blob: d6d50aba33566bec04350327cb27416da53fcdcc (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
|
#!/bin/bash
UNIXERS_GROUP = {{ unixers }}
/etc/kanidm/config
<<<
uri = "https://{{ idm_domain }}"
verify_ca = true
verify_hostnames = true
>>>
/etc/kanidm/unixd
<<<
version = '2'
default_shell = "/bin/zsh"
home_attr = "uuid"
home_alias = "name"
home_prefix = "/home/"
[kanidm]
pam_allowed_login_groups = ["{{ unixers }}"]
[[kanidm.map_group]]
local = "admins"
with = "coffee_admins"
>>>
/etc/sudo
<<<
%admins ALL=(ALL:ALL) ALL
>>>
systemctl enable --now kanidm-unixd
systemctl enable --now kanidm-unixd-tasks
add_line /etc/nsswitch.conf
<<<
passwd: kanidm files systemd
group: kanidm [SUCCESS=merge] files systemd
>>>
add_line /etc/ssh/sshd_config.d/10-kanidm-keys.conf
<<<
PubkeyAuthentication yes
UsePAM yes
Match Group {{ unixers_group }}
AuthorizedKeysCommand /usr/sbin/kanidm_ssh_authorizedkeys %u
AuthorizedKeysCommandUser nobody
>>>
# PAM
add_line /etc/pam.d/common-account
<<<
|
