IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-09-03 20:52:56 -05:00
Code Issues Packages Projects Releases Wiki Activity
2,639 Commits 11 Branches 63 Tags
5797c8167ae651be3705406584ee443a442e8cd9
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Simo Sorce 4262358111 Fix SASL mappings 2009-11-18 14:26:29 -05:00
Simo Sorce 9fe707a3f2 Basic changes to get a default principal for DNS 
Also moves delagation layout installation in dsinstance.
This is needed to allow us to set default membership in
other modules like bindinstance.

Signed-off-by: Martin Nagy <mnagy@redhat.com>
 2009-07-10 09:42:22 -04:00
Simo Sorce 24089821fb Check error in kpasswd 2009-07-10 09:42:21 -04:00
Simo Sorce c4ed025001 Fix delegation using the special python-kerberos patch. 2009-01-26 14:44:49 -05:00
Simo Sorce 077d6a0d35 Make KDC listen to TCP port as well by default 2009-01-26 14:44:40 -05:00
Simo Sorce 0fb3f394a5 read_file() was a remnant of the conversion of ldapupdate.py to a library and 
is not accessible directly. Use ipautil.template_file, this works.
 2009-01-26 14:44:34 -05:00
Simo Sorce 2b8b87b4d6 memberof was not indexed in older versions of fedora-ds, keep it around 
as an update so that if it is not there it will be added
 2008-12-05 18:18:14 -05:00
Simo Sorce 7c5ae7f402 Fix stupid typo in update file 2008-12-03 12:03:04 -05:00
Simo Sorce 80cc2c3715 Change ipa-compat-manage to work on older python versions too. Break try,except,finally into a try,try,finally,except Add also checks for LDAPError, errors. 2008-12-03 11:17:55 -05:00
Simo Sorce b3b4435d0e One line fix for ipa-server spec file 2008-12-03 11:17:51 -05:00
Simo Sorce d006587937 Adding an index for memberuid. Alsthough we do not use this attribute, many clients still ask for it so let's index it and make stuff faster. 2008-12-02 19:28:51 -05:00
Simo Sorce 0e6928dd1b Forgot to add ipa-compat-manage to the sbin programs 2008-12-02 16:50:21 -05:00
Simo Sorce e0e784f77f Add man page for ipa-compat-manage 2008-12-02 16:39:57 -05:00
Simo Sorce 3fb6343149 Fix makefiles after schema compat changes 2008-12-02 16:39:57 -05:00
Simo Sorce ef0bb46923 Fix typo, thanks to Michele for pointing it out 2008-12-01 17:19:10 -05:00
Simo Sorce 78166d949c Run updates on the replica too, otherwise changes to cn=config will be missing. 2008-12-01 17:19:10 -05:00
Simo Sorce 3a263e9466 Make sure the CA cert is copied to the replica, fail if no ca.crt is available. Cope with some versions of ipa that forgot to copy the ca.crt cert in the right place. 2008-12-01 17:19:10 -05:00
Simo Sorce 5d1d292c15 Add tool to enable or disable the schema compatibility plugin 2008-12-01 17:19:10 -05:00
Simo Sorce 83a4c7207d Fix memleaks found by valgrind 2008-11-20 19:54:03 -05:00
Simo Sorce 00e8af8ac3 We must always zero out the target ientry unconditionally where it is used 
and never free it in the destructor.
 2008-11-20 14:03:19 -05:00
Simo Sorce 16bb6e19df Avoid potential crashbug on invalid DNs (not in the tree). 2008-11-19 14:00:30 -05:00
Simo Sorce 7156f2ddfb Fix a free before use bug, it may lead to crashes but usually just corrupts 
the changepw dn we store so that it won't match. This causes normal password
changes to be interpreted as password resets instead, and the new legit
password is immediately expired.
 2008-11-14 10:23:43 -05:00
Simo Sorce 818cafdd4d Bump up version number to 1.2.0 2008-11-13 11:20:06 -05:00
Simo Sorce 8929075150 Make the list of users that can skip passwrod policies configurable. 
Addresses bz#471130

Also fix bugs in ipapwd_start.
Also remove mutex, it is not necessary with the current code,
we needed it when we used to change reload the configuration and
keep it referenced in a static pointer.
ipapwd_start runs only once and the global variables it sets are fixed
in stone until DS is restarted.
 2008-11-12 13:21:03 -05:00
Simo Sorce b4938f5e35 Fix syntax error 2008-09-18 17:23:13 -04:00
Simo Sorce f6cd489909 We were assuming that, if the realm was correct then also the 
rest of the krb5.conf configuration were. This clearly breaks
with the default EXAMPLE.COM realm configuratrion. Furthermore
it makes it not possible to try to 'fix' an installation by
rerruninng ipa-client-install

This patch removes the special case and avoids krb5.conf only
if the on_master flag is passed.
Fix also one inner 'if' statement to be simpler to understand.
 2008-09-18 17:23:12 -04:00
Simo Sorce bc70a5146f Remove reference to very unlikely service examples that are not 
currently kerberized (and may never be due to their nature).
 2008-09-18 17:23:12 -04:00
Simo Sorce 57669ba432 Add script to simplify operations to fix CVE 2008 3274 
Import all of change master key directly into the help fix,
allows for better control
 2008-09-10 15:07:42 -04:00
Simo Sorce 8e7c98eb7f CVE 2008 3274 related fixes 2008-09-10 15:07:33 -04:00
Simo Sorce 89ed5a0277 Add a tool to change the kerberos Master Key in case an admin wants to. 
This tool will dump and re-encrypt all keys, then reload and change
the master key in LDAP and in the stash file.
It will also restart the Directory Server and the the KDC
 2008-09-10 15:07:26 -04:00
Simo Sorce 86afc680cd Retrieve the kerberos configuration every time a new, it will be a bit slower 
but will allow for changing configurations without having to restart DS.
Password operations are slow and rare enough this is an acceptable compromise.
 2008-09-10 15:07:17 -04:00
Simo Sorce 2846083979 Add 2 features to ipa-getkeytab: 
1. Allow to specify the salt type along with the enctype
2. Allow to specify a password instead of forcing a random secret
 2008-08-21 11:04:59 -04:00
Simo Sorce 2659fb0eb4 Minor bugs found while testing stuff. 
- wrong import in certs.py makes ipa-replica-manage fail
- close the fs after the stash file is written so that the file is updated
  immediately and not when the fd is garbage collected
 2008-08-21 11:04:52 -04:00
Simo Sorce 0c6aeee6f1 Fix segfault cause by empty target entry 2008-08-19 11:14:27 -04:00
Simo Sorce c5b44f77a1 Comment out code that generates keys with a random salt, apparently this does not work as expected and generates faulty keys 2008-08-15 08:54:44 +02:00
Simo Sorce cee4b2cc1e Fix usage of mozldap libraries, 
thanks to W. Michael Petullo <mike@flyn.org> for finding the problem.
 2008-08-13 15:57:43 -04:00
Simo Sorce 44689b93c9 Remove unused stuff. 2008-08-13 15:57:35 -04:00
Simo Sorce afad6d96ae apparently the "configure" target is never used 2008-08-13 15:57:28 -04:00
Simo Sorce f5177e6b84 Install the ca.crt file early on so that we can always enforce SSL 
protected connections to other LDAP servers
Fix error reporting on replica creation.
 2008-08-13 15:36:57 -04:00
Simo Sorce 0d6b6fa084 Implement password operation checks and key material generation for the 
ldap add and modify operation performed on the userPassword attribute.

Add helper functions to reduce code duplication.

Do not enforce encrypted connections on ldap add/ldap mod for compatibility
reasons. (We cannot enforce people not to send the password in the clear
anyway, we can only refuse to accept it at the most which does not gain
you much if someone then re-send you the same password previously exposed)
 2008-08-12 14:48:41 -04:00
Simo Sorce 9648da8f5f Fix versioning for configure.ac and ipa-python/setup.py 
Fix make maintainer-clean

Also make RPM naming consistent by using a temp RELEASE file.
This one helps when testing builds using rpms.
Just 'echo X > RELEASE' to build a new rpms (X, X+1, X+2 ...)

Version 1.1.0 was released some times ago, bump up to 1.1.1
 2008-08-11 18:31:05 -04:00
Simo Sorce 0368d4329a Used the encrypt_file and decrypt_file utility functions to encrypt replica 
information. This way we do not risk to leave around sensitive data.
Set the destination host in the replica file too and do checks against
in ipa-replica-install
 2008-08-11 18:30:57 -04:00
Simo Sorce 5cbc453d89 Add encrypt_file and decrypt_file utility functions. 
We will use them to encrypt the replica file so that we can
transport it over more safely.
It contains sensitive data, by encrypting it we assure that
even if a distracted admin leaves it around it cannot be accessed
without knowing the access passphrase (usually the Directory Manager
password)

Along the way fix also ipautil.run which was buggy and not passing
in correctly stdin.

Add dependency for gnupg in spec file
 2008-08-11 18:30:50 -04:00
Simo Sorce 599fe1a0f5 Use larger set from which to choose chars for random passwords. 
Use SystemRandom() instead of Random() so that the randomicity
is non-deterministic.
 2008-08-11 18:30:40 -04:00
Simo Sorce 1b613fafa6 Treat Jan 1 1970 in krbPrincipalExpiration as a special date that means 
the account Never Expires
 2008-08-07 11:50:33 -04:00
Simo Sorce 4d88900c22 Fix a stupidty introduced recently in a fix to a segfault. 2008-07-24 11:35:04 -04:00
Simo Sorce 67f62709f8 In openvz we found out some interfaces may return a null pointer here. 
Skip them if no address is provided or we later get a segfault because
we dereference a null pointer.
 2008-07-15 16:16:33 -04:00
Simo Sorce 4b4e0e1516 fix typo 2008-07-15 16:16:33 -04:00
Simo Sorce 66aa3581fc Make sure we have the right prototypes when using openldap libs 2008-07-09 16:51:18 -04:00
Simo Sorce f86c8420b1 Admin must be able to add/delete too 2008-07-09 16:50:54 -04:00
Simo Sorce aead1f652e If krbPasswordExpiration or krbLastPwdChange are not present on the entry 
we might segfault trying a direct strcmp(), check they are not NULL.
Also fix a couple of memleaks.
 2008-07-07 10:01:29 -04:00
Simo Sorce 79df2465a7 After the rework of the code that binds to specific interfaces to 
correctly support multihomed server, we need to add a couple of
SELinux lines to the policy file. (lines suggested by Dan Walsh)
 2008-07-07 10:01:20 -04:00
Simo Sorce 675df04806 Make sure we listen only on the krb5 port and therefore disable krb4 support 2008-07-02 15:24:36 -04:00
Simo Sorce f5d9dd647f slapi_pw_find_sv() expects an array, make sure we have a NULL terminated 
one to avoid potential segfaults
Avoid leaking memory too.
 2008-06-30 14:13:25 -04:00
Simo Sorce 2dc64eddd4 Fix make all 2008-06-16 14:28:41 -04:00
Simo Sorce 798d345e13 Very ugly fix to configure to make it actually find a 
correctly installed slapi-plugin.h file
 2008-06-16 13:52:26 -04:00
Simo Sorce d2bd1b29a0 Must index uidnumber and gidnumber and any attribute that dna plugin is going 
to generate or that we need to search on.
 2008-06-12 19:06:38 -04:00
Simo Sorce 24f0f632b6 Fix uninizialized counter, was causing allocation to fail and command to 
return in case any encryption type was explicitly requested
 2008-06-12 19:06:30 -04:00
Simo Sorce 9c34dde165 Change default. 
By default increment by one  but set the maximum value to one million.

when installing a replica change values to start from 1 million +1 and
cap it to 2 million and so on for any other replica.
 2008-06-12 19:05:45 -04:00
Simo Sorce b3ca8359ee Fix cut&paste error 2008-06-11 11:36:21 -04:00
Simo Sorce 77906dce20 Fix typo in inet type 2008-06-11 11:36:14 -04:00
Simo Sorce e9b96cdabb Move version to 1.1.0 in preparation for new patch release 2008-06-11 09:21:18 -04:00
Simo Sorce 3f4b182bc4 Let DS encode the password, this will allow IPA -> AD password 
synchronization to work again.
 2008-06-11 09:18:38 -04:00
Simo Sorce 4f81c2faec Make ipa_kpasswd listen on each single interface explicitly 
instead of 0.0.0.0, this allows us to reply to a UDP request
by using the right source address to build the kerberos reply.
 2008-05-29 09:43:39 -04:00
Simo Sorce 8fb4809465 Use openldap libraries by default as mozldap libs seem to break 
ldap_extended_operation() somehow and ipa_kpasswd stops working
 2008-05-29 09:43:28 -04:00
Simo Sorce dc7d62d543 Fix crash bug in ipa_kpasswd 2008-05-29 09:43:20 -04:00
Simo Sorce 8f082f2d4f Now that admin is in the common users tree make the nss_ldap 
configuration look at the specific tree where users are and
not search the full server.
 2008-05-29 09:43:08 -04:00
Simo Sorce 53afb67537 Fix the case where domain != lower(REALM) 
add the domain to the ipa.conf file for apps that need to know
This should fix a bug in the replica setup
 2008-05-29 09:43:00 -04:00
Simo Sorce f32f8d6d82 Use a value that is explicitly 64bit on all architectures 2008-05-23 15:07:49 -04:00
Simo Sorce 3931d1d753 Move admin into cn=users,cn=accounts 
After some deep thinking I think the advantages of keeping all
posix enabled user accounts under cn=users,cn=accounts overweight a
perceived better protection of the admin account by keeping it in a
separate tree.
 2008-05-23 15:07:37 -04:00
Simo Sorce 0695649926 Don't make the rpm %post fail just because the server has never been 
configured before (and therefore there is nothing to upgrade, just let
it spit out warnings for admins that actually check whats going on.
 2008-05-22 17:20:09 -04:00
Simo Sorce 0d023b2680 Fix testing for asprintf errors, we need to test the return value as 
per standard the  buffer status is undefined.
While there also introduce a new spearate variable to return the final
error and keep using ret for local error checks. This avoid potentially
overwriting the correct return value when checking for asprintf ...
 2008-05-22 11:44:02 -04:00
Simo Sorce 6119f83799 Use split instead of find as split does not fail to provide a complete 
component if no '.' is found.
 2008-05-15 14:26:25 -04:00
Simo Sorce d0f0d97be6 If there is an error we need to send back a reply ourselves. 
Return also an intelligible error message.
 2008-05-15 12:59:28 -04:00
Simo Sorce fb3555c483 For some unknown reason the sort control returns values sorted in reverse. 
Ask for inverse order to get them straight ...
 2008-05-15 12:59:28 -04:00
Simo Sorce 10f0881dba Implement checks to make sure we are not assigning a number that is in use. 
Change config to support a maximum value so that ranges can be defined.
Add stubs to reach out and ask to swap in new ranges and notify that new
chuncks are needed/used.
 2008-05-15 12:59:28 -04:00
Simo Sorce a86b1eaeed fix stupid typo, 
thanks Nalin for spotting this.
 2008-05-10 11:25:31 -04:00
Simo Sorce 0b2756bed7 Fix existence check, default_server is an array so we need to 
check its length to determine if it is empty
 2008-05-10 11:25:31 -04:00
Simo Sorce 5c4b1770c0 On IPA Servers connect to ourselves using localhost, 
and avoid searching for KDC servers via DNS, we just connect
to ourselves.
 2008-05-08 17:31:19 -04:00
Simo Sorce 34c6ac06c6 Return better ewrror message that gives a hint about who actually returned it 
+ Some cleanups (trainling spaces and such).
 2008-05-08 17:03:43 -04:00
Simo Sorce 6f4d71d2cc Indent the plugin accordingly to our style guidelines. 
Used indent -kr -nut dna.c for most of the changes
 2008-05-07 14:45:46 -04:00
Simo Sorce 70d5209b11 Fix a bug in our dns library, do not return the query as a reply if 0 replies were returned. 2008-05-07 14:42:49 -04:00
Simo Sorce 1e3276cec1 Make sure recent ldapmodify tool (as in F9) do not complain by splitting the 
operation into 2 modify operations
 2008-04-25 14:18:39 -04:00
Simo Sorce 298747e15a Make sure we always have the [domain-realm] section or kerberos libs misbheave. 2008-04-22 15:28:42 -04:00
Simo Sorce 24a7cf3714 Fix client discovery and make sure command line options are not overwritten 
with discovered options, just verified.
 2008-04-09 15:55:46 -04:00
Simo Sorce 3e47b48068 Make sure we use the configured server in ipa.conf first, and 
fallback to the discovered ones only if that's not available
 2008-04-09 14:37:01 -04:00
Simo Sorce 70d3717e8b Add --permitted-enctypes command and add it to the man page too 2008-04-08 18:02:42 -04:00
Simo Sorce c45d58cc3f Make sure we start the NSCD daemon. 
It makes a huge difference on clients, if we cache lookups
 2008-04-08 14:58:52 -04:00
Simo Sorce f24842fd9d is_integer returns the integer, don't use an if clause, just check it, if it 
is wrong it will just throw an exception and exit.
Fix error reporting to use the canonical str(e)
 2008-04-08 14:35:26 -04:00
Simo Sorce 6778085531 The kpasswd keytab must not be owned by the dirsrv user. 
Fix copy&paste error.
 2008-04-08 09:25:48 -04:00
Simo Sorce dc861888ad Add _ntp SRV record 2008-04-07 15:27:42 -04:00
Simo Sorce f16d2d6e2d Password policy checks fixes. 
- don't let a user set a password identical to the current one.
- don't check more then the policy defined number of passwords in history
- don't set an history longer than policy defined
 2008-04-07 09:26:18 -04:00
Simo Sorce f7a425fff8 Need python-ldap in Requires 2008-04-02 19:13:46 -04:00
Simo Sorce 1083207dca Make sure we have ipa-client installed as now ipa-server-install calls 
ipa-client-install
 2008-04-02 12:36:25 -04:00
Simo Sorce a903eacba2 Cut&patse error 2008-04-02 11:57:52 -04:00
Simo Sorce 0d5f45b3dd Stricter directory control for ipa daemons, each one it's own directory 2008-04-01 18:07:14 -04:00
Simo Sorce 625d9b2de8 - Better defaults for nss_ldap 
- Make sure timeouts are not too high, so that machine does not hang if remote
  servers are not reachable
- Make sure root can always login no matter what the status of the ldap
  servers
- use rfc2307bis schema directive
 2008-04-01 18:04:59 -04:00
Simo Sorce c260d63245 Move ipa_kpasswd credential cache in its own directory 2008-04-01 17:33:53 -04:00
Simo Sorce af50f341ad Call client uninstall from server uninstall so that uninstall reverses also 
client bits.
 2008-03-31 17:35:45 -04:00
Simo Sorce a81ea4051b RHEL4 contrib client uninstall 2008-03-31 17:34:40 -04:00