Updated the scripts for OpenDSA - nologin on the account.

Signed-off-by: Filip Strömbäck <filip.stromback@liu.se>

files/opendsa/manage.sh

 #!/bin/bash
+
+OPENDSA_HOME="/srv/opendsa"
+
 if [ $# == 0 ]
 then
     echo "This script is only intended for managing the server. Please provide one argument as an action!"
     exit 1
 fi
-cd ~/OpenDSA/server/
-~/OpenDSA/server/main.py "$@"
+
+if [[ $(whoami) != "opendsa" ]]
+then
+    sudo -u opendsa $OPENDSA_HOME/manage.sh "$@"
+    exit $?
+fi
+
+cd $OPENDSA_HOME/OpenDSA/server/
+$OPENDSA_HOME/OpenDSA/server/main.py "$@"
+exit $?

files/sudoers_aes

@@ -2,7 +2,7 @@ klaar36 ALL=(ALL) NOPASSWD: ALL
 filst04 ALL=(ALL) NOPASSWD: ALL
 
 User_Alias EXAM_ADMINS = torjo38, klaar36, vikol94, magni54, filst04
-Runas_Alias EXAM_USER = examadm, %examadm
+Runas_Alias EXAM_USER = examadm, %examadm, opendsa, %opendsa
 
 Cmnd_Alias SERVICE_CMDS = /usr/bin/systemctl /usr/bin/less
 

manifests/opendsa.pp

@@ -12,8 +12,7 @@ class aes::opendsa {
     managehome => false,
     membership => inclusive,
     system => true,
-  # Do we need login shell. YES
-    shell => '/bin/bash',
+    shell => '/sbin/nologin',
   }
 
   file { "${opendsa_home}":
@@ -63,7 +62,7 @@ class aes::opendsa {
     ensure => present,
     owner  => "${opendsa_user}",
     group  => "${opendsa_group}",
-    mode => '0751',
+    mode => '0755',
     source => "puppet:///modules/${module_name}/opendsa/manage.sh",
   }