ccb17c7352
With default priority (128), pam-auth-update put module pam_sss after module pam_unix in /etc/pam.d/common-auth, and then a user with a local account and local password synchronized with AD password will never be granted a Kerberos TGT on session opening.
60 lines
1.7 KiB
Bash
60 lines
1.7 KiB
Bash
#!/bin/sh
|
|
set -e
|
|
|
|
case "$1" in
|
|
configure)
|
|
# Enable GDM customization
|
|
if command -v /usr/bin/dconf >/dev/null ; then
|
|
dconf update
|
|
fi
|
|
|
|
# Configure NSS for pam-pkcs11 and pam-sss
|
|
mkdir -p /etc/pki/nssdb
|
|
orange-certupdate /etc/pki/nssdb >/dev/null || true
|
|
orange-dongle-aladdin --force update /etc/pki/nssdb || true
|
|
|
|
# Configure certificates for SSSD (OpenSSL)
|
|
mkdir -p /etc/sssd/pki
|
|
cat /usr/share/ca-certificates/orange/*.crt \
|
|
> /etc/sssd/pki/sssd_auth_ca_db.pem
|
|
|
|
# Configure pam-pkcs11
|
|
if [ -d /etc/pam_pkcs11 ] ; then
|
|
# add Orange certificates
|
|
mkdir -p /etc/pam_pkcs11/cacerts
|
|
cp /usr/share/ca-certificates/orange/* /etc/pam_pkcs11/cacerts
|
|
(cd /etc/pam_pkcs11/cacerts && pkcs11_make_hash_link ) || true
|
|
# generate uid mapping from /etc/passwd
|
|
pkcs11_generate_uids || true
|
|
# Note: PAM module pkcs11 cannot be configured using command
|
|
# pam-auth-update because package libpam-pkcs11 does not provide
|
|
# a config file in dir /usr/share/pam-configs.
|
|
fi
|
|
|
|
# Configure PAM
|
|
pam-auth-update --package \
|
|
--remove sss krb5 \
|
|
--enable yourdev ccreds-check ccreds-save || true
|
|
|
|
# Fix sssd configuration permissions
|
|
chmod 600 /etc/sssd/sssd.conf || true
|
|
# Restart services
|
|
deb-systemd-invoke restart sssd.service || true
|
|
;;
|
|
|
|
abort-upgrade|abort-remove|abort-deconfigure)
|
|
;;
|
|
|
|
*)
|
|
echo "postinst called with unknown argument \`$1'" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
# dh_installdeb will replace this with shell code automatically
|
|
# generated by other debhelper scripts.
|
|
|
|
#DEBHELPER#
|
|
|
|
exit 0
|