ペパボはてな技術大会福岡編でのシンプルなLinuxユーザー管理システムSTNSの資料です
QZBNB(.01&1"#0JODϖύϘɾͯͳٕज़େձʙΠϯϑϥٕज़ج൫ʙ45/4
View Slide
IUUQTUFOTOBQPODPNγχΞɾΤϯδχΞࢁԼ!QZBNBϗεςΟϯάࣄۀ෦ϜʔϜʔυϝΠϯνʔϜ
-JOVYϢʔβʔཧ1.
-JOVYͱʁ
-JOVY
-JOVYϢʔβʔཧw -JOVYͰϑΝΠϧॴ༗ऀɺݖݶཧ͕ϢʔβʔɾάϧʔϓΛݩʹߦΘΕΔw ಛఆͷϢʔβʔݖݶͰίϚϯυΛ࣮ߦ͢Δ4VEPΛ࢝Ίɺଟ͘ͷίϚϯυͰϢʔβʔɾάϧʔϓͰ੍ޚ͞Ε͍ͯΔ
-JOVYϢʔβʔཧҰͭͷ8αʔϏεͰଟ͘ͷ-JOVY͕Քಇ͍ͯ͠Δ
-JOVYϢʔβʔཧؤுΔ͘Μ
͕ΜΕͳ͍܅ʁ
-JOVYϢʔβʔཧ
45/4w (PMBOHw 5PNMܗࣜͷઃఆϑΝΠϧw +40/ΠϯλʔϑΣʔεͷαʔόɾΫϥΠΞϯτw 8SBQQFSΛࣗ༝ʹมߋͰ͖Δ ϓϥΨϒϧ
ίϯηϓτ໊લղܾɺެ։伴औಘɺΞΧϯτೝূͷΈΛఏڙ͢Δɻଟ͘ΛΒͣɺγϯϓϧʹอͭ͜ͱͰཧɺΈ߹ΘͤΛ༰қʹɻhttps://github.com/STNS/STNS
-JOVYϢʔβʔάϧʔϓͷ໊લղܾ% ls -ltr-rw-r--r-- 1 pyama wheel 0 May 8 00:09 hatena_pepabo.txt% ls -ltr-rw-r--r-- 1 1000 1000 0 May 8 00:09 hatena_pepabo.txtid:1000 is pyama
ΞʔΩςΫνϟSTNShttp(1104)lslibnss-stnslibpam-stnsquery-wrapperkey-wrapper/user/name/pyama{name:pyama,id: 1000,dir:/home/pyama…}αʔόɾΫϥΠΞϯτؒhttpΛར༻ͨ͠JSONܗࣜͷΠϯλʔϑΣʔε
ઃఆϑΝΠϧαʔόQPSUJODMVEFFUDTUOTDPOGE[email protected][email protected][email protected][email protected]JE[email protected]LFZT<TTISTB99999ʜ>JEVTFST<FYBNQMF>QBTTXPSEGEDEBGFBBDBEBCGGCCCDEEDCGB
stns.conf(αʔό)stns.conf user.confgroup.confdeploy.confෳͷઃఆϑΝΠϧʹׂ͠ɺׂ৫͝ͱʹཧ͢ΔͱΑ͍
ઃఆϑΝΠϧΫϥΠΞϯτapi_end_point = ["http://:1104", "http://:1104"]user = "basic_user"password = "basic_password"wrapper_path = "/usr/local/bin/stns-query-wrapper"chain_ssh_wrapper = "/usr/libexec/openssh/ssh-ldap-wrapper"ssl_verify = true
ྫ͑͜͏͍͏͜ͱग़དྷΔprocesslibnss-stnslibpam-stnsquery-wrapperkey-wrapper/user/name/pyama{name:pyama,id: 1000,dir:/home/pyama…}LinuxϓϩηεͱͷΓऔΓSTNSΛར༻͠ɺϢʔβʔใRailsͰཧ͢Δ
σϓϩΠϢʔβʔͷཧ
σϓϩΠϢʔβʔͷཧ[email protected][email protected][email protected]/home/deploy/.ssh/authrized_keysʹ֤Ϣʔβʔͷެ։伴Λొ
σϓϩΠϢʔβʔͷཧࡢࠓͷWebαʔϏεͰσϓϩΠઐ༻ϢʔβʔΛઃ͚ͯσϓϩΠ͢Δ͜ͱ͕ଟ͍ɻ͔͠͠ɺطଘͷΈͰ࣮ݱ͢ΔʹσϓϩΠϢʔβʔͷ~/.ssh/authorized_keysʹσϓϩΠ͢ΔϢʔβʔͷެ։伴ΛฒͨΓ͢Δඞཁ͕͋ͬͨ
σϓϩΠϢʔβʔͷཧ[users.deploy]id = 1000group_id = 1000link_users = [“foo","bar"][users.foo]keys = ["ssh-rsa aaa”][users.bar]keys = ["ssh-rsa bbb"]deployϢʔβʔͰSSHϩάΠϯ͢Δࡍʹɺlink_usersͰࢦఆͨ͠Ϣʔβʔͷެ։伴Λར༻ग़དྷΔ→authorized_keysʹॻ͔ͳͯ͘ྑ্͍ʹɺɹ୭͕σϓϩΠग़དྷΔͷ͔Ұྎવ
৫ߏΛදݱ͢Δ
৫ߏΛදݱ͢Δྫ͑ɺٕज़1՝ʹॴଐ͢ΔϢʔβʔɺٕज़෦ͷϢʔβʔͰ͋Δɻͱ͋Δαʔόʹٕज़෦ͷϢʔβʔϩάΠϯग़དྷΔΑ͏ʹ͍ͨ͠ɻ
৫ߏΛදݱ͢Δ[groups.tech]users = ["antipop"]link_groups = [“tech-1"][groups.tech-1]users = ["pyama"]pyamatech-1ʹॴଐ͢ΔtechͷϢʔβʔͰ͋Δɻ۩ମతͳར༻γʔϯsshd_configͷAllowGroupsɺsudoersͳͲɺάϧʔϓͰཧ͢Δ߹ʹศརɻ
ಋೖ
ಋೖIUUQTUOTKQ
PTT
ಋೖw SQN EFCڞʹCJU CJU൛ͷఏڙ SFQPTUOTKQDVSMGT4-IUUQTSFQPTUOTKQTDSJQUTZVNSFQPTIcTIZVNJOTUBMMTUOTMJCOTTTUOTMJCQBNTUOTIUUQTHJUIVCDPN45/4TUOTDPPLCPPLIUUQTHJUIVCDPN45/4QVQQFUTUOTw $IFG 1VQQFUͷΫοΫϒοΫɺϚχϑΣετΛఏڙ 1VQQFUϚχϑΣετ!IGN͕։ൃͯ͘͠Εͨ
ಋೖΠϯετʔϧʙ44)ެ։伴ೝূ·Ͱඵ
ಋೖࣄྫ
Ϣʔβʔཧ(JUIVC'MPX(JUIVC&OUFSQSJTF͔ΒϢʔβʔσʔλΛ࡞͠ɺ1VMM3FRVFTU%SPOFͰࣗಈςετɾਓͷʹΑΔϨϏϡʔσϓϩΠ
HFOFSBUFCZUIPSDPOpHZNMUFBNTUFDIBENJO˒(JUIVCͷνʔϜ໊NVVBENJONJOOFBENJOLJCBOˑ[email protected]Λར༻͠৫Λ࿈݁εΫϦϓτͰใͷऔಘݩΛ()&ʹू͢Δ͜ͱʹΑΓɺϢʔβʔͷՃɺআΛ()&ʹҠৡ͢Δɻͦ͏͢Δ͜ͱͰγεςϜ͝ͱͷΞΧϯτࢄࡏΛ͙͜ͱ͕ग़དྷ·͢ɻ
ӡ༻Πϝʔδ2.
ӡ༻Πϝʔδnginxstnsnginxstns/HJOYͰ44-Λऴͭͭ͠ɺ$BQJTUSBOPͳͲͷσϓϩΠπʔϧͰTUOTDPOGΛσϓϩΠ
ӡ༻ΠϝʔδnginxstnsnginxstnsαʔόͷTUOTDPOGΛฤू͠ɺ4$1STZODͰಉظ
ӡ༻Πϝʔδ ͍͢processlibnss-stnslibpam-stnsquery-wrapperkey-wrapperFUDEΛར༻͠ɺαʔόϨεͳϢʔβʔཧ
ͱΓ͋͑ͣ৮ͬͯΈΔ
͜Ε͔ΒϢʔβཧΛ࢝ΊΔΈΜͳ3.
45/4ϘΫ͕։ൃऀͩͬͨ͠΄͏͕͍͍w ࡶԽͮ͠Β͍పఈͨ͠γϯϓϧ͞w γϯϓϧ͕ނʹ֦ுੑ͕ߴ͍w ಋೖͷख͕ؒগͳ͍
45/4ͰϢʔβʔཧΛ࢝ΊΑ͏
5IBOLZPV
͜͜Ͱঁੑਞ͔Β࣭͕ࡴ౸͢Δ