<commit_before># libnss_stns
[![Build Status](https://travis-ci.org/STNS/libnss_stns.svg?branch=master)](https://travis-ci.org/STNS/libnss_stns)

libnss_stns is [STNS](https://github.com/pyama86/STNS) Client Module.
* /etc/passwd,/etc/groups,/etc/shadow resolver.
* ssh authorized keys wrapper
* sudo auth wrapper

## diagram
![diagram](https://cloud.githubusercontent.com/assets/8022082/14065462/37435f26-f465-11e5-9d3a-c25b81cf6ae1.png)

## install
## redhat/centos
```
$ curl -fsSL https://repo.stns.jp/scripts/yum-repo.sh | sh
$ yum install libnss-stns libpam-stns
```
## debian/ubuntu
```
$ curl -fsSL https://repo.stns.jp/scripts/apt-repo.sh | sh
$ apt-get install libnss-stns libpam-stns
```

## config
* /etc/stns/libnss_stns.conf
```toml
api_end_point = ["http://<server-master>:1104", "http://<server-slave>:1104"]

# support basic auth
user = "basic_user"
password = "<PASSWORD>"

# stns access wrapper
wrapper_path = "/usr/local/bin/stns-query-wrapper"

# stns-key-wrapper on failure , this try chain_ssh_wrapper command
chain_ssh_wrapper = "/usr/libexec/openssh/ssh-ldap-wrapper"

ssl_verify = true
```

* /etc/nsswitch.conf
```
passwd:     files stns
shadow:     files stns
group:      files stns
```

* /etc/sshd/sshd_config

```
PubkeyAuthentication yes
AuthorizedKeysCommand /usr/local/bin/stns-key-wrapper
AuthorizedKeysCommandUser root
```

* /etc/nscd.conf
```
        enable-cache            passwd          yes
        positive-time-to-live   passwd          <PASSWORD>
        negative-time-to-live   passwd          300
        check-files             passwd          yes
        shared                  group           yes

        enable-cache            group           yes
        positive-time-to-live   group           3600
        negative-time-to-live   group           300
        check-files             group           yes
        shared                  group           yes

        enable-cache            hosts           no
        enable-cache            services        no
        enable-cache            netgroup        no
```

## wrapper command
Query is always through the wrapper.

```
# /usr/local/bin/stns-query-wrapper "user/name/example"
{
  "example": {
    "id": 1001,
    "group_id": 1001,
    "directory": "/home/example",
    "shell": "/bin/sh",
    "gecos": "example",
    "keys": [
      "ssh-rsa xxx
    ],
    "users": null
  }
}
```

Public key is using a key wrapper

```
# /usr/local/bin/stns-key-wrapper "example"
ssh-rsa xxx
```

## Tips
### auto create home dir by successed ssh login
```

$ echo 'session    required     pam_mkhomedir.so skel=/etc/skel/ umask=0022' >> /etc/pam.d/sshd

```

### Sudo Password authentication by Pam
STNS attribute

```toml
[sudoers.example]
password = "<PASSWORD>"
hash_type = "sha256"
```<commit_msg>add overview<commit_after># libnss_stns
[![Build Status](https://travis-ci.org/STNS/libnss_stns.svg?branch=master)](https://travis-ci.org/STNS/libnss_stns)

libnss_stns is [STNS](https://github.com/pyama86/STNS) Client Module.
* /etc/passwd,/etc/groups,/etc/shadow resolver.
* ssh authorized keys wrapper
* sudo auth wrapper

## diagram
![overview](https://cloud.githubusercontent.com/assets/8022082/14065462/37435f26-f465-11e5-9d3a-c25b81cf6ae1.png)

## install
## redhat/centos
```
$ curl -fsSL https://repo.stns.jp/scripts/yum-repo.sh | sh
$ yum install libnss-stns libpam-stns
```
## debian/ubuntu
```
$ curl -fsSL https://repo.stns.jp/scripts/apt-repo.sh | sh
$ apt-get install libnss-stns libpam-stns
```

## config
* /etc/stns/libnss_stns.conf
```toml
api_end_point = ["http://<server-master>:1104", "http://<server-slave>:1104"]

# support basic auth
user = "basic_user"
password = "<PASSWORD>"

# stns access wrapper
wrapper_path = "/usr/local/bin/stns-query-wrapper"

# stns-key-wrapper on failure , this try chain_ssh_wrapper command
chain_ssh_wrapper = "/usr/libexec/openssh/ssh-ldap-wrapper"

ssl_verify = true
```

* /etc/nsswitch.conf
```
passwd:     files stns
shadow:     files stns
group:      files stns
```

* /etc/sshd/sshd_config

```
PubkeyAuthentication yes
AuthorizedKeysCommand /usr/local/bin/stns-key-wrapper
AuthorizedKeysCommandUser root
```

* /etc/nscd.conf
```
        enable-cache            passwd          yes
        positive-time-to-live   passwd          600
        negative-time-to-live   passwd          300
        check-files             passwd          yes
        shared                  group           yes

        enable-cache            group           yes
        positive-time-to-live   group           3600
        negative-time-to-live   group           300
        check-files             group           yes
        shared                  group           yes

        enable-cache            hosts           no
        enable-cache            services        no
        enable-cache            netgroup        no
```

## wrapper command
Query is always through the wrapper.

```
# /usr/local/bin/stns-query-wrapper "user/name/example"
{
  "example": {
    "id": 1001,
    "group_id": 1001,
    "directory": "/home/example",
    "shell": "/bin/sh",
    "gecos": "example",
    "keys": [
      "ssh-rsa xxx
    ],
    "users": null
  }
}
```

Public key is using a key wrapper

```
# /usr/local/bin/stns-key-wrapper "example"
ssh-rsa xxx
```

## Tips
### auto create home dir by successed ssh login
```

$ echo 'session    required     pam_mkhomedir.so skel=/etc/skel/ umask=0022' >> /etc/pam.d/sshd

```

### Sudo Password authentication by Pam

![overview](https://cloud.githubusercontent.com/assets/8022082/14766700/e19c1ef0-0a4e-11e6-975b-1f5cbb4028c8.png)

STNS configure
```toml
[sudoers.example]
password = "<PASSWORD>"
hash_type = "sha256"
```
{'fraction_non_alphanumeric': 0.13732023851280253, 'fraction_numerical': 0.03139249386180288, 'mean_word_length': 2.3845697329376856, 'pattern_counts': {'":': 16, '<': 12, '<?xml version=': 0, '>': 16, 'https://': 13, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5637356', 'n_tokens_mistral': 2137, 'n_tokens_neox': 1953, 'n_words': 384}