ldap/pam: enable pam/ldap authentication

- modify pam configuration files to use ldap
- modify sshd to enable pam
- modify nsswitch.conf to use ldap

Signed-off-by: Amy Fong <amy.fong@windriver.com>

6 files changed, 141 insertions, 0 deletions

diff --git a/meta-openstack/recipes-extended/libpam/files/common-account b/meta-openstack/recipes-extended/libpam/files/common-account
new file mode 100644
index 0000000..66cc62c
--- /dev/null
+++ b/meta-openstack/recipes-extended/libpam/files/common-account
@@ -0,0 +1,26 @@
+#
+# /etc/pam.d/common-account - authorization settings common to all services
+#
+# This file is included from other service-specific PAM config files,
+# and should contain a list of the authorization modules that define
+# the central access policy for use on the system.  The default is to
+# only deny service to users whose accounts are expired in /etc/shadow.
+#
+# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
+# To take advantage of this, it is recommended that you configure any
+# local modules either before or after the default block, and use
+# pam-auth-update to manage selection of other modules.  See
+# pam-auth-update(8) for details.
+#
+
+# here are the per-package modules (the "Primary" block)
+account [success=1 new_authtok_reqd=done default=ignore]        pam_unix.so 
+# here's the fallback if no module succeeds
+account requisite                       pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+account required                        pam_permit.so
+# and here are more per-package modules (the "Additional" block)
+account [success=ok new_authtok_reqd=done ignore=ignore user_unknown=ignore authinfo_unavail=ignore default=bad]        pam_ldap.so minimum_uid=1000
+# end of pam-auth-update config
diff --git a/meta-openstack/recipes-extended/libpam/files/common-auth b/meta-openstack/recipes-extended/libpam/files/common-auth
new file mode 100644
index 0000000..e5b429d
--- /dev/null
+++ b/meta-openstack/recipes-extended/libpam/files/common-auth
@@ -0,0 +1,21 @@
+#
+# /etc/pam.d/common-auth - authentication settings common to all services
+#
+# This file is included from other service-specific PAM config files,
+# and should contain a list of the authentication modules that define
+# the central authentication scheme for use on the system
+# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the
+# traditional Unix authentication mechanisms.
+
+# here are the per-package modules (the "Primary" block)
+auth    [success=2 default=ignore]      pam_unix.so nullok_secure
+auth    [success=1 default=ignore]      pam_ldap.so minimum_uid=1000 use_first_pass
+# here's the fallback if no module succeeds
+auth    requisite                       pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+auth    required                        pam_permit.so
+# and here are more per-package modules (the "Additional" block)
+auth    optional                        pam_cap.so 
+# end of pam-auth-update config
diff --git a/meta-openstack/recipes-extended/libpam/files/common-password b/meta-openstack/recipes-extended/libpam/files/common-password
new file mode 100644
index 0000000..f9bbecc
--- /dev/null
+++ b/meta-openstack/recipes-extended/libpam/files/common-password
@@ -0,0 +1,28 @@
+#
+# /etc/pam.d/common-password - password-related modules common to all services
+#
+# This file is included from other service-specific PAM config files,
+# and should contain a list of modules that define the services to be
+# used to change user passwords.  The default is pam_unix.
+
+# Explanation of pam_unix options:
+#
+# The "sha512" option enables salted SHA512 passwords.  Without this option,
+# the default is Unix crypt.  Prior releases used the option "md5".
+#
+# The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in
+# login.defs.
+#
+# See the pam_unix manpage for other options.
+
+# here are the per-package modules (the "Primary" block)
+password        [success=2 default=ignore]      pam_unix.so obscure sha512
+password        [success=1 default=ignore]      pam_ldap.so minimum_uid=1000 try_first_pass
+# here's the fallback if no module succeeds
+password        requisite                       pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+password        required                        pam_permit.so
+# and here are more per-package modules (the "Additional" block)
+# end of pam-auth-update config
diff --git a/meta-openstack/recipes-extended/libpam/files/common-session b/meta-openstack/recipes-extended/libpam/files/common-session
new file mode 100644
index 0000000..7f95098
--- /dev/null
+++ b/meta-openstack/recipes-extended/libpam/files/common-session
@@ -0,0 +1,22 @@
+#
+# /etc/pam.d/common-session - session-related modules common to all services
+#
+# This file is included from other service-specific PAM config files,
+# and should contain a list of modules that define tasks to be performed
+# at the start and end of sessions of *any* kind (both interactive and
+# non-interactive).
+#
+
+# here are the per-package modules (the "Primary" block)
+session [default=1]                     pam_permit.so
+# here's the fallback if no module succeeds
+session requisite                       pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+session required                        pam_permit.so
+# and here are more per-package modules (the "Additional" block)
+session required        pam_unix.so 
+session [success=ok default=ignore]     pam_ldap.so minimum_uid=1000
+session required pam_mkhomedir.so skel=/etc/skel umask=0022
+# end of pam-auth-update config
diff --git a/meta-openstack/recipes-extended/libpam/files/common-session-noninteractive b/meta-openstack/recipes-extended/libpam/files/common-session-noninteractive
new file mode 100644
index 0000000..f7f83ed
--- /dev/null
+++ b/meta-openstack/recipes-extended/libpam/files/common-session-noninteractive
@@ -0,0 +1,21 @@
+#
+# /etc/pam.d/common-session-noninteractive - session-related modules
+# common to all non-interactive services
+#
+# This file is included from other service-specific PAM config files,
+# and should contain a list of modules that define tasks to be performed
+# at the start and end of all non-interactive sessions.
+#
+
+# here are the per-package modules (the "Primary" block)
+session [default=1]                     pam_permit.so
+# here's the fallback if no module succeeds
+session requisite                       pam_deny.so
+# prime the stack with a positive return value if there isn't one already;
+# this avoids us returning an error just because nothing sets a success code
+# since the modules above will each just jump around
+session required                        pam_permit.so
+# and here are more per-package modules (the "Additional" block)
+session required        pam_unix.so 
+session [success=ok default=ignore]     pam_ldap.so minimum_uid=1000
+# end of pam-auth-update config
diff --git a/meta-openstack/recipes-extended/libpam/libpam_1.1.5.bbappend b/meta-openstack/recipes-extended/libpam/libpam_1.1.5.bbappend
new file mode 100644
index 0000000..dc32cc9
--- /dev/null
+++ b/meta-openstack/recipes-extended/libpam/libpam_1.1.5.bbappend
@@ -0,0 +1,23 @@
+PRINC = "1"
+
+FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
+
+SRC_URI += "file://common-account"
+SRC_URI += "file://common-auth"
+SRC_URI += "file://common-password"
+SRC_URI += "file://common-session"
+SRC_URI += "file://common-session-noninteractive"
+
+PACKAGECONFIG ?= "${@base_contains('DISTRO_FEATURES', 'OpenLDAP', 'OpenLDAP', '', d)}"
+PACKAGECONFIG[OpenLDAP] = ",,,pam-plugin-mkhomedir nss-pam-ldapd"
+
+do_install_append() {
+    if ${@base_contains('DISTRO_FEATURES', 'OpenLDAP', 'true', 'false', d)}; then
+        install -m 755 -d ${D}/etc/pam.d/
+        install -m 644 ${WORKDIR}/common-account ${D}/etc/pam.d/
+        install -m 644 ${WORKDIR}/common-auth ${D}/etc/pam.d/
+        install -m 644 ${WORKDIR}/common-password ${D}/etc/pam.d/
+        install -m 644 ${WORKDIR}/common-session ${D}/etc/pam.d/
+        install -m 644 ${WORKDIR}/common-session-noninteractive ${D}/etc/pam.d/
+    fi
+}