IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity
Files
5d51ae50a59466fa2d6d230d7f2879de34210f0c
freeipa/install/updates/10-config.update

50 lines
1.6 KiB
Plaintext
Raw Normal View History

Enable 389-ds SSL host checking by defauilt Enforce that the remote hostname matches the remote SSL server certificate when 389-ds operates as an SSL client. Also add an update file to turn this off for existing installations. This also changes the way the ldapupdater modlist is generated to be more like the framework. Single-value attributes are done as replacements and there is a list of force-replacement attributes. ticket 1069
2011-05-19 22:30:53 -04:00
# Enforce matching SSL certificate host names when 389-ds acts as an SSL
# client. A restart is necessary for this to take effect, we do one when
# upgrading.
dn: cn=config
only:nsslapd-ssl-check-hostname: on
Set the ipa-modrdn plugin precedence to 60 so it runs last The default precedence for plugins is 50 and the run in more or less alphabetical order (but not guaranteed). This plugin needs to run after the others have already done their work. https://fedorahosted.org/freeipa/ticket/1370
2011-07-16 13:35:30 -04:00
The precendence on the modrdn plugin was set in the wrong location. https://fedorahosted.org/freeipa/ticket/1370
2011-09-12 10:36:56 -04:00
# Remove incorrect placement
dn: cn=Kerberos Principal Name,cn=IPA MODRDN,cn=plugins,cn=config
remove: nsslapd-pluginPrecedence: 60
Set the ipa-modrdn plugin precedence to 60 so it runs last The default precedence for plugins is 50 and the run in more or less alphabetical order (but not guaranteed). This plugin needs to run after the others have already done their work. https://fedorahosted.org/freeipa/ticket/1370
2011-07-16 13:35:30 -04:00
# Set the precedence of the ipa-modrdn plugin so it runs after other
# plugins (the default is 50).
The precendence on the modrdn plugin was set in the wrong location. https://fedorahosted.org/freeipa/ticket/1370
2011-09-12 10:36:56 -04:00
dn: cn=IPA MODRDN,cn=plugins,cn=config
Set the ipa-modrdn plugin precedence to 60 so it runs last The default precedence for plugins is 50 and the run in more or less alphabetical order (but not guaranteed). This plugin needs to run after the others have already done their work. https://fedorahosted.org/freeipa/ticket/1370
2011-07-16 13:35:30 -04:00
only: nsslapd-pluginPrecedence: 60
updates: Change default limits on ldap searches Fixes: https://fedorahosted.org/freeipa/ticket/1867 https://fedorahosted.org/freeipa/ticket/1888
2011-09-27 14:59:21 -04:00
# Set limits to suite better IPA deployment sizes, defaults are too
# conservative
dn: cn=config
default: nsslapd-sizelimit:100000
dn: cn=config,cn=ldbm database,cn=plugins,cn=config
replace: nsslapd-lookthroughlimit:5000::100000
replace: nsslapd-idlistscanlimit:4000::100000
#Set much lower limits for anonymous searhes
dn: cn=anonymous-limits,cn=etc,$SUFFIX
default:objectclass:nsContainer
default:objectclass:top
default:cn: anonymous-limits
default:nsSizeLimit: 5000
default:nsLookThroughLimit: 5000
dn: cn=config
Fix nsslapd-anonlimitsdn dn in cn=config The dn value needs to be quoted otherwise it is interpreted to be a multi-value. This will replace whatever value is currently set. https://fedorahosted.org/freeipa/ticket/2452
2012-03-07 17:59:19 -05:00
only:nsslapd-anonlimitsdn:'cn=anonymous-limits,cn=etc,$SUFFIX'
Add support defaultNamingContext and add --basedn to migrate-ds There are two sides to this, the server and client side. On the server side we attempt to add a defaultNamingContext on already installed servers. This will fail on older 389-ds instances but the failure is not fatal. New installations on versions of 389-ds that support this attribute will have it already defined. On the client side we need to look for both defaultNamingContext and namingContexts. We still need to check that the defaultNamingContext is an IPA server (info=IPAV2). The migration change also takes advantage of this and adds a new option which allows one to provide a basedn to use instead of trying to detect it. https://fedorahosted.org/freeipa/ticket/1919 https://fedorahosted.org/freeipa/ticket/2314
2012-01-30 16:29:32 -05:00
# Add a defaultNamingContext if one hasn't already been set. This was
# introduced in 389-ds-base-1.2.10-0.9.a8. Adding this to a server that
# doesn't support it generates a non-fatal error.
dn: cn=config
add:nsslapd-defaultNamingContext:'$SUFFIX'
Set nsslapd-minssf-exclude-rootdse to on so the DSE is always available. If minssf is set in configuration and this is not set then clients won't be able to detect the available namingContexts, defaultNamingContext, capabilities, etc. https://fedorahosted.org/freeipa/ticket/2542
2012-03-22 17:19:01 -04:00
# Allow the root DSE to be searched even with minssf set
dn: cn=config
only:nsslapd-minssf-exclude-rootdse:on
Support the new Winsync POSIX API. This will sync down the POSIX attributes from AD so we need to be careful to not mess with them when they are already set. This includes uidNumber, gidNumber, homeDirectory, loginShell and gecos. http://port389.org/wiki/WinSync_Posix http://port389.org/wiki/Windows_Sync_Plugin_API#Version_3_API_functions https://fedorahosted.org/freeipa/ticket/3007
2012-08-31 15:11:20 -04:00
# Set the IPA winsync precedence so it will run after the DS
# POSIX winsync plugin
dn: cn=ipa-winsync,cn=plugins,cn=config
only: nsslapd-pluginPrecedence: 60
Reference in New Issue Copy Permalink