diff options
author | Michael Scherer <misc@mageia.org> | 2011-01-13 18:12:32 +0000 |
---|---|---|
committer | Michael Scherer <misc@mageia.org> | 2011-01-13 18:12:32 +0000 |
commit | 92d55871e5bc152f00464daffd5b80f8871d1a15 (patch) | |
tree | 973faad776df49061ff5ae95b9f306c77686a25a /deployment | |
parent | d3afcb16658f3486a4a41fcd57a2b067e4848ce7 (diff) | |
download | puppet-92d55871e5bc152f00464daffd5b80f8871d1a15.tar puppet-92d55871e5bc152f00464daffd5b80f8871d1a15.tar.gz puppet-92d55871e5bc152f00464daffd5b80f8871d1a15.tar.bz2 puppet-92d55871e5bc152f00464daffd5b80f8871d1a15.tar.xz puppet-92d55871e5bc152f00464daffd5b80f8871d1a15.zip |
move the type of access_class to deployment ( as this is tied to our group name )
Diffstat (limited to 'deployment')
-rw-r--r-- | deployment/access_class/manifests/init.pp | 28 |
1 files changed, 28 insertions, 0 deletions
diff --git a/deployment/access_class/manifests/init.pp b/deployment/access_class/manifests/init.pp new file mode 100644 index 00000000..c2bbd5f8 --- /dev/null +++ b/deployment/access_class/manifests/init.pp @@ -0,0 +1,28 @@ +class access_class { + + # beware , theses classes are exclusives + # if you need multiple group access, you need to define you own class + # of access + + # for server where only admins can connect + class admin { + pam::multiple_ldap_access { "admin": + access_classes => ['mga-sysadmin'] + } + } + + # for server where people can connect with ssh ( git, svn ) + class committers { + # this is required, as we force the shell to be the restricted one + # openssh will detect if the file do not exist and while refuse to log the + # user, and erase the password ( see pam_auth.c in openssh code, seek badpw ) + # so the file must exist + # permission to use svn, git, etc must be added separatly + + include restrictshell::shell + + pam::multiple_ldap_access { "committers": + access_classes => ['mga-commiters'] + } + } +} |