4d5cfa9d91
Force non-interactive mode to avoid useless debconf message about conflict between sss and yourdev profiles. Solves #12
68 lines
2.1 KiB
Bash
68 lines
2.1 KiB
Bash
#!/bin/sh
|
|
# SPDX-License-Identifier: Orange-InnerSource
|
|
|
|
set -e
|
|
|
|
case "$1" in
|
|
configure)
|
|
# Enable GDM customization
|
|
if command -v /usr/bin/dconf >/dev/null ; then
|
|
dconf update
|
|
fi
|
|
|
|
# Configure NSS for pam-pkcs11 and pam-sss
|
|
mkdir -p /etc/pki/nssdb
|
|
orange-certupdate /etc/pki/nssdb >/dev/null || true
|
|
orange-dongle-aladdin --force update /etc/pki/nssdb || true
|
|
|
|
# Configure certificates for SSSD (OpenSSL)
|
|
mkdir -p /etc/sssd/pki
|
|
cat /usr/share/ca-certificates/orange/*.crt \
|
|
> /etc/sssd/pki/sssd_auth_ca_db.pem
|
|
|
|
# Configure pam-pkcs11
|
|
if [ -d /etc/pam_pkcs11 ] ; then
|
|
# add Orange certificates
|
|
mkdir -p /etc/pam_pkcs11/cacerts
|
|
cp /usr/share/ca-certificates/orange/* /etc/pam_pkcs11/cacerts
|
|
(cd /etc/pam_pkcs11/cacerts && pkcs11_make_hash_link ) || true
|
|
# generate uid mapping from /etc/passwd
|
|
pkcs11_generate_uids || true
|
|
# Note: PAM module pkcs11 cannot be configured using command
|
|
# pam-auth-update because package libpam-pkcs11 does not provide
|
|
# a config file in dir /usr/share/pam-configs.
|
|
fi
|
|
|
|
# Configure PAM
|
|
# Force non-interactive mode to avoid useless debconf message
|
|
# about conflict between sss and yourdev profiles (see #12)
|
|
DEBIAN_FRONTEND=noninteractive pam-auth-update --package \
|
|
--remove sss krb5 \
|
|
--enable yourdev ccreds-check ccreds-save || true
|
|
for profile in sss krb5 yourdev ; do
|
|
grep -qw "$profile" /var/lib/pam/seen \
|
|
|| echo "$profile" >> /var/lib/pam/seen || true
|
|
done
|
|
|
|
# Fix sssd configuration permissions
|
|
chmod 600 /etc/sssd/sssd.conf || true
|
|
# Restart services
|
|
deb-systemd-invoke restart sssd.service || true
|
|
;;
|
|
|
|
abort-upgrade|abort-remove|abort-deconfigure)
|
|
;;
|
|
|
|
*)
|
|
echo "postinst called with unknown argument \`$1'" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
# dh_installdeb will replace this with shell code automatically
|
|
# generated by other debhelper scripts.
|
|
|
|
#DEBHELPER#
|
|
|
|
exit 0
|