ldap/servers/slapd/config.c | 37 +-
ldap/servers/slapd/libglobs.c | 510 +++++++++++++++++++--------------------
ldap/servers/slapd/slap.h | 2
ldap/servers/slapd/tools/pwenc.c | 2
4 files changed, 280 insertions(+), 271 deletions(-)
New commits:
commit 524c0ca03e701bc78c5da1d9aa0dafbcb0ef5f8a
Author: William Brown <firstyear(a)redhat.com>
Date: Fri Aug 19 10:23:04 2016 +1000
Ticket 48947 - Update default password hash to SSHA512
Bug Description: Update the default password hash in DS to SSHA512
Fix Description: This change fixes some of the macro placements, and makes
it easier to upgrade in the future. If we do the update, and the admin has not
set a hash in dse.ldif this will transparently upgrade the hashtype!
https://fedorahosted.org/389/ticket/48947
Author: wibrown
Review by: mreynolds, nhosoi (Thanks)
diff --git a/ldap/servers/slapd/config.c b/ldap/servers/slapd/config.c
index fc83a13..83a6f2b 100644
--- a/ldap/servers/slapd/config.c
+++ b/ldap/servers/slapd/config.c
@@ -589,26 +589,25 @@ slapd_bootstrap_config(const char *configdir)
if (e)
slapi_entry_free(e);
}
- /* kexcoff: initialize rootpwstoragescheme and pw_storagescheme
- * if not explicilty set in the config file
- */
- if ( config_set_storagescheme() ) { /* default scheme plugin not loaded */
- slapi_log_err(SLAPI_LOG_ERR, "slapd_bootstrap_config",
- "The default password storage scheme SSHA could not be read or was not found in
the file %s. It is mandatory.\n",
- configfile);
- exit (1);
- }
- else {
- slapi_sdn_done(&plug_dn);
- rc= 1; /* OK */
- }
- }
-
- slapi_ch_free_string(&buf);
- }
+ /* kexcoff: initialize rootpwstoragescheme and pw_storagescheme
+ * if not explicilty set in the config file
+ */
+ if ( config_set_storagescheme() ) {
+ /* default scheme plugin not loaded */
+ slapi_log_err(SLAPI_LOG_ERR, "slapd_bootstrap_config",
+ "The default password storage scheme could not be read or was
not found in the file %s. It is mandatory.\n", configfile);
+ exit (1);
+ } else {
+ slapi_sdn_done(&plug_dn);
+ rc= 1; /* OK */
+ }
+ }
+
+ slapi_ch_free_string(&buf);
+ }
bail:
- slapi_ch_free_string(&buf);
- return rc;
+ slapi_ch_free_string(&buf);
+ return rc;
}
diff --git a/ldap/servers/slapd/libglobs.c b/ldap/servers/slapd/libglobs.c
index 2e07950..ac518bd 100644
--- a/ldap/servers/slapd/libglobs.c
+++ b/ldap/servers/slapd/libglobs.c
@@ -167,7 +167,6 @@ static int invalid_sasl_mech(char *str);
#define DEFAULT_LDAPI_AUTO_DN "cn=peercred,cn=external,cn=auth"
#define ENTRYUSN_IMPORT_INIT "0"
#define DEFAULT_ALLOWED_TO_DELETE_ATTRS "nsslapd-listenhost nsslapd-securelistenhost
nsslapd-defaultnamingcontext nsslapd-snmp-index"
-#define SALTED_SHA1_SCHEME_NAME "SSHA"
#define INIT_LOGGING_BACKEND_INTERNAL "dirsrv-log"
/* CONFIG_ON_OFF */
@@ -372,7 +371,7 @@ static struct config_get_and_set {
{CONFIG_PW_STORAGESCHEME_ATTRIBUTE, config_set_pw_storagescheme,
NULL, 0, NULL,
CONFIG_STRING, (ConfigGetFunc)config_get_pw_storagescheme,
- SALTED_SHA1_SCHEME_NAME},
+ DEFAULT_PASSWORD_SCHEME_NAME},
{CONFIG_PW_UNLOCK_ATTRIBUTE, config_set_pw_unlock,
NULL, 0,
(void**)&global_slapdFrontendConfig.pw_policy.pw_unlock,
@@ -568,7 +567,7 @@ static struct config_get_and_set {
{CONFIG_ROOTPWSTORAGESCHEME_ATTRIBUTE, config_set_rootpwstoragescheme,
NULL, 0, NULL,
CONFIG_STRING, (ConfigGetFunc)config_get_rootpwstoragescheme,
- SALTED_SHA1_SCHEME_NAME},
+ DEFAULT_PASSWORD_SCHEME_NAME},
{CONFIG_PW_HISTORY_ATTRIBUTE, config_set_pw_history,
NULL, 0,
(void**)&global_slapdFrontendConfig.pw_policy.pw_history,
@@ -1428,272 +1427,281 @@ getFrontendConfig(void)
void
FrontendConfig_init(void) {
- slapdFrontendConfig_t *cfg = getFrontendConfig();
+ slapdFrontendConfig_t *cfg = getFrontendConfig();
#if SLAPI_CFG_USE_RWLOCK == 1
- /* initialize the read/write configuration lock */
- if ( (cfg->cfg_rwlock = slapi_new_rwlock()) == NULL ) {
- slapi_log_err(SLAPI_LOG_EMERG, "FrontendConfig_init",
- "Failed to initialize cfg_rwlock. Exiting now.");
- exit(-1);
- }
+ /* initialize the read/write configuration lock */
+ if ( (cfg->cfg_rwlock = slapi_new_rwlock()) == NULL ) {
+ slapi_log_err(SLAPI_LOG_EMERG, "FrontendConfig_init",
+ "Failed to initialize cfg_rwlock. Exiting now.");
+ exit(-1);
+ }
#else
- if ((cfg->cfg_lock = PR_NewLock()) == NULL){
- slapi_log_err(SLAPI_LOG_EMERG, "FrontendConfig_init",
- "Failed to initialize cfg_lock. Exiting now.");
- exit(-1);
- }
+ if ((cfg->cfg_lock = PR_NewLock()) == NULL){
+ slapi_log_err(SLAPI_LOG_EMERG, "FrontendConfig_init",
+ "Failed to initialize cfg_lock. Exiting now.");
+ exit(-1);
+ }
#endif
- cfg->port = LDAP_PORT;
- cfg->secureport = LDAPS_PORT;
- cfg->ldapi_filename = slapi_ch_strdup(SLAPD_LDAPI_DEFAULT_FILENAME);
- init_ldapi_switch = cfg->ldapi_switch = LDAP_OFF;
- init_ldapi_bind_switch = cfg->ldapi_bind_switch = LDAP_OFF;
- cfg->ldapi_root_dn = slapi_ch_strdup(DEFAULT_DIRECTORY_MANAGER);
- init_ldapi_map_entries = cfg->ldapi_map_entries = LDAP_OFF;
- cfg->ldapi_uidnumber_type = slapi_ch_strdup(DEFAULT_UIDNUM_TYPE);
- cfg->ldapi_gidnumber_type = slapi_ch_strdup(DEFAULT_GIDNUM_TYPE);
- /* These DNs are no need to be normalized. */
- cfg->ldapi_search_base_dn = slapi_ch_strdup(DEFAULT_LDAPI_SEARCH_BASE);
+ /* Take the lock to make sure we barrier correctly. */
+ CFG_LOCK_WRITE(cfg);
+
+ cfg->port = LDAP_PORT;
+ cfg->secureport = LDAPS_PORT;
+ cfg->ldapi_filename = slapi_ch_strdup(SLAPD_LDAPI_DEFAULT_FILENAME);
+ init_ldapi_switch = cfg->ldapi_switch = LDAP_OFF;
+ init_ldapi_bind_switch = cfg->ldapi_bind_switch = LDAP_OFF;
+ cfg->ldapi_root_dn = slapi_ch_strdup(DEFAULT_DIRECTORY_MANAGER);
+ init_ldapi_map_entries = cfg->ldapi_map_entries = LDAP_OFF;
+ cfg->ldapi_uidnumber_type = slapi_ch_strdup(DEFAULT_UIDNUM_TYPE);
+ cfg->ldapi_gidnumber_type = slapi_ch_strdup(DEFAULT_GIDNUM_TYPE);
+ /* These DNs are no need to be normalized. */
+ cfg->ldapi_search_base_dn = slapi_ch_strdup(DEFAULT_LDAPI_SEARCH_BASE);
#if defined(ENABLE_AUTO_DN_SUFFIX)
- cfg->ldapi_auto_dn_suffix = slapi_ch_strdup(DEFAULT_LDAPI_AUTO_DN);
+ cfg->ldapi_auto_dn_suffix = slapi_ch_strdup(DEFAULT_LDAPI_AUTO_DN);
#endif
- init_allow_unauth_binds = cfg->allow_unauth_binds = LDAP_OFF;
- init_require_secure_binds = cfg->require_secure_binds = LDAP_OFF;
- cfg->allow_anon_access = SLAPD_ANON_ACCESS_ON;
- init_slapi_counters = cfg->slapi_counters = LDAP_ON;
- cfg->threadnumber = SLAPD_DEFAULT_MAX_THREADS;
- cfg->maxthreadsperconn = SLAPD_DEFAULT_MAX_THREADS_PER_CONN;
- cfg->reservedescriptors = SLAPD_DEFAULT_RESERVE_FDS;
- cfg->idletimeout = SLAPD_DEFAULT_IDLE_TIMEOUT;
- cfg->ioblocktimeout = SLAPD_DEFAULT_IOBLOCK_TIMEOUT;
- cfg->outbound_ldap_io_timeout = SLAPD_DEFAULT_OUTBOUND_LDAP_IO_TIMEOUT;
- cfg->max_filter_nest_level = SLAPD_DEFAULT_MAX_FILTER_NEST_LEVEL;
- cfg->maxsasliosize = SLAPD_DEFAULT_MAX_SASLIO_SIZE;
- cfg->localssf = SLAPD_DEFAULT_LOCAL_SSF;
- cfg->minssf = SLAPD_DEFAULT_MIN_SSF;
- /* minssf is applied to rootdse, by default */
- init_minssf_exclude_rootdse = cfg->minssf_exclude_rootdse = LDAP_OFF;
- cfg->validate_cert = SLAPD_VALIDATE_CERT_WARN;
+ init_allow_unauth_binds = cfg->allow_unauth_binds = LDAP_OFF;
+ init_require_secure_binds = cfg->require_secure_binds = LDAP_OFF;
+ cfg->allow_anon_access = SLAPD_ANON_ACCESS_ON;
+ init_slapi_counters = cfg->slapi_counters = LDAP_ON;
+ cfg->threadnumber = SLAPD_DEFAULT_MAX_THREADS;
+ cfg->maxthreadsperconn = SLAPD_DEFAULT_MAX_THREADS_PER_CONN;
+ cfg->reservedescriptors = SLAPD_DEFAULT_RESERVE_FDS;
+ cfg->idletimeout = SLAPD_DEFAULT_IDLE_TIMEOUT;
+ cfg->ioblocktimeout = SLAPD_DEFAULT_IOBLOCK_TIMEOUT;
+ cfg->outbound_ldap_io_timeout = SLAPD_DEFAULT_OUTBOUND_LDAP_IO_TIMEOUT;
+ cfg->max_filter_nest_level = SLAPD_DEFAULT_MAX_FILTER_NEST_LEVEL;
+ cfg->maxsasliosize = SLAPD_DEFAULT_MAX_SASLIO_SIZE;
+ cfg->localssf = SLAPD_DEFAULT_LOCAL_SSF;
+ cfg->minssf = SLAPD_DEFAULT_MIN_SSF;
+ /* minssf is applied to rootdse, by default */
+ init_minssf_exclude_rootdse = cfg->minssf_exclude_rootdse = LDAP_OFF;
+ cfg->validate_cert = SLAPD_VALIDATE_CERT_WARN;
#ifdef USE_SYSCONF
- cfg->conntablesize = sysconf( _SC_OPEN_MAX );
+ cfg->conntablesize = sysconf( _SC_OPEN_MAX );
#else /* USE_SYSCONF */
- cfg->conntablesize = getdtablesize();
+ cfg->conntablesize = getdtablesize();
#endif /* USE_SYSCONF */
- init_accesscontrol = cfg->accesscontrol = LDAP_ON;
+ init_accesscontrol = cfg->accesscontrol = LDAP_ON;
#if defined(LINUX)
- /* On Linux, by default, we use TCP_CORK so we must enable nagle */
- init_nagle = cfg->nagle = LDAP_ON;
+ /* On Linux, by default, we use TCP_CORK so we must enable nagle */
+ init_nagle = cfg->nagle = LDAP_ON;
#else
- init_nagle = cfg->nagle = LDAP_OFF;
+ init_nagle = cfg->nagle = LDAP_OFF;
#endif
- init_security = cfg->security = LDAP_OFF;
- init_ssl_check_hostname = cfg->ssl_check_hostname = LDAP_ON;
- init_return_exact_case = cfg->return_exact_case = LDAP_ON;
- init_result_tweak = cfg->result_tweak = LDAP_OFF;
- init_attrname_exceptions = cfg->attrname_exceptions = LDAP_OFF;
- cfg->reservedescriptors = SLAPD_DEFAULT_RESERVE_FDS;
- cfg->useroc = slapi_ch_strdup ( "" );
- cfg->userat = slapi_ch_strdup ( "" );
-/* kexcoff: should not be initialized by default here
- cfg->rootpwstoragescheme = pw_name2scheme( SALTED_SHA1_SCHEME_NAME );
- cfg->pw_storagescheme = pw_name2scheme( SALTED_SHA1_SCHEME_NAME );
-*/
- cfg->slapd_type = 0;
- cfg->versionstring = SLAPD_VERSION_STR;
- cfg->sizelimit = SLAPD_DEFAULT_SIZELIMIT;
- cfg->pagedsizelimit = 0;
- cfg->timelimit = SLAPD_DEFAULT_TIMELIMIT;
- cfg->anon_limits_dn = slapi_ch_strdup("");
- init_schemacheck = cfg->schemacheck = LDAP_ON;
- init_schemamod = cfg->schemamod = LDAP_ON;
- init_syntaxcheck = cfg->syntaxcheck = LDAP_OFF;
- init_plugin_track = cfg->plugin_track = LDAP_OFF;
- init_moddn_aci = cfg->moddn_aci = LDAP_ON;
- init_syntaxlogging = cfg->syntaxlogging = LDAP_OFF;
- init_dn_validate_strict = cfg->dn_validate_strict = LDAP_OFF;
- init_ds4_compatible_schema = cfg->ds4_compatible_schema = LDAP_OFF;
- init_enquote_sup_oc = cfg->enquote_sup_oc = LDAP_OFF;
- init_lastmod = cfg->lastmod = LDAP_ON;
- init_rewrite_rfc1274 = cfg->rewrite_rfc1274 = LDAP_OFF;
- cfg->schemareplace = slapi_ch_strdup( CONFIG_SCHEMAREPLACE_STR_REPLICATION_ONLY );
- init_schema_ignore_trailing_spaces = cfg->schema_ignore_trailing_spaces =
- SLAPD_DEFAULT_SCHEMA_IGNORE_TRAILING_SPACES;
- /* do not force sasl external by default -
- * let clients abide by the LDAP standards and send us a SASL/EXTERNAL bind
- * if that's what they want to do */
- init_force_sasl_external = cfg->force_sasl_external = LDAP_OFF;
-
- init_readonly = cfg->readonly = LDAP_OFF;
- init_pwpolicy_local = cfg->pwpolicy_local = LDAP_OFF;
- init_pwpolicy_inherit_global = cfg->pwpolicy_inherit_global = LDAP_OFF;
- init_pw_change = cfg->pw_policy.pw_change = LDAP_ON;
- init_pw_must_change = cfg->pw_policy.pw_must_change = LDAP_OFF;
- init_allow_hashed_pw = cfg->allow_hashed_pw = LDAP_OFF;
- init_pw_syntax = cfg->pw_policy.pw_syntax = LDAP_OFF;
- init_pw_exp = cfg->pw_policy.pw_exp = LDAP_OFF;
- init_pw_send_expiring = cfg->pw_policy.pw_send_expiring = LDAP_OFF;
- cfg->pw_policy.pw_minlength = 8;
- cfg->pw_policy.pw_mindigits = 0;
- cfg->pw_policy.pw_minalphas = 0;
- cfg->pw_policy.pw_minuppers = 0;
- cfg->pw_policy.pw_minlowers = 0;
- cfg->pw_policy.pw_minspecials = 0;
- cfg->pw_policy.pw_min8bit = 0;
- cfg->pw_policy.pw_maxrepeats = 0;
- cfg->pw_policy.pw_mincategories = 3;
- cfg->pw_policy.pw_mintokenlength = 3;
+ init_security = cfg->security = LDAP_OFF;
+ init_ssl_check_hostname = cfg->ssl_check_hostname = LDAP_ON;
+ init_return_exact_case = cfg->return_exact_case = LDAP_ON;
+ init_result_tweak = cfg->result_tweak = LDAP_OFF;
+ init_attrname_exceptions = cfg->attrname_exceptions = LDAP_OFF;
+ cfg->reservedescriptors = SLAPD_DEFAULT_RESERVE_FDS;
+ cfg->useroc = slapi_ch_strdup ( "" );
+ cfg->userat = slapi_ch_strdup ( "" );
+ /* kexcoff: should not be initialized by default here
+ * wibrown: The reason is that at the time this is called, plugins are
+ * not yet loaded, so there are no schemes avaliable. As a result
+ * pw_name2scheme will always return NULL
+ */
+ /* cfg->rootpwstoragescheme = pw_name2scheme( DEFAULT_PASSWORD_SCHEME_NAME ); */
+ /* cfg->pw_storagescheme = pw_name2scheme( DEFAULT_PASSWORD_SCHEME_NAME ); */
+ cfg->slapd_type = 0;
+ cfg->versionstring = SLAPD_VERSION_STR;
+ cfg->sizelimit = SLAPD_DEFAULT_SIZELIMIT;
+ cfg->pagedsizelimit = 0;
+ cfg->timelimit = SLAPD_DEFAULT_TIMELIMIT;
+ cfg->anon_limits_dn = slapi_ch_strdup("");
+ init_schemacheck = cfg->schemacheck = LDAP_ON;
+ init_schemamod = cfg->schemamod = LDAP_ON;
+ init_syntaxcheck = cfg->syntaxcheck = LDAP_OFF;
+ init_plugin_track = cfg->plugin_track = LDAP_OFF;
+ init_moddn_aci = cfg->moddn_aci = LDAP_ON;
+ init_syntaxlogging = cfg->syntaxlogging = LDAP_OFF;
+ init_dn_validate_strict = cfg->dn_validate_strict = LDAP_OFF;
+ init_ds4_compatible_schema = cfg->ds4_compatible_schema = LDAP_OFF;
+ init_enquote_sup_oc = cfg->enquote_sup_oc = LDAP_OFF;
+ init_lastmod = cfg->lastmod = LDAP_ON;
+ init_rewrite_rfc1274 = cfg->rewrite_rfc1274 = LDAP_OFF;
+ cfg->schemareplace = slapi_ch_strdup( CONFIG_SCHEMAREPLACE_STR_REPLICATION_ONLY
);
+ init_schema_ignore_trailing_spaces = cfg->schema_ignore_trailing_spaces =
+ SLAPD_DEFAULT_SCHEMA_IGNORE_TRAILING_SPACES;
+ /* do not force sasl external by default -
+ * let clients abide by the LDAP standards and send us a SASL/EXTERNAL bind
+ * if that's what they want to do */
+ init_force_sasl_external = cfg->force_sasl_external = LDAP_OFF;
+
+ init_readonly = cfg->readonly = LDAP_OFF;
+ init_pwpolicy_local = cfg->pwpolicy_local = LDAP_OFF;
+ init_pwpolicy_inherit_global = cfg->pwpolicy_inherit_global = LDAP_OFF;
+ init_pw_change = cfg->pw_policy.pw_change = LDAP_ON;
+ init_pw_must_change = cfg->pw_policy.pw_must_change = LDAP_OFF;
+ init_allow_hashed_pw = cfg->allow_hashed_pw = LDAP_OFF;
+ init_pw_syntax = cfg->pw_policy.pw_syntax = LDAP_OFF;
+ init_pw_exp = cfg->pw_policy.pw_exp = LDAP_OFF;
+ init_pw_send_expiring = cfg->pw_policy.pw_send_expiring = LDAP_OFF;
+ cfg->pw_policy.pw_minlength = 8;
+ cfg->pw_policy.pw_mindigits = 0;
+ cfg->pw_policy.pw_minalphas = 0;
+ cfg->pw_policy.pw_minuppers = 0;
+ cfg->pw_policy.pw_minlowers = 0;
+ cfg->pw_policy.pw_minspecials = 0;
+ cfg->pw_policy.pw_min8bit = 0;
+ cfg->pw_policy.pw_maxrepeats = 0;
+ cfg->pw_policy.pw_mincategories = 3;
+ cfg->pw_policy.pw_mintokenlength = 3;
#if defined(CPU_x86_64)
- cfg->pw_policy.pw_maxage = 8639913600; /* 99999 days */
+ cfg->pw_policy.pw_maxage = 8639913600; /* 99999 days */
#else
- cfg->pw_policy.pw_maxage = 8640000; /* 100 days */
+ cfg->pw_policy.pw_maxage = 8640000; /* 100 days */
#endif
- cfg->pw_policy.pw_minage = 0;
- cfg->pw_policy.pw_warning = _SEC_PER_DAY; /* 1 day */
- init_pw_history = cfg->pw_policy.pw_history = LDAP_OFF;
- cfg->pw_policy.pw_inhistory = 6;
- init_pw_lockout = cfg->pw_policy.pw_lockout = LDAP_OFF;
- cfg->pw_policy.pw_maxfailure = 3;
- init_pw_unlock = cfg->pw_policy.pw_unlock = LDAP_ON;
- cfg->pw_policy.pw_lockduration = 3600; /* 60 minutes */
- cfg->pw_policy.pw_resetfailurecount = 600; /* 10 minutes */
- cfg->pw_policy.pw_gracelimit = 0;
- cfg->pw_policy.pw_admin = NULL;
- cfg->pw_policy.pw_admin_user = NULL;
- init_pw_is_legacy = cfg->pw_policy.pw_is_legacy = LDAP_ON;
- init_pw_track_update_time = cfg->pw_policy.pw_track_update_time = LDAP_OFF;
- init_pw_is_global_policy = cfg->pw_is_global_policy = LDAP_OFF;
-
- init_accesslog_logging_enabled = cfg->accesslog_logging_enabled = LDAP_ON;
- cfg->accesslog_mode = slapi_ch_strdup(INIT_ACCESSLOG_MODE);
- cfg->accesslog_maxnumlogs = 10;
- cfg->accesslog_maxlogsize = 100;
- cfg->accesslog_rotationtime = 1;
- cfg->accesslog_rotationunit = slapi_ch_strdup(INIT_ACCESSLOG_ROTATIONUNIT);
- init_accesslog_rotationsync_enabled =
- cfg->accesslog_rotationsync_enabled = LDAP_OFF;
- cfg->accesslog_rotationsynchour = 0;
- cfg->accesslog_rotationsyncmin = 0;
- cfg->accesslog_maxdiskspace = 500;
- cfg->accesslog_minfreespace = 5;
- cfg->accesslog_exptime = 1;
- cfg->accesslog_exptimeunit = slapi_ch_strdup(INIT_ACCESSLOG_EXPTIMEUNIT);
- cfg->accessloglevel = 256;
- init_accesslogbuffering = cfg->accesslogbuffering = LDAP_ON;
- init_csnlogging = cfg->csnlogging = LDAP_ON;
-
- init_errorlog_logging_enabled = cfg->errorlog_logging_enabled = LDAP_ON;
- cfg->errorlog_mode = slapi_ch_strdup(INIT_ERRORLOG_MODE);
- cfg->errorlog_maxnumlogs = 1;
- cfg->errorlog_maxlogsize = 100;
- cfg->errorlog_rotationtime = 1;
- cfg->errorlog_rotationunit = slapi_ch_strdup (INIT_ERRORLOG_ROTATIONUNIT);
- init_errorlog_rotationsync_enabled =
- cfg->errorlog_rotationsync_enabled = LDAP_OFF;
- cfg->errorlog_rotationsynchour = 0;
- cfg->errorlog_rotationsyncmin = 0;
- cfg->errorlog_maxdiskspace = 100;
- cfg->errorlog_minfreespace = 5;
- cfg->errorlog_exptime = 1;
- cfg->errorlog_exptimeunit = slapi_ch_strdup(INIT_ERRORLOG_EXPTIMEUNIT);
- cfg->errorloglevel = SLAPD_DEFAULT_ERRORLOG_LEVEL;
-
- init_auditlog_logging_enabled = cfg->auditlog_logging_enabled = LDAP_OFF;
- cfg->auditlog_mode = slapi_ch_strdup(INIT_AUDITLOG_MODE);
- cfg->auditlog_maxnumlogs = 1;
- cfg->auditlog_maxlogsize = 100;
- cfg->auditlog_rotationtime = 1;
- cfg->auditlog_rotationunit = slapi_ch_strdup(INIT_AUDITLOG_ROTATIONUNIT);
- init_auditlog_rotationsync_enabled =
- cfg->auditlog_rotationsync_enabled = LDAP_OFF;
- cfg->auditlog_rotationsynchour = 0;
- cfg->auditlog_rotationsyncmin = 0;
- cfg->auditlog_maxdiskspace = 100;
- cfg->auditlog_minfreespace = 5;
- cfg->auditlog_exptime = 1;
- cfg->auditlog_exptimeunit = slapi_ch_strdup(INIT_AUDITLOG_EXPTIMEUNIT);
- init_auditlog_logging_hide_unhashed_pw =
+ cfg->pw_policy.pw_minage = 0;
+ cfg->pw_policy.pw_warning = _SEC_PER_DAY; /* 1 day */
+ init_pw_history = cfg->pw_policy.pw_history = LDAP_OFF;
+ cfg->pw_policy.pw_inhistory = 6;
+ init_pw_lockout = cfg->pw_policy.pw_lockout = LDAP_OFF;
+ cfg->pw_policy.pw_maxfailure = 3;
+ init_pw_unlock = cfg->pw_policy.pw_unlock = LDAP_ON;
+ cfg->pw_policy.pw_lockduration = 3600; /* 60 minutes */
+ cfg->pw_policy.pw_resetfailurecount = 600; /* 10 minutes */
+ cfg->pw_policy.pw_gracelimit = 0;
+ cfg->pw_policy.pw_admin = NULL;
+ cfg->pw_policy.pw_admin_user = NULL;
+ init_pw_is_legacy = cfg->pw_policy.pw_is_legacy = LDAP_ON;
+ init_pw_track_update_time = cfg->pw_policy.pw_track_update_time = LDAP_OFF;
+ init_pw_is_global_policy = cfg->pw_is_global_policy = LDAP_OFF;
+
+ init_accesslog_logging_enabled = cfg->accesslog_logging_enabled = LDAP_ON;
+ cfg->accesslog_mode = slapi_ch_strdup(INIT_ACCESSLOG_MODE);
+ cfg->accesslog_maxnumlogs = 10;
+ cfg->accesslog_maxlogsize = 100;
+ cfg->accesslog_rotationtime = 1;
+ cfg->accesslog_rotationunit = slapi_ch_strdup(INIT_ACCESSLOG_ROTATIONUNIT);
+ init_accesslog_rotationsync_enabled =
+ cfg->accesslog_rotationsync_enabled = LDAP_OFF;
+ cfg->accesslog_rotationsynchour = 0;
+ cfg->accesslog_rotationsyncmin = 0;
+ cfg->accesslog_maxdiskspace = 500;
+ cfg->accesslog_minfreespace = 5;
+ cfg->accesslog_exptime = 1;
+ cfg->accesslog_exptimeunit = slapi_ch_strdup(INIT_ACCESSLOG_EXPTIMEUNIT);
+ cfg->accessloglevel = 256;
+ init_accesslogbuffering = cfg->accesslogbuffering = LDAP_ON;
+ init_csnlogging = cfg->csnlogging = LDAP_ON;
+
+ init_errorlog_logging_enabled = cfg->errorlog_logging_enabled = LDAP_ON;
+ cfg->errorlog_mode = slapi_ch_strdup(INIT_ERRORLOG_MODE);
+ cfg->errorlog_maxnumlogs = 1;
+ cfg->errorlog_maxlogsize = 100;
+ cfg->errorlog_rotationtime = 1;
+ cfg->errorlog_rotationunit = slapi_ch_strdup (INIT_ERRORLOG_ROTATIONUNIT);
+ init_errorlog_rotationsync_enabled =
+ cfg->errorlog_rotationsync_enabled = LDAP_OFF;
+ cfg->errorlog_rotationsynchour = 0;
+ cfg->errorlog_rotationsyncmin = 0;
+ cfg->errorlog_maxdiskspace = 100;
+ cfg->errorlog_minfreespace = 5;
+ cfg->errorlog_exptime = 1;
+ cfg->errorlog_exptimeunit = slapi_ch_strdup(INIT_ERRORLOG_EXPTIMEUNIT);
+ cfg->errorloglevel = SLAPD_DEFAULT_ERRORLOG_LEVEL;
+
+ init_auditlog_logging_enabled = cfg->auditlog_logging_enabled = LDAP_OFF;
+ cfg->auditlog_mode = slapi_ch_strdup(INIT_AUDITLOG_MODE);
+ cfg->auditlog_maxnumlogs = 1;
+ cfg->auditlog_maxlogsize = 100;
+ cfg->auditlog_rotationtime = 1;
+ cfg->auditlog_rotationunit = slapi_ch_strdup(INIT_AUDITLOG_ROTATIONUNIT);
+ init_auditlog_rotationsync_enabled =
+ cfg->auditlog_rotationsync_enabled = LDAP_OFF;
+ cfg->auditlog_rotationsynchour = 0;
+ cfg->auditlog_rotationsyncmin = 0;
+ cfg->auditlog_maxdiskspace = 100;
+ cfg->auditlog_minfreespace = 5;
+ cfg->auditlog_exptime = 1;
+ cfg->auditlog_exptimeunit = slapi_ch_strdup(INIT_AUDITLOG_EXPTIMEUNIT);
+ init_auditlog_logging_hide_unhashed_pw =
cfg->auditlog_logging_hide_unhashed_pw = LDAP_ON;
- init_auditfaillog_logging_enabled = cfg->auditfaillog_logging_enabled = LDAP_OFF;
- cfg->auditfaillog_mode = slapi_ch_strdup(INIT_AUDITFAILLOG_MODE);
- cfg->auditfaillog_maxnumlogs = 1;
- cfg->auditfaillog_maxlogsize = 100;
- cfg->auditfaillog_rotationtime = 1;
- cfg->auditfaillog_rotationunit = slapi_ch_strdup(INIT_AUDITFAILLOG_ROTATIONUNIT);
- init_auditfaillog_rotationsync_enabled =
- cfg->auditfaillog_rotationsync_enabled = LDAP_OFF;
- cfg->auditfaillog_rotationsynchour = 0;
- cfg->auditfaillog_rotationsyncmin = 0;
- cfg->auditfaillog_maxdiskspace = 100;
- cfg->auditfaillog_minfreespace = 5;
- cfg->auditfaillog_exptime = 1;
- cfg->auditfaillog_exptimeunit = slapi_ch_strdup(INIT_AUDITFAILLOG_EXPTIMEUNIT);
- init_auditfaillog_logging_hide_unhashed_pw =
- cfg->auditfaillog_logging_hide_unhashed_pw = LDAP_ON;
+ init_auditfaillog_logging_enabled = cfg->auditfaillog_logging_enabled = LDAP_OFF;
+ cfg->auditfaillog_mode = slapi_ch_strdup(INIT_AUDITFAILLOG_MODE);
+ cfg->auditfaillog_maxnumlogs = 1;
+ cfg->auditfaillog_maxlogsize = 100;
+ cfg->auditfaillog_rotationtime = 1;
+ cfg->auditfaillog_rotationunit = slapi_ch_strdup(INIT_AUDITFAILLOG_ROTATIONUNIT);
+ init_auditfaillog_rotationsync_enabled =
+ cfg->auditfaillog_rotationsync_enabled = LDAP_OFF;
+ cfg->auditfaillog_rotationsynchour = 0;
+ cfg->auditfaillog_rotationsyncmin = 0;
+ cfg->auditfaillog_maxdiskspace = 100;
+ cfg->auditfaillog_minfreespace = 5;
+ cfg->auditfaillog_exptime = 1;
+ cfg->auditfaillog_exptimeunit = slapi_ch_strdup(INIT_AUDITFAILLOG_EXPTIMEUNIT);
+ init_auditfaillog_logging_hide_unhashed_pw =
+ cfg->auditfaillog_logging_hide_unhashed_pw = LDAP_ON;
#ifdef HAVE_CLOCK_GETTIME
- init_logging_hr_timestamps =
- cfg->logging_hr_timestamps = LDAP_ON;
+ init_logging_hr_timestamps =
+ cfg->logging_hr_timestamps = LDAP_ON;
#endif
- init_entryusn_global = cfg->entryusn_global = LDAP_OFF;
- cfg->entryusn_import_init = slapi_ch_strdup(ENTRYUSN_IMPORT_INIT);
- cfg->allowed_to_delete_attrs = slapi_ch_strdup("passwordadmindn
nsslapd-listenhost nsslapd-securelistenhost nsslapd-defaultnamingcontext");
- cfg->default_naming_context = NULL; /* store normalized dn */
- cfg->allowed_sasl_mechs = NULL;
-
- init_disk_monitoring = cfg->disk_monitoring = LDAP_OFF;
- cfg->disk_threshold = 2097152; /* 2 mb */
- cfg->disk_grace_period = 60; /* 1 hour */
- init_disk_logging_critical = cfg->disk_logging_critical = LDAP_OFF;
- init_ndn_cache_enabled = cfg->ndn_cache_enabled = LDAP_ON;
- cfg->ndn_cache_max_size = NDN_DEFAULT_SIZE;
- init_sasl_mapping_fallback = cfg->sasl_mapping_fallback = LDAP_OFF;
- cfg->ignore_vattrs = LDAP_OFF;
- cfg->sasl_max_bufsize = SLAPD_DEFAULT_SASL_MAXBUFSIZE;
- cfg->unhashed_pw_switch = SLAPD_UNHASHED_PW_ON;
- init_return_orig_type = cfg->return_orig_type = LDAP_OFF;
- init_enable_turbo_mode = cfg->enable_turbo_mode = LDAP_ON;
- init_connection_buffer = cfg->connection_buffer = CONNECTION_BUFFER_ON;
- init_connection_nocanon = cfg->connection_nocanon = LDAP_ON;
- init_plugin_logging = cfg->plugin_logging = LDAP_OFF;
- init_listen_backlog_size = cfg->listen_backlog_size = DAEMON_LISTEN_SIZE;
- init_ignore_time_skew = cfg->ignore_time_skew = LDAP_OFF;
- init_dynamic_plugins = cfg->dynamic_plugins = LDAP_OFF;
- init_cn_uses_dn_syntax_in_dns = cfg->cn_uses_dn_syntax_in_dns = LDAP_OFF;
- init_global_backend_local = LDAP_OFF;
- cfg->maxsimplepaged_per_conn = DEFAULT_MAXSIMPLEPAGED_PER_CONN;
- cfg->maxbersize = DEFAULT_MAXBERSIZE;
+ init_entryusn_global = cfg->entryusn_global = LDAP_OFF;
+ cfg->entryusn_import_init = slapi_ch_strdup(ENTRYUSN_IMPORT_INIT);
+ cfg->allowed_to_delete_attrs = slapi_ch_strdup("passwordadmindn
nsslapd-listenhost nsslapd-securelistenhost nsslapd-defaultnamingcontext");
+ cfg->default_naming_context = NULL; /* store normalized dn */
+ cfg->allowed_sasl_mechs = NULL;
+
+ init_disk_monitoring = cfg->disk_monitoring = LDAP_OFF;
+ cfg->disk_threshold = 2097152; /* 2 mb */
+ cfg->disk_grace_period = 60; /* 1 hour */
+ init_disk_logging_critical = cfg->disk_logging_critical = LDAP_OFF;
+ init_ndn_cache_enabled = cfg->ndn_cache_enabled = LDAP_ON;
+ cfg->ndn_cache_max_size = NDN_DEFAULT_SIZE;
+ init_sasl_mapping_fallback = cfg->sasl_mapping_fallback = LDAP_OFF;
+ cfg->ignore_vattrs = LDAP_OFF;
+ cfg->sasl_max_bufsize = SLAPD_DEFAULT_SASL_MAXBUFSIZE;
+ cfg->unhashed_pw_switch = SLAPD_UNHASHED_PW_ON;
+ init_return_orig_type = cfg->return_orig_type = LDAP_OFF;
+ init_enable_turbo_mode = cfg->enable_turbo_mode = LDAP_ON;
+ init_connection_buffer = cfg->connection_buffer = CONNECTION_BUFFER_ON;
+ init_connection_nocanon = cfg->connection_nocanon = LDAP_ON;
+ init_plugin_logging = cfg->plugin_logging = LDAP_OFF;
+ init_listen_backlog_size = cfg->listen_backlog_size = DAEMON_LISTEN_SIZE;
+ init_ignore_time_skew = cfg->ignore_time_skew = LDAP_OFF;
+ init_dynamic_plugins = cfg->dynamic_plugins = LDAP_OFF;
+ init_cn_uses_dn_syntax_in_dns = cfg->cn_uses_dn_syntax_in_dns = LDAP_OFF;
+ init_global_backend_local = LDAP_OFF;
+ cfg->maxsimplepaged_per_conn = DEFAULT_MAXSIMPLEPAGED_PER_CONN;
+ cfg->maxbersize = DEFAULT_MAXBERSIZE;
#ifdef ENABLE_NUNC_STANS
- init_enable_nunc_stans = cfg->enable_nunc_stans = LDAP_ON;
+ init_enable_nunc_stans = cfg->enable_nunc_stans = LDAP_ON;
#endif
#if defined(LINUX)
- init_malloc_mxfast = cfg->malloc_mxfast = DEFAULT_MALLOC_UNSET;
- init_malloc_trim_threshold = cfg->malloc_trim_threshold = DEFAULT_MALLOC_UNSET;
- init_malloc_mmap_threshold = cfg->malloc_mmap_threshold = DEFAULT_MALLOC_UNSET;
+ init_malloc_mxfast = cfg->malloc_mxfast = DEFAULT_MALLOC_UNSET;
+ init_malloc_trim_threshold = cfg->malloc_trim_threshold = DEFAULT_MALLOC_UNSET;
+ init_malloc_mmap_threshold = cfg->malloc_mmap_threshold = DEFAULT_MALLOC_UNSET;
#endif
#ifdef MEMPOOL_EXPERIMENTAL
- init_mempool_switch = cfg->mempool_switch = LDAP_ON;
- cfg->mempool_maxfreelist = 1024;
- cfg->system_page_size = sysconf(_SC_PAGE_SIZE); /* not to get every time; no set,
get only */
- {
- long sc_size = cfg->system_page_size;
- cfg->system_page_bits = 0;
- while ((sc_size >>= 1) > 0) {
- cfg->system_page_bits++; /* to calculate once; no set, get only */
+ init_mempool_switch = cfg->mempool_switch = LDAP_ON;
+ cfg->mempool_maxfreelist = 1024;
+ cfg->system_page_size = sysconf(_SC_PAGE_SIZE); /* not to get every time; no set,
get only */
+ {
+ long sc_size = cfg->system_page_size;
+ cfg->system_page_bits = 0;
+ while ((sc_size >>= 1) > 0) {
+ cfg->system_page_bits++; /* to calculate once; no set, get only */
+ }
}
- }
#endif /* MEMPOOL_EXPERIMENTAL */
- init_extract_pem = cfg->extract_pem = LDAP_OFF;
+ init_extract_pem = cfg->extract_pem = LDAP_OFF;
- init_config_get_and_set();
+ /* Done, unlock! */
+ CFG_UNLOCK_WRITE(cfg);
+
+ init_config_get_and_set();
}
-int
+int
g_get_global_lastmod(void)
{
return config_get_lastmod();
@@ -1715,7 +1723,7 @@ set_dll_entry_points( slapdEntryPoints *p )
{
if ( NULL == sep )
{
- sep = p;
+ sep = p;
}
}
@@ -3761,31 +3769,31 @@ config_set_rootpwstoragescheme( const char *attrname, char *value,
char *errorbu
return retVal;
}
-
+
/*
* kexcoff: to replace default initialization in FrontendConfig_init()
*/
int config_set_storagescheme(void) {
- slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
- struct pw_scheme *new_scheme = NULL;
+ slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
+ struct pw_scheme *new_scheme = NULL;
CFG_LOCK_WRITE(slapdFrontendConfig);
- new_scheme = pw_name2scheme("SSHA");
- free_pw_scheme(slapdFrontendConfig->pw_storagescheme);
- slapdFrontendConfig->pw_storagescheme = new_scheme;
+ new_scheme = pw_name2scheme(DEFAULT_PASSWORD_SCHEME_NAME);
+ free_pw_scheme(slapdFrontendConfig->pw_storagescheme);
+ slapdFrontendConfig->pw_storagescheme = new_scheme;
- new_scheme = pw_name2scheme("SSHA");
- slapdFrontendConfig->rootpwstoragescheme = new_scheme;
-
- CFG_UNLOCK_WRITE(slapdFrontendConfig);
+ new_scheme = pw_name2scheme(DEFAULT_PASSWORD_SCHEME_NAME);
+ slapdFrontendConfig->rootpwstoragescheme = new_scheme;
- return ( new_scheme == NULL );
+ CFG_UNLOCK_WRITE(slapdFrontendConfig);
+ return ( new_scheme == NULL );
}
-int
+
+int
config_set_localuser( const char *attrname, char *value, char *errorbuf, int apply ) {
int retVal = LDAP_SUCCESS;
slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
@@ -4925,16 +4933,16 @@ config_get_pw_storagescheme(void) {
CFG_LOCK_READ(slapdFrontendConfig);
retVal = config_copy_strval(slapdFrontendConfig->pw_storagescheme->pws_name);
CFG_UNLOCK_READ(slapdFrontendConfig);
-
+
return retVal;
}
-
+
int
config_get_pw_change(void) {
slapdFrontendConfig_t *slapdFrontendConfig = getFrontendConfig();
int retVal;
-
+
CFG_ONOFF_LOCK_READ(slapdFrontendConfig);
retVal = (int)slapdFrontendConfig->pw_policy.pw_change;
CFG_ONOFF_UNLOCK_READ(slapdFrontendConfig);
diff --git a/ldap/servers/slapd/slap.h b/ldap/servers/slapd/slap.h
index a8a3176..eeed212 100644
--- a/ldap/servers/slapd/slap.h
+++ b/ldap/servers/slapd/slap.h
@@ -2213,6 +2213,8 @@ typedef struct _slapdEntryPoints {
#define MAX_ALLOWED_TIME_IN_SECS 2147483647
#define MAX_ALLOWED_TIME_IN_SECS_64 9223372036854775807
+#define DEFAULT_PASSWORD_SCHEME_NAME "SSHA512"
+
typedef struct _slapdFrontendConfig {
#if SLAPI_CFG_USE_RWLOCK == 1
Slapi_RWLock *cfg_rwlock; /* read/write lock to serialize access */
diff --git a/ldap/servers/slapd/tools/pwenc.c b/ldap/servers/slapd/tools/pwenc.c
index 08328eb..caea653 100644
--- a/ldap/servers/slapd/tools/pwenc.c
+++ b/ldap/servers/slapd/tools/pwenc.c
@@ -215,7 +215,7 @@ main(int argc, char *argv[])
}
if ( cmppwsp == NULL && pwsp == NULL ) {
- pwsp = pw_name2scheme( SALTED_SHA1_SCHEME_NAME );
+ pwsp = pw_name2scheme( DEFAULT_PASSWORD_SCHEME_NAME );
}
if ( argc <= optind ) {