From 0a105a83b490ec9a1e58b9e09ca3904719c5a8f8 Mon Sep 17 00:00:00 2001 From: Ben Yanke Date: Wed, 11 Apr 2018 10:08:35 -0500 Subject: [PATCH 1/6] Adding account disabling feature --- .gitignore | 5 +++++ configbackend.go | 8 +++++++- glauth.go | 1 + 3 files changed, 13 insertions(+), 1 deletion(-) create mode 100644 .gitignore diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..40617d5 --- /dev/null +++ b/.gitignore @@ -0,0 +1,5 @@ +# Ignore default config file for testing +glauth.cfg + +# Ignore the built binary during testing +glauth diff --git a/configbackend.go b/configbackend.go index ee84848..612db82 100644 --- a/configbackend.go +++ b/configbackend.go @@ -134,7 +134,13 @@ func (h configHandler) Search(bindDN string, searchReq ldap.SearchRequest, conn attrs = append(attrs, &ldap.EntryAttribute{"uid", []string{u.Name}}) attrs = append(attrs, &ldap.EntryAttribute{"ou", []string{h.getGroupName(u.PrimaryGroup)}}) attrs = append(attrs, &ldap.EntryAttribute{"uidNumber", []string{fmt.Sprintf("%d", u.UnixID)}}) - attrs = append(attrs, &ldap.EntryAttribute{"accountStatus", []string{"active"}}) + + if (u.Disabled) { + attrs = append(attrs, &ldap.EntryAttribute{"accountStatus", []string{"inactive"}}) + } else { + attrs = append(attrs, &ldap.EntryAttribute{"accountStatus", []string{"active"}}) + } + attrs = append(attrs, &ldap.EntryAttribute{"objectClass", []string{"posixAccount"}}) attrs = append(attrs, &ldap.EntryAttribute{"homeDirectory", []string{"/home/" + u.Name}}) attrs = append(attrs, &ldap.EntryAttribute{"loginShell", []string{"/bin/bash"}}) diff --git a/glauth.go b/glauth.go index ea4282f..628d262 100644 --- a/glauth.go +++ b/glauth.go @@ -73,6 +73,7 @@ type configUser struct { PassSHA256 string PrimaryGroup int SSHKeys []string + Disabled bool UnixID int } type configGroup struct { From 84d5b6f270bf129d3b04f500e8210374a9e42590 Mon Sep 17 00:00:00 2001 From: Ben Yanke Date: Wed, 11 Apr 2018 10:35:30 -0500 Subject: [PATCH 2/6] Added optional mail field --- configbackend.go | 4 ++++ glauth.go | 1 + 2 files changed, 5 insertions(+) diff --git a/configbackend.go b/configbackend.go index 612db82..afcec80 100644 --- a/configbackend.go +++ b/configbackend.go @@ -141,6 +141,10 @@ func (h configHandler) Search(bindDN string, searchReq ldap.SearchRequest, conn attrs = append(attrs, &ldap.EntryAttribute{"accountStatus", []string{"active"}}) } + if len(u.Mail) > 0 { + attrs = append(attrs, &ldap.EntryAttribute{"mail", []string{u.Mail}}) + } + attrs = append(attrs, &ldap.EntryAttribute{"objectClass", []string{"posixAccount"}}) attrs = append(attrs, &ldap.EntryAttribute{"homeDirectory", []string{"/home/" + u.Name}}) attrs = append(attrs, &ldap.EntryAttribute{"loginShell", []string{"/bin/bash"}}) diff --git a/glauth.go b/glauth.go index 628d262..f3bb6e0 100644 --- a/glauth.go +++ b/glauth.go @@ -75,6 +75,7 @@ type configUser struct { SSHKeys []string Disabled bool UnixID int + Mail string } type configGroup struct { Name string From 209309e604d0a8e5aea7f5f5698d696de36af1a8 Mon Sep 17 00:00:00 2001 From: Ben Yanke Date: Wed, 11 Apr 2018 10:38:16 -0500 Subject: [PATCH 3/6] Add option to specify loginShell --- configbackend.go | 8 +++++++- glauth.go | 1 + 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/configbackend.go b/configbackend.go index afcec80..7e1dc6d 100644 --- a/configbackend.go +++ b/configbackend.go @@ -147,7 +147,13 @@ func (h configHandler) Search(bindDN string, searchReq ldap.SearchRequest, conn attrs = append(attrs, &ldap.EntryAttribute{"objectClass", []string{"posixAccount"}}) attrs = append(attrs, &ldap.EntryAttribute{"homeDirectory", []string{"/home/" + u.Name}}) - attrs = append(attrs, &ldap.EntryAttribute{"loginShell", []string{"/bin/bash"}}) + + if len(u.LoginShell) > 0 { + attrs = append(attrs, &ldap.EntryAttribute{"loginShell", []string{u.LoginShell}}) + } else { + attrs = append(attrs, &ldap.EntryAttribute{"loginShell", []string{"/bin/bash"}}) + } + attrs = append(attrs, &ldap.EntryAttribute{"description", []string{fmt.Sprintf("%s via LDAP", u.Name)}}) attrs = append(attrs, &ldap.EntryAttribute{"gecos", []string{fmt.Sprintf("%s via LDAP", u.Name)}}) attrs = append(attrs, &ldap.EntryAttribute{"gidNumber", []string{fmt.Sprintf("%d", u.PrimaryGroup)}}) diff --git a/glauth.go b/glauth.go index f3bb6e0..913dd56 100644 --- a/glauth.go +++ b/glauth.go @@ -76,6 +76,7 @@ type configUser struct { Disabled bool UnixID int Mail string + LoginShell string } type configGroup struct { Name string From f3d3a387614dada07186bfa2a46c419404372636 Mon Sep 17 00:00:00 2001 From: Ben Yanke Date: Wed, 11 Apr 2018 10:41:54 -0500 Subject: [PATCH 4/6] Implement givenName and SN (first and last name) --- configbackend.go | 10 ++++++++++ glauth.go | 2 ++ 2 files changed, 12 insertions(+) diff --git a/configbackend.go b/configbackend.go index 7e1dc6d..5f74719 100644 --- a/configbackend.go +++ b/configbackend.go @@ -132,6 +132,16 @@ func (h configHandler) Search(bindDN string, searchReq ldap.SearchRequest, conn attrs := []*ldap.EntryAttribute{} attrs = append(attrs, &ldap.EntryAttribute{"cn", []string{u.Name}}) attrs = append(attrs, &ldap.EntryAttribute{"uid", []string{u.Name}}) + + if len(u.GivenName) > 0 { + attrs = append(attrs, &ldap.EntryAttribute{"givenName", []string{u.GivenName}}) + } + + if len(u.SN) > 0 { + attrs = append(attrs, &ldap.EntryAttribute{"sn", []string{u.SN}}) + } + + attrs = append(attrs, &ldap.EntryAttribute{"ou", []string{h.getGroupName(u.PrimaryGroup)}}) attrs = append(attrs, &ldap.EntryAttribute{"uidNumber", []string{fmt.Sprintf("%d", u.UnixID)}}) diff --git a/glauth.go b/glauth.go index 913dd56..b036366 100644 --- a/glauth.go +++ b/glauth.go @@ -77,6 +77,8 @@ type configUser struct { UnixID int Mail string LoginShell string + GivenName string + SN string } type configGroup struct { Name string From c11de4c2bed49ba7483b85b2298d0458c0909364 Mon Sep 17 00:00:00 2001 From: Ben Yanke Date: Thu, 12 Apr 2018 14:40:06 -0500 Subject: [PATCH 5/6] Configurable home directory --- configbackend.go | 7 ++++++- glauth.go | 1 + 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/configbackend.go b/configbackend.go index 5f74719..6f90c87 100644 --- a/configbackend.go +++ b/configbackend.go @@ -156,7 +156,6 @@ func (h configHandler) Search(bindDN string, searchReq ldap.SearchRequest, conn } attrs = append(attrs, &ldap.EntryAttribute{"objectClass", []string{"posixAccount"}}) - attrs = append(attrs, &ldap.EntryAttribute{"homeDirectory", []string{"/home/" + u.Name}}) if len(u.LoginShell) > 0 { attrs = append(attrs, &ldap.EntryAttribute{"loginShell", []string{u.LoginShell}}) @@ -164,6 +163,12 @@ func (h configHandler) Search(bindDN string, searchReq ldap.SearchRequest, conn attrs = append(attrs, &ldap.EntryAttribute{"loginShell", []string{"/bin/bash"}}) } + if len(u.Homedir) > 0 { + attrs = append(attrs, &ldap.EntryAttribute{"homeDirectory", []string{u.Homedir}}) + } else { + attrs = append(attrs, &ldap.EntryAttribute{"homeDirectory", []string{"/home/" + u.Name}}) + } + attrs = append(attrs, &ldap.EntryAttribute{"description", []string{fmt.Sprintf("%s via LDAP", u.Name)}}) attrs = append(attrs, &ldap.EntryAttribute{"gecos", []string{fmt.Sprintf("%s via LDAP", u.Name)}}) attrs = append(attrs, &ldap.EntryAttribute{"gidNumber", []string{fmt.Sprintf("%d", u.PrimaryGroup)}}) diff --git a/glauth.go b/glauth.go index b036366..d95ab22 100644 --- a/glauth.go +++ b/glauth.go @@ -79,6 +79,7 @@ type configUser struct { LoginShell string GivenName string SN string + Homedir string } type configGroup struct { Name string From 0281f92959c3493acf4c417f62c258e506025003 Mon Sep 17 00:00:00 2001 From: Ben Yanke Date: Wed, 18 Apr 2018 20:12:33 -0500 Subject: [PATCH 6/6] Update readme to match new config options available --- README.md | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/README.md b/README.md index bb70496..b8a939d 100644 --- a/README.md +++ b/README.md @@ -67,6 +67,43 @@ In order to use S3, you must set your AWS credentials. Either: More configuration options are documented here: https://github.com/nmcclain/foo/blob/master/sample-simple.cfg +### Required Fields + * Name + * The user's username + * ou + * ID of the user's primary group + * uidbumber + * The user's unix user id + * sshPublicKey + * Specify an array of public keys + +### Optional Fields + * givenname + * First name + * Example: John + * default = blank + * sn + * Last name + * Example: Doe + * default = blank + * disabled + * Specify if account is active. + * Set to 'true' (without quotes) to make the LDAP entry add 'AccountStatus = inactive' + * default = false (active) + * mail + * Specify an email + * example: jdoe@example.com + * default = blank + * loginshell + * Specify a different login shell for the user + * Example: /bin/sh, or /sbin/nologin + * default = /bin/bash + * homedirectory + * Specify an overridden home directory for the user + * Example: /home/itadmin + * default = /home/[username] + + ### OpenSSH keys: GLAuth can store a user's SSH authorized keys. Add one or more keys per user as shown above, then setup the goklp helper: https://github.com/appliedtrust/goklp