userdir-ldap (0.3.XX) Xnstable; urgency=low * ud-replicate: sgran pointed out that if all we care about ignoring is EEXIST then we should use mkdir -p instead of [ -d userkeys ] || mkdir userkeys. * ud-mailgate: a bug in DoSSH caused all changes to fail that came after DoSSH in HandleChange. Now DoSSH properly returns without raising an exception if the line to handle is not an ssh public key. -- Peter Palfrader Sun, 18 May 2008 14:25:26 +0200 userdir-ldap (0.3.25) unstable; urgency=low * Make ssh-keys.tar.gz readable only by the user. -- Peter Palfrader Sat, 17 May 2008 16:14:56 +0200 userdir-ldap (0.3.24) unstable; urgency=low * ud-mailgate: better regex for ssh1 keys, which we reject. [joerg, weasel] * ud-replicate: Also support the imposter dchroot-dsa from the debian archive. [aba, weasel] * ud-generate: Add support for generation of authorized_keys file on the db host for the sshdist user. This is now possible since ud-replicate clients use their ssh host key to authenticate to the db server. The code now supports this but the feature is still disabled. [aba] * ud-generate: Add performance optimization by resolving IP adresses for hosts only once and caching the result. [aba] * ud-replicate, ud-generate: In addition to one big ssh-rsa-shadow file ud-generate now produces per-user authorized_keys files and tars them up. On the receiving end ud-replicate takes the tar and syncs it to userkeys/. The goal here is to no longer require a patched sshd. Setting AuthorizedKeysFile2 to /var/lib/misc/userkeys/%u is sufficient. For homedir creation we can use pam_mkhomedir. [mhy, sgran] -- Peter Palfrader Sat, 17 May 2008 14:49:28 +0200 userdir-ldap (0.3.23) unstable; urgency=low * Fix generation of known_hosts file. -- Peter Palfrader Wed, 14 May 2008 17:55:45 +0200 userdir-ldap (0.3.22) unstable; urgency=low * Add VoIP fiels to the LDAP shema and teach ud-info and ud-mailgate about it. [zobel] * Add IPv6-Adresses (and IPv4 in v6 notation - ::ffff:192.0.2.1) to ssh_known_hosts. [aba] * ud-mailgate no longer accepts ssh dss keys, keys with a size smaller than 1024. Additionally it checks new keys against a blacklist of ssh key fingerprints. [joerg] -- Peter Palfrader Wed, 14 May 2008 17:47:45 +0200 userdir-ldap (0.3.21) unstable; urgency=low * ud-replicate: use the host key to sync stuff from the db server, that is, call ssh with ii /etc/ssh/ssh_host_rsa_key. * ud-replicate: Call ssh with -o PreferredAuthentications=publickey so that it does not even try password authentication. -- Peter Palfrader Tue, 13 May 2008 22:06:23 +0200 userdir-ldap (0.3.20) unstable; urgency=low * Teach ud-mailgate about ipv6 addresses (RT#193). * Sanitize DNS entries somewhat before inserting them into LDAP. -- Peter Palfrader Mon, 21 Apr 2008 13:29:36 +0200 userdir-ldap (0.3.19) unstable; urgency=low * New [KEYRING] flag to indicate the debian keyring should be synced to this host. -- Peter Palfrader Fri, 18 Apr 2008 14:33:50 +0200 userdir-ldap (0.3.18) unstable; urgency=low * Various ud-fingerserv fixes. -- Peter Palfrader Thu, 17 Apr 2008 19:48:11 +0200 userdir-ldap (0.3.17) unstable; urgency=low * Calling dh_installdeb before dh_pysupport was probably not the smartest move. Reorder. -- Peter Palfrader Wed, 16 Apr 2008 19:59:42 +0200 userdir-ldap (0.3.16) unstable; urgency=low [ Peter Palfrader ] * Ship userdir-ldap.schema with the package, add a note that it is now version-controlled in bzr on top of the file. * Get rid of debian/conffiles, wich only listed files in /etc anyway. Those files were already being tagged as conffiles by debhelper, resulting in them being listed twice in the resulting binary package. * Change the build dependency on debhelper to be versioned >= 5. * Change Build-Depends-Indep to Build-Depends. * Change the build dependency on python-support to be versioned >= 0.3. * ud-roleadd: Do not try to make role accounts of objectClass inetOrgPerson, that doesn't work. * Add myself to uploaders. * Create /var/lib/misc/thishost as a symlink to the hostname in postinst. * Sleep for a random time, up to two minutes, in ud-replicate when not called interactively. This is to prevent DoSing the db server when many clients come at the same time. [ Mark Hymers ] * ud-userimport, ud-groupadd, ud-roleadd, ud-useradd, userdir_ldap.py: Update ud-userimport to use the same objectClasses as ud-{user,group,role}add and abstract them out into userdir_ldap.py * ud-useradd: Avoid a TypeError exception when constructing the template filename * Remove use of deprecated functions from the string module * ud-arbimport: os.exit -> sys.exit * ud-generate: Set shadow expiry to 1 for locked accounts. * update doc/slapd-config.txt: labeledURL was removed from the schema but not the slapd.conf example. Do that now. * add simple ud-config script for use in shell scripts. This allows querying config values. [ Marc 'HE' Brockschmidt ] * Make the host ud-replicate syncs from configurable in userdir-ldap.conf, instead of hardcoding it into the script. Also introduce a variable containing a shell glob on which no remote sync is needed, so that the db host doesn't need to have a key in the authorized_keys file for the sshdist user * ud-useradd: support usergroups. * ud-host/userdir-ldap.schema: Add 'purpose', 'physicalHost' to debianServer schema and teach ud-host about it * ud-host: cleanup: Replace local copy HBaseDn of the centrally configured HostBaseDn. * ud-generate: Mark that no passwords are exported also in the generated passwd file, not only in the shadow file (by using a "*" as password (meaning "no password"), instead of "x" (meaning "do I look like a passwd from the nineties? Look into /etc/shadow!")). [ Joerg Jaspert ] * Enhance copyright file a bit, also adding a pointer to our repository * Add those utf8 headerlines to mail templates. Same "trick" as used in dak to send utf8 mails for people that need them. Works there - should work here too. [ Stephen Gran ] * ud-fingerserv: implement daemonize() for non-inetd mode. * Packaging cleanup * Use standard debhelper tools * Create all files we ship instead of echoing them into creation at build time * Typo fix in copyright * Update Standards-Version to 3.7.3 (no changes) * Build manpages at build time (add Build-Depend on yodl) * Install built manpages -- Peter Palfrader Wed, 16 Apr 2008 14:10:12 +0200 userdir-ldap (0.3.15) unstable; urgency=low * userdir_gpg.py: fix RT #70 (sub-key support for mail gateway) * change *PK* mechanism to Linux standard ! mechanism, and check for it in the mail gateway for changes, too. * change packaging to make use of python-support, simplyfing scripts greatly. * Remove obsolete ud-killcrypt that wouldn't work with modern ldap anyways. -- Ryan Murray Sun, 12 Aug 2007 13:38:11 -0600 userdir-ldap (0.3.14) unstable; urgency=low * ud-generate: . Establish *PK* as mechanism for locked accounts with mail forwarding intact. No subscription to debian-private though, and no way to log in . Support [NOPASSWD] for generating configs that only don't contain the password for untrusted hosts that should receive the other regular export (patch by Andreas Barth ) * ud-host: . Import the base DN from the configuration file (patch by Andreas Barth ) * ud-roleadd: . Improved admin output * Removed unused and obsolete whrandom module (ud-host, ud-info, ud.py) * Query the LDAP server if no locally defined group with that name was found (userdir_ldap.py, ud-useradd, ud-roleadd) * Preparations for being useful with the version of Python in etch -- Joey Schulze Sat, 11 Aug 2007 22:23:25 +0200 userdir-ldap (0.3.13) unstable; urgency=low * ud-generate: only look for *LK*, not the fingerprint when auto-disabling mail -- Ryan Murray Mon, 15 Jan 2007 16:14:29 -0700 userdir-ldap (0.3.12) unstable; urgency=low * Add dns-sshfp file with DNS SSHFP records for each host. * Add mail-disable file from LDAP mailDisableMessage * Add mail-greylist and mail-callout files from LDAP mailGreylisting and mailCallout * Add mail-rbl, mail-rhsbl, and mail-whitelist files from LDAP, and add support to set them via mailgate * Add support for additional fields to mailgate arbitrary change and delete functions. -- Ryan Murray Thu, 28 Dec 2006 05:14:45 -0700 userdir-ldap (0.3.11) unstable; urgency=low * Add debianhosts file with ip addresses of all hosts. * Don't output bsmtp or DNS entries for accounts without fingerprints. * ud-replicate: - Adjusted symlink path for ssh_known_hosts inside chroot - Use "db" alias for where to rsync from, rather than a hostname (rmurray) - bsmtp handling updated for exim4 (rmurray) * ud-host: - Initialise Host so that -f will print a full list - Display error message and exit properly for wrong arguments - Take better care of unset attributes * userdir_gpg.py: - Removed reference to FCNTL * ud-info - Display error message and exit properly for wrong arguments -- Ryan Murray Sun, 13 Nov 2005 16:42:02 -0700 userdir-ldap (0.3.10) unstable; urgency=low * See cvs log for detailed changes * Fixes to run properly on sarge, and other misc changes. -- Ryan Murray Fri, 14 Oct 2005 21:49:28 -0600 userdir-ldap (0.3.9) unstable; urgency=low * Added an explicit PATH statement to ud-replicate -- Martin Schulze Tue, 25 Jan 2005 10:50:54 +0100 userdir-ldap (0.3.8) stable; urgency=low * ud-replicate: - Update the ssh shadow files in /etc if they don't exist - Corrected the verbosity detection - Only fiddle inside the chroot if the makedb program exist - Fixed path bug - Added support for hosts without imported shadow file * userdir_ldap.py: - Support pressing C-d and C-c - Support for alphanumeric group names - Added passwdAccessLDAP() for wider use by programs * ud-useradd: - Support for mistyped passwords - Support for alphanumerical group ids - Support for no debian-private subscription * ud-host: - Support for -l to list all hosts - Always perform the list output anonymously - Support for -f to list all fingerprints (-h host optional) * ud-info: - Corrected spelling for labeledURI * ud-mailgate: - Corrected spelling for labeledURI - Added support for deleting the d.net entry - Notify users about unsupported SSH1 keys * Added a proper copyright file * Updated welcome-message-800 from newsamosa * userdir_gpg.py: - Preparations for sarge, added --secret-keyring /dev/null * ud-generate: - Generic support for haydn and alioth as [UNTRUSTED] * userdir_gpg.py: - Create ~/.gnupg automagically * ud-roleadd: - New program - Support for creating role accounts (non-DD accounts) -- Martin Schulze Mon, 24 Jan 2005 09:04:00 +0100 userdir-ldap (0.3.7) stable; urgency=low * ud-fingerserv: Corrected the key/fingerprint feature * ud-fingerserv: Added the ICQ UIN * Case sensive LDAP field names for nearly all programs * ud-generate: . Honour locked accounts when writing the shadow file . Hardcode exception for haydn and costa as alioth hosts * ud-mailgate: No access for locked accounts * sigcheck: imported changes from murphy * Added sigcheck to the programs to be installed * Moved the web pages into webwml/db.debian.org * Moved the CGI programs into its own package * ud-replicate: . Added support for user chroot environments . Remove shadow files if they exist . Remove ud-replicate in /usr/local/bin -- Martin Schulze Thu, 18 Nov 2004 19:07:01 +0100 userdir-ldap (0.3.6) unstable; urgency=low * Specify full path to postmap -- Ryan Murray Fri, 26 Sep 2003 11:48:25 -0600 userdir-ldap (0.3.5) unstable; urgency=low * Add depends on rsync * Generate db of debian.org on postfix systems -- Ryan Murray Sat, 30 Aug 2003 18:41:29 -0600 userdir-ldap (0.3.4) unstable; urgency=low * Use the right python version in the maintainer scripts -- Ryan Murray Tue, 18 Mar 2003 19:26:31 -0700 userdir-ldap (0.3.3) unstable; urgency=low * Rebuild for python2.1 and woody -- Ryan Murray Wed, 12 Mar 2003 21:30:12 -0700 userdir-ldap (0.3.2) unstable; urgency=low * Seperation of bsmtp and zoneupdate -- Ryan Murray Thu, 8 Aug 2002 12:07:00 -0700 userdir-ldap (0.3.1) unstable; urgency=low * Add ud-zoneupdate from klecker's /usr/local/bin -- Ryan Murray Tue, 6 Aug 2002 22:42:05 -0700 userdir-ldap (0.3) unstable; urgency=low * Only use sshrsa{host,}key variable, and store all three types of keys in that attribute. -- Jason Gunthrope Sun, 2 Dec 2001 20:21:26 -0800 userdir-ldap (0.2) unstable; urgency=low * What the hey, a new version number. -- Jason Gunthrope Sun, 11 Feb 2001 18:37:27 -0800 userdir-ldap (0.1) unstable; urgency=low * Initial Packaging -- Jason Gunthrope Fri, 30 Apr 1999 00:39:31 -0600