Amir Alexander Abdelbaki
5d56984e38
ansipa-smb-setup.sh: - Adds KeyAdmin Linux group and luks-upload service account (member of KeyAdmin) on the IPA container, both persisted across restarts. - LUKS base dir /data/luks-keys owned root:KeyAdmin, mode 2750 (setgid so new files inherit the group). - New [ansipa-luks-keys] SMB share: valid users = @KeyAdmin, read only, write list = luks-upload. Human admins gain read access by being added to KeyAdmin: useradd -r -G KeyAdmin <user> && smbpasswd -a <user>. - LUKS_KEY_UPLOAD_PASSWORD sourced from env / /data/samba/ansipa-smb.env alongside the existing SMB_SCAN_PASSWORD. collect-luks-keys.yml: - After fetching /_LUKS_BACKUP_KEY from each client, uploads it to the ansipa-luks-keys share via smbclient using a temp credentials file (no_log, deleted in post_tasks). - Local staging copy is removed after a successful upload. - SMB credentials file uses an epoch-stamped path to avoid collisions. .env.example: documents LUKS_KEY_UPLOAD_PASSWORD. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| Desktop-Environments | ||
| FreeipaAnsible | ||
| optional-Modules | ||
| core-packages.sh | ||
| core.sh | ||
| package-managers.sh | ||
| shell-setup.sh | ||