This is an automated email from the git hooks/post-receive script.
rharwood pushed a commit to branch master
in repository gssproxy.
commit df9112e2cd2cb10d0ef4f7bf4e3898b41a71d30e
Author: Robbie Harwood <rharwood(a)redhat.com>
Date: Wed Mar 1 15:53:03 2017 -0500
Markdown conversion of docs from Trac
Signed-off-by: Robbie Harwood <rharwood(a)redhat.com>
Reviewed-by: Simo Sorce <simo(a)redhat.com>
PR: 161
---
proxy/docs/Apache.md | 102 +++++++++++++++++++++
proxy/docs/NFS.md | 176 ++++++++++++++++++++++++++++++++++++
proxy/docs/ProtocolDocumentation.md | 60 ++++++++++++
proxy/docs/ReleaseProcess.md | 74 +++++++++++++++
proxy/docs/Releases/v0.1.0.md | 59 ++++++++++++
proxy/docs/Releases/v0.1.2.md | 36 ++++++++
proxy/docs/Releases/v0.2.0.md | 50 ++++++++++
proxy/docs/Releases/v0.2.1.md | 20 ++++
proxy/docs/Releases/v0.2.2.md | 35 +++++++
proxy/docs/Releases/v0.2.3.md | 28 ++++++
proxy/docs/Releases/v0.3.0.md | 38 ++++++++
proxy/docs/Releases/v0.3.1.md | 34 +++++++
proxy/docs/Releases/v0.4.0.md | 57 ++++++++++++
proxy/docs/Releases/v0.4.1.md | 26 ++++++
proxy/docs/Releases/v0.5.0.md | 78 ++++++++++++++++
proxy/docs/Releases/v0.5.1.md | 23 +++++
proxy/docs/Releases/v0.6.0.md | 57 ++++++++++++
proxy/docs/Releases/v0.6.1.md | 15 +++
proxy/docs/Releases/v0.6.2.md | 12 +++
19 files changed, 980 insertions(+)
diff --git a/proxy/docs/Apache.md b/proxy/docs/Apache.md
new file mode 100644
index 0000000..3309657
--- /dev/null
+++ b/proxy/docs/Apache.md
@@ -0,0 +1,102 @@
+# Using GSS-Proxy for Apache httpd operation
+
+The traditional approach for performing Kerberos authentication in Apache 2.* is to use
the mod_auth_gssapi (historically, mod_auth_kerb would have been used) module. When using
this module, the Apache process must have read access to a keytab (configured with the
```GssapiCredStore``` option, or the default ```/etc/krb5.keytab```) containing keys for
the HTTP service. This is not optimal from a security point of view as all websites can
potentially get access to the key material. GSS-Pr [...]
+
+This page describes a setup which works on Fedora 21 with gssproxy-0.4.1-1.fc21.x86_64,
httpd-2.4.16-1.fc21.x86_64, and mod_auth_gssapi-1.3.0-2.fc21.x86_64, and verified on
Fedora 21 and RHEL 7.
+
+## Setting up GSS-Proxy
+
+The proxy will need access to the HTTP/server-name@realm's keytab. When using IPA
server, command
+
+```
+# ipa service-add HTTP/server-name
+```
+
+will create the service principal. On an IPA-enrolled client machine, the
+
+```
+# ipa-getkeytab -s $(awk '/^server =/ {print $3}' /etc/ipa/default.conf) -k
/etc/gssproxy/http.keytab -p HTTP/$(hostname -f)
+```
+
+will retrieve the keytab for the principal. In the following configuration snippet we
assume it is stored in ```/etc/gssproxy/http.keytab```. The permissions are set to 400,
owner root. The Apache user does not have access to the keytab.
+
+We need to know the Apache user numerical id to put it in the configuration file, because
GSS-Proxy uses the effective uid to distinguish the services. On my installation, the uid
is 48. Symbolic uids will be supported in a future release of gssproxy.
+
+We add a new section to the ```/etc/gssproxy/gssproxy.conf``` configuration file. This
section has to be before any section which might have ```allow_any_uid = yes```, namely
gssproxy-0.3.0 in its ```service/nfs-client```:
+
+```
+[service/HTTP]
+ mechs = krb5
+ cred_store = keytab:/etc/gssproxy/http.keytab
+ cred_store = ccache:/var/lib/gssproxy/clients/krb5cc_%U
+ euid = 48
+```
+
+There is an issue with libkrb5 creating a replay cache in /var/tmp, causing AVC denials.
It is tracked in
https://fedorahosted.org/gss-proxy/ticket/100 and it's fairly easy to
fix. Create separate directory and instruct the gssproxy service to use it.
+
+```
+# mkdir /var/lib/gssproxy/rcache
+# cat > /etc/systemd/system/gssproxy.service <<EOF
+.include /usr/lib/systemd/system/gssproxy.service
+[Service]
+Environment=KRB5RCACHEDIR=/var/lib/gssproxy/rcache
+EOF
+# systemctl daemon-reload
+```
+
+We then start the service:
+
+```
+# systemctl restart gssproxy.service
+# systemctl enable gssproxy.service
+```
+
+## Setting up Apache
+
+For Apache, we need to know the location or directory that we want to protect. For
testing purposes, we can create a simple file
+
+```
+# echo OK > /var/www/html/private
+```
+
+and configure mod_auth_gssapi to protect that location:
+
+```
+<Location /private>
+ AuthType GSSAPI
+ AuthName "GSSAPI Login"
+ Require valid-user
+</Location>
+```
+
+in some ```/etc/httpd/conf.d/*.conf``` file. Note that the path to the keytab is not
configured here since it will not be needed -- communication with GSS-Proxy via
```/var/lib/gssproxy/default.sock``` will be used instead.
+
+Furthermore, we need to tell the libraries to use the GSS-Proxy - create
```/etc/systemd/system/httpd.service``` with content
+
+```
+.include /lib/systemd/system/httpd.service
+[Service]
+Environment=GSS_USE_PROXY=1
+```
+
+Reload the configuration:
+
+```
+systemctl daemon-reload
+```
+
+When we now (re)start the Apache service
+
+```
+# systemctl restart httpd.service
+# systemctl enable httpd.service
+```
+
+we should be able to make HTTP requests against the server and they will be authenticated
if the client has a valid Kerberos ticket.
+
+## Issues
+
+On Fedora 21 and RHEL 7 with the latest updates installed, the above setup should work.
+
+
+
diff --git a/proxy/docs/NFS.md b/proxy/docs/NFS.md
new file mode 100644
index 0000000..cac1a1f
--- /dev/null
+++ b/proxy/docs/NFS.md
@@ -0,0 +1,176 @@
+# Introduction
+
+GSS-Proxy has been built as a way to provide an abstraction layer between a GSS client
(typically an application) and the credentials being used.
+This is normally used to perform privilege separation, so that a client application can
authenticate/use secure channels via GSSAPI without direct access to keying material.
+
+In the NFS server case we extended the GSS-Proxy protocol to be able to talk directly to
the in kernel NFSD. The reason we did this was to allow the kernel NFS server to handle
big tickets like those containing a MS-PAC payload that may be received by a Microsoft
client.
+For the NFS client case GSS-Proxy allows to operate impersonation behind the scenes so
that access to files is "always on" but network level security is maintained.
+
+## NFS Server
+
+To use GSS-Proxy with the NFS server you need a recent enough kernel. Anything more
recent than 3.10 should work just fine.
+
+At the time of writing the choice between using the classic rpc.scvgssd protocol and the
new gssproxy protocol is determined *once* at runtime. Once the kernel "chooses"
the method it cannot be changed. A reboot will be necessary.
+
+The kernel chooses what protocol to use on the first authentication request it receives.
It checks if a gssproxy "client" has registered in which case it will bind to
use the gssproxy protocol, otherwise it will select the classic rpc.svcgssd protocol and
stick to that one.
+
+The gssproxy client registers to the kernel by performing 2 actions in the following
order:
+
+- creates a unix socket for kernel communication in /var/run/gssproxy.sock (this path is
hardcoded in the kernel and cannot be changed at this time)
+- writes 1 byte in the proc file /proc/net/rpc/use-gss-proxy (the client must be ready to
accept a connection from the kernel when this is done, as the kernel we check that the
socket is available)
+
+
+The simplest GSS-Proxy configuration file to act as a NFSD helper is the following:
+```
+[gssproxy]
+
+[service/nfs-server]
+ mechs = krb5
+ socket = /run/gssproxy.sock
+ cred_store = keytab:/etc/krb5.keytab
+ trusted = yes
+ kernel_nfsd = yes
+ euid = 0
+```
+
+Let's see what this means, line by line:
+
+- The service is named (an arbitrary name so that the admin has a hint of what it is used
for) 'nfs-server'.
+- It limits the GSSAPI supported mechanisms to the 'krb5' mechanism (which is the
only one that NFS supports).
+- It sets the kernel socket name /run/gssproxy.sock (on my system /var/run is a symlink
to /run)
+- It defines that the server's keys are stored in /etc/krb5.keytab (the customary
place, you should have both host/ and nfs/ keys in there).
+- It marks the peer as trusted, which means we will believe the kernel when it says it is
connecting on behalf of a specific user even if the credentials (getpeercon) on the other
side of the socket say otherwise.
+- It enables the kernel extensions to the protocol (the context is exported as a lucid
context for example, and a list of resolved credentials is returned if authentication
succeeds)
+- It prevents any user but root/kernel (i.e. anything matching euid = 0 as returned by
getpeercon) from connecting to the socket.
+
+
+This is pretty much all that is needed to use GSS-Proxy as the user-space helper for the
kernel NSFD daemon when GSSAPI authentication of a client is required.
+
+
+## NFS Client
+
+The NFS client case is a little bit more complicated. For starter, at the time of writing
the NFS client code in kernel still uses the classic protocol and can only talk with the
rpc.gssd service. The interaction with GSS-Proxy, in the client case, is more subtle.
+
+The way GSS-Proxy is configured in the client case is pretty much the normal userspace
interposition, performed at the libgssapi level.
+The GSSAPI library need to be configured (either in /etc/gss.conf or
/etc/gss.conf.d/gssproxy.conf to load the GSS-Proxy interposer plugin which allows
GSS-Proxy to intercept GSSAPI calls and sprinkle a little magic on the operations (as well
as performing privilege separation).
+
+Example gss.conf
+```
+# GSS-API mechanism plugins
+#
+# Mechanism Name Object Identifier Shared Library Path Other Options
+gssproxy_v1 2.16.840.1.113730.3.8.15.1 @libdir(a)/gssproxy/proxymech.so <interposer>
+```
+
+Once this is done rpc.gssd must be started with the following environment variable
defined:
+```
+GSS_USE_PROXY="yes"
+```
+This instructs the interposer plugin to act, otherwise the interposer plugin will
silently fallback to standard GSSAPI behavior.
+
+
+In the client case the GSS-Proxy is usually employed when special cases need to be
handled. For example on unmanned systems people may need to use kerberized NFS but no
human being is present to manually create a credential cache.
+In these cases there are 2 options that can be employed based on the admin preference and
the local KDC capabilities.
+NOTE: we assume a modern version of rpc.gssd which drops privileges to the requesting uid
before calling GSSAPI.
+
+### Keytab based Client Initiation
+
+The GSS-Proxy daemon can easily initiate client credentials automatically based on a
keytab.
+In this case services (for example an Apache server) on the NFS client machines need to
access a krb5 protected mount unattended, but they can be given a Kerberos identity
(principal) and matching set of keys (stored in keytabs).
+
+The following configuration allows this mode of operation:
+```
+[service/nfs-client]
+ mechs = krb5
+ cred_store = keytab:/etc/krb5.keytab
+ cred_store = ccache:FILE:/var/lib/gssproxy/clients/krb5cc_%U
+ cred_store = client_keytab:/var/lib/gssproxy/clients/%U.keytab
+ cred_usage = initiate
+ allow_any_uid = yes
+ euid = 0
+```
+
+Let's see what this means, line by line:
+
+- The service is named (an arbitrary name so that the admin has a hint of what it is used
for) 'nfs-client'.
+- It limits the GSSAPI supported mechanisms to the 'krb5' mechanism (which is the
only one that NFS supports).
+- It defines that the client's nfs keys are stored in /etc/krb5.keytab (the customary
place).
+- It defines that ccaches created by GSS-Proxy for user's credentials are stored
under /var/lib/gssproxy/clients and use a format specifier to have a different name for
each user. "%U" translated to the use UID Number.
+- It defines that keytabs with user's keys are stored under /var/lib/gssproxy/clients
and use a format specifier to have a different name for each user. "%U"
translated to the use UID Number.
+- It marks the service usable only for initiation (this is important to avoid allowing
any user to receive connections using the system keytab).
+- It marks the service accessible by any user on the system. Each user will only be able
to use their own credentials if any are available.
+
+
+You may notice that an explicit UNIX socket is not configured, this mean this service is
exposed on the default socket that is available at /var/lib/gssproxy/default.sock by
default.
+
+The important bit here is the user's keytabs which are stored under
/var/lib/gssproxy/clients.
+If you have a HTTP service running as user Apache (uid=48) that needs to connect
unattended then keys for this user can be stored under /var/lib/gssproxy/clients/48.keytab
and this user can now always successfully use kerberized NFS w/o any additional
configuration (no cronjobs or other wrapper services necessary). The necessary credentials
will be fetched when needed from the KDC, on request.
+
+Note that if credentials are not available GSS-Proxy will return control to rpc.gssd and
the usual crawling for credentials will be attempted.
+
+Note that if you need only one specific service to connect you may also use a more
restricted service definition.
+
+Example for a system where only the Apache server uses unattended kerberized NFS mounts.
+```
+[service/apache]
+ mechs = krb5
+ cred_store = ccache:FILE:/var/lib/gssproxy/clients/krb5cc_apache
+ cred_store = client_keytab:/var/lib/gssproxy/clients/httpd.keytab
+ cred_usage = initiate
+ euid = 48
+```
+
+In this example, only the Apache user (euid = 48) is permitted to attempt to use the
GSS-Proxy service, and a fixed name for ccaches and keytab is used instead of a uid number
dependent one.
+
+
+### User Impersonation via Constrained Delegation
+
+The previous method works fine if you have a limited set of services running on the
machine that need unattended access to a NFS file system, but what to do if you have
actual physical users? Handling user's keytabs is annoying, both because it is a
liability and because user's passwords can be changed by the users (and when that
happens the keytab becomes invalid and needs to be regenerated). It also become cumbersome
pretty quickly if there are very many users.
+
+Yet in many cases there are users that run long lasting jobs on relatively trusted (by
the admin) machines and want to make sure their jobs won't fail after a day because
their credentials expire and they suddenly lose access to the NFS share. (Or maybe the job
is even batch scheduled so the user never even has a chance to leave credentials on the
machine actually running the job).
+
+In this cases, if the KDC support Constrained Delegation and specifically the
+[s4u2self and s4u2proxy protocol
extensions](https://ssimo.org/blog/id_011.html),
+then the administrator can "empower" the NFS client machine to impersonate
+arbitrary users. NOTE: not all KDCs support these extensions or have way to
+properly configure them. The 2 main products that do are Microsoft's
+[Active
Directory](http://en.wikipedia.org/wiki/Active_Directory) and the
+Linux oriented [FreeIPA](http://www.freeipa.org). NOTE: The FreeIPA s4u2proxy
+implementation can also precisely limit which services can be reached via
+delegation, for example allow the NFS client machine to obtain tickets
+exclusively for a specific NFS server, and no other service at all.
+
+The following configuration allows this mode of operation:
+```
+[service/nfs-client]
+ mechs = krb5
+ cred_store = keytab:/etc/krb5.keytab
+ cred_store = ccache:FILE:/var/lib/gssproxy/clients/krb5cc_%U
+ cred_usage = initiate
+ allow_any_uid = yes
+ impersonate = true
+ euid = 0
+```
+
+Let's see what this means, line by line:
+
+- The service is named (an arbitrary name so that the admin has a hint of what it is used
for) 'nfs-client'.
+- It limits the GSSAPI supported mechanisms to the 'krb5' mechanism (which is the
only one that NFS supports).
+- It defines that the client's nfs keys are stored in /etc/krb5.keytab (the customary
place, this is required for impersonation).
+- It defines that ccaches created by GSS-Proxy for user's credentials are stored
under /var/lib/gssproxy/clients and use a format specifier to have a different name for
each user. "%U" translated to the use UID Number.
+- It marks the service usable only for initiation (this is important to avoid allowing
any user to receive connections using the system keytab).
+- It marks the service accessible by any user on the system. Each user will only be able
to use their own credentials if any are avilable.
+- It instructs gssproxy to attempt impersonation of the requesting user.
+
+
+So what happens here if a user process tries to walk a mount point ?
+
+- the kernel asks rpc.gssd to establish a secure context with the server
+- rpc.gssd asks GSSAPI for user credentials
+- the GSSAPI mechproxy module intercepts the requests and forwards it to GSS-Proxy
+- GSS-Proxy sees that a user requested initiation, it furthermore notices that the
matching service allows impersonation. NOTE: that GSS-Proxy at this time uses a quite
unsophisticated resolution mechanism to map the user uid to a principal name, it simply
gets the user name from the system and tries to use that as the principal name (using the
default realm).
+- GSS-Proxy gets initial credentials with the system keytab, then it tries to acquire a
ticket for itself on behalf of the user (s4u2self).
+- GSS_Proxy finally tries to get a ticket for the target system using the previously
obtained ticket as evidence (s4u2proxy).
+
+If all goes well the NFS Client now can impersonate the user and successfully connect to
the NFS server.
+
diff --git a/proxy/docs/ProtocolDocumentation.md b/proxy/docs/ProtocolDocumentation.md
new file mode 100644
index 0000000..a47280e
--- /dev/null
+++ b/proxy/docs/ProtocolDocumentation.md
@@ -0,0 +1,60 @@
+# GSS-PROXY Protocol Documentation
+
+The GSS-PROXY protocol is an RPC protocol based on ONCRPC v2.
+
+## Protocol Definition
+
+The protocol definition file is currently maintained in GIT here:
+https://git.fedorahosted.org/cgit/gss-proxy.git/plain/x-files/gss_proxy.x
+
+The protocol is not stable yet and it is being revised while we progress prototyping
client and server code, however the parts used by the Linux kernel driver are considered
final and will see no backward incompatible changes.
+
+Long term we will probably submit an actual RFC to the IETF to standardize it.
+
+## Extensions
+
+There are 2 "extensions" currently being worked on for the Linux kernel
client.
+
+### Lucid context export type
+The Linux Kernel needs a special export and serialize Lucid context.
+
+To inform the proxy that this special format should be returned from the
gss_accept_se_context call, the client needs to set a gssx_option in call_ctx structure.
+
+The option field is set to the string "exported_context_type"
+
+The value field is set to the string "linux_lucid_v1"
+
+When these fields are set the proxy will return a lucid context formatted accordingly to
the Linux Kernel needs instead of a normal exported context buffer.
+
+### Export credentials flag
+When the accept_sec_context call is completed the Linux Kernel needs to be given a
credential set containing all the user uid, gid and secondary gids so that is can properly
handle access control.
+
+To inform the proxy that this data is needed the clientneeds to set a gssx_option in
call_ctx structure.
+
+The option field is set to the string "exported_creds_type"
+
+The value field is set to the string "linux_creds_v1"
+
+When these fields are set the proxy will return a buffer containing the credentials in
the accpet_sec_context call response buffer as a gssx_option.
+
+The option field is set to the string "linux_creds_v1"
+
+The value field contains the creds buffer.
+
+This buffer is composed of the fixed fields of 32 bit size and an array of 32 bit values
as follows: ` <uid>, <primary gid>, <count>, <array of
'count' secondary gids> `
+
+### Krb5 Set Allowed Enctypes
+Allows to send a krb5 mechanism specific option to set the allowed encryption types for a
credential.
+
+When a client obtains valid credentials it can attach an option to a gssx_cred_element
element of a gssx_cred credential to indicate to the server the desire to limit the
allowed encryption types used on said credential before the following call.
+On the next call, when said credentials are transmitted to the Gss Proxy, the server will
probe the received credentials and will attempt a call to gss_krb5_set_allowed_enctypes()
using the data provided in the credentials received.
+
+The gssx_cred option should be placed in a gssx_cred_element whose mech type is one of
the recognized krb5 mechanism OIDs.
+
+The option field is set to the string "krb5_set_allowed_enctype_values"
+
+The value field contains a buffer of 32bit integers
+
+The length of the buffer divided by 4 determines the number of enctypes conveyed. The
array of integers is stored in machine dependent byte order, and is cast directly into an
array of krb5_enctypes.
+
+
diff --git a/proxy/docs/ReleaseProcess.md b/proxy/docs/ReleaseProcess.md
new file mode 100644
index 0000000..58fca3d
--- /dev/null
+++ b/proxy/docs/ReleaseProcess.md
@@ -0,0 +1,74 @@
+# Release Process for GSS-Proxy
+
+The process is currently quite simple and requires write access to the project's git
repository.
+
+# Prepare the sources
+
+## Version and Tag the release
+
+
+- Commit a change in version.m4 with the new version number
+ (ex. 0.1.0)
+
+
+
+- Test locally with "make rpms" that everything builds fine
+
+
+
+- Tag the release in master like this:
+```
+git tag v0.1.0
+
+```
+ This will apply the tag to the last commit
+
+
+- Push the tag:
+```
+git push origin v0.1.0
+
+```
+
+## Create a release tarball and SHA hash
+
+
+- Run the following commands (on a git clean tree, please):
+```
+autoreconf -f -i
+./configure
+make dist
+make distcheck
+
+```
+ ... will generate a tarball named like: gssproxy-0.1.0.tar.gz
+```
+sha512sum gssproxy-0.1.0.tar.gz > gssproxy-0.1.0.tar.gz.sha512sum.txt
+```
+ ... will generate a file with a sha512 checksum
+
+## Publish the release
+
+
+- Push the tarball and sum to fedorahosting:
+ Use your ssh key in the fedora infrastructure to copy files:
+```
+scp gssproxy-0.1.0.tar.gz* fedorahosted.org:gss-proxy
+
+```
+
+
+- Create a Release page with highlights and a full changelog with the command:
+```
+git shortlog <oldtag>..<newtag>
+
+```
+
+
+- Add a link to the releases [page](/Releases) and replace the last one in the front
page.
+
+
+
+- Copy the content of the new-release page into a mail and announce on the gssproxy
mailinglist (
https://lists.fedorahosted.org/mailman/listinfo/gss-proxy)
+
+
diff --git a/proxy/docs/Releases/v0.1.0.md b/proxy/docs/Releases/v0.1.0.md
new file mode 100644
index 0000000..5eeef71
--- /dev/null
+++ b/proxy/docs/Releases/v0.1.0.md
@@ -0,0 +1,59 @@
+# Highlights
+
+
+- Various critical fixes for the interposer plugin infrastructure
+- GSS-Proxy is now fully stateless through the use of new import/export credential
functions avalable in MIT 1.11
+- Enable new kernel interface to enable GSS-Proxy support in the rpcgss kernel module
(still not mainline)
+- Add environment variables to influence interposer plugin behavior.
+- Improved tests
+- Packaging fixes, including systemd unit files fixes
+
+
+# Detailed Changeog
+Andreas Schneider (1):
+
+- Packaging fixes
+
+
+Günther Deschner (16):
+
+- build: check for gss_import_cred and gss_export_cred.
+- Change interposer usage, clients need to set GSS_USE_PROXY=1|YES.
+- Add example GSS-API mechanism plugins config file.
+- interposer-plugin: Fix MIT 1.11 gssi_import_sec_context_by_mech symbol name.
+- mechglue: fix gssi_set_cred_option() arguments.
+- mechglue: initialize gpp cred_handle in gssi_acquire_cred_with_password().
+- Add debug statement when gp_rpc_execute is called.
+- interpostest: improve debug output when gss_context_time() fails.
+- mechglue: add trace debugging
+- Fix gssi_import_sec_context_by_mech()
+- Fix gssi_context_time for remote calls.
+- Add various fixes to gssproxy.spec.
+- Add systemd packaging to gssproxy spec file.
+- Fix systemd config file for gssproxy.
+- Make it easier to test gssproxy behavior settings.
+- Test all possible proxy mode combinations.
+
+
+Simo Sorce (18):
+
+- Use new gss_import/export_cred functions
+- Move master version to 0.0.99
+- Fix includes
+- Add custom implementation of xdr_uint64_t
+- Use gssrpc instead of system rpc
+- Add support to get peer's SeLinux context
+- Remove gssproxy.service
+- Enable kernel support.
+- Make socket path a configure option
+- Write pid file at startup.
+- Create helper function to wrap token
+- Use token wrapper in gpp_remote_lo_local_ctx
+- Fix write_pid debug message
+- Improve ccache formatting.
+- Add helper function to check for krb5 oid
+- Add extension to set allowable enctypes
+- Add client side support to set allowed enctypes
+- Set version to 0.1
+
+
diff --git a/proxy/docs/Releases/v0.1.2.md b/proxy/docs/Releases/v0.1.2.md
new file mode 100644
index 0000000..ef2393d
--- /dev/null
+++ b/proxy/docs/Releases/v0.1.2.md
@@ -0,0 +1,36 @@
+# Highlights
+
+- Fixes for various issues found by Coverity
+- Switch default configuration backend to use libini_config
+
+
+# Detailed Changelog
+
+Günther Deschner (4):
+
+- Add missing newlines to GPDEBUG statements.
+- Abstract configuration layer for gssproxy.
+- Add dinglibs ini configuration detection and backend.
+- Prefer ini_config library support over iniparser support.
+
+
+Simo Sorce (16):
+
+- Fix unchecked return values found by Coverity
+- Fix copy and paste error found by Coverity
+- Fix locally dead code error found by coverity
+- Fix uninizialized variables found by Coverity
+- Fix dereference before null error fund by Coverity
+- Fix reporting of wrong error codes
+- Fix resource leaks found by Coverity
+- Fix infinite loop due to bad sign of variable
+- Fix missing break statement found by Coverity
+- Fix dereference after null checks found by Coverity
+- Use send() in client library to avoid SIGPIPE
+- Fix a few more resource leaks
+- Fix use of unintialized variable
+- Remove unused variables
+- Fix tabs in configure.ac
+- Release 0.1.1
+
+
diff --git a/proxy/docs/Releases/v0.2.0.md b/proxy/docs/Releases/v0.2.0.md
new file mode 100644
index 0000000..b816809
--- /dev/null
+++ b/proxy/docs/Releases/v0.2.0.md
@@ -0,0 +1,50 @@
+# Highlights
+
+- Switch to use cred store configuration options
+- Use the Credential Store and the Keytab Initiation features of Krb5 1.11 to handle
trusted services
+
+
+
+# Detailed Changelog
+Günther Deschner (11):
+
+- Fix memory leak in gp_service_free().
+- Silence a configure warning by adding AM_PROG_AR.
+- When checking for gssrpc libs also add gssapi library paths.
+- Add --all option to interposetest
+- Fix potential double-frees in load_services().
+- Add gp_config_get_string_array() and an implementation in dinglibs backend.
+- Use mutivalued "cred_store" parameter, deprecate unused parameters.
+- Convert gp_config_get_* to return an error.
+- Add documentation for -d!|--debug in gssproxy manpage.
+- Add more documentation in the gssproxy.conf manpage.
+- Add new gssproxy-mech.8 manpage to describe the interposer plugin
+
+
+Simo Sorce (18):
+
+- Release 0.1.1
+- Replace deprecated libtool macros
+- Import names as remote name by default.
+- Add krb5_client_keytab config option
+- Carefully process desired name based on service
+- Move string formatting in a separate function
+- Add generic function to get creds defaults
+- Use new GSSAPI Credential Store API
+- Special case client_keytab for root user
+- Treat credential store as opaquely as possible.
+- Improve default configuration.
+- Add support for per-service sockets
+- Make config functions return actual error codes.
+- Use const string in config functions
+- Fix typo in gssproxy.8 manpage
+- Require nothing less than MIT krb5 1.11.2
+- Add gssproxy-mech.8 manpage to spec file
+- Bump version for 0.2.0 release
+
+
+
+# Note
+In order to use all features of this release MIt Krb5 1.11.2 is the minimum
required.[[BR]]
+Additionally a
[
patch](https://github.com/krb5/krb5/commit/38cc076579888695a5820ceb44fe43... only
available in the development branch and targeted to 1.12 is required
+
diff --git a/proxy/docs/Releases/v0.2.1.md b/proxy/docs/Releases/v0.2.1.md
new file mode 100644
index 0000000..8e95a21
--- /dev/null
+++ b/proxy/docs/Releases/v0.2.1.md
@@ -0,0 +1,20 @@
+## Highlights
+
+
+- Minor bugfix release. No new features.
+
+
+
+## Detailed Changelog
+
+
+Günther Deschner (6):
+
+- Rename option_is_set to gp_boolean_is_true.
+- Make gp_boolean_is_true non-static.
+- Use gp_boolean_is_true from interposer plugin's GSS_USE_PROXY check.
+- Make sure non-root users can access gpstatedir.
+- Add --with-gpstate-path=PATH configure switch.
+- Bump version for 0.2.1 release.
+
+
diff --git a/proxy/docs/Releases/v0.2.2.md b/proxy/docs/Releases/v0.2.2.md
new file mode 100644
index 0000000..9efe95f
--- /dev/null
+++ b/proxy/docs/Releases/v0.2.2.md
@@ -0,0 +1,35 @@
+## Highlights
+
+
+- Minor bugfix release. No new features.
+
+
+
+## Detailed Changelog
+
+Günther Deschner (14):
+
+- Add --with-gpp-default-behavior configure switch.
+- Make error message in read_config() more precise, we fail in that case.
+- Fix unresolved symbol gp_boolean_is_true() in mechglue plugin.
+- Fix reallocation in gp_dinglibs_get_string_array().
+- Fix typo in gssi_import_name_by_mech().
+- Use counter when freeing cred_store configuration.
+- Don't forget to free gp_ini_context struct in load_config().
+- Fix two memleaks in the configuration code.
+- Add dlopen script to check for unresolved symbols.
+- Disable gss_export_name_composite() for now.
+- Overwrite existing GSS_USE_PROXY variable in the server.
+- Fix documentation of "mechs" parameter in gssproxy.conf(5).
+- Bump version for 0.2.2 release.
+- Make sure dlopen.sh is part of the tarball
+
+
+Simo Sorce (3):
+
+- Neutralize gssi_export_name.
+- Fix secondary socket detection at runtime.
+- Fix socket error handling.
+
+
+
diff --git a/proxy/docs/Releases/v0.2.3.md b/proxy/docs/Releases/v0.2.3.md
new file mode 100644
index 0000000..b62545a
--- /dev/null
+++ b/proxy/docs/Releases/v0.2.3.md
@@ -0,0 +1,28 @@
+## Highlights
+
+
+- Minor bugfix release. No new features.
+
+
+
+## Detailed Changelog
+
+Günther Deschner (10):
+
+- Make sure dlopen.sh is part of the tarball
+- Fix realloc size in gp_get_cred_environment().
+- Add "make test_proxymech" to provided specfile.
+- systemd: Make sure we start before nfs-secure services.
+- systemd: add require for the nfs kernel modules.
+- gssproxy: report an error message on event loop failure.
+- Require libverto-tevent to make sure libverto initialization succeeds
+- Use verbose ding-libs error reporting when config parsing failed.
+- Add Requires: libini_config >= 1.0.0.1 to the rpm spec file.
+- Bump version for 0.2.3 release.
+
+
+Simo Sorce (1):
+
+- Fix nfsd socket
+
+
diff --git a/proxy/docs/Releases/v0.3.0.md b/proxy/docs/Releases/v0.3.0.md
new file mode 100644
index 0000000..1f26cec
--- /dev/null
+++ b/proxy/docs/Releases/v0.3.0.md
@@ -0,0 +1,38 @@
+## Highlights
+
+
+- Add support for impersonation (depends on s4u2self/s4u2proxy on the KDC)
+- Add support for new rpc.gssd mode of operation that forks and changes uid
+- Add 2 new options allow_any_uid and cred_usage
+
+
+
+## Detailed Changelog
+
+Günther Deschner (5):
+
+- Further improve debugging, mention servicename, socket and euid.
+- Use right signedness for creds buffer.
+- Fix resource leak in gpm_accept_sec_context().
+- docs: autogenerate proxymech manpage.
+- docs: Fill in GSSPROXY_BEHAVIOR default setting from configure option.
+
+
+Simo Sorce (14):
+
+- Split nfs server and client services
+- Properly check socket for connection matching.
+- Coverity fixes.
+- Add service match using SeLinux Context
+- Fix selinux option check
+- Fix LOCAL_FIRST behavior
+- Fix documentation to match reality
+- Allow arbitrary users to connect to a service
+- Add option to specify allowed usage.
+- Add man page entry for allow_any_uid
+- Add man page entry for cred_usage
+- Move uid to name resolution in its own function.
+- Add impersonation support
+- Change version to 0.3.0
+
+
diff --git a/proxy/docs/Releases/v0.3.1.md b/proxy/docs/Releases/v0.3.1.md
new file mode 100644
index 0000000..0315370
--- /dev/null
+++ b/proxy/docs/Releases/v0.3.1.md
@@ -0,0 +1,34 @@
+## Highlights
+
+
+- Fix use of gssproxy for client initiation
+- Add new enforcing and filtering options for context initialization
+- Fix potential thread safety issues
+
+
+
+## Detailed Changelog
+
+Günther Deschner (1):
+
+- Change version to 0.3.1
+
+
+Simo Sorce (14):
+
+- Preserve requested flags and lifetime
+- Add way to return regular oid from special
+- Fix calling gpm_inquire_cred_by_mech
+- Fix continuations in context establishment calls
+- Autoinitialize creds on init_sec_context
+- Try impersonation even when a name is not provided
+- config: Add code to source flag filters
+- server: Implement flag filtering enforcement
+- man: Describe new flag filtering/enforcing options
+- config: Do not modify const strings
+- creds: Allow admins to define only client creds
+- Use secure_getenv in client and mechglue module
+- Add Thread-safe implementation of strerror()
+- Use gp_strerror() everywhere instead of strerror()
+
+
diff --git a/proxy/docs/Releases/v0.4.0.md b/proxy/docs/Releases/v0.4.0.md
new file mode 100644
index 0000000..80dd234
--- /dev/null
+++ b/proxy/docs/Releases/v0.4.0.md
@@ -0,0 +1,57 @@
+## Highlights
+
+
+- Added optional support for running GSS-Proxy as an unprivileged user
+- Uses new /etc/gss/mech.d configuration directory for gss mechanisms
+- Kernel related fixes
+- General bug fixing, many minor errors or incorrect behaviours have been corrected
+
+
+## Detailed Changelog
+
+Günther Deschner (1):
+
+- Fix potential segfault in gssi_inquire_context().
+
+
+Lukas Slebodnik (9):
+
+- BUILD: Fix building rpms
+- BUILD: Tests did not work from parallel directory
+- BUILD: Change ordering of invoking Makefiles
+- Suppress clang warning
+- Wrong coversion function was used
+- Use defined enum instead of constant
+- Fix memory leak
+- BUILD: Fix building with automake 1.15
+- Fix few build issues
+
+
+Simo Sorce (24):
+
+- Fix config token parsing.
+- Add support for dropping privileges
+- Add zero termination when the buffer is a string
+- Make name conversion more robust to failure
+- Add utility functions to read()/write() safely
+- Block parent process until child is initialized.
+- Properly cleanup mutex on failure.
+- Add cmdline option to override default socket
+- Add a test framework for gss-proxy
+- Zero out the outputs of display_name
+- Install gssproxy mechanism config in mech.d
+- Generalize GSS Display Status logger code
+- Log why acquiring credentials failed.
+- Do not open logfile multiple times
+- Prevent a backtrace when a subprocess is not found
+- Use different env vars bases for gssapi tests
+- Really use gss-proxy in tests
+- Fix cast error
+- Fix error in compiling without SELinux
+- Default to systemd initscript in rpm spec file
+- Fix variable replacement in non config files
+- Properly handle security contexts on error
+- Suppress exported_composite_name for the kernel
+- Release version 0.4.0
+
+
diff --git a/proxy/docs/Releases/v0.4.1.md b/proxy/docs/Releases/v0.4.1.md
new file mode 100644
index 0000000..958dfcd
--- /dev/null
+++ b/proxy/docs/Releases/v0.4.1.md
@@ -0,0 +1,26 @@
+## Highlights
+
+
+- Fixes a bug in generating the example config files
+- Other minor !Coverity/Clang fixes for issues introduced by the last version
+
+
+## Detailed Changelog
+
+Lukas Slebodnik (4):
+
+- Fix warning value stored to 'ret' is never read
+- Remove unused parameter from get_pipe_name
+- Include header file with prototypes in implementation module
+- Suppress warning: use after free
+
+
+Simo Sorce (5):
+
+- Switch to use pkg-config for krb5-gssapi
+- Use pkg-config for krb5 libs too
+- Fix handling of context initialization
+- Fix configuration file substitutions
+- Release version 0.4.1
+
+
diff --git a/proxy/docs/Releases/v0.5.0.md b/proxy/docs/Releases/v0.5.0.md
new file mode 100644
index 0000000..edc08fb
--- /dev/null
+++ b/proxy/docs/Releases/v0.5.0.md
@@ -0,0 +1,78 @@
+## Highlights
+
+
+- Added support for config directory and config snippets and reload on SIGHUP
+- Improved debug logging/tracing
+- Actually implemented the docuemnted krb5_principal option
+- Numerous bugfixes
+
+
+## Detailed Changelog
+
+Lukas Slebodnik (1):
+
+- BUILD: Include gp_rpc_debug.h into tarball
+
+
+Robbie Harwood (24):
+
+- Extract generalized selinux context comparison function
+- Ensure ini_config >= 1.2.0 for `ini_config_augment()`
+- Fix formatting on noncompliant copyright lines
+- Allow configdir and configfile to be specified together
+- getpwman(3) can return NULL without setting errno
+- Reload config on SIGHUP
+- Use pkg-config to find libgssapi-krb5.so*
+- Correct handling of EINTR on read()/write()
+- Port test suite to python3
+- Add tests for reloading on SIGHUP
+- Log useful message on kernel interface failure
+- Clear message structure before decoding into it
+- Fix potential deadlock on socket grab
+- Fix possible explicit NULL deref in gpm_accept_sec_context
+- Fix several leaks
+- Set C standard used to gnu99
+- Fix for gss_inquire_attrs_for_mech accepting NULLs
+- Specify KRB5RCACHEDIR in systemd unit file
+- Allow symbolic euids in conf files
+- Remove one layer of abstraction over dinglibs
+- Add support for config directories
+- Update man pages for symbolic euids and config snippets
+- Error on `allow_any_uid` issues
+- Add HTTP service and move NFS into its own conf file
+
+
+Roland Mainz (3):
+
+- Turn on strict aliasing rules
+- Remove support for iniparse library
+- Update BUILD.txt
+
+
+Simo Sorce (23):
+
+- Fix make clean
+- Fix const warning in gp_creds.c
+- Fix const warning that can lead to issues
+- Improve code in gp_export_gssx_cred()
+- Add options to specify a debug level
+- Add higher level debugging for all rpc calls
+- Add helper to find options in rpc messages
+- Add gss_acquire_cred_impersonate_name support
+- Add helpers to store and retrieve encrypted creds
+- Fix acquiring default credentials
+- Add acquire test and generally improve tests
+- Use t_utils.h in all tests.
+- Appropriately resolve const warnings in tests.
+- Add impersonate test
+- Better naming for tests log files
+- Always use valgrind for gssproxy tests
+- Since krb5 1.14 inquire_context may return no name
+- Fix crash bug when reconfiguring service
+- Fix use after free bug
+- Implement the krb5_principal option
+- Add test to verify krb5_principal works
+- Allow to specify a client name for init tests
+- Release version 0.5.0
+
+
diff --git a/proxy/docs/Releases/v0.5.1.md b/proxy/docs/Releases/v0.5.1.md
new file mode 100644
index 0000000..c55a7ad
--- /dev/null
+++ b/proxy/docs/Releases/v0.5.1.md
@@ -0,0 +1,23 @@
+## Highlights
+
+
+- Fix bug with export creds that can cause NFS failures
+- Fix bug with uid/pid/gid changes that can break autofs
+
+
+## Detailed Changelog
+
+Andrew Elble (1):
+
+- Fix typo in gp_get_export_creds_type()
+
+
+Robbie Harwood (3):
+
+- Fix return check on gp_conv_gssx_to_name
+- Use new socket if uid, pid, or gid changes
+- Release version 0.5.1
+
+
+
+
diff --git a/proxy/docs/Releases/v0.6.0.md b/proxy/docs/Releases/v0.6.0.md
new file mode 100644
index 0000000..d1e2da5
--- /dev/null
+++ b/proxy/docs/Releases/v0.6.0.md
@@ -0,0 +1,57 @@
+## Highlights
+
+
+- Test suite improvements
+- Improved tracing and debugging
+- s4u2proxy and s4u2self controls
+- Misc. leak fixes
+
+
+## Detailed Changelog
+Robbie Harwood (24):
+
+- Deploy KDC on LDAP instead of db2
+- Package runtests.py in dist tarball
+- Add configure option for build hardening
+- Fix NULL deref in gssi_release_name()
+- Fix NULL deref in gssi_release_cred()
+- Fix type of argument to gppint_get_def_creds()
+- Appease clang with memset instead of initializer
+- Fix two leaks in gp_get_cred_environment()
+- Fix leak of localname in gp_export_creds_linux()
+- Fix leak of ach in gp_accept_sec_context()
+- Remove sysvinit support
+- Cause `make check` to behave as expected
+- Split out test library functions
+- Split out each test into its own file
+- Separate out test return checking logic
+- Indent subtests
+- Lower 30-second timeouts to 10
+- Add test for cred store extensions
+- Include new tests in `make dist` tarball
+- Default to a MEMORY cred_store ccache
+- Exercise default ccache behavior in test suite
+- Sync package spec file with fedora
+- Raise failures in test suite
+- Release version 0.6.0
+
+
+Simo Sorce (15):
+
+- Add cred_store support for local calls.
+- Make sure to pass on request for delegated creds
+- In acquire_cred_from, probe for remote creds
+- Always initialize ccache when storing.
+- Trace the gssproxy process too.
+- Improved debug options
+- Fix print_return logic
+- Use a local keytab for creds encryption
+- Parse cred_store struct earlier
+- Make local call static
+- Add control to permit/deny protocol transition
+- Control access to constrained delegation
+- Add more impersonation tests
+- Fix impersonation tests to work properly
+- Fix make distcheck
+
+
diff --git a/proxy/docs/Releases/v0.6.1.md b/proxy/docs/Releases/v0.6.1.md
new file mode 100644
index 0000000..11d9ba9
--- /dev/null
+++ b/proxy/docs/Releases/v0.6.1.md
@@ -0,0 +1,15 @@
+Highlights:
+
+- Fix an error with missing keytab
+
+
+Robbie Harwood (1):
+
+- Release version 0.6.1
+
+
+Simo Sorce (1):
+
+- Missing keytab should not be fatal
+
+
diff --git a/proxy/docs/Releases/v0.6.2.md b/proxy/docs/Releases/v0.6.2.md
new file mode 100644
index 0000000..0f7e308
--- /dev/null
+++ b/proxy/docs/Releases/v0.6.2.md
@@ -0,0 +1,12 @@
+Highlights:
+
+- Fix a crash bug
+
+
+Robbie Harwood (2):
+
+- Fix allocation of cred_store to have two extra slots
+- Release version 0.6.2
+
+
+
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.