b03d583f88
Mark PAM profiles krb5, sss and yourdev as "seen" in /var/lib/pam so next execution of command /usr/sbin/pam-auth-update in interactive mode will ignore the values of 'Default' properties. This avoids the automatic selection of the sss profile, which conflicts with the yourdev profile.
64 lines
1.9 KiB
Bash
64 lines
1.9 KiB
Bash
#!/bin/sh
|
|
set -e
|
|
|
|
case "$1" in
|
|
configure)
|
|
# Enable GDM customization
|
|
if command -v /usr/bin/dconf >/dev/null ; then
|
|
dconf update
|
|
fi
|
|
|
|
# Configure NSS for pam-pkcs11 and pam-sss
|
|
mkdir -p /etc/pki/nssdb
|
|
orange-certupdate /etc/pki/nssdb >/dev/null || true
|
|
orange-dongle-aladdin --force update /etc/pki/nssdb || true
|
|
|
|
# Configure certificates for SSSD (OpenSSL)
|
|
mkdir -p /etc/sssd/pki
|
|
cat /usr/share/ca-certificates/orange/*.crt \
|
|
> /etc/sssd/pki/sssd_auth_ca_db.pem
|
|
|
|
# Configure pam-pkcs11
|
|
if [ -d /etc/pam_pkcs11 ] ; then
|
|
# add Orange certificates
|
|
mkdir -p /etc/pam_pkcs11/cacerts
|
|
cp /usr/share/ca-certificates/orange/* /etc/pam_pkcs11/cacerts
|
|
(cd /etc/pam_pkcs11/cacerts && pkcs11_make_hash_link ) || true
|
|
# generate uid mapping from /etc/passwd
|
|
pkcs11_generate_uids || true
|
|
# Note: PAM module pkcs11 cannot be configured using command
|
|
# pam-auth-update because package libpam-pkcs11 does not provide
|
|
# a config file in dir /usr/share/pam-configs.
|
|
fi
|
|
|
|
# Configure PAM
|
|
pam-auth-update --package \
|
|
--remove sss krb5 \
|
|
--enable yourdev ccreds-check ccreds-save || true
|
|
for profile in sss krb5 yourdev ; do
|
|
grep -qw "$profile" /var/lib/pam/seen \
|
|
|| echo "$profile" >> /var/lib/pam/seen || true
|
|
done
|
|
|
|
# Fix sssd configuration permissions
|
|
chmod 600 /etc/sssd/sssd.conf || true
|
|
# Restart services
|
|
deb-systemd-invoke restart sssd.service || true
|
|
;;
|
|
|
|
abort-upgrade|abort-remove|abort-deconfigure)
|
|
;;
|
|
|
|
*)
|
|
echo "postinst called with unknown argument \`$1'" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
# dh_installdeb will replace this with shell code automatically
|
|
# generated by other debhelper scripts.
|
|
|
|
#DEBHELPER#
|
|
|
|
exit 0
|