From 1be510f9529cb082f802408b472a77d074b394c0 Mon Sep 17 00:00:00 2001 From: Nicolas Vigier Date: Sun, 14 Apr 2013 13:46:12 +0000 Subject: Add zarb MLs html archives --- zarb-ml/mageia-sysadm/2010-November/000885.html | 144 ++++++++++++++++++++++++ 1 file changed, 144 insertions(+) create mode 100644 zarb-ml/mageia-sysadm/2010-November/000885.html (limited to 'zarb-ml/mageia-sysadm/2010-November/000885.html') diff --git a/zarb-ml/mageia-sysadm/2010-November/000885.html b/zarb-ml/mageia-sysadm/2010-November/000885.html new file mode 100644 index 000000000..d20a9b153 --- /dev/null +++ b/zarb-ml/mageia-sysadm/2010-November/000885.html @@ -0,0 +1,144 @@ + + + + [Mageia-sysadm] [451] restrict login to people of the group mga-commiters ( previous try was + + + + + + + + + +

[Mageia-sysadm] [451] restrict login to people of the group mga-commiters ( previous try was

+ root at mageia.org + root at mageia.org +
+ Wed Nov 24 03:50:46 CET 2010 +

+
+ +
Revision: 451
+Author:   misc
+Date:     2010-11-24 03:50:45 +0100 (Wed, 24 Nov 2010)
+Log Message:
+-----------
+restrict login to people of the group mga-commiters ( previous try was
+not working with ssh key )
+
+Modified Paths:
+--------------
+    puppet/modules/pam/manifests/init.pp
+    puppet/modules/pam/templates/system-auth
+
+Modified: puppet/modules/pam/manifests/init.pp
+===================================================================
+--- puppet/modules/pam/manifests/init.pp	2010-11-24 02:08:32 UTC (rev 450)
++++ puppet/modules/pam/manifests/init.pp	2010-11-24 02:50:45 UTC (rev 451)
+@@ -43,14 +43,17 @@
+          content => template("pam/ldap.conf")
+       }
+   } 
+-  
++ 
++  # beware , this two classes are exclusive
++ 
+   # for server where only admins can connect
+-  class admin_access inherits base {
++  class admin_access {
+     $access_class = "admin"
++    include base
+   }
+ 
+   # for server where people can connect with ssh ( git, svn )
+-  class committers_access inherits base {
++  class committers_access {
+     # this is required, as we force the shell to be the restricted one
+     # openssh will detect if the file do not exist and while refuse to log the
+     # user, and erase the password ( see pam_auth.c in openssh code, seek badpw )
+@@ -58,5 +61,6 @@
+     # permission to use svn, git, etc must be added separatly
+     include restrictshell::shell
+     $access_class = "committers"
++    include base
+   }
+ }
+
+Modified: puppet/modules/pam/templates/system-auth
+===================================================================
+--- puppet/modules/pam/templates/system-auth	2010-11-24 02:08:32 UTC (rev 450)
++++ puppet/modules/pam/templates/system-auth	2010-11-24 02:50:45 UTC (rev 451)
+@@ -1,10 +1,4 @@
+ auth    required     pam_env.so
+-<%- if access_class = 'admin' -%>
+-auth    required     pam_succeed_if.so quiet user ingroup mga-sysadmin
+-<%- end -%>
+-<%- if access_class = 'committers' -%>
+-auth    required     pam_succeed_if.so quiet user ingroup mga-committers
+-<%- end -%>
+ # this part is here if the module don't exist
+ # basically, the idea is to copy the exact detail of sufficient,
+ # and add abort=ignore
+@@ -15,6 +9,12 @@
+ 
+ 
+ account sufficient  pam_localuser.so
++<%- if access_class == 'admin' -%>
++account required    pam_succeed_if.so quiet user ingroup mga-sysadmin
++<%- end -%>
++<%- if access_class == 'committers' -%>
++account required    pam_succeed_if.so quiet user ingroup mga-committers
++<%- end -%>
+ account sufficient  pam_ldap.so
+ account required    pam_deny.so
+ 
+-------------- next part --------------
+An HTML attachment was scrubbed...
+URL: </pipermail/mageia-sysadm/attachments/20101124/878396e6/attachment.html>
+
+ + + + + + + + + + + + + + +
+

+ +
+More information about the Mageia-sysadm +mailing list
+ -- cgit v1.2.1