masson
Version:
Module execution engine for cluster deployments.
116 lines (103 loc) • 4.07 kB
Markdown
# Krb5 Client Configure
* `krb5.kadmin_principal` (string, required)
* `krb5.kadmin_password` (string, required)
* `krb5.kadmin_server` (string, required)
* `krb5.realm` (string, required)
* `krb5.etc_krb5_conf` (object)
Object representing the full ini file in "/etc/krb5.conf". It is
generated by default.
* `krb5.sshd` (object)
Properties inserted in the "/etc/ssh/sshd_config" file.
Example:
```json
{
"krb5": {
"realm": "ADALTAS.COM",
"kdc": "krb5.hadoop",
"kadmin_server": "krb5.hadoop",
"kadmin_principal": "wdavidw/admin@ADALTAS.COM",
"kadmin_password": "test",
"sshd": {
"ChallengeResponseAuthentication: "yes",
"KerberosAuthentication: "yes",
"KerberosOrLocalPasswd: "yes",
"KerberosTicketCleanup: "yes",
"GSSAPIAuthentication: "yes",
"GSSAPICleanupCredentials: "yes"
}
}
}
```
export default (service) ->
options = service.options
## Enable Client
options.krb5_conf ?= {}
options.krb5_conf.enabled ?= service.deps.krb5_server?.length > 0
options.fqdn ?= service.node.fqdn
options.sshd ?= {}
options.kinit ?= '/usr/bin/kinit'
options.admin = merge service.deps.krb5_server[0].options.admin, options.admin if service.deps.krb5_server
options.etc_krb5_conf = merge module.exports.etc_krb5_conf, options.etc_krb5_conf
# Merge global with server-based configuration
# options.etc_krb5_conf.realms = merge options.etc_krb5_conf.realms, options.etc_krb5_conf.realms
if service.deps.krb5_server
for srv in service.deps.krb5_server
for realm, config of srv.options.admin
options.etc_krb5_conf.realms[realm] ?= {}
options.etc_krb5_conf.realms[realm].kdc ?= []
options.etc_krb5_conf.realms[realm].kdc.push srv.node.fqdn
# realms[realm].kdc = [realms[realm].kdc] unless Array.isArray realms[realm].kdc
options.etc_krb5_conf.realms[realm].admin_server ?= []
options.etc_krb5_conf.realms[realm].admin_server.push srv.node.fqdn
# realms[realm].default_domain ?= realm.toLowerCase()
options.etc_krb5_conf.libdefaults.default_realm = realm
## Wait
options.wait = {}
options.wait.kdc_tcp = for realm, config of options.etc_krb5_conf.realms
for kdc in config.kdc
[kdc, port] = kdc.split ':'
host: kdc, port: port or '88'
options.wait.kdc_tcp = array.flatten options.wait.kdc_tcp
options.wait.kadmin_tcp = for realm, config of options.etc_krb5_conf.realms
continue unless config.admin_server?.length
for server in config.admin_server
[host, port] = server.split ':'
host: host, port: port or 749
options.wait.kadmin_tcp = array.flatten options.wait.kadmin_tcp
options.wait.kadmin_listprincs = for realm, config of options.admin
continue unless config.kadmin_principal and config.admin_server
misc.kadmin
realm: realm
kadmin_principal: config.kadmin_principal
kadmin_password: config.kadmin_password
kadmin_server: config.admin_server
, 'listprincs'
module.exports.etc_krb5_conf =
'logging':
'default': 'SYSLOG:INFO:LOCAL1'
'kdc': 'SYSLOG:NOTICE:LOCAL1'
'admin_server': 'SYSLOG:WARNING:LOCAL1'
'libdefaults':
'dns_lookup_realm': false
'dns_lookup_kdc': false
'ticket_lifetime': '24h'
'renew_lifetime': '7d'
'forwardable': true
'allow_weak_crypto': 'false'
'ticket_lifetime': '24h'
'clockskew': '300'
'rdns': 'false'
'realms': {}
'domain_realm': {}
'appdefaults':
'pam':
'debug': false
'ticket_lifetime': 36000
'renew_lifetime': 36000
'forwardable': true
'krb4_convert': false
'dbmodules': {}
## Dependencies
misc = require '@nikitajs/core/lib/misc'
array = require '@nikitajs/core/lib/misc/array'
{merge} = require 'mixme'