[Git][debian-edu/debian-edu-config][personal/sunweaver/tjener-non-fqdn-hostname] 7 commits: Add new daily running script 'debian-edu-apache2-update-allowlist', which...
"Mike Gabriel (@sunweaver)" <[email protected]>
| Newsgroups | gmane.linux.skolelinux.cvs |
|---|---|
| Message-ID | <[email protected]> |
Mike Gabriel pushed to branch personal/sunweaver/tjener-non-fqdn-hostname at Debian Edu / debian-edu-config Commits: 57b7fda3 by Daniel Teichmann at 2026-08-17T20:34:11+02:00 Add new daily running script 'debian-edu-apache2-update-allowlist', which updates Apache2 'Host:' allowlist. - - - - - 3aaed7b6 by Daniel Teichmann at 2026-08-17T20:34:11+02:00 Apache2 debian-edu-default.conf: Make Tjener be reachable with custom aliases without 302 redirects. + 10.x.x.x/8 is always allowed. + Allows .crt .dat files to be downloaded without HTTPS. + Supports custom aliases using allowlist map at: '/usr/share/debian-edu-config/apache2_host-allowlist.map'. + Allowlist map will be updated by systemd/cron once a day. + Uses predefined fallback (www.intern). - - - - - 1ca2ebec by Daniel Teichmann at 2026-08-17T20:34:11+02:00 Apache2 debian-edu-default.conf: Convert indentation spaces to tabs (whitespace-only). - - - - - 7edfcae0 by Daniel Teichmann at 2026-08-18T10:02:28+02:00 Rename Apache2 host allowlist to TJENER alias map. Avoid confusion with Debian Edu hosts (devices). The map lists HTTP Host header values that refer to TJENER, not client machines. Also document the timer as 15 minutes after boot, then daily, and add the author email to debian-edu-apache2-update-tjener-aliases. - - - - - 71f9695a by Daniel Teichmann at 2026-08-18T18:45:43+02:00 testsuite/ldap-server: Check /var/lib/ldap ownership. Regression check for Debian#1144741 (slapd / systemd-sysusers). debian-edu-config does not create the directory. - - - - - fc292d0d by Mike Gabriel at 2026-08-19T14:30:13+00:00 share/debian-edu-config/d-i/pre-pkgsel: white-space cleanup - - - - - 234d3b0c by Mike Gabriel at 2026-08-19T14:30:13+00:00 share/debian-edu-config/d-i/pre-pkgsel: Use 'tjener' in /etc/hostname and derive FQDN from /etc/hosts. (Closes: #893394). - - - - - 11 changed files: - Makefile - debian/changelog - debian/debian-edu-config.cron.daily - + debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.service - + debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.timer - debian/rules - etc/apache2/sites-available/debian-edu-default.conf - + libexec/debian-edu-apache2-update-tjener-aliases - + share/debian-edu-config/apache2_tjener-aliases.map - share/debian-edu-config/d-i/pre-pkgsel - testsuite/ldap-server Changes: ===================================== Makefile ===================================== @@ -22,6 +22,7 @@ SPROGS = \ $(NULL) LIBEXECPROGS = \ + debian-edu-apache2-update-tjener-aliases \ debian-edu-cups-queue-autoflush-for-netgroup-hosts \ debian-edu-cups-queue-autoreenable-for-netgroup-hosts \ debian-edu-fsautoresize-for-netgroup-hosts \ @@ -360,6 +361,7 @@ install: install-testsuite $(INSTALL_DATA) sbin/debian-edu-fsautoresizetab $(DESTDIR)/usr/share/debian-edu-config/fsautoresizetab set -e ; for f in \ + share/debian-edu-config/apache2_tjener-aliases.map \ share/debian-edu-config/avahi.smb.service \ share/debian-edu-config/rsyslog-collector \ share/debian-edu-config/rsyslog-filters \ ===================================== debian/changelog ===================================== @@ -1,3 +1,11 @@ +debian-edu-config (2.13.1) UNRELEASED; urgency=medium + + [ Daniel Teichmann ] + * testsuite/ldap-server: Check /var/lib/ldap exists and is owned by + openldap:openldap. Regression check for Debian#1144741. + + -- Daniel Teichmann <[email protected]> Tue, 18 Aug 2026 18:45:33 +0200 + debian-edu-config (2.13.0) unstable; urgency=medium [ Mike Gabriel ] ===================================== debian/debian-edu-config.cron.daily ===================================== @@ -9,3 +9,8 @@ export PATH if [ -x /usr/libexec/debian-edu-config/debian-edu-cups-queue-autoflush-for-netgroup-hosts ]; then exec /usr/libexec/debian-edu-config/debian-edu-cups-queue-autoflush-for-netgroup-hosts fi + +# regularly update Apache2 TJENER alias map if the script is present +if [ -x /usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases ]; then + exec /usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases +fi ===================================== debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.service ===================================== @@ -0,0 +1,6 @@ +[Unit] +Description=Update Apache2 TJENER alias map at /usr/share/debian-edu-config/apache2_tjener-aliases.map + +[Service] +Type=oneshot +ExecStart=/usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases ===================================== debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.timer ===================================== @@ -0,0 +1,9 @@ +[Unit] +Description=Run debian-edu-apache2-update-tjener-aliases.service 15 minutes after boot and then once a day. + +[Timer] +OnBootSec=15min +OnUnitActiveSec=1d + +[Install] +WantedBy=timers.target ===================================== debian/rules ===================================== @@ -23,6 +23,7 @@ override_dh_installsystemd: dh_installsystemd --no-start --name firefox-ldapconf dh_installsystemd --no-start --name debian-edu-fsautoresize dh_installsystemd --no-start --name debian-edu-update-netblock + dh_installsystemd --no-start --name debian-edu-apache2-update-tjener-aliases dh_installsystemd --no-start --name debian-edu-cups-queue-autoflush dh_installsystemd --no-start --name debian-edu-cups-queue-autoreenable ===================================== etc/apache2/sites-available/debian-edu-default.conf ===================================== @@ -1,16 +1,37 @@ <VirtualHost *:80> - ServerName www.intern + ServerName www.intern ServerAdmin [email protected] DocumentRoot /etc/debian-edu/www/ +# ---- <TJENER-alias redirect logic> ---- + UseCanonicalName On + + RewriteEngine On + RewriteMap tjeneralias "txt:/usr/share/debian-edu-config/apache2_tjener-aliases.map" + + # 1. Exclusions: Skip the redirect rules entirely for wpad.dat and Debian-Edu_rootCA.crt + RewriteCond %{REQUEST_URI} \.(?:dat|crt)$ [NC] + RewriteRule ^ - [L] + + # 2. Check if the requested HTTP Host matches Edu IP subnet e.g. 10.x.x.x/8 subnet.. + # NOTE: Single IPs should be part of the TJENER alias map. + # NOTE: .999.999 is technically possible, but harmless. + RewriteCond %1 ^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$ [OR] + + # 3. Path A (The Happy Path): HTTP Host is a known TJENER alias + # We strip the port, check the map. If it matches, redirect preserving the requested name. + RewriteCond %{HTTP_HOST} ^([^:]+) + RewriteCond ${tjeneralias:%1|DENY} ^ALLOW$ [NC] + RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L] + + # 4. Path B (The Fallback): HTTP Host is not a known TJENER alias + # If the request makes it past Rule 3 without triggering the [L] flag, + # it means the name was not in the map. We safely redirect to the static ServerName. + RewriteRule ^(.*)$ https://%{SERVER_NAME}/$1 [R=301,L] +# ---- </TJENER-alias redirect logic> ---- + <Directory /etc/debian-edu/www/ > - RewriteEngine On - RewriteCond %{SERVER_PORT} 80 - # HTTP only: wpad.dat + Debian-Edu_rootCA.crt - RewriteCond %{REQUEST_URI} !\.dat$ - RewriteCond %{REQUEST_URI} !\.crt$ - RewriteRule ^(.*)$ https://%{SERVER_ADDRESS}/$1 [R=301,L] Options Indexes FollowSymLinks MultiViews AllowOverride None Require all granted @@ -32,20 +53,20 @@ CustomLog /var/log/apache2/access.log combined ServerSignature On - Alias /doc/ "/usr/share/doc/" - <Directory "/usr/share/doc/"> - Options Indexes MultiViews FollowSymLinks - AllowOverride None + Alias /doc/ "/usr/share/doc/" + <Directory "/usr/share/doc/"> + Options Indexes MultiViews FollowSymLinks + AllowOverride None Require all denied - Allow from 127.0.0.0/255.0.0.0 ::1/128 - </Directory> + Allow from 127.0.0.0/255.0.0.0 ::1/128 + </Directory> - # add alias for munin, though it should really be handled by munin itself, - # rather than assuming /var/www is the defaultroot.. - Alias /munin "/var/cache/munin/www/" - <Directory /var/cache/munin/www/ > + # add alias for munin, though it should really be handled by munin itself, + # rather than assuming /var/www is the defaultroot.. + Alias /munin "/var/cache/munin/www/" + <Directory /var/cache/munin/www/ > Options Indexes FollowSymLinks MultiViews AllowOverride None Require all granted - </Directory> + </Directory> </VirtualHost> ===================================== libexec/debian-edu-apache2-update-tjener-aliases ===================================== @@ -0,0 +1,219 @@ +#!/bin/bash +# +# Author: Daniel 'dzatoah' Teichmann <[email protected]> +# Date: 2026-03-21 +# License: GNU General Public License v2 or later (GPL-2+) +# + +# ============================================================================= +# Queries LDAP for cNAMERecord entries under the Debian Edu DNS zone and +# smartly merges them into the Apache2 TJENER alias map file. +# +# Usage: /usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases +# ============================================================================= + +set -euo pipefail + +# ----------------------------------------------------------------------------- +# Configuration +# ----------------------------------------------------------------------------- +SCRIPT_PATH="/usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases" +MAP_FILE="/usr/share/debian-edu-config/apache2_tjener-aliases.map" +BACKUP_DIR="/var/backups/apache2-tjener-aliases" +LDAP_BASE="relativeDomainName=tjener,zoneName=intern,cn=tjener,ou=servers,ou=systems,dc=skole,dc=skolelinux,dc=no" +LDAP_OPTS="-x" +LOG_TAG="update-apache2-tjener-aliases" + +# Debian Edu default hostnames (short + .intern variants) — always included +# in the auto-generated block regardless of LDAP output. +DEBIAN_EDU_DEFAULTS=( + "www" "www.intern" + "tjener" "tjener.intern" + "ldap" "ldap.intern" +) + +# ----------------------------------------------------------------------------- +# Helpers +# ----------------------------------------------------------------------------- +log() { logger -t "$LOG_TAG" "$*"; echo "[$(date '+%F %T')] $*"; } +die() { log "ERROR: $*"; exit 1; } + +# ----------------------------------------------------------------------------- +# Sanity checks +# ----------------------------------------------------------------------------- +command -v ldapsearch >/dev/null 2>&1 || die "ldapsearch not found. Install ldap-utils." +[[ -d "$(dirname "$MAP_FILE")" ]] || die "Target directory does not exist: $(dirname "$MAP_FILE")" + +# ----------------------------------------------------------------------------- +# Backup existing map file +# ----------------------------------------------------------------------------- +mkdir -p "$BACKUP_DIR" +if [[ -f "$MAP_FILE" ]]; then + BACKUP_FILE="$BACKUP_DIR/apache2_tjener-aliases.map.$(date '+%Y%m%d_%H%M%S')" + cp "$MAP_FILE" "$BACKUP_FILE" + log "Backed up existing map to: $BACKUP_FILE" + + # Prune backups older than 30 days + find "$BACKUP_DIR" -name "apache2_tjener-aliases.map.*" -mtime +30 -delete +fi + +# ----------------------------------------------------------------------------- +# Parse HAND-EDIT block from existing file (preserve user additions) +# ----------------------------------------------------------------------------- +HAND_EDIT_BLOCK="" +if [[ -f "$MAP_FILE" ]]; then + # Extract everything from the HAND-EDIT marker to end of file + HAND_EDIT_BLOCK=$(awk '/^# ----- IMPORTANT HAND-EDIT ADDITIONS -----/{found=1} found{print}' "$MAP_FILE") +fi + +# If there was no hand-edit block yet, use the default placeholder +if [[ -z "$HAND_EDIT_BLOCK" ]]; then + HAND_EDIT_BLOCK='# ----- IMPORTANT HAND-EDIT ADDITIONS ----- +# If a user browses to the raw IP and it is not here, it will trigger a 302 +# response to a pre-defined server name. +# Add any other IP addresses assigned to Tjeners interfaces: +# 192.168.0.1 ALLOW' +fi + +# ----------------------------------------------------------------------------- +# Query LDAP for cNAMERecord entries +# ----------------------------------------------------------------------------- +log "Querying LDAP for cNAMERecord entries..." +LDAP_OUTPUT=$(ldapsearch $LDAP_OPTS -b "$LDAP_BASE" 2>&1) \ + || die "ldapsearch failed: $LDAP_OUTPUT" + +# Parse relativeDomainName values that have a cNAMERecord attribute. +# Strategy: track the current relativeDomainName per stanza; only emit it +# if a cNAMERecord line is also present in the same stanza. +mapfile -t LDAP_CNAMES < <( + awk ' + /^$/ { if (has_cname && rdn != "" && rdn != "tjener") print rdn; rdn=""; has_cname=0; next } + /^relativeDomainName:/ { rdn=$2 } + /^cNAMERecord:/ { has_cname=1 } + END { if (has_cname && rdn != "" && rdn != "tjener") print rdn } + ' <<< "$LDAP_OUTPUT" | sort -u +) + +log "LDAP returned ${#LDAP_CNAMES[@]} cNAME entries: ${LDAP_CNAMES[*]:-<none>}" + +# ----------------------------------------------------------------------------- +# Build the de-duplicated LDAP-only section +# (skip anything already in the Debian Edu defaults block) +# ----------------------------------------------------------------------------- + +# Build a lookup set of already-covered hostnames (short names only) +declare -A COVERED +for h in "${DEBIAN_EDU_DEFAULTS[@]}"; do + # Strip .intern suffix for comparison + short="${h%.intern}" + COVERED["$short"]=1 +done +# Also mark static entries +for h in localhost tjener; do COVERED["$h"]=1; done + +LDAP_EXTRA_LINES=() +for cname in "${LDAP_CNAMES[@]}"; do + if [[ -z "${COVERED[$cname]+_}" ]]; then + LDAP_EXTRA_LINES+=("$cname") + COVERED["$cname"]=1 + fi +done + +# ----------------------------------------------------------------------------- +# Format helper: pad hostname to column 20 then append ALLOW +# ----------------------------------------------------------------------------- +fmt_allow() { + printf "%-20s ALLOW\n" "$1" +} + +# ----------------------------------------------------------------------------- +# Assemble the new map file in a temp file, then atomically replace +# ----------------------------------------------------------------------------- +TMPFILE=$(mktemp "${MAP_FILE}.tmp.XXXXXX") +trap 'rm -f "$TMPFILE"' EXIT + +{ +# ── Static header ───────────────────────────────────────────────────────────── +cat <<HEADER +# /usr/share/debian-edu-config/apache2_tjener-aliases.map +# Format: <server_alias_or_IP> ALLOW +# +# IMPORTANT: This file will be changed daily by a script using cron/systemd. +# It contains allowed HTTP Host: header values (TJENER aliases +# and IPs), not client machines. +# The script tries to smartly merge existing hand-made entries, +# but you should execute the script manually once to make sure your +# changes are sticking: +# $ ${SCRIPT_PATH} + +# Local loopback devices +$(fmt_allow localhost) +$(fmt_allow "::1") +$(fmt_allow "127.0.0.1") +HEADER + +# ── Auto-generated Debian Edu defaults ──────────────────────────────────────── +cat <<'AUTOGEN_HEADER' + +# --------------------------- +# | Debian Edu defaults | +# --------------------------- +AUTOGEN_HEADER + +echo "# NOTE: 10.x.x.x/8 network is allowed anyway, so next line is redundand." +fmt_allow "10.0.2.2" +fmt_allow "www" +fmt_allow "www.intern" +fmt_allow "tjener" +fmt_allow "tjener.intern" +fmt_allow "ldap" +fmt_allow "ldap.intern" +echo "# ---------------------------" + +# ── LDAP-discovered cNAMEs (not already in defaults) ────────────────────────── +if [[ ${#LDAP_EXTRA_LINES[@]} -gt 0 ]]; then + echo "" + echo "" + echo "# ---------------------------" + echo "# | LDAP-discovered CNAMEs |" + echo "# | (auto-updated daily) |" + echo "# ---------------------------" + echo "# Last updated: $(date '+%Y-%m-%d %H:%M:%S')" + for h in "${LDAP_EXTRA_LINES[@]}"; do + fmt_allow "$h" + # Also emit the .intern variant if not already covered + intern_variant="${h}.intern" + if [[ -z "${COVERED[$intern_variant]+_}" ]]; then + fmt_allow "$intern_variant" + COVERED["$intern_variant"]=1 + fi + done + echo "# ---------------------------" +fi + +# ── Preserved hand-edit block ───────────────────────────────────────────────── +echo "" +echo "" +echo "$HAND_EDIT_BLOCK" + +} > "$TMPFILE" + +# Validate the temp file is non-empty before replacing +[[ -s "$TMPFILE" ]] || die "Generated file is empty — aborting." + +# Atomic replace +mv "$TMPFILE" "$MAP_FILE" +chmod 644 "$MAP_FILE" +log "Successfully updated: $MAP_FILE" + +# ----------------------------------------------------------------------------- +# Reload Apache2 if running (graceful — no dropped connections) +# ----------------------------------------------------------------------------- +if systemctl is-active --quiet apache2; then + log "Reloading Apache2..." + systemctl reload apache2 \ + && log "Apache2 reloaded successfully." \ + || log "WARNING: Apache2 reload failed. Check 'systemctl status apache2'." +else + log "Apache2 is not running — skipping reload." +fi ===================================== share/debian-edu-config/apache2_tjener-aliases.map ===================================== @@ -0,0 +1,44 @@ +# /usr/share/debian-edu-config/apache2_tjener-aliases.map +# Format: <server_alias_or_IP> ALLOW +# +# IMPORTANT: This file will be changed daily by a script using cron/systemd. +# It contains allowed HTTP Host: header values (TJENER aliases +# and IPs), not client machines. +# The script tries to smartly merge existing hand-made entries, +# but you should execute the script manually once to make sure your +# changes are sticking: +# $ /usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases +# +# WARNING: If you can read this and the file modification date is more than 24h +# in the past, then there is an issue with the automatic updating +# script managed by either cron or systemd. This file only contains +# the most basic configuration settings for Debian Edu and needs to be +# updated. +# +# DEV NOTE: If you're are updating this file in the debian-edu-config package +# please be aware that you'll have to adapt the update script too. + +# Local loopback devices +localhost ALLOW +::1 ALLOW +127.0.0.1 ALLOW + +# --------------------------- +# | Debian Edu defaults | +# --------------------------- +# NOTE: 10.x.x.x/8 network is allowed, so next line is redundand. +10.0.2.2 ALLOW +www ALLOW +www.intern ALLOW +tjener ALLOW +tjener.intern ALLOW +ldap ALLOW +ldap.intern ALLOW +# --------------------------- + + +# ----- IMPORTANT HAND-EDIT ADDITIONS ----- +# If a user browses to the raw IP and it is not here, it will trigger a 302 +# response to a pre-defined server name. +# Add any other IP addresses assigned to Tjeners interfaces: +# 172.16.0.51 ALLOW ===================================== share/debian-edu-config/d-i/pre-pkgsel ===================================== @@ -21,7 +21,7 @@ error() { configure_network() { # Write a functional /target/etc/network/interfaces if [ -z "$PROFILE" ]; then - PROFILE=Workstation + PROFILE=Workstation fi # Default hostname is 'localhost' @@ -44,21 +44,21 @@ configure_network() { # Hm, what if both server and workstation is choosen? Choose the # server config for eth0. for value in `echo $PROFILE |sed 's/ /-/g' | sed 's/,-/ /g'`; do - case $value in - Roaming-Workstation) - # Configure network-manager to connect to eth0 by - # default, to be able to look up user information in - # LDAP. - eth0=none - autoeth0="" - eth1=none - autoeth1="" - DNSDOMAIN= - MAILNAME= - MY_HOSTNAME= - eth0uuid=$(chroot /target uuid) - mkdir -p /target/etc/NetworkManager/system-connections - cat > /target/etc/NetworkManager/system-connections/eth0 <<EOF + case $value in + Roaming-Workstation) + # Configure network-manager to connect to eth0 by + # default, to be able to look up user information in + # LDAP. + eth0=none + autoeth0="" + eth1=none + autoeth1="" + DNSDOMAIN= + MAILNAME= + MY_HOSTNAME= + eth0uuid=$(chroot /target uuid) + mkdir -p /target/etc/NetworkManager/system-connections + cat > /target/etc/NetworkManager/system-connections/eth0 <<EOF [connection] id=eth0 uuid=$eth0uuid @@ -70,46 +70,46 @@ method=auto [ipv4] method=auto EOF - ;; - Standalone) - # Leave network configuration to network-manager on - # Standalone - eth0=none - autoeth0="" - eth1=none - autoeth1="" - DNSDOMAIN= - MAILNAME= - MY_HOSTNAME= - ;; - Workstation) - # Use this unless Server also was choosen. - if [ -z "$eth0" ] ; then - eth0=none - autoeth0="" - eth1=none - autoeth1="" - fi - ;; - Main-Server) - # Override for workstations combining as servers - eth0=10.0.2.2:255.0.0.0:10.255.255.255:10.0.0.1 - MY_HOSTNAME=tjener.intern - NAMESERVER=127.0.0.1 - autoeth0="auto eth0" - ;; - LTSP-Server) - # Use this unless Server also was choosen. - if [ -z "$eth0" ] ; then - eth0=none - autoeth0="" - fi - eth1=192.168.0.254:255.255.255.0:192.168.0.255:none - autoeth1="auto eth1" - ;; - esac + ;; + Standalone) + # Leave network configuration to network-manager on + # Standalone + eth0=none + autoeth0="" + eth1=none + autoeth1="" + DNSDOMAIN= + MAILNAME= + MY_HOSTNAME= + ;; + Workstation) + # Use this unless Server also was choosen. + if [ -z "$eth0" ] ; then + eth0=none + autoeth0="" + eth1=none + autoeth1="" + fi + ;; + Main-Server) + # Override for workstations combining as servers + eth0=10.0.2.2:255.0.0.0:10.255.255.255:10.0.0.1 + MY_HOSTNAME=tjener + NAMESERVER=127.0.0.1 + autoeth0="auto eth0" + ;; + LTSP-Server) + # Use this unless Server also was choosen. + if [ -z "$eth0" ] ; then + eth0=none + autoeth0="" + fi + eth1=192.168.0.254:255.255.255.0:192.168.0.255:none + autoeth1="auto eth1" + ;; + esac done - + # Every host need the loopback interface cat > $interfaces <<EOF # Created by debian-edu-profile during the Debian installation. @@ -123,24 +123,24 @@ iface lo inet loopback EOF for interface in eth0 eth1 ; do - eval "ifinfo=\$$interface" - eval "ifauto=\$auto$interface" - log "setting up network interface $interface using $ifinfo" - case $ifinfo in - dhcp) - cat >> $interfaces <<EOF + eval "ifinfo=\$$interface" + eval "ifauto=\$auto$interface" + log "setting up network interface $interface using $ifinfo" + case $ifinfo in + dhcp) + cat >> $interfaces <<EOF $ifauto iface $interface inet dhcp EOF - ;; - [0-9]*) - address=`echo $ifinfo | cut -d: -f1` - netmask=`echo $ifinfo | cut -d: -f2` - broadcast=`echo $ifinfo | cut -d: -f3` - gateway=`echo $ifinfo | cut -d: -f4` - cat >> $interfaces <<EOF + ;; + [0-9]*) + address=`echo $ifinfo | cut -d: -f1` + netmask=`echo $ifinfo | cut -d: -f2` + broadcast=`echo $ifinfo | cut -d: -f3` + gateway=`echo $ifinfo | cut -d: -f4` + cat >> $interfaces <<EOF auto $interface iface $interface inet static @@ -148,35 +148,35 @@ iface $interface inet static netmask $netmask broadcast $broadcast EOF - if [ none != "$gateway" ] ; then - cat >> $interfaces <<EOF + if [ none != "$gateway" ] ; then + cat >> $interfaces <<EOF gateway $gateway EOF - fi - if [ "$DNSDOMAIN" ] && [ "$NAMESERVER" = "127.0.0.1" ] ; then - cat >> $interfaces <<EOF + fi + if [ "$DNSDOMAIN" ] && [ "$NAMESERVER" = "127.0.0.1" ] ; then + cat >> $interfaces <<EOF dns-search $DNSDOMAIN dns-nameservers $NAMESERVER EOF - fi - cat >> $interfaces <<EOF + fi + cat >> $interfaces <<EOF # The commented lines below is to be used if a DHCP server is in use #iface $interface inet dhcp EOF - ;; - *) - # Nothing to do? - ;; - esac + ;; + *) + # Nothing to do? + ;; + esac done ( - echo "127.0.0.1 localhost.localdomain localhost" - echo "::1 localhost ip6-localhost ip6-loopback" - echo "fe00::0 ip6-localnet" - echo "ff00::0 ip6-mcastprefix" - echo "ff02::1 ip6-allnodes" - echo "ff02::2 ip6-allrouters" - echo "ff02::3 ip6-allhosts" + echo "127.0.0.1 localhost.localdomain localhost" + echo "::1 localhost ip6-localhost ip6-loopback" + echo "fe00::0 ip6-localnet" + echo "ff00::0 ip6-mcastprefix" + echo "ff02::1 ip6-allnodes" + echo "ff02::2 ip6-allrouters" + echo "ff02::3 ip6-allhosts" ) > /target/etc/hosts if [ ! -z "$MY_HOSTNAME" ] ; then @@ -187,37 +187,37 @@ EOF # Update hostname based on reverse DNS entry of current IP or # generate from MAC address, unless installing main-server. if echo $PROFILE | grep -q Main-Server ; then - : + : elif [ -x /target/usr/sbin/update-hostname-from-ip ] ; then - in-target /usr/sbin/update-hostname-from-ip -m || true + in-target /usr/sbin/update-hostname-from-ip -m || true fi # Avoid hardcoding entries on the clients, to make sure IP address # range can be changed on the clients by changing DHCP # configuration on the server. - if [ "tjener.intern" = "$MY_HOSTNAME" ] ; then - ( - echo - echo "10.0.2.2 tjener.intern tjener" - ) >> /target/etc/hosts + if [ "tjener" = "$MY_HOSTNAME" ] ; then + ( + echo + echo "10.0.2.2 ${MY_HOSTNAME}.${DNSDOMAIN} ${MY_HOSTNAME}" + ) >> /target/etc/hosts fi # Set /etc/mailname if it is missing if [ "$MAILNAME" ] && [ ! -f /target/etc/mailname ] ; then - echo "$MAILNAME" > /target/etc/mailname + echo "$MAILNAME" > /target/etc/mailname fi # Make sure that the interfaces are there for the cfengine run if # network isn't already configured if route | grep -q default ; then - log "Not restarting network, as it seem to be up already." + log "Not restarting network, as it seem to be up already." else - log "Restarting network to prepare for cfengine run." - # Redirecting fd 3 as a workaround for skolelinux bug #1229. - # make sure the redirecting happen inside the chroot, as - # in-target need to talk to debconf. - in-target /bin/sh -c "/etc/init.d/networking start 3> /dev/null" || true - touch /tmp/debian-edu-nonetwork + log "Restarting network to prepare for cfengine run." + # Redirecting fd 3 as a workaround for skolelinux bug #1229. + # make sure the redirecting happen inside the chroot, as + # in-target need to talk to debconf. + in-target /bin/sh -c "/etc/init.d/networking start 3> /dev/null" || true + touch /tmp/debian-edu-nonetwork fi } @@ -225,32 +225,32 @@ EOF # finish-install hook. set_kerberos_ldap_passwords() { if db_get passwd/root-password-crypted && [ "$RET" ] ; then - log "No clear text root password, unable to pass it on to Kerberos/LDAP." + log "No clear text root password, unable to pass it on to Kerberos/LDAP." else - log "Fetching password for Kerberos KDC and LDAP." 1>&2 - db_get passwd/root-password - ROOTPWD="$RET" - - log "Fetching info for first user." 1>&2 - - if db_get passwd/username && [ "$RET" ] ; then - FIRSTUSERNAME="$RET" - else - FIRSTUSERNAME="localadmin" - fi - if db_get passwd/user-fullname && [ "$RET" ] ; then - FIRSTUSERGECOS="$RET" - else - FIRSTUSERGECOS="LDAP initial admin user" - fi - if db_get passwd/user-password && [ "$RET" ] ; then - FIRSTUSERPWD="$RET" - else - FIRSTUSERPWD="$ROOTPWD" - fi - - file=/tmp/passwords-preseed - cat > $file <<EOF + log "Fetching password for Kerberos KDC and LDAP." 1>&2 + db_get passwd/root-password + ROOTPWD="$RET" + + log "Fetching info for first user." 1>&2 + + if db_get passwd/username && [ "$RET" ] ; then + FIRSTUSERNAME="$RET" + else + FIRSTUSERNAME="localadmin" + fi + if db_get passwd/user-fullname && [ "$RET" ] ; then + FIRSTUSERGECOS="$RET" + else + FIRSTUSERGECOS="LDAP initial admin user" + fi + if db_get passwd/user-password && [ "$RET" ] ; then + FIRSTUSERPWD="$RET" + else + FIRSTUSERPWD="$ROOTPWD" + fi + + file=/tmp/passwords-preseed + cat > $file <<EOF debian-edu-config debian-edu-config/kdc-password password $ROOTPWD debian-edu-config debian-edu-config/kdc-password-again password $ROOTPWD debian-edu-config debian-edu-config/ldap-password password $ROOTPWD @@ -259,10 +259,10 @@ debian-edu-config debian-edu-config/first-user-name string $FIRSTUSERNAME debian-edu-config debian-edu-config/first-user-fullname string $FIRSTUSERGECOS debian-edu-config debian-edu-config/first-user-password password $FIRSTUSERPWD EOF - # Pass user and password information into the target - cat $file | LANG=C chroot /target debconf-set-selections || \ - error "Failed to load preseed values from $file." - rm $file + # Pass user and password information into the target + cat $file | LANG=C chroot /target debconf-set-selections || \ + error "Failed to load preseed values from $file." + rm $file fi } @@ -275,25 +275,25 @@ create_initial_localadmin_user() { LOCAL_USER_INGROUPS="$LOCAL_USER_INGROUPS adm sudo" if db_get passwd/root-password-crypted && [ "$RET" ] ; then - log "No clear text root password, unable to use it for creating the initial local user" + log "No clear text root password, unable to use it for creating the initial local user" else - # retrieve root password - db_get passwd/root-password - LOCAL_USER_PASSWD=$RET - # create initial local user - in-target /usr/sbin/addgroup --gid $LOCAL_USER_PRIMGIDNUMBER $LOCAL_USER_ID 1>&2 || true - in-target /usr/sbin/adduser --gid $LOCAL_USER_PRIMGIDNUMBER \ - --firstuid $LOCAL_USER_UIDNUMBER \ - --home /home/$LOCAL_USER_ID \ - --shell /bin/bash \ - --disabled-login \ - --gecos "$LOCAL_USER_GECOS" $LOCAL_USER_ID 1>&2 || true - # add initial local user to some standard system groups - for group in ${LOCAL_USER_INGROUPS}; do - in-target /usr/sbin/adduser $LOCAL_USER_ID $group 1>&2 || true - done - # set password (batch mode) - in-target /bin/sh -c "echo ${LOCAL_USER_ID}:${LOCAL_USER_PASSWD} | /usr/sbin/chpasswd" 1>&2 || true + # retrieve root password + db_get passwd/root-password + LOCAL_USER_PASSWD=$RET + # create initial local user + in-target /usr/sbin/addgroup --gid $LOCAL_USER_PRIMGIDNUMBER $LOCAL_USER_ID 1>&2 || true + in-target /usr/sbin/adduser --gid $LOCAL_USER_PRIMGIDNUMBER \ + --firstuid $LOCAL_USER_UIDNUMBER \ + --home /home/$LOCAL_USER_ID \ + --shell /bin/bash \ + --disabled-login \ + --gecos "$LOCAL_USER_GECOS" $LOCAL_USER_ID 1>&2 || true + # add initial local user to some standard system groups + for group in ${LOCAL_USER_INGROUPS}; do + in-target /usr/sbin/adduser $LOCAL_USER_ID $group 1>&2 || true + done + # set password (batch mode) + in-target /bin/sh -c "echo ${LOCAL_USER_ID}:${LOCAL_USER_PASSWD} | /usr/sbin/chpasswd" 1>&2 || true fi } @@ -311,15 +311,15 @@ workaround_grub_issue() { # want. db_get grub-installer/choose_bootdev || true if [ "$RET" ] && [ "manual" != "$RET" ]; then - log "not overriding grub-installer/choose_bootdev to $grubdev, its value was '$RET'" - return + log "not overriding grub-installer/choose_bootdev to $grubdev, its value was '$RET'" + return fi case "$bootdev" in - /dev/sd*|/dev/vd*|/dev/hd*|/dev/xvd*) - log "overriding grub-installer/choose_bootdev, setting it to $grubdev" - db_set grub-installer/choose_bootdev "$grubdev" || true - ;; + /dev/sd*|/dev/vd*|/dev/hd*|/dev/xvd*) + log "overriding grub-installer/choose_bootdev, setting it to $grubdev" + db_set grub-installer/choose_bootdev "$grubdev" || true + ;; esac } @@ -341,20 +341,20 @@ configure_network edu-etcvcs commit if echo "$PROFILE" | grep -q Main-Server ; then - set_kerberos_ldap_passwords + set_kerberos_ldap_passwords fi for p in $(echo $PROFILE | tr , " ") ; do case $p in - # Only do this for the networked tasks, not for standalone - Main-Server|Workstation|Roaming-Workstation|LTSP-Server|Minimal) - #create_initial_localadmin_user - in-target /usr/share/debian-edu-config/tools/preseed-ldap-kerberos - in-target /usr/share/debian-edu-config/tools/preseed-sitesummary - - # Tell user-setup to not create a user, needed on - # Main-Server to be able to create the user in LDAP. - db_set passwd/make-user boolean false - ;; + # Only do this for the networked tasks, not for standalone + Main-Server|Workstation|Roaming-Workstation|LTSP-Server|Minimal) + #create_initial_localadmin_user + in-target /usr/share/debian-edu-config/tools/preseed-ldap-kerberos + in-target /usr/share/debian-edu-config/tools/preseed-sitesummary + + # Tell user-setup to not create a user, needed on + # Main-Server to be able to create the user in LDAP. + db_set passwd/make-user boolean false + ;; esac done ===================================== testsuite/ldap-server ===================================== @@ -36,6 +36,19 @@ fi RESULT=0 +if [ -d /var/lib/ldap ] ; then + owner=$(stat -c %U:%G /var/lib/ldap) + if [ "$owner" = "openldap:openldap" ]; then + echo "success: $0: /var/lib/ldap is owned by openldap:openldap" + else + echo "error: $0: /var/lib/ldap is owned by $owner, not openldap:openldap" + RESULT=1 + fi +else + echo "error: $0: /var/lib/ldap is missing" + RESULT=1 +fi + for port in ldap; do netstat_check $port tcp slapd || RESULT=1 done View it on GitLab: https://salsa.debian.org/debian-edu/debian-edu-config/-/compare/682ac86dd03658eaab8a5d0a08ca03cecc184ad3...234d3b0ca8b6da45830a9cfc95682f6449cda3ba -- View it on GitLab: https://salsa.debian.org/debian-edu/debian-edu-config/-/compare/682ac86dd03658eaab8a5d0a08ca03cecc184ad3...234d3b0ca8b6da45830a9cfc95682f6449cda3ba You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help