pam common-session is now in puppet - move login check until after puppet is setup

[mirror/dsa-wiki.git] / input / howto / new-machine.creole

diff --git a/input/howto/new-machine.creole b/input/howto/new-machine.creole
index 22cff66..86b0518 100644 (file)
--- a/input/howto/new-machine.creole
+++ b/input/howto/new-machine.creole
@@ -13,10 +13,7 @@ Note: this is partially obsolete now that we have [[puppet|howto/puppet-setup]].
     echo 'APT::Install-Recommends 0;' > /etc/apt/apt.conf.d/local-recommends
 }}}
 
-* sane locales:
-
- make sure there is _no_ locale defined in /etc/environment and /etc/default/locale
-
+* sane locales: (make sure there is _no_ locale defined in /etc/environment and /etc/default/locale)
 {{{
    echo -n > /etc/environment
    echo -n > /etc/default/locale
@@ -97,19 +94,14 @@ EOF
     : :: draghi :: && sudo -u sshdist ud-generate
 }}}
 
-* fix nsswitch for ud fu.
+* fix nsswitch for ud fu.  (you might have to restart sshd here)
 {{{
     sed -i -e 's/^passwd:\[[:space:]]\+compat$/passwd:         compat db/;
               s/^group:\[[:space:]]\+compat$/group:          db compat/;
               s/^shadow:\[[:space:]]\+compat$/shadow:         compat db/' \
         /etc/nsswitch.conf
-}}}
-
-(you might have to restart sshd here:
-{{{
     (cd / && env -i /etc/init.d/ssh restart)
 }}}
-)
 
 * on the host, run ud-replicate
 {{{
@@ -122,19 +114,11 @@ EOF
     id weasel
 }}}
 
-* add pam_mkhomedir to common-session:
-{{{
-    grep pam_mkhomedir /etc/pam.d/common-session || \
-    echo "session optional        pam_mkhomedir.so skel=/etc/skel umask=0022" >> /etc/pam.d/common-session
-}}}
-
 * install debian.org which brings you shells and much other fun
 {{{
     apt-get install debian.org
 }}}
 
-* try to login using your user and ssh key.  you should get a homedir.
-
 * make ca-certificates sane:  (choose to *not* trust new certs, and we only want the spi cert activated)
 {{{
     echo "ca-certificates ca-certificates/trust_new_crts  select no" | debconf-set-selections
@@ -157,49 +141,12 @@ EOF
     apt-get install vim && update-alternatives --set editor /usr/bin/vim.basic
 }}}
 
-* setup sudo
-{{{
-    grep '^%adm' /etc/sudoers || echo '%adm    ALL=(ALL) ALL' >> /etc/sudoers
-    grep '^%adm.*apt-get' /etc/sudoers || echo '%adm    ALL=(ALL) NOPASSWD: /usr/bin/apt-get update, /usr/bin/apt-get dist-upgrade, /usr/bin/apt-get clean, /usr/sbin/samhain -t check -i -p err -s none -l none -m none' >> /etc/sudoers
-
-    apt-get install libpam-pwdfile
-    cat > /etc/pam.d/sudo << EOF
-#%PAM-1.0
-
-auth [authinfo_unavail=ignore success=done ignore=ignore default=die] pam_pwdfile.so pwdfile=/var/lib/misc/thishost/sudo-passwd
-auth required pam_unix.so nullok_secure try_first_pass
-#@include common-auth
-@include common-account
-
-session required pam_permit.so
-session required pam_limits.so
-EOF
-}}}
-
-* OPEN A NEW SHELL - DO _NOT_ LOG OUT OF THIS ONE:<BR>
-  test that the dedicated sudo password works.  if not, undo the pam sudo config.
-  (comment out the auth lines and include common-auth again)
-
-* setup ldap.conf:
-{{{
-    grep '^URI.*db.debian.org' /etc/ldap/ldap.conf || cat >> /etc/ldap/ldap.conf << EOF
-
-URI             ldap://db.debian.org
-BASE            dc=debian,dc=org
-
-TLS_CACERT      /etc/ssl/certs/spi-cacert-2008.pem
-TLS_REQCERT     hard
-EOF
-}}}
-
 * add to munin on spohr
 {{{
     : :: spohr :: && sudo vi /etc/munin/munin.conf
 }}}
 
 
-* add host to nagios config
-
 * disable password auth with ssh, once you verified you can log in
   and become root using keys.
 {{{
@@ -214,8 +161,12 @@ EOF
 
 * setup [[puppet|howto/puppet-setup]]
 
+* try to login using your user and ssh key.  you should get a homedir.
+
 * edit dedication into in $DSA-PUPPET/modules/debian-org/misc/local.yaml
 
 * add to nagios
 
+* add host to ldap: ud-host -a $USER -h ....
+
 -- weasel, Wed, 04 Jun 2008 20:52:56 +0200