/[smeserver]/rpms/e-smith-ldap/sme8/e-smith-ldap-5.2.0-anonymous_acl.patch
ViewVC logotype

Annotation of /rpms/e-smith-ldap/sme8/e-smith-ldap-5.2.0-anonymous_acl.patch

Parent Directory Parent Directory | Revision Log Revision Log | View Revision Graph Revision Graph

Revision 1.1 - (hide annotations) (download)
Sat Oct 2 09:49:01 2010 UTC (14 years, 1 month ago) by vip-ire
Branch: MAIN
CVS Tags: e-smith-ldap-5_2_0-49_el5_sme, e-smith-ldap-5_2_0-76_el5_sme, e-smith-ldap-5_2_0-71_el5_sme, e-smith-ldap-5_2_0-77_el5_sme, e-smith-ldap-5_2_0-50_el5_sme, e-smith-ldap-5_2_0-78_el5_sme, e-smith-ldap-5_2_0-61_el5_sme, e-smith-ldap-5_2_0-66_el5_sme, e-smith-ldap-5_2_0-70_el5_sme, e-smith-ldap-5_2_0-79_el5_sme, e-smith-ldap-5_2_0-81_el5_sme, e-smith-ldap-5_2_0-59_el5_sme, e-smith-ldap-5_2_0-45_el5_sme, e-smith-ldap-5_2_0-75_el5_sme, e-smith-ldap-5_2_0-46_el5_sme, e-smith-ldap-5_2_0-56_el5_sme, e-smith-ldap-5_2_0-55_el5_sme, e-smith-ldap-5_2_0-57_el5_sme, e-smith-ldap-5_2_0-73_el5_sme, e-smith-ldap-5_2_0-69_el5_sme, e-smith-ldap-5_2_0-48_el5_sme, e-smith-ldap-5_2_0-44_el5_sme, e-smith-ldap-5_2_0-52_el5_sme, e-smith-ldap-5_2_0-51_el5_sme, e-smith-ldap-5_2_0-72_el5_sme, e-smith-ldap-5_2_0-65_el5_sme, e-smith-ldap-5_2_0-54_el5_sme, e-smith-ldap-5_2_0-53_el5_sme, e-smith-ldap-5_2_0-43_el5_sme, e-smith-ldap-5_2_0-47_el5_sme, e-smith-ldap-5_2_0-80_el5_sme, e-smith-ldap-5_2_0-74_el5_sme, e-smith-ldap-5_2_0-63_el5_sme, e-smith-ldap-5_2_0-60_el5_sme, e-smith-ldap-5_2_0-62_el5_sme, e-smith-ldap-5_2_0-42_el5_sme, e-smith-ldap-5_2_0-68_el5_sme, e-smith-ldap-5_2_0-67_el5_sme, e-smith-ldap-5_2_0-64_el5_sme, HEAD 
* Sat Oct 2 2010 Daniel Berteaud <daniel@firewall-services.com> 5.2.0-42.sme
- Deny access to some attributes for anonymous users [SME: 6254]
1 vip-ire 1.1 diff -Nur -x '*.orig' -x '*.rej' e-smith-ldap-5.2.0/root/etc/e-smith/templates/etc/openldap/slapd.conf/95acls60sensibleObjects mezzanine_patched_e-smith-ldap-5.2.0/root/etc/e-smith/templates/etc/openldap/slapd.conf/95acls60sensibleObjects
2     --- e-smith-ldap-5.2.0/root/etc/e-smith/templates/etc/openldap/slapd.conf/95acls60sensibleObjects 1970-01-01 01:00:00.000000000 +0100
3     +++ mezzanine_patched_e-smith-ldap-5.2.0/root/etc/e-smith/templates/etc/openldap/slapd.conf/95acls60sensibleObjects 2010-10-01 19:14:20.000000000 +0200
4     @@ -0,0 +1,10 @@
5     +# Anonymous users should only be able to see SME users and groups for addressbook purpose
6     +# Prevent access to system, dummy and machine accounts
7     +
8     +access to dn.subtree=ou=Users,{ esmith::util::ldapBase ($DomainName); } filter=(!(objectClass=inetOrgPerson))
9     + by anonymous none
10     +access to dn.subtree=ou=Groups,{ esmith::util::ldapBase ($DomainName); } filter=(!(objectClass=mailboxRelatedObject))
11     + by anonymous none
12     +access to dn.subtree=ou=Computers,{ esmith::util::ldapBase ($DomainName); }
13     + by anonymous none
14     +
15     diff -Nur -x '*.orig' -x '*.rej' e-smith-ldap-5.2.0/root/etc/e-smith/templates/etc/openldap/slapd.conf/95acls70sensibleAttrs mezzanine_patched_e-smith-ldap-5.2.0/root/etc/e-smith/templates/etc/openldap/slapd.conf/95acls70sensibleAttrs
16     --- e-smith-ldap-5.2.0/root/etc/e-smith/templates/etc/openldap/slapd.conf/95acls70sensibleAttrs 1970-01-01 01:00:00.000000000 +0100
17     +++ mezzanine_patched_e-smith-ldap-5.2.0/root/etc/e-smith/templates/etc/openldap/slapd.conf/95acls70sensibleAttrs 2010-10-01 19:12:10.000000000 +0200
18     @@ -0,0 +1,8 @@
19     +{
20     +
21     +# Array of attrs which should not be visible anonymously
22     +@sensible = ();
23     +
24     +$OUT .= '';
25     +
26     +}
27     diff -Nur -x '*.orig' -x '*.rej' e-smith-ldap-5.2.0/root/etc/e-smith/templates/etc/openldap/slapd.conf/95acls72posixAccount mezzanine_patched_e-smith-ldap-5.2.0/root/etc/e-smith/templates/etc/openldap/slapd.conf/95acls72posixAccount
28     --- e-smith-ldap-5.2.0/root/etc/e-smith/templates/etc/openldap/slapd.conf/95acls72posixAccount 1970-01-01 01:00:00.000000000 +0100
29     +++ mezzanine_patched_e-smith-ldap-5.2.0/root/etc/e-smith/templates/etc/openldap/slapd.conf/95acls72posixAccount 2010-10-01 19:12:10.000000000 +0200
30     @@ -0,0 +1,8 @@
31     +{
32     +
33     +# Sensible attributes related to posixAccount
34     +push @sensible, qw/loginShell gidNumber homeDirectory uidNumber/;
35     +
36     +$OUT .= '';
37     +
38     +}
39     diff -Nur -x '*.orig' -x '*.rej' e-smith-ldap-5.2.0/root/etc/e-smith/templates/etc/openldap/slapd.conf/95acls74shadowAccount mezzanine_patched_e-smith-ldap-5.2.0/root/etc/e-smith/templates/etc/openldap/slapd.conf/95acls74shadowAccount
40     --- e-smith-ldap-5.2.0/root/etc/e-smith/templates/etc/openldap/slapd.conf/95acls74shadowAccount 1970-01-01 01:00:00.000000000 +0100
41     +++ mezzanine_patched_e-smith-ldap-5.2.0/root/etc/e-smith/templates/etc/openldap/slapd.conf/95acls74shadowAccount 2010-10-01 19:12:10.000000000 +0200
42     @@ -0,0 +1,8 @@
43     +{
44     +
45     +# Sensible attributes related to shadowAccount
46     +push @sensible,qw/shadowExpire shadowFlag shadowInactive shadowLastChange shadowMax shadowMin shadowWarning/;
47     +
48     +$OUT .= '';
49     +
50     +}
51     diff -Nur -x '*.orig' -x '*.rej' e-smith-ldap-5.2.0/root/etc/e-smith/templates/etc/openldap/slapd.conf/95acls80sensibleAcl mezzanine_patched_e-smith-ldap-5.2.0/root/etc/e-smith/templates/etc/openldap/slapd.conf/95acls80sensibleAcl
52     --- e-smith-ldap-5.2.0/root/etc/e-smith/templates/etc/openldap/slapd.conf/95acls80sensibleAcl 1970-01-01 01:00:00.000000000 +0100
53     +++ mezzanine_patched_e-smith-ldap-5.2.0/root/etc/e-smith/templates/etc/openldap/slapd.conf/95acls80sensibleAcl 2010-10-01 19:16:31.000000000 +0200
54     @@ -0,0 +1,13 @@
55     +{
56     +my $attrs = join(",",@sensible);
57     +
58     +unless ($attrs eq ''){
59     + $OUT .=<<"HERE";
60     +# Restrict access to some sensible attributes
61     +access to attrs=$attrs
62     + by self peername.ip="127.0.0.1" read
63     + by self ssf=128 read
64     + by anonymous none
65     +HERE
66     +}
67     +}
admin@koozali.org
 ViewVC Help
Powered by ViewVC 1.2.1 RSS 2.0 feed