Skip to content

Commit 55d42c2

Browse files
markgoddardmarkgoddard
authored
Merge pull request #52 from stackhpc/sasl
Add support for SASL authentication
2 parents a4f0dcc + d899c79 commit 55d42c2

File tree

12 files changed

+158
-2
lines changed

12 files changed

+158
-2
lines changed

‎README.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,50 @@ option names to values. Default is an empty dict.
121121
`libvirt_host_qemu_conf`: Configuration for `qemu.conf`. Dict mapping option
122122
names to values. Default is an empty dict.
123123

124+
`libvirt_host_enable_sasl_support`: Whether to enable SASL authentication
125+
support. Default is `false`.
126+
127+
`libvirt_host_sasl_conf_enabled`: Whether to configure SASL authentication
128+
(`/etc/sasl2/libvirt.conf`). Default is the same as
129+
`libvirt_host_enable_sasl_support`.
130+
131+
`libvirt_host_sasl_conf`: Configuration for SASL authentication
132+
(`/etc/sasl2/libvirt.conf`). String.
133+
134+
`libvirt_host_sasl_mech_list`: List of enabled libvirt SASL authentication
135+
mechanisms. Default is `["SCRAM-SHA-256"]` when `libvirt_host_tls_listen` is
136+
`true`, otherwise `["DIGEST-MD5"]`.
137+
138+
`libvirt_host_sasl_credentials`: List of SASL authentication credentials to
139+
create. Each item is a dict containing `username` and `password` items.
140+
Default is a single item list containing `libvirt_host_sasl_authname` and
141+
`libvirt_host_sasl_password`.
142+
143+
`libvirt_host_sasl_authname`: Username for SASL authentication. Default is
144+
`libvirt`.
145+
146+
`libvirt_host_sasl_password`: Password for SASL authentication. Default is
147+
unset.
148+
149+
`libvirt_host_sasl_auth_conf_enabled`: Whether to configure SASL authentication
150+
credentials (`/etc/libvirt/auth.conf`). Default is the same as
151+
`libvirt_host_enable_sasl_support`.
152+
153+
`libvirt_host_sasl_auth_conf`: Configuration for SASL authentication
154+
credentials (`/etc/libvirt/auth.conf`). String.
155+
156+
`libvirt_host_sasl_auth_conf_filename`: Name of file to write SASL
157+
authentication credentials to. Default is `"/etc/libvirt/auth.conf"`.
158+
159+
`libvirt_host_sasl_auth_conf_owner`: Owner of file to write SASL
160+
authentication credentials to. Default is `"root"`.
161+
162+
`libvirt_host_sasl_auth_conf_group`: Group of file to write SASL
163+
authentication credentials to. Default is `"root"`.
164+
165+
`libvirt_host_sasl_auth_conf_mode`: Mode of file to write SASL
166+
authentication credentials to. Default is `"0600"`.
167+
124168
`libvirt_host_tcp_listen`: Whether to enable the systemd TCP socket unit.
125169
Default is `false`.
126170

‎defaults/main.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,48 @@ libvirt_host_qemu_conf_enabled: true
9090
# Configuration for qemu.conf. Dict mapping option names to values.
9191
libvirt_host_qemu_conf: {}
9292

93+
# Whether to enable SASL authentication support.
94+
libvirt_host_enable_sasl_support: false
95+
96+
# Whether to configure SASL authentication (/etc/sasl2/libvirt.conf).
97+
libvirt_host_sasl_conf_enabled: "{{ libvirt_host_enable_sasl_support | bool }}"
98+
# Configuration for SASL authentication (/etc/sasl2/libvirt.conf). String.
99+
libvirt_host_sasl_conf: |
100+
mech_list: {{ libvirt_host_sasl_mech_list | join(' ') }}
101+
sasldb_path: /etc/libvirt/passwd.db
102+
# List of enabled libvirt SASL authentication mechanisms.
103+
libvirt_host_sasl_mech_list:
104+
- "{{ 'SCRAM-SHA-256' if libvirt_host_tls_listen | bool else 'DIGEST-MD5' }}"
105+
106+
# List of SASL authentication credentials to create. Each item is a dict
107+
# containing "username" and "password" items.
108+
libvirt_host_sasl_credentials:
109+
- username: "{{ libvirt_host_sasl_authname }}"
110+
password: "{{ libvirt_host_sasl_password }}"
111+
# Username for SASL authentication.
112+
libvirt_host_sasl_authname: libvirt
113+
# Password for SASL authentication.
114+
libvirt_host_sasl_password:
115+
116+
# Whether to configure SASL authentication credentials (/etc/libvirt/auth.conf).
117+
libvirt_host_sasl_auth_conf_enabled: "{{ libvirt_host_enable_sasl_support | bool }}"
118+
# Configuration for SASL authentication credentials (/etc/libvirt/auth.conf). String.
119+
libvirt_host_sasl_auth_conf: |
120+
[credentials-default]
121+
authname={{ libvirt_host_sasl_authname }}
122+
password={{ libvirt_host_sasl_password }}
123+
124+
[auth-libvirt-default]
125+
credentials=default
126+
# Name of file to write SASL authentication credentials to.
127+
libvirt_host_sasl_auth_conf_filename: "/etc/libvirt/auth.conf"
128+
# Owner of file to write SASL authentication credentials to.
129+
libvirt_host_sasl_auth_conf_owner: "root"
130+
# Group of file to write SASL authentication credentials to.
131+
libvirt_host_sasl_auth_conf_group: "root"
132+
# Mode of file to write SASL authentication credentials to.
133+
libvirt_host_sasl_auth_conf_mode: "0600"
134+
93135
# Whether to enable the systemd TCP socket unit.
94136
libvirt_host_tcp_listen: false
95137
# Systemd TCP socket ListenStream. See man systemd.socket for format.

‎tasks/client-config.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
- name: Ensure client configuration files exist
3+
template:
4+
src: "{{ item.src }}"
5+
dest: "{{ item.dest }}"
6+
owner: "{{ item.owner }}"
7+
group: "{{ item.group }}"
8+
mode: "{{ item.mode }}"
9+
become: true
10+
loop: "{{ _libvirt_client_config_files | selectattr('enabled') }}"
11+
loop_control:
12+
label: "{{ item.dest | basename }}"
13+
vars:
14+
_libvirt_client_config_files:
15+
- src: auth.conf.j2
16+
dest: "{{ libvirt_host_sasl_auth_conf_filename }}"
17+
enabled: "{{ libvirt_host_sasl_auth_conf_enabled | bool }}"
18+
owner: "{{ libvirt_host_sasl_auth_conf_owner }}"
19+
group: "{{ libvirt_host_sasl_auth_conf_group }}"
20+
mode: "{{ libvirt_host_sasl_auth_conf_mode }}"

‎tasks/config.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,9 @@
4040
- src: qemu.conf.j2
4141
dest: /etc/libvirt/qemu.conf
4242
enabled: "{{ libvirt_host_qemu_conf_enabled | bool }}"
43+
- src: sasl.conf.j2
44+
dest: /etc/sasl2/libvirt.conf
45+
enabled: "{{ libvirt_host_sasl_conf_enabled | bool }}"
4346
notify:
4447
- restart libvirt
4548

@@ -115,6 +118,19 @@
115118
_libvirt_loop_item: "{{ _libvirt_tls_certs[item] }}"
116119
notify: restart libvirt
117120

121+
- name: Ensure libvirt SASL user exists
122+
shell:
123+
cmd: >
124+
set -o pipefail &&
125+
echo {{ item.password }} |
126+
saslpasswd2 -c -p -a libvirt {{ item.username }}
127+
executable: /bin/bash
128+
become: true
129+
no_log: true
130+
changed_when: true
131+
loop: "{{ libvirt_host_sasl_credentials }}"
132+
when: libvirt_host_enable_sasl_support | bool
133+
118134
- name: Flush handlers
119135
meta: flush_handlers
120136

‎tasks/main.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@
2121
- name: Include config.yml
2222
include_tasks: config.yml
2323
when: libvirt_host_install_daemon | bool
24+
- name: Include client-config.yml
25+
include_tasks: client-config.yml
26+
when: libvirt_host_install_client | bool
2427
- name: Include pools.yml
2528
include_tasks: pools.yml
2629
when: libvirt_host_pools | length > 0

‎tasks/validate.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,12 @@
2727
when:
2828
- libvirt_host_require_vt | bool
2929
- not libvirt_host_vt_enabled
30+
31+
- name: Fail if SASL password is not defined
32+
fail:
33+
msg: >
34+
One or more SASL passwords in 'libvirt_host_sasl_credentials' are not
35+
defined
36+
when:
37+
- libvirt_host_enable_sasl_support | bool
38+
- libvirt_host_sasl_credentials | rejectattr('password') | length > 0

‎templates/auth.conf.j2‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{{ libvirt_host_sasl_auth_conf }}

‎templates/sasl.conf.j2‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{{ libvirt_host_sasl_conf }}

‎vars/Archlinux.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,5 +21,9 @@ libvirt_host_packages_rbd_volume_pool:
2121
- libvirt-storage-rbd
2222
- qemu-block-rbd
2323

24+
# Packages for SASL authentication support.
25+
libvirt_host_packages_sasl:
26+
- cyrus-sasl
27+
2428
# These are passed to the lineinfile module to customize configuration files
2529
libvirt_host_lineinfile_extra_rules: []

‎vars/Debian.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,5 +35,10 @@ libvirt_host_packages_rbd_volume_pool:
3535
- libvirt-daemon-driver-storage-rbd
3636
- qemu-block-extra
3737

38+
# Packages for SASL authentication support.
39+
libvirt_host_packages_sasl:
40+
- libsasl2-modules-gssapi-mit
41+
- sasl2-bin
42+
3843
# These are passed to the lineinfile module to customize configuration files
3944
libvirt_host_lineinfile_extra_rules: []

0 commit comments

Comments
 (0)