Skip to content

Commit 2efb7e7

Browse files
jaymzhfacebook-github-bot
jaymzh
authored and
facebook-github-bot
committed
new cookbook: fb_sasl (facebook#284)
Summary: A pretty simple cookbook to setup SASL. Signed-off-by: Phil Dibowitz <phil@ipom.com> Pull Request resolved: facebook#284 Differential Revision: D70207096 fbshipit-source-id: 96d065d461c4c80c14163adac8d07b6bf476ca45
1 parent f414f45 commit 2efb7e7

File tree

7 files changed

+198
-0
lines changed

7 files changed

+198
-0
lines changed

‎cookbooks/fb_sasl/README.md‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
fb_sasl Cookbook
2+
================
3+
4+
Requirements
5+
------------
6+
7+
Attributes
8+
----------
9+
* node['fb_sasl']['enable_saslauthd']
10+
* node['fb_sasl']['manage_packages']
11+
* node['fb_sasl']['modules']
12+
* node['fb_sasl']['sysconfig']
13+
14+
Usage
15+
-----
16+
17+
### Packages
18+
19+
By default, this cookbook will install relevant SASL packages. To disable this,
20+
set `node['fb_sasl']['enable_saslauthd']` to `false`.
21+
22+
By default this cookbook installs on the basic SASL package for your distro. If
23+
you need additional modules, you can add them to `node['fb_sasl']['modules']`
24+
and the additional packages will be installed. Note that this configuration is
25+
used to build the package name, so it may be distribution dependent. Here's an
26+
example:
27+
28+
```ruby
29+
node.default['fb_sasl']['modules'] << 'ldap'
30+
```
31+
32+
This will add `libsasl2-modules-ldap` to the list of packages to install on
33+
Debian-like distros while on Fedora-like distros it'll add `cyrus-sasl-ldap`.
34+
35+
### saslauthd
36+
37+
Most simple configurations do not require running `saslauthd`, and as such, the
38+
default in this cookbook is to disable it. You can enable it by setting
39+
`node['fb_sasl']['enable_saslauthd']` to `true`.
40+
41+
Note that while Debian-like distros have support for running multiple
42+
instances, this cookbook does not support such a configuration. Only the
43+
default single-instance is supported by this cookbook.
44+
45+
### sysconfig
46+
47+
`saslauthd` does not have a configuration file and it's configuration is
48+
specified by options passed to it, and those options are controlled in the
49+
sysconfig file.
50+
51+
You can specify the various configs via `node['fb_sasl']['sysconfig']`, but you
52+
should check the documentation for your distro, as they options are different,
53+
for example, `mech` vs. `mechanism`. We have provided appropriate defaults that
54+
are valid for each distro.
55+
56+
There are two important things to remember about setting `sysconfig`:
57+
58+
* Use **lowercase** for the keys. We will upcase them when we generate the
59+
file, but using all lowercase ensures no conflicts.
60+
* Do **not** specify `start` (for those of you on Debian-like distros). We
61+
will set this based on `node['fb_sasl']['enable_saslauthd']`.

‎cookbooks/fb_sasl/attributes/default.rb‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
#
2+
# vim: syntax=ruby:expandtab:shiftwidth=2:softtabstop=2:tabstop=2
3+
#
4+
# Copyright (c) 2025-present, Meta Platforms, Inc.
5+
# Copyright (c) 2025-present, Phil Dibowitz
6+
# All rights reserved.
7+
#
8+
# Licensed under the Apache License, Version 2.0 (the "License");
9+
# you may not use this file except in compliance with the License.
10+
# You may obtain a copy of the License at
11+
#
12+
# http://www.apache.org/licenses/LICENSE-2.0
13+
#
14+
# Unless required by applicable law or agreed to in writing, software
15+
# distributed under the License is distributed on an "AS IS" BASIS,
16+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17+
# See the License for the specific language governing permissions and
18+
# limitations under the License.
19+
#
20+
21+
# because the attributes file is consumed in the node context,
22+
# 'debian?' will be fb_helper's node.debian? which is not what we
23+
# want, so specify full path
24+
if fedora_derived?
25+
sysconfig = {
26+
'socketdir' => '/run/saslauthd',
27+
'mech' => 'pam',
28+
'flags' => '',
29+
}
30+
elsif ChefUtils.debian?
31+
sysconfig = {
32+
'desc' => 'SASL Authentication Daemon',
33+
'name' => 'saslauthd',
34+
'mechanisms' => 'pam',
35+
'mech_options' => '',
36+
'threads' => 5,
37+
'options' => '-c -m /var/run/saslauthd',
38+
}
39+
else
40+
fail "fb_sasl: Unknown platform_family: #{node['platform_family']}"
41+
end
42+
43+
default['fb_sasl'] = {
44+
'manage_packages' => true,
45+
'modules' => [],
46+
'enable_saslauthd' => false,
47+
'sysconfig' => sysconfig,
48+
}

‎cookbooks/fb_sasl/metadata.rb‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
name 'fb_sasl'
2+
maintainer 'Meta Platforms, Inc.'
3+
maintainer_email 'noreply@meta.com'
4+
license 'Apache-2.0'
5+
description 'Installs/Configures Cyrus SASL'
6+
version '0.1.0'

‎cookbooks/fb_sasl/recipes/default.rb‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
#
2+
# Cookbook:: fb_sasl
3+
# Recipe:: default
4+
#
5+
# Copyright (c) 2025-present, Meta Platforms, Inc.
6+
# Copyright (c) 2025-present, Phil Dibowitz
7+
# All rights reserved.
8+
#
9+
# Licensed under the Apache License, Version 2.0 (the "License");
10+
# you may not use this file except in compliance with the License.
11+
# You may obtain a copy of the License at
12+
#
13+
# http://www.apache.org/licenses/LICENSE-2.0
14+
#
15+
# Unless required by applicable law or agreed to in writing, software
16+
# distributed under the License is distributed on an "AS IS" BASIS,
17+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
18+
# See the License for the specific language governing permissions and
19+
# limitations under the License.
20+
#
21+
22+
if fedora_derived?
23+
packages = %w{cyrus-sasl}
24+
modules_package_prefix = 'cyrus-sasl'
25+
sysconfig_path = '/etc/sysconfig/saslauthd'
26+
elsif debian?
27+
packages = %w{sasl2-bin}
28+
modules_package_prefix = 'libsasl2-modules'
29+
sysconfig_path = '/etc/default/saslauthd'
30+
else
31+
fail "fb_sasl: Unknown platform_family: #{node['platform_family']}"
32+
end
33+
34+
package 'sasl packages' do
35+
only_if { node['fb_sasl']['manage_packages'] }
36+
package_name lazy {
37+
packages + node['fb_sasl']['modules'].map do |mod|
38+
"#{modules_package_prefix}-#{mod}"
39+
end
40+
}
41+
action :upgrade
42+
notifies :restart, 'service[saslauthd]'
43+
end
44+
45+
whyrun_safe_ruby_block 'validate config' do
46+
block do
47+
node['fb_sasl']['sysconfig'].each_key do |key|
48+
if key != key.downcase
49+
fail "fb_sasl: invalid casing for key #{key} - please use downcase"
50+
end
51+
if key == 'start'
52+
fail 'fb_sasl: do not specify "start" in sysconfig, use ' +
53+
'enable_saslauthd instead'
54+
end
55+
end
56+
end
57+
end
58+
59+
template sysconfig_path do
60+
source 'sysconfig.erb'
61+
owner node.root_user
62+
group node.root_group
63+
mode '0644'
64+
notifies :restart, 'service[saslauthd]'
65+
end
66+
67+
service 'saslauthd' do
68+
only_if { node['fb_sasl']['enable_saslauthd'] }
69+
action [:enable, :start]
70+
end
71+
72+
service 'disable saslauthd' do
73+
not_if { node['fb_sasl']['enable_saslauthd'] }
74+
service_name 'saslauthd'
75+
action [:stop, :disable]
76+
end

‎cookbooks/fb_sasl/templates/sysconfig.erb‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# This file is controlled by Chef, do not modify!
2+
START="<%= node['fb_sasl']['enable_saslauthd'] ? 'yes' : 'no' %>"
3+
<% node['fb_sasl']['sysconfig'].each do |key, val| %>
4+
<%= key.upcase %>="<%= val %>"
5+
<% end %>

‎cookbooks/test_services/metadata.rb‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
depends 'fb_ejabberd'
1414
depends 'fb_influxdb'
1515
depends 'fb_reprepro'
16+
depends 'fb_sasl'
1617
depends 'fb_smokeping'
1718
depends 'fb_spamassassin'
1819
depends 'fb_vsftpd'

‎cookbooks/test_services/recipes/default.rb‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
# limitations under the License.
1919
#
2020

21+
include_recipe 'fb_sasl'
2122
include_recipe 'fb_bind'
2223

2324
# Currently fb_vsftpd is broken on debian

0 commit comments

Comments
 (0)