Table of Contents

1. Description
2. Setup - The basics of getting started with simp_ds389
   • What simp_ds389 affects
   • Setup requirements
   • Beginning with simp_ds389
3. Usage - Configuration options and additional functionality
4. Reference - An under-the-hood peek at what the module is doing and how
5. Limitations - OS compatibility, etc.
6. Development - Guide for contributing to the module
   • Acceptance Tests - Beaker env variables

Description

This is a profile module used by SIMP to configure 389ds LDAP instances for use within the SIMP ecosystem.

Currently it contains the following instances:

• accounts - Configures a TLS-enabled accounts LDAP instance that will be used to hold user accounts and groups and works with other SIMP modules.

This is a SIMP module

This module is a component of the System Integrity Management Platform, a compliance-management framework built on Puppet.

If you find any issues, submit them to our bug tracker.

This module is optimally designed for use within a larger SIMP ecosystem, but it can be used independently:

• When included within the SIMP ecosystem, security compliance settings will be managed from the Puppet server.
• If used independently, all SIMP-managed security subsystems are disabled by default and must be explicitly opted into by administrators. Please review the parameters in simp/simp_options for details.

Setup

The 389ds instances in this module are configured to work within a SIMP eco system.

Each instance can be used separately. See the individual instance for instructions on configuring it.

Accounts Instance

Description

The accounts instance, simp_ds389::instance::accounts, will set up a 389ds LDAP instance to be used for user authentication.

• It installs an configures a 389ds instance with TLS-enabled communication.

  • It can be configured for either TLS and STARTTLS.

• It configures a default password policy the is compliant with most standards.

• It configures a bind user.

• It configures 2 groups:

  • 'user' - group for general users
  • 'administrators' - group to allow administrator access to systems.

• It configures the firewall to allow access to the LDAP instance.

Usage

To set up a 389ds server to use for user authentication with in a SIMP ecosystem simply include this module.

include 'simp_ds389::instance::accounts'

If the root DN and bind DN password parameters are not explicitly set, they will be automatically generated using simplib::passgen.

Reference

Please refer to the inline documentation within each source file, or to REFERENCE.md for generated reference material.

You may also be interested in the documentation for the simp/ds389 module, which is what this module uses to install 389ds and create 389ds instances.

Limitations

The 389ds management console GUI is not configured. You can install it manually if it is needed.

At this time replication is not configured automatically.

SIMP Puppet modules are generally intended for use on Red Hat Enterprise Linux and compatible distributions, such as CentOS. Please see the metadata.json file for the most up-to-date list of supported operating systems, Puppet versions, and module dependencies.

Development

Please read our Contribution Guide.

Acceptance tests

This module includes Beaker acceptance tests using the SIMP Beaker Helpers. By default the tests use Vagrant with VirtualBox as a back-end; Vagrant and VirtualBox must both be installed to run these tests without modification. To execute the tests run the following:

bundle install
bundle exec rake beaker:suites[default]

Some environment variables may be useful:

BEAKER_debug=true
BEAKER_provision=no
BEAKER_destroy=no
BEAKER_use_fixtures_dir_for_modules=yes

• BEAKER_debug: show the commands being run on the STU and their output.
• BEAKER_destroy=no: prevent the machine destruction after the tests finish so you can inspect the state.
• BEAKER_provision=no: prevent the machine from being recreated. This can save a lot of time while you're writing the tests.
• BEAKER_use_fixtures_dir_for_modules=yes: cause all module dependencies to be loaded from the spec/fixtures/modules directory, based on the contents of .fixtures.yml. The contents of this directory are usually populated by bundle exec rake spec_prep. This can be used to run acceptance tests to run on isolated networks.

Please refer to the SIMP Beaker Helpers documentation for more information.

Reference

Table of Contents

Classes

• simp_ds389::instances::accounts: Create a 389ds instance with a common organizational LDIF for user accounts

Classes

simp_ds389::instances::accounts

Create a 389ds instance with a common organizational LDIF for user accounts

Parameters

The following parameters are available in the simp_ds389::instances::accounts class:

• instance_name
• base_dn
• root_dn
• root_pw
• bind_dn
• bind_pw
• listen_address
• enable_tls
• firewall
• trusted_nets
• port
• secure_port
• tls_params
• instance_params
• password_policy
• users_group_id
• administrators_group_id

instance_name

Data type: String[1]

The unique name of the instance.

Default value: 'accounts'

base_dn

Data type: String[2]

The base Distinguished Name of the directory server.

Default value: simplib::lookup('simp_options::ldap::base_dn', { 'default_value' => sprintf(simplib::ldap::domain_to_dn($facts.get('networking.domain'), true)) })

root_dn

Data type: String[2]

The default administrator Distinguished Name for the directory server.

• NOTE: To work around certain application bugs, items with spaces may not be used in this field.

Default value: 'cn=Directory_Manager'

root_pw

Data type: String[2]

The password for the the $root_dn.

• NOTE: To work around certain application bugs, items with spaces may not be used in this field.

Default value: simplib::passgen('simp_ds389-rootdn_accounts', { 'length' => 64, 'complexity' => 0 })

bind_dn

Data type: String[2]

The bind Distinguished Name of the directory server.

Default value: simplib::lookup('simp_options::ldap::bind_dn', { 'default_value' => "cn=hostAuth,ou=Hosts,${base_dn}" })

bind_pw

Data type: String[1]

The bind password.

Default value: simplib::lookup('simp_options::ldap::bind_pw', { 'default_value' => simplib::passgen("ds389_${instance_name}_bindpw", {'length' => 64})})

listen_address

Data type: Simplib::IP

The IP address upon which to listen.

Default value: '0.0.0.0'

enable_tls

Data type: Variant[Boolean, Enum['simp']]

Whether to configure the server to use TLS and also how to copy the pki certificates.

• simp => Will enable TLS and copy the certificates out from the puppetserver.
• true => Will enable TLS and copy the certificates from a local directory on the server.
• false => Will not enable TLS

Default value: simplib::lookup('simp_options::pki', { 'default_value' => false })

firewall

Data type: Boolean

Whether to configure access through the firewall.

Default value: simplib::lookup('simp_options::firewall', { 'default_value' => false })

trusted_nets

Data type: Simplib::Netlist

Which networks to all access through the firewall.

Default value: simplib::lookup('simp_options::trusted_nets', {'default_value' => ['127.0.0.1/32'] })

port

Data type: Simplib::Port

The port upon which to accept normal/STARTTLS connections

Default value: 389

secure_port

Data type: Simplib::Port

The port upon which to accept LDAPS connections.

Default value: 636

tls_params

Data type: Hash

Parameters to pass to the TLS module.

Default value: {}

instance_params

Data type: Hash

Any other arguments that you wish to pass through directly to the ds389::instance Defined Type.

Default value: {}

password_policy

Data type: Ds389::ConfigItem

Settings for the password policy. The defaults in the module data are set to meet most compliance standards.

users_group_id

Data type: Integer[1]

The group ID of the "users" group created in the install.

Default value: 100

administrators_group_id

Data type: Integer[500]

The group ID of the "administrators" group created in the install. The pupmod-simp-simp module configures permissions on systems using simp with the admin.pp manifest.

Default value: 700

• Wed Oct 11 2023 Steven Pritchard steve@sicura.us - 0.4.0

• [puppetsync] Updates for Puppet 8
  • These updates may include the following:
    • Update Gemfile
    • Add support for Puppet 8
    • Drop support for Puppet 6
    • Update module dependencies

• Thu Aug 31 2023 Steven Pritchard steve@sicura.us - 0.3.0

• Add AlmaLinux 8 support

• Mon Jul 17 2023 Chris Tessmer chris.tessmer@onyxpoint.com - 0.2.0

• Add RockyLinux 8 support

• Wed Aug 04 2021 Trevor Vaughan tvaughan@onyxpoint.com - 0.1.1

• Fixed the bootstrap template
  • Set the SUDOers OU properly
  • Removed the ignore_local_sudoers option from the sudo defaults for safety
  • Added the usual batch of sudoers defaults

• Mon May 17 2021 Jeanne Greulich jeanne.greulich@onyxpoint.com - 0.1.0

• Initial release