[freeipa PR#2150][opened] Disable Pylint 2.0 violations
by netoarmando
URL: https://github.com/freeipa/freeipa/pull/2150
Author: netoarmando
Title: #2150: Disable Pylint 2.0 violations
Action: opened
PR body:
"""
Opening this Pull Request to discuss if this violations should be ignored or addressed any other way.
Specifically `bad-mcs-classmethod-argument` (C0204) seems to be caused by a bug in the current version of Pylint (2.0.0.dev2), setting `valid-metaclass-classmethod-first-arg` to its default value (`mcs`) fixed the issue.
Globally disabling the following violations:
- `consider-using-get` (R1715):
Consider using dict.get for getting values from a dict if a key is
present or a default if not Using the builtin dict.get for getting a
value from a dictionary if a key is present or a default if not, is
simpler and considered more idiomatic, although sometimes a bit slower
- `assignment-from-no-return` (E1111):
Assigning to function call which doesn't return. Used when an
assignment is done on a function call but the inferred function
doesn't return anything.
Locally disabling the following:
- `subprocess-popen-preexec-fn` (W1509):
Using preexec_fn keyword which may be unsafe in the presence of
threads The preexec_fn parameter is not safe to use in the presence
of threads in your application. The child process could deadlock
before exec is called. If you must use it, keep it trivial! Minimize
the number of libraries you call into.
https://docs.python.org/3/library/subprocess.html#popen-constructor
- `missing-format-attribute` (W1306):
Missing format attribute %r in format specifier %r Used when a
PEP 3101 format string uses an attribute specifier ({0.length}),
but the argument passed for formatting doesn't have that attribute.
This message can't be emitted when using Python < 2.7.
- `consider-using-set-comprehension` (R1718):
Consider using a set comprehension Although there is nothing
syntactically wrong with this code, it is hard to read and can be
simplified to a set comprehension.Also it is faster since you don't
need to create another transient list
- `keyword-arg-before-vararg` (W1113):
Keyword argument before variable positional arguments list in the
definition of %s function When defining a keyword argument before
variable positional arguments, one can end up in having multiple
values passed for the aforementioned parameter in case the method is
called with keyword arguments.
- `dict-keys-not-iterating` (W1655):
dict.keys referenced when not iterating Used when dict.keys is
referenced in a non-iterating context (returns an iterator in
Python 3)
- `comprehension-escape` (W1662):
Using a variable that was bound inside a comprehension Emitted when
using a variable, that was bound in a comprehension handler, outside
of the comprehension itself. On Python 3 these variables will be
deleted outside of the comprehension.
Issue: https://pagure.io/freeipa/issue/7614
Signed-off-by: Armando Neto <abiagion(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/2150/head:pr2150
git checkout pr2150
5 years, 10 months
[freeipa PR#2156][opened] [Backport][ipa-4-6] Fix Pylint 2.0 violations
by tiran
URL: https://github.com/freeipa/freeipa/pull/2156
Author: tiran
Title: #2156: [Backport][ipa-4-6] Fix Pylint 2.0 violations
Action: opened
PR body:
"""
Manual backport of PR #2149 to 4.6 branch
Fix the following violations aiming to support Pylint 2.0
- `unneeded-not` (C0113):
Consider changing "not item in items" to "item not in items" used
when a boolean expression contains an unneeded negation.
- `useless-import-alias` (C0414):
Import alias does not rename original package Used when an import
alias is same as original package.e.g using import numpy as numpy
instead of import numpy as np
- `raising-format-tuple` (W0715):
Exception arguments suggest string formatting might be intended Used
when passing multiple arguments to an exception constructor, the
first of them a string literal containing what appears to be
placeholders intended for formatting
- `bad-continuation` (C0330):
This was already included on the disable list, although with current
version of pylint (2.0.0.dev2) violations at the end of the files
are not being ignored.
See: https://github.com/PyCQA/pylint/issues/2278
- `try-except-raise` (E0705):
The except handler raises immediately Used when an except handler
uses raise as its first or only operator. This is useless because it
raises back the exception immediately. Remove the raise operator or
the entire try-except-raise block!
- `consider-using-set-comprehension` (R1718):
Consider using a set comprehension Although there is nothing
syntactically wrong with this code, it is hard to read and can be
simplified to a set comprehension.Also it is faster since you don't
need to create another transient list
- `dict-keys-not-iterating` (W1655):
dict.keys referenced when not iterating Used when dict.keys is
referenced in a non-iterating context (returns an iterator in
Python 3)
- `comprehension-escape` (W1662):
Using a variable that was bound inside a comprehension Emitted when
using a variable, that was bound in a comprehension handler, outside
of the comprehension itself. On Python 3 these variables will be
deleted outside of the comprehension.
Issue: https://pagure.io/freeipa/issue/7614
Signed-off-by: Armando Neto <abiagion(a)redhat.com>
Reviewed-By: Christian Heimes <cheimes(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/2156/head:pr2156
git checkout pr2156
5 years, 10 months
[freeipa PR#2153][opened] Fedora 29: No longer build python2-ipaserver
by tiran
URL: https://github.com/freeipa/freeipa/pull/2153
Author: tiran
Title: #2153: Fedora 29: No longer build python2-ipaserver
Action: opened
PR body:
"""
Some Python 2 dependencies such as python2-pki are no longer available
on Fedora 29. The pki package is a required dependency of
python2-ipaserver. It's not yet feasible to remove all Python 2
packages, since fleetcommander is not fully ported to Python 3 yet.
On Fedora 29, python2-ipaserver and python2-ipatests are no longer
built. The Python 3 packages replace the Python 2 packages.
Signed-off-by: Christian Heimes <cheimes(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/2153/head:pr2153
git checkout pr2153
5 years, 10 months
[freeipa PR#2149][opened] Fix Pylint 2.0 violations
by netoarmando
URL: https://github.com/freeipa/freeipa/pull/2149
Author: netoarmando
Title: #2149: Fix Pylint 2.0 violations
Action: opened
PR body:
"""
Fix the following violations aiming to support Pylint 2.0
- `unneeded-not` (C0113):
Consider changing "not item in items" to "item not in items" used
when a boolean expression contains an unneeded negation.
- `useless-import-alias` (C0414):
Import alias does not rename original package Used when an import
alias is same as original package.e.g using import numpy as numpy
instead of import numpy as np
- `raising-format-tuple` (W0715):
Exception arguments suggest string formatting might be intended Used
when passing multiple arguments to an exception constructor, the
first of them a string literal containing what appears to be
placeholders intended for formatting
- `bad-continuation' (C0330):
This was already included on the disable list, although with current
version of pylint (2.0.0.dev2) violations at the end of the files
are not being ignored.
See: https://github.com/PyCQA/pylint/issues/2278
- `try-except-raise` (E0705):
The except handler raises immediately Used when an except handler
uses raise as its first or only operator. This is useless because it
raises back the exception immediately. Remove the raise operator or
the entire try-except-raise block!
Issue: https://pagure.io/freeipa/issue/7614
Signed-off-by: Armando Neto <abiagion(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/2149/head:pr2149
git checkout pr2149
5 years, 10 months
Proposal for new password syntax checking in FreeIPA
by Mark Reynolds
Hello,
I've written up a basic design doc below of what I am proposing for
FreeIPA. This work has already been done in 389 Directory Server, and
it can be easily ported to FreeIPA (which I am volunteering to do).
While there are other features we would like to add, these are the
features that most customers are "asking" for today, and these are the
features that we can easily "add" today. Please look it over, and share
your thoughts if this design is acceptable.
Thanks,
Mark
Enhance Password Policy Features in FreeIPA
===========================================
Customers have been requesting a richer set of password policy syntax
checking features. Mainly everybody wants the feature set from
pam_pwquality, and one particular customer has explicitly asked for a
feature to reject duplicate sequences of a particular length. Not all
of the pam_pwquality features can be ported to FreeIPA because some of
the features require you have the current password in clear text. The
following list contains the features that need to be added (and can be
added) to FreeIPA.
New Feature List
----------------------------------------
- Palindrome Checks (on/off)- password can not be a palindrome.
(pam_pwquality)
- Sequence Checks (length) - password can not have a monotonic sequence
(1234, abcd, 4321, dcba) of set length in password. (pam_pwquality)
- Sequence Sets (length) - password can not have duplicate monotonic
sequences of set length: ma123_123jF (customer request)
- Consecutive Character Classes (length) - Password can not have
consecutive characters from the same class/category greater than the
length. If set to 3, then this password is invalid: azd5555_f -> there
are 4 consecutive digits which exceeds the limit of 3. (pam_pwquality)
- Dictionary Check (on/off) - Checks password against CrackLib.
(pam_pwquality)
- Outstanding SELinux issue is blocking the dictionary check from
working: https://Bugzilla.redhat.com/show_bug.cgi?id=1599726et
- Dictionary Path (string) - Path to custom CrackLib dictionary files.
(pam_pwquality)
- Bad Words (string) - space separated list of words that are not
allowed to be in passwords. (pam_pwquality)
- User Attributes (string) - space separated list of attributes whose
values (tokens of values) are not allowed in the new password.
(pam_pwquality)
- This requires another setting (krbPwdMinTokenLength) that does
not currently exist in FreeIPA.
- Minimum number of digits (length) - (pam_pwquality)
- Minimum number of alphas (length) - (pam_pwquality)
- Minimum number of special characters (length) - (pam_pwquality)
- Minimum number of 8-bit characters (length) - (pam_pwquality)
- Minimum number of uppercase (length) - (pam_pwquality)
- Minimum number of lowercase (length) - (pam_pwquality)
- Maximum repeated characters (length) - (pam_pwquality)
Configuration
-----------------------------------------
Current FreeIPA Password Policy Configuration:
dn: cn=global_policy,cn=MARKFREE.COM,cn=kerberos,dc=markfree,dc=com
objectClass: top
objectClass: nsContainer
objectClass: krbPwdPolicy
krbMinPwdLife: 3600
krbPwdMinDiffChars: 0
krbPwdMinLength: 8
krbPwdHistoryLength: 0
krbMaxPwdLife: 7776000
krbPwdMaxFailure: 6
krbPwdFailureCountInterval: 60
krbPwdLockoutDuration: 600
cn: global_policy
New Attributes to add to objectclass "krbPwdPolicy":
krbPwdPalindrome: on
krbPwdMaxSequence: 4
krbPwdMaxSeqSets: 2
krbPwdMaxCharClass: 3
krbPwdMinDigits: 1
krbPwdMinAlphas: 1
krbPwdMinSpecial: 1
krbPwdMin8bit: 0
krbPwdMinUppers: 1
krbPwdMinLowers: 1
krbPwdMaxRepeated: 3
krbPwdDictCheck: on
krbPwdDictPath: /path/to/custom/cracklib/dict/files
krbPwdBadWords: redhat fedora
krbPwdUserAttrs: uid cn sn givenname mail
krbPwdMinTokenLength: 3 **works only with "krbPwdUserAttrs".
Example: if any 3 consecutive characters from "uid" (and friends) are in
the new password then it is rejected
Implementation
-------------------------------------------
Dictionary Checks require linking with CrackLib as follows:
diff --git a/freeipa.spec.in b/freeipa.spec.in
index 0ebc6df3e..ba573a00f 100755
--- a/freeipa.spec.in
+++ b/freeipa.spec.in
@@ -148,6 +148,7 @@ BuildRequires: libini_config-devel
BuildRequires: cyrus-sasl-devel
%if ! %{ONLY_CLIENT}
BuildRequires: 389-ds-base-devel >= %{ds_version}
+BuildRequires: cracklib-devel
diff --git a/util/Makefile.am b/util/Makefile.am
index be40e8699..5c24be2b9 100644
--- a/util/Makefile.am
+++ b/util/Makefile.am
@@ -14,3 +14,4 @@ libutil_la_SOURCES = ipa_krb5.c \
ipa_pwd_ntlm.c
libutil_la_LIBADD = $(CRYPTO_LIBS) $(KRB5_LIBS) $(LDAP_LIBS)
$(NSS_LIBS)
+libutil_la_LDFLAGS = -lcrack
pam_pwquality is open sourced and has been ported to 389 Directory
Server. The changes in 389 DS can basically be copied and pasted into
FreeIPA source (around ipapwd_CheckPolicy() in
daemons/ipa-slapi-plugins/ipa-pwd-extop/common.c). The major change
here is that we need to provide the Slapi_Entry to ipapwd_CheckPolicy()
so you can check its attributes/values for the "User Attribute"
comparison feature (I've actually already coded this in a beta patch).
5 years, 10 months