[Kim] vyos#2554 customise vyos-1x

* update sshd_config template with parameters required for freeipa/sssd
* symlink config to /config/freeipa so it can be updated and retained
  * /etc/krb5.conf
  * /etc/krb5.conf.d
  * /etc/nslcd.conf
  * /etc/nsswitch.conf
  * /etc/pam.d/common-account
  * /etc/pam.d/common-account-ldaps
  * /etc/pam.d/common-auth
  * /etc/pam.d/common-auth-ldaps
  * /etc/pam.d/common-session
  * /etc/pam.d/common-session-ldaps
  * /etc/pam.d/common-session-noninteractive
  * /etc/pam.d/common-session-noninteractive-ldaps
  * /etc/sssd/conf.d
  * /etc/sssd/pki
  * /etc/sssd/sssd.conf
  * /etc/telegraf/telegraf.conf
  * /etc/telegraf/telegraf.d
  * /root/.k5login
  * /usr/local/share/ca-certificates
  * /var/lib/ipa-client
* override service definitions to start in mgmt vrf
  * nslcd
  * pdns-recursor
  * telegraf

data/templates/ssh/sshd_config.j2

@@ -31,6 +31,14 @@ AddressFamily any
 DebianBanner no
 KbdInteractiveAuthentication no
 
+# Added freeipa config
+
+UsePAM yes
+GSSAPIAuthentication yes
+ChallengeResponseAuthentication yes
+AuthorizedKeysCommandUser nobody
+AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
+
 #
 # User configurable section
 #

src/etc/krb5.conf

@@ -0,0 +1 @@
+/config/freeipa/etc/krb5.conf

src/etc/krb5.conf.d

@@ -0,0 +1 @@
+/config/freeipa/etc/krb5.conf.d

src/etc/nslcd.conf

@@ -0,0 +1 @@
+/config/freeipa/etc/nslcd.conf

src/etc/nsswitch.conf

@@ -0,0 +1 @@
+/config/freeipa/etc/nsswitch.conf

src/etc/pam.d/common-account

@@ -0,0 +1 @@
+/config/freeipa/etc/pam.d/common-account

src/etc/pam.d/common-account-ldaps

@@ -0,0 +1 @@
+/config/freeipa/etc/pam.d/common-account-ldaps

src/etc/pam.d/common-auth

@@ -0,0 +1 @@
+/config/freeipa/etc/pam.d/common-auth

src/etc/pam.d/common-auth-ldaps

@@ -0,0 +1 @@
+/config/freeipa/etc/pam.d/common-auth-ldaps

src/etc/pam.d/common-session

@@ -0,0 +1 @@
+/config/freeipa/etc/pam.d/common-session

src/etc/pam.d/common-session-ldaps

@@ -0,0 +1 @@
+/config/freeipa/etc/pam.d/common-session-ldaps

src/etc/pam.d/common-session-noninteractive

@@ -0,0 +1 @@
+/config/freeipa/etc/pam.d/common-session-noninteractive

src/etc/pam.d/common-session-noninteractive-ldaps

@@ -0,0 +1 @@
+/config/freeipa/etc/pam.d/common-session-noninteractive-ldaps

src/etc/sssd/conf.d

@@ -0,0 +1 @@
+/config/freeipa/etc/sssd/conf.d

src/etc/sssd/pki

@@ -0,0 +1 @@
+/config/freeipa/etc/sssd/pki

src/etc/sssd/sssd.conf

@@ -0,0 +1 @@
+/config/freeipa/etc/sssd/sssd.conf

src/etc/systemd/system/nslcd.service.d/override.conf

@@ -0,0 +1,3 @@
+[Service]
+ExecStart=
+ExecStart=/usr/bin/ip vrf exec mgmt /etc/init.d/nslcd start

src/etc/systemd/system/pdns-recursor.service.d/override.conf

@@ -1,8 +1,15 @@
 [Service]
+User=root
 WorkingDirectory=
 WorkingDirectory=/run/powerdns
 RuntimeDirectory=
 RuntimeDirectory=powerdns
 RuntimeDirectoryPreserve=yes
 ExecStart=
-ExecStart=/usr/sbin/pdns_recursor --daemon=no --write-pid=no --disable-syslog --log-timestamp=no --config-dir=/run/powerdns --socket-dir=/run/powerdns
+ExecStart=/bin/ip vrf exec mgmt /usr/sbin/pdns_recursor --daemon=no --write-pid=no --disable-syslog --log-timestamp=no --config-dir=/run/powerdns --socket-dir=/run/powerdns --setuid=pdns
+
+LimitMEMLOCK=8388608
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_CHOWN CAP_SYS_ADMIN CAP_NET_ADMIN CAP_DAC_OVERRIDE CAP_SETUID
+AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_CHOWN CAP_SYS_ADMIN CAP_NET_ADMIN CAP_DAC_OVERRIDE CAP_SETUID
+ProtectControlGroups=false
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK

src/etc/systemd/system/telegraf.service.d/override.conf

@@ -0,0 +1,12 @@
+[Unit]
+After=vyos-router.service
+
+[Service]
+User=root
+ExecStart=
+ExecStart=/usr/sbin/ip vrf exec mgmt /sbin/runuser -u telegraf -- /usr/bin/telegraf -config /etc/telegraf/telegraf.conf -config-directory /etc/telegraf/telegraf.d $TELEGRAF_OPTS
+RestartSec=10s
+
+[Install]
+WantedBy=
+WantedBy=vyos.target

src/etc/telegraf/telegraf.conf

@@ -0,0 +1 @@
+/config/telegraf/telegraf.conf

src/etc/telegraf/telegraf.d

@@ -0,0 +1 @@
+/config/telegraf/telegraf.d

src/root/.k5login

@@ -0,0 +1 @@
+/config/freeipa/root/.k5login

src/usr/local/share/ca-certificates

@@ -0,0 +1 @@
+/config/freeipa/usr/local/share/ca-certificates

src/var/lib/ipa-client

@@ -0,0 +1 @@
+/config/freeipa/var/lib/ipa-client