felixalb/pvv-nixos-config
1
0
Fork 0
mirror of https://git.pvv.ntnu.no/Drift/pvv-nixos-config.git synced 2026-02-11 20:50:03 +01:00
Code Issues Projects Releases Wiki Activity

WIP: Move krb5 realm to pvv.local, make sane ldap structure

Browse Source
This commit is contained in:
Felix Albrigtsen
2024-07-07 00:07:59 +02:00
committed by h7x4
parent 1a4cca5025
commit a385f730b1
4 changed files with 66 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
hosts/dagali/services/openldap.nix
View File

@@ -1,7 +1,7 @@
{ config, pkgs, lib, ... }:
{
services.openldap = let
dn = "dc=kerberos,dc=pvv,dc=ntnu,dc=no";
dn = "dc=pvv,dc=ntnu,dc=no";
cfg = config.services.openldap;
heimdal = config.security.krb5.package;
@@ -80,7 +80,7 @@
objectClass = [ "olcOverlayConfig" "olcSmbK5PwdConfig" ];
olcOverlay = "{0}smbk5pwd";
olcSmbK5PwdEnable = [ "krb5" "samba" ];
olcSmbK5PwdMustChange = toString (60 * 60 * 24 * 30);
olcSmbK5PwdMustChange = toString (60 * 60 * 24 * 10000);
};
"olcDatabase={1}mdb".attrs = {
@@ -91,7 +91,7 @@
olcSuffix = dn;
# TODO: PW is supposed to be a secret, but it's probably fine for testing
olcRootDN = "cn=admin,${dn}";
olcRootDN = "cn=users,${dn}";
# TODO: replace with proper secret
olcRootPW.path = pkgs.writeText "olcRootPW" "pass";
@@ -101,7 +101,7 @@
olcAccess = [
''{0}to attrs=userPassword,shadowLastChange
by dn.exact=cn=admin,${dn} write
by dn.exact=cn=users,${dn} write
by self write
by anonymous auth
by * none''
@@ -111,7 +111,7 @@
/* allow read on anything else */
# ''{2}to *
# by cn=admin,${dn} write by dn.exact=gidNumber=0+uidNumber=0+cn=peercred,cn=external write
# by cn=users,${dn} write by dn.exact=gidNumber=0+uidNumber=0+cn=peercred,cn=external write
# by * read''
];
};