freeipa/install/updates/50-ipaconfig.update

dn: cn=ipaConfig,cn=etc,$SUFFIX
add:ipaSELinuxUserMapOrder: guest_u:s0$$xguest_u:s0$$user_u:s0$$staff_u:s0-s0:c0.c1023$$unconfined_u:s0-s0:c0.c1023
add:ipaSELinuxUserMapDefault: unconfined_u:s0-s0:c0.c1023
add:ipaUserObjectClasses: ipasshuser
remove:ipaConfigString:AllowLMhash
Add SELinux user mapping framework. This will allow one to define what SELinux context a given user gets on a given machine. A rule can contain a set of users and hosts or it can point to an existing HBAC rule that defines them. https://fedorahosted.org/freeipa/ticket/755 2011-11-23 15:59:21 -06:00			`dn: cn=ipaConfig,cn=etc,$SUFFIX`
Set MLS/MCS for user_u context to what will be on remote systems. The user_u context in the default list was broader than is actually configured by default on systems. https://fedorahosted.org/freeipa/ticket/3224 2012-11-01 09:13:01 -05:00			`add:ipaSELinuxUserMapOrder: guest_u:s0$$xguest_u:s0$$user_u:s0$$staff_u:s0-s0:c0.c1023$$unconfined_u:s0-s0:c0.c1023`
Set SELinux default context to unconfined_u:s0-s0:c0.c1023 Don't require ipaselinuxdefaultuser to be set. If this is unset then SSSD will use the system default. https://fedorahosted.org/freeipa/ticket/3045 2012-09-10 16:07:54 -05:00			`add:ipaSELinuxUserMapDefault: unconfined_u:s0-s0:c0.c1023`
Add LDAP schema for SSH public keys. https://fedorahosted.org/freeipa/ticket/754 2011-12-07 01:46:23 -06:00			`add:ipaUserObjectClasses: ipasshuser`
Remove deprecated AllowLMhash config Remove this ipaConfigString value as LM hash is deprecated and in fact even insecure. https://fedorahosted.org/freeipa/ticket/3795 2013-11-01 03:25:33 -05:00			`remove:ipaConfigString:AllowLMhash`