3.6.1.4.1.7165.2.1.36 NAME 'sambaUserWorkstations'
|
||||
DESC 'List of user workstations the user is allowed to logon to' EQUALITY cas
|
||||
eIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE )
|
||||
olcAttributeTypes: {16}( 1.3.6.1.4.1.7165.2.1.37 NAME 'sambaHomePath' DESC 'Ho
|
||||
me directory UNC path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.1
|
||||
21.1.15{128} )
|
||||
olcAttributeTypes: {17}( 1.3.6.1.4.1.7165.2.1.38 NAME 'sambaDomainName' DESC '
|
||||
Windows NT domain to which the user belongs' EQUALITY caseIgnoreMatch SYNTAX
|
||||
1.3.6.1.4.1.1466.115.121.1.15{128} )
|
||||
olcAttributeTypes: {18}( 1.3.6.1.4.1.7165.2.1.47 NAME 'sambaMungedDial' DESC '
|
||||
Base64 encoded user parameter string' EQUALITY caseExactMatch SYNTAX 1.3.6.1.
|
||||
4.1.1466.115.121.1.15{1050} )
|
||||
olcAttributeTypes: {19}( 1.3.6.1.4.1.7165.2.1.54 NAME 'sambaPasswordHistory' D
|
||||
ESC 'Concatenated MD5 hashes of the salted NT passwords used on this account'
|
||||
EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} )
|
||||
olcAttributeTypes: {20}( 1.3.6.1.4.1.7165.2.1.20 NAME 'sambaSID' DESC 'Securit
|
||||
y ID' EQUALITY caseIgnoreIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1
|
||||
.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE )
|
||||
olcAttributeTypes: {21}( 1.3.6.1.4.1.7165.2.1.23 NAME 'sambaPrimaryGroupSID' D
|
||||
ESC 'Primary Group Security ID' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.
|
||||
1.1466.115.121.1.26{64} SINGLE-VALUE )
|
||||
olcAttributeTypes: {22}( 1.3.6.1.4.1.7165.2.1.51 NAME 'sambaSIDList' DESC 'Sec
|
||||
urity ID List' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.
|
||||
26{64} )
|
||||
olcAttributeTypes: {23}( 1.3.6.1.4.1.7165.2.1.19 NAME 'sambaGroupType' DESC 'N
|
||||
T Group Type' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SING
|
||||
LE-VALUE )
|
||||
olcAttributeTypes: {24}( 1.3.6.1.4.1.7165.2.1.21 NAME 'sambaNextUserRid' DESC
|
||||
'Next NT rid to give our for users' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.
|
||||
1466.115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {25}( 1.3.6.1.4.1.7165.2.1.22 NAME 'sambaNextGroupRid' DESC
|
||||
'Next NT rid to give out for groups' EQUALITY integerMatch SYNTAX 1.3.6.1.4.
|
||||
1.1466.115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {26}( 1.3.6.1.4.1.7165.2.1.39 NAME 'sambaNextRid' DESC 'Nex
|
||||
t NT rid to give out for anything' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1
|
||||
466.115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {27}( 1.3.6.1.4.1.7165.2.1.40 NAME 'sambaAlgorithmicRidBase
|
||||
' DESC 'Base at which the samba RID generation algorithm should operate' EQUA
|
||||
LITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {28}( 1.3.6.1.4.1.7165.2.1.41 NAME 'sambaShareName' DESC 'S
|
||||
hare Name' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SING
|
||||
LE-VALUE )
|
||||
olcAttributeTypes: {29}( 1.3.6.1.4.1.7165.2.1.42 NAME 'sambaOptionName' DESC '
|
||||
Option Name' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX
|
||||
1.3.6.1.4.1.1466.115.121.1.15{256} )
|
||||
olcAttributeTypes: {30}( 1.3.6.1.4.1.7165.2.1.43 NAME 'sambaBoolOption' DESC '
|
||||
A boolean option' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 S
|
||||
INGLE-VALUE )
|
||||
olcAttributeTypes: {31}( 1.3.6.1.4.1.7165.2.1.44 NAME 'sambaIntegerOption' DES
|
||||
C 'An integer option' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
|
||||
.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {32}( 1.3.6.1.4.1.7165.2.1.45 NAME 'sambaStringOption' DESC
|
||||
'A string option' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121
|
||||
.1.26 SINGLE-VALUE )
|
||||
olcAttributeTypes: {33}( 1.3.6.1.4.1.7165.2.1.46 NAME 'sambaStringListOption'
|
||||
DESC 'A string list option' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.
|
||||
115.121.1.15 )
|
||||
olcAttributeTypes: {34}( 1.3.6.1.4.1.7165.2.1.53 NAME 'sambaTrustFlags' DESC '
|
||||
Trust Password Flags' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115
|
||||
.121.1.26 )
|
||||
olcAttributeTypes: {35}( 1.3.6.1.4.1.7165.2.1.58 NAME 'sambaMinPwdLength' DESC
|
||||
'Minimal password length (default: 5)' EQUALITY integerMatch SYNTAX 1.3.6.1.
|
||||
4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {36}( 1.3.6.1.4.1.7165.2.1.59 NAME 'sambaPwdHistoryLength'
|
||||
DESC 'Length of Password History Entries (default: 0 => off)' EQUALITY intege
|
||||
rMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {37}( 1.3.6.1.4.1.7165.2.1.60 NAME 'sambaLogonToChgPwd' DES
|
||||
C 'Force Users to logon for password change (default: 0 => off, 2 => on)' EQU
|
||||
ALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {38}( 1.3.6.1.4.1.7165.2.1.61 NAME 'sambaMaxPwdAge' DESC 'M
|
||||
aximum password age, in seconds (default: -1 => never expire passwords)' EQUA
|
||||
LITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {39}( 1.3.6.1.4.1.7165.2.1.62 NAME 'sambaMinPwdAge' DESC 'M
|
||||
inimum password age, in seconds (default: 0 => allow immediate password chang
|
||||
e)' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {40}( 1.3.6.1.4.1.7165.2.1.63 NAME 'sambaLockoutDuration' D
|
||||
ESC 'Lockout duration in minutes (default: 30, -1 => forever)' EQUALITY integ
|
||||
erMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {41}( 1.3.6.1.4.1.7165.2.1.64 NAME 'sambaLockoutObservation
|
||||
Window' DESC 'Reset time after lockout in minutes (default: 30)' EQUALITY int
|
||||
egerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {42}( 1.3.6.1.4.1.7165.2.1.65 NAME 'sambaLockoutThreshold'
|
||||
DESC 'Lockout users after bad logon attempts (default: 0 => off)' EQUALITY in
|
||||
tegerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {43}( 1.3.6.1.4.1.7165.2.1.66 NAME 'sambaForceLogoff' DESC
|
||||
'Disconnect Users outside logon hours (default: -1 => off, 0 => on)' EQUALITY
|
||||
integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {44}( 1.3.6.1.4.1.7165.2.1.67 NAME 'sambaRefuseMachinePwdCh
|
||||
ange' DESC 'Allow Machine Password changes (default: 0 => off)' EQUALITY inte
|
||||
gerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {45}( 1.3.6.1.4.1.7165.2.1.68 NAME 'sambaClearTextPassword'
|
||||
DESC 'Clear text password (used for trusted domain passwords)' EQUALITY octe
|
||||
tStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
|
||||
olcAttributeTypes: {46}( 1.3.6.1.4.1.7165.2.1.69 NAME 'sambaPreviousClearTextP
|
||||
assword' DESC 'Previous clear text password (used for trusted domain password
|
||||
s)' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
|
||||
olcAttributeTypes: {47}( 1.3.6.1.4.1.7165.2.1.70 NAME 'sambaTrustType' DESC 'T
|
||||
ype of trust' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SING
|
||||
LE-VALUE )
|
||||
olcAttributeTypes: {48}( 1.3.6.1.4.1.7165.2.1.71 NAME 'sambaTrustAttributes' D
|
||||
ESC 'Trust attributes for a trusted domain' EQUALITY integerMatch SYNTAX 1.3.
|
||||
6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {49}( 1.3.6.1.4.1.7165.2.1.72 NAME 'sambaTrustDirection' DE
|
||||
SC 'Direction of a trust' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.1
|
||||
21.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {50}( 1.3.6.1.4.1.7165.2.1.73 NAME 'sambaTrustPartner' DESC
|
||||
'Fully qualified name of the domain with which a trust exists' EQUALITY case
|
||||
IgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )
|
||||
olcAttributeTypes: {51}( 1.3.6.1.4.1.7165.2.1.74 NAME 'sambaFlatName' DESC 'Ne
|
||||
tBIOS name of a domain' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.
|
||||
121.1.15{128} )
|
||||
olcAttributeTypes: {52}( 1.3.6.1.4.1.7165.2.1.75 NAME 'sambaTrustAuthOutgoing'
|
||||
DESC 'Authentication information for the outgoing portion of a trust' EQUALIT
|
||||
Y caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} )
|
||||
olcAttributeTypes: {53}( 1.3.6.1.4.1.7165.2.1.76 NAME 'sambaTrustAuthIncoming'
|
||||
DESC 'Authentication information for the incoming portion of a trust' EQUALIT
|
||||
Y caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} )
|
||||
olcAttributeTypes: {54}( 1.3.6.1.4.1.7165.2.1.77 NAME 'sambaSecurityIdentifier
|
||||
' DESC 'SID of a trusted domain' EQUALITY caseIgnoreIA5Match SUBSTR caseExact
|
||||
IA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE )
|
||||
olcAttributeTypes: {55}( 1.3.6.1.4.1.7165.2.1.78 NAME 'sambaTrustForestTrustIn
|
||||
fo' DESC 'Forest trust information for a trusted domain object' EQUALITY case
|
||||
ExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} )
|
||||
olcAttributeTypes: {56}( 1.3.6.1.4.1.7165.2.1.79 NAME 'sambaTrustPosixOffset'
|
||||
DESC 'POSIX offset of a trust' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.
|
||||
115.121.1.27 SINGLE-VALUE )
|
||||
olcAttributeTypes: {57}( 1.3.6.1.4.1.7165.2.1.80 NAME 'sambaSupportedEncryptio
|
||||
nTypes' DESC 'Supported encryption types of a trust' EQUALITY integerMatch SY
|
||||
NTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||
olcObjectClasses: {0}( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' DESC 'Sam
|
||||
ba 3.0 Auxilary SAM Account' SUP top AUXILIARY MUST ( uid $ sambaSID ) MAY (
|
||||
cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $ sambaLogonTime $ s
|
||||
ambaLogoffTime $ sambaKickoffTime $ sambaPwdCanChange $ sambaPwdMustChange $
|
||||
sambaAcctFlags $ displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogonScr
|
||||
ipt $ sambaProfilePath $ description $ sambaUserWorkstations $ sambaPrimaryGr
|
||||
oupSID $ sambaDomainName $ sambaMungedDial $ sambaBadPasswordCount $ sambaBad
|
||||
PasswordTime $ sambaPasswordHistory $ sambaLogonHours ) )
|
||||
olcObjectClasses: {1}( 1.3.6.1.4.1.7165.2.2.4 NAME 'sambaGroupMapping' DESC 'S
|
||||
amba Group Mapping' SUP top AUXILIARY MUST ( gidNumber $ sambaSID $ sambaGrou
|
||||
pType ) MAY ( displayName $ description $ sambaSIDList ) )
|
||||
olcObjectClasses: {2}( 1.3.6.1.4.1.7165.2.2.14 NAME 'sambaTrustPassword' DESC
|
||||
'Samba Trust Password' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaNTPas
|
||||
sword $ sambaTrustFlags ) MAY ( sambaSID $ sambaPwdLastSet ) )
|
||||
olcObjectClasses: {3}( 1.3.6.1.4.1.7165.2.2.15 NAME 'sambaTrustedDomainPasswor
|
||||
d' DESC 'Samba Trusted Domain Password' SUP top STRUCTURAL MUST ( sambaDomain
|
||||
Name $ sambaSID $ sambaClearTextPassword $ sambaPwdLastSet ) MAY sambaPreviou
|
||||
sClearTextPassword )
|
||||
olcObjectClasses: {4}( 1.3.6.1.4.1.7165.2.2.5 NAME 'sambaDomain' DESC 'Samba D
|
||||
omain Information' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaSID ) MAY
|
||||
( sambaNextRid $ sambaNextGroupRid $ sambaNextUserRid $ sambaAlgorithmicRidB
|
||||
ase $ sambaMinPwdLength $ sambaPwdHistoryLength $ sambaLogonToChgPwd $ sambaM
|
||||
axPwdAge $ sambaMinPwdAge $ sambaLockoutDuration $ sambaLockoutObservationWin
|
||||
dow $ sambaLockoutThreshold $ sambaForceLogoff $ sambaRefuseMachinePwdChange
|
||||
) )
|
||||
olcObjectClasses: {5}( 1.3.6.1.4.1.7165.2.2.7 NAME 'sambaUnixIdPool' DESC 'Poo
|
||||
l for allocating UNIX uids/gids' SUP top AUXILIARY MUST ( uidNumber $ gidNumb
|
||||
er ) )
|
||||
olcObjectClasses: {6}( 1.3.6.1.4.1.7165.2.2.8 NAME 'sambaIdmapEntry' DESC 'Map
|
||||
ping from a SID to an ID' SUP top AUXILIARY MUST sambaSID MAY ( uidNumber $ g
|
||||
idNumber ) )
|
||||
olcObjectClasses: {7}( 1.3.6.1.4.1.7165.2.2.9 NAME 'sambaSidEntry' DESC 'Struc
|
||||
tural Class for a SID' SUP top STRUCTURAL MUST sambaSID )
|
||||
olcObjectClasses: {8}( 1.3.6.1.4.1.7165.2.2.10 NAME 'sambaConfig' DESC 'Samba
|
||||
Configuration Section' SUP top AUXILIARY MAY description )
|
||||
olcObjectClasses: {9}( 1.3.6.1.4.1.7165.2.2.11 NAME 'sambaShare' DESC 'Samba S
|
||||
hare Section' SUP top STRUCTURAL MUST sambaShareName MAY description )
|
||||
olcObjectClasses: {10}( 1.3.6.1.4.1.7165.2.2.12 NAME 'sambaConfigOption' DESC
|
||||
'Samba Configuration Option' SUP top STRUCTURAL MUST sambaOptionName MAY ( sa
|
||||
mbaBoolOption $ sambaIntegerOption $ sambaStringOption $ sambaStringListoptio
|
||||
n $ description ) )
|
||||
olcObjectClasses: {11}( 1.3.6.1.4.1.7165.2.2.16 NAME 'sambaTrustedDomain' DESC
|
||||
'Samba Trusted Domain Object' SUP top STRUCTURAL MUST cn MAY ( sambaTrustTyp
|
||||
e $ sambaTrustAttributes $ sambaTrustDirection $ sambaTrustPartner $ sambaFla
|
||||
tName $ sambaTrustAuthOutgoing $ sambaTrustAuthIncoming $ sambaSecurityIdenti
|
||||
fier $ sambaTrustForestTrustInfo $ sambaTrustPosixOffset $ sambaSupportedEncr
|
||||
yptionTypes) )
|
||||
8
secrets/ldap-root-password.age
Normal file
8
secrets/ldap-root-password.age
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 hC2TMg gmMUVd7GPIDYI6XJq+fCc/T0KjcXjPWcwREwPJATmRs
|
||||
XxVKVWuyCWdYJQmX3bmkex2Y0dbZ0WMfQmNh3jbcZ6Y
|
||||
-> ssh-ed25519 sI4HYw LZGzvLfAZuBq8rjJdwV+9AHxjOv/cw826hBanOtqqAI
|
||||
/d7W7tf60xJEMfFIYQErw5huMV4oiOrWroSzRxg3ibQ
|
||||
--- ms1br4YLjcCJG3wH5iVfRZSJk2fO1/kepZtwIHtueO0
|
||||
œŠ•Þ½’}ºŸÆÐ4°½cÛ€ÑȨÔ2?ïÅ&1þ—üHQÈ(»fÿéYYU³
|
||||
eõ<EFBFBD>ýô®Â¾ÖÓÍoØ-–4zî€7Ür
|
||||
|
|
@ -3,8 +3,9 @@ let
|
|||
users = [ jbruhn ];
|
||||
|
||||
telefonmann = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEwgqWVjNOgBygI1uaG8P6wQlfr91A+FJS/EHYZbYWlX";
|
||||
kameramann = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEfgDpNz95SbbBHYM8zSGCh1pyb/2quR6Oy8xyWFkl0n";
|
||||
systems = [ telefonmann kameramann ];
|
||||
kameramann = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEfgDpNz95SbbBHYM8zSGCh1pyb/2quR6Oy8xyWFkl0n";
|
||||
amtmann = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM85WwE8w9TaFpuYLy8GioqecCDEC+Ob25ecTT+aMVI8";
|
||||
systems = [ telefonmann kameramann amtmann ];
|
||||
in
|
||||
{
|
||||
"voip-trunk-ewe-host.age".publicKeys = users ++ [ telefonmann ];
|
||||
|
|
@ -25,4 +26,5 @@ in
|
|||
"camera-taubis-sub-url.age".publicKeys = users ++ [ kameramann ];
|
||||
"camera-foeff-url.age".publicKeys = users ++ [ kameramann ];
|
||||
"camera-foeff-sub-url.age".publicKeys = users ++ [ kameramann ];
|
||||
"ldap-root-password.age".publicKeys = users ++ [ amtmann ]; #slappasswd -s 'yourpassword'
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue