commit: bf339dafe9121c8d4bfe8e5eba6d07e7b08127a2 Author: Robin H. Johnson <robbat2 <AT> gentoo <DOT> org> AuthorDate: Thu Feb 9 23:47:49 2023 +0000 Commit: Robin H. Johnson <robbat2 <AT> gentoo <DOT> org> CommitDate: Thu Feb 9 23:48:30 2023 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bf339daf
net-nds/openldap: tweak upgrade safety checks & default database backend for 2.6 Signed-off-by: Robin H. Johnson <robbat2 <AT> gentoo.org> Closes: https://bugs.gentoo.org/893646 net-nds/openldap/files/openldap-2.6.3-slapd-conf | 64 ++++++++++++++++++++++++ net-nds/openldap/openldap-2.6.3-r3.ebuild | 2 +- net-nds/openldap/openldap-2.6.3-r7.ebuild | 17 +++++-- 3 files changed, 79 insertions(+), 4 deletions(-) diff --git a/net-nds/openldap/files/openldap-2.6.3-slapd-conf b/net-nds/openldap/files/openldap-2.6.3-slapd-conf new file mode 100644 index 000000000000..4555c620c281 --- /dev/null +++ b/net-nds/openldap/files/openldap-2.6.3-slapd-conf @@ -0,0 +1,64 @@ +# +# See slapd.conf(5) for details on configuration options. +# This file should NOT be world readable. +# +include /etc/openldap/schema/core.schema + +# Define global ACLs to disable default read access. + +# Do not enable referrals until AFTER you have a working directory +# service AND an understanding of referrals. +#referral ldap://root.openldap.org + +pidfile /run/openldap/slapd.pid +argsfile /run/openldap/slapd.args + +# Load dynamic backend modules: +###INSERTDYNAMICMODULESHERE### + +# Sample security restrictions +# Require integrity protection (prevent hijacking) +# Require 112-bit (3DES or better) encryption for updates +# Require 63-bit encryption for simple bind +# security ssf=1 update_ssf=112 simple_bind=64 + +# Sample access control policy: +# Root DSE: allow anyone to read it +# Subschema (sub)entry DSE: allow anyone to read it +# Other DSEs: +# Allow self write access +# Allow authenticated users read access +# Allow anonymous users to authenticate +# Directives needed to implement policy: +# access to dn.base="" by * read +# access to dn.base="cn=Subschema" by * read +# access to * +# by self write +# by users read +# by anonymous auth +# +# if no access controls are present, the default policy +# allows anyone and everyone to read anything but restricts +# updates to rootdn. (e.g., "access to * by * read") +# +# rootdn can always read and write EVERYTHING! + +####################################################################### +# BDB database definitions +####################################################################### + +database mdb +suffix "dc=my-domain,dc=com" +# <kbyte> <min> +checkpoint 32 30 +rootdn "cn=Manager,dc=my-domain,dc=com" +# Cleartext passwords, especially for the rootdn, should +# be avoid. See slappasswd(8) and slapd.conf(5) for details. +# Use of strong authentication encouraged. +rootpw secret +# The database directory MUST exist prior to running slapd AND +# should only be accessible by the slapd and slap tools. +# Mode 700 recommended. +directory /var/lib/openldap-data +# Indices to maintain +index objectClass eq diff --git a/net-nds/openldap/openldap-2.6.3-r3.ebuild b/net-nds/openldap/openldap-2.6.3-r3.ebuild index fccec9c055ec..55df096bb65f 100644 --- a/net-nds/openldap/openldap-2.6.3-r3.ebuild +++ b/net-nds/openldap/openldap-2.6.3-r3.ebuild @@ -643,7 +643,7 @@ multilib_src_install() { # use our config rm "${ED}"/etc/openldap/slapd.conf insinto /etc/openldap - newins "${FILESDIR}"/${PN}-2.4.40-slapd-conf slapd.conf + newins "${FILESDIR}"/${PN}-2.6.3-slapd-conf slapd.conf configfile="${ED}"/etc/openldap/slapd.conf # populate with built backends diff --git a/net-nds/openldap/openldap-2.6.3-r7.ebuild b/net-nds/openldap/openldap-2.6.3-r7.ebuild index 0c699006bb9c..dd5276bf5a17 100644 --- a/net-nds/openldap/openldap-2.6.3-r7.ebuild +++ b/net-nds/openldap/openldap-2.6.3-r7.ebuild @@ -166,7 +166,7 @@ openldap_find_versiontags() { openldap_found_tag=0 have_files=0 for each in ${openldap_datadirs[@]} ; do - CURRENT_TAGDIR="${ROOT}$(sed "s:\/::" <<< ${each})" + CURRENT_TAGDIR="${EROOT}$(sed "s:\/::" <<< ${each})" CURRENT_TAG="${CURRENT_TAGDIR}/${OPENLDAP_VERSIONTAG}" if [[ -d "${CURRENT_TAGDIR}" ]] && [[ "${openldap_found_tag}" == 0 ]] ; then einfo "- Checking ${each}..." @@ -232,7 +232,18 @@ openldap_find_versiontags() { | awk '/libdb-/{gsub("^libdb-","",$1);gsub(".so$","",$1);print $1}')" local fail=0 - if has_version "${CATEGORY}/${PN}[berkdb]" ; then + # This will not cover detection of cn=Config based configuration, but + # it's hopefully good enough. + if grep -sq '^backend.*shell' "${EROOT}"/etc/openldap/slapd.conf; then + eerror " OpenLDAP >= 2.6.x has dropped support for Shell backend." + eerror " You will need to migrate per upstream's migration notes" + eerror " at https://www.openldap.org/doc/admin25/appendix-upgrading.html."; + eerror " Your existing database will not be accessible until it is" + eerror " converted away from backend shell!" + echo + fail=1 + fi + if has_version "${CATEGORY}/${PN}[berkdb]" || grep -sq '^backend.*(bdb|hdb)' /etc/openldap/slapd.conf; then eerror " OpenLDAP >= 2.6.x has dropped support for Berkeley DB." eerror " You will need to migrate per upstream's migration notes" eerror " at https://www.openldap.org/doc/admin25/appendix-upgrading.html."; @@ -652,7 +663,7 @@ multilib_src_install() { # use our config rm "${ED}"/etc/openldap/slapd.conf insinto /etc/openldap - newins "${FILESDIR}"/${PN}-2.4.40-slapd-conf slapd.conf + newins "${FILESDIR}"/${PN}-2.6.3-slapd-conf slapd.conf configfile="${ED}"/etc/openldap/slapd.conf # populate with built backends
