FindPage
View Source:
KnowledgeBase/FreeBSD/NIS4Jails
Note:
You are viewing an old version of this page.
View the current version.
On host: Assuming NIS domain name 'cdn-mtumishi' and a master of 'master.mtumishi.cyberleo.net': /etc/rc.conf: <code brush="bash"> # Jail networking gateway_enable="YES" cloned_interfaces="lo1" ipv4_addrs_lo1="10.4.4.1-7/24" # NIS stuff nisdomainname="cdn-mtumishi" rpcbind_enable="YES" rpcbind_flags="-h 10.4.4.1" nis_server_enable="YES" nis_server_flags="-h 127.0.0.1 -h 10.4.4.1" nis_yppasswdd_enable="YES" nis_yppasswdd_flags="-a -v" nis_client_enable="YES" nis_client_flags="-m -S cdn-mtumishi,master" </code> /etc/hosts: <code brush="plain"> 10.4.4.1 master.mtumishi.cyberleo.net master 10.4.4.* other jail names </code> Populate /var/yp/master.passwd with the master list; same format as /etc/master.passwd Then start services rpcbind, ypserv, yppasswdd, ypbind in that order. Some may not start until after the NIS domain is initialized fully. Initialize the NIS domain <code brush="bash"> ypinit -m cdn-mtumishi </code> Populate /var/yp/ypservers with the list of servers; currently fqdn and short-dn <code brush="plain"> master.mtumishi.cyberleo.net master.mtumishi.cyberleo.net master master </code> Populate /var/yp/securenets with the network information <code brush="plain"> # allow connections from local host -- mandatory 127.0.0.1 255.255.255.255 # allow connections from private subnet 10.4.4.0 255.255.255.0 </code> Populate /var/yp/netgroup according to your allocation policy: <code brush="plain"> # Group definitions U-ADMINS (,adminusername,cdn-mtumishi) (,anotheradmin,cdn-mtumishi) U-EVERYONE U-ADMINS (,mortaluser,cdn-mtumishi) (,anothermortal,cdn-mtumishi) # Host definitions H-MASTER U-ADMINS H-PUB U-EVERYONE H-MAIN U-ADMINS (,mortaluser,cdn-mtumishi) </code> Then invoke 'make' in /var/yp to populate NIS databases. Remember to invoke 'make' to rebuild maps after changing anything that might be exported; look in /var/yp/cdn-mtumishi for details. Then restart services rpcbind, ypserv, yppasswdd, ypbind in that order, now that the NIS domain is fully initialized. Append to host /etc/master.passwd the magic import string, which will import all authorized users as-is, and all other users with a replacement 'nologin' shell. Leave off the last line to avoid importing users who cannot log in anyways. <code brush="plain"> +@MASTER::::::::: +:::::::::/usr/sbin/nologin </code> Append to host /etc/group the magic import string, which will import all groups and star out their passwords: <code brush="plain"> +:*:: </code> Use ypwhich to see what the current ypbind is bound to; use ypcat passwd to retrieve a map from NIS. Use ypchsh to try and change information. ---- When creating a new jail, do this: In master: Add H-SHORTHOSTNAME to /var/yp/netgroup and assign ADMINS and whomever else should have access In jail: append /etc/rc.conf <code brush="bash"> nisdomainname="cdn-mtumishi" nis_client_enable="YES" nis_client_flags="-m -S cdn-mtumishi,master" </code> append /etc/hosts <code brush="plain"> 10.4.4.1 master.mtumishi.cyberleo.net master </code> patch /etc/nsswitch.conf <code brush="diff"> -hosts: files dns +hosts: files nis dns </code> append /etc/master.passwd <code brush="plain"> +@H-SHORTHOSTNAME::::::::: +:::::::::/usr/sbin/nologin </code> append /etc/group <code brush="plain"> +:*:: </code> configure pam_exec to create home directories upon first user login /root/bin/check_user.sh: <code brush="bash"> #!/bin/sh -e # Runs as root with an environment like this: #PAM_SM_FUNC=pam function #PWD=/ #PAM_RHOST=remote host #PAM_SERVICE=service #PAM_USER=username # # PAM_SM_FUNC can be one of: # auth: # - pam_sm_setcred # - pam_sm_authenticate # account: # - pam_sm_acct_mgmt # session: # - pam_sm_open_session # - pam_sm_close_session # password: # - pam_sm_chauthtok # Check that the user's homedir exists; if not, create it and populate from the # skel directory /usr/share/skel, a-la adduser USER_HOME="$(sh -c "echo ~${PAM_USER}")" USER_GROUP="$(id -g "${PAM_USER}")" create_home_struct() { # Do nothing [ -e /home -a -e /usr/home ] && return # Nothing exists; create /home with proper permissions [ ! -e /home -a ! -e /usr/home ] && { mkdir -p /home chown root:wheel /home chmod 751 /home } # /usr/home exists, but /home does not; symlink [ ! -e /home -a -e /usr/home ] && { ln -sf usr/home /home } # /home exists, but /usr/home does not; symlink [ -e /home -a ! -e /usr/home ] && { ln -sf ../home /usr/home } } getpwnam() { [ "${1}" ] || return 1 /usr/sbin/pw usershow "${1}" } user_can_login() { IFS=: read login pass uid gid unknown unknown unknown gecos home shell beyond sed -e 's/#.*$//; /^[[:space:]]*$/d' /etc/shells | grep -q "^${shell}$" } create_home_dir() { [ -d "${USER_HOME}" ] && return create_home_struct getpwnam "${PAM_USER}" | user_can_login || return /usr/sbin/pw usermod "${PAM_USER}" -m } case "${PAM_SM_FUNC}" in pam_sm_acct_mgmt) create_home_dir ;; *) ;; esac </code> /etc/pam.d/mkhomedir: <code brush="plain"> # # Create home directory if it does not exist # account optional pam_exec.so -- /root/bin/check_user.sh </code> Patch /etc/pam.d/system <code brush="diff"> +account include mkhomedir </code> Patch /etc/pam.d/sshd <code brush="diff"> +account include mkhomedir </code> Patch /etc/pam.d/other <code brush="diff"> +account include mkhomedir </code> Patch other pam.d files as necessary to enable homedir creation for those services.