Skip to content

Commit 14b2f72

Browse files
tiredofittiredofit
committed
saslauthd finalization
1 parent 1892f4c commit 14b2f72

5 files changed

Lines changed: 81 additions & 23 deletions

File tree

‎README.md‎

Lines changed: 26 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -260,21 +260,32 @@ If you already have a check_password.conf or ppm.conf in /etc/openldap/ the foll
260260

261261
#### SASLAuthd Options
262262

263-
| Variable | Description | Default |
264-
| ------------------------------------ | --------------------------------------------- | ---------------------- |
265-
| `ENABLE_SASLAUTHD` | Enable saslauthd daemon | `FALSE` |
266-
| `SASLAUTHD_LOG_TYPE` | Log Type `file` `console` `both` `none` | `both` |
267-
| `SASLAUTHD_LOG_PATH` | Log Path | `/logs/` |
268-
| `SASLAUTHD_LOG_FILE` | Log File | `saslauthd.log` |
269-
| `SASLAUTHD_PATH` | Path for volatile data | `/run/saslauthd/` |
270-
| `SASLAUTHD_COMBINE_REALM` | Combine Realms | `FALSE` |
271-
| `SASLAUTHD_ENABLE_ACCEPT_LOCKING` | Enable accept() Locking | `FALSE` |
272-
| `SASLAUTHD_ENABLE_CREDENTIAL_CACHE` | Enable Credential Caching | `TRUE` |
273-
| `SASLAUTHD_CREDENTIAL_CACHE_SIZE` | Cache size in kilobytes | |
274-
| `SASLAUTHD_CREDENTIAL_CACHE_TIMEOUT` | Cache timeout in seconds | |
275-
| `SASLAUTHD_PROCESSES` | Processes to run (0 dynamic) | `0` |
276-
| `SASLAUTHD_TYPE` | Type when writing `/etc/sasl/slapd.conf` | `pam` |
277-
| `SASLAUTHD_MECH_LIST` | Mech List when writing `/etc/sasl/slapd.conf` | `PLAIN LOGIN EXTERNAL` |
263+
| Variable | Description | Default |
264+
| ------------------------------------ | ------------------------------------------------------------------------------------------ | ------------------------------------------- |
265+
| `ENABLE_SASLAUTHD` | Enable saslauthd daemon | `FALSE` |
266+
| `SASLAUTHD_LOG_TYPE` | Log Type `file` `console` `both` `none` | `both` |
267+
| `SASLAUTHD_LOG_PATH` | Log Path | `/logs/` |
268+
| `SASLAUTHD_LOG_FILE` | Log File | `saslauthd.log` |
269+
| `SASLAUTHD_CONFIG_PATH` | Path for storing SASLAUTHD_SLAPD_CONFIG_FILE - if not default will symlink to this default | `/etc/sasl2/` |
270+
| `SASLAUTHD_SLAPD_CONFIG_FILE` | Configuration file for slapd | `slapd.conf` |
271+
| `SASLAUTHD_RUN_PATH` | Path for volatile data | `/run/saslauthd/` |
272+
| `SASLAUTHD_COMBINE_REALM` | Combine Realms | `FALSE` |
273+
| `SASLAUTHD_ENABLE_ACCEPT_LOCKING` | Enable accept() Locking | `FALSE` |
274+
| `SASLAUTHD_ENABLE_CREDENTIAL_CACHE` | Enable Credential Caching | `TRUE` |
275+
| `SASLAUTHD_CREDENTIAL_CACHE_SIZE` | Cache size in kilobytes | |
276+
| `SASLAUTHD_CREDENTIAL_CACHE_TIMEOUT` | Cache timeout in seconds | |
277+
| `SASLAUTHD_PROCESSES` | Processes to run (0 dynamic) | `0` |
278+
| `SASLAUTHD_AUTO_CONFIGURE` | Auto configure ${SASLAUTHD_CONFIG_PATH}/${SASLAUTHD_SLAPD_CONFIG_FILE} | `TRUE` |
279+
| `SASLAUTHD_SLAPD_TYPE` | Type when writing `/etc/sasl/slapd.conf` | `pam` |
280+
| `SASLAUTHD_MECH_LIST` | Mech List when writing `/etc/sasl/slapd.conf` | `PLAIN LOGIN EXTERNAL` |
281+
| `SASLAUTHD_SLAPD_TYPE` | | `pam` |
282+
| `SASLAUTHD_PAM_CONFIG_PATH` | Pam Configuration path - If not default will symlink to this | `/etc/pam/` |
283+
| `SASLAUTHD_SLAPD_PAM_FILE` | Pam Configuration file - If not default will symlink to this | `ldap` |
284+
| `SASLAUTHD_PAM_AUTO_CONFIGURE` | Auto configure ${SASLAUTHD_PAM_CONFIG_PATH}/${SASLAUTHD_PAM_SLAPD_CONFIG_FILE} | `TRUE` |
285+
| `SASLAUTHD_PAM_LDAP_AUTH_ENTRY` | Auth line entry | see second line |
286+
| | `required pam_exec.so debug expose_authtok` | |
287+
| `SASLAUTHD_PAM_LDAP_ACCOUNT_ENTRY` | Account line entry | see second line |
288+
| | ``required pam_permit.so` | |
278289

279290
## Users and Groups
280291

‎rootfs/container/defaults/30-saslauthd‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,22 @@
22
#
33
# SPDX-License-Identifier: MIT
44

5-
ENABLE_SASLAUTHD=${ENABLE_SASLAUTHD:-"FALSE"}
5+
ENABLE_SASLAUTHD=${ENABLE_SASLAUTHD:-"TRUE"}
6+
SASLAUTHD_AUTO_CONFIGURE=${SASLAUTHD_AUTO_CONFIGURE:-"TRUE"}
67
SASLAUTHD_COMBINE_REALM=${SASLAUTHD_COMBINE_REALM:-"FALSE"}
8+
SASLAUTHD_CONFIG_PATH=${SASLAUTHD_CONFIG_PATH:-"/etc/sasl2"}
79
SASLAUTHD_ENABLE_ACCEPT_LOCKING=${SASLAUTHD_ENABLE_ACCEPT_LOCKING:-"FALSE"}
810
SASLAUTHD_ENABLE_CREDENTIAL_CACHE=${SASLAUTHD_ENABLE_CREDENTIAL_CACHE:-"TRUE"}
911
SASLAUTHD_LOG_FILE=${SASLAUTHD_LOG_FILE:-"saslauthd.log"}
1012
SASLAUTHD_LOG_PATH=${SASLAUTH_LOG_PATH:-"/logs/"}
1113
SASLAUTHD_LOG_TYPE=${SASLAUTHD_LOG_TYPE:-"FILE"}
1214
SASLAUTHD_MECH_LIST=${SASLAUTHD_MECH_LIST:-"PLAIN LOGIN EXTERNAL"}
13-
SASLAUTHD_PATH=${SASLAUTHD_PATH:-"/run/saslauthd/"}
15+
SASLAUTHD_PAM_AUTO_CONFIGURE=${SASLAUTHD_PAM_AUTO_CONFIGURE:-"TRUE"}
16+
SASLAUTHD_PAM_LDAP_ACCOUNT_ENTRY=${SASLAUTHD_PAM_LDAP_ACCOUNT_ENTRY:-"required pam_permit.so"}
17+
SASLAUTHD_PAM_LDAP_AUTH_ENTRY=${SASLAUTHD_PAM_LDAP_AUTH_ENTRY:-"required pam_exec.so debug expose_authtok"}
1418
SASLAUTHD_PROCESSES=${SASLAUTHD_PROCESSES:-"0"}
15-
SASLAUTHD_TYPE=${SASLAUTHD_TYPE:-"pam"}
19+
SASLAUTHD_RUN_PATH=${SASLAUTHD_RUN_PATH:-"/run/saslauthd/"}
20+
SASLAUTHD_SLAPD_CONFIG_FILE=${SASLAUTHD_SLAPD_CONFIG_FILE:-"slapd.conf"}
21+
SASLAUTHD_PAM_CONFIG_PATH=${SASLAUTHD_PAM_CONFIG_PATH:-"/etc/pam/"}
22+
SASLAUTHD_SLAPD_PAM_FILE=${SASLAUTHD_SLAPD_PAM_FILE:-"ldap"}
23+
SASLAUTHD_SLAPD_TYPE=${SASLAUTHD_TYPE:-"pam"}

‎rootfs/container/functions/30-saslauthd‎

Lines changed: 41 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,20 +3,58 @@
33
# SPDX-License-Identifier: MIT
44

55
saslauthd_bootstrap_filesystem() {
6-
create_folder "${SASLAUTHD_PATH}" root:root 755
6+
if [ "${SASLAUTHD_CONFIG_PATH%/}" != "/etc/sasl2" ] ; then
7+
rm -rf /etc/sasl2
8+
ln -sf "${SASLAUTHD_CONFIG_PATH%/}" /etc/sasl2
9+
fi
10+
create_folder "${SASLAUTHD_CONFIG_PATH}" root:ldap 750 force
711
case "${SASLAUTHD_LOG_TYPE,,}" in
812
file | both )
913
touch "${SASLAUTHD_LOG_PATH%/}"/"${SASLAUTHD_LOG_FILE}"
1014
saslauthd_log_file="${SASLAUTHD_LOG_PATH%/}"/"${SASLAUTHD_LOG_FILE}"
1115
create_logrotate saslauthd "${SASLAUTHD_LOG_PATH%/}"/"${SASLAUTHD_LOG_FILE}" none root root
1216
;;
1317
esac
18+
19+
create_folder "${SASLAUTHD_RUN_PATH%/}" root:ldap 750 force
1420
}
1521

22+
1623
saslauthd_configure_daemon() {
17-
write_file /etc/sasl2/slapd.conf:600 <<EOF
24+
if var_true "${SASLAUTHD_AUTO_CONFIGURE}" ; then
25+
write_file "${SASLAUTHD_CONFIG_PATH%/}"/"${SASLAUTHD_SLAPD_CONFIG_FILE}":640 <<EOF
1826
pwcheck_method: saslauthd
19-
saslauthd_path: ${SASLAUTHD_PATH}/mux
27+
saslauthd_path: ${SASLAUTHD_RUN_PATH}/mux
2028
mech_list: ${SASLAUTHD_MECH_LIST}
2129
EOF
30+
else
31+
print_warning "SASLAUTHD_AUTO_CONFIGURE is disabled, skipping automatic configuration for saslauthd. Ensure that the appropriate configuration files are mounted at ${SASLAUTHD_CONFIG_PATH%/}/${SASLAUTHD_SLAPD_CONFIG_FILE} and ${SASLAUTHD_PAM_CONFIG_PATH%/}/${SASLAUTHD_PAM_LDAP_CONFIG_FILE} with the necessary entries for saslauthd"
32+
chmod 640 "${SASLAUTHD_CONFIG_PATH%/}"/"${SASLAUTHD_SLAPD_CONFIG_FILE}"
33+
chown root:ldap "${SASLAUTHD_CONFIG_PATH%/}"/"${SASLAUTHD_SLAPD_CONFIG_FILE}"
34+
fi
35+
}
36+
37+
saslauthd_configure_pam() {
38+
if [ "${SASLAUTHD_SLAPD_TYPE,,}" = "pam" ] ; then
39+
print_notice "Configuring PAM for saslauthd/slapd"
40+
if [ -n "${SASLAUTHD_LDAP_PAM_CONFIG_FILE}" ] ; then
41+
ln -s "${SASLAUTHD_PAM_CONFIG_PATH%/}"/"${SASLAUTHD_PAM_LDAP_CONFIG_FILE}" /etc/pam.d/ldap
42+
fi
43+
44+
if [ "${SASLAUTHD_PAM_CONFIG_PATH%/}" != "/etc/pam" ] && [ "${SASLAUTHD_PAM_LDAP_CONFIG_FILE}" != "ldap" ] ; then
45+
rm -rf /etc/pam/ldap
46+
ln -s "${SASLAUTHD_PAM_CONFIG_PATH%/}"/"${SASLAUTHD_PAM_LDAP_CONFIG_FILE}" /etc/pam.d/ldap
47+
fi
48+
if var_true "${SASLAUTHD_PAM_AUTO_CONFIGURE}" ; then
49+
write_file "${SASLAUTHD_PAM_CONFIG_PATH%/}"/"${SASLAUTHD_PAM_LDAP_CONFIG_FILE}":700 <<EOF
50+
auth ${SASLAUTHD_PAM_LDAP_AUTH_ENTRY}
51+
account ${SASLAUTHD_PAM_LDAP_ACCOUNT_ENTRY}
52+
EOF
53+
else
54+
chmod 644 "${SASLAUTHD_PAM_CONFIG_PATH%/}"/"${SASLAUTHD_PAM_LDAP_CONFIG_FILE}"
55+
chown root:ldap "${SASLAUTHD_PAM_CONFIG_PATH%/}"/"${SASLAUTHD_PAM_LDAP_CONFIG_FILE}"
56+
print_warning "SASLAUTHD_PAM_AUTO_CONFIGURE is disabled, skipping PAM configuration for saslauthd. Ensure that the appropriate PAM configuration file is mounted at ${SASLAUTHD_PAM_CONFIG_PATH%/}/${SASLAUTHD_PAM_LDAP_CONFIG_FILE} with the necessary auth and account entries for saslauthd"
57+
fi
58+
fi
2259
}
60+
dcu

‎rootfs/container/init/init.d/30-saslauthd‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ if var_true "${ENABLE_SASLAUTHD}" ; then
1111
print_notice "Configuring saslauthd"
1212
saslauthd_bootstrap_filesystem
1313
saslauthd_configure_daemon
14+
saslauthd_configure_pam
1415
else
1516
print_debug "Disabling saslauthd"
1617
service_stop 30-saslauthd

‎rootfs/container/run/available/30-saslauthd/run‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ _exec_log() {
5757
print_start "Starting SASL Authentication Daemon"
5858
_exec_log "${SASLAUTHD_LOG_TYPE}" "${saslauthd_log_file}" \
5959
/usr/sbin/saslauthd \
60-
-m ${SASLAUTHD_PATH} \
61-
-a ${SASLAUTHD_TYPE} \
60+
-m ${SASLAUTHD_RUN_PATH%/} \
61+
-a ${SASLAUTHD_SLAPD_TYPE} \
6262
-n ${SASLAUTHD_PROCESSES} \
6363
-d ${cc_args} ${lock_args} ${combine_realm_arg} ${SASLAUTHD_EXTRA_ARGS}

0 commit comments

Comments
 (0)