Chapter 111. Using Ansible to automount NFS shares for IdM users

Procedure

1. On any IdM-enrolled host, add the NFS service to IdM:

   $ ipa service-add nfs/nfs-server.idm.example.com
   ------------------------------------------------------------
   Added service "nfs/nfs-server.idm.example.com@IDM.EXAMPLE.COM"
   ------------------------------------------------------------
     Principal name: nfs/nfs-server.idm.example.com@IDM.EXAMPLE.COM
     Principal alias: nfs/nfs-server.idm.example.com@IDM.EXAMPLE.COM
     Managed by: nfs-server.idm.example.com

2. On the NFS server, obtain the keytab for the NFS service:

   # ipa-getkeytab -p nfs/nfs-server.idm.example.com -k /etc/krb5.keytab
   Keytab successfully retrieved and stored in: /etc/krb5.keytab

3. On the NFS server, restart the NFS service:

   # systemctl restart nfs-server

4. On the NFS server, enable the NFS service:

   # systemctl enable nfs-server
   Created symlink /etc/systemd/system/multi-user.target.wants/nfs-server.service → /usr/lib/systemd/system/nfs-server.service.

Procedure

1. Create the directory you want to export:

   # mkdir -p /exports/project

2. Give the owner and group the rights to read, write and execute the directory:

   # chmod 770 /exports/project

3. Add the GSID sticky bit so that any files created in the directory will have their group ownership set to that of the directory owner:

   # chmod g+s /exports/project

4. Create a file in the directory with some content:

   # echo "this is a read-write file" > /exports/project/rw_file

5. To a file in the /etc/exports.d/ directory, add the following information:

   • Which directory you want to export
   • How you want users to authenticate to access the files in the directory

   • What permissions you want users to have on the files in the directory

     # echo "/exports/project *(sec=krb5,rw)" > /etc/exports.d/project.exports

     sec=krb5 uses the Kerberos V5 protocol instead of local UNIX UIDs and GIDs to authenticate users.

   Alternatively, use sec=krb5i or sec=krb5p:

   sec=krb5i

   uses Kerberos V5 for user authentication and performs integrity checking of NFS operations using secure checksums to prevent data tampering.

   sec=krb5p

   uses Kerberos V5 for user authentication, integrity checking, and encrypts NFS traffic to prevent traffic sniffing. This is the most secure setting, but it also involves the most performance overhead.

6. Re-export all directories, synchronizing the main export table kept in /var/lib/nfs/etab with /etc/exports and files under /etc/exports.d:

   # exportfs -r

7. Display the current export list suitable for /etc/exports:

   # exportfs -s
   /exports/project  *(sync,wdelay,hide,no_subtree_check,sec=krb5p,rw,secure,root_squash,no_all_squash)

Procedure

1. Create a directory for your Ansible configuration and playbooks in your home directory:

   $ mkdir ~/MyPlaybooks/

2. Change into the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks

3. Create the ~/MyPlaybooks/ansible.cfg file with the following content:

   [defaults]
   inventory = /home/your_username/MyPlaybooks/inventory
   
   [privilege_escalation]
   become=True

4. Create the ~/MyPlaybooks/inventory file with the following content:

   [ipaserver]
   server.idm.example.com
   
   [ipareplicas]
   replica1.idm.example.com
   replica2.idm.example.com
   
   [ipacluster:children]
   ipaserver
   ipareplicas
   
   [ipacluster:vars]
   ipaadmin_password=SomeADMINpassword
   
   [ipaclients]
   ipaclient1.example.com
   ipaclient2.example.com
   
   [ipaclients:vars]
   ipaadmin_password=SomeADMINpassword

   This configuration defines two host groups, eu and us, for hosts in these locations. Additionally, this configuration defines the ipaserver host group, which contains all hosts from the eu and us groups.

5. [Optional] Create an SSH public and private key. To simplify access in your test environment, do not set a password on the private key:

   $ ssh-keygen

6. Copy the SSH public key to the IdM admin account on each managed node:

   $ ssh-copy-id admin@server.idm.example.com
   $ ssh-copy-id admin@replica.idm.example.com

   You must enter the IdM admin password when you enter these commands.

Procedure

1. On your Ansible control node, navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the automount-location-present.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/automount/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/automount/automount-location-present.yml automount-location-map-and-key-present.yml

3. Open the automount-location-map-and-key-present.yml file for editing.

4. Adapt the file by setting the following variables in the ipaautomountlocation task section:

   • Set the ipaadmin_password variable to the password of the IdM admin.
   • Set the name variable to raleigh.

   • Ensure that the state variable is set to present.

     This is the modified Ansible playbook file for the current example:

   ---
   - name: Automount location present example
     hosts: ipaserver
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Ensure automount location is present
       ipaautomountlocation:
         ipaadmin_password: "{{ ipaadmin_password }}"
         name: raleigh
         state: present

5. Continue editing the automount-location-map-and-key-present.yml file:

   1. In the tasks section, add a task to ensure the presence of an automount map:

      [...]
        vars_files:
        - /home/user_name/MyPlaybooks/secret.yml
        tasks:
      [...]
        - name: ensure map named auto.devel in location raleigh is created
          ipaautomountmap:
            ipaadmin_password: "{{ ipaadmin_password }}"
            name: auto.devel
            location: raleigh
            state: present

   2. Add another task to add the mount point and NFS server information to the map:

      [...]
        vars_files:
        - /home/user_name/MyPlaybooks/secret.yml
        tasks:
      [...]
        - name: ensure automount key /devel/project is present
          ipaautomountkey:
            ipaadmin_password: "{{ ipaadmin_password }}"
            location: raleigh
            mapname: auto.devel
            key: /devel/project
            info: nfs-server.idm.example.com:/exports/project
            state: present

   3. Add another task to ensure auto.devel is connected to auto.master:

      [...]
        vars_files:
        - /home/user_name/MyPlaybooks/secret.yml
        tasks:
      [...]
      - name: Ensure auto.devel is connected in auto.master:
        ipaautomountkey:
          ipaadmin_password: "{{ ipaadmin_password }}"
          location: raleigh
          mapname: auto.map
          key: /devel
          info: auto.devel
          state: present

6. Save the file.

7. Run the Ansible playbook and specify the playbook and inventory files:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory automount-location-map-and-key-present.yml

Procedure

1. On your Ansible control node, navigate to the ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Open the automount-location-map-and-key-present.yml file for editing.

3. In the tasks section, add a task to ensure that the IdM developers group exists and idm_user is added to this group:

   [...]
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
   [...]
     - ipagroup:
        ipaadmin_password: "{{ ipaadmin_password }}"
         name: developers
         user:
         - idm_user
         state: present

4. Save the file.

5. Run the Ansible playbook and specify the playbook and inventory files:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory automount-location-map-and-key-present.yml

6. On the NFS server, change the group ownership of the /exports/project directory to developers so that every IdM user in the group can access the directory:

   # chgrp developers /exports/project

Procedure

1. On the IdM client, enter the ipa-client-automount command and specify the location. Use the -U option to run the script unattended:

   # ipa-client-automount --location raleigh -U

2. Stop the autofs service, clear the SSSD cache, and start the autofs service to load the new configuration settings:

   # systemctl stop autofs ; sss_cache -E ; systemctl start autofs

Procedure

1. Verify that the IdM user can access the read-write directory:

   1. Connect to the IdM client as the IdM user:

      $ ssh idm_user@idm-client.idm.example.com
      Password:

   2. Obtain the ticket-granting ticket (TGT) for the IdM user:

      $ kinit idm_user

   3. [Optional] View the group membership of the IdM user:

      $ ipa user-show idm_user
        User login: idm_user
        [...]
        Member of groups: developers, ipausers

   4. Navigate to the /devel/project directory:

      $ cd /devel/project

   5. List the directory contents:

      $ ls
      rw_file

   6. Add a line to the file in the directory to test the write permission:

      $ echo "idm_user can write into the file" > rw_file

   7. [Optional] View the updated contents of the file:

      $ cat rw_file
      this is a read-write file
      idm_user can write into the file

   The output confirms that idm_user can write into the file.