Provide documenation
This commit is contained in:
Raphael Dannecker
parent
f1cb7486a5
commit
e8ef744f59
3 changed files with 258 additions and 0 deletions
27
doc/exam_mode.md
Normal file
27
doc/exam_mode.md
Normal file
|
|
@ -0,0 +1,27 @@
|
||||||
|
# exam_mode
|
||||||
|
|
||||||
|
## Description / use cases
|
||||||
|
|
||||||
|
Activating exam_mode provides following functionalities:
|
||||||
|
* when -exam user logs in, firewalld.service will start and prevent communication between devices in the same local network
|
||||||
|
* home- and media-directory of -exam users will be renamed (on the next day) and removed (after some days).\
|
||||||
|
This is important due the fact, that -exam user will be new created (with new user-id) on exam-mode initialisation.\
|
||||||
|
Without renaming/deleting the home- and media-directory, the -exam user couldn't log in twice on the same pc.\
|
||||||
|
Particularly important on machines with localhome
|
||||||
|
|
||||||
|
## Requirements
|
||||||
|
|
||||||
|
none
|
||||||
|
|
||||||
|
## Example
|
||||||
|
|
||||||
|
Per default, all hosts will get exam_mode. But we don't want exam_mode on teacher devices
|
||||||
|
|
||||||
|
inventory.yml
|
||||||
|
```
|
||||||
|
teacherdevices:
|
||||||
|
hosts:
|
||||||
|
10.0.14.[1..75]
|
||||||
|
vars:
|
||||||
|
exam_mode: false
|
||||||
|
```
|
||||||
45
doc/vm_support.md
Normal file
45
doc/vm_support.md
Normal file
|
|
@ -0,0 +1,45 @@
|
||||||
|
# VM support
|
||||||
|
|
||||||
|
lmn_client provides scripts to
|
||||||
|
* create
|
||||||
|
* modify
|
||||||
|
* distribute
|
||||||
|
* run
|
||||||
|
|
||||||
|
VMs based on Qemu/KVM in school network.
|
||||||
|
|
||||||
|
## Requirements
|
||||||
|
|
||||||
|
* For distribution of VMs, you have to run a `seedbox` with aria2 server (torrent server).\
|
||||||
|
Repository with ansible-playbook for seedbox install: https://codeberg.org/digitalsouveraeneschule/...
|
||||||
|
* `seedbox`-hostname must be resolvable via DNS
|
||||||
|
|
||||||
|
## Activation / Default
|
||||||
|
|
||||||
|
### To enable VM support:
|
||||||
|
|
||||||
|
```
|
||||||
|
vm_support: true
|
||||||
|
```
|
||||||
|
|
||||||
|
Default: `vm_support: false
|
||||||
|
|
||||||
|
### Torrent Server
|
||||||
|
```
|
||||||
|
torrent_srv: "myseedbox.linuxmuster.net"
|
||||||
|
```
|
||||||
|
|
||||||
|
Default: `torrent_srv: "seedbox.{{ domain }}"`
|
||||||
|
|
||||||
|
|
||||||
|
## Example
|
||||||
|
|
||||||
|
Enable VM support on all clients.
|
||||||
|
|
||||||
|
inventory.yml
|
||||||
|
```
|
||||||
|
all:
|
||||||
|
vars:
|
||||||
|
vm_support: true
|
||||||
|
torrent_srv: "myseedbox.linuxmuster.net" # default: seedbox.{{ domain }}
|
||||||
|
```
|
||||||
186
doc/wlan.md
Normal file
186
doc/wlan.md
Normal file
|
|
@ -0,0 +1,186 @@
|
||||||
|
# WLAN support
|
||||||
|
|
||||||
|
Supported modes authenticating via WLAN:
|
||||||
|
|
||||||
|
* **WPA-Personal** (WPA-PSK)\
|
||||||
|
authentication via preshared key (psk)
|
||||||
|
* **WPA-Enterprise** (WPA-802.1x) with **EAP-TLS**\
|
||||||
|
authentication via client certificates (eap-tls)
|
||||||
|
|
||||||
|
Which method is used is determined by the variable `wlan`
|
||||||
|
|
||||||
|
Choices:
|
||||||
|
* `"none"` <- (default)
|
||||||
|
* `"psk"`
|
||||||
|
* `"eap-tls"`
|
||||||
|
|
||||||
|
## WPA-Personal
|
||||||
|
|
||||||
|
### Requirements
|
||||||
|
|
||||||
|
WLAN with configured WPA-Personal (WPA-PSK)
|
||||||
|
|
||||||
|
### Configuration / Variables
|
||||||
|
|
||||||
|
* **wlan**
|
||||||
|
Authentication mode
|
||||||
|
Type: *String*
|
||||||
|
Values:
|
||||||
|
* "none" <-- (default)
|
||||||
|
* "psk" <-- set to use WPA-Personal
|
||||||
|
* "eap-tls"
|
||||||
|
* **wlan_ssid**
|
||||||
|
SSID of used WLAN
|
||||||
|
Type: *String*
|
||||||
|
* **wlan_password**
|
||||||
|
Password of WLAN. Only for `wlan: "psk"`
|
||||||
|
Type: *String*
|
||||||
|
|
||||||
|
### Examples
|
||||||
|
|
||||||
|
#### One class of devices with wlan access
|
||||||
|
|
||||||
|
inventory.yml
|
||||||
|
```yaml
|
||||||
|
laptop:
|
||||||
|
hosts:
|
||||||
|
10.0.13.[1-28]:
|
||||||
|
vars:
|
||||||
|
wlan: "psk"
|
||||||
|
wlan_ssid: "devicesPSK"
|
||||||
|
wlan_password: "topsecretpasswd"
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Two device classes with different wlan access
|
||||||
|
|
||||||
|
inventory.yml
|
||||||
|
```yaml
|
||||||
|
laptop_students:
|
||||||
|
hosts:
|
||||||
|
10.0.13.[1-28]:
|
||||||
|
vars:
|
||||||
|
wlan: "psk"
|
||||||
|
wlan_ssid: "Students"
|
||||||
|
wlan_password: "topsecretpasswd1"
|
||||||
|
laptop_teachers:
|
||||||
|
hosts:
|
||||||
|
10.0.23.[1-82]:
|
||||||
|
vars:
|
||||||
|
wlan: "psk"
|
||||||
|
wlan_ssid: "Teachers"
|
||||||
|
wlan_password: "topsecretpasswd2"
|
||||||
|
```
|
||||||
|
|
||||||
|
## WPA-Enterprise with EAP-TLS
|
||||||
|
|
||||||
|
Authentication is based on individual certificates, which will be automaticaly created on the radius server.
|
||||||
|
Every devices gets his own certificate. When creating new certificates, the old one will be revoked.
|
||||||
|
|
||||||
|
### Requirements
|
||||||
|
|
||||||
|
* You need to run a freeradius server. For installation see https://codeberg....
|
||||||
|
* The user, running this playbook, must have access to the radius-Server via ssh.
|
||||||
|
|
||||||
|
### Configuration / Variables
|
||||||
|
|
||||||
|
* **wlan**
|
||||||
|
Authentication mode
|
||||||
|
Type: *String*
|
||||||
|
Values:
|
||||||
|
* "none" <-- (default)
|
||||||
|
* "psk"
|
||||||
|
* "eap-tls" <-- set to use WPA Enterprise with EAP-TLS
|
||||||
|
* **wlan_ssid**
|
||||||
|
SSID of used WLAN
|
||||||
|
Type: *String*
|
||||||
|
* **wlan_eap_ca**
|
||||||
|
CA data for certs and crl
|
||||||
|
Type: *Dictionary of Strings*
|
||||||
|
Keys:
|
||||||
|
* C <-- default: "DE"
|
||||||
|
* ST <-- default: "Baden-Wuerttemberg"
|
||||||
|
* L <-- default: "Reutlingen"
|
||||||
|
* O <-- default: "Linuxschule"
|
||||||
|
* emailAddress <-- default: "admin@example.com"
|
||||||
|
* CN <-- default: "Radius Certificate Authority"
|
||||||
|
* password <-- default: "OtherVerySecurePassw0rd"
|
||||||
|
* **wlan_force_issue**
|
||||||
|
Force to issue a new certificate
|
||||||
|
Only for `wlan: "eap-tls"`
|
||||||
|
Type: *Bolean*
|
||||||
|
Values:
|
||||||
|
* true
|
||||||
|
* false <-- (default)
|
||||||
|
|
||||||
|
### Examples
|
||||||
|
|
||||||
|
inventory.yml:
|
||||||
|
```yaml
|
||||||
|
infrastructure:
|
||||||
|
hosts:
|
||||||
|
radius_server:
|
||||||
|
ansible_host: 10.0.0.15
|
||||||
|
ansible_user: ansible
|
||||||
|
laptop:
|
||||||
|
vars:
|
||||||
|
wlan: "eap-tls"
|
||||||
|
wlan_ssid: "devices8021x"
|
||||||
|
wlan_eap_ca:
|
||||||
|
C: "DE"
|
||||||
|
ST: "Baden-Wuerttemberg"
|
||||||
|
L: "Reutlingen"
|
||||||
|
O: "Linuxschule"
|
||||||
|
emailAddress: "admin@example.com"
|
||||||
|
CN: "Radius Certificate Authority"
|
||||||
|
password: "secret4radiusCA"
|
||||||
|
```
|
||||||
|
|
||||||
|
## complex example with both modes
|
||||||
|
|
||||||
|
We have three groups of devices (one with psk, two with eap-tls):
|
||||||
|
|
||||||
|
inventory.yml
|
||||||
|
```yaml
|
||||||
|
all:
|
||||||
|
vars:
|
||||||
|
wlan_ssid: "WLAName" # teacher and staff are using the same ssid
|
||||||
|
radiusca_password: "secret4radiusCA"
|
||||||
|
country_name: "DE"
|
||||||
|
state_or_province_name: "Baden-Württemberg"
|
||||||
|
locality_name: "Stuttgart"
|
||||||
|
organization_name: "Baumschule"
|
||||||
|
admin_email: "admin@example.com"
|
||||||
|
|
||||||
|
infrastructure:
|
||||||
|
hosts:
|
||||||
|
radius_server:
|
||||||
|
ansible_host: 10.0.0.15
|
||||||
|
ansible_user: ansible
|
||||||
|
|
||||||
|
laptop_students:
|
||||||
|
hosts:
|
||||||
|
10.0.13.[1-28]:
|
||||||
|
vars:
|
||||||
|
wlan: "psk"
|
||||||
|
wlan_ssid: "Students" # ssid "WLAN" from group "all" will be overwritten
|
||||||
|
wlan_password: "topsecretpasswd"
|
||||||
|
laptop_teachers:
|
||||||
|
hosts:
|
||||||
|
10.0.23.[1-82]:
|
||||||
|
vars:
|
||||||
|
wlan: "eap-tls"
|
||||||
|
laptop_staff:
|
||||||
|
hosts:
|
||||||
|
10.0.61.[1-20]:
|
||||||
|
vars:
|
||||||
|
wlan: "eap-tls"
|
||||||
|
```
|
||||||
|
|
||||||
|
## example: Force issue of new certs
|
||||||
|
|
||||||
|
The issue of certificates can be forced.
|
||||||
|
|
||||||
|
Force issue of new certs for hosts in group laptop_teacher.
|
||||||
|
If there is a valid certificate, the old one will be revoked and a new certificate will be issued.
|
||||||
|
|
||||||
|
ansible-playbook -i myinventory.yml -l laptop_teachers lmn-client.yml -e "wlan_force_issue=true"
|
||||||
Loading…
Add table
Reference in a new issue