feat: add amtmann openldap server
This commit is contained in:
parent
ba09656909
commit
e564a04f87
8 changed files with 406 additions and 2 deletions
|
|
@ -29,6 +29,7 @@
|
||||||
hosts = {
|
hosts = {
|
||||||
telefonmann = { system = "x86_64-linux"; targetHost = "telefonmann"; };
|
telefonmann = { system = "x86_64-linux"; targetHost = "telefonmann"; };
|
||||||
kameramann = { system = "x86_64-linux"; targetHost = "kameramann"; };
|
kameramann = { system = "x86_64-linux"; targetHost = "kameramann"; };
|
||||||
|
amtmann = { system = "x86_64-linux"; targetHost = "amtmann"; };
|
||||||
};
|
};
|
||||||
|
|
||||||
systems = nixpkgs.lib.unique (nixpkgs.lib.mapAttrsToList (_: cfg: cfg.system) hosts);
|
systems = nixpkgs.lib.unique (nixpkgs.lib.mapAttrsToList (_: cfg: cfg.system) hosts);
|
||||||
|
|
|
||||||
10
hosts/amtmann/default.nix
Normal file
10
hosts/amtmann/default.nix
Normal file
|
|
@ -0,0 +1,10 @@
|
||||||
|
{ ... }: {
|
||||||
|
imports = [
|
||||||
|
./hardware.nix
|
||||||
|
./disko.nix
|
||||||
|
./ldap.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
networking.hostName = "amtmann";
|
||||||
|
networking.useDHCP = true;
|
||||||
|
}
|
||||||
33
hosts/amtmann/disko.nix
Normal file
33
hosts/amtmann/disko.nix
Normal file
|
|
@ -0,0 +1,33 @@
|
||||||
|
{ ... }: {
|
||||||
|
disko.devices = {
|
||||||
|
disk = {
|
||||||
|
main = {
|
||||||
|
type = "disk";
|
||||||
|
device = "/dev/sda";
|
||||||
|
content = {
|
||||||
|
type = "gpt";
|
||||||
|
partitions = {
|
||||||
|
ESP = {
|
||||||
|
size = "512M";
|
||||||
|
type = "EF00";
|
||||||
|
content = {
|
||||||
|
type = "filesystem";
|
||||||
|
format = "vfat";
|
||||||
|
mountpoint = "/boot";
|
||||||
|
mountOptions = [ "umask=0077" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
root = {
|
||||||
|
size = "100%";
|
||||||
|
content = {
|
||||||
|
type = "filesystem";
|
||||||
|
format = "ext4";
|
||||||
|
mountpoint = "/";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
13
hosts/amtmann/hardware.nix
Normal file
13
hosts/amtmann/hardware.nix
Normal file
|
|
@ -0,0 +1,13 @@
|
||||||
|
{ ... }: {
|
||||||
|
services.qemuGuest.enable = true;
|
||||||
|
boot.loader = {
|
||||||
|
systemd-boot.enable = true;
|
||||||
|
efi.canTouchEfiVariables = true;
|
||||||
|
};
|
||||||
|
boot.initrd.availableKernelModules = [
|
||||||
|
"virtio_pci"
|
||||||
|
"virtio_scsi"
|
||||||
|
"ahci"
|
||||||
|
"sd_mod"
|
||||||
|
];
|
||||||
|
}
|
||||||
113
hosts/amtmann/ldap.nix
Normal file
113
hosts/amtmann/ldap.nix
Normal file
|
|
@ -0,0 +1,113 @@
|
||||||
|
{ config, pkgs, ... }:
|
||||||
|
{
|
||||||
|
age.secrets."ldap-root-password" = {
|
||||||
|
file = ../../secrets/ldap-root-password.age;
|
||||||
|
owner = "openldap";
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.tmpfiles.rules = [
|
||||||
|
"d /var/lib/openldap/data 0700 openldap openldap -"
|
||||||
|
];
|
||||||
|
|
||||||
|
services.openldap = {
|
||||||
|
enable = true;
|
||||||
|
urlList = [ "ldap:///" "ldapi:///" ];
|
||||||
|
|
||||||
|
settings = {
|
||||||
|
attrs = {
|
||||||
|
olcLogLevel = "stats";
|
||||||
|
olcPasswordCryptSaltFormat = "$6$%.8s";
|
||||||
|
olcDisallows = "bind_anon";
|
||||||
|
olcRequires = "authc";
|
||||||
|
olcIdleTimeout = "60";
|
||||||
|
};
|
||||||
|
|
||||||
|
children = {
|
||||||
|
"cn=schema".includes = [
|
||||||
|
"${pkgs.openldap}/etc/schema/core.ldif"
|
||||||
|
"${pkgs.openldap}/etc/schema/cosine.ldif"
|
||||||
|
"${pkgs.openldap}/etc/schema/inetorgperson.ldif"
|
||||||
|
"${pkgs.openldap}/etc/schema/nis.ldif"
|
||||||
|
"${./samba.ldif}"
|
||||||
|
];
|
||||||
|
|
||||||
|
"olcDatabase={-1}frontend" = {
|
||||||
|
attrs = {
|
||||||
|
objectClass = [ "olcDatabaseConfig" "olcFrontendConfig" ];
|
||||||
|
olcDatabase = "{-1}frontend";
|
||||||
|
olcSizeLimit = "unlimited";
|
||||||
|
olcPasswordHash = "{CRYPT}";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# Access only via: ldapmodify -Y EXTERNAL -H ldapi:/// (as root)
|
||||||
|
"olcDatabase={0}config" = {
|
||||||
|
attrs = {
|
||||||
|
objectClass = "olcDatabaseConfig";
|
||||||
|
olcDatabase = "{0}config";
|
||||||
|
olcAccess = [
|
||||||
|
''to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none''
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
"olcDatabase={1}mdb" = {
|
||||||
|
attrs = {
|
||||||
|
objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
|
||||||
|
olcDatabase = "{1}mdb";
|
||||||
|
olcDbDirectory = "/var/lib/openldap/data";
|
||||||
|
olcSuffix = "dc=baubs,dc=net";
|
||||||
|
olcRootDN = "uid=root,cn=users,dc=baubs,dc=net";
|
||||||
|
olcRootPW.path = config.age.secrets."ldap-root-password".path;
|
||||||
|
olcDbIndex = [
|
||||||
|
"objectClass eq"
|
||||||
|
"cn pres,eq,sub"
|
||||||
|
"uid pres,eq,sub"
|
||||||
|
"uidNumber pres,eq"
|
||||||
|
"gidNumber pres,eq"
|
||||||
|
"memberUid eq"
|
||||||
|
"member eq"
|
||||||
|
"sambaDomainName eq"
|
||||||
|
"sambaSID eq"
|
||||||
|
"entryCSN eq"
|
||||||
|
"entryUUID eq"
|
||||||
|
];
|
||||||
|
olcAccess = [
|
||||||
|
''to dn.base="" by * read''
|
||||||
|
''to dn.base="cn=Subschema" by * read''
|
||||||
|
''to attrs=userPassword by self write by set="[cn=Directory Operators,cn=groups,dc=baubs,dc=net]/member* & user" =w by set="[cn=Directory Consumers,cn=groups,dc=baubs,dc=net]/member* & user" read by anonymous auth''
|
||||||
|
''to attrs=sambaLMPassword,sambaNTPassword by self write by set="[cn=Directory Operators,cn=groups,dc=baubs,dc=net]/member* & user" write by set="[cn=Directory Consumers,cn=groups,dc=baubs,dc=net]/member* & user" read by set="[cn=Directory Clients,cn=groups,dc=baubs,dc=net]/member* & user" read''
|
||||||
|
''to attrs=shadowLastChange,sambaPwdLastSet by self write by set="[cn=Directory Operators,cn=groups,dc=baubs,dc=net]/member* & user" write by users read''
|
||||||
|
''to attrs=homeDirectory,uid,cn,uidNumber,gidNumber by set="[cn=Directory Operators,cn=groups,dc=baubs,dc=net]/member* & user" write by * read''
|
||||||
|
''to attrs=gecos,@inetOrgPerson by self write by set="[cn=Directory Operators,cn=groups,dc=baubs,dc=net]/member* & user" write by * read''
|
||||||
|
''to * by set="[cn=Directory Operators,cn=groups,dc=baubs,dc=net]/member* & user" write by * read''
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
children = {
|
||||||
|
"olcOverlay={0}memberof" = {
|
||||||
|
attrs = {
|
||||||
|
objectClass = [ "olcOverlayConfig" "olcMemberOf" ];
|
||||||
|
olcOverlay = "{0}memberof";
|
||||||
|
olcMemberOfDangling = "ignore";
|
||||||
|
olcMemberOfRefInt = "FALSE";
|
||||||
|
olcMemberOfGroupOC = "posixGroup";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
"olcOverlay={1}ppolicy" = {
|
||||||
|
attrs = {
|
||||||
|
objectClass = [ "olcOverlayConfig" "olcPPolicyConfig" ];
|
||||||
|
olcOverlay = "{1}ppolicy";
|
||||||
|
olcPPolicyDefault = "cn=default,ou=pwpolicies,dc=baubs,dc=net";
|
||||||
|
olcPPolicyHashCleartext = "FALSE";
|
||||||
|
olcPPolicyUseLockout = "FALSE";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.firewall.allowedTCPPorts = [ 389 636 ];
|
||||||
|
}
|
||||||
224
hosts/amtmann/samba.ldif
Normal file
224
hosts/amtmann/samba.ldif
Normal file
|
|
@ -0,0 +1,224 @@
|
||||||
|
dn: cn=samba,cn=schema,cn=config
|
||||||
|
objectClass: olcSchemaConfig
|
||||||
|
cn: samba
|
||||||
|
olcAttributeTypes: {0}( 1.3.6.1.4.1.7165.2.1.24 NAME 'sambaLMPassword' DESC 'L
|
||||||
|
anManager Password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.1
|
||||||
|
21.1.26{32} SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {1}( 1.3.6.1.4.1.7165.2.1.25 NAME 'sambaNTPassword' DESC 'M
|
||||||
|
D4 hash of the unicode password' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4
|
||||||
|
.1.1466.115.121.1.26{32} SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {2}( 1.3.6.1.4.1.7165.2.1.26 NAME 'sambaAcctFlags' DESC 'Ac
|
||||||
|
count Flags' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
|
||||||
|
{16} SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {3}( 1.3.6.1.4.1.7165.2.1.27 NAME 'sambaPwdLastSet' DESC 'T
|
||||||
|
imestamp of the last password update' EQUALITY integerMatch SYNTAX 1.3.6.1.4.
|
||||||
|
1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {4}( 1.3.6.1.4.1.7165.2.1.28 NAME 'sambaPwdCanChange' DESC
|
||||||
|
'Timestamp of when the user is allowed to update the password' EQUALITY integ
|
||||||
|
erMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {5}( 1.3.6.1.4.1.7165.2.1.29 NAME 'sambaPwdMustChange' DESC
|
||||||
|
'Timestamp of when the password will expire' EQUALITY integerMatch SYNTAX 1.
|
||||||
|
3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {6}( 1.3.6.1.4.1.7165.2.1.30 NAME 'sambaLogonTime' DESC 'Ti
|
||||||
|
mestamp of last logon' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
|
||||||
|
1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {7}( 1.3.6.1.4.1.7165.2.1.31 NAME 'sambaLogoffTime' DESC 'T
|
||||||
|
imestamp of last logoff' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.12
|
||||||
|
1.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {8}( 1.3.6.1.4.1.7165.2.1.32 NAME 'sambaKickoffTime' DESC '
|
||||||
|
Timestamp of when the user will be logged off automatically' EQUALITY integer
|
||||||
|
Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {9}( 1.3.6.1.4.1.7165.2.1.48 NAME 'sambaBadPasswordCount' D
|
||||||
|
ESC 'Bad password attempt count' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.146
|
||||||
|
6.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {10}( 1.3.6.1.4.1.7165.2.1.49 NAME 'sambaBadPasswordTime' D
|
||||||
|
ESC 'Time of the last bad password attempt' EQUALITY integerMatch SYNTAX 1.3.
|
||||||
|
6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {11}( 1.3.6.1.4.1.7165.2.1.55 NAME 'sambaLogonHours' DESC '
|
||||||
|
Logon Hours' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
|
||||||
|
{42} SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {12}( 1.3.6.1.4.1.7165.2.1.33 NAME 'sambaHomeDrive' DESC 'D
|
||||||
|
river letter of home directory mapping' EQUALITY caseIgnoreIA5Match SYNTAX 1.
|
||||||
|
3.6.1.4.1.1466.115.121.1.26{4} SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {13}( 1.3.6.1.4.1.7165.2.1.34 NAME 'sambaLogonScript' DESC
|
||||||
|
'Logon script path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.
|
||||||
|
1.15{255} SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {14}( 1.3.6.1.4.1.7165.2.1.35 NAME 'sambaProfilePath' DESC
|
||||||
|
'Roaming profile path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.1
|
||||||
|
21.1.15{255} SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {15}( 1.3.6.1.4.1.7165.2.1.36 NAME 'sambaUserWorkstations'
|
||||||
|
DESC 'List of user workstations the user is allowed to logon to' EQUALITY cas
|
||||||
|
eIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {16}( 1.3.6.1.4.1.7165.2.1.37 NAME 'sambaHomePath' DESC 'Ho
|
||||||
|
me directory UNC path' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.1
|
||||||
|
21.1.15{128} )
|
||||||
|
olcAttributeTypes: {17}( 1.3.6.1.4.1.7165.2.1.38 NAME 'sambaDomainName' DESC '
|
||||||
|
Windows NT domain to which the user belongs' EQUALITY caseIgnoreMatch SYNTAX
|
||||||
|
1.3.6.1.4.1.1466.115.121.1.15{128} )
|
||||||
|
olcAttributeTypes: {18}( 1.3.6.1.4.1.7165.2.1.47 NAME 'sambaMungedDial' DESC '
|
||||||
|
Base64 encoded user parameter string' EQUALITY caseExactMatch SYNTAX 1.3.6.1.
|
||||||
|
4.1.1466.115.121.1.15{1050} )
|
||||||
|
olcAttributeTypes: {19}( 1.3.6.1.4.1.7165.2.1.54 NAME 'sambaPasswordHistory' D
|
||||||
|
ESC 'Concatenated MD5 hashes of the salted NT passwords used on this account'
|
||||||
|
EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} )
|
||||||
|
olcAttributeTypes: {20}( 1.3.6.1.4.1.7165.2.1.20 NAME 'sambaSID' DESC 'Securit
|
||||||
|
y ID' EQUALITY caseIgnoreIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1
|
||||||
|
.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {21}( 1.3.6.1.4.1.7165.2.1.23 NAME 'sambaPrimaryGroupSID' D
|
||||||
|
ESC 'Primary Group Security ID' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.
|
||||||
|
1.1466.115.121.1.26{64} SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {22}( 1.3.6.1.4.1.7165.2.1.51 NAME 'sambaSIDList' DESC 'Sec
|
||||||
|
urity ID List' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.
|
||||||
|
26{64} )
|
||||||
|
olcAttributeTypes: {23}( 1.3.6.1.4.1.7165.2.1.19 NAME 'sambaGroupType' DESC 'N
|
||||||
|
T Group Type' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SING
|
||||||
|
LE-VALUE )
|
||||||
|
olcAttributeTypes: {24}( 1.3.6.1.4.1.7165.2.1.21 NAME 'sambaNextUserRid' DESC
|
||||||
|
'Next NT rid to give our for users' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.
|
||||||
|
1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {25}( 1.3.6.1.4.1.7165.2.1.22 NAME 'sambaNextGroupRid' DESC
|
||||||
|
'Next NT rid to give out for groups' EQUALITY integerMatch SYNTAX 1.3.6.1.4.
|
||||||
|
1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {26}( 1.3.6.1.4.1.7165.2.1.39 NAME 'sambaNextRid' DESC 'Nex
|
||||||
|
t NT rid to give out for anything' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1
|
||||||
|
466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {27}( 1.3.6.1.4.1.7165.2.1.40 NAME 'sambaAlgorithmicRidBase
|
||||||
|
' DESC 'Base at which the samba RID generation algorithm should operate' EQUA
|
||||||
|
LITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {28}( 1.3.6.1.4.1.7165.2.1.41 NAME 'sambaShareName' DESC 'S
|
||||||
|
hare Name' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SING
|
||||||
|
LE-VALUE )
|
||||||
|
olcAttributeTypes: {29}( 1.3.6.1.4.1.7165.2.1.42 NAME 'sambaOptionName' DESC '
|
||||||
|
Option Name' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX
|
||||||
|
1.3.6.1.4.1.1466.115.121.1.15{256} )
|
||||||
|
olcAttributeTypes: {30}( 1.3.6.1.4.1.7165.2.1.43 NAME 'sambaBoolOption' DESC '
|
||||||
|
A boolean option' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 S
|
||||||
|
INGLE-VALUE )
|
||||||
|
olcAttributeTypes: {31}( 1.3.6.1.4.1.7165.2.1.44 NAME 'sambaIntegerOption' DES
|
||||||
|
C 'An integer option' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
|
||||||
|
.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {32}( 1.3.6.1.4.1.7165.2.1.45 NAME 'sambaStringOption' DESC
|
||||||
|
'A string option' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121
|
||||||
|
.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {33}( 1.3.6.1.4.1.7165.2.1.46 NAME 'sambaStringListOption'
|
||||||
|
DESC 'A string list option' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.
|
||||||
|
115.121.1.15 )
|
||||||
|
olcAttributeTypes: {34}( 1.3.6.1.4.1.7165.2.1.53 NAME 'sambaTrustFlags' DESC '
|
||||||
|
Trust Password Flags' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115
|
||||||
|
.121.1.26 )
|
||||||
|
olcAttributeTypes: {35}( 1.3.6.1.4.1.7165.2.1.58 NAME 'sambaMinPwdLength' DESC
|
||||||
|
'Minimal password length (default: 5)' EQUALITY integerMatch SYNTAX 1.3.6.1.
|
||||||
|
4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {36}( 1.3.6.1.4.1.7165.2.1.59 NAME 'sambaPwdHistoryLength'
|
||||||
|
DESC 'Length of Password History Entries (default: 0 => off)' EQUALITY intege
|
||||||
|
rMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {37}( 1.3.6.1.4.1.7165.2.1.60 NAME 'sambaLogonToChgPwd' DES
|
||||||
|
C 'Force Users to logon for password change (default: 0 => off, 2 => on)' EQU
|
||||||
|
ALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {38}( 1.3.6.1.4.1.7165.2.1.61 NAME 'sambaMaxPwdAge' DESC 'M
|
||||||
|
aximum password age, in seconds (default: -1 => never expire passwords)' EQUA
|
||||||
|
LITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {39}( 1.3.6.1.4.1.7165.2.1.62 NAME 'sambaMinPwdAge' DESC 'M
|
||||||
|
inimum password age, in seconds (default: 0 => allow immediate password chang
|
||||||
|
e)' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {40}( 1.3.6.1.4.1.7165.2.1.63 NAME 'sambaLockoutDuration' D
|
||||||
|
ESC 'Lockout duration in minutes (default: 30, -1 => forever)' EQUALITY integ
|
||||||
|
erMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {41}( 1.3.6.1.4.1.7165.2.1.64 NAME 'sambaLockoutObservation
|
||||||
|
Window' DESC 'Reset time after lockout in minutes (default: 30)' EQUALITY int
|
||||||
|
egerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {42}( 1.3.6.1.4.1.7165.2.1.65 NAME 'sambaLockoutThreshold'
|
||||||
|
DESC 'Lockout users after bad logon attempts (default: 0 => off)' EQUALITY in
|
||||||
|
tegerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {43}( 1.3.6.1.4.1.7165.2.1.66 NAME 'sambaForceLogoff' DESC
|
||||||
|
'Disconnect Users outside logon hours (default: -1 => off, 0 => on)' EQUALITY
|
||||||
|
integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {44}( 1.3.6.1.4.1.7165.2.1.67 NAME 'sambaRefuseMachinePwdCh
|
||||||
|
ange' DESC 'Allow Machine Password changes (default: 0 => off)' EQUALITY inte
|
||||||
|
gerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {45}( 1.3.6.1.4.1.7165.2.1.68 NAME 'sambaClearTextPassword'
|
||||||
|
DESC 'Clear text password (used for trusted domain passwords)' EQUALITY octe
|
||||||
|
tStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
|
||||||
|
olcAttributeTypes: {46}( 1.3.6.1.4.1.7165.2.1.69 NAME 'sambaPreviousClearTextP
|
||||||
|
assword' DESC 'Previous clear text password (used for trusted domain password
|
||||||
|
s)' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
|
||||||
|
olcAttributeTypes: {47}( 1.3.6.1.4.1.7165.2.1.70 NAME 'sambaTrustType' DESC 'T
|
||||||
|
ype of trust' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SING
|
||||||
|
LE-VALUE )
|
||||||
|
olcAttributeTypes: {48}( 1.3.6.1.4.1.7165.2.1.71 NAME 'sambaTrustAttributes' D
|
||||||
|
ESC 'Trust attributes for a trusted domain' EQUALITY integerMatch SYNTAX 1.3.
|
||||||
|
6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {49}( 1.3.6.1.4.1.7165.2.1.72 NAME 'sambaTrustDirection' DE
|
||||||
|
SC 'Direction of a trust' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.1
|
||||||
|
21.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {50}( 1.3.6.1.4.1.7165.2.1.73 NAME 'sambaTrustPartner' DESC
|
||||||
|
'Fully qualified name of the domain with which a trust exists' EQUALITY case
|
||||||
|
IgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )
|
||||||
|
olcAttributeTypes: {51}( 1.3.6.1.4.1.7165.2.1.74 NAME 'sambaFlatName' DESC 'Ne
|
||||||
|
tBIOS name of a domain' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.
|
||||||
|
121.1.15{128} )
|
||||||
|
olcAttributeTypes: {52}( 1.3.6.1.4.1.7165.2.1.75 NAME 'sambaTrustAuthOutgoing'
|
||||||
|
DESC 'Authentication information for the outgoing portion of a trust' EQUALIT
|
||||||
|
Y caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} )
|
||||||
|
olcAttributeTypes: {53}( 1.3.6.1.4.1.7165.2.1.76 NAME 'sambaTrustAuthIncoming'
|
||||||
|
DESC 'Authentication information for the incoming portion of a trust' EQUALIT
|
||||||
|
Y caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} )
|
||||||
|
olcAttributeTypes: {54}( 1.3.6.1.4.1.7165.2.1.77 NAME 'sambaSecurityIdentifier
|
||||||
|
' DESC 'SID of a trusted domain' EQUALITY caseIgnoreIA5Match SUBSTR caseExact
|
||||||
|
IA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {55}( 1.3.6.1.4.1.7165.2.1.78 NAME 'sambaTrustForestTrustIn
|
||||||
|
fo' DESC 'Forest trust information for a trusted domain object' EQUALITY case
|
||||||
|
ExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} )
|
||||||
|
olcAttributeTypes: {56}( 1.3.6.1.4.1.7165.2.1.79 NAME 'sambaTrustPosixOffset'
|
||||||
|
DESC 'POSIX offset of a trust' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.
|
||||||
|
115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: {57}( 1.3.6.1.4.1.7165.2.1.80 NAME 'sambaSupportedEncryptio
|
||||||
|
nTypes' DESC 'Supported encryption types of a trust' EQUALITY integerMatch SY
|
||||||
|
NTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcObjectClasses: {0}( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' DESC 'Sam
|
||||||
|
ba 3.0 Auxilary SAM Account' SUP top AUXILIARY MUST ( uid $ sambaSID ) MAY (
|
||||||
|
cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $ sambaLogonTime $ s
|
||||||
|
ambaLogoffTime $ sambaKickoffTime $ sambaPwdCanChange $ sambaPwdMustChange $
|
||||||
|
sambaAcctFlags $ displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogonScr
|
||||||
|
ipt $ sambaProfilePath $ description $ sambaUserWorkstations $ sambaPrimaryGr
|
||||||
|
oupSID $ sambaDomainName $ sambaMungedDial $ sambaBadPasswordCount $ sambaBad
|
||||||
|
PasswordTime $ sambaPasswordHistory $ sambaLogonHours ) )
|
||||||
|
olcObjectClasses: {1}( 1.3.6.1.4.1.7165.2.2.4 NAME 'sambaGroupMapping' DESC 'S
|
||||||
|
amba Group Mapping' SUP top AUXILIARY MUST ( gidNumber $ sambaSID $ sambaGrou
|
||||||
|
pType ) MAY ( displayName $ description $ sambaSIDList ) )
|
||||||
|
olcObjectClasses: {2}( 1.3.6.1.4.1.7165.2.2.14 NAME 'sambaTrustPassword' DESC
|
||||||
|
'Samba Trust Password' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaNTPas
|
||||||
|
sword $ sambaTrustFlags ) MAY ( sambaSID $ sambaPwdLastSet ) )
|
||||||
|
olcObjectClasses: {3}( 1.3.6.1.4.1.7165.2.2.15 NAME 'sambaTrustedDomainPasswor
|
||||||
|
d' DESC 'Samba Trusted Domain Password' SUP top STRUCTURAL MUST ( sambaDomain
|
||||||
|
Name $ sambaSID $ sambaClearTextPassword $ sambaPwdLastSet ) MAY sambaPreviou
|
||||||
|
sClearTextPassword )
|
||||||
|
olcObjectClasses: {4}( 1.3.6.1.4.1.7165.2.2.5 NAME 'sambaDomain' DESC 'Samba D
|
||||||
|
omain Information' SUP top STRUCTURAL MUST ( sambaDomainName $ sambaSID ) MAY
|
||||||
|
( sambaNextRid $ sambaNextGroupRid $ sambaNextUserRid $ sambaAlgorithmicRidB
|
||||||
|
ase $ sambaMinPwdLength $ sambaPwdHistoryLength $ sambaLogonToChgPwd $ sambaM
|
||||||
|
axPwdAge $ sambaMinPwdAge $ sambaLockoutDuration $ sambaLockoutObservationWin
|
||||||
|
dow $ sambaLockoutThreshold $ sambaForceLogoff $ sambaRefuseMachinePwdChange
|
||||||
|
) )
|
||||||
|
olcObjectClasses: {5}( 1.3.6.1.4.1.7165.2.2.7 NAME 'sambaUnixIdPool' DESC 'Poo
|
||||||
|
l for allocating UNIX uids/gids' SUP top AUXILIARY MUST ( uidNumber $ gidNumb
|
||||||
|
er ) )
|
||||||
|
olcObjectClasses: {6}( 1.3.6.1.4.1.7165.2.2.8 NAME 'sambaIdmapEntry' DESC 'Map
|
||||||
|
ping from a SID to an ID' SUP top AUXILIARY MUST sambaSID MAY ( uidNumber $ g
|
||||||
|
idNumber ) )
|
||||||
|
olcObjectClasses: {7}( 1.3.6.1.4.1.7165.2.2.9 NAME 'sambaSidEntry' DESC 'Struc
|
||||||
|
tural Class for a SID' SUP top STRUCTURAL MUST sambaSID )
|
||||||
|
olcObjectClasses: {8}( 1.3.6.1.4.1.7165.2.2.10 NAME 'sambaConfig' DESC 'Samba
|
||||||
|
Configuration Section' SUP top AUXILIARY MAY description )
|
||||||
|
olcObjectClasses: {9}( 1.3.6.1.4.1.7165.2.2.11 NAME 'sambaShare' DESC 'Samba S
|
||||||
|
hare Section' SUP top STRUCTURAL MUST sambaShareName MAY description )
|
||||||
|
olcObjectClasses: {10}( 1.3.6.1.4.1.7165.2.2.12 NAME 'sambaConfigOption' DESC
|
||||||
|
'Samba Configuration Option' SUP top STRUCTURAL MUST sambaOptionName MAY ( sa
|
||||||
|
mbaBoolOption $ sambaIntegerOption $ sambaStringOption $ sambaStringListoptio
|
||||||
|
n $ description ) )
|
||||||
|
olcObjectClasses: {11}( 1.3.6.1.4.1.7165.2.2.16 NAME 'sambaTrustedDomain' DESC
|
||||||
|
'Samba Trusted Domain Object' SUP top STRUCTURAL MUST cn MAY ( sambaTrustTyp
|
||||||
|
e $ sambaTrustAttributes $ sambaTrustDirection $ sambaTrustPartner $ sambaFla
|
||||||
|
tName $ sambaTrustAuthOutgoing $ sambaTrustAuthIncoming $ sambaSecurityIdenti
|
||||||
|
fier $ sambaTrustForestTrustInfo $ sambaTrustPosixOffset $ sambaSupportedEncr
|
||||||
|
yptionTypes) )
|
||||||
8
secrets/ldap-root-password.age
Normal file
8
secrets/ldap-root-password.age
Normal file
|
|
@ -0,0 +1,8 @@
|
||||||
|
age-encryption.org/v1
|
||||||
|
-> ssh-ed25519 hC2TMg gmMUVd7GPIDYI6XJq+fCc/T0KjcXjPWcwREwPJATmRs
|
||||||
|
XxVKVWuyCWdYJQmX3bmkex2Y0dbZ0WMfQmNh3jbcZ6Y
|
||||||
|
-> ssh-ed25519 sI4HYw LZGzvLfAZuBq8rjJdwV+9AHxjOv/cw826hBanOtqqAI
|
||||||
|
/d7W7tf60xJEMfFIYQErw5huMV4oiOrWroSzRxg3ibQ
|
||||||
|
--- ms1br4YLjcCJG3wH5iVfRZSJk2fO1/kepZtwIHtueO0
|
||||||
|
œŠ•Þ½’}ºŸÆÐ4°½cÛ€ÑȨÔ2?ïÅ&1þ—üHQÈ(»fÿéYYU³
|
||||||
|
eõ<EFBFBD>ýô®Â¾ÖÓÍoØ-–4zî€7Ür
|
||||||
|
|
@ -3,8 +3,9 @@ let
|
||||||
users = [ jbruhn ];
|
users = [ jbruhn ];
|
||||||
|
|
||||||
telefonmann = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEwgqWVjNOgBygI1uaG8P6wQlfr91A+FJS/EHYZbYWlX";
|
telefonmann = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEwgqWVjNOgBygI1uaG8P6wQlfr91A+FJS/EHYZbYWlX";
|
||||||
kameramann = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEfgDpNz95SbbBHYM8zSGCh1pyb/2quR6Oy8xyWFkl0n";
|
kameramann = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEfgDpNz95SbbBHYM8zSGCh1pyb/2quR6Oy8xyWFkl0n";
|
||||||
systems = [ telefonmann kameramann ];
|
amtmann = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM85WwE8w9TaFpuYLy8GioqecCDEC+Ob25ecTT+aMVI8";
|
||||||
|
systems = [ telefonmann kameramann amtmann ];
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
"voip-trunk-ewe-host.age".publicKeys = users ++ [ telefonmann ];
|
"voip-trunk-ewe-host.age".publicKeys = users ++ [ telefonmann ];
|
||||||
|
|
@ -25,4 +26,5 @@ in
|
||||||
"camera-taubis-sub-url.age".publicKeys = users ++ [ kameramann ];
|
"camera-taubis-sub-url.age".publicKeys = users ++ [ kameramann ];
|
||||||
"camera-foeff-url.age".publicKeys = users ++ [ kameramann ];
|
"camera-foeff-url.age".publicKeys = users ++ [ kameramann ];
|
||||||
"camera-foeff-sub-url.age".publicKeys = users ++ [ kameramann ];
|
"camera-foeff-sub-url.age".publicKeys = users ++ [ kameramann ];
|
||||||
|
"ldap-root-password.age".publicKeys = users ++ [ amtmann ]; #slappasswd -s 'yourpassword'
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue