Repository navigation
Upgrade: current distros, better domain discovery, shellcheck clean - #125
Merged
Merged
Conversation
… clean Distro support - Detect the distribution from /etc/os-release (ID, then ID_LIKE) instead of hostnamectl/lsb_release text. Adds Rocky, Alma, RHEL, Oracle, Pop!_OS, Ubuntu flavours, openSUSE (was "No compatible System found") and works without lsb_release. The yum menu is chosen the same way. - Raspberry Pi OS 32-bit (raspbian) uses the Debian client like 64-bit. - RHEL/Fedora: krb5-user/heimdal-clients are Debian names and made dnf abort the whole install; use krb5-workstation, install optional packages separately, use dnf when present. ldap-utils -> openldap-clients. - Time sync: keep the running service, otherwise ntp -> ntpsec -> chrony (ntp is gone on Ubuntu 26.04 / Debian 13 and broke the Ubuntu install). - raspberry(): aptitude -> apt-get. debianclient: fix dkpg/apt get typos. Domain discovery - discover_domain: realm discover, then DNS search/domain names, systemd-resolved, NetworkManager and hostname -d domains plus parent domains, keeping the first realm realmd confirms. Replaces the ping check (DCs often block ICMP). - A DOMAIN set in readfile is now used instead of rediscovering. - End of run, "Check for errors", leave and rejoin check the joined domain (realm list) instead of a bare realm discover, which reported "Realm not installed" on joined machines without a DHCP domain. - failcheck_yum compared the realm name with "no"; check configured:. Fixes found with shellcheck (CI now passes) - OUSPECIFIED from readfile was never set and was glued to --install=/. - SSH allow list only kept bash users: local zsh users (Kali default) were locked out. Use UID_MIN+ users with any login shell, and fix "tee -a sudo tee -a" writing stray files. - LDAPS: quoted glob never matched the CA cert and $cacer was empty. - -l never logged ($? instead of $#); -f called a removed function. - Quoting, useless echo, unreachable code; notify-send only with a display.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brings
ADconnection.shup to date with current distributions, makes domain discovery work without a DHCP-announced domain, and fixes every ShellCheck finding, so the Test Pipeline (which fails onmastertoday) should pass.Distro support
/etc/os-release(ID, thenID_LIKEfor derivatives) instead of parsinghostnamectl/lsb_releasetext. This adds Rocky, Alma, RHEL, Oracle, Pop!_OS, Ubuntu flavours and openSUSE (it used to hit "No compatible System found"), and it works withoutlsb_release. The yum menu is picked the same way.krb5-user/heimdal-clientsare Debian names, and dnf aborts the whole install when one package is missing. Now useskrb5-workstation, installs optional packages separately, and prefersdnf.ntp→ntpsec→chrony.ntpis gone on Ubuntu 26.04 and Debian 13, where the Ubuntu install line failed.raspbian) now uses the Debian client like 64-bit;aptitude→apt-get.Domain discovery
discover_domain: triesrealm discover, then DNS search/domain names (resolv.conf, systemd-resolved, NetworkManager) andhostname -d, including parent domains, and keeps the first realm realmd confirms. Replaces thepingcheck, since DCs often block ICMP.DOMAINfromreadfileis now actually used.realm list) instead of a barerealm discover, which said "Realm not installed" on joined machines.Bugs found with ShellCheck
OUSPECIFIEDfromreadfilewas never set, and"$OUSPECIFIED"--install=/glued the OU to--install.tee -a sudo tee -a, which wrote straysudo/teefiles.$cacertypo wrote an emptyldap_tls_cacert.-lnever logged (it tested$?instead of$#);-fcalled a function that no longer exists.failcheck_yumcompared the realm name withno.Testing
shellcheck(0.11.0): 0 findings (master: 81).bash -nand--helpOK.gode.lan), starting from stock state: no sssd available, nosudoers:line innsswitch.conf, computer account deleted. sssd prompt → pinned sid → sssd installed; no sudo lockout; domain auto-discovered from the DNS search domain; joined. The final check reports "Realm configured?.. YES". An AD user can SSH in, gets a home directory, gets sudo through<hostname>sudoers, and gets a Kerberos ticket.ntp/policykit-1)Not tested end to end: the Ubuntu desktop, RHEL/Fedora and SUSE join flows. Those have only had detection and package names checked in containers.