IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Big changeset that includes the work around keytab management.

Browse Source 
Following the changelog history from my dev tree, some comments are useful imo

------------------------------------------------------

user:        Simo Sorce <ssorce@redhat.com>
date:        Fri Dec 21 03:05:36 2007 -0500
files:       ipa-server/ipa-slapi-plugins/ipa-pwd-extop/test-get-keytab.c
description:
Remove remnants of the initial test tool

changeset:   563:4fe574b7bdf1
user:        Simo Sorce <ssorce@redhat.com>
date:        Fri Dec 21 02:58:37 2007 -0500
files:       ipa-server/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c
description:
Maybe actually encrypting the keys will help :-)

changeset:   562:488ded41242a
user:        Simo Sorce <ssorce@redhat.com>
date:        Thu Dec 20 23:53:50 2007 -0500
files:       ipa-server/ipa-install/share/Makefile.am ipa-server/ipa-install/share/default-aci.ldif
description:
Fixes

changeset:   561:4518f6f5ecaf
user:        Simo Sorce <ssorce@redhat.com>
date:        Thu Dec 20 23:53:32 2007 -0500
files:       ipa-admintools/Makefile ipa-admintools/ipa-addservice
description:
transform the old ipa-getkeytab in a tool to add services as the new
ipa-getkeytab won't do it (and IMO it makes more sense to keep the
two functions separate anyway).

changeset:   559:25a7f8ee973d
user:        Simo Sorce <ssorce@redhat.com>
date:        Thu Dec 20 23:48:59 2007 -0500
files:       ipa-server/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c
description:
Bugfixes

changeset:   558:28fcabe4aeba
user:        Simo Sorce <ssorce@redhat.com>
date:        Thu Dec 20 23:48:29 2007 -0500
files:       ipa-client/configure.ac ipa-client/ipa-client.spec ipa-client/ipa-client.spec.in ipa-client/ipa-getkeytab.c
description:
Configure fixes
Add ipa-getkeytab to spec
Client fixes

changeset:   557:e92a4ffdcda4
user:        Simo Sorce <ssorce@redhat.com>
date:        Thu Dec 20 20:57:10 2007 -0500
files:       ipa-client/Makefile.am ipa-client/configure.ac
description:
Try to make ipa-getkeytab build via autotools

changeset:   556:224894175d6b
user:        Simo Sorce <ssorce@redhat.com>
date:        Thu Dec 20 20:35:56 2007 -0500
files:       ipa-admintools/ipa-getkeytab ipa-client/ipa-getkeytab.c
description:
Messed a bit with hg commands.
To make it short:
- Remove the python ipa-getkeytab program
- Rename the keytab plugin test program to ipa-getkeytab
- Put the program in ipa-client as it should be distributed with the client
  tools

changeset:   555:5e1a068f2e90
user:        Simo Sorce <ssorce@redhat.com>
date:        Thu Dec 20 20:20:40 2007 -0500
files:       ipa-server/ipa-slapi-plugins/ipa-pwd-extop/test-get-keytab.c
description:
Polish the client program

changeset:   554:0a5b19a167cf
user:        Simo Sorce <ssorce@redhat.com>
date:        Thu Dec 20 18:53:49 2007 -0500
files:       ipa-server/ipa-install/share/default-aci.ldif ipa-server/ipa-install/share/default-keytypes.ldif ipa-server/ipa-install/share/kdc.conf.template ipa-server/ipa-install/share/kerberos.ldif ipa-server/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c ipa-server/ipa-slapi-plugins/ipa-pwd-extop/test-get-keytab.c ipa-server/ipaserver/krbinstance.py
description:
Support retrieving enctypes from LDAP
Filter enctypes
Update test program

changeset:   553:f75d7886cb91
user:        Simo Sorce <ssorce@redhat.com>
date:        Thu Dec 20 00:17:40 2007 -0500
files:       ipa-server/ipa-slapi-plugins/ipa-pwd-extop/test-get-keytab.c
description:
Fix ber generation and remove redundant keys

changeset:   552:0769cafe6dcd
user:        Simo Sorce <ssorce@redhat.com>
date:        Wed Dec 19 19:31:37 2007 -0500
files:       ipa-server/ipa-slapi-plugins/ipa-pwd-extop/test-get-keytab.c
description:
Avoid stupid segfault

changeset:   551:1acd5fdb5788
user:        Simo Sorce <ssorce@redhat.com>
date:        Wed Dec 19 18:39:12 2007 -0500
files:       ipa-server/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c
description:
If ber_peek_tag() returns LBER_ERROR it may just be that we are at the
end of the buffer. Unfortunately ber_scanf is broken in the sense that
it doesn't actually really consider sequence endings (due probably to the fact
they are just representation and do not reflect in the underlieing DER
encoding.)

changeset:   550:e974fb2726a4
user:        Simo Sorce <ssorce@redhat.com>
date:        Wed Dec 19 18:35:07 2007 -0500
files:       ipa-server/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c ipa-server/ipa-slapi-plugins/ipa-pwd-extop/test-get-keytab.c
description:
First shot at the new method
This commit is contained in:
Simo Sorce
2007-12-21 11:37:19 -05:00
parent 2855e9d40a
commit ed50c663e8
14 changed files with 1890 additions and 559 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
ipa-server/ipa-install/share/Makefile.am
View File

@@ -8,6 +8,7 @@ app_DATA = \
60ipaconfig.ldif \
bootstrap-template.ldif \
default-aci.ldif \
default-keytypes.ldif \
kerberos.ldif \
indeces.ldif \
bind.named.conf.template \

5
ipa-server/ipa-install/share/default-aci.ldif
View File

@@ -3,8 +3,9 @@
dn: $SUFFIX
changetype: modify
replace: aci
aci: (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMkey")(version 3.0; acl "Enable Anonymous access"; allow (read, search, compare) userdn = "ldap:///anyone";)
aci: (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMkey")(version 3.0; acl "Admin can manage any entry"; allow (all) userdn = "ldap:///uid=admin,cn=sysaccounts,cn=etc,$SUFFIX";)
aci: (targetattr = "krbMKey")(version 3.0; acl "Only the kerberos account can access this one"; deny (read, search, compare, write) userdn != "ldap:///uid=kdc,cn=sysaccounts,cn=etc,$SUFFIX";)
aci: (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory")(version 3.0; acl "Enable Anonymous access"; allow (read, search, compare) userdn = "ldap:///anyone";)
aci: (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory")(version 3.0; acl "Admin can manage any entry"; allow (all) userdn = "ldap:///uid=admin,cn=sysaccounts,cn=etc,$SUFFIX";)
aci: (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory")(version 3.0; acl "Admins can write passwords"; allow (write) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,$SUFFIX";)
aci: (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory")(version 3.0; acl "Password change service can read/write passwords"; allow (read, write) userdn="ldap:///krbprincipalname=kadmin/changepw@$REALM,cn=$REALM,cn=kerberos,$SUFFIX";)
aci: (targetattr = "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory")(version 3.0; acl "KDC System Account can access passwords"; allow (all) userdn="ldap:///uid=kdc,cn=sysaccounts,cn=etc,$SUFFIX";)

20
ipa-server/ipa-install/share/default-keytypes.ldif Normal file
View File

@@ -0,0 +1,20 @@
#kerberos keytypes
dn: cn=$REALM,cn=kerberos,$SUFFIX
changetype: modify
add: krbSupportedEncSaltTypes
krbSupportedEncSaltTypes: aes256-cts:normal
krbSupportedEncSaltTypes: aes128-cts:normal
krbSupportedEncSaltTypes: des3-hmac-sha1:normal
krbSupportedEncSaltTypes: arcfour-hmac:normal
krbSupportedEncSaltTypes: des-hmac-sha1:normal
krbSupportedEncSaltTypes: des-cbc-md5:normal
krbSupportedEncSaltTypes: des-cbc-crc:normal
krbSupportedEncSaltTypes: des-cbc-crc:v4
krbSupportedEncSaltTypes: des-cbc-crc:afs3
krbDefaultEncSaltTypes: aes256-cts:normal
krbDefaultEncSaltTypes: aes128-cts:normal
krbDefaultEncSaltTypes: des3-hmac-sha1:normal
krbDefaultEncSaltTypes: arcfour-hmac:normal
krbDefaultEncSaltTypes: des-hmac-sha1:normal
krbDefaultEncSaltTypes: des-cbc-md5:normal

2
ipa-server/ipa-install/share/kdc.conf.template
View File

@@ -4,7 +4,7 @@
[realms]
$REALM = {
master_key_type = des3-hmac-sha1
supported_enctypes = des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal des-cbc-crc:v4 des-cbc-crc:afs3
supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal des-cbc-crc:v4 des-cbc-crc:afs3
max_life = 7d
max_renewable_life = 14d
acl_file = /var/kerberos/krb5kdc/kadm5.acl

1
ipa-server/ipa-install/share/kerberos.ldif
View File

@@ -14,4 +14,3 @@ objectClass: top
cn: kerberos
aci: (targetattr="*")(version 3.0; acl "KDC System Account"; allow (all) userdn= "ldap:///uid=kdc,cn=sysaccounts,cn=etc,$SUFFIX";)

1742
ipa-server/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c
View File

File diff suppressed because it is too large Load Diff

5
ipa-server/ipaserver/krbinstance.py
View File

@@ -128,6 +128,7 @@ class KrbInstance(service.Service):
self.step("adding kerberos entries to the DS", self.__add_krb_entries)
self.step("adding defalt ACIs", self.__add_default_acis)
self.step("configuring KDC", self.__create_instance)
self.step("adding defalt keytypes", self.__add_default_keytypes)
self.step("creating a keytab for the directory", self.__create_ds_keytab)
self.step("creating a keytab for the machine", self.__create_host_keytab)
self.step("exporting the kadmin keytab", self.__export_kadmin_changepw_keytab)
@@ -253,9 +254,11 @@ class KrbInstance(service.Service):
self.__ldap_mod("kerberos.ldif")
def __add_default_acis(self):
#Change the default ACL to avoid anonimous access to kerberos keys and othe hashes
self.__ldap_mod("default-aci.ldif")
def __add_default_keytypes(self):
self.__ldap_mod("default-keytypes.ldif")
def __create_replica_instance(self):
self.__create_instance(replica=True)