1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
|
# File 'manifests/configsudo.pp', line 1
define ipa::configsudo (
$host = $name,
$os = {},
$sudopw = {},
$adminpw = {},
$domain = {},
$masterfqdn = {}
) {
Augeas["nsswitch-sudoers-${host}"] -> Exec["set-sudopw-${host}"]
$dc = prefix([regsubst($domain,'(\.)',',dc=','G')],'dc=')
augeas { "nsswitch-sudoers-${host}":
context => '/files/etc/nsswitch.conf',
changes => [
"set database[. = 'sudoers'] sudoers",
"set database[. = 'sudoers']/service[1] files",
"set database[. = 'sudoers']/service[2] ldap"
]
}
if $os == 'RedHat5' {
augeas { "sudo-ldap-rhel5-${host}":
context => '/files/etc/ldap.conf',
changes => [
"set binddn uid=sudo,cn=sysaccounts,cn=etc,${dc}",
"set bindpw $sudopw",
"set ssl start_tls",
"set tls_cacertfile /etc/ipa/ca.crt",
"set tls_checkpeer yes",
"set bind_timelimit 5",
"set timelimit 15",
"set sudoers_base ou=sudoers,${dc}"
]
}
} else {
file { "sudo-ldap-${host}":
path => "/etc/sudo-ldap.conf",
owner => 'root',
group => 'root',
mode => '0640',
content => template('ipa/sudo-ldap.conf.erb')
}
}
exec { "set-sudopw-${host}":
command => "/bin/bash -c \"LDAPTLS_REQCERT=never /usr/bin/ldappasswd -x -H ldaps://${masterfqdn} -D uid=admin,cn=users,cn=accounts,${dc} -w ${adminpw} -s ${sudopw} uid=sudo,cn=sysaccounts,cn=etc,${dc}\"",
unless => "/bin/bash -c \"LDAPTLS_REQCERT=never /usr/bin/ldapsearch -x -H ldaps://${masterfqdn} -D uid=sudo,cn=sysaccounts,cn=etc,${dc} -w ${sudopw} -b cn=sysaccounts,cn=etc,${dc} uid=sudo\"",
onlyif => "/usr/bin/test $(/bin/hostname -f) = $masterfqdn",
logoutput => "on_failure"
}
}
|