IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-23 15:40:01 -06:00
Code Issues Packages Projects Releases Wiki Activity
f123b01d81
freeipa/install/updates/10-config.update

76 lines
2.4 KiB
Plaintext
Raw Normal View History

Enable 389-ds SSL host checking by defauilt Enforce that the remote hostname matches the remote SSL server certificate when 389-ds operates as an SSL client. Also add an update file to turn this off for existing installations. This also changes the way the ldapupdater modlist is generated to be more like the framework. Single-value attributes are done as replacements and there is a list of force-replacement attributes. ticket 1069
2011-05-19 21:30:53 -05:00
# Enforce matching SSL certificate host names when 389-ds acts as an SSL
# client. A restart is necessary for this to take effect, we do one when
# upgrading.
dn: cn=config
only:nsslapd-ssl-check-hostname: on
Set the ipa-modrdn plugin precedence to 60 so it runs last The default precedence for plugins is 50 and the run in more or less alphabetical order (but not guaranteed). This plugin needs to run after the others have already done their work. https://fedorahosted.org/freeipa/ticket/1370
2011-07-16 12:35:30 -05:00
The precendence on the modrdn plugin was set in the wrong location. https://fedorahosted.org/freeipa/ticket/1370
2011-09-12 09:36:56 -05:00
# Remove incorrect placement
dn: cn=Kerberos Principal Name,cn=IPA MODRDN,cn=plugins,cn=config
remove: nsslapd-pluginPrecedence: 60
Set the ipa-modrdn plugin precedence to 60 so it runs last The default precedence for plugins is 50 and the run in more or less alphabetical order (but not guaranteed). This plugin needs to run after the others have already done their work. https://fedorahosted.org/freeipa/ticket/1370
2011-07-16 12:35:30 -05:00
# Set the precedence of the ipa-modrdn plugin so it runs after other
# plugins (the default is 50).
The precendence on the modrdn plugin was set in the wrong location. https://fedorahosted.org/freeipa/ticket/1370
2011-09-12 09:36:56 -05:00
dn: cn=IPA MODRDN,cn=plugins,cn=config
Set the ipa-modrdn plugin precedence to 60 so it runs last The default precedence for plugins is 50 and the run in more or less alphabetical order (but not guaranteed). This plugin needs to run after the others have already done their work. https://fedorahosted.org/freeipa/ticket/1370
2011-07-16 12:35:30 -05:00
only: nsslapd-pluginPrecedence: 60
updates: Change default limits on ldap searches Fixes: https://fedorahosted.org/freeipa/ticket/1867 https://fedorahosted.org/freeipa/ticket/1888
2011-09-27 13:59:21 -05:00
# Set limits to suite better IPA deployment sizes, defaults are too
# conservative
dn: cn=config
Increase default limit on LDAP searches to 100k A similar change was attempted years ago in commit 9724251292e4c0797367fcc351a9f16f30c6aefe but it was never applied because it used the wrong DN and because nsslapd-timelimit is already present in the entry the default keyword won't trigger. Use replace instead to increase the value to 100k from the default as originally intended. nsslapd-sizelimit can be changed only with a MOD_REPLACE otherwise a LDAP_NO_SUCH_ATTRIBUTE error is thrown. IPA only uses MOD_REPLACE for single-value attributes but nsslapd-sizelimit is not yet in schema. Add it to the known set of exceptions for single-value attributes. https://pagure.io/freeipa/issue/8962 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2021-08-19 15:45:14 -05:00
replace: nsslapd-sizelimit:2000::100000
updates: Change default limits on ldap searches Fixes: https://fedorahosted.org/freeipa/ticket/1867 https://fedorahosted.org/freeipa/ticket/1888
2011-09-27 13:59:21 -05:00
dn: cn=config,cn=ldbm database,cn=plugins,cn=config
replace: nsslapd-lookthroughlimit:5000::100000
replace: nsslapd-idlistscanlimit:4000::100000
#Set much lower limits for anonymous searhes
dn: cn=anonymous-limits,cn=etc,$SUFFIX
default:objectclass:nsContainer
default:objectclass:top
default:cn: anonymous-limits
default:nsSizeLimit: 5000
default:nsLookThroughLimit: 5000
dn: cn=config
Server Upgrade: remove CSV from upgrade files CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 08:27:12 -05:00
only:nsslapd-anonlimitsdn:cn=anonymous-limits,cn=etc,$SUFFIX
Add support defaultNamingContext and add --basedn to migrate-ds There are two sides to this, the server and client side. On the server side we attempt to add a defaultNamingContext on already installed servers. This will fail on older 389-ds instances but the failure is not fatal. New installations on versions of 389-ds that support this attribute will have it already defined. On the client side we need to look for both defaultNamingContext and namingContexts. We still need to check that the defaultNamingContext is an IPA server (info=IPAV2). The migration change also takes advantage of this and adds a new option which allows one to provide a basedn to use instead of trying to detect it. https://fedorahosted.org/freeipa/ticket/1919 https://fedorahosted.org/freeipa/ticket/2314
2012-01-30 15:29:32 -06:00
# Add a defaultNamingContext if one hasn't already been set. This was
# introduced in 389-ds-base-1.2.10-0.9.a8. Adding this to a server that
# doesn't support it generates a non-fatal error.
dn: cn=config
Server Upgrade: remove CSV from upgrade files CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 08:27:12 -05:00
add:nsslapd-defaultNamingContext:$SUFFIX
Set nsslapd-minssf-exclude-rootdse to on so the DSE is always available. If minssf is set in configuration and this is not set then clients won't be able to detect the available namingContexts, defaultNamingContext, capabilities, etc. https://fedorahosted.org/freeipa/ticket/2542
2012-03-22 16:19:01 -05:00
# Allow the root DSE to be searched even with minssf set
dn: cn=config
only:nsslapd-minssf-exclude-rootdse:on
Support the new Winsync POSIX API. This will sync down the POSIX attributes from AD so we need to be careful to not mess with them when they are already set. This includes uidNumber, gidNumber, homeDirectory, loginShell and gecos. http://port389.org/wiki/WinSync_Posix http://port389.org/wiki/Windows_Sync_Plugin_API#Version_3_API_functions https://fedorahosted.org/freeipa/ticket/3007
2012-08-31 14:11:20 -05:00
# Set the IPA winsync precedence so it will run after the DS
# POSIX winsync plugin
dn: cn=ipa-winsync,cn=plugins,cn=config
only: nsslapd-pluginPrecedence: 60
Enable SASL mapping fallback. Assign a default priority of 10 to our SASL mappings. https://fedorahosted.org/freeipa/ticket/3330
2013-03-22 05:15:51 -05:00
# Enable SASL mapping fallback
dn: cn=config
only:nsslapd-sasl-mapping-fallback: on
dn: cn=Full Principal,cn=mapping,cn=sasl,cn=config
addifnew:nsSaslMapPriority: 10
dn: cn=Name Only,cn=mapping,cn=sasl,cn=config
addifnew:nsSaslMapPriority: 10
Increase default SASL buffer size Default SASL buffer size was too small and could lead for example to migration errors. https://fedorahosted.org/freeipa/ticket/3826
2013-08-07 06:35:27 -05:00
Allow hashed passwords in DS Without nsslapd-allow-hashed-passwords being turned on, user password migration fails. https://fedorahosted.org/freeipa/ticket/4450 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-07-23 06:03:57 -05:00
# Allow hashed passwords to be added by non-DM users. Without this
# setting, password migration fails
dn: cn=config
only:nsslapd-allow-hashed-passwords:on
Decreased timeout for IO blocking for DS Should fix the DS from going unresponsive in some cases https://fedorahosted.org/freeipa/ticket/5383 Reviewed-By: Thierry Bordaz <tbordaz@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-05-31 10:01:29 -05:00
# Decrease default value for IO blocking to prevent server unresponsiveness
dn: cn=config
only:nsslapd-ioblocktimeout:10000
Disable password schema update on LDAP bind 389-DS 1.4.1+ attempts to update passwords to new schema on LDAP bind. IPA blocks hashed password updates and requires password changes to go through proper APIs. This option disables password hashing schema updates on bind. See: https://pagure.io/freeipa/issue/8315 See: https://bugzilla.redhat.com/show_bug.cgi?id=1833266 See: https://pagure.io/389-ds-base/issue/49421 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-05-08 05:01:03 -05:00
# 389-DS 1.4.1.6+ attempts to update passwords to new schema on LDAP bind.
# IPa blocks hashed password updates and requires password changes to go
# through proper APIs. This option disables password hashing schema updates
# on LDAP bind, see https://pagure.io/freeipa/issue/8315
dn: cn=config
only: nsslapd-enable-upgrade-hash:off
Reference in New Issue Copy Permalink