[Fedora-directory-devel] Installing FDS
by Joe Baker
Is there a good howto for installing Fedora Directory Server (FDS) on a
Fedora Core 5 system.
I've heard many good things about FDS. I'd like to begin migrating from
our old Mandriva 9.1 system running OpenLDAP to FDS.
I've been surprised that FDS hasn't shown up over on Gentoo as an ebuild
script.
I tried but failed to install FDS on CentOS 4.
I'm looking for an easy way to try FDS but my past installation attempts
have left me thinking it is a difficult thing to get right.
-Joe Baker
17 years, 2 months
Re: [Fedora-directory-devel] TLS upgrades with mod_nss
by Peter Djalaliev
Rob,
I made most changes required to mod_nss. You recommended looking in
nss_hook_Access() to see how to force a TLS handshake. In this function,
the TLS handshake is renegotiated from scratch to reflect any reconfigured
parameters, right?
In the case of upgrading HTTP to TLS, there has been no previous TLS
handshake. Should I still use the SSL_ReHandshake function (as in
nss_hook_Access)? Or, would I need to call SSL_ResetHandshake instead?
Regards,
Peter
17 years, 2 months
[Fedora-directory-devel] Re: TLS upgrades with mod_nss
by Peter Djalaliev
No, there are not any browsers that support this, but apparently it is not
very complicated to implement server-requested TLS upgrades in Firefox or
any another application using NSS:
http://archive.netbsd.se/?ml=mozilla-crypto&a=2005-10&t=1393140
The way I see it, Firefox would look for responses with HTTP 426 (Upgrade
Required) code and then the exchange specified in RFC2817 would take place.
I am not sure this will actually work :) One step at a time... :)
Apparently, it has been done before, but not documented.
Peter
17 years, 2 months
[Fedora-directory-devel] TLS upgrades with mod_nss
by Peter Djalaliev
Hello,
Apache/mod_ssl supports TLS upgrades (RFC2817) in version 2.2.0 and I was
wondering - has anybody anybody ported this to mod_nss?
If not, I will try to implement TSL upgrades in mod_nss. I can find online
the patch that was probably applied to mod_ssl to implement the TLS upgrades
there and my plan is to start from there and try to make equivalent changes
to mod_nss.
Does anybody have any advice as to what I should be careful about - e.g.
places where mod_nss might require something more than just changes
equivalent to those done to mod_ssl? Two of the significant differences b/n
mod_nss and mod_ssl that I can think of right now are the NSS database vs.
the mod_ssl certificate and key files, as well as that mod_nss always
authenticates the whole certificate chain.
>From what I see so far the main changes that need to be made to mod_nss are
in the way the module configures: itself (ssl_init_Modules), the SSL engine
(nss_cmd_NSSEngine) and a server (ssl_init_ConfigureServer). Also, changed
would be needed in the Access handler, Authentication handler, Read Request
handler, and Fixup hook functions.
An additional question is: where is the nss_cmd_NSSEngine function invoked?
It's function prototype should be changed because now the NSSEngine state is
not simply a boolean, but I can't find where the function is invoked from...
Thanks in advance :)
Regards,
Peter
17 years, 2 months
[Fedora-directory-devel] Re: [Fedora-directory-users] Announcing Fedora Directory Server 1.0.2
by Rich Megginson
David Hollis wrote:
>On Thu, 2006-03-02 at 07:55 -0700, Richard Megginson wrote:
>
>
>
>>* Support for Linux x86_64 - RPMs for Fedora Core 4 and Fedora
>>Core3/RHEL4 x86_64 are
>>on the Download page.
>>
>>
>
>Would the x86_64 support be of the "it builds and it might work. Use at
>your own risk" variety or "it builds, it works, we've fully tested and
>would be the enterprise on it" variety?
>
The former. This is the first time we've released on x86_64. However,
we've had native 64 bit support for years on Sun and HP, so it's not as
if this is the first ever native 64 bit version that has a lot of latent
64 bit porting issues.
>I've been waiting to finally
>upgrade from OpenLDAP until there was a native 64-bit version, and now
>it's here.
>
>
>
>------------------------------------------------------------------------
>
>--
>Fedora-directory-users mailing list
>Fedora-directory-users(a)redhat.com
>https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
>
17 years, 3 months
[Fedora-directory-devel] [SECURITY] Fedora Directory Server 1.0.1 Update
by Rich Megginson
---------------------------------------------------------------------
Fedora Directory Server Update Notification
2006-03-01
---------------------------------------------------------------------
Product : Fedora Directory Server
Name : Directory Server
Version : 1.0.1
Release : 1
Summary : The core LDAP server engine
Description :
The core directory server component of Fedora Directory Server is the
LDAP server engine/daemon.
---------------------------------------------------------------------
Update Information:
Evgeny Legerov of GLEG, Ltd. (http://www.gleg.net/) discovered several
flaws affecting Fedora Directory Server using the GLEG ProtoVer LDAP
test suite. A remote attacker who is able to connect to the directory
server could send malicious requests which would cause the server to
crash leading to a denial of service.
The Common Vulnerabilities and Exposures project assigned the names
CVE-2006-0451, CVE-2006-0452, and CVE-2006-0453 to these issues.
---------------------------------------------------------------------
This update is available by upgrading to Fedora Directory Server 1.0.2
available here:
http://directory.fedora.redhat.com/wiki/Download
The above link has instructions for downloading the new version and
upgrading older versions.
17 years, 3 months