89 lines
2.6 KiB
Bash
89 lines
2.6 KiB
Bash
#!/bin/sh
|
|
# SPDX-License-Identifier: Orange-InnerSource
|
|
|
|
set -e
|
|
|
|
CONF_FILE="/etc/security/pwquality.conf"
|
|
|
|
yd_update_keyval() { # file key value...
|
|
local file="$1" key="$2" ; shift 2
|
|
# delete line starting with key then append to the end
|
|
sed -e "/^[ \t]*$key[ \t]\=/d" -e "\$a$key = $*" -i "$file"
|
|
}
|
|
|
|
case "$1" in
|
|
configure)
|
|
# Enable GDM customization
|
|
if command -v /usr/bin/dconf >/dev/null ; then
|
|
dconf update
|
|
fi
|
|
|
|
# Configure NSS for pam-pkcs11 and pam-sss
|
|
mkdir -p /etc/pki/nssdb
|
|
orange-certupdate /etc/pki/nssdb >/dev/null || true
|
|
orange-dongle-aladdin --force update /etc/pki/nssdb || true
|
|
|
|
# Configure certificates for SSSD (OpenSSL)
|
|
mkdir -p /etc/sssd/pki
|
|
cat /usr/share/ca-certificates/orange/*.crt \
|
|
> /etc/sssd/pki/sssd_auth_ca_db.pem
|
|
|
|
# Configure pam-pkcs11
|
|
if [ -d /etc/pam_pkcs11 ] ; then
|
|
# add Orange certificates
|
|
mkdir -p /etc/pam_pkcs11/cacerts
|
|
cp /usr/share/ca-certificates/orange/* /etc/pam_pkcs11/cacerts
|
|
(cd /etc/pam_pkcs11/cacerts && pkcs11_make_hash_link ) || true
|
|
# generate uid mapping from /etc/passwd
|
|
pkcs11_generate_uids || true
|
|
# Note: PAM module pkcs11 cannot be configured using command
|
|
# pam-auth-update because package libpam-pkcs11 does not provide
|
|
# a config file in dir /usr/share/pam-configs.
|
|
fi
|
|
|
|
# Configure PAM
|
|
pam-auth-update --package \
|
|
--remove sss krb5 \
|
|
--enable yourdev ccreds-check ccreds-save || true
|
|
for profile in sss krb5 yourdev ; do
|
|
grep -qw "$profile" /var/lib/pam/seen \
|
|
|| echo "$profile" >> /var/lib/pam/seen || true
|
|
done
|
|
|
|
# Fix sssd configuration permissions
|
|
chmod 600 /etc/sssd/sssd.conf || true
|
|
# Restart services
|
|
deb-systemd-invoke restart sssd.service || true
|
|
;;
|
|
|
|
abort-upgrade|abort-remove|abort-deconfigure)
|
|
;;
|
|
|
|
*)
|
|
echo "postinst called with unknown argument \`$1'" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
# Min size of password
|
|
yd_update_keyval "$CONF_FILE" "minlen" "12"
|
|
|
|
# Lowercase char (-1 => min 1 char)
|
|
yd_update_keyval "$CONF_FILE" "lcredit" "-1"
|
|
|
|
# Uppercase char (-1 => min 1 char)
|
|
yd_update_keyval "$CONF_FILE" "ucredit" "-1"
|
|
|
|
# Decimal char (-1 => min 1 char)
|
|
yd_update_keyval "$CONF_FILE" "dcredit" "-1"
|
|
|
|
# Other char (-1 => min 1 char)
|
|
yd_update_keyval "$CONF_FILE" "ocredit" "-1"
|
|
|
|
# dh_installdeb will replace this with shell code automatically
|
|
# generated by other debhelper scripts.
|
|
|
|
#DEBHELPER#
|
|
|
|
exit 0
|