Eel: host for kerberos kdc and ldap

flake.nix

@@ -220,6 +220,7 @@
         {
           imports = commonModules ++ modules;
           deployment.tags = [ group ];
+          deployment.allowLocalDeployment = true; # for debugging and deploying when github actions deployment breaks
           deployment.targetHost = "${host}.ocf.berkeley.edu";
           # TODO: Think of a less ugly way of doing this
           deployment.targetUser =
@@ -284,6 +285,7 @@
         ocf-cosmic-applets = ocf-cosmic-applets.packages.${final.stdenv.hostPlatform.system}.default;
         ocf-cosmic-greeter = final.callPackage ./pkgs/ocf-cosmic-greeter.nix { };
         ocf-hplip = final.callPackage ./pkgs/ocf-hplip.nix { };
+        ldap-git-backup = final.callPackage ./pkgs/ldap-git-backup.nix { };
       };
 
       agenix-rekey = agenix-rekey.configure {
@@ -320,7 +322,7 @@
           system = overrideSystem.${host} or defaultSystem;
           pkgs = pkgsFor system;
           modules = colmenaConfig.imports;
-          specialArgs = { inherit inputs; };
+          specialArgs = { inherit self inputs; };
         }
       ) colmenaHosts;
     };

hosts/servers/eel.nix

@@ -0,0 +1,31 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+
+{
+  imports = [ ../../hardware/virtualized.nix ];
+
+  networking.hostName = "eel";
+
+  ocf.motd.description = ''
+    LDAP and Kerberos server; crucial to the rest of our infrastucture working.
+  '';
+
+  ocf.network = {
+    enable = true;
+    lastOctet = 98;
+  };
+
+  ocf.kerberosKdc.enable = true;
+  ocf.ldapServer.enable = true;
+
+  ocf.acme.extraCerts = [
+    "ldap0.ocf.berkeley.edu"
+    "kdc.ocf.berkeley.edu"
+  ];
+
+  system.stateVersion = "25.11";
+}

modules/auth.nix → modules/auth/default.nix

@@ -7,7 +7,7 @@
 
 let
   cfg = config.ocf.auth;
-  keytabSecretPath = ../secrets/master-keyed/keytabs + "/${config.networking.hostName}.age";
+  keytabSecretPath = ../../secrets/master-keyed/keytabs + "/${config.networking.hostName}.age";
   hasKeytab = builtins.pathExists keytabSecretPath;
 in
 {
@@ -16,7 +16,7 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    age.secrets.root-password-hash.rekeyFile = ../secrets/master-keyed/root-password-hash.age;
+    age.secrets.root-password-hash.rekeyFile = ../../secrets/master-keyed/root-password-hash.age;
 
     # Per-host keytab for GSSAPI SSH authentication
     # Only configured if the host has a keytab in secrets/master-keyed/keytabs/<hostname>.age
@@ -34,7 +34,7 @@ in
 
       ldap = {
         enable = true;
-        server = "ldaps://ldap.ocf.berkeley.edu";
+        server = "ldaps://ldap0.ocf.berkeley.edu ldaps://ldap.ocf.berkeley.edu";
         base = "dc=OCF,dc=Berkeley,dc=EDU";
         daemon.enable = true;
         extraConfig = ''
@@ -59,7 +59,7 @@ in
     };
 
     environment.etc."ldap/ldap.conf".text = ''
-      URI ldaps://ldap.ocf.berkeley.edu
+      URI ldaps://ldap0.ocf.berkeley.edu ldaps://ldap.ocf.berkeley.edu
       BASE dc=ocf,dc=berkeley,dc=edu
       TLS_REQCERT hard
       TLS_CACERT /etc/ssl/certs/ca-certificates.crt
@@ -126,8 +126,11 @@ in
 
       settings = {
         realms."OCF.BERKELEY.EDU" = {
-          admin_server = "kerberos.ocf.berkeley.edu";
-          kdc = [ "kerberos.ocf.berkeley.edu" ];
+          admin_server = "kdc.ocf.berkeley.edu";
+          kdc = [
+            "kdc.ocf.berkeley.edu"
+            "kerberos.ocf.berkeley.edu"
+          ];
         };
         domain_realm = {
           "ocf.berkeley.edu" = "OCF.BERKELEY.EDU";

modules/auth/kerberos-kdc/check-pass-strength.py

@@ -0,0 +1,44 @@
+#!/usr/bin/env python3
+"""Enforce OCF account password complexity.
+
+Designed to be used as an external password check program by Heimdal. Uses
+ocflib to validate password strength with the same requirements as all other
+password changing tools.
+
+Details on interface Heimdal uses:
+http://www.h5l.org/manual/HEAD/info/heimdal/Password-changing.html
+
+Example usage:
+$ echo -e "principal: ckuehl@OCF.BERKELEY.EDU\nnew-password: hello" | ./check-pass-strength
+
+(ported directly from our old puppet module: https://github.com/ocf/puppet/blob/master/modules/ocf_kerberos/files/check-pass-strength)
+"""
+import sys
+
+import ocflib.account.utils as utils
+import ocflib.account.validators as validators
+
+
+if __name__ == '__main__':
+    data = {}
+    while True:
+        line = sys.stdin.readline().rstrip('\n')
+        if line == 'end' or not line:
+            break
+        else:
+            line = line.split(':')
+            assert len(line) == 2, 'Could not parse input: ' + str(line)
+            data[line[0]] = line[1][1:]
+    try:
+        username = utils.extract_username_from_principal(data['principal'])
+        password = data['new-password']
+    except (KeyError, ValueError):
+        print('Did not receive principal or password from input', file=sys.stderr)
+        sys.exit(1)
+    else:
+        try:
+            validators.validate_password(username, password)
+        except ValueError as e:
+            print(e, file=sys.stderr)
+        else:
+            print('APPROVED')

modules/auth/kerberos-kdc/default.nix

@@ -0,0 +1,128 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.ocf.kerberosKdc;
+
+  # check-pass-strength wrapped with a Python environment that has ocflib.
+  checkPassStrength = pkgs.writeShellScript "check-pass-strength" ''
+    exec ${pkgs.python312.withPackages (ps: [ ps.ocflib ])}/bin/python3 \
+      ${./check-pass-strength.py} "$@"
+  '';
+in
+{
+  options.ocf.kerberosKdc = {
+    enable = lib.mkEnableOption "OCF Kerberos KDC server (Heimdal)";
+  };
+
+  # The KDC database lives in /var/lib/heimdal/ and must be initialized manually:
+  #   kadmin -l init OCF.BERKELEY.EDU
+  # For migration between hosts, dump with: kadmin -l dump <file>
+  # and restore with: kadmin -l load <file>
+
+  config = lib.mkIf cfg.enable {
+    services.kerberos_server = {
+      enable = true;
+      settings = {
+        kdc.extra-addresses = "127.0.0.2";
+        kdc.enable-fast = false;
+
+        realms."OCF.BERKELEY.EDU" = {
+          acl = [
+            # Staff /admin principals have full KDC access
+            {
+              principal = "*/admin";
+              access = [ "all" ];
+            }
+            # Staff /root principals can change any principal's password
+            {
+              principal = "*/root";
+              access = [ "cpw" ];
+              target = "*@OCF.BERKELEY.EDU";
+            }
+            # create/admin is used by account creation tooling (ocflib)
+            {
+              principal = "create/admin";
+              access = [
+                "add"
+                "get"
+                "cpw"
+              ];
+              target = "*@OCF.BERKELEY.EDU";
+            }
+          ];
+        };
+
+        # a wrapper for ocflib's `validate_password`. more complex than doing
+        # it natively, but good to standardize password requirements across
+        # ocf/utils and ocf/ocfweb. heimdal's external password checking like
+        # this might not be easily possible in MIT...? consider if migrating
+        # off of heimdal kerb.
+
+        password_quality = {
+          policies = "external-check";
+          external_program = "${checkPassStrength}";
+        };
+      };
+    };
+
+    # KDC must start after slapd so SASL/GSSAPI is available for KDC → LDAP lookups
+    systemd.services.kdc.after = [ "openldap.service" ];
+
+    environment.systemPackages = [ pkgs.heimdal ];
+
+    networking.firewall = {
+      allowedTCPPorts = [
+        88 # kerberos
+        749 # kadmin
+      ];
+      allowedUDPPorts = [
+        88 # kerberos
+        464 # kpasswd
+      ];
+    };
+
+    systemd.tmpfiles.rules = [
+      "d /var/backups/kerberos 0700 root root -"
+    ];
+
+    # unlike LDAP, not uploaded to github (for now?)
+    systemd.services.kerberos-git-backup = {
+      description = "Kerberos KDC git backup";
+      after = [ "kdc.service" ];
+      requires = [ "kdc.service" ];
+      path = [
+        pkgs.heimdal
+        pkgs.git
+      ];
+      serviceConfig = {
+        Type = "oneshot";
+        User = "root";
+        UMask = "0077";
+      };
+      script = ''
+        dir=/var/backups/kerberos
+        [ -d "$dir/.git" ] || git -C "$dir" init -q
+        kadmin -l dump --decrypt "$dir/kerberos.dump"
+        git -C "$dir" add kerberos.dump
+        git -C "$dir" commit -q -m 'kerberos-git-backup' --allow-empty kerberos.dump
+        git -C "$dir" gc --auto --quiet
+      '';
+    };
+
+    systemd.timers.kerberos-git-backup = {
+      description = "Run Kerberos KDC git backup daily";
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        # Run before rsnapshot so the backup server gets a fresh daily snapshot
+        OnCalendar = "*-*-* 01:00:00";
+        Persistent = true;
+      };
+    };
+
+  };
+}