openldap-bugs

openldap-bugs@openldap.org

1 participants
20963 discussions

(ITS#6704) Patch - Mozilla NSS - use both cacert and cacertdir
by rmeggins＠redhat.com 12 Nov '10

12 Nov '10

Full_Name: Rich Megginson Version: 2.4.23 (current CVS HEAD) OS: RHEL5 URL: ftp://ftp.openldap.org/incoming/openldap-2.4.23-use_both_cacert_and_cacertd… Submission from: (NULL) (76.113.111.209) The code should attempt to use both TLS_CACERT and TLS_CACERTDIR if both are specified. This patch file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Red Hat. Red Hat has not assigned rights and/or interest in this work to any party. I, Rich Megginson am authorized by Red Hat, my employer, to release this work under the following terms. Red Hat hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

(ITS#6703) Patch - Mozilla NSS - reject non-file key and cert files
by rmeggins＠redhat.com 12 Nov '10

12 Nov '10

Full_Name: Rich Megginson Version: 2.4.23 (current CVS HEAD) OS: RHEL5 URL: ftp://ftp.openldap.org/incoming/openldap-2.4.23-reject_non_file_key_cert_pe… Submission from: (NULL) (76.113.111.209) If you specify a directory instead of a file to TLS_CACERT, or if one of the items in the TLS_CACERTDIR is a directory, the NSS PEM reader will crash. This patch rejects any item which looks like a directory. This patch file is derived from OpenLDAP Software. All of the modifications to OpenLDAP Software represented in the following patch(es) were developed by Red Hat. Red Hat has not assigned rights and/or interest in this work to any party. I, Rich Megginson am authorized by Red Hat, my employer, to release this work under the following terms. Red Hat hereby place the following modifications to OpenLDAP Software (and only these modifications) into the public domain. Hence, these modifications may be freely used and/or redistributed for any purpose with or without attribution and/or other notice.

1 0

Re: (ITS#6702) slappasswd prompts missing
by d＠delphij.net 12 Nov '10

12 Nov '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 11/11/10 20:51, David Gessel wrote: > Excellent. > > Xin Li had a partial patch earlier tonight that got the prompts directed properly to console. Thanks. To Howard, I think getpassphrase(3) is Solaris specific interface and not part of standard. On FreeBSD, getpass(3) returns a buffer pointer that contains at most 128 (_PASSWORD_LEN) characters, which should fulfill the need of OpenBSD but shorter than Solaris[1] which have 256, not counting the terminating nul character. Note that FreeBSD do have a readpassphrase(3) extension which provide more flexibility. I am not sure, however, whether we should implement the Solaris behavior for getpassphrase(3), as it's not a standard defined interface? Is there any other operating system that provide getpassphrase(3) and have the same behavior? If it's desirable we could have it implemented on FreeBSD this way: ================= char * getpassrase(const char *prompt) { static char buf[256 + 1]; return(readpassphrase(prompt, buf, sizeof(buf), RPP_ECHO_OFF)); } ================= Please advise, thanks! [1] http://docs.sun.com/app/docs/doc/816-5168/getpassphrase-3c?l=en&n=1&a=view > -------- Original Message -------- > Subject: Re: (ITS#6702) slappasswd prompts missing > From: Howard Chu <hyc(a)symas.com> > To: gessel(a)blackrosetech.com > Date: Thu Nov 11 2010 19:18:29 GMT-0800 (Pacific Standard Time) > >> Apparently FreeBSD doesn't provide a usable getpassphrase() in its libc, so a >> replacement in the OpenLDAP code is used instead. The OpenLDAP code is now >> fixed in HEAD. >> - -- Xin LI <delphij(a)delphij.net> http://www.delphij.net/ FreeBSD - The Power to Serve! Live free or die -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (FreeBSD) iQEcBAEBCAAGBQJM3YW3AAoJEATO+BI/yjfB2jsIANUBBR2Cu/uhd7w8SDmfWJkL UcibY5xL4i1gg2CM2DR/SgVqUYF/SHnGmMECgmu7CVRvXRNPn7Zp7TzhfYJgM7SJ lYqE5+uajyGUt3N3z7bB4BT9GF6PTyXhWUDsdxc1IHcQ2Dvpq/3Ih7vuCQmAimCv NJ9CXQYJPLflRo8RAMmNtiYeiZjMWK9PjrfC7CuAYKPvhKGFMQ5o7NXBZ8T+16WC Igbw7DKALAPBZmV2hXbwMQAYJ8hBUkDlph2U8k7zBTfIkWSqx+DDeY/CaOmUnb9A puUTm3WEYI2MxwlOVLnvy7QRNFsXejFvXkZN5ZTPoDbBT7MZRFrOn9gKQRGF4D8= =9iQc -----END PGP SIGNATURE-----

1 0

Re: (ITS#6702) slappasswd prompts missing
by gessel＠blackrosetech.com 11 Nov '10

11 Nov '10

Excellent. Xin Li had a partial patch earlier tonight that got the prompts directed properly to console. -------- Original Message -------- Subject: Re: (ITS#6702) slappasswd prompts missing From: Howard Chu <hyc(a)symas.com> To: gessel(a)blackrosetech.com Date: Thu Nov 11 2010 19:18:29 GMT-0800 (Pacific Standard Time) > gessel(a)blackrosetech.com wrote: >> Note: on editing slapd.conf, I see that prompt IO is directed to the file, not to the console. That is the file contains the prompts: >> "rootpw New password:" >> "Re-enter new password:" >> >> >> > Apparently FreeBSD doesn't provide a usable getpassphrase() in its libc, so a > replacement in the OpenLDAP code is used instead. The OpenLDAP code is now > fixed in HEAD. >

1 0

Re: (ITS#6702) slappasswd prompts missing
by hyc＠symas.com 11 Nov '10

11 Nov '10

gessel(a)blackrosetech.com wrote: > Note: on editing slapd.conf, I see that prompt IO is directed to the file, not to the console. That is the file contains the prompts: > "rootpw New password:" > "Re-enter new password:" > > > Apparently FreeBSD doesn't provide a usable getpassphrase() in its libc, so a replacement in the OpenLDAP code is used instead. The OpenLDAP code is now fixed in HEAD. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6701) Update to man8 slappasswd: English usage
by hyc＠symas.com 11 Nov '10

11 Nov '10

diver06(a)gmx.net wrote: > Full_Name: Simon Wright > Version: 2.4.23 > OS: FreeBSD > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (212.98.32.54) > > > The man page for slappasswd says that encryption scheme names need to be > protected due to "{". This is wrong usage: scheme names may need to be protected > *by* "{" Wrong. The manpage text is correct. The '{' and '}' are part of the scheme names. Since these are also meta-characters in common command shells, they may need to be protected from expansion. This ITS will be closed. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#6702) slappasswd prompts missing
by gessel＠blackrosetech.com 11 Nov '10

11 Nov '10

Note: on editing slapd.conf, I see that prompt IO is directed to the file, not to the console. That is the file contains the prompts: "rootpw New password:" "Re-enter new password:"

1 0

(ITS#6702) slappasswd prompts missing
by gessel＠blackrosetech.com 11 Nov '10

11 Nov '10

Full_Name: David Gessel Version: openldap-sasl-server-2.4.23 OS: FreeBSD 8.1 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (66.93.181.141) Attempting to insert a hash of the root pw into slapd.conf with the command: # slappasswd >> slapd.conf yields a blank prompt, that is there is no feedback to prompt the user along the lines of: "Enter root password" and "Verify root password" But entering the root password twice with no feedback (and blank characters for security, so completely blind) gets through the command successfully.

1 0

(ITS#6701) Update to man8 slappasswd: English usage
by diver06＠gmx.net 11 Nov '10

11 Nov '10

Full_Name: Simon Wright Version: 2.4.23 OS: FreeBSD URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (212.98.32.54) The man page for slappasswd says that encryption scheme names need to be protected due to "{". This is wrong usage: scheme names may need to be protected *by* "{" Patch: --- openldap-2.4.23/doc/man/man8/slappasswd.8 2010-04-13 22:22:46.000000000 +0200 +++ slappasswd.8 2010-11-11 16:36:28.000000000 +0100 @@ -100,7 +100,7 @@ The default is .BR {SSHA} . -Note that scheme names may need to be protected, due to +Note that scheme names may need to be protected by .B { and .BR } ,

1 0

Re: (ITS#6698) Please add BDB 5.x support for SLAPD
by hyc＠symas.com 11 Nov '10

11 Nov '10

faessler(a)was.ch wrote: > Full_Name: Dominik Fässler > Version: 2.4.23 > OS: FreeBSD (8.1-RELEASE) > URL: > Submission from: (NULL) (62.2.101.221) > > > We know that for the moment only BDB versions 4.4 - 4.8 are supported as backend > for SLAPD. > We would be happy, if you could include support for BDB versions 5.x as well. > (For now we are using 5.1) > Thanx. > Added to configure script in HEAD. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs