Example configurations
The following configuration files are illustrative and therefore will not work without editing. These examples show some of what Martinet can evaluate and how Martinet is configured.
Example configuration
version = 1
# Where should Martinet feedback be sent?
feedback email = Unit-Martinet-feedback@mx.uillinois.edu
# Warn on groups with members (non-empty groups).
[group:"Field Consultants" "CN=Field Services OU Admins,OU=FC Groups,OU=Field Consulting,OU=Delegated,OU=TechServices,OU=Urbana,DC=ad,DC=uillinois,DC=edu" "CN=Tech Services FC Tech\*,OU=FC Groups,OU=Field Consulting,OU=Delegated,OU=TechServices,OU=Urbana,DC=ad,DC=uillinois,DC=edu" 03efc439-b0dc-4615-afed-646fd22dfe34]
member count = 0
Example output
Line 8: The following 4 AD groups have member counts other than 0 members—expected exactly 0 members in each group:
| Group sAMAccountName | Group member count |
|---|---|
| FCTechOps | 5 |
| Field Consultants | 15 |
| FC-Unix | 2 |
| Field Services OU Admins | 2 |
Example configuration
version = 1 # Where should Martinet feedback be sent? feedback email = Unit-Martinet-feedback@mx.uillinois.edu # What subject should feedback emails have? feedback subject = Martinet report # What user (typically a service account granted read-only access) will run Martinet? runas user = uofi\unit-martinet-svc # # Objects in the specified OU should have names ending in -ReadWrite, -NoAccess, or -ReadOnly. # [ou:OU=Storage,OU=File Share Permission Groups,OU=My Unit,OU=Urbana,DC=ad,DC=uillinois,DC=edu] object name matches -(ReadWrite|NoAccess|ReadOnly)$ object name matches ^MyUnit # # "MyUnit All Staff" group is the all-inclusive group. # This AD object must have at least one member and all group members must be groups. # [group:MyUnit All Staff] member count > 0 member type is group # # The main-office print queue should have 7 ACEs and one of them must allow wislande to print. # [print-queue:main-office@myunit-print.ad.uillinois.edu] ACE count = 7 ACE entry is: Principal is uofi\wislande; AccessControlType is AccessAllowed; PrintQueueRights contains ReadExtendedAttributes, ReadPermissions; # # Make sure there are only desirable share-level permissions in place. # [SMB-share:\\myunit-file.ad.uillinois.edu\Storage] # Members of the ne'er-do-well group should be denied access to the share entirely. ACE entry is: AccountName is UOFI\MyUnit Deny Access; AccessControlType is Deny; AccessRight is Full # "MyUnit-Storage share users" group are the legitimate members of this fileshare. ACE entry is: AccountName is UOFI\MyUnit-Storage share users; AccessControlType is Allow; AccessRight is Full # Nobody but the "MyUnit-Storage share users" group should be granted an allowing ACE on this fileshare. ACE entry is: not AccessControlType is Allow; AccountName is not UOFI\MyUnit-Storage share users; # Warn if there are more or fewer than 2 ACEs in the \\MyUnit-file.ad.uillinois.edu\Storage ACL. ACE count = 2 # Don't let just anyone with an AD user account login to the system running Martinet. [local-group:Users] member name is not Domain Users
Plain language explanation of example configuration file
The first list which email address (line 2) to send a report to and the subject header (line 3) to use for such emails.
Every group in OU=Storage,OU=File Share Permission Groups,OU=MyUnit,OU=Urbana,DC=ad,DC=uillinois,DC=edu:
- has a name which matches
-(ReadWrite|NoAccess|ReadOnly)$(line 14), - and has a name which matches
^MyUnit(line 15).
Both regular expressions in lines 14 & 15 could have been stated in one requirement (^MyUnit.*-(ReadWrite|NoAccess|ReadOnly)$) if concision is desired.
Each line in the configuration file is independent of the other lines in the same section, so it's possible that only one regular expression will match (which raises no warning) but the other regular expression does not match (which raises a warning).
Every member of group MyUnit All Users:
- should have a name which matches the regular expression
staff$; the leading space in the regular expression is preserved with quotes, - should be a group,
- and should have a positive member count (in other words, the group should not be empty).