[Mageia-sysadm] pam ldap deployement tonight

Wed Nov 24 02:11:27 CET 2010

Le mardi 23 novembre 2010 à 18:22 +0100, Michael Scherer a écrit :
+> Ok so everything is in the title.
+> 
+> I will deploy tonight pam_ldap on valstar, likely after midnight. I will
+> warn on irc ( #mageia-sysadm ) before, people should expect potential
+> unavailability of the service.  
+
+So, as said, I did it on 1h CEST.
+
+I have removed accounts from /etc/shadow and others files, and I have
+reassigned files to their owner. Everybody will be in mga-users by
+default.
+
+Since some people were not in ldap, I have sent them a mail and take
+care of that.
+
+And some accounts were surprising :
+- mageia
+- pacha 
+
+I suspect the first one is the user that replaced the mandrake one, but
+I think we decided to use more descriptive name. SO I think we can
+remove it.
+
+Pacha is a user created the 5 november, and never connected, nor did
+anything. I suspect this was a test user, so I guess we can remove it
+too ?
+
+I have also promoted olivier burger as commiter, as asked on #mageia-web
+today. I will see with him how it goes for our first real pure ldap
+user, who is not admin ( I think I may have did something wrong in
+system-auth with required/sufficient ). 
+
+Next thing to do : 
+- fix stuff not working ( just in case )
+- reassign svn repository to the proper group ( mga-commiters ).
+  - use svn::repository to handle them 
+
+- add a secondary ldap on krampouizh 
+- make sure pam_ldap use the 2 ldap
+
+> Please be sure that your account in catdap is correct. Please also make
+> sure that the ssh keys is ok. For now, we do not have decided to roll
+> out the ssh key deployment from ldap ( ie, this requires some test ) but
+> since buchan has enabled it in catdap, please add your key there ( and
+> send us bugs and feedback ). 
+
+I have tested this too in the evening, and basically, after fighting
+against puppet parser, I think I managed to make him do what I wanted. I
+have checked, this will not break the ssh root access. 
+
+Next steps :
+- add our ssh keys in catdap ( since buchan added the support for it )
+- check that the key is properly extracted on a testvm and that
+everything still work
+- migrate on this scheme.
+
+
+-- 
+Michael Scherer
+
+