diff options
Diffstat (limited to 'deployment/access_class')
-rw-r--r-- | deployment/access_class/manifests/init.pp | 28 |
1 files changed, 28 insertions, 0 deletions
diff --git a/deployment/access_class/manifests/init.pp b/deployment/access_class/manifests/init.pp new file mode 100644 index 00000000..c2bbd5f8 --- /dev/null +++ b/deployment/access_class/manifests/init.pp @@ -0,0 +1,28 @@ +class access_class { + + # beware , theses classes are exclusives + # if you need multiple group access, you need to define you own class + # of access + + # for server where only admins can connect + class admin { + pam::multiple_ldap_access { "admin": + access_classes => ['mga-sysadmin'] + } + } + + # for server where people can connect with ssh ( git, svn ) + class committers { + # this is required, as we force the shell to be the restricted one + # openssh will detect if the file do not exist and while refuse to log the + # user, and erase the password ( see pam_auth.c in openssh code, seek badpw ) + # so the file must exist + # permission to use svn, git, etc must be added separatly + + include restrictshell::shell + + pam::multiple_ldap_access { "committers": + access_classes => ['mga-commiters'] + } + } +} |