+++ /dev/null
-lxc.include = /usr/share/lxc/config/common.conf
-
-lxc.arch = x86_64
-lxc.uts.name = ins.in.useribm.hu
-lxc.rootfs.path = __CONTAINER_PATH__/rootfs
-lxc.mount.auto = proc:rw sys:ro
-
-lxc.net.0.type = veth
-lxc.net.0.flags = up
-lxc.net.0.link = bri-dev
-lxc.net.0.hwaddr = 02:0c:18:03:6d:68
-
-lxc.autodev = 1
-
-lxc.cgroup2.devices.allow = a
-
-lxc.signal.halt = SIGRTMIN+4
-
-lxc.start.auto = 1
-lxc.start.order = __CONTAINER_START_ORDER__
-lxc.start.delay = 5
+++ /dev/null
-DISTRIBUTION=Fedora
-DISTRIBUTION_VERSION=35
-ROOT_PACKAGES="hostname initscripts iproute rootfiles systemd-udev"
-BASE_PACKAGES="NetworkManager iputils logrotate rsyslog tar vim-minimal"
-SPEC_PACKAGES="bind bind-utils"
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active NetworkManager.service
-NM_RC=$?
-WAITED=0
-while [ $NM_RC -ne 0 ]
-do
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active NetworkManager.service
- NM_RC=$?
-done
-[ $WAITED -eq 1 ] && echo
-
-CONNECTIONS=$(nmcli --terse connection show | wc -l)
-while [ $CONNECTIONS -ne 1 ]
-do
- echo "Number of connections: $CONNECTIONS" >&2
- sleep 1
- CONNECTIONS=$(nmcli --terse connection show | wc -l)
-done
-
-nmcli --terse connection show | grep ':$' >/dev/null
-ALL_CONNECTION_DEVICES_KNOWN=$?
-while [ $ALL_CONNECTION_DEVICES_KNOWN -eq 0 ]
-do
- echo "Not all connection devices are known yet" >&2
- sleep 1
- nmcli --terse connection show | grep ':$' >/dev/null
- ALL_CONNECTION_DEVICES_KNOWN=$?
-done
-
-CONNECTION_LINE=$(nmcli --terse connection show)
-CONNECTION_UUID=$(echo $CONNECTION_LINE | cut -f 2 -d ':')
-CONNECTION_DEVICE=$(echo $CONNECTION_LINE | cut -f 4 -d ':')
-
-nmcli connection delete uuid "$CONNECTION_UUID"
-
-nmcli connection add \
- connection.autoconnect yes \
- connection.id internal \
- connection.interface-name $CONNECTION_DEVICE \
- connection.type 802-3-ethernet \
- ipv4.addresses "10.228.109.104/16" \
- ipv4.dns "10.228.109.159, 10.228.92.159" \
- ipv4.dns-search "in.useribm.hu" \
- ipv4.gateway "10.228.109.254" \
- ipv4.method "manual" \
- ipv6.addresses "2a02:d400:0000:f268:000c:18ff:fe03:6d68/64" \
- ipv6.dns "2a02:d400:0000:f268:000c:18ff:fe03:6d9f, 2a02:d400:0000:f268:000c:18ff:fe03:5c9f" \
- ipv6.dns-search "in.useribm.hu" \
- ipv6.gateway "2a02:d400:0000:f268:000c:18ff:fe03:6dfe" \
- ipv6.method "manual" \
- save yes
-
-nmcli connection show
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active dbus.service
-DBUS_RC=$?
-WAITED=0
-while [ $DBUS_RC -ne 0 ]
-do
- if [ $WAITED -eq 0 ]
- then
- echo -n "Waiting for dbus.service"
- fi
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active dbus.service
- DBUS_RC=$?
-done
-[ $WAITED -ne 0 ] && echo
-timedatectl set-timezone Europe/Budapest
+++ /dev/null
-#!/bin/sh
-
-
-exit 0
-authselect select sssd with-mkhomedir --force
-
-cat >>/etc/openldap/ldap.conf <<EOF
-BASE dc=user,dc=hu
-URI ldap://ldap.in.useribm.hu
-EOF
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-chown -R root.root $SOURCE_PATH/*
-
-chgrp named $SOURCE_PATH/etc/named.*
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-chmod 640 $SOURCE_PATH/etc/named.*
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-tar --create \
- --directory=$REAL_PATH \
- --exclude=.placeholder \
- --to-stdout \
- install \
- | tar --extract \
- --backup \
- --directory=/ \
- --no-overwrite-dir \
- --strip-components=1 \
- --suffix=.orig
+++ /dev/null
-#!/bin/sh
-
-
-systemctl enable named.service
-systemctl enable NetworkManager-wait-online.service
-
-systemctl enable logrotate.timer
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-//
-// named.conf
-//
-
-options {
- directory "/var/named";
- dump-file "data/cache_dump.db";
- statistics-file "data/named_stats.txt";
- memstatistics-file "data/named_mem_stats.txt";
- secroots-file "data/named.secroots";
- recursing-file "data/named.recursing";
-
- listen-on port 53 { any; };
- listen-on-v6 port 53 { any; };
-
- allow-query { none; };
- allow-query-cache { none; };
- allow-recursion { none; };
-
- dnssec-validation yes;
-
- random-device "/dev/urandom";
-
- max-cache-size 64m;
-
- managed-keys-directory "/var/named/dynamic";
- geoip-directory "/usr/share/GeoIP";
-
- include "/etc/crypto-policies/back-ends/bind.config";
-};
-
-logging {
- channel default_debug {
- file "data/named.run" versions 3 size 5m;
- severity dynamic;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel client_channel {
- file "data/client.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel lame-servers_channel {
- file "data/lame-servers.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel notify_channel {
- file "data/notify.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel queries_channel {
- file "data/queries.log" versions 3 size 5m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel security_channel {
- file "data/security.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel xfer-in_channel {
- file "data/xfer-in.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel xfer-out_channel {
- file "data/xfer-out.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- category default {
- default_syslog;
- default_debug;
- };
- category client {
- client_channel;
- };
- category lame-servers {
- lame-servers_channel;
- };
- category notify {
- notify_channel;
- };
- category queries {
- queries_channel;
- };
- category security {
- security_channel;
- };
- category xfer-in {
- xfer-in_channel;
- };
- category xfer-out {
- xfer-out_channel;
- };
-};
-
-key "primary_ns-internal_ns" {
- algorithm hmac-sha256;
- secret "fjQyVn7bfGnbbBTgm7CgJSVOttSm9ji7WlVGVgV02Qo=";
-};
-
-acl internal_networks { 10.228.0.0/16; 192.168.42.0/24; 192.168.43.0/24; };
-acl vpn_client_network { 172.16.223.0/24; };
-acl primary_ns_key_acl { key "primary_ns-internal_ns"; };
-
-masters primary_ns_master { 10.228.109.174 key "primary_ns-internal_ns"; };
-
-server 10.228.109.174 { keys { "primary_ns-internal_ns"; }; };
-
-view "internal" {
- match-clients { internal_networks; vpn_client_network; localhost; };
-
- recursion yes;
-
- allow-query { internal_networks; vpn_client_network; localhost; };
- allow-query-cache { internal_networks; vpn_client_network; localhost; };
- allow-recursion { internal_networks; vpn_client_network; localhost; };
-
- allow-notify { primary_ns_key_acl; };
- notify no;
-
- include "/etc/named.rfc1912.zones";
-
- # internal zones
- zone "in.user.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/in.user.hu.zone";
- };
- zone "43.168.192.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/43.168.192.in-addr.arpa.zone";
- };
- zone "in.useribm.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/in.useribm.hu.zone";
- };
- zone "228.10.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/228.10.in-addr.arpa.zone";
- };
- zone "8.6.2.f.0.0.0.0.0.0.4.d.2.0.a.2.ip6.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/8.6.2.f.0.0.0.0.0.0.4.d.2.0.a.2.ip6.arpa.zone";
- };
- zone "mlx1.useribm.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/mlx1.useribm.hu.zone";
- };
- zone "131.16.172.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/131.16.172.in-addr.arpa.zone";
- };
- zone "mlx2.useribm.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/mlx2.useribm.hu.zone";
- };
- zone "132.16.172.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/132.16.172.in-addr.arpa.zone";
- };
- zone "sr.user.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/sr.user.hu.zone";
- };
- zone "42.168.192.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/42.168.192.in-addr.arpa.zone";
- };
- zone "usr.user.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/usr.user.hu.zone";
- };
-
- # perimeter zones
- zone "pm.useribm.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/pm.useribm.hu.zone";
- };
- zone "173.168.192.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/173.168.192.in-addr.arpa.zone";
- };
- zone "d.a.2.f.0.0.0.0.0.0.4.d.2.0.a.2.ip6.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/d.a.2.f.0.0.0.0.0.0.4.d.2.0.a.2.ip6.arpa.zone";
- };
-
- # external zones
- zone "mediacube.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/mediacube.hu.zone.signed";
- };
- zone "useredms.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/useredms.hu.zone.signed";
- };
- zone "useribm.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/useribm.hu.zone.signed";
- };
- zone "userrendszerhaz.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/userrendszerhaz.hu.zone.signed";
- };
-};
+++ /dev/null
-lxc.include = /usr/share/lxc/config/common.conf
-
-lxc.arch = x86_64
-lxc.uts.name = ldap.in.useribm.hu
-lxc.rootfs.path = __CONTAINER_PATH__/rootfs
-lxc.mount.auto = proc:rw sys:ro
-
-lxc.net.0.type = veth
-lxc.net.0.flags = up
-lxc.net.0.link = bri-dev
-lxc.net.0.hwaddr = 02:0c:18:03:6d:fc
-
-lxc.autodev = 1
-
-lxc.cgroup2.devices.allow = a
-
-lxc.signal.halt = SIGRTMIN+4
-
-lxc.start.auto = 1
-lxc.start.order = __CONTAINER_START_ORDER__
-lxc.start.delay = 5
+++ /dev/null
-DISTRIBUTION=Fedora
-DISTRIBUTION_VERSION=35
-ROOT_PACKAGES="hostname initscripts iproute rootfiles systemd-udev"
-BASE_PACKAGES="NetworkManager iputils logrotate rsyslog tar vim-minimal"
-SPEC_PACKAGES="openssh-server openssh-clients openssl sudo"
-SPEC_PACKAGES="$SPEC_PACKAGES authselect openldap-servers openldap-clients oddjob-mkhomedir pam_ssh passwd python3 sssd-ldap"
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active NetworkManager.service
-NM_RC=$?
-WAITED=0
-while [ $NM_RC -ne 0 ]
-do
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active NetworkManager.service
- NM_RC=$?
-done
-[ $WAITED -eq 1 ] && echo
-
-CONNECTIONS=$(nmcli --terse connection show | wc -l)
-while [ $CONNECTIONS -ne 1 ]
-do
- echo "Number of connections: $CONNECTIONS" >&2
- sleep 1
- CONNECTIONS=$(nmcli --terse connection show | wc -l)
-done
-
-nmcli --terse connection show | grep ':$' >/dev/null
-ALL_CONNECTION_DEVICES_KNOWN=$?
-while [ $ALL_CONNECTION_DEVICES_KNOWN -eq 0 ]
-do
- echo "Not all connection devices are known yet" >&2
- sleep 1
- nmcli --terse connection show | grep ':$' >/dev/null
- ALL_CONNECTION_DEVICES_KNOWN=$?
-done
-
-CONNECTION_LINE=$(nmcli --terse connection show)
-CONNECTION_UUID=$(echo $CONNECTION_LINE | cut -f 2 -d ':')
-CONNECTION_DEVICE=$(echo $CONNECTION_LINE | cut -f 4 -d ':')
-
-nmcli connection delete uuid "$CONNECTION_UUID"
-
-nmcli connection add \
- connection.autoconnect yes \
- connection.id internal \
- connection.interface-name $CONNECTION_DEVICE \
- connection.type 802-3-ethernet \
- ipv4.addresses "10.228.109.252/16" \
- ipv4.dns "10.228.109.159, 10.228.92.159" \
- ipv4.dns-search "in.useribm.hu" \
- ipv4.gateway "10.228.109.254" \
- ipv4.method "manual" \
- ipv6.method "auto" \
- save yes
-
-nmcli connection show
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active dbus.service
-DBUS_RC=$?
-WAITED=0
-while [ $DBUS_RC -ne 0 ]
-do
- if [ $WAITED -eq 0 ]
- then
- echo -n "Waiting for dbus.service"
- fi
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active dbus.service
- DBUS_RC=$?
-done
-[ $WAITED -ne 0 ] && echo
-timedatectl set-timezone Europe/Budapest
+++ /dev/null
-#!/bin/sh
-set -x
-
-read -n 1 -p "Recreate ldap certificate? y/[n] " -t 5 RECREATE
-if [ "$RECREATE" = "y" ]
-then
- cd /etc/pki/tls/certs
- openssl genrsa -aes128 2048 >tmp.key
- openssl rsa -in tmp.key -out slapd.key
- openssl req -utf8 -new -key slapd.key -out slapd.csr
- openssl x509 -in slapd.csr -out slapd.crt -req -signkey slapd.key -days 3650
- chmod 600 slapd.key
- rm -f slapd.csr tmp.key
-fi
-
-cp -p /etc/pki/tls/certs/slapd.key \
- /etc/pki/tls/certs/slapd.crt \
- /etc/pki/tls/certs/ca-bundle.crt \
- /etc/openldap/certs/
-
-chown ldap.ldap /etc/openldap/certs/slapd.key \
- /etc/openldap/certs/slapd.crt \
- /etc/openldap/certs/ca-bundle.crt
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(realpath $(dirname $0))
-
-
->$REAL_PATH/SEED.txt
->$REAL_PATH/UIDS.txt
-cat $REAL_PATH/USERS.txt | while read LINE
-do
- COMPACT_LINE=$(echo $LINE | sed 's/, /,/g')
- LOGIN=$(echo $COMPACT_LINE | cut -f 1 -d ',')
- LOGIN_MD5SUM=$(echo $LOGIN | md5sum | awk '{print $1}')
- UID_POSITION=30
- UID_IS_UNIQUE=0
- while [ $UID_IS_UNIQUE -eq 0 ]
- do
- LOGIN_UID=$(echo $LOGIN_MD5SUM | cut -c ${UID_POSITION}- | cut -c 1-3)
- grep $LOGIN_UID $REAL_PATH/SEED.txt >/dev/null 2>&1
- if [ $? -eq 1 ]
- then
- INT_UID=$(python -c "print(10000 + int('$LOGIN_UID', 16))")
- HEX_UID=$(python -c "print(hex($INT_UID))")
- #echo $LOGIN $LOGIN_MD5SUM $LOGIN_UID $INT_UID $HEX_UID
- echo $LOGIN_UID >>$REAL_PATH/SEED.txt
- echo "${INT_UID},${HEX_UID},$COMPACT_LINE" >>$REAL_PATH/UIDS.txt
- UID_IS_UNIQUE=1
- else
- UID_POSITION=$(( $UID_POSITION - 1 ))
- echo "shifted $LOGIN to $UID_POSITION"
- if [ $UID_POSITION -eq 0 ]
- then
- echo "Cannot generate unique uid for $LOGIN" >&2
- exit 1
- fi
- fi
- done
- #echo $LOGIN $LOGIN_UID $INT_UID $LOGIN_MD5SUM
-done
-
->$REAL_PATH/setupusers.ldif
-cat $REAL_PATH/UIDS.txt | while read LINE
-do
- INT_UID=$(echo $LINE | cut -f 1 -d ',')
- HEX_UID=$(echo $LINE | cut -f 2 -d ',')
- LOGIN=$(echo $LINE | cut -f 3 -d ',')
- FIRSTNAME=$(echo $LINE | cut -f 4 -d ',')
- LASTNAME=$(echo $LINE | cut -f 5 -d ',')
- MAIL_ADDRESS=$(echo $LINE | cut -f 6 -d ',')
- MOBILE_NUMBER=$(echo $LINE | cut -f 7 -d ',')
- sed -e "s/__UID__/$INT_UID/" \
- -e "s/__LOGIN__/$LOGIN/" \
- -e "s/__FIRSTNAME__/$FIRSTNAME/" \
- -e "s/__LASTNAME__/$LASTNAME/" \
- -e "s/__MAIL__/$MAIL_ADDRESS/" \
- -e "s/__MOBILE__/$MOBILE_NUMBER/" \
- <$REAL_PATH/user_template.ldif \
- >>$REAL_PATH/setupusers.ldif
-done
+++ /dev/null
-#!/bin/sh
-set -x
-
-REAL_PATH=$(realpath $(dirname $0))
-SLAPD_RUNNING=0
-
-
-while [ $SLAPD_RUNNING -ne 1 ]
-do
- echo -n '.'
- sleep 1
- systemctl --quiet is-active slapd.service
- SLAPD_RUNNING=$(( $? + 1 ))
-done
-
-read -n 1 -p "Recreate ldap database? y/[n] " -t 5 RECREATE
-
-ldapadd -Y EXTERNAL -H ldapi:/// -f $REAL_PATH/setup0config.ldif
-ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
-ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
-ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
-ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/ppolicy.ldif
-ldapmodify -Y EXTERNAL -H ldapi:/// -f $REAL_PATH/setup1monitor.ldif
-ldapmodify -Y EXTERNAL -H ldapi:/// -f $REAL_PATH/setup2mdb.ldif
-ldapmodify -Y EXTERNAL -H ldapi:/// -f $REAL_PATH/setupppolicymodule.ldif
-ldapmodify -Y EXTERNAL -H ldapi:/// -f $REAL_PATH/setupppolicyconfig.ldif
-ldapmodify -Y EXTERNAL -H ldapi:/// -f $REAL_PATH/setupppolicydefault.ldif
-ldapmodify -Y EXTERNAL -H ldapi:/// -f $REAL_PATH/setuptls.ldif
-if [ "$RECREATE" = "y" ]
-then
- ldapadd -x -D cn=Manager,dc=user,dc=hu -w pwd -f $REAL_PATH/setupdomain.ldif
- ldapadd -x -D cn=Manager,dc=user,dc=hu -w pwd -f $REAL_PATH/setupusers.ldif
-fi
-ldapmodify -Y EXTERNAL -H ldapi:/// -f $REAL_PATH/replacerootpw.ldif
-
-if [ "$RECREATE" != "y" ]
-then
- systemctl stop slapd.service
- slapadd -n 2 -l $REAL_PATH/data.ldif
- chown -R ldap.ldap /var/lib/ldap
- systemctl start slapd.service
-fi
-
-authselect select sssd with-mkhomedir --force
-systemctl restart oddjobd.service
-systemctl restart sssd.service
-
-# back up passwords
-#ldapsearch -x -D cn=Manager,dc=user,dc=hu -W -b "ou=People,dc=user,dc=hu" "objectClass=*" userPassword shadowLastChange
-
-# back up openldap
-#slapcat -n 0 >/tmp/config.ldif
-#slapcat -n 2 >/tmp/data.ldif
-
-# restore openldap
-#slapadd -n 0 -F /etc/openldap/slapd.d -l /tmp/config.ldif
-#slapadd -n 2 -F /etc/openldap/slapd.d -l /tmp/data.ldif
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-akosztolanyi, Árpád, Kosztolányi, arpad.kosztolanyi@userrendszerhaz.hu, +36 20 583 7539
-csgulyas, Csaba, Gulyás, csaba.gulyas@userrendszerhaz.hu, +36 30 374 4065
-cslevai, Csilla, Lévai, csilla.levai@userrendszerhaz.hu, +36 30 280 8517
-dhorvath, Dénes, Horváth, denes.horvath@userrendszerhaz.hu, +36 30 971 8563
-dvasary, Dániel, Vásáry, daniel.vasary@userrendszerhaz.hu, +36 30 515 9417
-fritter, Ferenc, Ritter, ferenc.ritter@userrendszerhaz.hu, +36 20 937 8022
-fschnell, Ferenc, Schnellbach, ferenc.schnellbach@userrendszerhaz.hu, +36 30 950 2529
-khorvath, Kálmán, Horváth, kalman.horvath@userrendszerhaz.hu, +36 20 444 8693
-kkancz, Krisztián, Káncz, krisztian.kancz@userrendszerhaz.hu, +36 70 666 2663
-kvajda, Krisztina, Vajda, krisztina.vajda@userrendszerhaz.hu, +36 20 313 0028
-mszabo, Marcell, Szabó, marcell.szabo@userrendszerhaz.hu, +36 70 458 1234
-osweidan, Omár, Sweidan, omar.sweidan@userrendszerhaz.hu, +36 70 382 4621
-ppazmandi, Péter, Pázmándi, peter.pazmandi@userrendszerhaz.hu, +36 30 731 3717
-rrendek, Róbert, Rendek, robert.rendek@userrendszerhaz.hu, +36 30 977 5888
-tlevai, Tibor, Lévai, tibor.levai@userrendszerhaz.hu, +36 30 297 6481
-zfelleg, Zoltán, Felleg, zoltan.felleg@userrendszerhaz.hu, +36 20 954 1513
+++ /dev/null
-temp (pwd): {SSHA}PaJYPlbWfzdt301XlzPy7PhfJkIDohyc
-final : {SSHA}RWEH1A6dxFFVufJrFI5BchIyq3AIAq4I
+++ /dev/null
-dn: olcDatabase={2}mdb,cn=config
-changetype: modify
-replace: olcRootPW
-olcRootPW: {SSHA}RWEH1A6dxFFVufJrFI5BchIyq3AIAq4I
+++ /dev/null
-dn: olcDatabase={0}config,cn=config
-changetype: modify
-add: olcRootPW
-olcRootPW: {SSHA}Qta8GXQLA1k8WpxRd9FQ2qzi3jcJBfob
-
-#dn: cn=config
-#changetype: modify
-#replace: olcLogLevel
-#olcLogLevel: Conns ACL
+++ /dev/null
-dn: olcDatabase={1}monitor,cn=config
-changetype: modify
-replace: olcAccess
-olcAccess: {0}to *
- by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
- by dn.base="cn=Manager,dc=user,dc=hu" read
- by * none
+++ /dev/null
-dn: olcDatabase={2}mdb,cn=config
-changetype: modify
-replace: olcSuffix
-olcSuffix: dc=user,dc=hu
-
-dn: olcDatabase={2}mdb,cn=config
-changetype: modify
-replace: olcRootDN
-olcRootDN: cn=Manager,dc=user,dc=hu
-
-dn: olcDatabase={2}mdb,cn=config
-changetype: modify
-add: olcRootPW
-olcRootPW: {SSHA}PaJYPlbWfzdt301XlzPy7PhfJkIDohyc
-
-dn: olcDatabase={2}mdb,cn=config
-changetype: modify
-add: olcAccess
-olcAccess: {0}to attrs=userPassword
- by dn="cn=Manager,dc=user,dc=hu" write
- by anonymous auth
- by self write
- by * none
-olcAccess: {1}to attrs=shadowLastChange
- by dn="cn=Manager,dc=user,dc=hu" write
- by self write
- by * read
-olcAccess: {2}to dn.base=""
- by * read
-olcAccess: {3}to *
- by dn="cn=Manager,dc=user,dc=hu" write
- by * read
+++ /dev/null
-dn: dc=user,dc=hu
-objectClass: top
-objectClass: dcObject
-objectclass: organization
-o: USER Sytemhouse
-dc: user
-
-dn: cn=Manager,dc=user,dc=hu
-objectClass: organizationalRole
-cn: Manager
-description: Directory Manager
-
-dn: ou=People,dc=user,dc=hu
-objectClass: organizationalUnit
-ou: People
-
-dn: ou=Group,dc=user,dc=hu
-objectClass: organizationalUnit
-ou: Group
+++ /dev/null
-dn: cn=config
-changetype: modify
-add: olcTLSCACertificateFile
-olcTLSCACertificateFile: /etc/openldap/certs/ca-bundle.crt
--
-replace: olcTLSCertificateFile
-olcTLSCertificateFile: /etc/openldap/certs/slapd.crt
--
-replace: olcTLSCertificateKeyFile
-olcTLSCertificateKeyFile: /etc/openldap/certs/slapd.key
+++ /dev/null
-# __LOGIN__
-dn: uid=__LOGIN__,ou=People,dc=user,dc=hu
-objectClass: inetOrgPerson
-objectClass: posixAccount
-objectClass: shadowAccount
-cn: __FIRSTNAME__ __LASTNAME__
-givenName: __FIRSTNAME__
-sn: __LASTNAME__
-mail: __MAIL__
-mobile: __MOBILE__
-loginShell: /bin/bash
-uidNumber: __UID__
-gidNumber: __UID__
-homeDirectory: /home/__LOGIN__
-userPassword: {SSHA}Be0QldINCqu8gM+Fii1cR2fpjCzSqEcO
-shadowLastChange: 0
-shadowMax: 3650
-
-dn: cn=__LOGIN__,ou=Group,dc=user,dc=hu
-objectClass: posixGroup
-cn: __LOGIN__
-gidNumber: __UID__
-memberUid: __LOGIN__
-
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-
-chown -R root.root $SOURCE_PATH
-chown -R ldap.ldap $SOURCE_PATH/var/lib/ldap
-
-chgrp ssh_keys $SOURCE_PATH/etc/ssh/*_key
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-
-chmod 600 $SOURCE_PATH/etc/pki/tls/certs/slapd.key
-chmod 400 $SOURCE_PATH/etc/ssh/*_key
-chmod 444 $SOURCE_PATH/etc/ssh/*.pub
-chmod 600 $SOURCE_PATH/etc/sssd/sssd.conf
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-tar --create \
- --directory=$REAL_PATH \
- --exclude=.placeholder \
- --to-stdout \
- install \
- | tar --extract \
- --backup \
- --directory=/ \
- --no-overwrite-dir \
- --strip-components=1 \
- --suffix=.orig
+++ /dev/null
-#!/bin/sh
-
-
-systemctl enable oddjobd.service
-systemctl enable slapd.service
-systemctl enable sssd.service
-systemctl enable NetworkManager-wait-online.service
-
-systemctl enable logrotate.timer
+++ /dev/null
-#!/bin/sh
-
-
-echo "AuthorizedKeysCommand /usr/libexec/openssh/ssh-ldap-wrapper" >>/etc/ssh/sshd_config
-echo "AuthorizedKeysCommandUser nobody" >>/etc/ssh/sshd_config
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-ldap.in.useribm.hu /tmp/data.ldif firstboot
+++ /dev/null
-#
-# LDAP Defaults
-#
-
-# See ldap.conf(5) for details
-# This file should be world readable but not world writable.
-
-#BASE dc=example,dc=com
-#URI ldap://ldap.example.com ldap://ldap-master.example.com:666
-
-#SIZELIMIT 12
-#TIMELIMIT 15
-#DEREF never
-
-# When no CA certificates are specified the Shared System Certificates
-# are in use. In order to have these available along with the ones specified
-# by TLS_CACERTDIR one has to include them explicitly:
-#TLS_CACERT /etc/pki/tls/cert.pem
-
-# System-wide Crypto Policies provide up to date cipher suite which should
-# be used unless one needs a finer grinded selection of ciphers. Hence, the
-# PROFILE=SYSTEM value represents the default behavior which is in place
-# when no explicit setting is used. (see openssl-ciphers(1) for more info)
-#TLS_CIPHER_SUITE PROFILE=SYSTEM
-
-# Turning this off breaks GSSAPI used with krb5 when rdns = false
-SASL_NOCANON on
-
-BASE dc=user,dc=hu
-URI ldap://ldap.in.useribm.hu
+++ /dev/null
------BEGIN CERTIFICATE-----
-MIIDMjCCAhoCCQC4bVg+Y9rSOjANBgkqhkiG9w0BAQsFADBbMQswCQYDVQQGEwJI
-VTERMA8GA1UEBwwIQnVkYXBlc3QxHjAcBgNVBAoMFVVTRVIgU3lzdGVtaG91c2Ug
-THRkLjEZMBcGA1UEAwwQbGRhcC51c3IudXNlci5odTAeFw0xODEwMDEwOTU0MjJa
-Fw0yODA5MjgwOTU0MjJaMFsxCzAJBgNVBAYTAkhVMREwDwYDVQQHDAhCdWRhcGVz
-dDEeMBwGA1UECgwVVVNFUiBTeXN0ZW1ob3VzZSBMdGQuMRkwFwYDVQQDDBBsZGFw
-LnVzci51c2VyLmh1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAm1g5
-LJtdXNjzxSonx/FH5Mxo3Jx8pYOSjPfkQGMLn7k9hpaZFjlZQlMZURlP3lBntSpz
-7ZUecEpIP1f5Yompk/zdDrAAToLpFoKwhp2sBwlcqgPMw8hi2WD88/jVcigbdQL+
-jhqHtYHXBF4HfwQf5AiJgqnQ+jY8jOKQgwSUsrNKVL/LDRW9rJzGrUwf1k0IYfnL
-/eOhwzJj7aCpFY5cf9cMP1SeBq9UL7tzT2tIGneQLhxb38/aPKYVEP4vZavCW/G1
-B/p0DOXZ9njyy8sOj02vdZN8CIuOqyIOS79rWRkQlXt85httRF+rNOtHg6LqviH6
-ZKsbkjsALnyWj1FnwQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQADOaFtkRiO3pSn
-5BGeWYIPu0iE0ADaZDjMIxd+7fQyMb8jx7S114ylWvdpmQAhUPqDgojW4xrSteR+
-fGIY2ai2ZBoVHgFqhDGcg/iAv/BeblspD81AdYy9/OGLkmNi2nvggmNQ5pEATqAO
-CavZ6DIZp/i1Y2dxKvlnkKFo9jwpZVIqZdFYLsybq9xIcI5L942I0LVYL0Mgyhr0
-3VF1uwxva0apM7yl0KZ/MNcwsJU1s6ObnWyeybNwTnCKlyIStfhV3e3KJ5bHQLaI
-snX6owJIAve99AmVw6aneGu27qlKYbuENYC06K+RuYrbYHRzrjbF5SGEHcLAhFVN
-/Cb2K+qe
------END CERTIFICATE-----
+++ /dev/null
------BEGIN RSA PRIVATE KEY-----
-MIIEogIBAAKCAQEAm1g5LJtdXNjzxSonx/FH5Mxo3Jx8pYOSjPfkQGMLn7k9hpaZ
-FjlZQlMZURlP3lBntSpz7ZUecEpIP1f5Yompk/zdDrAAToLpFoKwhp2sBwlcqgPM
-w8hi2WD88/jVcigbdQL+jhqHtYHXBF4HfwQf5AiJgqnQ+jY8jOKQgwSUsrNKVL/L
-DRW9rJzGrUwf1k0IYfnL/eOhwzJj7aCpFY5cf9cMP1SeBq9UL7tzT2tIGneQLhxb
-38/aPKYVEP4vZavCW/G1B/p0DOXZ9njyy8sOj02vdZN8CIuOqyIOS79rWRkQlXt8
-5httRF+rNOtHg6LqviH6ZKsbkjsALnyWj1FnwQIDAQABAoIBABvNOUZLc/UW+uGx
-frcg7n37O1UoSIKSvpquDtKbJ0xpqaI5t6Irl1bwalqCTjH6b+UTePXvNyhfkviL
-NR22h3vtyF5Fj3h9o1uc/hzJgS0tNsFStsXfShmfawX65bBtjyRs6cPi6aDJYQLu
-FSddRJvaD0osPDNbm5CXR8e6/SXR+zdDsdOTFnnM6KsNqw0SQgNVBoTHIHMGKU//
-SprTYNgP5Jhib4kuUNa+iaNwv/I8BEzooRG+JXJezhtbUecM0poI1izyKhPTlFgx
-KTJ0FmzpPtypOGWnPazt710wIUU/O4dODOKB/J6eF578QkHoOZ4Z0Ykes9p6RWMF
-oPqb07ECgYEAzJKOf6fNWrWjzZksiP6NB5jvfEF3Fb3IyclH3z0cYLJ40DHYehp7
-Qs2/2BikPd4zsZHLCcp08gjlT8LsZQwYdJK4BsQ80xHVsiZY3Gfqm867EJJlnZ7b
-Le1h0iCXmrkh9KeNHeWZdOpttJPo/5kvf9TdNL1dk3VHxXuVy9mBat0CgYEAwmWQ
-Xh3egaIPYNdlPAeK8Q67CrQ0CKriwJMUeyMzU+IhbyRQgus5dWOnvdS0Jt8tT7dA
-thrfWDQCaeSjsXW8vNdQxK9WMZoCYSI5gayu0WmlX9Vcgp1LSxuRkGpJvqdU4SlU
-XGoP7NuIqxvDJ3TiWVV+1nufk74XLhlEKhuG6DUCgYAHQE6iwbzqsTOMLxjABl3T
-Xh1nBx8Ee0SpumO8yvq9hrX3kzy8H0ItPQPG0iDIPJ8SdTuALlf02FHggOVGM6aO
-Q0EYpE4PoTs05F0T+u769Nn2nWnSq3XTa+2iuBsHlfZZKLM80w2cck7PLsr8fF6N
-pmrs2qV9e5O+sUG/BweqVQKBgFfvtaS9gj/F3YsDJMpI5zMwZK/s4HTjSHuwjN0/
-CSLy8gjitoDigzV1BRY8N9o1rruWu/Ekqs+th0H7qYjHJ7+M7v5qCmWZs2XZI4Zj
-ZRlZ3vNBAv4axUqOiAR58C4MZ7sLBRxg5h9RF7u/bUJV/2ZF5ICFn6Qnozi5OTqL
-BTXZAoGAS8bsX6GVqWd/FkBJCqFVbUQcbawQKy0ZVlEIPg06hPtxRcmNZt+dtOWT
-6W/yoer/7oGGUoSHE1y6a5SX0vHOvtkToYy4zUjESaMsa9Wr/DoP9RDkCqUJijxY
-zG3XPCj7maygTKSC77ao2bCyQqKYyjIU80CjmI8X8ybAQIkdgAo=
------END RSA PRIVATE KEY-----
+++ /dev/null
-# $Id: openssh-5.5p1-ldap.patch,v 1.3 2010/07/07 13:48:36 jfch2222 Exp $
-#
-# This is the example configuration file for the OpenSSH
-# LDAP backend
-#
-# see ssh-ldap.conf(5)
-#
-
-# URI with your LDAP server name. This allows to use
-# Unix Domain Sockets to connect to a local LDAP Server.
-uri ldap://127.0.0.1/
-#uri ldaps://127.0.0.1/
-#uri ldapi://%2fvar%2frun%2fldapi_sock/
-# Note: %2f encodes the '/' used as directory separator
-
-# Another way to specify your LDAP server is to provide an
-# host name and the port of our LDAP server. Host name
-# must be resolvable without using LDAP.
-# Multiple hosts may be specified, each separated by a
-# space. How long nss_ldap takes to failover depends on
-# whether your LDAP client library supports configurable
-# network or connect timeouts (see bind_timelimit).
-#host 127.0.0.1
-
-# The port.
-# Optional: default is 389.
-#port 389
-
-# The distinguished name to bind to the server with.
-# Optional: default is to bind anonymously.
-#binddn cn=openssh_keys,dc=example,dc=org
-
-# The credentials to bind with.
-# Optional: default is no credential.
-#bindpw TopSecret
-
-# The distinguished name of the search base.
-#base dc=example,dc=org
-
-# The LDAP version to use (defaults to 3
-# if supported by client library)
-#ldap_version 3
-
-# The search scope.
-#scope sub
-#scope one
-#scope base
-
-# Search timelimit
-#timelimit 30
-
-# Bind/connect timelimit
-#bind_timelimit 30
-
-# Reconnect policy: hard (default) will retry connecting to
-# the software with exponential backoff, soft will fail
-# immediately.
-#bind_policy hard
-
-# SSL setup, may be implied by URI also.
-ssl no
-#ssl on
-#ssl start_tls
-
-# OpenLDAP SSL options
-# Require and verify server certificate (yes/no)
-# Default is to use libldap's default behavior, which can be configured in
-# /etc/openldap/ldap.conf using the TLS_REQCERT setting. The default for
-# OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes".
-#tls_checkpeer hard
-
-# CA certificates for server certificate verification
-# At least one of these are required if tls_checkpeer is "yes"
-#tls_cacertfile /etc/ssl/ca.cert
-#tls_cacertdir /etc/pki/tls/certs
-
-# Seed the PRNG if /dev/urandom is not provided
-#tls_randfile /var/run/egd-pool
-
-# SSL cipher suite
-# See man ciphers for syntax
-#tls_ciphers TLSv1
-
-# Client certificate and key
-# Use these, if your server requires client authentication.
-#tls_cert
-#tls_key
-
-# OpenLDAP search_format
-# format used to search for users in LDAP directory using substitution
-# for %u for user name and %f for SSH_Filter option (optional, empty by default)
-#search_format (&(objectclass=%c)(objectclass=ldapPublicKey)(uid=%u)%f)
-
-#AccountClass posixAccount
-
+++ /dev/null
------BEGIN OPENSSH PRIVATE KEY-----
-b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
-1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQRNhyIFsn1XHUZl3cXseM3xVxjVTDL4
-wBFyEQELvVGAEGmxqhETsNPb0xzFGXstoNZkQeBO72huapDROPbs72JXAAAAoLbGMeS2xj
-HkAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBE2HIgWyfVcdRmXd
-xex4zfFXGNVMMvjAEXIRAQu9UYAQabGqEROw09vTHMUZey2g1mRB4E7vaG5qkNE49uzvYl
-cAAAAhALkbjaiJrtAkV7WAjDoFzCcjYavVqLSDWyq549QfKliMAAAAAAECAwQFBgc=
------END OPENSSH PRIVATE KEY-----
+++ /dev/null
-ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBE2HIgWyfVcdRmXdxex4zfFXGNVMMvjAEXIRAQu9UYAQabGqEROw09vTHMUZey2g1mRB4E7vaG5qkNE49uzvYlc=
+++ /dev/null
------BEGIN OPENSSH PRIVATE KEY-----
-b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
-QyNTUxOQAAACAPqi+85zTZURcO07ZEkK/+WbPE0jeqbs5ezIefribFxwAAAIgiYFM1ImBT
-NQAAAAtzc2gtZWQyNTUxOQAAACAPqi+85zTZURcO07ZEkK/+WbPE0jeqbs5ezIefribFxw
-AAAEDv3ANgLBg7Rq+8xAZZLTCknzJn4WtmPtyQ9aqJUqFJMQ+qL7znNNlRFw7TtkSQr/5Z
-s8TSN6puzl7Mh5+uJsXHAAAAAAECAwQF
------END OPENSSH PRIVATE KEY-----
+++ /dev/null
-ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAILjtjMrHvSbyzjUu5OhxkAnSTtnDUo0J2qVnUJHq7OwfAAAAIA+qL7znNNlRFw7TtkSQr/5Zs8TSN6puzl7Mh5+uJsXHAAAAAAAAAAAAAAACAAAAEmxkYXAuaW4udXNlcmlibS5odQAAABYAAAASbGRhcC5pbi51c2VyaWJtLmh1AAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgRdggjOtRLHz8FDr+22RKvmgTIHkXliDhunUM6SoM430AAABTAAAAC3NzaC1lZDI1NTE5AAAAQCwoXaZKKq1b0072iGhd0C+DAbpxuEnrGCYSQRjS3epMcdX8jsDgXfql0s0y+PX12leqzNvpjADJQRzznCBcXAM= ssh_host_ed25519_key.pub
+++ /dev/null
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA+qL7znNNlRFw7TtkSQr/5Zs8TSN6puzl7Mh5+uJsXH
+++ /dev/null
------BEGIN OPENSSH PRIVATE KEY-----
-b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn
-NhAAAAAwEAAQAAAQEAl33xHJr1IacdKzig31rgBuKL4kfuvLmXPzHgftSlH0q1r0zMizAE
-aPcXMRHZ5w/TVUegd3qk2tNVQcJSPoqTjOFC2+tTpYYO6uJ7i5iDvP5v2Akm0VlSL3zwdv
-k/TYBwpp3qXtLz4TNhcCjFpup63QgPCVlhZj7WyES4fWstR56ePAyBGydWUkwz1d4pZo8G
-ChrSflt3F9nHcfTkgoZPD5GMQnm521rpL+yeuyUOmkO0DTkh00CP8nm9rhXUN99uGlYxDM
-+lMcNn/1PV/8/BYMzhgeI1qJz10yXwPKQb5fxXdk/6qa4I9AKzscTV23/QAwgmz4bSYlzz
-ypYlt0enEQAAA7h06oRJdOqESQAAAAdzc2gtcnNhAAABAQCXffEcmvUhpx0rOKDfWuAG4o
-viR+68uZc/MeB+1KUfSrWvTMyLMARo9xcxEdnnD9NVR6B3eqTa01VBwlI+ipOM4ULb61Ol
-hg7q4nuLmIO8/m/YCSbRWVIvfPB2+T9NgHCmnepe0vPhM2FwKMWm6nrdCA8JWWFmPtbIRL
-h9ay1Hnp48DIEbJ1ZSTDPV3ilmjwYKGtJ+W3cX2cdx9OSChk8PkYxCebnbWukv7J67JQ6a
-Q7QNOSHTQI/yeb2uFdQ3324aVjEMz6Uxw2f/U9X/z8FgzOGB4jWonPXTJfA8pBvl/Fd2T/
-qprgj0ArOxxNXbf9ADCCbPhtJiXPPKliW3R6cRAAAAAwEAAQAAAQA3Q7aF3PG4CSLW9Z2a
-XaiEWnj1X5B0QLAwWZ2wJxrlw3dsL/QegrHZKOrI994qMNfDsJGVhKRHP/lGOAGQ1zTkm/
-isCblGFRW0ElNHpafJdniOsyf6Dz+wG0AN5vd06nouDkXFuedGLFxLclRIhBm2MI5rtrOV
-fS8VeBxlhIfMLD2QGy6tZytksdqTIf8egAYv5QGn/LAYmjtiXfyWIGwN4LUKV6jeQUz9mk
-P0UzY9VyOwXAthWE43MDM3zllzXF7Yw8vf2EJuOKLzXqbuKzNPAyNrOXMXYHMt2ZlJuy0b
-JThk72tmR7aCiyKOsHxWPjwMad9hBvjV7Kg475UD+WkRAAAAgQCPim2W3nzD8i1mq89jr7
-VkQQWsmKmbeS/cufuHoJ23JqNyoO3dxfRT1GHupBYJXvjwQS9Dt/v2+GTVZa6Ldbx9T1Ew
-COetJS1ZnrTUPbT6fesSuFZnCBDwGjx02bOcPbhDutTMDqCTPh8J45kIpw8U4UynWTIe9w
-ZhObgUeKh2rQAAAIEAyJS2/z7CpwN7gtzRovSuaPFMtxBGlmkHDBa/AA9oCSleoXABMSiI
-GE7Mfl6B3q+ryvLJMNj9ILSfPhBORMvO6RhKVV3qR0hUKuqFxy9p8e8e69N1QoYVgBsEtR
-q+iij76B1cnwsV6wf4kxHKRHmivHATfKFPgZONmr4E9SST4ncAAACBAMFZHe0EdpReZGw4
-ARCyj6fvGLOu3ApM+PreNyVLXETNxvPIsqn1JTAPsMrX/82HKxD78c6nu1Ki0qJ7BuTEBQ
-Rq6SiGjEEaW3skoppOK0md5cj7xNBY7eJFVbVAFmiudQaEbQlorf63jd0ErzIu0xKEi0Kg
-l5RXrm5GsNIiwly3AAAAAAEC
------END OPENSSH PRIVATE KEY-----
+++ /dev/null
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCXffEcmvUhpx0rOKDfWuAG4oviR+68uZc/MeB+1KUfSrWvTMyLMARo9xcxEdnnD9NVR6B3eqTa01VBwlI+ipOM4ULb61Olhg7q4nuLmIO8/m/YCSbRWVIvfPB2+T9NgHCmnepe0vPhM2FwKMWm6nrdCA8JWWFmPtbIRLh9ay1Hnp48DIEbJ1ZSTDPV3ilmjwYKGtJ+W3cX2cdx9OSChk8PkYxCebnbWukv7J67JQ6aQ7QNOSHTQI/yeb2uFdQ3324aVjEMz6Uxw2f/U9X/z8FgzOGB4jWonPXTJfA8pBvl/Fd2T/qprgj0ArOxxNXbf9ADCCbPhtJiXPPKliW3R6cR
+++ /dev/null
-HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub
+++ /dev/null
-TrustedUserCAKeys /etc/ssh/trusted-user-ca.keys
+++ /dev/null
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJdSgSmeOIwnP90z5zXAK1x5jMpg4PU5iOVxJeTbndC7 user-CA (qqcs)
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICcf/XXU8dNVtbveGmwbdnRJfYIItzxKmgRkzlp0k6r5 user-CA (user)
+++ /dev/null
-[domain/default]
-id_provider = ldap
-autofs_provider = ldap
-auth_provider = ldap
-chpass_provider = ldap
-ldap_uri = ldap://ldap.usr.user.hu/
-ldap_search_base = dc=user,dc=hu
-ldap_id_use_start_tls = True
-ldap_tls_cacertdir = /etc/openldap/certs
-cache_credentials = True
-ldap_tls_reqcert = allow
-
-[sssd]
-services = nss, pam, autofs
-domains = default
-
-[nss]
-homedir_substring = /home
+++ /dev/null
-#!/bin/sh
-
-
-systemctl stop slapd.service
-slapcat -n 2 >/tmp/data.ldif
-systemctl start slapd.service
+++ /dev/null
-# $OpenLDAP$
-# Example DB_CONFIG file for use with slapd(8) BDB/HDB databases.
-#
-# See the Oracle Berkeley DB documentation
-# <http://www.oracle.com/technology/documentation/berkeley-db/db/ref/env/db_config.html>
-# for detail description of DB_CONFIG syntax and semantics.
-#
-# Hints can also be found in the OpenLDAP Software FAQ
-# <http://www.openldap.org/faq/index.cgi?file=2>
-# in particular:
-# <http://www.openldap.org/faq/index.cgi?file=1075>
-
-# Note: most DB_CONFIG settings will take effect only upon rebuilding
-# the DB environment.
-
-# one 0.25 GB cache
-set_cachesize 0 268435456 1
-
-# Data Directory
-#set_data_dir db
-
-# Transaction Log settings
-set_lg_regionmax 262144
-set_lg_bsize 2097152
-#set_lg_dir logs
-
-# Note: special DB_CONFIG flags are no longer needed for "quick"
-# slapadd(8) or slapindex(8) access (see their -q option).
+++ /dev/null
-ldap.in.useribm.hu root /root/backupldapdb.sh
+++ /dev/null
-lxc.include = /usr/share/lxc/config/common.conf
-
-lxc.arch = x86_64
-lxc.uts.name = svc.in.useribm.hu
-lxc.rootfs.path = __CONTAINER_PATH__/rootfs
-lxc.mount.auto = proc:rw sys:ro
-
-lxc.net.0.type = veth
-lxc.net.0.flags = up
-lxc.net.0.link = bri-dev
-lxc.net.0.hwaddr = 02:0c:18:03:6d:fd
-
-lxc.autodev = 1
-
-lxc.cgroup2.devices.allow = a
-
-lxc.signal.halt = SIGRTMIN+4
-
-lxc.start.auto = 1
-lxc.start.order = __CONTAINER_START_ORDER__
-lxc.start.delay = 5
+++ /dev/null
-DISTRIBUTION=Fedora
-DISTRIBUTION_VERSION=35
-ROOT_PACKAGES="hostname initscripts iproute rootfiles systemd-udev"
-BASE_PACKAGES="NetworkManager iputils logrotate rsyslog tar vim-minimal"
-SPEC_PACKAGES="bind bind-utils dhcp-server postfix python3 python3-dbus"
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active NetworkManager.service
-NM_RC=$?
-WAITED=0
-while [ $NM_RC -ne 0 ]
-do
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active NetworkManager.service
- NM_RC=$?
-done
-[ $WAITED -eq 1 ] && echo
-
-CONNECTIONS=$(nmcli --terse connection show | wc -l)
-while [ $CONNECTIONS -ne 1 ]
-do
- echo "Number of connections: $CONNECTIONS" >&2
- sleep 1
- CONNECTIONS=$(nmcli --terse connection show | wc -l)
-done
-
-nmcli --terse connection show | grep ':$' >/dev/null
-ALL_CONNECTION_DEVICES_KNOWN=$?
-while [ $ALL_CONNECTION_DEVICES_KNOWN -eq 0 ]
-do
- echo "Not all connection devices are known yet" >&2
- sleep 1
- nmcli --terse connection show | grep ':$' >/dev/null
- ALL_CONNECTION_DEVICES_KNOWN=$?
-done
-
-CONNECTION_LINE=$(nmcli --terse connection show)
-CONNECTION_UUID=$(echo $CONNECTION_LINE | cut -f 2 -d ':')
-CONNECTION_DEVICE=$(echo $CONNECTION_LINE | cut -f 4 -d ':')
-
-nmcli connection delete uuid "$CONNECTION_UUID"
-
-nmcli connection add \
- connection.autoconnect yes \
- connection.id internal \
- connection.interface-name $CONNECTION_DEVICE \
- connection.type 802-3-ethernet \
- ipv4.addresses "10.228.109.253/16" \
- ipv4.dns "10.228.109.159, 10.228.92.159" \
- ipv4.dns-search "in.useribm.hu" \
- ipv4.gateway "10.228.109.254" \
- ipv4.method "manual" \
- ipv6.addresses "2a02:d400:0000:f268:000c:18ff:fe03:6dfd/64" \
- ipv6.dns "2a02:d400:0000:f268:000c:18ff:fe03:6d9f, 2a02:d400:0000:f268:000c:18ff:fe03:5c9f" \
- ipv6.dns-search "in.useribm.hu" \
- ipv6.gateway "2a02:d400:0000:f268:000c:18ff:fe03:6dfe" \
- ipv6.method "manual" \
- save yes
-
-nmcli connection show
+++ /dev/null
-#!/bin/sh
-
-
-sleep 1
-systemctl --quiet is-active dbus.service
-DBUS_RC=$?
-WAITED=0
-while [ $DBUS_RC -ne 0 ]
-do
- if [ $WAITED -eq 0 ]
- then
- echo -n "Waiting for dbus.service"
- fi
- echo -n .
- sleep 1
- WAITED=1
- systemctl --quiet is-active dbus.service
- DBUS_RC=$?
-done
-[ $WAITED -ne 0 ] && echo
-timedatectl set-timezone Europe/Budapest
+++ /dev/null
-#!/bin/sh
-
-
-exit 0
-authselect select sssd with-mkhomedir --force
-
-cat >>/etc/openldap/ldap.conf <<EOF
-BASE dc=user,dc=hu
-URI ldap://ldap.in.useribm.hu
-EOF
+++ /dev/null
-#!/bin/sh
-
-
-systemctl enable postfix.service
-systemctl start postfix.service
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-chown -R root.root $SOURCE_PATH/*
-
-chgrp named $SOURCE_PATH/etc/named.*
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-SOURCE_PATH=$REAL_PATH/install
-
-chmod 640 $SOURCE_PATH/etc/named.*
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-tar --create \
- --directory=$REAL_PATH \
- --exclude=.placeholder \
- --to-stdout \
- install \
- | tar --extract \
- --backup \
- --directory=/ \
- --no-overwrite-dir \
- --strip-components=1 \
- --suffix=.orig
+++ /dev/null
-#!/bin/sh
-
-
-sed --in-place=.orig \
- 's/^After=\(.*\)network\.target\(.*\)$/After=\1network-online.target\2/' \
- /usr/lib/systemd/system/named.service
-
-sed --in-place=.orig \
- 's/^After=\(.*\)network\.target\(.*\)$/After=\1network-online.target\2/' \
- /usr/lib/systemd/system/postfix.service
+++ /dev/null
-#!/bin/sh
-
-
-systemctl disable postfix.service
-
-systemctl enable dhcpd.service
-systemctl enable named.service
-systemctl enable NetworkManager-wait-online.service
-
-systemctl enable logrotate.timer
+++ /dev/null
-#!/bin/sh
-
-
-REAL_PATH=$(dirname $(realpath $0))
-
-echo rm -Rf $REAL_PATH
+++ /dev/null
-# dhcpd.conf
-#
-# Configuration file for ISC dhcpd
-#
-
-# Option definitions
-option broadcast-address 10.228.255.255;
-option domain-name "in.useribm.hu";
-option domain-name-servers 10.228.92.159, 10.228.109.159;
-option domain-search "in.useribm.hu", "sr.user.hu", "in.user.hu";
-option ntp-servers ntp1.in.useribm.hu, ntp2.in.useribm.hu;
-option routers ifg.in.useribm.hu;
-option smtp-server mx.in.useribm.hu;
-option subnet-mask 255.255.0.0;
-option time-offset 3600;
-
-option space PXE;
-option PXE.mtftp-ip code 1 = ip-address;
-option PXE.mtftp-cport code 2 = unsigned integer 16;
-option PXE.mtftp-sport code 3 = unsigned integer 16;
-option PXE.mtftp-tmout code 4 = unsigned integer 8;
-option PXE.mtftp-delay code 5 = unsigned integer 8;
-option architecture-type code 93 = unsigned integer 16;
-
-option space pxelinux;
-option pxelinux.magic code 208 = string;
-option pxelinux.configfile code 209 = text;
-option pxelinux.pathprefix code 210 = text;
-option pxelinux.reboottime code 211 = unsigned integer 32;
-option architecture-type code 93 = unsigned integer 16;
-
-option space apc;
-option apc.cookie code 1 = text;
-option apc.cookie "1APC";
-
-# 12/24 hours
-default-lease-time 43200;
-max-lease-time 86400;
-
-# Disable dynamic dns updates
-ddns-update-style none;
-
-# This DHCP server is the official DHCP server for the local network
-authoritative;
-
-# Use this to send dhcp log messages to a different log file (you also
-# have to hack syslog.conf to complete the redirection).
-log-facility local7;
-
-# in.useribm.hu subnet
-subnet 10.228.0.0 netmask 255.255.0.0 {
- range 10.228.43.1 10.228.43.254;
- vendor-option-space apc;
-}
-
-# static hosts
-host tn-phone-test {
- hardware ethernet 00:0b:82:66:f2:3e;
- fixed-address 10.228.215.220;
-}
-host tn-phone-sf {
- hardware ethernet 00:0b:82:67:2f:1c;
- fixed-address 10.228.215.196;
-}
-host tn-intercom-gf {
- hardware ethernet 7c:1e:b3:fe:4e:61;
- fixed-address 10.228.215.76;
-}
-host tn-phone-ff {
- hardware ethernet 00:0b:82:67:2d:26;
- fixed-address 10.228.215.66;
-}
-host apcups2 {
- hardware ethernet 00:c0:b7:23:dd:7d;
- fixed-address 10.228.226.2;
-}
-host apcups1 {
- hardware ethernet 00:c0:b7:58:c2:0c;
- fixed-address 10.228.226.1;
-}
-host db2svr {
- hardware ethernet 00:50:56:00:d4:2a;
- fixed-address 10.228.212.42;
-}
-host accounting-usr {
- hardware ethernet 00:50:56:00:d4:0d;
- fixed-address 10.228.212.13;
-}
-host tsmapil {
- hardware ethernet 00:50:56:00:c0:d4;
- fixed-address 10.228.192.212;
-}
-host sssbn3 {
- hardware ethernet 00:50:56:00:d1:83;
- fixed-address 10.228.209.131;
-}
-host sssbn2 {
- hardware ethernet 00:50:56:00:d1:82;
- fixed-address 10.228.209.130;
-}
-host sssbn1 {
- hardware ethernet 00:50:56:00:d1:81;
- fixed-address 10.228.209.129;
-}
-host sssan3 {
- hardware ethernet 00:50:56:00:d1:03;
- fixed-address 10.228.209.3;
-}
-host sssan2 {
- hardware ethernet 00:50:56:00:d1:02;
- fixed-address 10.228.209.2;
-}
-host sssan1 {
- hardware ethernet 00:50:56:00:d1:01;
- fixed-address 10.228.209.1;
-}
-host spstsql {
- hardware ethernet 00:50:56:00:ce:d4;
- fixed-address 10.228.206.212;
-}
-host spstad {
- hardware ethernet 00:50:56:00:ce:d3;
- fixed-address 10.228.206.211;
-}
-host spstsp {
- hardware ethernet 00:50:56:00:ce:d2;
- fixed-address 10.228.206.210;
-}
-host spw2k08sql {
- hardware ethernet 00:50:56:00:ce:cf;
- fixed-address 10.228.206.207;
-}
-host spw2k08sp {
- hardware ethernet 00:50:56:00:ce:ce;
- fixed-address 10.228.206.206;
-}
-host spw2k08ad {
- hardware ethernet 00:50:56:00:ce:0e;
- fixed-address 10.228.206.14;
-}
-host ppitsp {
- hardware ethernet 00:50:56:00:ce:03;
- fixed-address 10.228.206.3;
-}
-host ppitdb {
- hardware ethernet 00:50:56:00:ce:02;
- fixed-address 10.228.206.2;
-}
-host ppitad {
- hardware ethernet 00:50:56:00:ce:01;
- fixed-address 10.228.206.1;
-}
-host rredms {
- hardware ethernet 00:50:56:00:c6:35;
- fixed-address 10.228.198.53;
-}
-host ssam {
- hardware ethernet 00:50:56:00:c0:d1;
- fixed-address 10.228.192.209;
-}
-host spsbsql {
- hardware ethernet 00:50:56:00:c0:cf;
- fixed-address 10.228.192.207;
-}
-host spsb {
- hardware ethernet 00:50:56:00:c0:ce;
- fixed-address 10.228.192.206;
-}
-host tsmddtest {
- hardware ethernet 00:50:56:00:c0:cc;
- fixed-address 10.228.192.204;
-}
-host toolbox {
- hardware ethernet 00:50:56:00:c0:ca;
- fixed-address 10.228.192.202;
-}
-host spsbad {
- hardware ethernet 00:50:56:00:c0:bf;
- fixed-address 10.228.192.191;
-}
-host jenkinswin {
- hardware ethernet 00:50:56:00:c0:7b;
- fixed-address 10.228.192.123;
-}
-host mkbdarc2dev {
- hardware ethernet 00:50:56:00:c0:2c;
- fixed-address 10.228.192.44;
-}
-host blobtest {
- hardware ethernet 00:50:56:00:c0:28;
- fixed-address 10.228.192.40;
-}
-host rkdominoadmin {
- hardware ethernet 00:50:56:00:bf:01;
- fixed-address 10.228.191.1;
-}
-host rhgssn3 {
- hardware ethernet 00:50:56:00:bb:03;
- fixed-address 10.228.187.3;
-}
-host rhgssn2 {
- hardware ethernet 00:50:56:00:bb:02;
- fixed-address 10.228.187.2;
-}
-host rhgssn1 {
- hardware ethernet 00:50:56:00:bb:01;
- fixed-address 10.228.187.1;
-}
-host purebcw2k12 {
- hardware ethernet 00:50:56:00:a2:f2;
- fixed-address 10.228.162.242;
-}
-host purebcw2k08 {
- hardware ethernet 00:50:56:00:a2:ee;
- fixed-address 10.228.162.238;
-}
-host purebcw2k03 {
- hardware ethernet 00:50:56:00:a2:e9;
- fixed-address 10.228.162.233;
-}
-host purebcrhel7 {
- hardware ethernet 00:50:56:00:a2:bb;
- fixed-address 10.228.162.187;
-}
-host purebcrhel6 {
- hardware ethernet 00:50:56:00:a2:ba;
- fixed-address 10.228.162.186;
-}
-host purebcwdb2105 {
- hardware ethernet 00:50:56:00:a2:6a;
- fixed-address 10.228.162.106;
-}
-host purebcldb2105 {
- hardware ethernet 00:50:56:00:a2:69;
- fixed-address 10.228.162.105;
-}
-host purebcldb297 {
- hardware ethernet 00:50:56:00:a2:61;
- fixed-address 10.228.162.97;
-}
-host msexchange {
- hardware ethernet 00:50:56:00:95:f3;
- fixed-address 10.228.149.243;
-}
-host msptt4 {
- hardware ethernet 00:50:56:00:95:d4;
- fixed-address 10.228.149.212;
-}
-host msptt3 {
- hardware ethernet 00:50:56:00:95:d3;
- fixed-address 10.228.149.211;
-}
-host msptt2 {
- hardware ethernet 00:50:56:00:95:d2;
- fixed-address 10.228.149.210;
-}
-host msptt1 {
- hardware ethernet 00:50:56:00:95:d1;
- fixed-address 10.228.149.209;
-}
-host msfhblbtest2 {
- hardware ethernet 00:50:56:00:95:04;
- fixed-address 10.228.149.4;
-}
-host msfhblbtest1 {
- hardware ethernet 00:50:56:00:95:03;
- fixed-address 10.228.149.3;
-}
-host msflashtest {
- hardware ethernet 00:50:56:00:95:02;
- fixed-address 10.228.149.2;
-}
-host mstsmupgrade {
- hardware ethernet 00:50:56:00:95:01;
- fixed-address 10.228.149.1;
-}
-host svc {
- hardware ethernet 00:50:56:00:6d:fd;
- fixed-address 10.228.109.253;
-}
-host idm {
- hardware ethernet 00:50:56:00:6d:fc;
- fixed-address 10.228.109.252;
-}
-host vpn {
- hardware ethernet 00:50:56:00:6d:fb;
- fixed-address 10.228.109.251;
-}
-host store {
- hardware ethernet 00:50:56:00:6d:fa;
- fixed-address 10.228.109.250;
-}
-host tsm {
- hardware ethernet 00:50:56:00:6d:f9;
- fixed-address 10.228.109.249;
-}
-host winadk {
- hardware ethernet 00:50:56:00:6d:33;
- fixed-address 10.228.109.51;
-}
-host vcsa60 {
- hardware ethernet 00:50:56:00:5d:3c;
- fixed-address 10.228.93.60;
-}
-host vcsvr55 {
- hardware ethernet 00:50:56:00:5d:37;
- fixed-address 10.228.93.55;
-}
-host vhost2 {
- hardware ethernet e4:1f:13:bc:e0:d0;
- fixed-address 10.228.93.2;
-}
-host vhost1 {
- hardware ethernet e4:1f:13:bc:c3:20;
- fixed-address 10.228.93.1;
-}
-host svcb {
- hardware ethernet 00:50:56:00:5c:fd;
- fixed-address 10.228.92.253;
-}
-host fuonyffilenet {
- hardware ethernet 00:50:56:00:51:02;
- fixed-address 10.228.81.2;
-}
-host futmp {
- hardware ethernet 00:50:56:00:51:01;
- fixed-address 10.228.81.1;
-}
-host fsmq8004 {
- hardware ethernet 00:50:56:00:4f:54;
- fixed-address 10.228.79.84;
-}
-host frsppapp {
- hardware ethernet 00:50:56:00:4e:ce;
- fixed-address 10.228.78.206;
-}
-host frtsm71 {
- hardware ethernet 00:50:56:00:4e:47;
- fixed-address 10.228.78.71;
-}
-host fdic922bmc {
- hardware ethernet 08:94:ef:80:e5:57;
- fixed-address 10.228.64.92;
-}
-host dvredmine {
- hardware ethernet 00:50:56:00:3e:c1;
- fixed-address 10.228.62.193;
-}
-host dvedmstest {
- hardware ethernet 00:50:56:00:3e:46;
- fixed-address 10.228.62.70;
-}
-host dvaviglion {
- hardware ethernet 00:18:85:09:80:06;
- fixed-address 10.228.62.32;
-}
-host desktop-20 {
- hardware ethernet 00:50:56:00:3c:14;
- fixed-address 10.228.60.20;
-}
-host desktop-19 {
- hardware ethernet 00:50:56:00:3c:13;
- fixed-address 10.228.60.19;
-}
-host desktop-18 {
- hardware ethernet 00:50:56:00:3c:12;
- fixed-address 10.228.60.18;
-}
-host desktop-17 {
- hardware ethernet 00:50:56:00:3c:11;
- fixed-address 10.228.60.17;
-}
-host desktop-16 {
- hardware ethernet 00:50:56:00:3c:10;
- fixed-address 10.228.60.16;
-}
-host desktop-15 {
- hardware ethernet 00:50:56:00:3c:0f;
- fixed-address 10.228.60.15;
-}
-host desktop-14 {
- hardware ethernet 00:50:56:00:3c:0e;
- fixed-address 10.228.60.14;
-}
-host desktop-13 {
- hardware ethernet 00:50:56:00:3c:0d;
- fixed-address 10.228.60.13;
-}
-host desktop-12 {
- hardware ethernet 00:50:56:00:3c:0c;
- fixed-address 10.228.60.12;
-}
-host desktop-11 {
- hardware ethernet 00:50:56:00:3c:0b;
- fixed-address 10.228.60.11;
-}
-host desktop-10 {
- hardware ethernet 00:50:56:00:3c:0a;
- fixed-address 10.228.60.10;
-}
-host desktop-09 {
- hardware ethernet 00:50:56:00:3c:09;
- fixed-address 10.228.60.9;
-}
-host desktop-08 {
- hardware ethernet 00:50:56:00:3c:08;
- fixed-address 10.228.60.8;
-}
-host desktop-07 {
- hardware ethernet 00:50:56:00:3c:07;
- fixed-address 10.228.60.7;
-}
-host desktop-06 {
- hardware ethernet 00:50:56:00:3c:06;
- fixed-address 10.228.60.6;
-}
-host desktop-05 {
- hardware ethernet 00:50:56:00:3c:05;
- fixed-address 10.228.60.5;
-}
-host desktop-04 {
- hardware ethernet 00:50:56:00:3c:04;
- fixed-address 10.228.60.4;
-}
-host desktop-03 {
- hardware ethernet 00:50:56:00:3c:03;
- fixed-address 10.228.60.3;
-}
-host desktop-02 {
- hardware ethernet 00:50:56:00:3c:02;
- fixed-address 10.228.60.2;
-}
-host desktop-01 {
- hardware ethernet 00:50:56:00:3c:01;
- fixed-address 10.228.60.1;
-}
-host ads {
- hardware ethernet 00:50:56:00:2a:f6;
- fixed-address 10.228.42.246;
-}
-host spelive {
- hardware ethernet 00:50:56:00:2a:f5;
- fixed-address 10.228.42.245;
-}
-host datacap-rr {
- hardware ethernet 00:50:56:00:2a:ec;
- fixed-address 10.228.42.236;
-}
-host testcibod9 {
- hardware ethernet 00:50:56:00:2a:e7;
- fixed-address 10.228.42.231;
-}
-host rtc4 {
- hardware ethernet 00:50:56:00:2a:d0;
- fixed-address 10.228.42.208;
-}
-host vmbkp {
- hardware ethernet 00:50:56:00:2a:cf;
- fixed-address 10.228.42.207;
-}
-host mqsvr {
- hardware ethernet 00:50:56:00:2a:ce;
- fixed-address 10.228.42.206;
-}
-host mqback {
- hardware ethernet 00:50:56:00:2a:cd;
- fixed-address 10.228.42.205;
-}
-host mqfiles {
- hardware ethernet 00:50:56:00:2a:cc;
- fixed-address 10.228.42.204;
-}
-host azsamboki01 {
- hardware ethernet 00:50:56:00:2a:cb;
- fixed-address 10.228.42.203;
-}
-host csldallianz {
- hardware ethernet 00:50:56:00:2a:c2;
- fixed-address 10.228.42.194;
-}
-host tsmmon-p {
- hardware ethernet 00:50:56:00:2a:be;
- fixed-address 10.228.42.190;
-}
-host tsmmon-s {
- hardware ethernet 00:50:56:00:2a:bd;
- fixed-address 10.228.42.189;
-}
-host accounting {
- hardware ethernet 00:50:56:00:2a:bc;
- fixed-address 10.228.42.188;
-}
-host jenkinslnx {
- hardware ethernet 00:50:56:00:2a:b9;
- fixed-address 10.228.42.185;
-}
-host jenkinstst {
- hardware ethernet 00:50:56:00:2a:b8;
- fixed-address 10.228.42.184;
-}
-host ssam71 {
- hardware ethernet 00:50:56:00:2a:b4;
- fixed-address 10.228.42.180;
-}
-host azsssam {
- hardware ethernet 00:50:56:00:24:d1;
- fixed-address 10.228.36.209;
-}
-host azsssamdev {
- hardware ethernet 00:50:56:00:24:c2;
- fixed-address 10.228.36.194;
-}
-host azsnfs {
- hardware ethernet 00:50:56:00:24:92;
- fixed-address 10.228.36.146;
-}
-host azsgpfs2 {
- hardware ethernet 00:50:56:00:24:58;
- fixed-address 10.228.36.88;
-}
-host azsgpfs1 {
- hardware ethernet 00:50:56:00:24:57;
- fixed-address 10.228.36.87;
-}
-host cdvm {
- hardware ethernet 00:50:56:00:22:e9;
- fixed-address 10.228.34.233;
-}
-host cds822p4 {
- hardware ethernet 98:be:94:04:06:fb;
- fixed-address 10.228.34.25;
-}
-host cds822p3 {
- hardware ethernet 98:be:94:04:06:fa;
- fixed-address 10.228.34.24;
-}
-host cds822p2 {
- hardware ethernet 98:be:94:04:06:f9;
- fixed-address 10.228.34.23;
-}
-host cds822p1 {
- hardware ethernet 98:be:94:04:06:f8;
- fixed-address 10.228.34.22;
-}
-host cds822hmc2 {
- hardware ethernet 98:be:94:4c:5e:3f;
- fixed-address 10.228.34.2;
-}
-host cds822hmc1 {
- hardware ethernet 98:be:94:4c:5e:3e;
- fixed-address 10.228.34.1;
-}
-host akmacmini {
- hardware ethernet 10:dd:b1:b3:e3:ad;
- fixed-address 10.228.21.143;
-}
-host aiac922 {
- hardware ethernet 08:94:ef:80:21:3b;
- fixed-address 10.228.19.13;
-}
-host aiac922bmc {
- hardware ethernet 08:94:ef:80:21:3a;
- fixed-address 10.228.19.12;
-}
-host acubuntu14 {
- hardware ethernet 00:50:56:00:0d:0e;
- fixed-address 10.228.13.14;
-}
-host acopensuse11 {
- hardware ethernet 00:50:56:00:0d:0b;
- fixed-address 10.228.13.11;
-}
-host accentos5 {
- hardware ethernet 00:50:56:00:0d:05;
- fixed-address 10.228.13.5;
-}
-host zfvpn {
- hardware ethernet 00:50:56:00:0a:ec;
- fixed-address 10.228.10.236;
-}
-host zfmssql {
- hardware ethernet 00:50:56:00:0a:95;
- fixed-address 10.228.10.149;
-}
-host zfwin81 {
- hardware ethernet 00:50:56:00:0a:51;
- fixed-address 10.228.10.81;
-}
-host zfbldw2k08 {
- hardware ethernet 00:50:56:00:0a:1c;
- fixed-address 10.228.10.28;
-}
-host zfbldrhel7 {
- hardware ethernet 00:50:56:00:0a:1b;
- fixed-address 10.228.10.27;
-}
-host zfbldrhel6 {
- hardware ethernet 00:50:56:00:0a:1a;
- fixed-address 10.228.10.26;
-}
-host zfwin2k {
- hardware ethernet 00:50:56:00:0a:14;
- fixed-address 10.228.10.20;
-}
-host zfwin7 {
- hardware ethernet 00:50:56:00:0a:07;
- fixed-address 10.228.10.7;
-}
-host zfryzen {
- hardware ethernet 1c:1b:0d:e4:ed:c7;
- fixed-address 10.228.10.3;
-}
-# zfelleg (BLU R1 HD)
-host zfblu-r1-hd {
- hardware ethernet cc:79:4a:fe:58:8b;
- fixed-address 10.228.10.2;
-}
+++ /dev/null
-//
-// named.conf
-//
-
-options {
- directory "/var/named";
- dump-file "data/cache_dump.db";
- statistics-file "data/named_stats.txt";
- memstatistics-file "data/named_mem_stats.txt";
- secroots-file "data/named.secroots";
- recursing-file "data/named.recursing";
-
- listen-on port 53 { any; };
- listen-on-v6 port 53 { any; };
-
- allow-query { none; };
- allow-query-cache { none; };
- allow-recursion { none; };
-
- dnssec-validation yes;
-
- random-device "/dev/urandom";
-
- max-cache-size 64m;
-
- managed-keys-directory "/var/named/dynamic";
- geoip-directory "/usr/share/GeoIP";
-
- include "/etc/crypto-policies/back-ends/bind.config";
-};
-
-logging {
- channel default_debug {
- file "data/named.run" versions 3 size 5m;
- severity dynamic;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel client_channel {
- file "data/client.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel lame-servers_channel {
- file "data/lame-servers.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel notify_channel {
- file "data/notify.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel queries_channel {
- file "data/queries.log" versions 3 size 5m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel security_channel {
- file "data/security.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel xfer-in_channel {
- file "data/xfer-in.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- channel xfer-out_channel {
- file "data/xfer-out.log" versions 3 size 1m;
- severity info;
- print-category yes;
- print-severity yes;
- print-time yes;
- };
- category default {
- default_syslog;
- default_debug;
- };
- category client {
- client_channel;
- };
- category lame-servers {
- lame-servers_channel;
- };
- category notify {
- notify_channel;
- };
- category queries {
- queries_channel;
- };
- category security {
- security_channel;
- };
- category xfer-in {
- xfer-in_channel;
- };
- category xfer-out {
- xfer-out_channel;
- };
-};
-
-key "primary_ns-internal_ns" {
- algorithm hmac-sha256;
- secret "fjQyVn7bfGnbbBTgm7CgJSVOttSm9ji7WlVGVgV02Qo=";
-};
-
-acl internal_networks { 10.228.0.0/16; 192.168.42.0/24; 192.168.43.0/24; };
-acl vpn_client_network { 172.16.223.0/24; };
-acl primary_ns_key_acl { key "primary_ns-internal_ns"; };
-
-masters primary_ns_master { 10.228.109.174 key "primary_ns-internal_ns"; };
-
-server 10.228.109.174 { keys { "primary_ns-internal_ns"; }; };
-
-view "internal" {
- match-clients { internal_networks; vpn_client_network; localhost; };
-
- recursion yes;
-
- allow-query { internal_networks; vpn_client_network; localhost; };
- allow-query-cache { internal_networks; vpn_client_network; localhost; };
- allow-recursion { internal_networks; vpn_client_network; localhost; };
-
- allow-notify { primary_ns_key_acl; };
- notify no;
-
- include "/etc/named.rfc1912.zones";
-
- # internal zones
- zone "in.user.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/in.user.hu.zone";
- };
- zone "43.168.192.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/43.168.192.in-addr.arpa.zone";
- };
- zone "in.useribm.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/in.useribm.hu.zone";
- };
- zone "228.10.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/228.10.in-addr.arpa.zone";
- };
- zone "8.6.2.f.0.0.0.0.0.0.4.d.2.0.a.2.ip6.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/8.6.2.f.0.0.0.0.0.0.4.d.2.0.a.2.ip6.arpa.zone";
- };
- zone "mlx1.useribm.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/mlx1.useribm.hu.zone";
- };
- zone "131.16.172.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/131.16.172.in-addr.arpa.zone";
- };
- zone "mlx2.useribm.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/mlx2.useribm.hu.zone";
- };
- zone "132.16.172.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/132.16.172.in-addr.arpa.zone";
- };
- zone "sr.user.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/sr.user.hu.zone";
- };
- zone "42.168.192.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/42.168.192.in-addr.arpa.zone";
- };
- zone "usr.user.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/usr.user.hu.zone";
- };
-
- # perimeter zones
- zone "pm.useribm.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/pm.useribm.hu.zone";
- };
- zone "173.168.192.in-addr.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/173.168.192.in-addr.arpa.zone";
- };
- zone "d.a.2.f.0.0.0.0.0.0.4.d.2.0.a.2.ip6.arpa" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/d.a.2.f.0.0.0.0.0.0.4.d.2.0.a.2.ip6.arpa.zone";
- };
-
- # external zones
- zone "mediacube.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/mediacube.hu.zone.signed";
- };
- zone "useredms.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/useredms.hu.zone.signed";
- };
- zone "useribm.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/useribm.hu.zone.signed";
- };
- zone "userrendszerhaz.hu" IN {
- type slave;
- masters { primary_ns_master; };
- file "slaves/userrendszerhaz.hu.zone.signed";
- };
-};
+++ /dev/null
-# Global Postfix configuration file. This file lists only a subset
-# of all parameters. For the syntax, and for a complete parameter
-# list, see the postconf(5) manual page (command: "man 5 postconf").
-#
-# For common configuration examples, see BASIC_CONFIGURATION_README
-# and STANDARD_CONFIGURATION_README. To find these documents, use
-# the command "postconf html_directory readme_directory", or go to
-# http://www.postfix.org/BASIC_CONFIGURATION_README.html etc.
-#
-# For best results, change no more than 2-3 parameters at a time,
-# and test if Postfix still works after every change.
-
-# COMPATIBILITY
-#
-# The compatibility_level determines what default settings Postfix
-# will use for main.cf and master.cf settings. These defaults will
-# change over time.
-#
-# To avoid breaking things, Postfix will use backwards-compatible
-# default settings and log where it uses those old backwards-compatible
-# default settings, until the system administrator has determined
-# if any backwards-compatible default settings need to be made
-# permanent in main.cf or master.cf.
-#
-# When this review is complete, update the compatibility_level setting
-# below as recommended in the RELEASE_NOTES file.
-#
-# The level below is what should be used with new (not upgrade) installs.
-#
-compatibility_level = 2
-
-# SOFT BOUNCE
-#
-# The soft_bounce parameter provides a limited safety net for
-# testing. When soft_bounce is enabled, mail will remain queued that
-# would otherwise bounce. This parameter disables locally-generated
-# bounces, and prevents the SMTP server from rejecting mail permanently
-# (by changing 5xx replies into 4xx replies). However, soft_bounce
-# is no cure for address rewriting mistakes or mail routing mistakes.
-#
-#soft_bounce = no
-
-# LOCAL PATHNAME INFORMATION
-#
-# The queue_directory specifies the location of the Postfix queue.
-# This is also the root directory of Postfix daemons that run chrooted.
-# See the files in examples/chroot-setup for setting up Postfix chroot
-# environments on different UNIX systems.
-#
-queue_directory = /var/spool/postfix
-
-# The command_directory parameter specifies the location of all
-# postXXX commands.
-#
-command_directory = /usr/sbin
-
-# The daemon_directory parameter specifies the location of all Postfix
-# daemon programs (i.e. programs listed in the master.cf file). This
-# directory must be owned by root.
-#
-daemon_directory = /usr/libexec/postfix
-
-# The data_directory parameter specifies the location of Postfix-writable
-# data files (caches, random numbers). This directory must be owned
-# by the mail_owner account (see below).
-#
-data_directory = /var/lib/postfix
-
-# QUEUE AND PROCESS OWNERSHIP
-#
-# The mail_owner parameter specifies the owner of the Postfix queue
-# and of most Postfix daemon processes. Specify the name of a user
-# account THAT DOES NOT SHARE ITS USER OR GROUP ID WITH OTHER ACCOUNTS
-# AND THAT OWNS NO OTHER FILES OR PROCESSES ON THE SYSTEM. In
-# particular, don't specify nobody or daemon. PLEASE USE A DEDICATED
-# USER.
-#
-mail_owner = postfix
-
-# The default_privs parameter specifies the default rights used by
-# the local delivery agent for delivery to external file or command.
-# These rights are used in the absence of a recipient user context.
-# DO NOT SPECIFY A PRIVILEGED USER OR THE POSTFIX OWNER.
-#
-#default_privs = nobody
-
-# INTERNET HOST AND DOMAIN NAMES
-#
-# The myhostname parameter specifies the internet hostname of this
-# mail system. The default is to use the fully-qualified domain name
-# from gethostname(). $myhostname is used as a default value for many
-# other configuration parameters.
-#
-#myhostname = host.domain.tld
-#myhostname = virtual.domain.tld
-myhostname = mx.in.useribm.hu
-
-# The mydomain parameter specifies the local internet domain name.
-# The default is to use $myhostname minus the first component.
-# $mydomain is used as a default value for many other configuration
-# parameters.
-#
-#mydomain = domain.tld
-
-# SENDING MAIL
-#
-# The myorigin parameter specifies the domain that locally-posted
-# mail appears to come from. The default is to append $myhostname,
-# which is fine for small sites. If you run a domain with multiple
-# machines, you should (1) change this to $mydomain and (2) set up
-# a domain-wide alias database that aliases each user to
-# user@that.users.mailhost.
-#
-# For the sake of consistency between sender and recipient addresses,
-# myorigin also specifies the default domain name that is appended
-# to recipient addresses that have no @domain part.
-#
-#myorigin = $myhostname
-myorigin = $mydomain
-
-# RECEIVING MAIL
-
-# The inet_interfaces parameter specifies the network interface
-# addresses that this mail system receives mail on. By default,
-# the software claims all active interfaces on the machine. The
-# parameter also controls delivery of mail to user@[ip.address].
-#
-# See also the proxy_interfaces parameter, for network addresses that
-# are forwarded to us via a proxy or network address translator.
-#
-# Note: you need to stop/start Postfix when this parameter changes.
-#
-#inet_interfaces = all
-#inet_interfaces = $myhostname
-inet_interfaces = $myhostname, localhost
-#inet_interfaces = localhost
-
-# Enable IPv4, and IPv6 if supported
-inet_protocols = ipv4
-
-# The proxy_interfaces parameter specifies the network interface
-# addresses that this mail system receives mail on by way of a
-# proxy or network address translation unit. This setting extends
-# the address list specified with the inet_interfaces parameter.
-#
-# You must specify your proxy/NAT addresses when your system is a
-# backup MX host for other domains, otherwise mail delivery loops
-# will happen when the primary MX host is down.
-#
-#proxy_interfaces =
-#proxy_interfaces = 1.2.3.4
-
-# The mydestination parameter specifies the list of domains that this
-# machine considers itself the final destination for.
-#
-# These domains are routed to the delivery agent specified with the
-# local_transport parameter setting. By default, that is the UNIX
-# compatible delivery agent that lookups all recipients in /etc/passwd
-# and /etc/aliases or their equivalent.
-#
-# The default is $myhostname + localhost.$mydomain + localhost. On
-# a mail domain gateway, you should also include $mydomain.
-#
-# Do not specify the names of virtual domains - those domains are
-# specified elsewhere (see VIRTUAL_README).
-#
-# Do not specify the names of domains that this machine is backup MX
-# host for. Specify those names via the relay_domains settings for
-# the SMTP server, or use permit_mx_backup if you are lazy (see
-# STANDARD_CONFIGURATION_README).
-#
-# The local machine is always the final destination for mail addressed
-# to user@[the.net.work.address] of an interface that the mail system
-# receives mail on (see the inet_interfaces parameter).
-#
-# Specify a list of host or domain names, /file/name or type:table
-# patterns, separated by commas and/or whitespace. A /file/name
-# pattern is replaced by its contents; a type:table is matched when
-# a name matches a lookup key (the right-hand side is ignored).
-# Continue long lines by starting the next line with whitespace.
-#
-# See also below, section "REJECTING MAIL FOR UNKNOWN LOCAL USERS".
-#
-mydestination = $myhostname, localhost.$mydomain, localhost
-#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
-#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain,
-# mail.$mydomain, www.$mydomain, ftp.$mydomain
-
-# REJECTING MAIL FOR UNKNOWN LOCAL USERS
-#
-# The local_recipient_maps parameter specifies optional lookup tables
-# with all names or addresses of users that are local with respect
-# to $mydestination, $inet_interfaces or $proxy_interfaces.
-#
-# If this parameter is defined, then the SMTP server will reject
-# mail for unknown local users. This parameter is defined by default.
-#
-# To turn off local recipient checking in the SMTP server, specify
-# local_recipient_maps = (i.e. empty).
-#
-# The default setting assumes that you use the default Postfix local
-# delivery agent for local delivery. You need to update the
-# local_recipient_maps setting if:
-#
-# - You define $mydestination domain recipients in files other than
-# /etc/passwd, /etc/aliases, or the $virtual_alias_maps files.
-# For example, you define $mydestination domain recipients in
-# the $virtual_mailbox_maps files.
-#
-# - You redefine the local delivery agent in master.cf.
-#
-# - You redefine the "local_transport" setting in main.cf.
-#
-# - You use the "luser_relay", "mailbox_transport", or "fallback_transport"
-# feature of the Postfix local delivery agent (see local(8)).
-#
-# Details are described in the LOCAL_RECIPIENT_README file.
-#
-# Beware: if the Postfix SMTP server runs chrooted, you probably have
-# to access the passwd file via the proxymap service, in order to
-# overcome chroot restrictions. The alternative, having a copy of
-# the system passwd file in the chroot jail is just not practical.
-#
-# The right-hand side of the lookup tables is conveniently ignored.
-# In the left-hand side, specify a bare username, an @domain.tld
-# wild-card, or specify a user@domain.tld address.
-#
-#local_recipient_maps = unix:passwd.byname $alias_maps
-#local_recipient_maps = proxy:unix:passwd.byname $alias_maps
-#local_recipient_maps =
-
-# The unknown_local_recipient_reject_code specifies the SMTP server
-# response code when a recipient domain matches $mydestination or
-# ${proxy,inet}_interfaces, while $local_recipient_maps is non-empty
-# and the recipient address or address local-part is not found.
-#
-# The default setting is 550 (reject mail) but it is safer to start
-# with 450 (try again later) until you are certain that your
-# local_recipient_maps settings are OK.
-#
-unknown_local_recipient_reject_code = 550
-
-# TRUST AND RELAY CONTROL
-
-# The mynetworks parameter specifies the list of "trusted" SMTP
-# clients that have more privileges than "strangers".
-#
-# In particular, "trusted" SMTP clients are allowed to relay mail
-# through Postfix. See the smtpd_recipient_restrictions parameter
-# in postconf(5).
-#
-# You can specify the list of "trusted" network addresses by hand
-# or you can let Postfix do it for you (which is the default).
-#
-# By default (mynetworks_style = subnet), Postfix "trusts" SMTP
-# clients in the same IP subnetworks as the local machine.
-# On Linux, this does works correctly only with interfaces specified
-# with the "ifconfig" command.
-#
-# Specify "mynetworks_style = class" when Postfix should "trust" SMTP
-# clients in the same IP class A/B/C networks as the local machine.
-# Don't do this with a dialup site - it would cause Postfix to "trust"
-# your entire provider's network. Instead, specify an explicit
-# mynetworks list by hand, as described below.
-#
-# Specify "mynetworks_style = host" when Postfix should "trust"
-# only the local machine.
-#
-#mynetworks_style = class
-#mynetworks_style = subnet
-#mynetworks_style = host
-
-# Alternatively, you can specify the mynetworks list by hand, in
-# which case Postfix ignores the mynetworks_style setting.
-#
-# Specify an explicit list of network/netmask patterns, where the
-# mask specifies the number of bits in the network part of a host
-# address.
-#
-# You can also specify the absolute pathname of a pattern file instead
-# of listing the patterns here. Specify type:table for table-based lookups
-# (the value on the table right-hand side is not used).
-#
-#mynetworks = 168.100.189.0/28, 127.0.0.0/8
-#mynetworks = $config_directory/mynetworks
-#mynetworks = hash:/etc/postfix/network_table
-mynetworks = 10.228.0.0/16, 192.168.42.0/24, 192.168.43.0/24
-
-# The relay_domains parameter restricts what destinations this system will
-# relay mail to. See the smtpd_recipient_restrictions description in
-# postconf(5) for detailed information.
-#
-# By default, Postfix relays mail
-# - from "trusted" clients (IP address matches $mynetworks) to any destination,
-# - from "untrusted" clients to destinations that match $relay_domains or
-# subdomains thereof, except addresses with sender-specified routing.
-# The default relay_domains value is $mydestination.
-#
-# In addition to the above, the Postfix SMTP server by default accepts mail
-# that Postfix is final destination for:
-# - destinations that match $inet_interfaces or $proxy_interfaces,
-# - destinations that match $mydestination
-# - destinations that match $virtual_alias_domains,
-# - destinations that match $virtual_mailbox_domains.
-# These destinations do not need to be listed in $relay_domains.
-#
-# Specify a list of hosts or domains, /file/name patterns or type:name
-# lookup tables, separated by commas and/or whitespace. Continue
-# long lines by starting the next line with whitespace. A file name
-# is replaced by its contents; a type:name table is matched when a
-# (parent) domain appears as lookup key.
-#
-# NOTE: Postfix will not automatically forward mail for domains that
-# list this system as their primary or backup MX host. See the
-# permit_mx_backup restriction description in postconf(5).
-#
-#relay_domains = $mydestination
-
-# INTERNET OR INTRANET
-
-# The relayhost parameter specifies the default host to send mail to
-# when no entry is matched in the optional transport(5) table. When
-# no relayhost is given, mail is routed directly to the destination.
-#
-# On an intranet, specify the organizational domain name. If your
-# internal DNS uses no MX records, specify the name of the intranet
-# gateway host instead.
-#
-# In the case of SMTP, specify a domain, host, host:port, [host]:port,
-# [address] or [address]:port; the form [host] turns off MX lookups.
-#
-# If you're connected via UUCP, see also the default_transport parameter.
-#
-#relayhost = $mydomain
-#relayhost = [gateway.my.domain]
-#relayhost = [mailserver.isp.tld]
-#relayhost = uucphost
-#relayhost = [an.ip.add.ress]
-
-# REJECTING UNKNOWN RELAY USERS
-#
-# The relay_recipient_maps parameter specifies optional lookup tables
-# with all addresses in the domains that match $relay_domains.
-#
-# If this parameter is defined, then the SMTP server will reject
-# mail for unknown relay users. This feature is off by default.
-#
-# The right-hand side of the lookup tables is conveniently ignored.
-# In the left-hand side, specify an @domain.tld wild-card, or specify
-# a user@domain.tld address.
-#
-#relay_recipient_maps = hash:/etc/postfix/relay_recipients
-
-# INPUT RATE CONTROL
-#
-# The in_flow_delay configuration parameter implements mail input
-# flow control. This feature is turned on by default, although it
-# still needs further development (it's disabled on SCO UNIX due
-# to an SCO bug).
-#
-# A Postfix process will pause for $in_flow_delay seconds before
-# accepting a new message, when the message arrival rate exceeds the
-# message delivery rate. With the default 100 SMTP server process
-# limit, this limits the mail inflow to 100 messages a second more
-# than the number of messages delivered per second.
-#
-# Specify 0 to disable the feature. Valid delays are 0..10.
-#
-#in_flow_delay = 1s
-
-# ADDRESS REWRITING
-#
-# The ADDRESS_REWRITING_README document gives information about
-# address masquerading or other forms of address rewriting including
-# username->Firstname.Lastname mapping.
-
-# ADDRESS REDIRECTION (VIRTUAL DOMAIN)
-#
-# The VIRTUAL_README document gives information about the many forms
-# of domain hosting that Postfix supports.
-
-# "USER HAS MOVED" BOUNCE MESSAGES
-#
-# See the discussion in the ADDRESS_REWRITING_README document.
-
-# TRANSPORT MAP
-#
-# See the discussion in the ADDRESS_REWRITING_README document.
-
-# ALIAS DATABASE
-#
-# The alias_maps parameter specifies the list of alias databases used
-# by the local delivery agent. The default list is system dependent.
-#
-# On systems with NIS, the default is to search the local alias
-# database, then the NIS alias database. See aliases(5) for syntax
-# details.
-#
-# If you change the alias database, run "postalias /etc/aliases" (or
-# wherever your system stores the mail alias file), or simply run
-# "newaliases" to build the necessary DBM or DB file.
-#
-# It will take a minute or so before changes become visible. Use
-# "postfix reload" to eliminate the delay.
-#
-#alias_maps = dbm:/etc/aliases
-alias_maps = hash:/etc/aliases
-#alias_maps = hash:/etc/aliases, nis:mail.aliases
-#alias_maps = netinfo:/aliases
-
-# The alias_database parameter specifies the alias database(s) that
-# are built with "newaliases" or "sendmail -bi". This is a separate
-# configuration parameter, because alias_maps (see above) may specify
-# tables that are not necessarily all under control by Postfix.
-#
-#alias_database = dbm:/etc/aliases
-#alias_database = dbm:/etc/mail/aliases
-alias_database = hash:/etc/aliases
-#alias_database = hash:/etc/aliases, hash:/opt/majordomo/aliases
-
-# ADDRESS EXTENSIONS (e.g., user+foo)
-#
-# The recipient_delimiter parameter specifies the separator between
-# user names and address extensions (user+foo). See canonical(5),
-# local(8), relocated(5) and virtual(5) for the effects this has on
-# aliases, canonical, virtual, relocated and .forward file lookups.
-# Basically, the software tries user+foo and .forward+foo before
-# trying user and .forward.
-#
-#recipient_delimiter = +
-
-# DELIVERY TO MAILBOX
-#
-# The home_mailbox parameter specifies the optional pathname of a
-# mailbox file relative to a user's home directory. The default
-# mailbox file is /var/spool/mail/user or /var/mail/user. Specify
-# "Maildir/" for qmail-style delivery (the / is required).
-#
-#home_mailbox = Mailbox
-#home_mailbox = Maildir/
-
-# The mail_spool_directory parameter specifies the directory where
-# UNIX-style mailboxes are kept. The default setting depends on the
-# system type.
-#
-#mail_spool_directory = /var/mail
-#mail_spool_directory = /var/spool/mail
-
-# The mailbox_command parameter specifies the optional external
-# command to use instead of mailbox delivery. The command is run as
-# the recipient with proper HOME, SHELL and LOGNAME environment settings.
-# Exception: delivery for root is done as $default_user.
-#
-# Other environment variables of interest: USER (recipient username),
-# EXTENSION (address extension), DOMAIN (domain part of address),
-# and LOCAL (the address localpart).
-#
-# Unlike other Postfix configuration parameters, the mailbox_command
-# parameter is not subjected to $parameter substitutions. This is to
-# make it easier to specify shell syntax (see example below).
-#
-# Avoid shell meta characters because they will force Postfix to run
-# an expensive shell process. Procmail alone is expensive enough.
-#
-# IF YOU USE THIS TO DELIVER MAIL SYSTEM-WIDE, YOU MUST SET UP AN
-# ALIAS THAT FORWARDS MAIL FOR ROOT TO A REAL USER.
-#
-#mailbox_command = /some/where/procmail
-#mailbox_command = /some/where/procmail -a "$EXTENSION"
-
-# The mailbox_transport specifies the optional transport in master.cf
-# to use after processing aliases and .forward files. This parameter
-# has precedence over the mailbox_command, fallback_transport and
-# luser_relay parameters.
-#
-# Specify a string of the form transport:nexthop, where transport is
-# the name of a mail delivery transport defined in master.cf. The
-# :nexthop part is optional. For more details see the sample transport
-# configuration file.
-#
-# NOTE: if you use this feature for accounts not in the UNIX password
-# file, then you must update the "local_recipient_maps" setting in
-# the main.cf file, otherwise the SMTP server will reject mail for
-# non-UNIX accounts with "User unknown in local recipient table".
-#
-# Cyrus IMAP over LMTP. Specify ``lmtpunix cmd="lmtpd"
-# listen="/var/imap/socket/lmtp" prefork=0'' in cyrus.conf.
-#mailbox_transport = lmtp:unix:/var/lib/imap/socket/lmtp
-
-# If using the cyrus-imapd IMAP server deliver local mail to the IMAP
-# server using LMTP (Local Mail Transport Protocol), this is prefered
-# over the older cyrus deliver program by setting the
-# mailbox_transport as below:
-#
-# mailbox_transport = lmtp:unix:/var/lib/imap/socket/lmtp
-#
-# The efficiency of LMTP delivery for cyrus-imapd can be enhanced via
-# these settings.
-#
-# local_destination_recipient_limit = 300
-# local_destination_concurrency_limit = 5
-#
-# Of course you should adjust these settings as appropriate for the
-# capacity of the hardware you are using. The recipient limit setting
-# can be used to take advantage of the single instance message store
-# capability of Cyrus. The concurrency limit can be used to control
-# how many simultaneous LMTP sessions will be permitted to the Cyrus
-# message store.
-#
-# Cyrus IMAP via command line. Uncomment the "cyrus...pipe" and
-# subsequent line in master.cf.
-#mailbox_transport = cyrus
-
-# The fallback_transport specifies the optional transport in master.cf
-# to use for recipients that are not found in the UNIX passwd database.
-# This parameter has precedence over the luser_relay parameter.
-#
-# Specify a string of the form transport:nexthop, where transport is
-# the name of a mail delivery transport defined in master.cf. The
-# :nexthop part is optional. For more details see the sample transport
-# configuration file.
-#
-# NOTE: if you use this feature for accounts not in the UNIX password
-# file, then you must update the "local_recipient_maps" setting in
-# the main.cf file, otherwise the SMTP server will reject mail for
-# non-UNIX accounts with "User unknown in local recipient table".
-#
-#fallback_transport = lmtp:unix:/var/lib/imap/socket/lmtp
-#fallback_transport =
-
-# The luser_relay parameter specifies an optional destination address
-# for unknown recipients. By default, mail for unknown@$mydestination,
-# unknown@[$inet_interfaces] or unknown@[$proxy_interfaces] is returned
-# as undeliverable.
-#
-# The following expansions are done on luser_relay: $user (recipient
-# username), $shell (recipient shell), $home (recipient home directory),
-# $recipient (full recipient address), $extension (recipient address
-# extension), $domain (recipient domain), $local (entire recipient
-# localpart), $recipient_delimiter. Specify ${name?value} or
-# ${name:value} to expand value only when $name does (does not) exist.
-#
-# luser_relay works only for the default Postfix local delivery agent.
-#
-# NOTE: if you use this feature for accounts not in the UNIX password
-# file, then you must specify "local_recipient_maps =" (i.e. empty) in
-# the main.cf file, otherwise the SMTP server will reject mail for
-# non-UNIX accounts with "User unknown in local recipient table".
-#
-#luser_relay = $user@other.host
-#luser_relay = $local@other.host
-#luser_relay = admin+$local
-
-# JUNK MAIL CONTROLS
-#
-# The controls listed here are only a very small subset. The file
-# SMTPD_ACCESS_README provides an overview.
-
-# The header_checks parameter specifies an optional table with patterns
-# that each logical message header is matched against, including
-# headers that span multiple physical lines.
-#
-# By default, these patterns also apply to MIME headers and to the
-# headers of attached messages. With older Postfix versions, MIME and
-# attached message headers were treated as body text.
-#
-# For details, see "man header_checks".
-#
-#header_checks = regexp:/etc/postfix/header_checks
-
-# FAST ETRN SERVICE
-#
-# Postfix maintains per-destination logfiles with information about
-# deferred mail, so that mail can be flushed quickly with the SMTP
-# "ETRN domain.tld" command, or by executing "sendmail -qRdomain.tld".
-# See the ETRN_README document for a detailed description.
-#
-# The fast_flush_domains parameter controls what destinations are
-# eligible for this service. By default, they are all domains that
-# this server is willing to relay mail to.
-#
-#fast_flush_domains = $relay_domains
-
-# SHOW SOFTWARE VERSION OR NOT
-#
-# The smtpd_banner parameter specifies the text that follows the 220
-# code in the SMTP server's greeting banner. Some people like to see
-# the mail version advertised. By default, Postfix shows no version.
-#
-# You MUST specify $myhostname at the start of the text. That is an
-# RFC requirement. Postfix itself does not care.
-#
-#smtpd_banner = $myhostname ESMTP $mail_name
-#smtpd_banner = $myhostname ESMTP $mail_name ($mail_version)
-
-# PARALLEL DELIVERY TO THE SAME DESTINATION
-#
-# How many parallel deliveries to the same user or domain? With local
-# delivery, it does not make sense to do massively parallel delivery
-# to the same user, because mailbox updates must happen sequentially,
-# and expensive pipelines in .forward files can cause disasters when
-# too many are run at the same time. With SMTP deliveries, 10
-# simultaneous connections to the same domain could be sufficient to
-# raise eyebrows.
-#
-# Each message delivery transport has its XXX_destination_concurrency_limit
-# parameter. The default is $default_destination_concurrency_limit for
-# most delivery transports. For the local delivery agent the default is 2.
-
-#local_destination_concurrency_limit = 2
-#default_destination_concurrency_limit = 20
-
-# DEBUGGING CONTROL
-#
-# The debug_peer_level parameter specifies the increment in verbose
-# logging level when an SMTP client or server host name or address
-# matches a pattern in the debug_peer_list parameter.
-#
-debug_peer_level = 2
-
-# The debug_peer_list parameter specifies an optional list of domain
-# or network patterns, /file/name patterns or type:name tables. When
-# an SMTP client or server host name or address matches a pattern,
-# increase the verbose logging level by the amount specified in the
-# debug_peer_level parameter.
-#
-#debug_peer_list = 127.0.0.1
-#debug_peer_list = some.domain
-
-# The debugger_command specifies the external command that is executed
-# when a Postfix daemon program is run with the -D option.
-#
-# Use "command .. & sleep 5" so that the debugger can attach before
-# the process marches on. If you use an X-based debugger, be sure to
-# set up your XAUTHORITY environment variable before starting Postfix.
-#
-debugger_command =
- PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
- ddd $daemon_directory/$process_name $process_id & sleep 5
-
-# If you can't use X, use this to capture the call stack when a
-# daemon crashes. The result is in a file in the configuration
-# directory, and is named after the process name and the process ID.
-#
-# debugger_command =
-# PATH=/bin:/usr/bin:/usr/local/bin; export PATH; (echo cont;
-# echo where) | gdb $daemon_directory/$process_name $process_id 2>&1
-# >$config_directory/$process_name.$process_id.log & sleep 5
-#
-# Another possibility is to run gdb under a detached screen session.
-# To attach to the screen sesssion, su root and run "screen -r
-# <id_string>" where <id_string> uniquely matches one of the detached
-# sessions (from "screen -list").
-#
-# debugger_command =
-# PATH=/bin:/usr/bin:/sbin:/usr/sbin; export PATH; screen
-# -dmS $process_name gdb $daemon_directory/$process_name
-# $process_id & sleep 1
-
-# INSTALL-TIME CONFIGURATION INFORMATION
-#
-# The following parameters are used when installing a new Postfix version.
-#
-# sendmail_path: The full pathname of the Postfix sendmail command.
-# This is the Sendmail-compatible mail posting interface.
-#
-sendmail_path = /usr/sbin/sendmail.postfix
-
-# newaliases_path: The full pathname of the Postfix newaliases command.
-# This is the Sendmail-compatible command to build alias databases.
-#
-newaliases_path = /usr/bin/newaliases.postfix
-
-# mailq_path: The full pathname of the Postfix mailq command. This
-# is the Sendmail-compatible mail queue listing command.
-#
-mailq_path = /usr/bin/mailq.postfix
-
-# setgid_group: The group for mail submission and queue management
-# commands. This must be a group name with a numerical group ID that
-# is not shared with other accounts, not even with the Postfix account.
-#
-setgid_group = postdrop
-
-# html_directory: The location of the Postfix HTML documentation.
-#
-html_directory = no
-
-# manpage_directory: The location of the Postfix on-line manual pages.
-#
-manpage_directory = /usr/share/man
-
-# sample_directory: The location of the Postfix sample configuration files.
-# This parameter is obsolete as of Postfix 2.1.
-#
-sample_directory = /usr/share/doc/postfix/samples
-
-# readme_directory: The location of the Postfix README files.
-#
-readme_directory = /usr/share/doc/postfix/README_FILES
-meta_directory = /etc/postfix
-shlib_directory = /usr/lib64/postfix
-
-message_size_limit = 67108864
https://git.useribm.hu / user-lxc.git / commitdiff