[Mageia-sysadm] pam ldap deployement tonight

[Michael Scherer]

Le mardi 23 novembre 2010 à 18:22 +0100, Michael Scherer a écrit :
> Ok so everything is in the title.
> 
> I will deploy tonight pam_ldap on valstar, likely after midnight. I will
> warn on irc ( #mageia-sysadm ) before, people should expect potential
> unavailability of the service.  

So, as said, I did it on 1h CEST.

I have removed accounts from /etc/shadow and others files, and I have
reassigned files to their owner. Everybody will be in mga-users by
default.

Since some people were not in ldap, I have sent them a mail and take
care of that.

And some accounts were surprising :
- mageia
- pacha 

I suspect the first one is the user that replaced the mandrake one, but
I think we decided to use more descriptive name. SO I think we can
remove it.

Pacha is a user created the 5 november, and never connected, nor did
anything. I suspect this was a test user, so I guess we can remove it
too ?

I have also promoted olivier burger as commiter, as asked on #mageia-web
today. I will see with him how it goes for our first real pure ldap
user, who is not admin ( I think I may have did something wrong in
system-auth with required/sufficient ). 

Next thing to do : 
- fix stuff not working ( just in case )
- reassign svn repository to the proper group ( mga-commiters ).
  - use svn::repository to handle them 

- add a secondary ldap on krampouizh 
- make sure pam_ldap use the 2 ldap

> Please be sure that your account in catdap is correct. Please also make
> sure that the ssh keys is ok. For now, we do not have decided to roll
> out the ssh key deployment from ldap ( ie, this requires some test ) but
> since buchan has enabled it in catdap, please add your key there ( and
> send us bugs and feedback ). 

I have tested this too in the evening, and basically, after fighting
against puppet parser, I think I managed to make him do what I wanted. I
have checked, this will not break the ssh root access. 

Next steps :
- add our ssh keys in catdap ( since buchan added the support for it )
- check that the key is properly extracted on a testvm and that
everything still work
- migrate on this scheme.


-- 
Michael Scherer