Author: rmeggins
Update of /cvs/dirsec/adminserver/admserv/newinst/src
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv3405/adminserver/admserv/newinst/src
Modified Files:
Tag: Directory_Server_8_0_Branch
AdminServer.pm.in
Log Message:
Reviewed by: nkinder (Thanks!)
Branch: Directory_Server_8_0_Branch
Fix Description: I changed security to get the security file directory for the directory
server from cn=config from that directory server. Unfortunately, I didn't take into
consideration that the CGI might have to use LDAPS to connect. If you have checked the
Use SSL for Console button in the console when configuring that directory server for SSL,
the CGIs will attempt to use LDAPS. In this case, there were several problems:
1) NSS was not initialized - need to use the admin server key/cert db to talk LDAPS to the
directory server
2) When I did do the NSS init, it failed because the admin server key/cert db did not
exist, and the directory was not writable.
3) I needed to shutdown NSS so that the key/cert db for the directory server itself could
be opened in order to get its contents
The consequences of this are that now, when you attempt to use NSS for the first time, if
the key/cert databases do not exist, they will be created empty. If the user sets up the
directory server for SSL, and tells the console to use SSL with this directory server, the
user will have to install the CA certificate in the admin server key/cert db, so that the
console and admin CGIs can talk to that directory server using LDAPS.
I changed all of the admin server CGIs to properly initialize NSS in case they too needed
to speak LDAPS for some reason. I also cleaned up several compiler warnings in the admin
server CGIs.
I believe this is also the same problem as
https://bugzilla.redhat.com/show_bug.cgi?id=430499
Platforms tested: RHEL5, Fedora 8, Fedora 9
Flag Day: no
Doc impact: no
QA impact: Will need to test various console interactions with SSL with admin server and
directory server.
New Tests integrated into TET: none
Index: AdminServer.pm.in
===================================================================
RCS file: /cvs/dirsec/adminserver/admserv/newinst/src/AdminServer.pm.in,v
retrieving revision 1.12.2.1
retrieving revision 1.12.2.2
diff -u -r1.12.2.1 -r1.12.2.2
--- AdminServer.pm.in 14 Jul 2008 19:30:16 -0000 1.12.2.1
+++ AdminServer.pm.in 14 Jul 2008 20:14:16 -0000 1.12.2.2
@@ -66,6 +66,15 @@
my $admConf = getAdmConf($configdir);
my $uid = getpwnam $admConf->{sysuser};
+ # chown the config directory
+ $! = 0; # clear errno
+ chown $uid, -1, $configdir;
+ if ($!) {
+ $setup->msg($FATAL, 'error_chowning_file', $configdir,
+ $admConf->{sysuser}, $!);
+ return 0;
+ }
+
# chown and chmod other files appropriately
for (glob("$configdir/*")) {
# these are owned by root