1065 lines
47 KiB
Bash
Executable File
1065 lines
47 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
# ansipa-enforce-policies.sh — enforce FreeIPA host-group-driven policies on this client.
|
||
#
|
||
# Policies are idempotent and reversible: joining a group applies the policy;
|
||
# leaving the group removes it on the next run (every 30 min via systemd timer).
|
||
#
|
||
# Host-group naming conventions (device policies — applied to the whole machine):
|
||
# dev_daemon-enable-<unit> Ensure <unit> is enabled and running (systemctl enable --now).
|
||
# Leaving the group reverts: service is disabled and stopped.
|
||
# dev_daemon-disable-<unit> Ensure <unit> is disabled and stopped (systemctl disable --now).
|
||
# Leaving the group reverts: service is re-enabled and started.
|
||
# <unit> may omit the .service suffix; all systemd unit types work.
|
||
# If a unit appears in both enable and disable groups it is skipped.
|
||
# dev_timeshift-backup Enforce a daily Timeshift snapshot (requires timeshift installed)
|
||
# dev_security-scan Enforce daily ClamAV + rkhunter + chkrootkit scans
|
||
# dev_no-local-users Lock passwords for root and all local users (UID >= 1000) so
|
||
# that only FreeIPA domain accounts with centrally-managed sudo
|
||
# rules can authenticate and gain elevated privileges.
|
||
# Leaving the group reverts: every account locked by this policy
|
||
# is unlocked on the next run.
|
||
# dev_local-sudo-<username> Grant <username> full sudo on this specific device by adding
|
||
# them to the local sudoers drop-in. Leaving the group removes
|
||
# the drop-in on the next run.
|
||
#
|
||
# User-group naming conventions (per-user policies — follow the user across devices):
|
||
# usr_admin Members get full sudo on every enrolled host via a sudoers
|
||
# drop-in (/etc/sudoers.d/ansipa-usr-admin). Applied while the
|
||
# FreeIPA user group exists; drop-in is removed when the group is
|
||
# deleted. Uses SSSD so group membership resolves without local
|
||
# accounts.
|
||
# usr_block-binary-<name> Prevent members of this FreeIPA user group from running <name>
|
||
# on any enrolled host. Use __ in place of . to support Flatpak
|
||
# app IDs (e.g. usr_block-binary-org__gimp__Gimp blocks the
|
||
# Flatpak org.gimp.Gimp). Enforced via a PATH-priority wrapper
|
||
# that checks group membership at runtime via SSSD/id(1).
|
||
# Removing the user group from FreeIPA reverts the wrapper.
|
||
# usr_prt_<printer> Auto-add <printer> to CUPS on any enrolled host where a member
|
||
# is logged in. The printer URI is stored in the IPA group
|
||
# description (e.g. ipps://host/printers/name). Access is
|
||
# per-user only (allow:<username>); each new member who logs in
|
||
# gets added to the allow list. When the IPA group is deleted
|
||
# or all members leave, the printer is removed from CUPS on that
|
||
# host. A profile.d snippet + NOPASSWD sudo rule trigger the
|
||
# enforcer at login for immediate setup.
|
||
# usr_scan-notify Members receive scan alert notifications on every enrolled device
|
||
# they log into. The fetch-alerts timer is installed fleet-wide
|
||
# when the group exists; the notification daemon starts on login
|
||
# only for group members (checked via id(1) / SSSD).
|
||
# Deleting the IPA user group removes the timer and profile.d
|
||
# snippet on the next enforcer run.
|
||
#
|
||
# Notes:
|
||
# - Install scan tools first: add the host to dev_mod_anti-malware.
|
||
# - Configure Timeshift (type + target device) before enabling dev_timeshift-backup.
|
||
|
||
set -euo pipefail
|
||
|
||
LOG_TAG="ansipa-policies"
|
||
STATE_DIR="/var/lib/ansipa-policies"
|
||
BLOCK_DIR="/usr/local/bin"
|
||
CRON_DIR="/etc/cron.d"
|
||
|
||
log() { echo "[$LOG_TAG] $*"; logger -t "$LOG_TAG" "$*" 2>/dev/null || true; }
|
||
warn() { echo "[$LOG_TAG][WARN] $*" >&2; logger -t "$LOG_TAG" "WARN: $*" 2>/dev/null || true; }
|
||
|
||
HOST_FQDN=$(hostname -f 2>/dev/null || hostname)
|
||
|
||
if ! command -v ipa &>/dev/null; then
|
||
warn "ipa command not found — host not enrolled in FreeIPA. Exiting."
|
||
exit 0
|
||
fi
|
||
|
||
kinit -k "host/$HOST_FQDN" &>/dev/null || true
|
||
mkdir -p "$STATE_DIR"
|
||
|
||
# ── Fetch host group membership ───────────────────────────────────────────────
|
||
RAW_GROUPS=$(ipa host-show "$HOST_FQDN" --all 2>/dev/null \
|
||
| grep -i "Member of host-groups:" | sed 's/.*: //' || true)
|
||
|
||
# ── Parse active host-group (device) policies ─────────────────────────────────
|
||
ACTIVE_DAEMON_ENABLE=()
|
||
ACTIVE_DAEMON_DISABLE=()
|
||
ACTIVE_LOCAL_SUDO_USERS=()
|
||
ACTIVE_SSH_USERS=()
|
||
WANT_TIMESHIFT_BACKUP=false
|
||
WANT_SECURITY_SCAN=false
|
||
WANT_SCAN_NOTIFY=false
|
||
WANT_NO_LOCAL_USERS=false
|
||
WANT_USR_ADMIN=false
|
||
ACTIVE_PRT_GROUPS=()
|
||
ACTIVE_PRT_PRINTERS=()
|
||
|
||
if [[ -n "$RAW_GROUPS" ]]; then
|
||
while IFS=',' read -ra GRP_ARRAY; do
|
||
for g in "${GRP_ARRAY[@]}"; do
|
||
g="${g// /}"
|
||
case "$g" in
|
||
dev_daemon-enable-*) ACTIVE_DAEMON_ENABLE+=("${g#dev_daemon-enable-}") ;;
|
||
dev_daemon-disable-*) ACTIVE_DAEMON_DISABLE+=("${g#dev_daemon-disable-}") ;;
|
||
dev_timeshift-backup) WANT_TIMESHIFT_BACKUP=true ;;
|
||
dev_security-scan) WANT_SECURITY_SCAN=true ;;
|
||
dev_no-local-users) WANT_NO_LOCAL_USERS=true ;;
|
||
dev_local-sudo-*) ACTIVE_LOCAL_SUDO_USERS+=("${g#dev_local-sudo-}") ;;
|
||
dev_ssh_*) ACTIVE_SSH_USERS+=("${g#dev_ssh_}") ;;
|
||
esac
|
||
done
|
||
done <<< "$RAW_GROUPS"
|
||
fi
|
||
|
||
# ── Fetch user-group-based binary block policies from FreeIPA ─────────────────
|
||
# usr_block-binary-<name> groups are FreeIPA *user* groups — membership follows
|
||
# the user to every enrolled host rather than being tied to a device.
|
||
ACTIVE_BLOCK_BINARIES=()
|
||
ACTIVE_BLOCK_IPA_GROUPS=()
|
||
|
||
_BLOCK_LIST=$(ipa group-find --pkey-only 2>/dev/null \
|
||
| awk '/Group name:/ {print $NF}' \
|
||
| grep "^usr_block-binary-" | sort -u || true)
|
||
|
||
while IFS= read -r _grp; do
|
||
[[ -z "$_grp" ]] && continue
|
||
_raw="${_grp#usr_block-binary-}"
|
||
ACTIVE_BLOCK_BINARIES+=("${_raw//__/.}")
|
||
ACTIVE_BLOCK_IPA_GROUPS+=("$_grp")
|
||
done <<< "$_BLOCK_LIST"
|
||
unset _BLOCK_LIST _grp _raw
|
||
|
||
# ── Fetch user-group-based admin policy from FreeIPA ─────────────────────────
|
||
# usr_admin is a FreeIPA *user* group. When it exists, a sudoers drop-in grants
|
||
# full sudo to the group on every enrolled host (resolved via SSSD/NSS).
|
||
if ipa group-show usr_admin >/dev/null 2>&1; then
|
||
WANT_USR_ADMIN=true
|
||
fi
|
||
|
||
# ── Fetch user-group-based printer policies from FreeIPA ─────────────────────
|
||
# usr_prt_<printer> groups grant CUPS access to <printer> for members.
|
||
_PRT_LIST=$(ipa group-find --pkey-only 2>/dev/null \
|
||
| awk '/Group name:/ {print $NF}' \
|
||
| grep "^usr_prt_" | sort -u || true)
|
||
|
||
while IFS= read -r _pgrp; do
|
||
[[ -z "$_pgrp" ]] && continue
|
||
ACTIVE_PRT_GROUPS+=("$_pgrp")
|
||
ACTIVE_PRT_PRINTERS+=("${_pgrp#usr_prt_}")
|
||
done <<< "$_PRT_LIST"
|
||
unset _PRT_LIST _pgrp
|
||
|
||
# ── Fetch user-group-based scan-notify policy from FreeIPA ────────────────────
|
||
# usr_scan-notify is a FreeIPA *user* group — membership follows the user to
|
||
# every enrolled host. Install the fetch-alerts timer on any device where the
|
||
# group exists; the profile.d snippet gates daemon start on runtime membership.
|
||
if ipa group-show usr_scan-notify >/dev/null 2>&1; then
|
||
WANT_SCAN_NOTIFY=true
|
||
fi
|
||
|
||
log "Device policies — daemon-enable: ${ACTIVE_DAEMON_ENABLE[*]:-none}" \
|
||
"| daemon-disable: ${ACTIVE_DAEMON_DISABLE[*]:-none}" \
|
||
"| timeshift-backup: $WANT_TIMESHIFT_BACKUP | security-scan: $WANT_SECURITY_SCAN" \
|
||
"| no-local-users: $WANT_NO_LOCAL_USERS | local-sudo: ${ACTIVE_LOCAL_SUDO_USERS[*]:-none}" \
|
||
"| ssh-keys: ${ACTIVE_SSH_USERS[*]:-none}"
|
||
log "User policies — admin: $WANT_USR_ADMIN" \
|
||
"| block-binary: ${ACTIVE_BLOCK_BINARIES[*]:-none}" \
|
||
"| printers: ${ACTIVE_PRT_PRINTERS[*]:-none}" \
|
||
"| scan-notify: $WANT_SCAN_NOTIFY"
|
||
|
||
# ── Helpers ───────────────────────────────────────────────────────────────────
|
||
_in_block_list() {
|
||
local needle="$1"
|
||
for b in "${ACTIVE_BLOCK_BINARIES[@]}"; do
|
||
[[ "$b" == "$needle" ]] && return 0
|
||
done
|
||
return 1
|
||
}
|
||
|
||
# ── Binary blocking (user-based) ──────────────────────────────────────────────
|
||
# A PATH-priority wrapper is installed in /usr/local/bin/ for every binary named
|
||
# by a usr_block-binary-* FreeIPA *user* group. The wrapper checks the
|
||
# caller's group membership at runtime (via id + SSSD) and only blocks members;
|
||
# non-members are transparently passed through to the real binary.
|
||
# __ in the group suffix decodes to . so Flatpak app IDs are fully supported.
|
||
# Removing the IPA user group causes the wrapper to be cleaned up on the next run.
|
||
|
||
BLOCK_STATE="$STATE_DIR/blocked-binaries"
|
||
[[ -f "$BLOCK_STATE" ]] || touch "$BLOCK_STATE"
|
||
|
||
for _idx in "${!ACTIVE_BLOCK_BINARIES[@]}"; do
|
||
BIN="${ACTIVE_BLOCK_BINARIES[$_idx]}"
|
||
IPA_GRP="${ACTIVE_BLOCK_IPA_GROUPS[$_idx]}"
|
||
WRAPPER="$BLOCK_DIR/$BIN"
|
||
# Write (or refresh) the wrapper when it is absent, not ours, or the group name changed.
|
||
if [[ ! -f "$WRAPPER" ]] \
|
||
|| ! grep -q "blocked by ansipa policy" "$WRAPPER" 2>/dev/null \
|
||
|| ! grep -qF "$IPA_GRP" "$WRAPPER" 2>/dev/null; then
|
||
log "Installing user-aware block wrapper: $BIN (group: $IPA_GRP)"
|
||
cat > "$WRAPPER" <<WRAPPER
|
||
#!/bin/bash
|
||
# blocked by ansipa policy (user-based)
|
||
if id -Gn 2>/dev/null | tr ' ' '\n' | grep -qxF "${IPA_GRP}"; then
|
||
echo "[ansipa-policies] '${BIN}' is blocked by system policy for your account." >&2
|
||
exit 1
|
||
fi
|
||
_real=\$(PATH="/usr/bin:/usr/sbin:/bin:/sbin:/usr/local/sbin:/opt/bin:/var/lib/flatpak/exports/bin:/usr/share/flatpak/exports/bin" command -v "${BIN}" 2>/dev/null)
|
||
[[ -n "\$_real" ]] && exec "\$_real" "\$@"
|
||
command -v flatpak &>/dev/null && exec flatpak run "${BIN}" "\$@" 2>/dev/null
|
||
echo "${BIN}: command not found" >&2
|
||
exit 127
|
||
WRAPPER
|
||
chmod 755 "$WRAPPER"
|
||
fi
|
||
done
|
||
unset _idx
|
||
|
||
# Remove wrappers whose IPA user group no longer exists.
|
||
while IFS= read -r OLD_BIN; do
|
||
[[ -z "$OLD_BIN" ]] && continue
|
||
if ! _in_block_list "$OLD_BIN"; then
|
||
WRAPPER="$BLOCK_DIR/$OLD_BIN"
|
||
if [[ -f "$WRAPPER" ]] && grep -q "blocked by ansipa policy" "$WRAPPER" 2>/dev/null; then
|
||
rm -f "$WRAPPER"
|
||
log "Removed binary block wrapper: $OLD_BIN"
|
||
fi
|
||
fi
|
||
done < "$BLOCK_STATE"
|
||
|
||
# Persist current blocked list.
|
||
if [[ ${#ACTIVE_BLOCK_BINARIES[@]} -gt 0 ]]; then
|
||
printf '%s\n' "${ACTIVE_BLOCK_BINARIES[@]}" | sort -u > "$BLOCK_STATE"
|
||
else
|
||
> "$BLOCK_STATE"
|
||
fi
|
||
|
||
# ── Timeshift daily backup ─────────────────────────────────────────────────────
|
||
TIMESHIFT_CRON="$CRON_DIR/ansipa-timeshift-backup"
|
||
|
||
if [[ "$WANT_TIMESHIFT_BACKUP" == true ]]; then
|
||
if [[ ! -f "$TIMESHIFT_CRON" ]]; then
|
||
if ! command -v timeshift &>/dev/null; then
|
||
warn "timeshift not found — add host to dev_mod_timeshift first. Cron will be installed anyway."
|
||
fi
|
||
log "Enabling daily Timeshift backups"
|
||
cat > "$TIMESHIFT_CRON" <<'CRON'
|
||
# ansipa-dev_timeshift-backup: managed by ansipa-enforce-policies — do not edit manually.
|
||
# Timeshift must be configured on this host (type + target device) before snapshots work.
|
||
0 3 * * * root /usr/bin/timeshift --create --comments "ansipa-daily" --tags D 2>&1 | logger -t timeshift-backup
|
||
CRON
|
||
chmod 644 "$TIMESHIFT_CRON"
|
||
fi
|
||
else
|
||
if [[ -f "$TIMESHIFT_CRON" ]]; then
|
||
rm -f "$TIMESHIFT_CRON"
|
||
log "Removed Timeshift backup cron (host left dev_timeshift-backup group)"
|
||
fi
|
||
fi
|
||
|
||
# ── Security scan ─────────────────────────────────────────────────────────────
|
||
SCAN_CRON="$CRON_DIR/ansipa-security-scan"
|
||
SCAN_SCRIPT="/usr/local/bin/ansipa-security-scan.sh"
|
||
|
||
if [[ "$WANT_SECURITY_SCAN" == true ]]; then
|
||
# (Re-)write the scan script so it stays current with this version of the enforcer.
|
||
cat > "$SCAN_SCRIPT" <<'SCAN'
|
||
#!/bin/bash
|
||
# ansipa-security-scan — daily ClamAV / rkhunter / chkrootkit run + SMB upload.
|
||
# Managed by ansipa-enforce-policies — do not edit manually.
|
||
LOG=/var/log/ansipa-security-scan.log
|
||
HOSTNAME=$(hostname -f 2>/dev/null || hostname)
|
||
DATE=$(date +%Y-%m-%d)
|
||
{
|
||
echo "=== ansipa-security-scan: $DATE $HOSTNAME ==="
|
||
|
||
if command -v freshclam &>/dev/null; then
|
||
freshclam --quiet 2>/dev/null || true
|
||
fi
|
||
if command -v clamscan &>/dev/null; then
|
||
clamscan -r --infected --quiet /home /etc /tmp /var/tmp 2>/dev/null || true
|
||
fi
|
||
if command -v rkhunter &>/dev/null; then
|
||
rkhunter --update --quiet 2>/dev/null || true
|
||
rkhunter --check --skip-keypress --quiet 2>/dev/null || true
|
||
fi
|
||
if command -v chkrootkit &>/dev/null; then
|
||
chkrootkit 2>/dev/null || true
|
||
fi
|
||
|
||
echo "=== scan complete ==="
|
||
} >> "$LOG" 2>&1
|
||
|
||
# ── Upload to server SMB share ────────────────────────────────────────────────
|
||
IPA_SERVER=$(awk '/^server[[:space:]]*=/{print $3}' /etc/ipa/default.conf 2>/dev/null || echo "")
|
||
if [[ -n "$IPA_SERVER" ]] && [[ -f /etc/ansipa-smb.creds ]] && command -v smbclient &>/dev/null; then
|
||
# Create host archive dir (mkdir is idempotent; errors suppressed).
|
||
smbclient "//$IPA_SERVER/ansipa-scans" -A /etc/ansipa-smb.creds \
|
||
-c "mkdir archive; mkdir archive\\$HOSTNAME; put $LOG archive\\$HOSTNAME\\$DATE.log" \
|
||
>> "$LOG" 2>&1 \
|
||
&& echo "[ansipa] Scan results uploaded to $IPA_SERVER/ansipa-scans/archive/$HOSTNAME/$DATE.log" >> "$LOG" \
|
||
|| echo "[ansipa][WARN] SMB upload failed — results remain local at $LOG" >> "$LOG"
|
||
else
|
||
echo "[ansipa] SMB upload skipped (no credentials or smbclient not found)." >> "$LOG"
|
||
fi
|
||
SCAN
|
||
chmod 755 "$SCAN_SCRIPT"
|
||
|
||
if [[ ! -f "$SCAN_CRON" ]]; then
|
||
log "Enabling daily security scans (ClamAV / rkhunter / chkrootkit)"
|
||
cat > "$SCAN_CRON" <<'CRON'
|
||
# ansipa-dev_security-scan: managed by ansipa-enforce-policies — do not edit manually.
|
||
# Install scan tools by adding the host to the dev_mod_anti-malware group.
|
||
0 2 * * * root /usr/local/bin/ansipa-security-scan.sh
|
||
CRON
|
||
chmod 644 "$SCAN_CRON"
|
||
fi
|
||
else
|
||
if [[ -f "$SCAN_CRON" ]]; then
|
||
rm -f "$SCAN_CRON"
|
||
rm -f "$SCAN_SCRIPT"
|
||
log "Removed security scan policy (host left dev_security-scan group)"
|
||
fi
|
||
fi
|
||
|
||
# ── Scan notification daemon ──────────────────────────────────────────────────
|
||
# usr_scan-notify is a FreeIPA *user* group (not a host group). The fetch-
|
||
# alerts timer runs fleet-wide on any host where the group exists; the profile.d
|
||
# snippet starts the notification daemon on login only for group members
|
||
# (checked via id(1) / SSSD so no IPA query is needed at login time).
|
||
# - Root timer (every 10 min): ansipa-fetch-alerts.sh downloads alerts from the
|
||
# server SMB share and places them in ~/administration/<hostname>/ per active user.
|
||
# - profile.d snippet: starts ansipa-scan-notify.sh as a user daemon on login;
|
||
# the daemon sends notify-send every 10 min while *.alert files remain.
|
||
# Deleting a file from ~/administration/ counts as acknowledgment.
|
||
#
|
||
# Requires: ansipa-fetch-alerts.sh and ansipa-scan-notify.sh deployed by
|
||
# deploy-ansipa-policies.yml (static scripts — not written inline here).
|
||
|
||
FETCH_SVC="/etc/systemd/system/ansipa-fetch-alerts.service"
|
||
FETCH_TIMER="/etc/systemd/system/ansipa-fetch-alerts.timer"
|
||
NOTIFY_PROFILED="/etc/profile.d/ansipa-notify.sh"
|
||
|
||
if [[ "$WANT_SCAN_NOTIFY" == true ]]; then
|
||
if [[ ! -x /usr/local/bin/ansipa-fetch-alerts.sh ]]; then
|
||
warn "ansipa-fetch-alerts.sh not found — run deploy-ansipa-policies.yml first."
|
||
fi
|
||
|
||
if [[ ! -f "$FETCH_SVC" ]]; then
|
||
log "Installing ansipa-fetch-alerts systemd service + timer"
|
||
cat > "$FETCH_SVC" <<'UNIT'
|
||
[Unit]
|
||
Description=Fetch Ansipa security alerts from the server SMB share
|
||
After=network-online.target sssd.service
|
||
Wants=network-online.target
|
||
|
||
[Service]
|
||
Type=oneshot
|
||
ExecStart=/usr/local/bin/ansipa-fetch-alerts.sh
|
||
StandardOutput=journal
|
||
StandardError=journal
|
||
UNIT
|
||
|
||
cat > "$FETCH_TIMER" <<'UNIT'
|
||
[Unit]
|
||
Description=Periodic ansipa security alert fetch
|
||
|
||
[Timer]
|
||
OnBootSec=2min
|
||
OnUnitActiveSec=10min
|
||
|
||
[Install]
|
||
WantedBy=timers.target
|
||
UNIT
|
||
systemctl daemon-reload
|
||
systemctl enable --now ansipa-fetch-alerts.timer
|
||
log "ansipa-fetch-alerts.timer enabled"
|
||
fi
|
||
|
||
if [[ ! -f "$NOTIFY_PROFILED" ]]; then
|
||
log "Installing /etc/profile.d/ansipa-notify.sh"
|
||
cat > "$NOTIFY_PROFILED" <<'PROFILED'
|
||
# ansipa-notify: launch the scan alert notification daemon on login for
|
||
# members of the usr_scan-notify FreeIPA user group.
|
||
# Managed by ansipa-enforce-policies — do not edit manually.
|
||
_NOTIFY_DAEMON=/usr/local/bin/ansipa-scan-notify.sh
|
||
if [[ -x "$_NOTIFY_DAEMON" ]] && \
|
||
id -nG 2>/dev/null | grep -qw "usr_scan-notify" && \
|
||
! pgrep -u "$(id -u)" -f "ansipa-scan-notify" >/dev/null 2>&1; then
|
||
"$_NOTIFY_DAEMON" &
|
||
disown
|
||
fi
|
||
unset _NOTIFY_DAEMON
|
||
PROFILED
|
||
chmod 644 "$NOTIFY_PROFILED"
|
||
fi
|
||
else
|
||
if [[ -f "$FETCH_TIMER" ]]; then
|
||
systemctl disable --now ansipa-fetch-alerts.timer 2>/dev/null || true
|
||
rm -f "$FETCH_SVC" "$FETCH_TIMER"
|
||
systemctl daemon-reload
|
||
log "Removed ansipa-fetch-alerts timer (usr_scan-notify user group no longer exists)"
|
||
fi
|
||
if [[ -f "$NOTIFY_PROFILED" ]]; then
|
||
rm -f "$NOTIFY_PROFILED"
|
||
log "Removed /etc/profile.d/ansipa-notify.sh"
|
||
fi
|
||
fi
|
||
|
||
# ── Daemon enable / disable ───────────────────────────────────────────────────
|
||
# dev_daemon-enable-<unit>: ensure the unit is enabled and running.
|
||
# Leaving the group reverts: unit is disabled and stopped.
|
||
# dev_daemon-disable-<unit>: ensure the unit is disabled and stopped.
|
||
# Leaving the group reverts: unit is re-enabled and started.
|
||
# <unit> may omit the .service suffix; systemd accepts both forms.
|
||
# Conflicts (unit in both lists): logged as a warning, unit is left untouched.
|
||
|
||
DAEMON_ENABLE_STATE="$STATE_DIR/daemon-enabled"
|
||
DAEMON_DISABLE_STATE="$STATE_DIR/daemon-disabled"
|
||
[[ -f "$DAEMON_ENABLE_STATE" ]] || touch "$DAEMON_ENABLE_STATE"
|
||
[[ -f "$DAEMON_DISABLE_STATE" ]] || touch "$DAEMON_DISABLE_STATE"
|
||
|
||
# Append .service only when the name has no unit-type suffix already.
|
||
_svc_unit() { [[ "$1" == *.* ]] && echo "$1" || echo "${1}.service"; }
|
||
|
||
_in_enable_list() { local n="$1"; for s in "${ACTIVE_DAEMON_ENABLE[@]}"; do [[ "$s" == "$n" ]] && return 0; done; return 1; }
|
||
_in_disable_list() { local n="$1"; for s in "${ACTIVE_DAEMON_DISABLE[@]}"; do [[ "$s" == "$n" ]] && return 0; done; return 1; }
|
||
|
||
# Apply enable policies
|
||
for _SVC in "${ACTIVE_DAEMON_ENABLE[@]}"; do
|
||
if _in_disable_list "$_SVC"; then
|
||
warn "Conflict: '$_SVC' is in both daemon-enable and daemon-disable groups — skipped"
|
||
continue
|
||
fi
|
||
_UNIT=$(_svc_unit "$_SVC")
|
||
_EN=$(systemctl is-enabled "$_UNIT" 2>/dev/null || echo "not-found")
|
||
_AC=$(systemctl is-active "$_UNIT" 2>/dev/null || echo "inactive")
|
||
if [[ "$_EN" != "enabled" || "$_AC" != "active" ]]; then
|
||
log "Enabling service: $_UNIT (enabled=$_EN active=$_AC)"
|
||
systemctl enable --now "$_UNIT" 2>/dev/null \
|
||
&& log "Service enabled: $_UNIT" \
|
||
|| warn "Failed to enable $_UNIT — unit may not exist on this host"
|
||
fi
|
||
done
|
||
|
||
# Apply disable policies
|
||
for _SVC in "${ACTIVE_DAEMON_DISABLE[@]}"; do
|
||
if _in_enable_list "$_SVC"; then
|
||
continue # conflict already warned above
|
||
fi
|
||
_UNIT=$(_svc_unit "$_SVC")
|
||
_EN=$(systemctl is-enabled "$_UNIT" 2>/dev/null || echo "not-found")
|
||
_AC=$(systemctl is-active "$_UNIT" 2>/dev/null || echo "inactive")
|
||
if [[ "$_EN" == "enabled" || "$_AC" == "active" ]]; then
|
||
log "Disabling service: $_UNIT (enabled=$_EN active=$_AC)"
|
||
systemctl disable --now "$_UNIT" 2>/dev/null \
|
||
&& log "Service disabled: $_UNIT" \
|
||
|| warn "Failed to disable $_UNIT — unit may not exist on this host"
|
||
fi
|
||
done
|
||
|
||
# Revert: host left a daemon-enable group → disable and stop the service
|
||
while IFS= read -r _OLD; do
|
||
[[ -z "$_OLD" ]] && continue
|
||
if ! _in_enable_list "$_OLD"; then
|
||
_UNIT=$(_svc_unit "$_OLD")
|
||
log "Reverting enable policy: disabling $_UNIT (host left daemon-enable group)"
|
||
systemctl disable --now "$_UNIT" 2>/dev/null \
|
||
|| warn "Failed to disable (revert) $_UNIT"
|
||
fi
|
||
done < "$DAEMON_ENABLE_STATE"
|
||
|
||
# Revert: host left a daemon-disable group → re-enable and start the service
|
||
while IFS= read -r _OLD; do
|
||
[[ -z "$_OLD" ]] && continue
|
||
if ! _in_disable_list "$_OLD"; then
|
||
_UNIT=$(_svc_unit "$_OLD")
|
||
log "Reverting disable policy: enabling $_UNIT (host left daemon-disable group)"
|
||
systemctl enable --now "$_UNIT" 2>/dev/null \
|
||
|| warn "Failed to enable (revert) $_UNIT"
|
||
fi
|
||
done < "$DAEMON_DISABLE_STATE"
|
||
|
||
# Persist current state
|
||
if [[ ${#ACTIVE_DAEMON_ENABLE[@]} -gt 0 ]]; then
|
||
printf '%s\n' "${ACTIVE_DAEMON_ENABLE[@]}" | sort -u > "$DAEMON_ENABLE_STATE"
|
||
else
|
||
> "$DAEMON_ENABLE_STATE"
|
||
fi
|
||
if [[ ${#ACTIVE_DAEMON_DISABLE[@]} -gt 0 ]]; then
|
||
printf '%s\n' "${ACTIVE_DAEMON_DISABLE[@]}" | sort -u > "$DAEMON_DISABLE_STATE"
|
||
else
|
||
> "$DAEMON_DISABLE_STATE"
|
||
fi
|
||
|
||
# ── Per-device local sudo grants ──────────────────────────────────────────────
|
||
# dev_local-sudo-<username>: write a sudoers drop-in granting <username> full sudo on
|
||
# this specific device. The drop-in is removed when the host leaves the group.
|
||
|
||
LOCAL_SUDO_DIR="/etc/sudoers.d"
|
||
LOCAL_SUDO_STATE="$STATE_DIR/local-sudo-users"
|
||
[[ -f "$LOCAL_SUDO_STATE" ]] || touch "$LOCAL_SUDO_STATE"
|
||
|
||
for _USER in "${ACTIVE_LOCAL_SUDO_USERS[@]}"; do
|
||
_DROPIN="$LOCAL_SUDO_DIR/ansipa-local-sudo-${_USER}"
|
||
if [[ ! -f "$_DROPIN" ]]; then
|
||
log "Granting local sudo to $_USER on this device"
|
||
echo "$_USER ALL=(ALL) ALL" > "$_DROPIN"
|
||
chmod 440 "$_DROPIN"
|
||
fi
|
||
grep -qxF "$_USER" "$LOCAL_SUDO_STATE" 2>/dev/null || echo "$_USER" >> "$LOCAL_SUDO_STATE"
|
||
done
|
||
|
||
# Revoke sudo for users no longer in any active dev_local-sudo-* group.
|
||
while IFS= read -r _OLD_USER; do
|
||
[[ -z "$_OLD_USER" ]] && continue
|
||
_still_active=false
|
||
for _U in "${ACTIVE_LOCAL_SUDO_USERS[@]}"; do
|
||
[[ "$_U" == "$_OLD_USER" ]] && _still_active=true && break
|
||
done
|
||
if [[ "$_still_active" == false ]]; then
|
||
_DROPIN="$LOCAL_SUDO_DIR/ansipa-local-sudo-${_OLD_USER}"
|
||
if [[ -f "$_DROPIN" ]]; then
|
||
rm -f "$_DROPIN"
|
||
log "Revoked local sudo for $_OLD_USER (host left dev_local-sudo-$_OLD_USER group)"
|
||
fi
|
||
fi
|
||
done < "$LOCAL_SUDO_STATE"
|
||
|
||
# Persist current local sudo users.
|
||
if [[ ${#ACTIVE_LOCAL_SUDO_USERS[@]} -gt 0 ]]; then
|
||
printf '%s\n' "${ACTIVE_LOCAL_SUDO_USERS[@]}" | sort -u > "$LOCAL_SUDO_STATE"
|
||
else
|
||
> "$LOCAL_SUDO_STATE"
|
||
fi
|
||
unset _USER _DROPIN _OLD_USER _still_active _U
|
||
|
||
# ── No-local-users policy ──────────────────────────────────────────────────────
|
||
# dev_no-local-users: lock the passwords of root and all local users (UID >= 1000)
|
||
# so that only FreeIPA domain accounts with centrally-managed sudo rules can
|
||
# authenticate and gain elevated privileges.
|
||
# Leaving the group reverts: every account locked by this policy is unlocked.
|
||
|
||
NO_LOCAL_USERS_STATE="$STATE_DIR/no-local-users"
|
||
|
||
_apply_no_local_users() {
|
||
log "Applying no_local_users policy — locking local account passwords"
|
||
[[ -f "$NO_LOCAL_USERS_STATE" ]] || touch "$NO_LOCAL_USERS_STATE"
|
||
|
||
while IFS=: read -r uname _ uid _; do
|
||
[[ "$uid" =~ ^[0-9]+$ ]] || continue
|
||
{ [[ "$uid" == "0" ]] || [[ "$uid" -ge 1000 ]]; } || continue
|
||
|
||
# Skip accounts already tracked (locked on a previous run)
|
||
grep -qxF "$uname" "$NO_LOCAL_USERS_STATE" 2>/dev/null && continue
|
||
|
||
# Lock only accounts that currently have a real (unlocked) password hash
|
||
local hash
|
||
hash=$(getent shadow "$uname" 2>/dev/null | cut -d: -f2 || true)
|
||
[[ -z "$hash" || "$hash" == '!'* || "$hash" == '*'* ]] && continue
|
||
|
||
if passwd -l "$uname" &>/dev/null; then
|
||
echo "$uname" >> "$NO_LOCAL_USERS_STATE"
|
||
log "Locked local account: $uname"
|
||
else
|
||
warn "Failed to lock local account: $uname"
|
||
fi
|
||
done < /etc/passwd
|
||
}
|
||
|
||
_revert_no_local_users() {
|
||
[[ -f "$NO_LOCAL_USERS_STATE" ]] || return 0
|
||
log "Reverting no_local_users policy — unlocking previously locked accounts"
|
||
while IFS= read -r uname; do
|
||
[[ -z "$uname" ]] && continue
|
||
if passwd -u "$uname" &>/dev/null; then
|
||
log "Unlocked local account: $uname"
|
||
else
|
||
warn "Failed to unlock local account: $uname (may have been removed)"
|
||
fi
|
||
done < "$NO_LOCAL_USERS_STATE"
|
||
> "$NO_LOCAL_USERS_STATE"
|
||
}
|
||
|
||
if [[ "$WANT_NO_LOCAL_USERS" == true ]]; then
|
||
_apply_no_local_users
|
||
else
|
||
if [[ -f "$NO_LOCAL_USERS_STATE" ]] && [[ -s "$NO_LOCAL_USERS_STATE" ]]; then
|
||
_revert_no_local_users
|
||
fi
|
||
fi
|
||
|
||
# ── usr_admin: global sudo for FreeIPA admin group ───────────────────────────
|
||
# When the FreeIPA user group usr_admin exists, install a sudoers drop-in that
|
||
# grants full sudo to that group (resolved via SSSD/NSS) on this host.
|
||
# The drop-in is removed when the group is deleted from FreeIPA.
|
||
|
||
USR_ADMIN_DROPIN="/etc/sudoers.d/ansipa-usr-admin"
|
||
USR_ADMIN_STATE="$STATE_DIR/usr-admin"
|
||
|
||
if [[ "$WANT_USR_ADMIN" == true ]]; then
|
||
if [[ ! -f "$USR_ADMIN_DROPIN" ]]; then
|
||
log "Installing usr_admin sudoers drop-in"
|
||
printf '%%usr_admin ALL=(ALL:ALL) ALL\n' > "$USR_ADMIN_DROPIN"
|
||
chmod 440 "$USR_ADMIN_DROPIN"
|
||
fi
|
||
touch "$USR_ADMIN_STATE"
|
||
else
|
||
if [[ -f "$USR_ADMIN_STATE" ]] || [[ -f "$USR_ADMIN_DROPIN" ]]; then
|
||
rm -f "$USR_ADMIN_DROPIN" "$USR_ADMIN_STATE"
|
||
log "Removed usr_admin sudoers drop-in (IPA group no longer exists)"
|
||
fi
|
||
fi
|
||
|
||
# ── usr_prt_<printer>: per-user printer auto-add via FreeIPA groups ───────────
|
||
# For each usr_prt_<printer> group in FreeIPA:
|
||
# - The group description must contain the printer URI
|
||
# (e.g. "ipps://printserver.corp.example.com/printers/hp-office")
|
||
# - When a logged-in user is a member of the group, the printer is added to
|
||
# CUPS on this host and restricted to that user (allow:<user>).
|
||
# - Multiple users in the group can each gain access on the same host.
|
||
# - When a user leaves the group their allow entry is revoked; when no users
|
||
# remain the printer is removed from CUPS on this host entirely.
|
||
# The profile.d snippet /etc/profile.d/ansipa-printers.sh triggers this enforcer
|
||
# at login so printers appear immediately rather than waiting for the 30-min tick.
|
||
#
|
||
# To register a printer in FreeIPA:
|
||
# ipa group-mod usr_prt_hp-office \
|
||
# --desc='ipps://printserver.corp.example.com/printers/hp-office'
|
||
|
||
PRT_STATE_DIR="$STATE_DIR/printer-users"
|
||
PRT_DEFS_DIR="$STATE_DIR/printer-defs"
|
||
PRT_PROFILED="/etc/profile.d/ansipa-printers.sh"
|
||
PRT_SUDO_DROPIN="/etc/sudoers.d/ansipa-printers-trigger"
|
||
mkdir -p "$PRT_STATE_DIR" "$PRT_DEFS_DIR"
|
||
|
||
# Read/write per-printer authorized-user state files (<printer>.users)
|
||
_prt_read_users() {
|
||
local sf="$PRT_STATE_DIR/${1}.users"
|
||
[[ -f "$sf" ]] && grep -v '^$' "$sf" | sort -u || true
|
||
}
|
||
_prt_write_users() {
|
||
local printer="$1"; shift
|
||
if [[ $# -gt 0 ]]; then
|
||
printf '%s\n' "$@" | sort -u > "$PRT_STATE_DIR/${printer}.users"
|
||
else
|
||
> "$PRT_STATE_DIR/${printer}.users"
|
||
fi
|
||
}
|
||
# Apply the full allow list from state (or remove printer if list is empty)
|
||
_prt_apply_acl() {
|
||
local printer="$1"
|
||
local -a users
|
||
mapfile -t users < <(_prt_read_users "$printer")
|
||
if [[ ${#users[@]} -gt 0 ]]; then
|
||
local allow_list
|
||
allow_list=$(IFS=','; echo "${users[*]}")
|
||
lpadmin -p "$printer" -u "allow:${allow_list}" 2>/dev/null \
|
||
|| warn "lpadmin ACL update failed for printer $printer"
|
||
else
|
||
lpadmin -x "$printer" 2>/dev/null \
|
||
&& log "Removed printer $printer (no authorized users remaining)" \
|
||
|| warn "lpadmin -x failed for printer $printer"
|
||
rm -f "$PRT_STATE_DIR/${printer}.users"
|
||
fi
|
||
}
|
||
_prt_is_active() {
|
||
local needle="$1"
|
||
for _ap in "${ACTIVE_PRT_PRINTERS[@]+"${ACTIVE_PRT_PRINTERS[@]}"}"; do
|
||
[[ "$_ap" == "$needle" ]] && return 0
|
||
done
|
||
return 1
|
||
}
|
||
|
||
if command -v lpadmin &>/dev/null; then
|
||
# ── Process each active usr_prt_* group ──────────────────────────────────
|
||
for _i in "${!ACTIVE_PRT_PRINTERS[@]}"; do
|
||
_PRT="${ACTIVE_PRT_PRINTERS[$_i]}"
|
||
_GRP="${ACTIVE_PRT_GROUPS[$_i]}"
|
||
|
||
# Fetch URI from IPA group description (must start with a scheme://)
|
||
_URI=$(ipa group-show "$_GRP" --all 2>/dev/null \
|
||
| awk -F': ' '/Description:/{print $2; exit}' \
|
||
| grep -E '^[a-z][a-z+.-]+://' || true)
|
||
|
||
if [[ -z "$_URI" ]]; then
|
||
warn "Group $_GRP has no printer URI in its description — set it with:"
|
||
warn " ipa group-mod $_GRP --desc='ipps://printserver/printers/$_PRT'"
|
||
continue
|
||
fi
|
||
echo "$_URI" > "$PRT_DEFS_DIR/${_GRP}.uri"
|
||
|
||
mapfile -t _CUR_USERS < <(_prt_read_users "$_PRT")
|
||
_UPDATED=false
|
||
|
||
# Check logged-in users for new members to grant access to
|
||
while IFS= read -r _LUSER; do
|
||
[[ -z "$_LUSER" ]] && continue
|
||
id -Gn "$_LUSER" 2>/dev/null | tr ' ' '\n' | grep -qxF "$_GRP" || continue
|
||
printf '%s\n' "${_CUR_USERS[@]+"${_CUR_USERS[@]}"}" | grep -qxF "$_LUSER" && continue
|
||
|
||
# Add the printer to CUPS if not present yet
|
||
if ! lpstat -p "$_PRT" &>/dev/null; then
|
||
log "Adding printer $_PRT (URI: $_URI)"
|
||
lpadmin -p "$_PRT" -v "$_URI" -m everywhere -E 2>/dev/null \
|
||
|| lpadmin -p "$_PRT" -v "$_URI" -E 2>/dev/null \
|
||
|| { warn "lpadmin failed to add printer $_PRT"; continue; }
|
||
fi
|
||
|
||
log "Granting printer $_PRT access to $_LUSER"
|
||
_CUR_USERS+=("$_LUSER")
|
||
_UPDATED=true
|
||
done < <(who -u 2>/dev/null | awk '{print $1}' | sort -u)
|
||
|
||
# Revoke users who left the group
|
||
_VALID_USERS=()
|
||
for _U in "${_CUR_USERS[@]+"${_CUR_USERS[@]}"}"; do
|
||
if id -Gn "$_U" 2>/dev/null | tr ' ' '\n' | grep -qxF "$_GRP"; then
|
||
_VALID_USERS+=("$_U")
|
||
else
|
||
log "Revoking printer $_PRT access for $_U (no longer in $_GRP)"
|
||
_UPDATED=true
|
||
fi
|
||
done
|
||
|
||
if [[ "$_UPDATED" == true ]]; then
|
||
_prt_write_users "$_PRT" "${_VALID_USERS[@]+"${_VALID_USERS[@]}"}"
|
||
_prt_apply_acl "$_PRT"
|
||
fi
|
||
done
|
||
unset _i _PRT _GRP _URI _LUSER _U _CUR_USERS _VALID_USERS _UPDATED _ap
|
||
|
||
# ── Remove printers whose IPA group was deleted ───────────────────────────
|
||
shopt -s nullglob
|
||
for _sf in "$PRT_STATE_DIR"/*.users; do
|
||
[[ -f "$_sf" ]] || continue
|
||
_PRT=$(basename "$_sf" .users)
|
||
_prt_is_active "$_PRT" && continue
|
||
log "Removing printer $_PRT (IPA group usr_prt_$_PRT deleted)"
|
||
lpadmin -x "$_PRT" 2>/dev/null || true
|
||
rm -f "$_sf"
|
||
done
|
||
shopt -u nullglob
|
||
unset _sf _PRT
|
||
|
||
# ── profile.d login trigger ───────────────────────────────────────────────
|
||
# Installs a profile.d snippet + NOPASSWD sudo rule so that when a user
|
||
# logs in, the enforcer runs immediately and adds their printers without
|
||
# waiting for the next 30-minute timer tick.
|
||
if [[ ${#ACTIVE_PRT_PRINTERS[@]} -gt 0 ]]; then
|
||
if [[ ! -f "$PRT_SUDO_DROPIN" ]]; then
|
||
log "Installing ansipa-printers sudo trigger rule"
|
||
printf 'ALL ALL=(root) NOPASSWD: /usr/bin/systemctl start ansipa-enforce-policies.service\n' \
|
||
> "$PRT_SUDO_DROPIN"
|
||
chmod 440 "$PRT_SUDO_DROPIN"
|
||
fi
|
||
if [[ ! -f "$PRT_PROFILED" ]]; then
|
||
log "Installing /etc/profile.d/ansipa-printers.sh"
|
||
cat > "$PRT_PROFILED" <<'PROFILED'
|
||
# ansipa-printers: trigger policy enforcer at login to auto-add printers.
|
||
# Managed by ansipa-enforce-policies — do not edit manually.
|
||
sudo -n /usr/bin/systemctl start ansipa-enforce-policies.service 2>/dev/null &
|
||
disown 2>/dev/null || true
|
||
PROFILED
|
||
chmod 644 "$PRT_PROFILED"
|
||
fi
|
||
else
|
||
if [[ -f "$PRT_SUDO_DROPIN" ]]; then
|
||
rm -f "$PRT_SUDO_DROPIN"
|
||
log "Removed ansipa-printers sudo trigger (no active printer groups)"
|
||
fi
|
||
if [[ -f "$PRT_PROFILED" ]]; then
|
||
rm -f "$PRT_PROFILED"
|
||
log "Removed /etc/profile.d/ansipa-printers.sh (no active printer groups)"
|
||
fi
|
||
fi
|
||
else
|
||
[[ ${#ACTIVE_PRT_PRINTERS[@]} -gt 0 ]] && \
|
||
warn "lpadmin not found — install cups to enforce printer policies"
|
||
fi
|
||
unset _ap
|
||
|
||
# ── usr_smb_<r|rw>_<name>: auto-mount network shares in user home dirs ────────
|
||
# For each usr_smb_r_<name> or usr_smb_rw_<name> group in FreeIPA:
|
||
# - The FreeIPA container hosts a Samba share [usr-<name>-r] or [usr-<name>-rw]
|
||
# under /data/smb-shares/<name>/ with UNIX group permissions.
|
||
# - When a logged-in user is a member of the group the share is mounted at
|
||
# ~/‹name› (a new folder named after the share, no r/rw suffix).
|
||
# - rw membership takes precedence over r if the user is in both groups for
|
||
# the same share name.
|
||
# - The mount is tracked in the state file; leaving the group unmounts it.
|
||
#
|
||
# Credential string (server, Samba user, password) is stored in the IPA group
|
||
# description by ansipa-smb-setup.sh: cifs://<ipa-host>:<samba-user>:<password>
|
||
#
|
||
# Requires: cifs-utils installed on the client.
|
||
|
||
SMB_MOUNT_STATE="$STATE_DIR/smb-mounts"
|
||
[[ -f "$SMB_MOUNT_STATE" ]] || touch "$SMB_MOUNT_STATE"
|
||
SMB_CREDS_DIR="$STATE_DIR/smb-creds"
|
||
mkdir -p "$SMB_CREDS_DIR"
|
||
chmod 700 "$SMB_CREDS_DIR"
|
||
|
||
if command -v mount.cifs &>/dev/null; then
|
||
|
||
# ── Discover usr_smb_* groups from IPA ───────────────────────────────────
|
||
declare -A _SMB_R_GRP _SMB_RW_GRP # share-name → IPA group name
|
||
|
||
while IFS= read -r _g; do
|
||
[[ -z "$_g" ]] && continue
|
||
if [[ "$_g" =~ ^usr_smb_r_(.+)$ ]]; then _SMB_R_GRP["${BASH_REMATCH[1]}"]="$_g"
|
||
elif [[ "$_g" =~ ^usr_smb_rw_(.+)$ ]]; then _SMB_RW_GRP["${BASH_REMATCH[1]}"]="$_g"
|
||
fi
|
||
done < <(ipa group-find --pkey-only 2>/dev/null \
|
||
| awk '/Group name:/ {print $NF}' \
|
||
| grep "^usr_smb_" | sort -u || true)
|
||
unset _g
|
||
|
||
# Union of r + rw share names.
|
||
declare -A _SMB_NAMES
|
||
for _n in "${!_SMB_R_GRP[@]}" "${!_SMB_RW_GRP[@]}"; do _SMB_NAMES["$_n"]=1; done
|
||
unset _n
|
||
|
||
# ── Helpers ───────────────────────────────────────────────────────────────
|
||
# Outputs "host samba_user password" when description contains a cifs:// credential.
|
||
_smb_parse_cred() {
|
||
local _desc
|
||
_desc=$(ipa group-show "$1" --all 2>/dev/null \
|
||
| awk -F': ' '/Description:/{print $2; exit}' || true)
|
||
[[ "$_desc" =~ ^cifs://([^:]+):([^:]+):(.+)$ ]] && \
|
||
echo "${BASH_REMATCH[1]} ${BASH_REMATCH[2]} ${BASH_REMATCH[3]}"
|
||
}
|
||
_smb_member() { id -nG "$1" 2>/dev/null | tr ' ' '\n' | grep -qxF "$2"; }
|
||
|
||
# ── Collect active logged-in users (loginctl → who fallback) ─────────────
|
||
declare -A _SMB_SESS # user → home
|
||
_smb_add_sess() {
|
||
local _u
|
||
[[ "$2" == "loginctl" ]] && _u=$(awk '{print $3}' <<< "$1") \
|
||
|| _u=$(awk '{print $1}' <<< "$1")
|
||
[[ -z "$_u" || "$_u" == "root" || "$_u" == "USER" ]] && return 0
|
||
local _h; _h=$(getent passwd "$_u" | cut -d: -f6 2>/dev/null) || return 0
|
||
[[ -d "$_h" ]] && _SMB_SESS["$_u"]="$_h"
|
||
}
|
||
if loginctl list-sessions --no-legend &>/dev/null; then
|
||
while IFS= read -r _L; do _smb_add_sess "$_L" "loginctl"
|
||
done < <(loginctl list-sessions --no-legend 2>/dev/null)
|
||
else
|
||
while IFS= read -r _L; do _smb_add_sess "$_L" "who"
|
||
done < <(who 2>/dev/null)
|
||
fi
|
||
unset _L
|
||
|
||
# ── Apply: mount shares for logged-in members ─────────────────────────────
|
||
for _SMB_NAME in "${!_SMB_NAMES[@]}"; do
|
||
_R_GRP="${_SMB_R_GRP[$_SMB_NAME]:-}"
|
||
_RW_GRP="${_SMB_RW_GRP[$_SMB_NAME]:-}"
|
||
|
||
# Both access levels use the same credential; read from whichever has it.
|
||
_CRED_LINE=""
|
||
[[ -n "$_RW_GRP" ]] && _CRED_LINE=$(_smb_parse_cred "$_RW_GRP")
|
||
[[ -z "$_CRED_LINE" && -n "$_R_GRP" ]] && _CRED_LINE=$(_smb_parse_cred "$_R_GRP")
|
||
|
||
if [[ -z "$_CRED_LINE" ]]; then
|
||
warn "No credential in IPA description for share $_SMB_NAME — skipped (run ansipa-smb.service on FreeIPA container)"
|
||
continue
|
||
fi
|
||
read -r _SMB_HOST _SMB_SUSER _SMB_SPASS <<< "$_CRED_LINE"
|
||
|
||
_CREDS_FILE="$SMB_CREDS_DIR/${_SMB_NAME}.creds"
|
||
printf 'username=%s\npassword=%s\ndomain=WORKGROUP\n' "$_SMB_SUSER" "$_SMB_SPASS" \
|
||
> "$_CREDS_FILE"
|
||
chmod 600 "$_CREDS_FILE"
|
||
|
||
for _SMB_U in "${!_SMB_SESS[@]}"; do
|
||
# Determine per-user access level (rw beats r).
|
||
_SMB_LVL=""
|
||
[[ -n "$_RW_GRP" ]] && _smb_member "$_SMB_U" "$_RW_GRP" && _SMB_LVL="rw"
|
||
[[ -z "$_SMB_LVL" && -n "$_R_GRP" ]] && _smb_member "$_SMB_U" "$_R_GRP" && _SMB_LVL="r"
|
||
[[ -z "$_SMB_LVL" ]] && continue
|
||
|
||
_SMB_H="${_SMB_SESS[$_SMB_U]}"
|
||
_SMB_MP="$_SMB_H/$_SMB_NAME"
|
||
_SMB_SHARE="usr-${_SMB_NAME}-${_SMB_LVL}"
|
||
|
||
if mountpoint -q "$_SMB_MP" 2>/dev/null; then
|
||
grep -qxF "${_SMB_U}:${_SMB_NAME}" "$SMB_MOUNT_STATE" 2>/dev/null || \
|
||
echo "${_SMB_U}:${_SMB_NAME}" >> "$SMB_MOUNT_STATE"
|
||
continue
|
||
fi
|
||
|
||
mkdir -p "$_SMB_MP"
|
||
chown "$_SMB_U" "$_SMB_MP" 2>/dev/null || true
|
||
|
||
if mount -t cifs "//${_SMB_HOST}/${_SMB_SHARE}" "$_SMB_MP" \
|
||
-o "credentials=${_CREDS_FILE},uid=${_SMB_U},gid=${_SMB_U},file_mode=0644,dir_mode=0755,nounix,noserverino" \
|
||
2>/dev/null; then
|
||
log "Mounted //${_SMB_HOST}/${_SMB_SHARE} → $_SMB_MP for $_SMB_U"
|
||
grep -qxF "${_SMB_U}:${_SMB_NAME}" "$SMB_MOUNT_STATE" 2>/dev/null || \
|
||
echo "${_SMB_U}:${_SMB_NAME}" >> "$SMB_MOUNT_STATE"
|
||
else
|
||
warn "Failed to mount //${_SMB_HOST}/${_SMB_SHARE} for $_SMB_U"
|
||
rmdir "$_SMB_MP" 2>/dev/null || true
|
||
fi
|
||
done
|
||
done
|
||
unset _SMB_NAME _R_GRP _RW_GRP _CRED_LINE _SMB_HOST _SMB_SUSER _SMB_SPASS \
|
||
_CREDS_FILE _SMB_U _SMB_H _SMB_MP _SMB_SHARE _SMB_LVL
|
||
|
||
# ── Revert: unmount shares whose group was removed or user left ───────────
|
||
_NEW_SMB_MOUNTS=()
|
||
while IFS=: read -r _OLD_USER _OLD_NAME; do
|
||
[[ -z "$_OLD_USER" || -z "$_OLD_NAME" ]] && continue
|
||
_OLD_HOME=$(getent passwd "$_OLD_USER" | cut -d: -f6 2>/dev/null) || continue
|
||
_OLD_MPT="$_OLD_HOME/$_OLD_NAME"
|
||
|
||
_STILL_MEMBER=false
|
||
if [[ -n "${_SMB_R_GRP[$_OLD_NAME]+x}" ]] && \
|
||
_smb_member "$_OLD_USER" "${_SMB_R_GRP[$_OLD_NAME]}"; then
|
||
_STILL_MEMBER=true
|
||
elif [[ -n "${_SMB_RW_GRP[$_OLD_NAME]+x}" ]] && \
|
||
_smb_member "$_OLD_USER" "${_SMB_RW_GRP[$_OLD_NAME]}"; then
|
||
_STILL_MEMBER=true
|
||
fi
|
||
|
||
if [[ "$_STILL_MEMBER" == true ]]; then
|
||
_NEW_SMB_MOUNTS+=("${_OLD_USER}:${_OLD_NAME}")
|
||
else
|
||
umount -l "$_OLD_MPT" 2>/dev/null || true
|
||
rmdir "$_OLD_MPT" 2>/dev/null || true
|
||
log "Unmounted ${_OLD_MPT} for ${_OLD_USER} (left usr_smb_*_${_OLD_NAME})"
|
||
fi
|
||
done < "$SMB_MOUNT_STATE"
|
||
unset _OLD_USER _OLD_NAME _OLD_HOME _OLD_MPT _STILL_MEMBER
|
||
|
||
if [[ ${#_NEW_SMB_MOUNTS[@]} -gt 0 ]]; then
|
||
printf '%s\n' "${_NEW_SMB_MOUNTS[@]}" | sort -u > "$SMB_MOUNT_STATE"
|
||
else
|
||
> "$SMB_MOUNT_STATE"
|
||
fi
|
||
|
||
# Credential files are written fresh on each run; remove stale ones.
|
||
rm -f "$SMB_CREDS_DIR"/*.creds 2>/dev/null || true
|
||
|
||
unset _SMB_R_GRP _SMB_RW_GRP _SMB_NAMES _SMB_SESS _NEW_SMB_MOUNTS
|
||
|
||
else
|
||
warn "mount.cifs not found — install cifs-utils to enable usr_smb_* policies"
|
||
[[ -s "$SMB_MOUNT_STATE" ]] && \
|
||
warn "smb-mounts state is non-empty — cannot revert existing mounts without cifs-utils" || true
|
||
fi
|
||
|
||
# ── dev_ssh_<userid>: distribute SSH public keys to user home dirs ────────────
|
||
# When this host is in dev_ssh_<userid>, the IPA user <userid>'s public keys are
|
||
# written to /home/<userid>/.ssh/authorized_keys in an ansipa-managed section.
|
||
# This enables Amir (or any named IPA user) to SSH into this device using the key
|
||
# registered in their IPA profile — the same key reaches every enrolled device.
|
||
#
|
||
# Keys are stored in the IPA user object (not on each device); add via:
|
||
# ipa user-mod <userid> --sshpubkey="ssh-ed25519 AAAA..."
|
||
# Multiple keys (e.g. workstation + laptop) are each added with --sshpubkey.
|
||
#
|
||
# The ansipa-managed section in authorized_keys is marked with:
|
||
# # BEGIN ansipa-ssh-managed … # END ansipa-ssh-managed
|
||
# This preserves any manually-added keys and is cleanly removed on revert.
|
||
#
|
||
# Leaving the host group removes only the ansipa-managed section on the next run.
|
||
|
||
SSH_KEY_STATE="$STATE_DIR/ssh-keys"
|
||
[[ -f "$SSH_KEY_STATE" ]] || touch "$SSH_KEY_STATE"
|
||
|
||
# Write or clear the ansipa-managed section in an authorized_keys file.
|
||
# Usage: _ssh_write_keys <user> <homedir> [key1 key2 ...]
|
||
# Passing no keys removes the section (revert).
|
||
_ssh_write_keys() {
|
||
local _u="$1" _h="$2"; shift 2
|
||
local _auth="$_h/.ssh/authorized_keys"
|
||
mkdir -p "$_h/.ssh"
|
||
chmod 700 "$_h/.ssh"
|
||
[[ -f "$_auth" ]] || touch "$_auth"
|
||
# Strip any existing ansipa section.
|
||
local _rest
|
||
_rest=$(awk '
|
||
/^# BEGIN ansipa-ssh-managed$/ { skip=1; next }
|
||
skip && /^# END ansipa-ssh-managed$/ { skip=0; next }
|
||
!skip
|
||
' "$_auth" 2>/dev/null || true)
|
||
if [[ $# -gt 0 ]]; then
|
||
{ [[ -n "$_rest" ]] && printf '%s\n' "$_rest"; \
|
||
echo "# BEGIN ansipa-ssh-managed"; \
|
||
printf '%s\n' "$@"; \
|
||
echo "# END ansipa-ssh-managed"; } > "$_auth"
|
||
else
|
||
[[ -n "$_rest" ]] && printf '%s\n' "$_rest" > "$_auth" || > "$_auth"
|
||
fi
|
||
chmod 600 "$_auth"
|
||
chown "$_u:$_u" "$_h/.ssh" "$_auth" 2>/dev/null || true
|
||
}
|
||
|
||
declare -A _SSH_APPLIED # userid → 1 (applied this run)
|
||
|
||
for _SSH_UID in "${ACTIVE_SSH_USERS[@]+"${ACTIVE_SSH_USERS[@]}"}"; do
|
||
# Verify the IPA user exists.
|
||
ipa user-show "$_SSH_UID" &>/dev/null || {
|
||
warn "dev_ssh_${_SSH_UID}: IPA user '$_SSH_UID' not found — skipping"
|
||
continue
|
||
}
|
||
|
||
# Fetch SSH public keys from IPA user profile.
|
||
# `ipa user-show --all` shows: " SSH public key: <key>"
|
||
# " SSH public key fingerprint: ..." is a separate field — exclude it.
|
||
_SSH_KEYS=()
|
||
mapfile -t _SSH_KEYS < <(
|
||
ipa user-show "$_SSH_UID" --all 2>/dev/null \
|
||
| grep "^ SSH public key:" | grep -v "fingerprint" \
|
||
| sed 's/^ SSH public key: //' || true
|
||
)
|
||
|
||
if [[ ${#_SSH_KEYS[@]} -eq 0 ]]; then
|
||
warn "dev_ssh_${_SSH_UID}: '$_SSH_UID' has no SSH keys in IPA — add via:"
|
||
warn " ipa user-mod $_SSH_UID --sshpubkey='ssh-ed25519 AAAA...'"
|
||
continue
|
||
fi
|
||
|
||
# Resolve home directory via SSSD (works for IPA users once SSSD is running).
|
||
_SSH_HOME=$(getent passwd "$_SSH_UID" 2>/dev/null | cut -d: -f6 || true)
|
||
if [[ -z "$_SSH_HOME" ]]; then
|
||
warn "dev_ssh_${_SSH_UID}: '$_SSH_UID' not resolvable via getent — is SSSD running?"
|
||
continue
|
||
fi
|
||
|
||
# Create home dir now if it doesn't yet exist (IPA user may not have logged in).
|
||
if [[ ! -d "$_SSH_HOME" ]]; then
|
||
log "Creating home dir for $_SSH_UID: $_SSH_HOME"
|
||
mkdir -p "$_SSH_HOME"
|
||
chown "$_SSH_UID:$_SSH_UID" "$_SSH_HOME" 2>/dev/null || true
|
||
chmod 700 "$_SSH_HOME"
|
||
fi
|
||
|
||
_ssh_write_keys "$_SSH_UID" "$_SSH_HOME" "${_SSH_KEYS[@]}"
|
||
log "SSH keys for $_SSH_UID: ${#_SSH_KEYS[@]} key(s) written to $_SSH_HOME/.ssh/authorized_keys"
|
||
_SSH_APPLIED["$_SSH_UID"]=1
|
||
grep -qxF "$_SSH_UID" "$SSH_KEY_STATE" 2>/dev/null || echo "$_SSH_UID" >> "$SSH_KEY_STATE"
|
||
done
|
||
unset _SSH_UID _SSH_KEYS _SSH_HOME
|
||
|
||
# Revert: remove ansipa keys for users whose dev_ssh_* group was removed from this host.
|
||
_NEW_SSH_STATE=()
|
||
while IFS= read -r _OLD_SSH_UID; do
|
||
[[ -z "$_OLD_SSH_UID" ]] && continue
|
||
if [[ -n "${_SSH_APPLIED[$_OLD_SSH_UID]+x}" ]]; then
|
||
_NEW_SSH_STATE+=("$_OLD_SSH_UID")
|
||
else
|
||
_OLD_SSH_HOME=$(getent passwd "$_OLD_SSH_UID" 2>/dev/null | cut -d: -f6 || true)
|
||
if [[ -n "$_OLD_SSH_HOME" ]]; then
|
||
_ssh_write_keys "$_OLD_SSH_UID" "$_OLD_SSH_HOME" # no keys = remove section
|
||
log "Removed ansipa SSH keys for $_OLD_SSH_UID (host left dev_ssh_${_OLD_SSH_UID})"
|
||
fi
|
||
fi
|
||
done < "$SSH_KEY_STATE"
|
||
unset _OLD_SSH_UID _OLD_SSH_HOME
|
||
|
||
if [[ ${#_NEW_SSH_STATE[@]} -gt 0 ]]; then
|
||
printf '%s\n' "${_NEW_SSH_STATE[@]}" | sort -u > "$SSH_KEY_STATE"
|
||
else
|
||
> "$SSH_KEY_STATE"
|
||
fi
|
||
unset _SSH_APPLIED _NEW_SSH_STATE
|
||
|
||
log "Policy enforcement complete."
|