Upgrade to Pro — share decks privately, control downloads, hide ads and more …

出会って10分で伝えるSTNSとLinuxの 認証基盤

出会って10分で伝えるSTNSとLinuxの 認証基盤

[KIXS Vol.000 インフラLTの祭典]にてLTしたSTNSについての資料です。

Kazuhiko Yamashita

August 27, 2016
Tweet

More Decks by Kazuhiko Yamashita

Other Decks in Technology

Transcript

  1. QZBNB(.01&1"#0JOD
    ,*947PMΠϯϑϥ-5ͷࡇయ
    ग़ձͬͯ෼Ͱ఻͑Δ
    45/4ͱ-JOVYͷ
    ೝূج൫

    View full-size slide

  2. IUUQTUFOTOBQPODPN
    γχΞɾΤϯδχΞ
    ࢁԼ࿨඙!QZBNB
    ϗεςΟϯάࣄۀ෦ϜʔϜʔυϝΠϯνʔϜ

    View full-size slide

  3. -JOVYೝূج൫
    1.

    View full-size slide

  4. -JOVYೝূج൫
    44)ϩάΠϯ
    Ϣʔβʔ໊
    άϧʔϓ໊ʁ
    ύεϫʔυʁ
    ެ։伴ʁ

    View full-size slide

  5. -JOVYೝূج൫
    w FUDQBTTXE FUDHSPVQ FUDTIBEPX BVUIPSJ[FE@LFZT
    w -%"1
    w .Z42-

    View full-size slide

  6. -JOVYೝূج൫
    wFUDQBTTXE FUDHSPVQ FUDTIBEPX BVUIPSJ[FE@LFZT
    ˠVTFSBEE HSPVQBEE
    w-%"1
    ˠ匠͕ඞཁ
    w.Z42-
    ˠϢʔβʔ؅ཧʹ͸Ͱ͔͗͢Δ

    View full-size slide

  7. -JOVYೝূج൫
    ੢ͷঊ ౦ͷঊ
    ೆͷঊ
    ๺ͷঊ
    ๭ࣾͰ͸αʔϏε͝ͱʹཚཱ͞Εͨ
    -%"1ΛঊͷྗΛ૯݁ूͨ͠
    ಉظεΫϦϓτͰ
    -%"1ิ׬ܭըΛ਱ߦத
    -%"1͸ΞτϦϏϡʔτ͕௥Ճ͠΍͘͢൚༻ੑ͕ߴ͍ͷͰɺ
    ӡ༻͔ΒᷓΕɺཚཱ͞Εͯ͠·͍͕ͪ

    View full-size slide

  8. ͲΕ΋͠ΜͲ͍͚Ͳ
    ΍Βͳ͖Ό͍͚ͳ͍

    View full-size slide

  9. 45/4
    w (PMBOH
    w 5PNMܗࣜͷઃఆϑΝΠϧ
    w +40/ΠϯλʔϑΣʔεͷαʔόɾΫϥΠΞϯτ
    w 8SBQQFSΛࣗ༝ʹมߋͰ͖Δ ϓϥΨϒϧ

    View full-size slide

  10. ίϯηϓτ
    ໊લղܾɺެ։伴औಘɺΞΧ΢ϯτೝূͷΈΛఏڙ
    ͢Δɻଟ͘Λ΍Βͣɺγϯϓϧʹอͭ͜ͱͰ؅ཧɺ
    ૊Έ߹ΘͤΛ༰қʹɻ
    https://github.com/STNS/STNS

    View full-size slide

  11. -JOVYϢʔβʔάϧʔϓͷ໊લղܾ
    % ls -ltr
    -rw-r--r-- 1 pyama wheel 0 May 8 00:09 hatena_pepabo.txt
    % ls -ltr
    -rw-r--r-- 1 1000 1000 0 May 8 00:09 hatena_pepabo.txt
    id:1000 is pyama

    View full-size slide

  12. w TVEPFST
    w TTIE@DPOpH "MMPX(SPVQT "MMPX6TFST

    w QBNೝূ
    -JOVYϢʔβʔάϧʔϓͷ໊લղܾ

    View full-size slide

  13. ΞʔΩςΫνϟ
    STNS
    http(1104)
    ls
    libnss-stns
    libpam-stns
    query-wrapper
    key-wrapper
    /user/name/pyama
    {
    name:pyama,
    id: 1000,
    dir:/home/pyama

    }
    αʔόɾΫϥΠΞϯτؒ͸httpΛར༻ͨ͠
    JSONܗࣜͷΠϯλʔϑΣʔε

    View full-size slide

  14. ઃఆϑΝΠϧαʔό
    QPSU
    JODMVEFFUDTUOTDPOGE
    TBMU@FOBCMFUSVF
    TUSFUDIJOH@OVNCFS
    VTFSlCBTJD@VTFS
    QBTTXPSECBTJD@QBTTXPSE

    JE
    HSPVQ@JE
    LFZT<TTISTB99999ʜ>

    JE
    VTFST<FYBNQMF>

    QBTTXPSE
    GEDEBGFBBDBEBCGGCCCDEEDCGB

    View full-size slide

  15. ઃఆϑΝΠϧΫϥΠΞϯτ
    api_end_point = ["http://:1104", "http://:1104"]
    user = "basic_user"
    password = "basic_password"
    wrapper_path = "/usr/local/bin/stns-query-wrapper"
    chain_ssh_wrapper = "/usr/libexec/openssh/ssh-ldap-wrapper"
    ssl_verify = true
    LDAPͱͷڞଘ΋Մೳ

    View full-size slide

  16. XSBQQFSίϚϯυ
    $ stns-query-wrapper /user/name/pyama
    {
    "metadata": {
    "api_version": 2,
    "result": "success",
    "min_id": 2000
    },
    "items": {
    "pyama": {
    "id": 10301,
    "password": "",
    "hash_type": "",
    "group_id": 2000,
    "directory": "",
    "shell": "",
    "gecos": "",
    "keys": [
    "ssh-rsa xxx"
    ],
    "link_users": null
    }
    }

    View full-size slide

  17. ಋೖ
    w SQN EFCڞʹCJU CJU൛ͷఏڙ SFQPTUOTKQ

    DVSMGT4-IUUQTSFQPTUOTKQTDSJQUTZVNSFQPTIcTI
    ZVNJOTUBMMTUOTMJCOTTTUOTMJCQBNTUOT
    IUUQTHJUIVCDPN45/4TUOTDPPLCPPL
    IUUQTHJUIVCDPN45/4QVQQFUTUOT
    w $IFG 1VQQFUͷΫοΫϒοΫɺϚχϑΣετΛఏڙ
    1VQQFUϚχϑΣετ͸!IGN͕։ൃͯ͘͠Εͨ

    View full-size slide

  18. ಋೖ
    Πϯετʔϧʙ44)ެ։伴ೝূ·Ͱ෼ඵ

    View full-size slide

  19. Ϣʔβʔ؅ཧ΋(JUIVC'MPX
    (JUIVC&OUFSQSJTF͔ΒϢʔβʔσʔλΛ࡞੒͠ɺ1VMM3FRVFTU
    ࣗಈςετɾਓͷ໨ʹΑΔϨϏϡʔ
    σϓϩΠ

    View full-size slide

  20. ӡ༻Πϝʔδ
    nginx
    stns
    nginx
    stns
    /HJOYͰ44-Λऴ୺ͭͭ͠ɺ$BQJTUSBOPͳͲͷσϓϩΠπʔϧͰ
    TUOTDPOGΛσϓϩΠ

    View full-size slide

  21. ӡ༻Πϝʔδ
    nginx
    stns
    nginx
    stns
    αʔόͷTUOTDPOGΛ௚઀ฤू͠ɺ4$1΍STZODͰಉظ

    View full-size slide

  22. 45/4ϘΫ͕։ൃऀͩ͠࢖ͬͨ΄͏͕͍͍
    w ൥ࡶԽͮ͠Β͍పఈͨ͠γϯϓϧ͞
    w γϯϓϧ͕ނʹ֦ுੑ͕ߴ͍
    w ಋೖͷख͕ؒগͳ͍
    w ೔ຊޠυΩϡϝϯτͷఏڙɺ։ൃऀ͕೔ຊ࣌ؒʹ͍Δ

    View full-size slide

  23. 45/4ͰϢʔβʔ؅ཧΛ
    ࢝ΊΑ͏

    View full-size slide