fedora-cosmic: add Kanidm Unix authentication
Install kanidm-unixd-clients/kanidm-clients, point /etc/kanidm/config at
auth.plabble.org, configure unixd (TPM-backed cache, pam_allowed_login_groups),
and set up PAM/nsswitch via an authselect custom profile (with a direct-file
fallback). Enable kanidm-unixd{,-tasks} and make unconfined_service_t
permissive until Kanidm ships an SELinux policy.
This commit is contained in:
@@ -23,6 +23,10 @@ packages:
|
||||
- pam-u2f
|
||||
- token2-fido-bridge
|
||||
|
||||
# Kanidm Unix authentication (kanidm-unixd-clients pulls kanidm-clients).
|
||||
- kanidm-unixd-clients
|
||||
- kanidm-clients
|
||||
|
||||
# Firefox is intentionally not part of the base system. It is preinstalled as a
|
||||
# per-user Flatpak on first login instead (see flatpaks.list).
|
||||
exclude-packages:
|
||||
@@ -35,6 +39,13 @@ add-files:
|
||||
- ["flatpaks.list", "/usr/share/flatpak/flatpaks.list"]
|
||||
- ["50-token2-fido-bridge.preset", "/usr/lib/systemd/system-preset/50-token2-fido-bridge.preset"]
|
||||
- ["uhid.conf", "/usr/lib/modules-load.d/uhid.conf"]
|
||||
# Kanidm client config and authselect profile sources.
|
||||
- ["kanidm-config", "/etc/kanidm/config"]
|
||||
- ["kanidm-unixd", "/etc/kanidm/unixd"]
|
||||
- ["kanidm-system-auth", "/usr/share/fedora-cosmic/authselect/system-auth"]
|
||||
- ["kanidm-password-auth", "/usr/share/fedora-cosmic/authselect/password-auth"]
|
||||
- ["kanidm-nsswitch.conf", "/usr/share/fedora-cosmic/authselect/nsswitch.conf"]
|
||||
- ["50-kanidm.preset", "/usr/lib/systemd/system-preset/50-kanidm.preset"]
|
||||
|
||||
postprocess:
|
||||
# The upstream fedora.yaml removes the Google Chrome repo from the Fedora
|
||||
@@ -52,3 +63,33 @@ postprocess:
|
||||
set -xeuo pipefail
|
||||
chmod 0755 /usr/libexec/flatpak-user-firstboot
|
||||
systemctl --user --global preset-all
|
||||
|
||||
# Kanidm PAM/nsswitch integration. Prefer an authselect profile; fall back to
|
||||
# installing the files directly (and dropping the authselect symlinks) if
|
||||
# authselect is unavailable in the compose environment.
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
set -xeuo pipefail
|
||||
if ! (
|
||||
set -euo pipefail
|
||||
authselect create-profile kanidm -b local
|
||||
install -m 0644 /usr/share/fedora-cosmic/authselect/system-auth \
|
||||
/etc/authselect/custom/kanidm/system-auth
|
||||
install -m 0644 /usr/share/fedora-cosmic/authselect/password-auth \
|
||||
/etc/authselect/custom/kanidm/password-auth
|
||||
install -m 0644 /usr/share/fedora-cosmic/authselect/nsswitch.conf \
|
||||
/etc/authselect/custom/kanidm/nsswitch.conf
|
||||
authselect select custom/kanidm --force
|
||||
); then
|
||||
echo "authselect setup failed, installing PAM/nsswitch directly" >&2
|
||||
rm -f /etc/pam.d/system-auth /etc/pam.d/password-auth /etc/nsswitch.conf
|
||||
install -m 0644 /usr/share/fedora-cosmic/authselect/system-auth /etc/pam.d/system-auth
|
||||
install -m 0644 /usr/share/fedora-cosmic/authselect/password-auth /etc/pam.d/password-auth
|
||||
install -m 0644 /usr/share/fedora-cosmic/authselect/nsswitch.conf /etc/nsswitch.conf
|
||||
fi
|
||||
|
||||
# Kanidm does not ship an SELinux policy yet; let the unixd daemons run.
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
set -xeuo pipefail
|
||||
semanage permissive -a unconfined_service_t || true
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
# Kanidm Unix authentication daemons.
|
||||
enable kanidm-unixd.service
|
||||
enable kanidm-unixd-tasks.service
|
||||
@@ -0,0 +1 @@
|
||||
uri = "https://auth.plabble.org"
|
||||
@@ -0,0 +1,14 @@
|
||||
passwd: kanidm compat systemd
|
||||
group: kanidm compat systemd
|
||||
shadow: files
|
||||
hosts: files dns myhostname
|
||||
services: files
|
||||
netgroup: files
|
||||
automount: files
|
||||
aliases: files
|
||||
ethers: files
|
||||
gshadow: files
|
||||
networks: files dns
|
||||
protocols: files
|
||||
publickey: files
|
||||
rpc: files
|
||||
@@ -0,0 +1,19 @@
|
||||
auth required pam_env.so
|
||||
auth required pam_faildelay.so delay=2000000
|
||||
auth sufficient pam_kanidm.so ignore_unknown_user
|
||||
auth sufficient pam_unix.so nullok
|
||||
auth required pam_deny.so
|
||||
|
||||
account sufficient pam_kanidm.so
|
||||
account required pam_unix.so
|
||||
|
||||
password requisite pam_pwquality.so
|
||||
password sufficient pam_unix.so yescrypt shadow nullok use_authtok
|
||||
password required pam_deny.so
|
||||
|
||||
session optional pam_keyinit.so revoke
|
||||
session required pam_limits.so
|
||||
-session optional pam_systemd.so
|
||||
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
|
||||
session optional pam_kanidm.so
|
||||
session required pam_unix.so
|
||||
@@ -0,0 +1,20 @@
|
||||
auth required pam_env.so
|
||||
auth required pam_faildelay.so delay=2000000
|
||||
auth sufficient pam_fprintd.so
|
||||
auth sufficient pam_kanidm.so ignore_unknown_user
|
||||
auth sufficient pam_unix.so nullok
|
||||
auth required pam_deny.so
|
||||
|
||||
account sufficient pam_kanidm.so ignore_unknown_user
|
||||
account required pam_unix.so
|
||||
|
||||
password requisite pam_pwquality.so
|
||||
password sufficient pam_unix.so yescrypt shadow nullok use_authtok
|
||||
password required pam_deny.so
|
||||
|
||||
session optional pam_keyinit.so revoke
|
||||
session required pam_limits.so
|
||||
-session optional pam_systemd.so
|
||||
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
|
||||
session optional pam_kanidm.so
|
||||
session required pam_unix.so
|
||||
@@ -0,0 +1,20 @@
|
||||
version = "2"
|
||||
|
||||
# Bind cached credentials to the local TPM when one is available.
|
||||
hsm_type = "tpm_if_possible"
|
||||
|
||||
default_shell = "/bin/bash"
|
||||
home_prefix = "/home/"
|
||||
home_attr = "uuid"
|
||||
home_alias = "name"
|
||||
use_etc_skel = true
|
||||
selinux = true
|
||||
|
||||
[kanidm]
|
||||
# Members of this Kanidm POSIX group are allowed to log in via PAM.
|
||||
pam_allowed_login_groups = ["unix_users"]
|
||||
|
||||
# Token for the Kanidm service account used to resolve identities. Provision it
|
||||
# at /etc/kanidm/unixd_token (a single line) after install, or remove this line
|
||||
# if the server permits anonymous reads.
|
||||
service_account_token_path = "/etc/kanidm/unixd_token"
|
||||
Reference in New Issue
Block a user