Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Speaker Deck
PRO
Sign in
Sign up for free
STNS pepabo_hatena_tech_con
Kazuhiko Yamashita
July 09, 2016
Technology
0
4.9k
STNS pepabo_hatena_tech_con
ペパボはてな技術大会福岡編でのシンプルなLinuxユーザー管理システムSTNSの資料です
Kazuhiko Yamashita
July 09, 2016
Tweet
Share
More Decks by Kazuhiko Yamashita
See All by Kazuhiko Yamashita
Is Kubernetes On-premises Hardway?
pyama86
2
290
突然のグループ一斉在宅勤務開始!!1に おける働き方を変革する技術や仕組み
pyama86
4
870
企業に必要とされている インフラ技術とこれから
pyama86
13
8k
「ペパボっぽい」 エンジニアカルチャーを創る 言葉と仕組み
pyama86
20
4.8k
CloudNative Buildpacksで創る、CloudNativeな開発体験
pyama86
9
12k
CN Buildpacksが作る未来
pyama86
2
2.2k
クラウドネイティブを創る技術
pyama86
3
1.5k
linux-middleware-development-by-go.pdf
pyama86
1
2.2k
ふくばねてす_1_CNBuildpack.pdf
pyama86
0
140
Other Decks in Technology
See All in Technology
TypeScript 4.7と型レベルプログラミング
uhyo
5
2.5k
技術広報の役割を定義してみた 2022年春
afroscript
3
2.2k
エンタープライズにおけるSRE立ち上げとNew Relic選定に至った背景とは / SRE Startup and New Relic in the Enterprise
tomoyakitaura
2
110
AWS Control TowerとAWS Organizationsを活用した組織におけるセキュリティ設定
fu3ak1
2
580
msal.jsのあれこれ
takas0522
0
1.2k
Power BI Premiumでデータ準備!
hanaseleb
1
170
CADDi HCMC Technology Center
caddi_eng
0
160
AWS全体のセキュリティ管理と快適なセキュリティ運用
cmusudakeisuke
2
10k
The Real MVP: Going from idea to users' hands
adavis
0
520
220428event_karibe_part
caddi_eng
0
180
OSINT/GEOINT ワークショップ 20220514 古橋資料
furuhashilab
2
200
モデリング、コンテキスト トランジション +1 / Data modeling
ishiayaya
0
110
Featured
See All Featured
Rails Girls Zürich Keynote
gr2m
86
12k
Building Better People: How to give real-time feedback that sticks.
wjessup
343
17k
Building Applications with DynamoDB
mza
83
4.6k
The Illustrated Children's Guide to Kubernetes
chrisshort
14
34k
GraphQLとの向き合い方2022年版
quramy
16
8k
Pencils Down: Stop Designing & Start Developing
hursman
112
9.8k
ReactJS: Keep Simple. Everything can be a component!
pedronauck
655
120k
Rebuilding a faster, lazier Slack
samanthasiow
62
7.2k
Adopting Sorbet at Scale
ufuk
63
7.5k
Responsive Adventures: Dirty Tricks From The Dark Corners of Front-End
smashingmag
237
19k
RailsConf & Balkan Ruby 2019: The Past, Present, and Future of Rails at GitHub
eileencodes
119
28k
How GitHub (no longer) Works
holman
296
140k
Transcript
QZBNB(.01&1"#0JOD ϖύϘɾͯͳٕज़େձʙΠϯϑϥٕज़ج൫ʙ 45/4
IUUQTUFOTOBQPODPN γχΞɾΤϯδχΞ ࢁԼ!QZBNB ϗεςΟϯάࣄۀ෦ϜʔϜʔυϝΠϯνʔϜ
-JOVYϢʔβʔཧ 1.
-JOVYͱʁ
-JOVY
-JOVYϢʔβʔཧ w -JOVYͰϑΝΠϧॴ༗ऀɺݖݶཧ͕Ϣʔβʔɾάϧʔϓ ΛݩʹߦΘΕΔ w ಛఆͷϢʔβʔݖݶͰίϚϯυΛ࣮ߦ͢Δ4VEPΛ࢝Ίɺ ଟ͘ͷίϚϯυͰϢʔβʔɾάϧʔϓͰ੍ޚ͞Ε͍ͯΔ
-JOVYϢʔβʔཧ Ұͭͷ8&#αʔϏεͰ ଟ͘ͷ-JOVY͕Քಇ͍ͯ͠Δ
-JOVYϢʔβʔཧ ؤுΔ͘Μ
None
͕ΜΕͳ͍܅ʁ
None
-JOVYϢʔβʔཧ
45/4 w (PMBOH w 5PNMܗࣜͷઃఆϑΝΠϧ w +40/ΠϯλʔϑΣʔεͷαʔόɾΫϥΠΞϯτ w 8SBQQFSΛࣗ༝ʹมߋͰ͖Δ ϓϥΨϒϧ
ίϯηϓτ ໊લղܾɺެ։伴औಘɺΞΧϯτೝূͷΈΛఏڙ ͢Δɻଟ͘ΛΒͣɺγϯϓϧʹอͭ͜ͱͰཧɺ Έ߹ΘͤΛ༰қʹɻ https://github.com/STNS/STNS
-JOVYϢʔβʔάϧʔϓͷ໊લղܾ % ls -ltr -rw-r--r-- 1 pyama wheel 0 May
8 00:09 hatena_pepabo.txt % ls -ltr -rw-r--r-- 1 1000 1000 0 May 8 00:09 hatena_pepabo.txt id:1000 is pyama
ΞʔΩςΫνϟ STNS http(1104) ls libnss-stns libpam-stns query-wrapper key-wrapper /user/name/pyama {
name:pyama, id: 1000, dir:/home/pyama … } αʔόɾΫϥΠΞϯτؒhttpΛར༻ͨ͠ JSONܗࣜͷΠϯλʔϑΣʔε
ઃఆϑΝΠϧαʔό QPSU JODMVEFFUDTUOTDPOGE TBMU@FOBCMFUSVF TUSFUDIJOH@OVNCFS VTFSlCBTJD@VTFS QBTTXPSECBTJD@QBTTXPSE <VTFSTFYBNQMF> JE
HSPVQ@JE LFZT<TTISTB99999ʜ> <HSPVQTFYBNQMF> JE VTFST<FYBNQMF> <TVEPFSTFYBNQMF> QBTTXPSE GEDEBGFBBDBEBCGGCCCDEEDCGB
stns.conf(αʔό) stns.conf user.conf group.conf deploy.conf ෳͷઃఆϑΝΠϧʹׂ͠ɺ ׂ৫͝ͱʹཧ͢ΔͱΑ͍
ઃఆϑΝΠϧΫϥΠΞϯτ api_end_point = ["http://<server-master>:1104", "http://<server-slave>:1104"] user = "basic_user" password =
"basic_password" wrapper_path = "/usr/local/bin/stns-query-wrapper" chain_ssh_wrapper = "/usr/libexec/openssh/ssh-ldap-wrapper" ssl_verify = true
ྫ͑͜͏͍͏͜ͱग़དྷΔ process libnss-stns libpam-stns query-wrapper key-wrapper /user/name/pyama { name:pyama, id:
1000, dir:/home/pyama … } LinuxϓϩηεͱͷΓऔΓSTNSΛར༻͠ɺ ϢʔβʔใRailsͰཧ͢Δ
σϓϩΠϢʔβʔͷ ཧ
σϓϩΠϢʔβʔͷཧ deploy@muumuu-domain.com deploy@muumuu-domain.com deploy@muumuu-domain.com /home/deploy/.ssh/authrized_keys ʹ֤Ϣʔβʔͷެ։伴Λొ
σϓϩΠϢʔβʔͷཧ ࡢࠓͷWebαʔϏεͰσϓϩΠઐ༻ϢʔβʔΛઃ ͚ͯσϓϩΠ͢Δ͜ͱ͕ଟ͍ɻ ͔͠͠ɺطଘͷΈͰ࣮ݱ͢ΔʹσϓϩΠϢʔ βʔͷ~/.ssh/authorized_keysʹσϓϩΠ͢ΔϢʔ βʔͷެ։伴ΛฒͨΓ͢Δඞཁ͕͋ͬͨ
σϓϩΠϢʔβʔͷཧ [users.deploy] id = 1000 group_id = 1000 link_users =
[“foo","bar"] [users.foo] keys = ["ssh-rsa aaa”] [users.bar] keys = ["ssh-rsa bbb"] deployϢʔβʔͰSSHϩάΠϯ͢Δࡍʹɺlink_usersͰ ࢦఆͨ͠Ϣʔβʔͷެ։伴Λར༻ग़དྷΔ →authorized_keysʹॻ͔ͳͯ͘ྑ্͍ʹɺ ɹ୭͕σϓϩΠग़དྷΔͷ͔Ұྎવ
৫ߏΛදݱ͢Δ
৫ߏΛදݱ͢Δ ྫ͑ɺٕज़1՝ʹॴଐ͢ΔϢʔβʔɺٕज़෦ͷϢʔ βʔͰ͋Δɻͱ͋Δαʔόʹٕज़෦ͷϢʔβʔϩά Πϯग़དྷΔΑ͏ʹ͍ͨ͠ɻ
৫ߏΛදݱ͢Δ [groups.tech] users = ["antipop"] link_groups = [“tech-1"] [groups.tech-1] users
= ["pyama"] pyamatech-1ʹॴଐ͢ΔtechͷϢʔβʔͰ͋Δɻ ۩ମతͳར༻γʔϯsshd_configͷAllowGroupsɺ sudoersͳͲɺάϧʔϓͰཧ͢Δ߹ʹศརɻ
ಋೖ
ಋೖ IUUQTUOTKQ
PTT
ಋೖ
ಋೖ w SQN EFCڞʹCJU CJU൛ͷఏڙ SFQPTUOTKQ DVSMGT4-IUUQTSFQPTUOTKQTDSJQUTZVNSFQPTIcTI ZVNJOTUBMMTUOTMJCOTTTUOTMJCQBNTUOT IUUQTHJUIVCDPN45/4TUOTDPPLCPPL
IUUQTHJUIVCDPN45/4QVQQFUTUOT w $IFG 1VQQFUͷΫοΫϒοΫɺϚχϑΣετΛఏڙ 1VQQFUϚχϑΣετ!IGN͕։ൃͯ͘͠Εͨ
ಋೖ Πϯετʔϧʙ44)ެ։伴ೝূ·Ͱඵ
ಋೖࣄྫ
Ϣʔβʔཧ(JUIVC'MPX (JUIVC&OUFSQSJTF͔ΒϢʔβʔσʔλΛ࡞͠ɺ1VMM3FRVFTU %SPOFͰࣗಈςετɾਓͷʹΑΔϨϏϡʔ σϓϩΠ
HFOFSBUFCZUIPS DPOpHZNM UFBNT UFDIBENJO˒(JUIVCͷνʔϜ໊ NVVBENJO NJOOFBENJO LJCBOˑMJOL@HSPVQΛར༻͠৫Λ࿈݁ εΫϦϓτͰใͷऔಘݩΛ()&ʹू͢Δ͜ͱʹΑΓɺϢʔβʔ ͷՃɺআΛ()&ʹҠৡ͢Δɻ ͦ͏͢Δ͜ͱͰγεςϜ͝ͱͷΞΧϯτࢄࡏΛ͙͜ͱ͕ग़དྷ·
͢ɻ
ӡ༻Πϝʔδ 2.
ӡ༻Πϝʔδ nginx stns nginx stns /HJOYͰ44-Λऴͭͭ͠ɺ$BQJTUSBOPͳͲͷσϓϩΠπʔϧͰ TUOTDPOGΛσϓϩΠ
ӡ༻Πϝʔδ nginx stns nginx stns αʔόͷTUOTDPOGΛฤू͠ɺ4$1STZODͰಉظ
ӡ༻Πϝʔδ ͍͢ process libnss-stns libpam-stns query-wrapper key-wrapper FUDEΛར༻͠ɺαʔόϨεͳϢʔβʔཧ
ͱΓ͋͑ͣ৮ͬͯΈΔ
͜Ε͔ΒϢʔβཧΛ࢝ΊΔ ΈΜͳ 3.
45/4ϘΫ͕։ൃऀͩͬͨ͠΄͏͕͍͍ w ࡶԽͮ͠Β͍పఈͨ͠γϯϓϧ͞ w γϯϓϧ͕ނʹ֦ுੑ͕ߴ͍ w ಋೖͷख͕ؒগͳ͍
45/4ͰϢʔβʔཧΛ ࢝ΊΑ͏
5IBOLZPV
͜͜Ͱঁੑਞ͔Β ࣭͕ࡴ౸͢Δ