6c7a4fd683
Recommends sssd, sssd-tools, libpam-sss Add SSSD configuration (sssd.conf) Configure certificates for SSSD (postinst) Restart SSSD service (postinst)
75 lines
2.4 KiB
Bash
75 lines
2.4 KiB
Bash
#!/bin/sh
|
|
set -e
|
|
|
|
case "$1" in
|
|
configure)
|
|
# enable GDM customization
|
|
if [ -x /usr/bin/dconf ] ; then
|
|
dconf update
|
|
fi
|
|
|
|
# Configure NSS for pam-pkcs11 and pam-sss
|
|
mkdir -p /etc/pki/nssdb
|
|
orange-certupdate /etc/pki/nssdb >/dev/null || true
|
|
orange-dongle-aladdin --force update /etc/pki/nssdb || true
|
|
|
|
# Configure certificates for SSSD (OpenSSL)
|
|
mkdir -p /etc/sssd/pki
|
|
cat /usr/share/ca-certificates/orange/*.crt \
|
|
> /etc/sssd/pki/sssd_auth_ca_db.pem
|
|
|
|
# configure pam-pkcs11
|
|
if [ -d /etc/pam_pkcs11 ] ; then
|
|
# add Orange certificates
|
|
mkdir -p /etc/pam_pkcs11/cacerts
|
|
cp /usr/share/ca-certificates/orange/* /etc/pam_pkcs11/cacerts
|
|
(cd /etc/pam_pkcs11/cacerts && pkcs11_make_hash_link ) || true
|
|
# generate uid mapping from /etc/passwd
|
|
pkcs11_generate_uids || true
|
|
# Note: PAM module pkcs11 cannot be configured using command
|
|
# pam-auth-update because package libpam-pkcs11 does not provide
|
|
# a config file in dir /usr/share/pam-configs.
|
|
fi
|
|
|
|
# Configure PAM for credential cache
|
|
apt-mark manual libpam-ccreds >/dev/null || true
|
|
if [ -e /usr/share/pam-configs/ccreds-check ] ; then
|
|
pam-auth-update --force --package --enable \
|
|
ccreds-check ccreds-save || true
|
|
fi
|
|
|
|
# Configure PAM for Kerberos
|
|
if [ -e /usr/share/pam-configs/sss ] ; then
|
|
# Use pam-sss if present and disable pam-krb5
|
|
echo "Using pam-sss ..."
|
|
pam-auth-update --force --package --enable sss || true
|
|
pam-auth-update --force --package --remove krb5 || true
|
|
elif [ -e /usr/share/pam-configs/krb5 ] ; then
|
|
echo "Using pam-krb5 ..."
|
|
pam-auth-update --force --package --enable krb5 || true
|
|
else
|
|
echo "Warning: no PAM config for Kerberos found!"
|
|
fi
|
|
|
|
# fix sssd configuration permissions
|
|
chmod 600 /etc/sssd/sssd.conf || true
|
|
# restart services
|
|
deb-systemd-invoke restart sssd.service || true
|
|
;;
|
|
|
|
abort-upgrade|abort-remove|abort-deconfigure)
|
|
;;
|
|
|
|
*)
|
|
echo "postinst called with unknown argument \`$1'" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
# dh_installdeb will replace this with shell code automatically
|
|
# generated by other debhelper scripts.
|
|
|
|
#DEBHELPER#
|
|
|
|
exit 0
|