View | Details | Raw Unified | Return to bug 47974
Collapse All | Expand All

(-)conffiles/etc/cron.d/univention-ldap (-2 / +2 lines)
 Lines 2-11    Link Here 
2 

          2
          

        

        

          3
          
PATH=/usr/sbin:/usr/bin:/sbin:/bin

          3
          
PATH=/usr/sbin:/usr/bin:/sbin:/bin

        

        

          4
          

          4
          

        

          
            

              5
              
# recreate dh paramter files for forward secrecy


              5
              
# re-create dh parameter files for forward secrecy on a regular basis

            

        

          6
          
@!@

          6
          
@!@

        

        

          7
          
script = '/usr/share/univention-ldap/create-dh-parameter-files'

          7
          
script = '/usr/share/univention-ldap/create-dh-parameter-files'

        

          
            

              8
              
interval = configRegistry.get('ldap/tls/dh/cron', '30 4  * * *')


              8
              
interval = configRegistry.get('ldap/tls/dh/cron')

            

        

          9
          
if interval:

          9
          
if interval:

        

        

          10
          
	print '%s	root	%s' % (interval, script)

          10
          
	print '%s	root	%s' % (interval, script)

        

        

          11
          
@!@

          11
          
@!@

        



(-)conffiles/etc/ldap/slapd.conf.d/30univention-ldap-server_head
      (-1 / +1 lines)




  

    

    

       Lines 15-21
       
    
  Link Here 
    

  

        

          15
          
if protocol:

          15
          
if protocol:

        

        

          16
          
	print 'TLSProtocolMin	%s' % (protocol,)

          16
          
	print 'TLSProtocolMin	%s' % (protocol,)

        

        

          17
          
from os.path import exists

          17
          
from os.path import exists

        

          
            

              18
              
filename = configRegistry.get("ldap/tls/dh/paramfile", "/etc/ldap/dh_2048.pem")


              18
              
filename = configRegistry.get("ldap/tls/dh/paramfile")

            

        

          19
          
if filename and exists(filename):

          19
          
if filename and exists(filename):

        

        

          20
          
	print 'TLSDHParamFile	%s' % (filename,)

          20
          
	print 'TLSDHParamFile	%s' % (filename,)

        

        

          21
          
@!@

          21
          
@!@

        



(-)debian/changelog
      (+12 lines)




  

    

    

       Lines 1-3
       
    
  Link Here 
    

  

            

              
              
              1
              
univention-ldap (11.0.12-11) unstable; urgency=low

            

            

              2
              

            

            

              3
              
  * Bug #38685: Disable DH parameter creation by default

            

            

              4
              

            

            

              5
              
 -- Philipp Hahn <hahn@univention.de>  Mon, 20 Jul 2015 11:58:17 +0200

            

            

              6
              

            

            

              7
              
univention-ldap (11.0.12-10) unstable; urgency=low

            

            

              8
              

            

            

              9
              
  * Bug #38685: Make SSL/TLS ciphers configurable

            

            

              10
              

            

            

              11
              
 -- Philipp Hahn <hahn@univention.de>  Fri, 17 Jul 2015 08:03:11 +0200

            

            

              12
              

            

        

          1
          
univention-ldap (11.0.12-9) unstable; urgency=low

          13
          
univention-ldap (11.0.12-9) unstable; urgency=low

        

        

          2
          

          14
          

        

        

          3
          
  * Bug #38584: Remove DHCP policy references

          15
          
  * Bug #38584: Remove DHCP policy references

        



(-)debian/univention-ldap-server.postinst
      (-2 / +3 lines)




  

    

    

       Lines 84-91
       
    
  Link Here 
    

  

        

          84
          
	security/packetfilter/package/univention-ldap-server/tcp/7636/all/en="LDAPS"

          84
          
	security/packetfilter/package/univention-ldap-server/tcp/7636/all/en="LDAPS"

        

        

          85
          
[ -x "/etc/init.d/univention-firewall" ] && invoke-rc.d univention-firewall restart

          85
          
[ -x "/etc/init.d/univention-firewall" ] && invoke-rc.d univention-firewall restart

        

        

          86
          

          86
          

        

            

              87
              
[ -f /etc/ldap/dh_2048.pem ] || cp /usr/share/univention-ldap/dh_2048.pem /etc/ldap/

              
              
            

            

              88
              

            

        

          89
          
ucr set \

          87
          
ucr set \

        

        

          90
          
	ldap/debug/level?0 \

          88
          
	ldap/debug/level?0 \

        

        

          91
          
	slapd/port?"7389,389" \

          89
          
	slapd/port?"7389,389" \

        

  

    

    

       Lines 108-113
       
    
  Link Here 
    

  

        

          108
          
	ldap/tls/dh/paramfile?/etc/ldap/dh_2048.pem \

          106
          
	ldap/tls/dh/paramfile?/etc/ldap/dh_2048.pem \

        

        

          109
          
	ldap/maxopenfiles?8192 # Bug #17705

          107
          
	ldap/maxopenfiles?8192 # Bug #17705

        

        

          110
          

          108
          

        

            

              
              
              109
              
paramfile="$(ucr get ldap/tls/dh/paramfile)"

            

            

              110
              
[ -n "$paramfile" ] && [ ! -f "$paramfile" ] && cp /usr/share/univention-ldap/dh_2048.pem "$paramfile"

            

            

              111
              

            

        

          111
          
# UDM Property Attributes

          112
          
# UDM Property Attributes

        

        

          112
          
udm_prop_attrs="univentionUDMPropertyVersion,univentionUDMPropertyModule,univentionUDMPropertyShortDescription,univentionUDMPropertyLongDescription,univentionUDMPropertySyntax,univentionUDMPropertyMultivalue,univentionUDMPropertyDefault,univentionUDMPropertyLdapMapping,univentionUDMPropertyObjectClass,univentionUDMPropertyDeleteObjectClass,univentionUDMPropertyValueMayChange,univentionUDMPropertyLayoutTabName,univentionUDMPropertyLayoutOverwriteTab,univentionUDMPropertyLayoutOverwritePosition,univentionUDMPropertyLayoutPosition,univentionUDMPropertyCLIName,univentionUDMPropertyTranslationShortDescription,univentionUDMPropertyTranslationLongDescription,univentionUDMPropertyTranslationTabName,univentionUDMPropertyOptions,univentionUDMPropertyLayoutTabAdvanced,univentionUDMPropertyValueRequired,univentionUDMPropertyHook,univentionUDMPropertyDoNotSearch"

          113
          
udm_prop_attrs="univentionUDMPropertyVersion,univentionUDMPropertyModule,univentionUDMPropertyShortDescription,univentionUDMPropertyLongDescription,univentionUDMPropertySyntax,univentionUDMPropertyMultivalue,univentionUDMPropertyDefault,univentionUDMPropertyLdapMapping,univentionUDMPropertyObjectClass,univentionUDMPropertyDeleteObjectClass,univentionUDMPropertyValueMayChange,univentionUDMPropertyLayoutTabName,univentionUDMPropertyLayoutOverwriteTab,univentionUDMPropertyLayoutOverwritePosition,univentionUDMPropertyLayoutPosition,univentionUDMPropertyCLIName,univentionUDMPropertyTranslationShortDescription,univentionUDMPropertyTranslationLongDescription,univentionUDMPropertyTranslationTabName,univentionUDMPropertyOptions,univentionUDMPropertyLayoutTabAdvanced,univentionUDMPropertyValueRequired,univentionUDMPropertyHook,univentionUDMPropertyDoNotSearch"

        

        

          113
          
# recommended index settings

          114
          
# recommended index settings

        



(-)scripts/create-dh-parameter-files
      (-1 / +1 lines)




  

    

    

       Lines 38-44
       
    
  Link Here 
    

  

        

          38
          
tmp=$(mktemp "$paramfile.XXXXXXXXXX")

          38
          
tmp=$(mktemp "$paramfile.XXXXXXXXXX")

        

        

          39
          
trap "cat '$log';rm -f '$tmp' '$log'" EXIT

          39
          
trap "cat '$log';rm -f '$tmp' '$log'" EXIT

        

        

          40
          

          40
          

        

          
            

              41
              
openssl gendh -out "$tmp" -2 2048


              41
              
openssl dhparam -out "$tmp" -2 2048

            

        

          42
          
chmod 644 "$tmp"

          42
          
chmod 644 "$tmp"

        

        

          43
          
mv "$tmp" "$paramfile"

          43
          
mv "$tmp" "$paramfile"

        

        

          44
          

          44
          

        






  

  Return to bug 47974