Hello,
I am in a student context and we use FreeIPA. The station type is fedora
31.
All profiles (home directories) are stored on an NFS kerberised crypted
share.
Students have personnal web pages on the NFS share with ~student_name1,
~student_name2, ...
The local httpd needs a TGT somwhere and i suppose, gssproxy is the good
approach.
I have try a lot of things with gssproxy to allow local httpd tu access
the pages with no real success.
Here is "the best" i had, but it's not very usable.
I suppose, it existes a nicer way ?
Merci beaucoup
The file is for automatic deployment : gssproxy part + sudo part for
students
I did a setup of un ipa account apache 48/48
#!/usr/bin/bash
kinit_admin(){
kinit admin <<EOF
xxxxxxx
EOF
}
apache_nfs(){
# A - gssproxy part
kinit_admin
rm -f /etc/gssproxy/httpd.keytab
ipa-getkeytab -s $( awk '/^server/ { print $3 }' /etc/ipa/default.conf )
-k /etc/gssproxy/httpd.keytab -p apache(a)MYDOMAIN.FR
kdestroy
#
# 80-httpd.conf
#
cat >/etc/gssproxy/80-httpd.conf <<ESC
[service/apache]
mechs = krb5
cred_store = ccache:FILE:/var/lib/gssproxy/clients/krb5cc_48
cred_store = client_keytab:/etc/gssproxy/httpd.keytab
euid = 48
ESC
mkdir /etc/systemd/system/httpd.service.d
cat >/etc/systemd/system/httpd.service.d/48-httpd.conf <<ESC
[Service]
Environment=GSS_USE_PROXY=1
ESC
/usr/bin/systemctl daemon-reload
/usr/bin/systemctl restart httpd
# B - sudo part
#
# sudo script gsproxy.sh in /usr/bin
#
cat >/usr/bin/gsproxy.sh <<ESC
/usr/bin/kinit \$(/usr/bin/logname)
if [ \$? -gt 0 ] ; then
/usr/bin/echo "Password error"
/usr/bin/echo "Restart sudo"
exit 1
fi
/usr/bin/kdestroy -c /var/lib/gssproxy/clients/krb5cc_48
/usr/bin/kinit -k -t /etc/gssproxy/httpd.keytab -c
/var/lib/gssproxy/clients/krb5cc_48 -p apache(a)MYDOMAIN.FR
/usr/bin/kdestroy
ESC
#
# sudo file
#
echo '%utilisateurs ALL = /usr/bin/gsproxy.sh'
/etc/sudoers.d/gsproxy
chmod +x /usr/bin/gsproxy.sh
}