Produits Entr'ouvert » U-Auth

#!/bin/sh

# Do initial configuration of slapd

set -e

LDIFDIR=/usr/share/u-auth

BACKUPDIR="/var/backup/reset-ldap-`date +%Y%m%dT%H:%M:%S`"

mkdir -p "$BACKUPDIR"

echo Old configuration saved in $BACKUPDIR

cp -R /var/lib/ldap /etc/ldap/slapd.d/ "$BACKUPDIR"

rm -rf /var/lib/ldap/*

mkdir /var/lib/ldap/config-accesslog/

echo Load overlay modules, configure auditlog for cn=config

slapadd -n0 -F/etc/ldap/slapd.d -l${LDIFDIR}/radius.ldif

echo "Suffixe de la base à créer (exemple : dc=univ-psl,dc=fr) :"

echo -n "-> "

read SUFFIX

echo

if [ -d "/var/lib/ldap/$SUFFIX" ]; then

        echo "ERR: le répertoire '/var/lib/ldap/$SUFFIX' existe déjà" >&2

        exit 1

fi

if ldapsearch -H ldapi:// -Y EXTERNAL -b cn=config olcSuffix=$SUFFIX 2>/dev/null | grep -q '^result: [1-9]'; then

        echo "ERR: le suffixe $SUFFIX existe déjà" >&2

        exit 2

fi

echo "Choisir un mot de passe administrateur (uid=admin,ou=people,$SUFFIX) :"

echo -n "-> "

stty -echo

read PASSWORD

stty echo

echo

echo "Une nouvelle fois :"

echo -n "-> "

stty -echo

read PASSWORD2

stty echo

echo

if [ x"$PASSWORD" != x"$PASSWORD2" ]; then

        echo "ERR: mots de passe différents" >&2

        exit 3

fi

echo

echo "Nom de l'organisation (ou=...) :"

echo "uniquement des majuscules, sans accent"

echo "Exemple: ENS"

echo -n "-> "

read ORGANIZATION

echo

echo "Récapitulatif :"

echo " Suffixe : $SUFFIX"

echo "     Nom : $ORGANIZATION"

echo "DN établissement : ou=$ORGANIZATION,$SUFFIX"

echo

echo "Créer cette base ? (taper oui)"

echo -n "-> "

read OK

echo

if [ "x$OK" != "xoui" ]; then

        exit 4

fi

DC=`echo $SUFFIX | sed 's/dc=\([^,]*\).*/\1/'`

DBDIR=/var/lib/ldap/$SUFFIX

DBACCESSLOGDIR=/var/lib/ldap/$SUFFIX/accesslog/

mkdir -p "$DBDIR" "$DBACCESSLOGDIR"

chown -R openldap:openldap /etc/ldap/slapd.d /var/lib/ldap

LDIF=`tempfile --prefix=newdb --suffix=.ldif`

cat << EOF > $LDIF

# LDAPVI syntax

add olcDatabase={1}mdb,cn=config

objectClass: olcDatabaseConfig

objectClass: olcMdbConfig

olcDatabase: {1}mdb

olcSuffix: $SUFFIX

olcDbDirectory: /var/lib/ldap/$SUFFIX/

olcRootDN: uid=admin,ou=people,$SUFFIX

olcRootPW: $PASSWORD

olcLastMod: TRUE

olcAddContentACL: FALSE

olcMonitoring: TRUE

olcSyncUseSubentry: FALSE

olcMaxDerefDepth: 0

olcLimits: {0}dn.exact="uid=admin,ou=people,$SUFFIX" size.soft=unlimited  size.hard=unlimited  time.soft=unlimited  time.hard=unlimited

olcLimits: {1}dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" size.soft=unlimited  size.hard=unlimited  time.soft=unlimited  time.hard=unlimited

olcReadOnly: FALSE

# Index

olcDbIndex: objectClass,member,owner eq

olcDbIndex: mail,givenName,uid,cn,sn,displayName pres,eq,approx,sub

# Accès super-utilisateur

olcAccess: {0}to *

   by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage

   by group.exact="cn=admin,ou=groups,$SUFFIX" manage 

   by * break

# Branche people

olcAccess: {1}to dn.regex="uid=[^,]+,ou=people,$SUFFIX" attrs=userPassword,labeledURI

   by self write

   by * break

# Les accès aux autres attributs utilisateurs

olcAccess: {2}to dn.one="ou=people,$SUFFIX"

   by users read

   by anonymous auth

   by * none

# Branche groups

# Le propriétaire du groupe

olcAccess: {3}to dn.one="ou=groups,$SUFFIX" 

   by set="this/owner & user" manage 

   by * break

# Les utilisateurs en général sur les attributs descriptifs

olcAccess: {4}to dn.one="ou=groups,$SUFFIX" attrs=cn,description,owner

   by users read 

   by * break

# Create accesslog DIT

add olcDatabase={1}mdb,cn=config

objectClass: olcDatabaseConfig

objectClass: olcMdbConfig

olcSuffix: cn=accesslog,$SUFFIX

olcDbDirectory: /var/lib/ldap/$SUFFIX/accesslog/

olcAccess: {0}to * 

  by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage

  by group=cn=admin,ou=groupes,$SUFFIX manage

  by * break

add olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config

objectClass: olcOverlayConfig

objectClass: olcSyncProvConfig

olcOverlay: {0}syncprov

olcSpCheckpoint: 100 10

olcSpSessionlog: 100

# Log all writes to the db

add olcOverlay={1}accesslog,olcDatabase={2}mdb,cn=config

objectClass: olcAccesslogConfig

objectClass: olcOverlayConfig

objectClass: olcConfig

objectClass: top

olcOverlay: {1}accesslog

olcAccessLogDB: cn=accesslog,$SUFFIX

olcAccessLogOps: writes

# log are conserved one year and purged every day

olcAccessLogPurge: 365+00:00 1+00:00

# Keep a copy of everything

olcAccessLogOld: objectClass=*

add olcOverlay={2}refint,olcDatabase={2}mdb,cn=config

objectClass: olcOverlayConfig

objectClass: olcRefintConfig

olcOverlay: {2}refint

olcRefintAttribute: member 

olcRefintNothing: $SUFFIX

add olcOverlay={3}constraint,olcDatabase={2}mdb,cn=config

objectClass: olcOverlayConfig

objectClass: olcConstraintConfig

olcOverlay: {3}constraint

# un seul cn pour les utilisateurs

olcConstraintAttribute: cn count 1 restrict="ldap:///ou=people,$SUFFIX??sub?(objectClass=*)" 

#olcConstraintAttribute: cn regex "^[-A-Z' ]*$" restrict="ldap:///ou=people,$SUFFIX??sub?(objectClass=*)" 

olcConstraintAttribute: cn regex "^[-A-Za-z0-9 ]*$" restrict="ldap:///ou=groups,$SUFFIX??sub?(objectClass=*)" 

olcConstraintAttribute: cn regex "^[-A-Za-z0-9 ]*$" restrict="ldap:///$SUFFIX??base?(objectClass=*)" 

olcConstraintAttribute: dc regex "^[a-z0-9-]*$" 

olcConstraintAttribute: mail count 1

olcConstraintAttribute: mail 

  regex "^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,4}$" 

# olcConstraintAttribute: mailForwardingAddress 

  regex "^([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,4}|[a-zA-Z0-9]+)$" # mail ou uid

add $SUFFIX

objectClass: organization

objectClass: dcObject

dc: $DC

o: $ORGANIZATION

add ou=people,$SUFFIX

objectClass: organizationalUnit

ou: people

add uid=admin,ou=people,$SUFFIX

objectClass: inetOrgPerson

uid: admin

cn: Administrateur annuaire

displayName: Administrateur annuaire

givenName: Administrateur

sn: annuaire

userPassword: $PASSWORD

add ou=$ORGANIZATION,$SUFFIX

objectClass: organizationalUnit

ou: $ORGANIZATION

EOF

echo "Chargement de la définition de la nouvelle base annuaire ($LDIF) :"

ldapvi --verbose --profile config --ldapmodify --ldapvi --add $LDIF

# slapadd -n0 -F/etc/ldap/slapd.d -l${LDIF}

echo "OK"

chown -R openldap.openldap /etc/ldap/slapd.d /var/lib/ldap

LDAP_SETUP=`tempfile --prefix=ldap --suffix=.conf`

cat << EOF > $LDAP_SETUP

ldap {

	#

	#  Note that this needs to match the name in the LDAP

	#  server certificate, if you're using ldaps.

	server = "localhost"

	identity = "uid=admin,ou=people,$SUFFIX"

	password = "$PASSWORD"

	basedn = "ou=$ORGANIZATION,$SUFFIX"

	filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"

	#base_filter = "(objectclass=radiusprofile)"

	ldap_connections_number = 5

	#  How many times the connection can be used before

	#  being re-established. This is useful for things

	#  like load balancers, which may exhibit sticky

	#  behaviour without it. (0) is unlimited.

	max_uses = 0

	#  Port to connect on, defaults to 389. Setting this to

	#  636 will enable LDAPS if start_tls (see below) is not

	#  able to be used.

	#port = 389

	# seconds to wait for LDAP query to finish. default: 20

	timeout = 4

	#  seconds LDAP server has to process the query (server-side

	#  time limit). default: 20

	#

	#  LDAP_OPT_TIMELIMIT is set to this value.

	timelimit = 3

	#

	#  seconds to wait for response of the server. (network

	#   failures) default: 10

	#

	#  LDAP_OPT_NETWORK_TIMEOUT is set to this value.

	net_timeout = 1

	# Mapping of RADIUS dictionary attributes to LDAP

	# directory attributes.

	dictionary_mapping = \${confdir}/ldap.attrmap

	#  Un-comment the following to disable Novell

	#  eDirectory account policy check and intruder

	#  detection. This will work *only if* FreeRADIUS is

	#  configured to build with --with-edir option.

	#

	edir_account_policy_check = no

	#  By default, if the packet contains a User-Password,

	#  and no other module is configured to handle the

	#  authentication, the LDAP module sets itself to do

	#  LDAP bind for authentication.

	#

	#  THIS WILL ONLY WORK FOR PAP AUTHENTICATION.

	#

	#  THIS WILL NOT WORK FOR CHAP, MS-CHAP, or 802.1x (EAP). 

	#

	#  You can disable this behavior by setting the following

	#  configuration entry to "no".

	#

	#  allowed values: {no, yes}

	# set_auth_type = yes

	#  Keepalive configuration.  This MAY NOT be supported by your

	#  LDAP library.  If these configuration entries appear in the

	#  output of "radiusd -X", then they are supported.  Otherwise,

	#  they are unsupported, and changing them will do nothing.

	#

	keepalive {

		# LDAP_OPT_X_KEEPALIVE_IDLE

		idle = 60

		# LDAP_OPT_X_KEEPALIVE_PROBES

		probes = 3

		# LDAP_OPT_X_KEEPALIVE_INTERVAL

		interval = 3

	}

}

EOF

service freeradius stop

cp /etc/freeradius/modules/ldap /etc/freeradius/modules/ldap.backup

mv $LDAP_SETUP /etc/freeradius/modules/ldap

service freeradius start