[Da-tools-commits] ./da-tools/userdir-ldap-common r395: Merge from Debian
Joerg Jaspert
joerg at debian.org
Sun May 18 10:49:46 UTC 2008
------------------------------------------------------------
revno: 395
committer: Joerg Jaspert <joerg at debian.org>
branch nick: userdir-ldap-common
timestamp: Sun 2008-05-18 12:49:46 +0200
message:
Merge from Debian
modified:
debian/changelog
ud-generate
ud-mailgate
ud-replicate
------------------------------------------------------------
revno: 349.5.7
committer: Peter Palfrader <peter at palfrader.org>
branch nick: userdir-ldap
timestamp: Sat 2008-05-17 11:18:45 +0200
message:
better check for ssh1 keys (which we do not accept). Merged from alioth but slightly improved regex
modified:
debian/changelog
ud-mailgate
------------------------------------------------------------
revno: 349.5.8
committer: Peter Palfrader <peter at palfrader.org>
branch nick: userdir-ldap
timestamp: Sat 2008-05-17 11:22:00 +0200
message:
ud-replicate: Also support the imposter dchroot-dsa from the debian archive [aba]
modified:
debian/changelog
ud-replicate
------------------------------------------------------------
revno: 349.5.9
committer: Peter Palfrader <peter at palfrader.org>
branch nick: userdir-ldap
timestamp: Sat 2008-05-17 11:27:06 +0200
message:
ud-generate: Add support for generation of authorized_keys file on the db host
for the sshdist user. This is now possible since ud-replicate clients use
their ssh host key to authenticate to the db server. The code now supports
this but the feature is still disabled. [aba]
modified:
debian/changelog
ud-generate
------------------------------------------------------------
revno: 349.5.10
committer: Peter Palfrader <peter at palfrader.org>
branch nick: userdir-ldap
timestamp: Sat 2008-05-17 11:30:01 +0200
message:
ud-generate: Add performance optimization by resolving IP adresses for hosts
only once and caching the result. [aba]
modified:
debian/changelog
ud-generate
------------------------------------------------------------
revno: 349.5.11
committer: Peter Palfrader <peter at palfrader.org>
branch nick: userdir-ldap
timestamp: Sat 2008-05-17 11:30:38 +0200
message:
merge from alioth: aba: add myself to copyright holders
modified:
ud-generate
------------------------------------------------------------
revno: 349.5.12
committer: Peter Palfrader <peter at palfrader.org>
branch nick: userdir-ldap
timestamp: Sat 2008-05-17 11:39:20 +0200
message:
ud-replicate, ud-generate: Instead of one big ssh-rsa-shadow file ud-generate
now produces per-user authorized_keys files and tars them up. On the receiving
end ud-replicate takes the tar and syncs it to userkeys/. The goal here is to
no longer require a patched sshd. Setting AuthorizedKeysFile2 to
/var/lib/misc/userkeys/%u is sufficient. For homedir creation we can use
pam_mkhomedir. [mhy, sgran]
modified:
debian/changelog
ud-generate
ud-replicate
userdir-ldap.conf
userdir_ldap.py
------------------------------------------------------------
revno: 349.5.13
committer: Peter Palfrader <peter at palfrader.org>
branch nick: userdir-ldap
timestamp: Sat 2008-05-17 11:40:33 +0200
message:
Fuzz with the shell in ud-replicate's sshkeys part
modified:
ud-replicate
------------------------------------------------------------
revno: 349.5.14
committer: Peter Palfrader <peter at palfrader.org>
branch nick: userdir-ldap
timestamp: Sat 2008-05-17 11:41:11 +0200
message:
Fix wording in the changelog
modified:
debian/changelog
------------------------------------------------------------
revno: 349.5.15
committer: Peter Palfrader <peter at palfrader.org>
branch nick: userdir-ldap
timestamp: Sat 2008-05-17 15:29:42 +0200
message:
Fix string vs. int issue in userlist introduced by multiple-ssh patch
modified:
ud-generate
------------------------------------------------------------
revno: 349.5.16
committer: Peter Palfrader <peter at palfrader.org>
branch nick: userdir-ldap
timestamp: Sat 2008-05-17 15:41:13 +0200
message:
And clean up the bugs I introduced while mucking with sgran's shell
modified:
ud-replicate
------------------------------------------------------------
revno: 349.5.17
committer: Peter Palfrader <peter at palfrader.org>
branch nick: userdir-ldap
timestamp: Sat 2008-05-17 15:41:24 +0200
message:
0.3.24
modified:
debian/changelog
------------------------------------------------------------
revno: 349.5.18
committer: Peter Palfrader <peter at palfrader.org>
branch nick: userdir-ldap
timestamp: Sat 2008-05-17 16:15:26 +0200
message:
Make ssh-keys.tar.gz readable only by the user.
modified:
debian/changelog
ud-generate
-------------- next part --------------
=== modified file 'debian/changelog'
--- a/debian/changelog 2008-05-16 21:00:43 +0000
+++ b/debian/changelog 2008-05-17 14:15:26 +0000
@@ -1,18 +1,30 @@
-userdir-ldap (0.3.23+common1) unstable; urgency=low
-
- [ Andreas Barth ]
- * Add compatibility to dchroot-dsa to ud-replicate.
- * Add (disabled) generation of authorized_keys suiteable for sshdist.
- * Add performance optimization by caching IP adresses in ud-generate
- (as a precondition for automatically adding aliases)
-
- [ Stephen Gran ]
- * ud-replicate: handle individual ssh keys
-
- [ Mark Hymers ]
- * ud-generate: handle individual ssh keys
-
- -- Mark Hymers <mhy at debian.org> Wed, 14 May 2008 22:09:22 +0100
+userdir-ldap (0.3.25) unstable; urgency=low
+
+ * Make ssh-keys.tar.gz readable only by the user.
+
+ -- Peter Palfrader <weasel at debian.org> Sat, 17 May 2008 16:14:56 +0200
+
+userdir-ldap (0.3.24) unstable; urgency=low
+
+ * ud-mailgate: better regex for ssh1 keys, which we reject. [joerg, weasel]
+ * ud-replicate: Also support the imposter dchroot-dsa from the debian
+ archive. [aba, weasel]
+ * ud-generate: Add support for generation of authorized_keys file on
+ the db host for the sshdist user. This is now possible since
+ ud-replicate clients use their ssh host key to authenticate to the
+ db server. The code now supports this but the feature is still
+ disabled. [aba]
+ * ud-generate: Add performance optimization by resolving IP adresses
+ for hosts only once and caching the result. [aba]
+ * ud-replicate, ud-generate: In addition to one big ssh-rsa-shadow file
+ ud-generate now produces per-user authorized_keys files and tars
+ them up. On the receiving end ud-replicate takes the tar and
+ syncs it to userkeys/. The goal here is to no longer require
+ a patched sshd. Setting AuthorizedKeysFile2 to
+ /var/lib/misc/userkeys/%u is sufficient. For homedir creation
+ we can use pam_mkhomedir. [mhy, sgran]
+
+ -- Peter Palfrader <weasel at debian.org> Sat, 17 May 2008 14:49:28 +0200
userdir-ldap (0.3.23) unstable; urgency=low
=== modified file 'ud-generate'
--- a/ud-generate 2008-05-16 21:00:43 +0000
+++ b/ud-generate 2008-05-17 14:15:26 +0000
@@ -131,7 +131,7 @@
if len(GetAttr(x,"gecos")) > 100 or len(GetAttr(x,"loginShell")) > 50:
continue;
- userlist[GetAttr(x, "uid")] = GetAttr(x, "gidNumber")
+ userlist[GetAttr(x, "uid")] = int(GetAttr(x, "gidNumber"))
Line = "%s:%s:%s:%s:%s:%s%s:%s" % (GetAttr(x,"uid"),\
PwdMarker,\
GetAttr(x,"uidNumber"),GetAttr(x,"gidNumber"),\
@@ -968,7 +968,9 @@
# Now we know who we're allowing on the machine, export
# the relevant ssh keys
if MultipleSSHFiles:
+ OldMask = os.umask(0077);
tf = tarfile.open(name=os.path.join(GlobalDir, 'ssh-keys-%s.tar.gz' % CurrentHost), mode='w:gz')
+ os.umask(OldMask);
for f in userlist.keys():
if f not in SSHFiles:
continue
@@ -983,12 +985,12 @@
# In these cases, look it up in the normal way so we
# deal with cases where, for instance, users are in group
# users as their primary group.
- grname = grp.getgrgid(int(userlist[f]))[0]
+ grname = grp.getgrgid(userlist[f])[0]
except Exception, e:
pass
if grname is None:
- print "User %s is supposed to have their key exported to host %s but their primary group (gid: %s) isn't in LDAP" % (f, CurrentHost, userlist[f])
+ print "User %s is supposed to have their key exported to host %s but their primary group (gid: %d) isn't in LDAP" % (f, CurrentHost, userlist[f])
continue
to = tf.gettarinfo(os.path.join(GlobalDir, 'userkeys', f), f)
=== modified file 'ud-mailgate'
--- a/ud-mailgate 2008-05-15 21:35:13 +0000
+++ b/ud-mailgate 2008-05-17 09:18:45 +0000
@@ -30,7 +30,7 @@
DNS = {}
SSHFingerprint = re.compile('^(\d+) ([0-9a-f\:]{47}) (.+)$')
-SSHRSA1Match = re.compile('^\d+ (\d+) \d+ .*')
+SSHRSA1Match = re.compile('^^(.* )?\d+ \d+ \d+')
ArbChanges = {"c": "..",
"l": ".*",
@@ -242,7 +242,7 @@
g = Match.groups()
typekey = g[1]
if Match == None:
- Match =SSHRSA1Match.match(Str)
+ Match = SSHRSA1Match.match(Str)
if Match is not None:
return "RSA1 keys not supported anymore"
return None;
=== modified file 'ud-replicate'
--- a/ud-replicate 2008-05-16 21:00:43 +0000
+++ b/ud-replicate 2008-05-17 13:41:13 +0000
@@ -4,7 +4,7 @@
# Copyright (c) 2002-2003,2006 Ryan Murray <rmurray at debian.org>
# Copyright (c) 2004-2005 Joey Schulze <joey at infodrom.org>
# Copyright (c) 2008 Peter Palfrader <peter at palfrader.org>
-# Copyright (?) 2008 Stephen Gran <sgran at debian.org>
+# Copyright (c) 2008 Stephen Gran <sgran at debian.org>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -78,21 +78,19 @@
ln -sf `pwd -P`/ssh_known_hosts /etc/ssh
if [ -e ${HOST}/ssh-keys.tar.gz ]; then
- export TMPDIR='/tmp/'
+ export TMPDIR='/tmp/'
tempdir=$(mktemp -d)
- old=$(pwd -P)
- cd $tempdir && tar -xf ${old}/${HOST}/ssh-keys.tar.gz
- cd $old
- mkdir userkeys 2> /dev/null || true
+ tar -C "$tempdir" -xf ${HOST}/ssh-keys.tar.gz
+ [ -d userkeys ] || mkdir userkeys
chmod 755 $tempdir
rsync -a --delete-after $tempdir/ userkeys/
fi
+CHROOTS=""
if [ -x /usr/bin/dchroot ]; then
CHROOTS=`dchroot --listpaths`
-fi
-if [ -x /usr/bin/dchroot-dsa ]; then
- CHROOTS=$(dchroot-dsa -i | grep Location | awk '{print $2}')
+elif [ -x /usr/bin/dchroot-dsa ]; then
+ CHROOTS=$(dchroot-dsa -i | grep Location | awk '{print $2}')
fi
if [ -n "$CHROOTS" ]; then
for c in $CHROOTS; do
More information about the Da-tools-commits
mailing list