Attachment 9442 Details for Bug 46530

[patch] Fix Kerberos UCRV and more

32456-heimdal-Evaluate-UCRV-as-boolean.patch (text/plain), 13.71 KB, created by Philipp Hahn on 2018-03-07 14:45 CET

(hide)

Description:

Filename:

MIME Type:

Creator: Philipp Hahn

Created: 2018-03-07 14:45 CET

Size: 13.71 KB

patch

obsolete

>From c8b96115985ab5ef8367393f3af1b99d9cb12724 Mon Sep 17 00:00:00 2001
>Message-Id: <c8b96115985ab5ef8367393f3af1b99d9cb12724.1520427963.git.hahn@univention.de>
>From: Philipp Hahn <hahn@univention.de>
>Date: Wed, 7 Mar 2018 12:57:33 +0100
>Subject: [PATCH] Bug #32456 heimdal: Evaluate UCRV as boolean
>Organization: Univention GmbH, Bremen, Germany
>
><https://www.systutorials.com/docs/linux/man/5-heimdal-krb5.conf/>
><https://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html>
>
>'debug' does not work with Heimdal Kerberos.
>
>Run `verify_krb5_conf --warn-mit-syntax` to verify.
>---
> base/univention-heimdal/conffiles/etc/krb5.conf    | 115 +++++++++------------
> ...dal-common.univention-config-registry-variables |  24 ++---
> 2 files changed, 59 insertions(+), 80 deletions(-)
>
>diff --git a/base/univention-heimdal/conffiles/etc/krb5.conf b/base/univention-heimdal/conffiles/etc/krb5.conf
>index a55c743721..e4d4e5adcd 100644
>--- a/base/univention-heimdal/conffiles/etc/krb5.conf
>+++ b/base/univention-heimdal/conffiles/etc/krb5.conf
>@@ -2,47 +2,45 @@
> 
> [libdefaults]
> @!@
>-kerberos_realm = configRegistry.get('kerberos/realm') or 'UNIVENTION.UNCONFIGURED'
>+PERMITTED_ENCTYPES = 'aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 arcfour-hmac-md5 des-cbc-crc des-cbc-md5 des-cbc-md4 des3-hmac-sha1 des3-cbc-sha1'
>+kerberos_realm = configRegistry.setdefault('kerberos/realm', 'UNIVENTION.UNCONFIGURED')
>+default_enctypes = configRegistry.setdefault('kerberos/defaults/enctypes/permitted', PERMITTED_ENCTYPES)
>+kerberos_kdc = configRegistry.setdefault('kerberos/kdc', '127.0.0.1:88')
>+kerberos_adminserver = configRegistry.setdefault('kerberos/adminserver', '127.0.0.1:88')
>+kerberos_kpasswdserver = configRegistry.setdefault('kerberos/kpasswdserver', '127.0.0.1:464')
> 
>-print '\tdefault_realm = %s' % kerberos_realm
>-
>-permitted_enctypes = 'aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 arcfour-hmac-md5 des-cbc-crc des-cbc-md5 des-cbc-md4 des3-hmac-sha1 des3-cbc-sha1'
>-default_enctypes = configRegistry.get('kerberos/defaults/enctypes/permitted', permitted_enctypes)
>+print '\tdefault_realm = %(kerberos/realm)s' % configRegistry
> 
> ## Set Heimdal options
>-print '\tdefault_etypes = %s' % default_enctypes
>+print '\tdefault_etypes = %s  # Heimdal only' % default_enctypes
> default_tgs_etypes = configRegistry.get('kerberos/defaults/enctypes/tgs')
> if default_tgs_etypes:
>-	print '\tdefault_tgs_etypes = %s' % default_tgs_etypes
>+	print '\tdefault_tgs_etypes = %s  # Heimdal only' % default_tgs_etypes
> default_as_etypes = configRegistry.get('kerberos/defaults/enctypes/tkt')
> if default_as_etypes:
>-	print '\tdefault_as_etypes = %s' % default_as_etypes
>+	print '\tdefault_as_etypes = %s  # Heimdal only' % default_as_etypes
> 
>-if not configRegistry.is_false('kerberos/allow/weak/crypto'):
>-	print '\tallow_weak_crypto=true'
>-print '\tdns_lookup_kdc = %s' % configRegistry.get('kerberos/defaults/dns_lookup_kdc', 'true')
>-print '\tdns_lookup_realm = %s' % configRegistry.get('kerberos/defaults/dns_lookup_realm', 'false')
>-print '\tforwardable = %s' % configRegistry.get('kerberos/defaults/forwardable', 'true')
>-print '\tproxiable = %s' % configRegistry.get('kerberos/defaults/proxiable', 'true')
>-print '\tkdc_timesync = %s' % configRegistry.get('kerberos/defaults/kdc_timesync', '1')
>-print '\tdebug = %s' % configRegistry.get('kerberos/defaults/debug', 'false')
>+def boolean(key, default=False): return 'true' if configRegistry.is_true(key, default) else 'false'
>+print '\tallow_weak_crypto = %s' % (boolean('kerberos/allow/weak/crypto', True),)
>+print '\tdns_lookup_kdc = %s' % (boolean('kerberos/defaults/dns_lookup_kdc', True),)
>+print '\tdns_lookup_realm = %s' % (boolean('kerberos/defaults/dns_lookup_realm', False),)
>+print '\tforwardable = %s' % (boolean('kerberos/defaults/forwardable', True),)
>+print '\tproxiable = %s' % (boolean('kerberos/defaults/proxiable', True),)
>+print '\tkdc_timesync = %d' % (1 if configRegistry.is_true('kerberos/defaults/kdc_timesync', True) else 0,)
> 
> ## Also set the MIT options, for compatibility
> print '\t# '
> print '\t# The following libdefaults are for clients using the MIT Kerberos library'
> print '\t# '
>-print '\tpermitted_enctypes = %s' % default_enctypes
>-print '\tdefault_tgs_enctypes = %s' % (default_tgs_etypes or permitted_enctypes)
>-print '\tdefault_tkt_enctypes = %s' % (default_as_etypes or permitted_enctypes)
>-if configRegistry.is_true('kerberos/defaults/ignore_acceptor_hostname'):
>-	print '\tignore_acceptor_hostname = true'
>-if configRegistry.is_false('kerberos/defaults/rdns'):
>-	print '\trdns = false'
>-print ''
>+print '\tpermitted_enctypes = %s  # MIT only' % default_enctypes
>+print '\tdefault_tgs_enctypes = %s  # MIT only' % (default_tgs_etypes or PERMITTED_ENCTYPES)
>+print '\tdefault_tkt_enctypes = %s  # MIT only' % (default_as_etypes or PERMITTED_ENCTYPES)
>+print '\tignore_acceptor_hostname = %s  # MIT only' % (boolean('kerberos/defaults/ignore_acceptor_hostname'),)
>+print '\trdns = %s  # MIT only' % (boolean('kerberos/defaults/rdns', True),)
> 
> def is_samba4_dc():
> 	import os.path
>-	if not configRegistry.get('server/role') in ['domaincontroller_master', 'domaincontroller_backup', 'domaincontroller_slave']:
>+	if configRegistry.get('server/role') not in ['domaincontroller_master', 'domaincontroller_backup', 'domaincontroller_slave']:
> 		return False
> 	if not os.path.exists('/usr/sbin/univention-s4search'):
> 		return False
>@@ -50,52 +48,39 @@ def is_samba4_dc():
> 
> if configRegistry.get('kerberos/domain_realms'):
> 	print '[domain_realm]'
>-	domain_realms = configRegistry.get('kerberos/domain_realms').split(',')
>-	for i in domain_realms:
>-		print i
>+	print configRegistry.get('kerberos/domain_realms').replace(',', '\n')
> 
>-kerberos_kdc = configRegistry.get('kerberos/kdc')
>-kerberos_adminserver = configRegistry.get('kerberos/adminserver')
>-kerberos_kpasswdserver = configRegistry.get('kerberos/kpasswdserver')
>-print '[realms]'
>-print '%s = { ' % kerberos_realm
>-print '\tacl_file = /var/lib/heimdal-kdc/kadmind.acl'
>-if kerberos_kdc:
>-	print '\tkdc = %s' % kerberos_kdc
>-if kerberos_adminserver:
>-	print '\tadmin_server = %s' % kerberos_adminserver
>-if kerberos_kpasswdserver:
>-	print '\tkpasswd_server = %s' % kerberos_kpasswdserver
>-print '}'
>+print '''
>+[realms]
>+%(kerberos/realms)s = {
>+	kdc = %(kerberos/kdc)s
>+	admin_server = %(kerberos/adminserver)s
>+	kpasswd_server = %(kerberos/kpasswdserver)s
>+}''' % configRegistry
> 
> windows_domain = configRegistry.get('windows/domain')
> if windows_domain and windows_domain != kerberos_realm and is_samba4_dc():
>-	if configRegistry.get('kerberos/realm'):
>-		print ''
>-	else:
>-		print '[realms]'
>-	print '%s = { ' % windows_domain
>-	print '\tkdc = %s' % (kerberos_kdc or "127.0.0.1:88")
>-	print '\tadmin_server = %s' % (kerberos_adminserver or "127.0.0.1:88")
>-	print '\tdefault_domain = %s' % configRegistry['domainname']
>-	print '}'
>+	print '''
>+%(windows/domain)s = {
>+	kdc = %(kerberos/kdc)s
>+	admin_server = %(kerberos/adminserver)s
>+	default_domain = %(domainnames)s
>+}''' % configRegistry
> 
>-print '''[kdc]
>+print '''
>+[kdc]
> hdb-ldap-create-base = cn=kerberos,%(ldap/base)s
>-''' % configRegistry
>+database = {
>+	dbname = ldap:%(ldap/base)s
>+	realm = %(kerberos/realm)s
>+	mkey_file = /var/heimdal/m-key
>+	acl_file = /var/lib/heimdal-kdc/kadmind.acl
>+	log_file = /var/log/heimdal-database.log
>+}''' % configRegistry
> 
>-print '[kadmin]'
> if configRegistry.get('kerberos/kadmin/default/keys'):
>-	print '\tdefault_keys = %s' % configRegistry.get('kerberos/kadmin/default/keys')
>-
>-print '''database = {
>-	label = {
>-		acl_file = /var/lib/heimdal-kdc/kadmind.acl
>-		dbname = ldap:%(ldap_base)s
>-		realm = %(kerberos_realm)s''' % {"ldap_base": configRegistry['ldap/base'],
>-			"kerberos_realm": kerberos_realm}
>+	print '''
>+[kadmin]
>+	default_keys = %(kerberos/kadmin/default/keys)s
>+''' % configRegistry
> @!@
>-		log_file = /var/log/heimdal-database.log
>-		mkey_file = /var/heimdal/m-key
>-	}
>-}
>diff --git a/base/univention-heimdal/debian/univention-heimdal-common.univention-config-registry-variables b/base/univention-heimdal/debian/univention-heimdal-common.univention-config-registry-variables
>index 2d8d11c351..21d8108dac 100644
>--- a/base/univention-heimdal/debian/univention-heimdal-common.univention-config-registry-variables
>+++ b/base/univention-heimdal/debian/univention-heimdal-common.univention-config-registry-variables
>@@ -62,47 +62,41 @@ Categories=service-heimdal
> [kerberos/defaults/dns_lookup_realm]
> Description[de]=Die Abbildung zusÃ¤tzliche DNS-DomÃ¤nennamen zu Kerberos-Realms erfolgt in der Regel Ã¼ber die Variable 'kerberos/domain_realms'. Wird diese Variable auf 'true' gesetzt, wird die Kerberos-Realm aus einem TXT-Record im DNS ausgelesen werden. Das Format wird unter <http://web.mit.edu/Kerberos/krb5-1.6/krb5-1.6.3/doc/krb5-admin.html#Mapping-Hostnames-onto-Kerberos-Realms> beschrieben. Ist die Variable nicht gesetzt, wird auf die AuflÃ¶sung per DNS verzichtet.
> Description[en]=Additional DNS domainnames can be mapped on Kerberos realms using the variable 'kerberos/domain_realms'. If this variable is set to 'true', the Kerberos realm is read from a TXT record in DNS. The format is described at <http://web.mit.edu/Kerberos/krb5-1.6/krb5-1.6.3/doc/krb5-admin.html#Mapping-Hostnames-onto-Kerberos-Realms>. If the variable is unset, no DNS lookups are made.
>-Type=str
>+Type=bool
> Categories=service-heimdal
> 
> [kerberos/defaults/dns_lookup_kdc]
> Description[de]=Ist diese Variable auf 'true' gesetzt oder nicht gesetzt, wird der/die KDC-Server fÃ¼r das System aus DNS-Service-Records gelesen. Dies kann durch Setzen der Variable auf 'false' deaktiviert werden, in welchem Fall der/die KDCs Ã¼ber die Variable 'kerberos/kdc' konfiguriert werden muss.
> Description[en]=If this variable is set to 'true' or unset, the KDC(s) used by the system are read from DNS service records. This can be disabled by setting the variable to 'false', is which case the KDC(s) must be set through the variable 'kerberos/kdc'.
>-Type=str
>+Type=bool
> Categories=service-heimdal
> 
> [kerberos/defaults/forwardable]
> Description[de]=Ist diese Variable auf 'true' gesetzt ist, kann ein ausgestelltes Kerberos-Ticket auch fÃ¼r die Anmeldung an weiteren Systemen der DomÃ¤ne verwendet werden. Wird sie auf 'false' gesetzt, ist das Ticket an eine IP-Adresse gebunden. Ist die Variable nicht gesetzt, ist die Option aktiviert.
> Description[en]=If this variable is set to 'true', an issued Kerberos ticket can be used for logging into additional systems of the domain. If set to 'false', the ticket is bound to an IP address. If the variable is unset, the option is deactivated.
>-Type=str
>+Type=bool
> Categories=service-heimdal
> 
> [kerberos/defaults/proxiable]
> Description[de]=Ist diese Variable auf 'true' gesetzt oder nicht gesetzt, ist das Ticket Granting Ticket nicht auf eine IP-Adresse beschrÃ¤nkt.
> Description[en]=If this variable is set to 'true' or not set, the ticket granting ticket is not limited to an IP address.
>-Type=str
>+Type=bool
> Categories=service-heimdal
> 
> [kerberos/defaults/kdc_timesync]
>-Description[de]=Wenn diese Variable auf '1' gesetzt ist, kann ein Kerberos-Client Unterschiede zwischen der lokalen Rechneruhr und der Uhr des KDCs ausgleichen. Um die Option zu verwenden, muss zusÃ¤tzlich der Typ des Credential-Caches angepasst werden (Option 'ccache_type').
>-Description[en]=If this is set to '1', Kerberos clients can balance differences between the time of the local clock and the clock of the KDC. To use this option, the type of the credentials cache need to be adapted (option 'ccache_type').
>-Type=str
>-Categories=service-heimdal
>-
>-[kerberos/defaults/debug]
>-Description[de]=Wird diese Variable auf 'true' gesetzt, werden zusÃ¤tzliche Debugausgaben protokolliert.
>-Description[en]=If this variable is set to 'true' additional debug statements are logged.
>-Type=str
>+Description[de]=Wenn diese Variable auf 'true' gesetzt ist, kann ein Kerberos-Client Unterschiede zwischen der lokalen Rechneruhr und der Uhr des KDCs ausgleichen. Um die Option zu verwenden, muss zusÃ¤tzlich der Typ des Credential-Caches angepasst werden (Option 'ccache_type').
>+Description[en]=If this is set to 'true', Kerberos clients can balance differences between the time of the local clock and the clock of the KDC. To use this option, the type of the credentials cache need to be adapted (option 'ccache_type').
>+Type=bool
> Categories=service-heimdal
> 
> [kerberos/defaults/ignore_acceptor_hostname]
> Description[de]=Wird diese Variable auf 'true' gesetzt, wird der hostname des aufrufenden Programms ignoriert, und Clients dÃ¼rfen mit jedem Service Prinzipal in der keytab authentifizieren, der dem Service- und Realmnamen entspricht (sofern angegeben). Falls die Variable nicht gesetzt ist, dann gilt  die Voreinstellung der MIT Kerberos Bibliothek ('false').
> Description[en]=If this variable is set to 'true', any hostname passed by the calling application is ignored, and clients are allowed to authenticate to any service principal in the keytab matching the service name and realm name (if given). If the variable is unset the default of the MIT Kerberos library applies ('false').
>-Type=str
>+Type=bool
> Categories=service-heimdal
> 
> [kerberos/defaults/rdns]
> Description[de]=Wird diese Variable auf 'true' gesetzt, dann werden beim Anfordern eines Service Tickets Hostnamen nicht nur mit Hilfe von DNS in FQDNs umgewandelt, sondern zusÃ¤tzlich auch noch rÃ¼ckwÃ¤rts aufelÃ¶st. FÃ¼r Dienste, die Ã¼ber DNS-Aliase angesprochen werden, kann das nicht gewÃ¼nscht sein. Falls die Variable nicht gesetzt ist, dann gilt die Voreinstellung der MIT Kerberos Bibliothek ('true').
> Description[en]=If this variable is set to 'true', reverse DNS lookup will be used in addition to forward DNS lookup to canonicalizing hostnames for use in service principal names. This may be undesirable for serices accessed via DNS alias. If the variable is unset the default of the MIT Kerberos library applies ('true').
>-Type=str
>+Type=bool
> Categories=service-heimdal
>-- 
>2.11.0
>

Actions: View | Diff

Attachments on bug 46530: 9442