123 lines
4.7 KiB
Bash
123 lines
4.7 KiB
Bash
#!/bin/bash
|
|
set -e
|
|
|
|
# Pull in the mustache template library for bash
|
|
source lib/mo
|
|
|
|
if [ ! -f ./ldap.vars ]; then
|
|
echo "ldap.vars file not found!"
|
|
echo "Please copy ldap.vars.template to ldap.vars and edit it."
|
|
exit 1
|
|
fi
|
|
|
|
source ldap.vars
|
|
export current_host=$(hostname)
|
|
|
|
echo "--- Starting LDAP to SSSD Migration ---"
|
|
|
|
echo "1. Cleaning up old LDAP configuration and packages..."
|
|
|
|
# 1. Remove old packages (libnss-ldap, libpam-ldap, sudo-ldap, nscd, etc.)
|
|
DEBIAN_FRONTEND=noninteractive apt purge -y libnss-ldap libpam-ldap nscd sudo-ldap nslcd
|
|
|
|
# Preserve ldap-utils if it's still useful for general LDAP querying
|
|
# apt purge -y ldap-utils
|
|
|
|
# 2. Clean up old configuration files
|
|
echo " - Removing old configuration files..."
|
|
rm -f /etc/pam_ldap.conf
|
|
rm -f /etc/ldap/ldap.conf
|
|
rm -f /etc/ldap.conf
|
|
rm -f /etc/sudo-ldap.conf
|
|
|
|
# 3. Revert nsswitch.conf entries related to 'ldap'
|
|
echo " - Reverting /etc/nsswitch.conf entries for 'ldap'..."
|
|
sed -i '/passwd:/ s/ ldap//' /etc/nsswitch.conf
|
|
sed -i '/group:/ s/ ldap//' /etc/nsswitch.conf
|
|
# You might want to review other services like 'shadow' or 'hosts' if they also had 'ldap'
|
|
# For example: sed -i '/shadow:/ s/ ldap//' /etc/nsswitch.conf
|
|
|
|
# 4. Clean up PAM configurations
|
|
echo " - Cleaning up old PAM configurations..."
|
|
# Disable 'ldap' in pam-auth-update if it was enabled directly
|
|
pam-auth-update --remove ldap
|
|
|
|
# Remove specific common-password modifications made by the old script
|
|
# The old script removed 'use_authtok'. Let's ensure a clean state if SSSD needs a different one.
|
|
# It's generally safer to restore from a backup or let the new SSSD setup configure PAM.
|
|
# For simplicity, we'll rely on the new sssd pam module to set things correctly.
|
|
sed -i '/session required pam_mkhomedir.so skel=\/etc\/skel umask=077/d' /etc/pam.d/common-session
|
|
|
|
# Ensure nscd is stopped and disabled if it wasn't purged
|
|
systemctl stop nscd || true
|
|
systemctl disable nscd || true
|
|
|
|
echo "Cleanup complete."
|
|
echo "--- Installing New SSSD Configuration ---"
|
|
|
|
# Install SSSD and required tools
|
|
# We use sssd-ldap for the backend and libnss-sss/libpam-sss for the system hooks
|
|
DEBIAN_FRONTEND=noninteractive apt update
|
|
DEBIAN_FRONTEND=noninteractive apt install -y sudo sssd sssd-ldap libnss-sss libpam-sss ldap-utils libsss-sudo curl libsasl2-modules-gssapi-mit
|
|
|
|
# Create the SSSD configuration from template
|
|
mkdir -p /etc/sssd
|
|
echo " - Creating /etc/sssd/sssd.conf from template..."
|
|
cat files/sssd.conf.mo | mo > /etc/sssd/sssd.conf
|
|
chmod 600 /etc/sssd/sssd.conf
|
|
|
|
# Ensure nsswitch uses sss for passwd, group, and sudoers
|
|
echo " - Updating /etc/nsswitch.conf for SSSD..."
|
|
sed -i 's/^passwd:.*/passwd: files sss/' /etc/nsswitch.conf
|
|
sed -i 's/^group:.*/group: files sss/' /etc/nsswitch.conf
|
|
if ! grep -q "sudoers:" /etc/nsswitch.conf; then
|
|
echo "sudoers: files sss" >> /etc/nsswitch.conf
|
|
else
|
|
sed -i 's/^sudoers:.*/sudoers: files sss/' /etc/nsswitch.conf
|
|
fi
|
|
|
|
# Enable home directory creation (this should already be handled by pam-auth-update)
|
|
# Double-check this line if it causes issues; pam-auth-update should configure /etc/pam.d/common-session
|
|
# pam-auth-update --enable mkhomedir
|
|
|
|
# Restart SSSD
|
|
echo " - Restarting and enabling SSSD service..."
|
|
systemctl restart sssd
|
|
systemctl enable sssd
|
|
|
|
# --- Maintain Custom SSH Key Script ---
|
|
echo " - Setting up custom SSH key script..."
|
|
cat files/ldap-ssh-key.sh | mo > /usr/local/bin/ldap-ssh-key
|
|
chmod +x /usr/local/bin/ldap-ssh-key
|
|
|
|
# Update SSHD config if not already present
|
|
echo " - Configuring SSHD for LDAP SSH keys..."
|
|
if ! grep -q "AuthorizedKeysCommand /usr/local/bin/ldap-ssh-key" /etc/ssh/sshd_config; then
|
|
echo "AuthorizedKeysCommand /usr/local/bin/ldap-ssh-key" >> /etc/ssh/sshd_config
|
|
echo "AuthorizedKeysCommandUser nobody" >> /etc/ssh/sshd_config
|
|
systemctl restart sshd
|
|
else
|
|
# If the lines exist, just ensure sshd is restarted in case it wasn't earlier
|
|
systemctl restart sshd
|
|
fi
|
|
|
|
echo " - Enabling sssd-sudo socket..."
|
|
systemctl enable --now sssd-sudo.socket
|
|
|
|
# --- SSO Group Creation API Calls ---
|
|
if [[ -v sso_token ]]; then
|
|
echo " - Registering host groups via API..."
|
|
# (Existing curl logic remains here)
|
|
curl "${sso_url}/api/group/" \
|
|
-H "auth-token: ${sso_token}" \
|
|
-H "content-type: application/json; charset=UTF-8" \
|
|
--data-binary "{\"name\":\"host_${current_host}_access\",\"description\":\"Access for $current_host\"}"
|
|
curl "${sso_url}/api/group/" \
|
|
-H "auth-token: ${sso_token}" \
|
|
-H "content-type: application/json; charset=UTF-8" \
|
|
--data-binary "{\"name\":\"host_${current_host}_admin\",\"description\":\"sudo for $current_host\"}"
|
|
fi
|
|
|
|
echo "--- SSSD Migration Complete! ---"
|
|
echo "Please verify authentication and user access."
|