-userdir-ldap (0.3.15+xxx) XXunstable; urgency=low
+userdir-ldap (0.3.76) unstable; urgency=low
+
+ [ Peter Palfrader ]
+ * ud-generate: Export groups even if nobody has that group as a
+ supplementary group, as long as there are users that have it as a primary
+ group.
+ * ud-useradd: If we do not have a template for a specific group, use the
+ general purpose template file (welcome-message).
+ * ud-useradd: Fix usergroup support:
+ - Move ldap call to actually add the user to the right place,
+ - Properly compare strings and numbers.
+ * ud-useradd: Only ask for private subscription if this installation
+ has a debian-private like mailinglist whose membership is configured
+ by ud-ldap. (defaults to true.)
+ * Fix welcome-message to be like welcome-message-800 and 60000 wrt
+ email headers
+ * ud-useradd: Properly encode realname in subjects and to header lines
+ regardless of which template is being used.
+ * ud-generate: move the regex that determines whether or not to include
+ a host in the dns-sshfp zone snippet (for SSHFP and A, AAAA and MX
+ records) to the config file.
+ * Include a host in DNS even if we do not have both ssh keys and an
+ arch for that host configured.
+
+ [ Stephen Gran ]
+ * Add patches from Helmut Grohne <helmut@subdivi.de>:
+ Allow ssh keys to be exported only to specific hosts by prefixing them
+ with allowed_hosts=[host1[,host2 ...]]] when adding them using
+ ud-mailgate.
+
+ -- Stephen Gran <sgran@debian.org> Sat, 30 Jan 2010 13:33:40 +0000
+
+userdir-ldap (0.3.75) unstable; urgency=low
+
+ * Enable support for mailDefaultOptions
+ * Make a stab at really not exporting empty groups.
+
+ -- Stephen Gran <sgran@debian.org> Mon, 16 Nov 2009 21:36:53 +0000
+
+userdir-ldap (0.3.74) unstable; urgency=low
+
+ [ Peter Palfrader ]
+ * ud-generate: Make sure we only add people in gid 800 to debian-private.
+ (DebianUsers was just a copy of PasswdAttrs. So use PasswdAttrs in
+ all the places that currently use DebianUsers. Make a filtered list
+ DebianDDUsers (accounts in gid 800), and use that for building the
+ debian-private subscription list.)
+ * welcome-message-60000: improve wording of a sentence. Sometimes less
+ is more.
+
+ [ Stephen Gran ]
+ * Initial support for BATV token storage.
+ * generate a new file for mail forwards for users present on this machine
+
+ -- Stephen Gran <sgran@debian.org> Sun, 15 Nov 2009 11:54:41 +0000
+
+userdir-ldap (0.3.73) unstable; urgency=low
+
+ * Add dnsTTL host attribute to override the zone default TTL
+ for A and AAAA records. Also for MX, HINFO and SSHFP.
+
+ -- Peter Palfrader <weasel@debian.org> Sun, 18 Oct 2009 12:38:51 +0200
+
+userdir-ldap (0.3.72) unstable; urgency=low
+
+ [ Peter Palfrader ]
+ * ud-useradd: Allow unsetting of middle names by entering a space.
+ * userdir-ldap.conf: Add debian-maintainers.gpg to keyrings and
+ sync_keyrings.
+ * ud-useradd: force gidNumber to be an int when we open the welcome
+ template (it can be different when we read it from input using -n).
+ * Tweak templates/welcome-message-60000.
+ * ud-generate: don't blow up when a host does not have IP-addresses.
+ * We autogenerate the authorized_keys files for sshdist on db-master.
+ It limits the hosts' ssh key to coming from their respective addresses.
+ Now we can add additional source addresses to accept for this since
+ not all hosts appear to come from their published address (or have
+ a published address for that matter).
+
+ [ Stephen Gran ]
+ * Make zone reloads work when ud-generate updates zone files
+
+ -- Stephen Gran <sgran@debian.org> Mon, 05 Oct 2009 00:54:43 +0100
+
+userdir-ldap (0.3.71) unstable; urgency=low
+
+ * Enable autogeneration of DNS records for .d.o hosts
+
+ -- Stephen Gran <sgran@debian.org> Sun, 23 Aug 2009 12:50:01 +0000
+
+userdir-ldap (0.3.70) unstable; urgency=low
+
+ * Enable autogeneration of sshdist's authorized_keys file
+
+ -- Stephen Gran <sgran@debian.org> Sun, 09 Aug 2009 16:10:35 +0000
+
+userdir-ldap (0.3.69) unstable; urgency=low
+
+ * Make ud-host do allowedGroups, exportOptions.
+
+ -- Peter Palfrader <weasel@debian.org> Thu, 23 Jul 2009 22:52:08 +0200
+
+userdir-ldap (0.3.68) unstable; urgency=low
+
+ * userdir-ldap.conf: localsyncon = "*draghi*"
+ * userdir-ldap-slapd.conf.in: database hdb
+ * schema: allowedGroups, exportOptions attribute for servers
+ * Move away from generate.conf and use the information provided in
+ the ldap.
+
+ -- Peter Palfrader <weasel@debian.org> Thu, 23 Jul 2009 22:32:44 +0200
+
+userdir-ldap (0.3.67) unstable; urgency=low
+
+ [ Stephen Gran ]
+ * ud-replicate no longer uses localsyncon=*samosa*.
+ * ud-generate cleanup:
+ - general code tidy (whitespace, semi-colons, python idioms)
+ - loop cleanup, so that fewer redundant checks are done
+ - split groups up so mail is only handled for gid Debian
+ - Stop exporting information about retired developers
+ - Stop exporting locked accounts
+ - begin cleanup of use of string exceptions
+
+ [ Peter Palfrader ]
+ * .debian.net DNS creates BSMTP maps for MX 0 master in addition to gluck.
+ * .debian.net DNS no longer creates BSMTP maps for MX 0 gluck.
+ * Remove mailSpamOptOut ldap attribute - it isn't used anywhere.
+ * schema, ud-info, ud-mailgate, ud-generate: Add mailContentInspectionAction
+ attribute. Possible values are reject, blackhole and markup.
+
+ -- Peter Palfrader <weasel@debian.org> Tue, 14 Jul 2009 11:02:27 +0200
+
+userdir-ldap (0.3.66) unstable; urgency=low
+
+ * We would previously ignore purpose hosts for ssh known hosts purposes
+ if the service name would not start the purpose field. Fix this.
+
+ -- Peter Palfrader <weasel@debian.org> Fri, 01 May 2009 17:10:05 +0200
+
+userdir-ldap (0.3.65) unstable; urgency=low
+
+ * userdir-ldap.conf: remove from default keyrings:
+ - /home/jgg/keys/extrakeys.gpg
+ - /home/jgg/keys/guest-keys.gpg
+
+ -- Peter Palfrader <weasel@debian.org> Mon, 06 Apr 2009 01:40:37 +0200
+
+userdir-ldap (0.3.64) unstable; urgency=low
+
+ * userdir-ldap.conf: add keyring.pgp to default add_keyrings.
+ * userdir_gpg.py: add a ClearKeyrings().
+ * ud-gpgimport: work on add_keyrings if no keyrings are given on the
+ command line.
+
+ -- Peter Palfrader <weasel@debian.org> Mon, 06 Apr 2009 01:35:12 +0200
+
+userdir-ldap (0.3.63) unstable; urgency=low
+
+ * Print gpg's exit status when it fails.
+
+ -- Peter Palfrader <weasel@debian.org> Mon, 23 Mar 2009 12:39:27 +0100
+
+userdir-ldap (0.3.62) unstable; urgency=low
+
+ * ud-generate: do not die when building ssh_known_hosts
+ just because a host is not (yet) in DNS.
+
+ -- Peter Palfrader <weasel@debian.org> Fri, 20 Mar 2009 16:35:02 +0100
+
+userdir-ldap (0.3.61) unstable; urgency=low
+
+ * Gratuitous version increment
+
+ -- Stephen Gran <sgran@debian.org> Sat, 28 Feb 2009 12:42:45 +0000
+
+userdir-ldap (0.3.60) unstable; urgency=low
+
+ * Stop using string exceptions in ud-mailgate. We should probably stop
+ using them everywhere, but this one is causing bounces, so we'll deal with
+ it first.
+ * Create an exception generator to make it easy to create new types of
+ exceptions.
+ * Actually install the new exceptions module
+
+ -- Stephen Gran <sgran@debian.org> Sat, 28 Feb 2009 12:10:35 +0000
+
+userdir-ldap (0.3.59) unstable; urgency=low
+
+ * Role accounts may have dnsZoneEntry attributes.
+ * ud-generate: and export dns zones to the zonefile for roleaccounts.
+ * Remove a lie from welcome-message-60000 - not that it's the only one.
+ * Apply patch to welcome-message-800 provided by Sandro Tosi:
+ - some machines/services have been renamed
+ - point to http://wiki.debian.org/MigrateToDDAccount
+ * More tweaks on welcome-message-800.
+
+ -- Peter Palfrader <weasel@debian.org> Wed, 07 Jan 2009 17:13:09 +0100
+
+userdir-ldap (0.3.58) unstable; urgency=low
+
+ * ud-info: Fix regression from r493: When we log in as admin user and modify
+ another user we got shown that other user but all changes would be made
+ against our own record.
+
+ -- Peter Palfrader <weasel@debian.org> Fri, 19 Dec 2008 09:25:20 +0100
+
+userdir-ldap (0.3.57) unstable; urgency=low
+
+ * In ud-mailgate use an empty envelope from when sending error messages.
+
+ -- Peter Palfrader <weasel@debian.org> Thu, 18 Dec 2008 10:03:35 +0100
+
+userdir-ldap (0.3.56) unstable; urgency=low
+
+ * There is a deadlock situation when ud-mailgate gets a mail claiming
+ to be from itself:
+ - ud-mailgate opens and locks the replay cache
+ - verification of the mail fails for whatever reason
+ - a reply is sent (to itself)
+ - exim tries to deliver the mail by directly calling ud-mailgate
+ - ud-mailgate tries to acquire the lock -> deadlock
+ Fix this by changing when we open the replay cache, and unlock it
+ as soon as we are done.
+
+ -- Peter Palfrader <weasel@debian.org> Wed, 17 Dec 2008 12:54:10 +0100
+
+userdir-ldap (0.3.55) unstable; urgency=low
+
+ [ Joey Schulze ]
+ * Adjust boolean value detection code to use upper case letters in the
+ end. Enable it for all three boolean attributes. Widen tabular
+ display by one character so the description fits again.
+ [ Martin Zobel-Helas ]
+ * Copy new mailSpamOptOut to debianDeveloper accounts as well
+
+ -- Joey Schulze <joey@infodrom.org> Sun, 14 Dec 2008 02:55:41 +0100
+
+userdir-ldap (0.3.54) unstable; urgency=low
+
+ [ Martin Zobel-Helas ]
+ * Add new attribute mailSpamOptOut to turn on/off spam filtering
+ entirely.
+ [ Joey Schulze ]
+ * Add support for this attribute in ud-info taking into account that
+ only boolean values are acceptable.
+ [ Thomas Viehmann ]
+ * ud-generate: Add IPv6 addresses to debianhosts.
+ * ud-info, userdir_ldap.py: remove function getpass and use the one
+ from python standard library getpass.
+
+ -- Martin Zobel-Helas <zobel@debian.org> Sun, 14 Dec 2008 02:22:55 +0100
+
+userdir-ldap (0.3.53) unstable; urgency=low
+
+ * Properly show shadowlastchange and mail disabled message when
+ locking an account, but not disabling email. It was written to
+ ldap correctly, but we updated the data to display wrongly.
+ * Fix formatting of PGP fingerprints - the double space was always
+ one element too early.
+ * Do not call FinishConfirmSudopassword if we already decided to
+ not commit this change mail because of parse errors.
+
+ -- Peter Palfrader <weasel@debian.org> Mon, 08 Dec 2008 11:39:54 +0100
+
+userdir-ldap (0.3.52) unstable; urgency=low
+
+ * Remove cruft comment.
+ * Fix group does not exist warning (layout/spacing issues).
+ * call addGroups with the proper number of arguments, when doing so
+ recursively.
+ * Also do the subgroups/transitive stuff dance when considering
+ if a user is in a group for exporting them to a host in the
+ first place.
+
+ -- Peter Palfrader <weasel@debian.org> Sun, 23 Nov 2008 22:09:07 +0100
+
+userdir-ldap (0.3.51) unstable; urgency=low
+
+ * Update template/welcome-message-800 to match the actual template used
+ on db.debian.org.
+ * Add subgroup support: A group can now have subgroups. This means
+ that if a user is a member of a group he also becomes a member of
+ all its subgroups. E.g. members of a wb-all group will automatically
+ be members of wb-i386, wb-arm, wb-mips, etc. [Luk Claes]
+ * Extend that support so that subgroups work on a per host basis too,
+ so that for instance the debbugs group can be in group
+ maillog@rietz.debian.org.
+ * Add hostnames from the host purpose field to the ssh_known_hosts
+ file [Thomas Viehmann].
+
+ -- Peter Palfrader <weasel@debian.org> Sun, 23 Nov 2008 21:22:58 +0100
+
+userdir-ldap (0.3.50) unstable; urgency=low
+
+ * ud-generate: Support $gid@$host supplementary group entries for users.
+
+ -- Peter Palfrader <weasel@debian.org> Sat, 15 Nov 2008 11:20:09 +0100
+
+userdir-ldap (0.3.49) unstable; urgency=low
+
+ * ud-replicate: Only link ssh-rsa-shadow to var/lib/misc/$host and etc/ssh
+ if it exists. Else remove the symlink.
+
+ -- Peter Palfrader <weasel@debian.org> Fri, 14 Nov 2008 23:14:58 +0100
+
+userdir-ldap (0.3.48) unstable; urgency=low
+
+ * ud-generate: Remove support for single ssh key shadow file.
+ * ud-generate: Make ssh key tarballs the default.
+ * ud-generate: Move ssh tarball generation into its own function.
+ Currently it's part of the main loop.
+
+ -- Peter Palfrader <weasel@debian.org> Fri, 14 Nov 2008 23:04:21 +0100
+
+userdir-ldap (0.3.47) unstable; urgency=low
+
+ * Fix a typo on ud-mailgate.
+
+ -- Peter Palfrader <weasel@debian.org> Fri, 14 Nov 2008 20:40:19 +0100
+
+userdir-ldap (0.3.46) unstable; urgency=low
+
+ * Change the hmac that protect sudopassword entries to also
+ hash the purpose ("sudo") and the owning user's uid into
+ the mac.
+
+ -- Peter Palfrader <weasel@debian.org> Fri, 14 Nov 2008 20:27:38 +0100
+
+userdir-ldap (0.3.45) unstable; urgency=low
+
+ * ud-generate: Declare [UNTRSUTED] flag as obsolete.
+ * ud-generate: Add [NOMARKERS] flag to not push markers (gps coordinates) to host.
+ * ud-replicate: Use --delete-after with rsync. Previously we didn't delete
+ stuff ever.
+ * ud-replicate: Sync only ssh_known_hosts into chroots, not ssh*.
+ * ud-replicate: Clean up better, correcting some mistakes done by earlier
+ versions.
+
+ -- Peter Palfrader <weasel@debian.org> Sun, 26 Oct 2008 22:31:46 +0100
+
+userdir-ldap (0.3.44) unstable; urgency=low
+
+ * ud-mailgate: Do not support del requests for sshDSAAuthKey - there is no
+ such attribute.
+ * ud-generate: do not export sudopassword to untrusted or nopasswd hosts,
+ unless the password is explicitly added for this host and not just for '*'.
+
+ -- Peter Palfrader <weasel@debian.org> Fri, 03 Oct 2008 13:23:22 +0200
+
+userdir-ldap (0.3.43) unstable; urgency=low
+
+ * FQHNs sometimes, well always, include dots.
+
+ -- Peter Palfrader <weasel@debian.org> Tue, 16 Sep 2008 15:07:21 +0200
+
+userdir-ldap (0.3.42) unstable; urgency=low
+
+ * Export all accounts into sudo-passwd, even if they
+ do not have a sudo password set. Set their password to '*' then.
+ etc/pam.d/sudo should look like this then:
+ auth [authinfo_unavail=ignore success=done ignore=ignore default=die] pam_pwdfile.so pwdfile=/var/lib/misc/thishost/sudo-passwd
+ auth required pam_unix.so nullok_secure try_first_pass
+ @include common-account
+
+ -- Peter Palfrader <weasel@debian.org> Tue, 16 Sep 2008 14:30:41 +0200
+
+userdir-ldap (0.3.41) unstable; urgency=low
+
+ * ud-generate: lower casing the sudopasswd ldap entry prior to parsing
+ and verifying it was a bad idea.
+
+ -- Peter Palfrader <weasel@debian.org> Mon, 15 Sep 2008 19:26:14 +0200
+
+userdir-ldap (0.3.40) unstable; urgency=low
+
+ * Reading the hmac key only once is too troublesome.
+
+ -- Peter Palfrader <weasel@debian.org> Mon, 15 Sep 2008 01:12:23 +0200
+
+userdir-ldap (0.3.39) unstable; urgency=low
+
+ * Lowercasing hashed sudo passwords in ud-mailgate not considered smart.
+
+ -- Peter Palfrader <weasel@debian.org> Mon, 15 Sep 2008 00:40:13 +0200
+
+userdir-ldap (0.3.38) unstable; urgency=low
+
+ * Fix order of some calls so stuff works again.
+ * And import pwd and os and the hmac crowed in userdir_ldap.py.
+ * Using the right variable name will also help.
+
+ -- Peter Palfrader <weasel@debian.org> Mon, 15 Sep 2008 00:18:37 +0200
+
+userdir-ldap (0.3.37) unstable; urgency=low
+
+ * ud-mailgate: Do not commit any changes if one of the requests is invalid
+ or could not be parsed or caused an error or anything.
+ * Add sudoPassword to schema, and the slapd.conf/ACL snippet
+ A sudoPassword entry in LDAP has the form of
+ "<uuid> unconfirmed <hostlist> <cryptedpassword>", or
+ "<uuid> confirmed:<hmac_sha1("password-is-confirmed:<uuid>:<hosts>:<cryptedpass>")> <hostlist> <cryptedpassword>"
+ * ud-mailgate: Implement confirmation of sudoPassword field:
+ A confirmationation is of the form
+ "confirm sudopassword <uuid> <hostlist> <hmac_sha1("confirm-new-password:<uuid>:<hosts>:<cryptedpass>")>"
+ * ud-generate: generate a sudo passwd file
+
+ -- Peter Palfrader <weasel@debian.org> Sun, 14 Sep 2008 23:45:36 +0200
+
+userdir-ldap (0.3.36) unstable; urgency=low
+
+ * Aha. Error is not some magic variable or exception, it's a
+ normal string that needs defining when we use it.
+
+ -- Peter Palfrader <weasel@debian.org> Sat, 19 Jul 2008 21:35:39 +0200
+
+userdir-ldap (0.3.35) unstable; urgency=low
+
+ * Check if a key has encryption capabilities and fail saying so when
+ trying to encrypt stuff (like passwords) to users. All this does is
+ give nicer error messages, it previously failed with just "gpg failed".
+
+ -- Peter Palfrader <weasel@debian.org> Sat, 19 Jul 2008 16:17:13 +0200
+
+userdir-ldap (0.3.34) unstable; urgency=low
+
+ * ud-info: fix changing of DD status/DD status comment -
+ we were missing prompt information so we got a backtrace.
+ * ud-info: Warn when we don't have a prompt string for
+ attributes on startup.
+ * ud-info: Change the "retired" status to "inactive".
+ inactive covers memorial, removed, expelled more clearly.
+ * userdir_gpg.py
+ - do not use SIGEXPIRED, it's deprecated
+ - use EXPKEYSIG to tell if a signature is made by an expired key.
+ - Check that the primary key is not expired, even if we get a
+ GOODSIG status from gnupg. Based on patch by Jeremy T. Bouse.
+
+ -- Peter Palfrader <weasel@debian.org> Tue, 08 Jul 2008 14:33:08 +0200
+
+userdir-ldap (0.3.33) unstable; urgency=low
+
+ * add "security simple_bind=128" to sample slapd.conf.
+ * ud-info: Only show "Lock account" in root mode.
+ * ud-info: Add "retire developer" option that sets
+ accountStatus properly to either retiring, retired, memorial
+ or active. Active is for all currently active developers,
+ memorial is for those who have passed away and whose accounts
+ will never be reused, retiring is a developer who is retired
+ but still receives mail at their @debian.org address. After
+ a few months they should move on to retired, with their mail
+ also disabled. accountStatus is just a freeform text, but
+ these 4 options should be the only ones that exist.
+ * Allow setting of gender in ud-mailgate. Based on patch by Bernhard
+ R. Link.
+ * Add userdir-ldap-slapd.conf, a snipped to be included in slapd.conf
+ to the package.
+
+ -- Peter Palfrader <weasel@debian.org> Mon, 23 Jun 2008 22:59:02 +0200
+
+userdir-ldap (0.3.32) unstable; urgency=low
+
+ * Do SSL when connecting to the ldap server.
+
+ -- Peter Palfrader <weasel@debian.org> Fri, 23 May 2008 23:50:03 +0200
+
+userdir-ldap (0.3.31) unstable; urgency=low
+
+ [ Joerg Jaspert ]
+ * Use sync_keyrings from config file in ud-generate instead of a
+ hardcoded list
+ * Use add_keyrings from config file in ud-useradd instead of a
+ hardcoded list
+ * Use ud-config to get the emailappend value in ud-replicate, no longer
+ hardcoding @debian.org
+
+ [ Stephen Gran ]
+ * Document how to use unique overlay for uid and keyFingerPrint
+
+ -- Peter Palfrader <weasel@debian.org> Fri, 23 May 2008 10:01:51 +0200
+
+userdir-ldap (0.3.30) unstable; urgency=low
+
+ * When we touch usePassword in ud-info or ud-mailgate we now also
+ update shadowLastChange.
+ * When we lock accounts, set shadowExpire to 1. shadowExpire
+ is "days since Jan 1, 1970 that account is disabled".
+ * Properly capitalize shadowInactive and shadowExpire attributes in
+ ud-info and ud-generate.
+ * Add copyright statements to ud-info from bzr log.
+
+ -- Peter Palfrader <weasel@debian.org> Thu, 22 May 2008 22:39:10 +0200
+
+userdir-ldap (0.3.29) unstable; urgency=low
+
+ * ud-info: Add an option "L" to lock accounts in the interactive
+ interface. Locking an account sets a user's password to "{crypt}*LK*"
+ and sets a mailDisableMessage of "account locked".
+
+ -- Peter Palfrader <weasel@debian.org> Thu, 22 May 2008 21:49:19 +0200
+
+userdir-ldap (0.3.28) unstable; urgency=low
+
+ * ud-generate: Do not disable mail just because the account is locked.
+
+ -- Peter Palfrader <weasel@debian.org> Thu, 22 May 2008 21:38:56 +0200
+
+userdir-ldap (0.3.27) unstable; urgency=low
+
+ * Export ssh-keys.tar.gz to [UNTRUSTED] hosts. Since we already export
+ ssh-rsa-shadow this is probably the right thing.
+ * Make keys in the ssh-keys tarball mode 0400 instead of mode 0600.
+
+ -- Peter Palfrader <weasel@debian.org> Mon, 19 May 2008 08:55:28 +0200
+
+userdir-ldap (0.3.26) unstable; urgency=low
+
+ * ud-replicate: sgran pointed out that if all we care about ignoring is
+ EEXIST then we should use mkdir -p instead of [ -d userkeys ] || mkdir
+ userkeys.
+ * ud-mailgate: a bug in DoSSH caused all changes to fail that came after
+ DoSSH in HandleChange. Now DoSSH properly returns without raising an
+ exception if the line to handle is not an ssh public key.
+ * Fix userdir-ldap.schema (objectClass now contains MAY: VoIP). [zobel]
+
+ -- Peter Palfrader <weasel@debian.org> Sun, 18 May 2008 14:27:50 +0200
+
+userdir-ldap (0.3.25) unstable; urgency=low
+
+ * Make ssh-keys.tar.gz readable only by the user.
+
+ -- Peter Palfrader <weasel@debian.org> Sat, 17 May 2008 16:14:56 +0200
+
+userdir-ldap (0.3.24) unstable; urgency=low
+
+ * ud-mailgate: better regex for ssh1 keys, which we reject. [joerg, weasel]
+ * ud-replicate: Also support the imposter dchroot-dsa from the debian
+ archive. [aba, weasel]
+ * ud-generate: Add support for generation of authorized_keys file on
+ the db host for the sshdist user. This is now possible since
+ ud-replicate clients use their ssh host key to authenticate to the
+ db server. The code now supports this but the feature is still
+ disabled. [aba]
+ * ud-generate: Add performance optimization by resolving IP adresses
+ for hosts only once and caching the result. [aba]
+ * ud-replicate, ud-generate: In addition to one big ssh-rsa-shadow file
+ ud-generate now produces per-user authorized_keys files and tars
+ them up. On the receiving end ud-replicate takes the tar and
+ syncs it to userkeys/. The goal here is to no longer require
+ a patched sshd. Setting AuthorizedKeysFile2 to
+ /var/lib/misc/userkeys/%u is sufficient. For homedir creation
+ we can use pam_mkhomedir. [mhy, sgran]
+
+ -- Peter Palfrader <weasel@debian.org> Sat, 17 May 2008 14:49:28 +0200
+
+userdir-ldap (0.3.23) unstable; urgency=low
+
+ * Fix generation of known_hosts file.
+
+ -- Peter Palfrader <weasel@debian.org> Wed, 14 May 2008 17:55:45 +0200
+
+userdir-ldap (0.3.22) unstable; urgency=low
+
+ * Add VoIP fiels to the LDAP shema and teach ud-info and ud-mailgate
+ about it. [zobel]
+ * Add IPv6-Adresses (and IPv4 in v6 notation - ::ffff:192.0.2.1) to
+ ssh_known_hosts. [aba]
+ * ud-mailgate no longer accepts ssh dss keys, keys with a size smaller
+ than 1024. Additionally it checks new keys against a blacklist of
+ ssh key fingerprints. [joerg]
+
+ -- Peter Palfrader <weasel@debian.org> Wed, 14 May 2008 17:47:45 +0200
+
+userdir-ldap (0.3.21) unstable; urgency=low
+
+ * ud-replicate: use the host key to sync stuff from the db server,
+ that is, call ssh with ii /etc/ssh/ssh_host_rsa_key.
+ * ud-replicate: Call ssh with -o PreferredAuthentications=publickey
+ so that it does not even try password authentication.
+
+ -- Peter Palfrader <weasel@debian.org> Tue, 13 May 2008 22:06:23 +0200
+
+userdir-ldap (0.3.20) unstable; urgency=low
+
+ * Teach ud-mailgate about ipv6 addresses (RT#193).
+ * Sanitize DNS entries somewhat before inserting them into LDAP.
+
+ -- Peter Palfrader <weasel@debian.org> Mon, 21 Apr 2008 13:29:36 +0200
+
+userdir-ldap (0.3.19) unstable; urgency=low
+
+ * New [KEYRING] flag to indicate the debian keyring should be synced
+ to this host.
+
+ -- Peter Palfrader <weasel@debian.org> Fri, 18 Apr 2008 14:33:50 +0200
+
+userdir-ldap (0.3.18) unstable; urgency=low
+
+ * Various ud-fingerserv fixes.
+
+ -- Peter Palfrader <weasel@debian.org> Thu, 17 Apr 2008 19:48:11 +0200
+
+userdir-ldap (0.3.17) unstable; urgency=low
+
+ * Calling dh_installdeb before dh_pysupport was probably not the smartest
+ move. Reorder.
+
+ -- Peter Palfrader <weasel@debian.org> Wed, 16 Apr 2008 19:59:42 +0200
+
+userdir-ldap (0.3.16) unstable; urgency=low
[ Peter Palfrader ]
* Ship userdir-ldap.schema with the package, add a note that it is
* Change the build dependency on python-support to be versioned >= 0.3.
* ud-roleadd: Do not try to make role accounts of objectClass
inetOrgPerson, that doesn't work.
+ * Add myself to uploaders.
+ * Create /var/lib/misc/thishost as a symlink to the hostname in postinst.
+ * Sleep for a random time, up to two minutes, in ud-replicate when not
+ called interactively. This is to prevent DoSing the db server when
+ many clients come at the same time.
[ Mark Hymers ]
* ud-userimport, ud-groupadd, ud-roleadd, ud-useradd, userdir_ldap.py:
filename
* Remove use of deprecated functions from the string module
* ud-arbimport: os.exit -> sys.exit
+ * ud-generate: Set shadow expiry to 1 for locked accounts.
+ * update doc/slapd-config.txt: labeledURL was removed from the schema but
+ not the slapd.conf example. Do that now.
+ * add simple ud-config script for use in shell scripts. This allows
+ querying config values.
[ Marc 'HE' Brockschmidt ]
* Make the host ud-replicate syncs from configurable in userdir-ldap.conf,
containing a shell glob on which no remote sync is needed, so that
the db host doesn't need to have a key in the authorized_keys file
for the sshdist user
-
- -- Marc 'HE' Brockschmidt <he@debian.org> Thu, 27 Dec 2007 17:14:51 +0100
+ * ud-useradd: support usergroups.
+ * ud-host/userdir-ldap.schema: Add 'purpose', 'physicalHost' to
+ debianServer schema and teach ud-host about it
+ * ud-host: cleanup: Replace local copy HBaseDn of the centrally
+ configured HostBaseDn.
+ * ud-generate: Mark that no passwords are exported also in the
+ generated passwd file, not only in the shadow file (by using a "*"
+ as password (meaning "no password"), instead of "x" (meaning "do I
+ look like a passwd from the nineties? Look into /etc/shadow!")).
+
+ [ Joerg Jaspert ]
+ * Enhance copyright file a bit, also adding a pointer to our repository
+ * Add those utf8 headerlines to mail templates. Same "trick" as used in dak
+ to send utf8 mails for people that need them. Works there - should work
+ here too.
+
+ [ Stephen Gran ]
+ * ud-fingerserv: implement daemonize() for non-inetd mode.
+ * Packaging cleanup
+ * Use standard debhelper tools
+ * Create all files we ship instead of echoing them into creation at build
+ time
+ * Typo fix in copyright
+ * Update Standards-Version to 3.7.3 (no changes)
+ * Build manpages at build time (add Build-Depend on yodl)
+ * Install built manpages
+
+ -- Peter Palfrader <weasel@debian.org> Wed, 16 Apr 2008 14:10:12 +0200
userdir-ldap (0.3.15) unstable; urgency=low