nixpkgs/nixos
aszlig 227229653a
nixos/taskserver: Add a nixos-taskdctl command
It's a helper for NixOS systems to make it easier to handle CA
certificate signing, similar to what taskd provides but comes preseeded
with the values from the system configuration.

The tool is very limited at the moment and only allows to *add*
organisations, users and groups. Deletion and suspension however is much
simpler to implement, because we don't need to handle certificate
signing.

Another limitation is that we don't take into account whether
certificates and keys are already set in the system configuration and if
they're set it will fail spectacularly.

For passing the commands to the taskd command, we're using a small C
program which does setuid() and setgid() to the Taskserver user and
group, because runuser(1) needs PAM (quite pointless if you're already
root) and su(1) doesn't allow for setting the group and setgid()s to the
default group of the user, so it even doesn't work in conjunction with
sg(1).

In summary, we now have a shiny nixos-taskdctl command, which lets us do
things like:

nixos-taskdctl add-org NixOS
nixos-taskdctl add-user NixOS alice
nixos-taskdctl export-user NixOS alice

The last command writes a series of shell commands to stdout, which then
can be imported on the client by piping it into a shell as well as doing
it for example via SSH:

ssh root@server nixos-taskdctl export-user NixOS alice | sh

Of course, in terms of security we need to improve this even further so
that we generate the private key on the client and just send a CSR to
the server so that we don't need to push any secrets over the wire.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-04-05 18:53:31 +02:00
..
doc/manual Merge pull request #14426 from nbp/fix-rl1603-typo 2016-04-04 12:41:35 +02:00
lib Fix the EC2 test 2016-03-30 21:50:23 +02:00
maintainers Update AMI creation script 2016-04-05 11:25:12 +02:00
modules nixos/taskserver: Add a nixos-taskdctl command 2016-04-05 18:53:31 +02:00
tests nixos/tests: Add a test for keyboard layouts 2016-03-31 09:49:08 +02:00
COPYING Move all of NixOS to nixos/ in preparation of the repository merge 2013-10-10 13:28:20 +02:00
default.nix Revert "Add the tool "nixos-typecheck" that can check an option declaration to:" 2016-03-01 20:52:06 +01:00
README Move all of NixOS to nixos/ in preparation of the repository merge 2013-10-10 13:28:20 +02:00
release-combined.nix NixOS release: Don't depend on chromium 2016-03-15 16:06:09 +01:00
release-small.nix release-small.nix: Drop the grub1 test 2015-08-11 13:51:55 +02:00
release.nix nixos/tests: Add a test for keyboard layouts 2016-03-31 09:49:08 +02:00

*** NixOS ***

NixOS is a Linux distribution based on the purely functional package
management system Nix.  More information can be found at
http://nixos.org/nixos and in the manual in doc/manual.