aboutsummaryrefslogtreecommitdiffstats
path: root/deployment/access_classes
diff options
context:
space:
mode:
authorMichael Scherer <misc@mageia.org>2011-01-13 20:07:12 +0000
committerMichael Scherer <misc@mageia.org>2011-01-13 20:07:12 +0000
commitde5d12a142814441c921a34beb4f9eaf6fcf5a91 (patch)
tree882fb19033d08277c759b77f87fcda4b76865ecb /deployment/access_classes
parent4c3d756ced226a845b63b00d93e7cc10592fb8a8 (diff)
downloadpuppet-de5d12a142814441c921a34beb4f9eaf6fcf5a91.tar
puppet-de5d12a142814441c921a34beb4f9eaf6fcf5a91.tar.gz
puppet-de5d12a142814441c921a34beb4f9eaf6fcf5a91.tar.bz2
puppet-de5d12a142814441c921a34beb4f9eaf6fcf5a91.tar.xz
puppet-de5d12a142814441c921a34beb4f9eaf6fcf5a91.zip
rename access_class to access_classes ( better from a grammatical point of view )
Diffstat (limited to 'deployment/access_classes')
-rw-r--r--deployment/access_classes/manifests/init.pp33
1 files changed, 33 insertions, 0 deletions
diff --git a/deployment/access_classes/manifests/init.pp b/deployment/access_classes/manifests/init.pp
new file mode 100644
index 00000000..5a380907
--- /dev/null
+++ b/deployment/access_classes/manifests/init.pp
@@ -0,0 +1,33 @@
+class access_classes {
+
+ # beware , theses classes are exclusives
+ # if you need multiple group access, you need to define you own class
+ # of access
+
+ # for server where only admins can connect
+ class admin {
+ pam::multiple_ldap_access { "admin":
+ access_classes => ['mga-sysadmin']
+ }
+ }
+
+ # for server where people can connect with ssh ( git, svn )
+ class committers {
+ # this is required, as we force the shell to be the restricted one
+ # openssh will detect if the file do not exist and while refuse to log the
+ # user, and erase the password ( see pam_auth.c in openssh code, seek badpw )
+ # so the file must exist
+ # permission to use svn, git, etc must be added separatly
+
+ pam::multiple_ldap_access { "committers":
+ access_classes => ['mga-committers'],
+ restricted_shell => true,
+ }
+ }
+
+ class iso_makers {
+ pam::multiple_ldap_access { "iso_makers":
+ access_classes => ['mga-iso_makers','mga-sysadmin']
+ }
+ }
+}