Attachment #10905 for bug #52575

Lines 1178-1185 Type=str Link Here

(-)a/base/univention-base-files/debian/univention-base-files.univention-config-registry-variables (-2 / +2 lines)
1178	Categories=service-base	1178	Categories=service-base
1179		1179
1180	[machine/password/length]	1180	[machine/password/length]
1181	Description[de]=Das Passwort des Rechnerkontos wird in der Regel automatisch erstellt und rotiert. Es wird in der Datei /etc/machine.secret gespeichert. Diese Variable konfiguriert die Länge des generierten Passworts. Ist die Variable nicht gesetzt, ist das Passwort 20 Zeichen lang.	1181	Description[de]=Das Passwort des Rechnerkontos wird in der Regel automatisch erstellt und rotiert. Es wird in der Datei /etc/machine.secret gespeichert. Diese Variable konfiguriert die Länge des generierten Passworts. Ist die Variable nicht gesetzt, ist das Passwort 32 Zeichen lang.
1182	Description[en]=The password for the computer account is usually automatically created and rotated. It is stored in the file /etc/machine.secret. This variable configures the length of the generated password. If the variable is unset, the password consists of 20 characters.	1182	Description[en]=The password for the computer account is usually automatically created and rotated. It is stored in the file /etc/machine.secret. This variable configures the length of the generated password. If the variable is unset, the password consists of 32 characters.
1183	Type=int	1183	Type=int
1184	Categories=service-base	1184	Categories=service-base
1185		1185

Lines 48-54 def createMachinePassword(): Link Here

(-)a/base/univention-lib/python/misc.py (-1 / +1 lines)
48	"""	48	"""
49	ucr = ConfigRegistry()	49	ucr = ConfigRegistry()
50	ucr.load()	50	ucr.load()
51	length = ucr.get('machine/password/length', '20')	51	length = ucr.get('machine/password/length', '32')
52	compl = ucr.get('machine/password/complexity', 'scn')	52	compl = ucr.get('machine/password/complexity', 'scn')
53	p = subprocess.Popen(["pwgen", "-1", "-" + compl, length], stdout=subprocess.PIPE, stderr=subprocess.PIPE)	53	p = subprocess.Popen(["pwgen", "-1", "-" + compl, length], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
54	(stdout, stderr) = p.communicate()	54	(stdout, stderr) = p.communicate()

Lines 145-151 create_machine_password () { Link Here

(-)a/base/univention-lib/shell/base.sh (-1 / +1 lines)
145	local length compl	145	local length compl
146	length="$(/usr/sbin/univention-config-registry get machine/password/length)"	146	length="$(/usr/sbin/univention-config-registry get machine/password/length)"
147	compl="$(/usr/sbin/univention-config-registry get machine/password/complexity)"	147	compl="$(/usr/sbin/univention-config-registry get machine/password/complexity)"
148	pwgen -1 -"${compl:-scn}" "${length:-20}" \| tr -d '\n'	148	pwgen -1 -"${compl:-scn}" "${length:-32}" \| tr -d '\n'
149	}	149	}
150		150
151	#	151	#

Lines 8-14 Link Here

(-)a/base/univention-licence/lib/license_ldap.c (-1 / +1 lines)
8		8
9	static univention_ldap_parameters_t *lp = NULL;	9	static univention_ldap_parameters_t *lp = NULL;
10		10
11	#define _UNIVENTION_LDAP_MACHINE_SECRET_LEN_MAX 60	11	#define _UNIVENTION_LDAP_MACHINE_SECRET_LEN_MAX 256
12	int univention_ldap_set_machine_connection(univention_ldap_parameters_t *lp) {	12	int univention_ldap_set_machine_connection(univention_ldap_parameters_t *lp) {
13	FILE *secret;	13	FILE *secret;
14	size_t len;	14	size_t len;

Lines 107-113 static int sasl_interact(LDAP ld, unsigned flags, void defaults, void *in) Link Here

(-)a/base/univention-policy/lib/ldap.c (-1 / +1 lines)
107	return LDAP_SUCCESS;	107	return LDAP_SUCCESS;
108	}	108	}
109		109
110	#define _UNIVENTION_LDAP_SECRET_LEN_MAX 27	110	#define _UNIVENTION_LDAP_SECRET_LEN_MAX 256
111	int univention_ldap_set_admin_connection( univention_ldap_parameters_t *lp )	111	int univention_ldap_set_admin_connection( univention_ldap_parameters_t *lp )
112	{	112	{
113	FILE *secret;	113	FILE *secret;

Lines 26-32 Link Here

(-)a/doc/manual/computers-de.xml (-1 / +1 lines)
26	<para>	26	<para>
27	Das Passwort für das Rechnerkonto wird beim Domänenbeitritt automatisch erzeugt und in der	27	Das Passwort für das Rechnerkonto wird beim Domänenbeitritt automatisch erzeugt und in der
28	Datei <filename>/etc/machine.secret</filename> gespeichert. Das Passwort umfasst in der	28	Datei <filename>/etc/machine.secret</filename> gespeichert. Das Passwort umfasst in der
29	Grundeinstellung 20 Zeichen (konfigurierbar über die &ucsUCRV; <envar>machine/password/length</envar>).	29	Grundeinstellung 32 Zeichen (konfigurierbar über die &ucsUCRV; <envar>machine/password/length</envar>).
30	Das Passwort wird in festen Intervallen automatisch	30	Das Passwort wird in festen Intervallen automatisch
31	neu generiert (in der Grundeinstellung 21 Tage, konfigurierbar über die	31	neu generiert (in der Grundeinstellung 21 Tage, konfigurierbar über die
32	&ucsUCRV; <envar>server/password/interval</envar>). Die Passwortrotation kann über die	32	&ucsUCRV; <envar>server/password/interval</envar>). Die Passwortrotation kann über die

Lines 27-33 Link Here

(-)a/doc/manual/computers-en.xml (-1 / +1 lines)
27	<para>	27	<para>
28	The password for the computer account is generated automatically during the domain join and	28	The password for the computer account is generated automatically during the domain join and
29	saved in the <filename>/etc/machine.secret</filename> file. By default the	29	saved in the <filename>/etc/machine.secret</filename> file. By default the
30	password consists of 20 characters (can be configured via the &ucsUCRV;	30	password consists of 32 characters (can be configured via the &ucsUCRV;
31	<envar>machine/password/length</envar>). The password is regenerated	31	<envar>machine/password/length</envar>). The password is regenerated
32	automatically at fixed intervals (default setting: 21 days; can be configured using the	32	automatically at fixed intervals (default setting: 21 days; can be configured using the
33	&ucsUCRV; <envar>server/password/interval</envar>). Password rotation can also be disabled	33	&ucsUCRV; <envar>server/password/interval</envar>). Password rotation can also be disabled

Lines 40-47 CONTAINER=$(ucr get "$ucr_container_key") Link Here

(-)a/management/univention-appcenter/scripts/joinscripthelper.sh (-1 / +2 lines)
40	joinscript_add_simple_app_system_user () {	40	joinscript_add_simple_app_system_user () {
41	local password	41	local password
42	local pwdfile	42	local pwdfile
		43	eval "$(ucr shell machine/password/length)"
43		44
44	password="$(makepasswd)"	45	password="$(makepasswd --chars=${machine_password_length:-32})"
45	pwdfile="/etc/$APP.secret"	46	pwdfile="/etc/$APP.secret"
46	joinscript_run_in_container touch "$pwdfile"	47	joinscript_run_in_container touch "$pwdfile"
47	joinscript_run_in_container chmod 600 "$pwdfile"	48	joinscript_run_in_container chmod 600 "$pwdfile"

Lines 60-66 if [ "$server_role" = "domaincontroller_master" -o "$server_role" = "domaincontr Link Here

(-)a/management/univention-self-service/35univention-self-service-passwordreset-umc.inst (-1 / +1 lines)
60	DB_SECRET_FILE="/etc/self-service-db.secret"	60	DB_SECRET_FILE="/etc/self-service-db.secret"
61	if [ ! -f $DB_SECRET_FILE ]; then	61	if [ ! -f $DB_SECRET_FILE ]; then
62	echo "Generating new DB password..."	62	echo "Generating new DB password..."
63	selfservice_pwd="$(makepasswd --chars 20)"	63	selfservice_pwd="$(makepasswd --chars=${machine_password_length:-32})"
64	touch "$DB_SECRET_FILE"	64	touch "$DB_SECRET_FILE"
65	chown root:root "$DB_SECRET_FILE"	65	chown root:root "$DB_SECRET_FILE"
66	chmod 600 "$DB_SECRET_FILE"	66	chmod 600 "$DB_SECRET_FILE"

Lines 134-140 if [ "$server_role" = "domaincontroller_master" ]; then Link Here

(-)a/saml/univention-saml/91univention-saml.inst (-1 / +1 lines)
134	# Only set password if sys-idp-user does not exist	134	# Only set password if sys-idp-user does not exist
135	username=$(ucs_getAttrOfDN uid uid=sys-idp-user,cn=users,"$ldap_base" "$@" 2>/dev/null)	135	username=$(ucs_getAttrOfDN uid uid=sys-idp-user,cn=users,"$ldap_base" "$@" 2>/dev/null)
136	if [ ! "$username" = "sys-idp-user" ]; then	136	if [ ! "$username" = "sys-idp-user" ]; then
137	PASSWORD=$(makepasswd --chars=20)	137	PASSWORD=$(makepasswd --chars=${machine_password_length:-32})
138	touch "$SECRETFILE"	138	touch "$SECRETFILE"
139	chown root:"DC Backup Hosts" "$SECRETFILE"	139	chown root:"DC Backup Hosts" "$SECRETFILE"
140	chmod 640 "$SECRETFILE"	140	chmod 640 "$SECRETFILE"

Lines 39-48 test_mysql_access() { Link Here

(-)a/services/univention-mariadb/debian/univention-mariadb.postinst (-1 / +2 lines)
39		39
40	create_mysql_secret_if_not_exists () {	40	create_mysql_secret_if_not_exists () {
41	if [ ! -e /etc/mysql.secret ]; then	41	if [ ! -e /etc/mysql.secret ]; then
		42	eval "$(ucr shell machine/password/length 2>/dev/null \|\| /bin/true)"
42	touch /etc/mysql.secret	43	touch /etc/mysql.secret
43	chmod 600 /etc/mysql.secret	44	chmod 600 /etc/mysql.secret
44	chown root /etc/mysql.secret	45	chown root /etc/mysql.secret
45	makepasswd --nocrypt --chars=20 >> /etc/mysql.secret	46	makepasswd --nocrypt --chars=${machine_password_length:-32} >> /etc/mysql.secret
46	fi	47	fi
47	}	48	}
48		49

Return to bug 52575