aboutsummaryrefslogtreecommitdiff
path: root/manifests
diff options
context:
space:
mode:
Diffstat (limited to 'manifests')
-rw-r--r--manifests/init.pp4
-rw-r--r--manifests/server.pp58
-rw-r--r--manifests/server/ads.pp116
-rw-r--r--manifests/server/share.pp5
-rw-r--r--manifests/server/winbind.pp16
5 files changed, 154 insertions, 45 deletions
diff --git a/manifests/init.pp b/manifests/init.pp
index c71ee1d..8a914a4 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -1,3 +1,7 @@
class samba {
include samba::server
+
+ if samba::server::security == 'ads' {
+ include samba::server::ads
+ }
} \ No newline at end of file
diff --git a/manifests/server.pp b/manifests/server.pp
index cc1a951..9b6d3c0 100644
--- a/manifests/server.pp
+++ b/manifests/server.pp
@@ -18,53 +18,27 @@ class samba::server($interfaces = '',
notify => Class['samba::server::service']
}
- augeas { 'global-interfaces':
- context => $context,
- changes => $interfaces ? {
- default => ["set \"${target}/interfaces\" '${interfaces}'", "set \"${target}/bind interfaces only\" yes"],
- '' => ["rm \"${target}/interfaces\"", "rm \"${target}/bind interfaces only\""],
- },
- require => Augeas['global-section'],
- notify => Class['samba::server::service']
- }
- augeas { 'global-security':
- context => $context,
- changes => $security ? {
- default => "set \"${target}/security\" '${security}'",
- '' => "rm \"${target}/security\"",
- },
- require => Augeas['global-section'],
- notify => Class['samba::server::service']
- }
-
- augeas { 'global-server_string':
- context => $context,
- changes => $server_string ? {
- default => "set \"${target}/server string\" '${server_string}'",
- '' => "rm \"${target}/server string\"",
- },
- require => Augeas['global-section'],
- notify => Class['samba::server::service']
+ set_samba_option {
+ 'bind interfaces only': value => 'yes';
+ 'security': value => $security;
+ 'server string': value => $server_string;
+ 'unix password sync': value => $unix_password_sync;
+ 'workgroup': value => $workgroup;
}
+}
- augeas { 'global-unix_password_sync':
- context => $context,
- changes => $unix_password_sync ? {
- default => "set \"${target}/unix password sync\" '$unix_password_sync'",
- '' => "rm \"${target}/unix_password_sync\"",
- },
- require => Augeas['global-section'],
- notify => Class['samba::server::service']
+define set_samba_option ( $value = '', $signal = 'samba::server::service' ) {
+ $context = $samba::server::context
+ $target = $samba::server::target
+ $changes = $value ? {
+ default => "set \"${target}/$name\" $value",
+ '' => "rm ${target}/$name",
}
-
- augeas { 'global-workgroup':
+ augeas { "samba-$name":
context => $context,
- changes => $workgroup ? {
- default => "set ${target}/workgroup '${workgroup}'",
- '' => "rm ${target}/workgroup",
- },
+ changes => $changes,
require => Augeas['global-section'],
- notify => Class['samba::server::service']
+ notify => Class[$signal]
}
}
diff --git a/manifests/server/ads.pp b/manifests/server/ads.pp
new file mode 100644
index 0000000..1f8e602
--- /dev/null
+++ b/manifests/server/ads.pp
@@ -0,0 +1,116 @@
+# This module join samba server to Active Dirctory
+#
+# Copyright (c) 2013 Lebedev Vadim, abraham1901 at g mail dot c o m
+# Licensed under the MIT License, http://opensource.org/licenses/MIT
+
+class samba::server::ads($ensure = present,
+ $winbind_acct = 'admin',
+ $winbind_pass = 'SecretPass',
+ $realm = 'domain.com',
+ $winbind_uid = '10000-20000',
+ $winbind_gid = '10000-20000',
+ $winbind_enum_groups = 'yes',
+ $winbind_enum_users = 'yes',
+ $winbind_use_default_domain = 'yes',
+ $nsswitch = false,
+ $acl_group_control = 'yes',
+ $map_acl_inherit = 'yes',
+ $inherit_acls = 'yes',
+ $store_dos_attributes = 'yes',
+ $ea_support = 'yes',
+ $dos_filemode = 'yes',
+ $acl_check_permissions = false,
+ $map_system = 'no',
+ $map_archive = 'no',
+ $map_readonly = 'no',
+ $target_ou = 'Nix_Mashine') {
+
+ package{
+ 'krb5-user': ensure => installed;
+ 'winbind': ensure => installed;
+ 'expect': ensure => installed;
+ }
+
+ include samba::server::config
+ include samba::server::winbind
+
+ $signal = 'samba::server::winbind'
+
+ set_samba_option {
+ 'realm': value => $realm,
+ signal => $signal;
+ 'winbind uid': value => $winbind_uid,
+ signal => $signal;
+ 'winbind gid': value => $winbind_gid,
+ signal => $signal;
+ 'winbind enum groups': value => $winbind_enum_groups,
+ signal => $signal;
+ 'winbind enum users': value => $winbind_enum_users,
+ signal => $signal;
+ 'winbind use default domain': value => $winbind_use_default_domain,
+ signal => $signal;
+ 'acl group control': value => $acl_group_control;
+ 'map acl inherit': value => $map_acl_inherit;
+ 'inherit acls': value => $inherit_acls;
+ 'store dos attributes': value => $store_dos_attributes;
+ 'ea support': value => $ea_support;
+ 'dos filemode': value => $dos_filemode;
+ 'acl check permissions': value => $acl_check_permissions;
+ 'map system': value => $map_system;
+ 'map archive': value => $map_archive;
+ 'map readonly': value => $map_readonly;
+ }
+
+ $nss_file='etc/nsswitch.conf'
+
+ $changes=$nsswitch ? {
+ true => [
+ "set database[. = 'passwd']/service[1] compat",
+ "set database[. = 'passwd']/service[2] winbind",
+ "set database[. = 'group']/service[1] compat",
+ "set database[. = 'group']/service[2] winbind",
+ ],
+ false => [
+ "rm /files/${nss_file}/database[. = 'passwd']/service[. = 'winbind']",
+ "rm /files/${nss_file}/database[. = 'group']/service[. = 'winbind']",
+ ]
+ }
+
+ augeas { 'nsswitch':
+ context => "/files/${nss_file}",
+ changes => $changes
+ }
+
+ file {'verify_active_directory':
+ # this script returns 0 if join is intact
+ path => '/sbin/verify_active_directory',
+ owner => root,
+ group => root,
+ mode => "0755",
+ content => template("${module_name}/verify_active_directory.erb"),
+ require => [ Package['krb5-user', 'winbind', 'expect'],
+ Augeas['samba-realm', 'samba-security', 'samba-winbind enum users',
+ 'samba-winbind enum groups', 'samba-winbind uid', 'samba-winbind gid',
+ 'samba-winbind use default domain'] ],
+ }
+
+ file {'configure_active_directory':
+ # this script joins or leaves a domain
+ path => '/sbin/configure_active_directory',
+ owner => root,
+ group => root,
+ mode => "0755",
+ content => template("${module_name}/configure_active_directory.erb"),
+ require => [ Package['krb5-user', 'winbind', 'expect'],
+ Augeas['samba-realm', 'samba-security', 'samba-winbind enum users',
+ 'samba-winbind enum groups', 'samba-winbind uid', 'samba-winbind gid',
+ 'samba-winbind use default domain'] ],
+ }
+
+ exec {'join-active-directory':
+ # join the domain configured in samba.conf
+ command => '/sbin/configure_active_directory -j',
+ unless => '/sbin/verify_active_directory',
+ require => [ File['configure_active_directory', 'verify_active_directory'], Class['samba::server::winbind'] ],
+ }
+}
diff --git a/manifests/server/share.pp b/manifests/server/share.pp
index 7d308a0..b4eb02f 100644
--- a/manifests/server/share.pp
+++ b/manifests/server/share.pp
@@ -15,10 +15,9 @@ define samba::server::share($ensure = present,
$read_only = '',
$public = '',
$writable = '',
- $printable = '',
- ) {
+ $printable = '') {
- $context = '/files/etc/samba/smb.conf'
+ $context = $samba::server::context
$target = "target[. = '${name}']"
augeas { "${name}-section":
diff --git a/manifests/server/winbind.pp b/manifests/server/winbind.pp
new file mode 100644
index 0000000..76136b9
--- /dev/null
+++ b/manifests/server/winbind.pp
@@ -0,0 +1,16 @@
+class samba::server::winbind ($ensure = running, $enable = true) {
+ $service_name = 'winbind'
+
+ notify { 'winbind-service':
+ message => 'Check winbind service',
+ }
+
+ service { $service_name:
+ ensure => $ensure,
+ hasstatus => true,
+ hasrestart => true,
+ enable => $enable,
+ require => Class['samba::server::config']
+ }
+
+}
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-11 05:49:25 +0000