|
 |
1756dc |
From be3cea05e06cbfcfbd684b46c49fcdc8f8f5b880 Mon Sep 17 00:00:00 2001
|
|
|
1756dc |
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
|
|
|
1756dc |
Date: Tue, 18 Sep 2018 14:28:18 +0200
|
|
|
1756dc |
Subject: [PATCH 14/16] profiles: add options to exclude lines from
|
|
|
1756dc |
nsswitch.conf
|
|
|
1756dc |
|
|
|
1756dc |
There is a common use case that users want to change lines in nsswitch.conf
|
|
|
1756dc |
but do not want to create a whole custom profile. This applies especially
|
|
|
1756dc |
to nis profile as it sets all nsswitch databases and thus renders recently
|
|
|
1756dc |
added user-nsswitch.conf useless.
|
|
|
1756dc |
|
|
|
1756dc |
For distributing company wide configuration, custom profiles should be used though.
|
|
|
1756dc |
|
|
|
1756dc |
Resolves:
|
|
|
1756dc |
https://github.com/pbrezina/authselect/issues/95
|
|
|
1756dc |
---
|
|
|
1756dc |
profiles/nis/README | 50 ++++++++++++++++++++++++++++++++++
|
|
|
1756dc |
profiles/nis/nsswitch.conf | 28 +++++++++----------
|
|
|
1756dc |
profiles/sssd/README | 26 ++++++++++++++++++
|
|
|
1756dc |
profiles/sssd/nsswitch.conf | 12 ++++----
|
|
|
1756dc |
profiles/winbind/README | 14 ++++++++++
|
|
|
1756dc |
profiles/winbind/nsswitch.conf | 4 +--
|
|
|
1756dc |
6 files changed, 112 insertions(+), 22 deletions(-)
|
|
|
1756dc |
|
|
|
1756dc |
diff --git a/profiles/nis/README b/profiles/nis/README
|
|
|
1756dc |
index 34789b1e7643f0df082d40e0e87cb3d0823bba56..3911959c59287d2d5425ef304f744ff4cd5b408d 100644
|
|
|
1756dc |
--- a/profiles/nis/README
|
|
|
1756dc |
+++ b/profiles/nis/README
|
|
|
1756dc |
@@ -41,6 +41,56 @@ with-nispwquality::
|
|
|
1756dc |
without-nullok::
|
|
|
1756dc |
Do not add nullok parameter to pam_unix.
|
|
|
1756dc |
|
|
|
1756dc |
+DISABLE SPECIFIC NSSWITCH DATABASES
|
|
|
1756dc |
+-----------------------------------
|
|
|
1756dc |
+
|
|
|
1756dc |
+Normally, nsswitch databases set by the profile overwrites values set in
|
|
|
1756dc |
+user-nsswitch.conf. The following options can force authselect to
|
|
|
1756dc |
+ignore value set by the profile and use the one set in user-nsswitch.conf
|
|
|
1756dc |
+instead.
|
|
|
1756dc |
+
|
|
|
1756dc |
+with-custom-aliases::
|
|
|
1756dc |
+Ignore "aliases" map set by the profile.
|
|
|
1756dc |
+
|
|
|
1756dc |
+with-custom-automount::
|
|
|
1756dc |
+Ignore "automount" map set by the profile.
|
|
|
1756dc |
+
|
|
|
1756dc |
+with-custom-ethers::
|
|
|
1756dc |
+Ignore "ethers" map set by the profile.
|
|
|
1756dc |
+
|
|
|
1756dc |
+with-custom-group::
|
|
|
1756dc |
+Ignore "group" map set by the profile.
|
|
|
1756dc |
+
|
|
|
1756dc |
+with-custom-hosts::
|
|
|
1756dc |
+Ignore "hosts" map set by the profile.
|
|
|
1756dc |
+
|
|
|
1756dc |
+with-custom-initgroups::
|
|
|
1756dc |
+Ignore "initgroups" map set by the profile.
|
|
|
1756dc |
+
|
|
|
1756dc |
+with-custom-netgroup::
|
|
|
1756dc |
+Ignore "netgroup" map set by the profile.
|
|
|
1756dc |
+
|
|
|
1756dc |
+with-custom-networks::
|
|
|
1756dc |
+Ignore "networks" map set by the profile.
|
|
|
1756dc |
+
|
|
|
1756dc |
+with-custom-passwd::
|
|
|
1756dc |
+Ignore "passwd" map set by the profile.
|
|
|
1756dc |
+
|
|
|
1756dc |
+with-custom-protocols::
|
|
|
1756dc |
+Ignore "protocols" map set by the profile.
|
|
|
1756dc |
+
|
|
|
1756dc |
+with-custom-publickey::
|
|
|
1756dc |
+Ignore "publickey" map set by the profile.
|
|
|
1756dc |
+
|
|
|
1756dc |
+with-custom-rpc::
|
|
|
1756dc |
+Ignore "rpc" map set by the profile.
|
|
|
1756dc |
+
|
|
|
1756dc |
+with-custom-services::
|
|
|
1756dc |
+Ignore "services" map set by the profile.
|
|
|
1756dc |
+
|
|
|
1756dc |
+with-custom-shadow::
|
|
|
1756dc |
+Ignore "shadow" map set by the profile.
|
|
|
1756dc |
+
|
|
|
1756dc |
EXAMPLES
|
|
|
1756dc |
--------
|
|
|
1756dc |
* Enable NIS with no additional modules
|
|
|
1756dc |
diff --git a/profiles/nis/nsswitch.conf b/profiles/nis/nsswitch.conf
|
|
|
1756dc |
index 4397deb1ef347d5cb8798926f553c373f8c15649..f5451657f3d8b988b633304d549a3242257715d3 100644
|
|
|
1756dc |
--- a/profiles/nis/nsswitch.conf
|
|
|
1756dc |
+++ b/profiles/nis/nsswitch.conf
|
|
|
1756dc |
@@ -1,14 +1,14 @@
|
|
|
1756dc |
-aliases: files nis
|
|
|
1756dc |
-automount: files nis
|
|
|
1756dc |
-ethers: files nis
|
|
|
1756dc |
-group: files nis systemd
|
|
|
1756dc |
-hosts: files nis dns myhostname
|
|
|
1756dc |
-initgroups: files nis
|
|
|
1756dc |
-netgroup: files nis
|
|
|
1756dc |
-networks: files nis
|
|
|
1756dc |
-passwd: files nis systemd
|
|
|
1756dc |
-protocols: files nis
|
|
|
1756dc |
-publickey: files nis
|
|
|
1756dc |
-rpc: files nis
|
|
|
1756dc |
-services: files nis
|
|
|
1756dc |
-shadow: files nis
|
|
|
1756dc |
+aliases: files nis {exclude if "with-custom-aliases"}
|
|
|
1756dc |
+automount: files nis {exclude if "with-custom-automount"}
|
|
|
1756dc |
+ethers: files nis {exclude if "with-custom-ethers"}
|
|
|
1756dc |
+group: files nis systemd {exclude if "with-custom-group"}
|
|
|
1756dc |
+hosts: files nis dns myhostname {exclude if "with-custom-hosts"}
|
|
|
1756dc |
+initgroups: files nis {exclude if "with-custom-initgroups"}
|
|
|
1756dc |
+netgroup: files nis {exclude if "with-custom-netgroup"}
|
|
|
1756dc |
+networks: files nis {exclude if "with-custom-networks"}
|
|
|
1756dc |
+passwd: files nis systemd {exclude if "with-custom-passwd"}
|
|
|
1756dc |
+protocols: files nis {exclude if "with-custom-protocols"}
|
|
|
1756dc |
+publickey: files nis {exclude if "with-custom-publickey"}
|
|
|
1756dc |
+rpc: files nis {exclude if "with-custom-rpc"}
|
|
|
1756dc |
+services: files nis {exclude if "with-custom-services"}
|
|
|
1756dc |
+shadow: files nis {exclude if "with-custom-shadow"}
|
|
|
1756dc |
\ No newline at end of file
|
|
|
1756dc |
diff --git a/profiles/sssd/README b/profiles/sssd/README
|
|
|
1756dc |
index a2fbf66323f4893391474de49f323c06123a2ebf..42293ab39c628c285921b8b47c4a763fd0215472 100644
|
|
|
1756dc |
--- a/profiles/sssd/README
|
|
|
1756dc |
+++ b/profiles/sssd/README
|
|
|
1756dc |
@@ -59,6 +59,32 @@ with-pamaccess::
|
|
|
1756dc |
without-nullok::
|
|
|
1756dc |
Do not add nullok parameter to pam_unix.
|
|
|
1756dc |
|
|
|
1756dc |
+DISABLE SPECIFIC NSSWITCH DATABASES
|
|
|
1756dc |
+-----------------------------------
|
|
|
1756dc |
+
|
|
|
1756dc |
+Normally, nsswitch databases set by the profile overwrites values set in
|
|
|
1756dc |
+user-nsswitch.conf. The following options can force authselect to
|
|
|
1756dc |
+ignore value set by the profile and use the one set in user-nsswitch.conf
|
|
|
1756dc |
+instead.
|
|
|
1756dc |
+
|
|
|
1756dc |
+with-custom-passwd::
|
|
|
1756dc |
+Ignore "passwd" database set by the profile.
|
|
|
1756dc |
+
|
|
|
1756dc |
+with-custom-group::
|
|
|
1756dc |
+Ignore "group" database set by the profile.
|
|
|
1756dc |
+
|
|
|
1756dc |
+with-custom-netgroup::
|
|
|
1756dc |
+Ignore "netgroup" database set by the profile.
|
|
|
1756dc |
+
|
|
|
1756dc |
+with-custom-automount::
|
|
|
1756dc |
+Ignore "automount" database set by the profile.
|
|
|
1756dc |
+
|
|
|
1756dc |
+with-custom-services::
|
|
|
1756dc |
+Ignore "services" database set by the profile.
|
|
|
1756dc |
+
|
|
|
1756dc |
+with-custom-sudoers::
|
|
|
1756dc |
+Ignore "sudoers" database set by the profile.
|
|
|
1756dc |
+
|
|
|
1756dc |
EXAMPLES
|
|
|
1756dc |
--------
|
|
|
1756dc |
|
|
|
1756dc |
diff --git a/profiles/sssd/nsswitch.conf b/profiles/sssd/nsswitch.conf
|
|
|
1756dc |
index 5d05102ee8836f5bbce5f0527b87b1559fbe664e..9734bbbe68e7cf73a4a560e3573162d353e551e8 100644
|
|
|
1756dc |
--- a/profiles/sssd/nsswitch.conf
|
|
|
1756dc |
+++ b/profiles/sssd/nsswitch.conf
|
|
|
1756dc |
@@ -1,6 +1,6 @@
|
|
|
1756dc |
-passwd: sss files systemd
|
|
|
1756dc |
-group: sss files systemd
|
|
|
1756dc |
-netgroup: sss files
|
|
|
1756dc |
-automount: sss files
|
|
|
1756dc |
-services: sss files
|
|
|
1756dc |
-sudoers: files sss {include if "with-sudo"}
|
|
|
1756dc |
+passwd: sss files systemd {exclude if "with-custom-passwd"}
|
|
|
1756dc |
+group: sss files systemd {exclude if "with-custom-group"}
|
|
|
1756dc |
+netgroup: sss files {exclude if "with-custom-netgroup"}
|
|
|
1756dc |
+automount: sss files {exclude if "with-custom-automount"}
|
|
|
1756dc |
+services: sss files {exclude if "with-custom-services"}
|
|
|
1756dc |
+sudoers: files sss {include if "with-sudo"}
|
|
|
1756dc |
diff --git a/profiles/winbind/README b/profiles/winbind/README
|
|
|
1756dc |
index a824c7e78954bafffa6500e45a6e826835fd2b58..cd1606800d77eeb93be918f17fe47c2586b2519d 100644
|
|
|
1756dc |
--- a/profiles/winbind/README
|
|
|
1756dc |
+++ b/profiles/winbind/README
|
|
|
1756dc |
@@ -51,6 +51,20 @@ with-pamaccess::
|
|
|
1756dc |
without-nullok::
|
|
|
1756dc |
Do not add nullok parameter to pam_unix.
|
|
|
1756dc |
|
|
|
1756dc |
+DISABLE SPECIFIC NSSWITCH DATABASES
|
|
|
1756dc |
+-----------------------------------
|
|
|
1756dc |
+
|
|
|
1756dc |
+Normally, nsswitch databases set by the profile overwrites values set in
|
|
|
1756dc |
+user-nsswitch.conf. The following options can force authselect to
|
|
|
1756dc |
+ignore value set by the profile and use the one set in user-nsswitch.conf
|
|
|
1756dc |
+instead.
|
|
|
1756dc |
+
|
|
|
1756dc |
+with-custom-passwd::
|
|
|
1756dc |
+Ignore "passwd" database set by the profile.
|
|
|
1756dc |
+
|
|
|
1756dc |
+with-custom-group::
|
|
|
1756dc |
+Ignore "group" database set by the profile.
|
|
|
1756dc |
+
|
|
|
1756dc |
EXAMPLES
|
|
|
1756dc |
--------
|
|
|
1756dc |
* Enable winbind with no additional modules
|
|
|
1756dc |
diff --git a/profiles/winbind/nsswitch.conf b/profiles/winbind/nsswitch.conf
|
|
|
1756dc |
index 3018a7526ece30236969ce69dce729998c9a57de..8a23bd71935eb26c5093e4b2080b1d91b6de5582 100644
|
|
|
1756dc |
--- a/profiles/winbind/nsswitch.conf
|
|
|
1756dc |
+++ b/profiles/winbind/nsswitch.conf
|
|
|
1756dc |
@@ -1,2 +1,2 @@
|
|
|
1756dc |
-passwd: files winbind systemd
|
|
|
1756dc |
-group: files winbind systemd
|
|
|
1756dc |
+passwd: files winbind systemd {exclude if "with-custom-passwd"}
|
|
|
1756dc |
+group: files winbind systemd {exclude if "with-custom-group"}
|
|
|
1756dc |
--
|
|
|
1756dc |
2.17.1
|
|
|
1756dc |
|