pam/manifests/init.pp

class pam {

  class base {
      package { ["pam_ldap","nss_ldap","nscd"]:
        ensure => installed,  
      }

      service { nscd:
        ensure => running,
        path => '/etc/init.d/nscd',
      } 

      file { "system-auth":
         path => "/etc/pam.d/system-auth",
         owner => root,
         group => root,
         mode => 644,
         content => template("pam/system-auth")
      }

      file { "nsswitch.conf":
         path => "/etc/nsswitch.conf",
         owner => root,
         group => root,
         mode => 644,
         content => template("pam/nsswitch.conf")
      }

      $ldap_password = extlookup("${fqdn}_ldap_password",'x')
      file { "ldap.secret":
         path => "/etc/ldap.secret",
         owner => root,
         group => root,
         mode => 600,
         content => $ldap_password
      }
 
      file { "ldap.conf":
         path => "/etc/ldap.conf",
         owner => root,
         group => root,
         mode => 644,
         content => template("pam/ldap.conf")
      }
  } 
 
  # beware , this two classes are exclusive
 
  # for server where only admins can connect
  class admin_access {
    $access_class = "admin"
    include base
  }

  # for server where people can connect with ssh ( git, svn )
  class committers_access {
    # this is required, as we force the shell to be the restricted one
    # openssh will detect if the file do not exist and while refuse to log the
    # user, and erase the password ( see pam_auth.c in openssh code, seek badpw )
    # so the file must exist
    # permission to use svn, git, etc must be added separatly
    include restrictshell::shell
    $access_class = "committers"
    include base
  }
}
1	class pam {
2
3	class base {
4	package { ["pam_ldap","nss_ldap","nscd"]:
5	ensure => installed,
6	}
7
8	service { nscd:
9	ensure => running,
10	path => '/etc/init.d/nscd',
11	}
12
13	file { "system-auth":
14	path => "/etc/pam.d/system-auth",
15	owner => root,
16	group => root,
17	mode => 644,
18	content => template("pam/system-auth")
19	}
20
21	file { "nsswitch.conf":
22	path => "/etc/nsswitch.conf",
23	owner => root,
24	group => root,
25	mode => 644,
26	content => template("pam/nsswitch.conf")
27	}
28
29	$ldap_password = extlookup("${fqdn}_ldap_password",'x')
30	file { "ldap.secret":
31	path => "/etc/ldap.secret",
32	owner => root,
33	group => root,
34	mode => 600,
35	content => $ldap_password
36	}
37
38	file { "ldap.conf":
39	path => "/etc/ldap.conf",
40	owner => root,
41	group => root,
42	mode => 644,
43	content => template("pam/ldap.conf")
44	}
45	}
46
47	# beware , this two classes are exclusive
48
49	# for server where only admins can connect
50	class admin_access {
51	$access_class = "admin"
52	include base
53	}
54
55	# for server where people can connect with ssh ( git, svn )
56	class committers_access {
57	# this is required, as we force the shell to be the restricted one
58	# openssh will detect if the file do not exist and while refuse to log the
59	# user, and erase the password ( see pam_auth.c in openssh code, seek badpw )
60	# so the file must exist
61	# permission to use svn, git, etc must be added separatly
62	include restrictshell::shell
63	$access_class = "committers"
64	include base
65	}
66	}