qzwi: add LDAP

bundles/openldap/files/etc-default-slapd

@@ -0,0 +1,45 @@
+# Default location of the slapd.conf file or slapd.d cn=config directory. If
+# empty, use the compiled-in default (/etc/ldap/slapd.d with a fallback to
+# /etc/ldap/slapd.conf).
+SLAPD_CONF=/etc/ldap/slapd.conf
+
+# System account to run the slapd server under. If empty the server
+# will run as root.
+SLAPD_USER="openldap"
+
+# System group to run the slapd server under. If empty the server will
+# run in the primary group of its user.
+SLAPD_GROUP="openldap"
+
+# Path to the pid file of the slapd server. If not set the init.d script
+# will try to figure it out from $SLAPD_CONF (/etc/ldap/slapd.d by
+# default)
+SLAPD_PIDFILE=
+
+# slapd normally serves ldap only on all TCP-ports 389. slapd can also
+# service requests on TCP-port 636 (ldaps) and requests via unix
+# sockets.
+# Example usage:
+# SLAPD_SERVICES="ldap://127.0.0.1:389/ ldaps:/// ldapi:///"
+SLAPD_SERVICES="ldap:/// ldapi:/// ldaps://0.0.0.0:636/"
+
+# If SLAPD_NO_START is set, the init script will not start or restart
+# slapd (but stop will still work).  Uncomment this if you are
+# starting slapd via some other means or if you don't want slapd normally
+# started at boot.
+#SLAPD_NO_START=1
+
+# If SLAPD_SENTINEL_FILE is set to path to a file and that file exists,
+# the init script will not start or restart slapd (but stop will still
+# work).  Use this for temporarily disabling startup of slapd (when doing
+# maintenance, for example, or through a configuration management system)
+# when you don't want to edit a configuration file.
+SLAPD_SENTINEL_FILE=/etc/ldap/noslapd
+
+# For Kerberos authentication (via SASL), slapd by default uses the system
+# keytab file (/etc/krb5.keytab).  To use a different keytab file,
+# uncomment this line and change the path.
+#export KRB5_KTNAME=/etc/krb5.keytab
+
+# Additional options to pass to slapd
+SLAPD_OPTIONS=""

bundles/openldap/files/openssh-lpk_openldap.schema

@@ -0,0 +1,9 @@
+attributetype ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey'
+        DESC 'MANDATORY: OpenSSH Public key'
+        EQUALITY octetStringMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+
+objectclass ( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' SUP top AUXILIARY
+        DESC 'MANDATORY: OpenSSH LPK objectclass'
+        MAY ( sshPublicKey $ uid )
+        )

bundles/openldap/files/slapd.conf

@@ -0,0 +1,88 @@
+include         /etc/ldap/schema/core.schema
+include         /etc/ldap/schema/cosine.schema
+include         /etc/ldap/schema/nis.schema
+include         /etc/ldap/schema/inetorgperson.schema
+% for schema in sorted(conf.get('schemas', set())):
+include         /etc/ldap/schema/${schema}.schema
+% endfor
+include         /etc/ldap/schema/ppolicy.schema
+
+pidfile         /var/run/slapd/slapd.pid
+argsfile        /var/run/slapd/slapd.args
+
+# OpenLDAP logs can get rather spammy, so we enable logging only
+# on demand for debug purposes to keep the syslog nice and tidy.
+loglevel ${conf.get('loglevel', 0)}
+
+sizelimit unlimited
+
+disallow bind_anon
+
+modulepath      /usr/lib/ldap
+moduleload      back_mdb.so
+moduleload      back_monitor.so
+moduleload      back_ldap.so
+moduleload      memberof.so
+moduleload      syncprov.so
+moduleload      ppolicy.so
+moduleload      pw-sha2.so
+
+TLSCACertificateFile    /etc/ldap/ssl/${conf['ssl']}.crt_intermediate.pem
+TLSCertificateFile      /etc/ldap/ssl/${conf['ssl']}.crt.pem
+TLSCertificateKeyFile   /etc/ldap/ssl/${conf['ssl']}.key.pem
+#TLSVerifyClient never
+#TLSCRLCheck             none
+#security tls=1
+
+backend mdb
+database mdb
+suffix      "dc=qzwi,dc=de"
+checkpoint   32   30
+rootdn      "uid=root,dc=qzwi,dc=de"
+rootpw      ${conf['rootpw']}
+directory   /var/lib/ldap
+# mdb has a limit:
+maxsize     1000000000
+
+monitoring on
+
+index cn pres,eq
+index dc pres,eq
+index member pres,eq
+index memberOf pres,eq
+index memberUid eq
+index objectClass eq
+index uid pres,eq
+
+overlay memberof
+memberof-group-oc groupOfNames
+memberof-member-ad member
+memberof-memberof-ad memberOf
+memberof-refint TRUE
+
+overlay ppolicy
+
+#access to dn.one="ou=QZWI,dc=qzwi,dc=de"
+#        attrs=userPassword
+#        by anonymous auth
+#        by * break
+
+#access to * by group="ou=qzwi-admins,ou=Groups,dc=qzwi,dc=de" manage by * break
+
+% for tree, matches in sorted(conf.get('access', {}).items()):
+# ${tree}
+%  for access, user in sorted(matches.items()):
+access to dn.sub="${tree}" by dn.exact="${user}" ${access} by * break
+%  endfor
+# / ${tree}
+
+% endfor
+
+# Grant read access to all applications
+#access to dn.children="ou=Applications,dc=qzwi,dc=de" attrs=userPassword by anonymous auth by * break
+#access to dn.sub="ou=People,dc=qzwi,dc=de" by dn.children="ou=Applications,dc=qzwi,dc=de" read by * break
+#access to dn.sub="ou=Groups,dc=qzwi,dc=de" by dn.children="ou=Applications,dc=qzwi,dc=de" read by * break
+
+database monitor
+rootDN  "cn=admin,cn=Monitor"
+rootPW  admin

bundles/openldap/files/slapdump

@@ -0,0 +1,13 @@
+#!/bin/bash
+#      ^^^^ Needed for fancy co-processes.
+
+db=$1
+
+[[ -z "$db" ]] && { echo "Usage: $0 <db>" >&2; exit 1; }
+
+slapcat -b "$db" -f /etc/ldap/slapd.conf \
+    1> >(gzip >/var/tmp/ldapdumps/"$db".gz) \
+    2> >(grep -v \
+         -e "no DB_CONFIG file found in directory" \
+         -e "Expect poor performance" \
+         >&2)