Compare commits
No commits in common. 'c10-beta' and 'c9' have entirely different histories.
@ -1 +1 @@
|
||||
bc93feb781e01b2101e06e413f65924d4f633d0a SOURCES/authselect-1.5.0.tar.gz
|
||||
9c2bb483de9209a00df4f69368245fdf3b8f635c SOURCES/authselect-1.2.6.tar.gz
|
||||
|
||||
@ -1 +1 @@
|
||||
SOURCES/authselect-1.5.0.tar.gz
|
||||
SOURCES/authselect-1.2.6.tar.gz
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,101 +0,0 @@
|
||||
From adb36ae3633e2dfaa9c21bb45d05551f1ea3d749 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
|
||||
Date: Wed, 21 Feb 2024 14:27:49 +0100
|
||||
Subject: [PATCH 01/11] sssd: reintroduce with-files-access-provider
|
||||
|
||||
This is still needed to support .k5login file with proxy domain. For
|
||||
example:
|
||||
|
||||
```
|
||||
[domain/proxy]
|
||||
id_provider = proxy
|
||||
proxy_lib_name = files
|
||||
access_provider = krb5
|
||||
auth_provider = krb5
|
||||
krb5_server = kdc.test
|
||||
krb5_realm = TEST
|
||||
```
|
||||
---
|
||||
profiles/sssd/README | 10 ++++++++++
|
||||
profiles/sssd/fingerprint-auth | 2 +-
|
||||
profiles/sssd/password-auth | 2 +-
|
||||
profiles/sssd/smartcard-auth | 2 +-
|
||||
profiles/sssd/system-auth | 2 +-
|
||||
5 files changed, 14 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/profiles/sssd/README b/profiles/sssd/README
|
||||
index 770891a338754b53ee48ba34d9d80c2f2f31cdb6..f7aaba8ecca4bc18a0e57d2334c2030fd26fda0d 100644
|
||||
--- a/profiles/sssd/README
|
||||
+++ b/profiles/sssd/README
|
||||
@@ -89,6 +89,16 @@ with-mdns4::
|
||||
with-mdns6::
|
||||
Enable multicast DNS over IPv6.
|
||||
|
||||
+with-files-access-provider:: If set, account management for local users is
|
||||
+ handled also by pam_sss. This can be used to support SSSD's proxy domain
|
||||
+ that is configured to serve users from local files but provide
|
||||
+ authentication and access management (.k5login file) via Kerberos.
|
||||
+
|
||||
+ *WARNING:* SSSD access check will become mandatory for local users and
|
||||
+ if SSSD is stopped then local users will not be able to log in. Only
|
||||
+ system accounts (as defined by pam_usertype, including root) will be
|
||||
+ able to log in.
|
||||
+
|
||||
with-gssapi::
|
||||
If set, pam_sss_gss module is enabled to perform user authentication over
|
||||
GSSAPI.
|
||||
diff --git a/profiles/sssd/fingerprint-auth b/profiles/sssd/fingerprint-auth
|
||||
index 94232086a60f56976bd5182f5d10da9c63ec22b6..20ad3613e66ec85c7d2462d0449854e522383b3a 100644
|
||||
--- a/profiles/sssd/fingerprint-auth
|
||||
+++ b/profiles/sssd/fingerprint-auth
|
||||
@@ -11,7 +11,7 @@ auth required pam_deny.so
|
||||
account required pam_access.so {include if "with-pamaccess"}
|
||||
account required pam_faillock.so {include if "with-faillock"}
|
||||
account required pam_unix.so
|
||||
-account sufficient pam_localuser.so
|
||||
+account sufficient pam_localuser.so {exclude if "with-files-access-provider"}
|
||||
account sufficient pam_usertype.so issystem
|
||||
account [default=bad success=ok user_unknown=ignore] pam_sss.so
|
||||
account required pam_permit.so
|
||||
diff --git a/profiles/sssd/password-auth b/profiles/sssd/password-auth
|
||||
index 05487ca293138a1154cb6820dbc9a53770904670..97c33b678706e7eeb86bf45251baa41739f2940f 100644
|
||||
--- a/profiles/sssd/password-auth
|
||||
+++ b/profiles/sssd/password-auth
|
||||
@@ -18,7 +18,7 @@ account required pam_access.so
|
||||
account required pam_faillock.so {include if "with-faillock"}
|
||||
account sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
account required pam_unix.so
|
||||
-account sufficient pam_localuser.so
|
||||
+account sufficient pam_localuser.so {exclude if "with-files-access-provider"}
|
||||
account sufficient pam_usertype.so issystem
|
||||
account [default=bad success=ok user_unknown=ignore] pam_sss.so
|
||||
account required pam_permit.so
|
||||
diff --git a/profiles/sssd/smartcard-auth b/profiles/sssd/smartcard-auth
|
||||
index 540556ce89b727a226bec4d3322a1775ef350253..78cb329bf332f4d629740a0fff7d2dfe43f7d78d 100644
|
||||
--- a/profiles/sssd/smartcard-auth
|
||||
+++ b/profiles/sssd/smartcard-auth
|
||||
@@ -11,7 +11,7 @@ auth required pam_deny.so
|
||||
account required pam_access.so {include if "with-pamaccess"}
|
||||
account required pam_faillock.so {include if "with-faillock"}
|
||||
account required pam_unix.so
|
||||
-account sufficient pam_localuser.so
|
||||
+account sufficient pam_localuser.so {exclude if "with-files-access-provider"}
|
||||
account sufficient pam_usertype.so issystem
|
||||
account [default=bad success=ok user_unknown=ignore] pam_sss.so
|
||||
account required pam_permit.so
|
||||
diff --git a/profiles/sssd/system-auth b/profiles/sssd/system-auth
|
||||
index 83f9214fdd0a97ec49a8df52a2e202e034cbc0c6..90c3504a414f0a151475cc207285b230fec381b1 100644
|
||||
--- a/profiles/sssd/system-auth
|
||||
+++ b/profiles/sssd/system-auth
|
||||
@@ -25,7 +25,7 @@ account required pam_access.so
|
||||
account required pam_faillock.so {include if "with-faillock"}
|
||||
account sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
account required pam_unix.so
|
||||
-account sufficient pam_localuser.so
|
||||
+account sufficient pam_localuser.so {exclude if "with-files-access-provider"}
|
||||
account sufficient pam_usertype.so issystem
|
||||
account [default=bad success=ok user_unknown=ignore] pam_sss.so
|
||||
account required pam_permit.so
|
||||
--
|
||||
2.42.0
|
||||
|
||||
@ -0,0 +1,48 @@
|
||||
From 9b52842d6b4b6ae0ad1f36d3d731d7afc94338e1 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
|
||||
Date: Thu, 29 Jun 2023 14:07:25 +0200
|
||||
Subject: [PATCH 2/8] profiles: do not try to change password via sssd for
|
||||
local users
|
||||
|
||||
Steps to reproduce:
|
||||
1. Create local user and set passsword
|
||||
2. Log in as the local user
|
||||
3. Run passwd and provide wrong password as "Current password"
|
||||
|
||||
"Current password" prompt should be printed only once.
|
||||
|
||||
Resolves: https://github.com/authselect/authselect/issues/338
|
||||
(cherry picked from commit c9cc4b23badeb5e2fe3a38fa5b0649b3d7b0a718)
|
||||
(cherry picked from commit 7fbb0454f2adfd8de44e17e1784eab79fce2232f)
|
||||
---
|
||||
profiles/sssd/password-auth | 1 +
|
||||
profiles/sssd/system-auth | 1 +
|
||||
2 files changed, 2 insertions(+)
|
||||
|
||||
diff --git a/profiles/sssd/password-auth b/profiles/sssd/password-auth
|
||||
index 5ea280a..7fe23f2 100644
|
||||
--- a/profiles/sssd/password-auth
|
||||
+++ b/profiles/sssd/password-auth
|
||||
@@ -25,6 +25,7 @@ password requisite pam_pwquality.so local_
|
||||
password [default=1 ignore=ignore success=ok] pam_localuser.so {include if "with-pwhistory"}
|
||||
password requisite pam_pwhistory.so use_authtok {include if "with-pwhistory"}
|
||||
password sufficient pam_unix.so yescrypt shadow {if not "without-nullok":nullok} use_authtok
|
||||
+password [success=1 default=ignore] pam_localuser.so
|
||||
password sufficient pam_sss.so use_authtok
|
||||
password required pam_deny.so
|
||||
|
||||
diff --git a/profiles/sssd/system-auth b/profiles/sssd/system-auth
|
||||
index fd1e31c..ce2e266 100644
|
||||
--- a/profiles/sssd/system-auth
|
||||
+++ b/profiles/sssd/system-auth
|
||||
@@ -32,6 +32,7 @@ password requisite pam_pwquality.so local_
|
||||
password [default=1 ignore=ignore success=ok] pam_localuser.so {include if "with-pwhistory"}
|
||||
password requisite pam_pwhistory.so use_authtok {include if "with-pwhistory"}
|
||||
password sufficient pam_unix.so yescrypt shadow {if not "without-nullok":nullok} use_authtok
|
||||
+password [success=1 default=ignore] pam_localuser.so
|
||||
password sufficient pam_sss.so use_authtok
|
||||
password required pam_deny.so
|
||||
|
||||
--
|
||||
2.40.1
|
||||
|
||||
@ -1,217 +0,0 @@
|
||||
From d498f7aa562cf41e0999f7733664c27fa62bcf7c Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
|
||||
Date: Fri, 23 Feb 2024 11:54:44 +0100
|
||||
Subject: [PATCH 02/11] spec: modify specfile for Fedora 40 and RHEL 10 as
|
||||
minimal version
|
||||
|
||||
- conditionals that are no longer used are removed
|
||||
- upgrade path is removed
|
||||
- this was already triggered in Fedora 38, so it is no longer useful
|
||||
- RHEL is updated to authselect with leapp when going from 7 to 8
|
||||
we don't want to touch existing configurations
|
||||
---
|
||||
rpm/authselect.spec.in | 102 ++---------------------------------------
|
||||
1 file changed, 3 insertions(+), 99 deletions(-)
|
||||
|
||||
diff --git a/rpm/authselect.spec.in b/rpm/authselect.spec.in
|
||||
index 24ce4e603208ce26eb228bbee565c868428a2af1..e2c0482f1e7cfceac4aed3a3a4375bca031ac8c1 100644
|
||||
--- a/rpm/authselect.spec.in
|
||||
+++ b/rpm/authselect.spec.in
|
||||
@@ -12,20 +12,6 @@ Source0: %{url}/archive/%{version}/%{name}-%{version}.tar.gz
|
||||
|
||||
%global makedir %{_builddir}/%{name}-%{version}
|
||||
|
||||
-%if 0%{?fedora} >= 35 || 0%{?rhel} >= 10
|
||||
-%global with_compat 0
|
||||
-%else
|
||||
-%global with_compat 1
|
||||
-%endif
|
||||
-
|
||||
-%if 0%{?fedora} >= 36 || 0%{?rhel} >= 10
|
||||
-%global with_user_nsswitch 0
|
||||
-%global enforce_authselect 1
|
||||
-%else
|
||||
-%global with_user_nsswitch 1
|
||||
-%global enforce_authselect 0
|
||||
-%endif
|
||||
-
|
||||
# Set the default profile
|
||||
%{?fedora:%global default_profile local with-silent-lastlog}
|
||||
%{?rhel:%global default_profile local}
|
||||
@@ -43,21 +29,14 @@ BuildRequires: po4a
|
||||
BuildRequires: %{_bindir}/a2x
|
||||
BuildRequires: libcmocka-devel >= 1.0.0
|
||||
BuildRequires: libselinux-devel
|
||||
-%if %{with_compat}
|
||||
-BuildRequires: python3-devel
|
||||
-%endif
|
||||
Requires: authselect-libs%{?_isa} = %{version}-%{release}
|
||||
Suggests: sssd
|
||||
Suggests: samba-winbind
|
||||
Suggests: fprintd-pam
|
||||
Suggests: oddjob-mkhomedir
|
||||
|
||||
-%if !%{with_compat}
|
||||
# Properly obsolete removed authselect-compat package.
|
||||
-Obsoletes: authselect-compat < 1.2.4
|
||||
-# Inherited from former authselect-compat package.
|
||||
-Obsoletes: authconfig < 7.0.1-6
|
||||
-%endif
|
||||
+Obsoletes: authselect-compat < 1.3
|
||||
|
||||
%description
|
||||
Authselect is designed to be a replacement for authconfig but it takes
|
||||
@@ -74,14 +53,6 @@ Summary: Utility library used by the authselect tool
|
||||
Requires: coreutils
|
||||
Requires: sed
|
||||
Suggests: systemd
|
||||
-%if %{enforce_authselect}
|
||||
-# authselect now owns nsswitch.conf (glibc) and pam files
|
||||
-Conflicts: pam < 1.5.2-8
|
||||
-Conflicts: glibc < 2.34.9000-27
|
||||
-# systemd, nss-mdns no longer contains nsswitch.conf scriptlets
|
||||
-Conflicts: systemd < 249.7-4
|
||||
-Conflicts: nss-mdns < 0.15.1-3
|
||||
-%endif
|
||||
|
||||
%description libs
|
||||
Common library files for authselect. This package is used by the authselect
|
||||
@@ -95,25 +66,6 @@ Requires: authselect-libs%{?_isa} = %{version}-%{release}
|
||||
System header files and development libraries for authselect. Useful if
|
||||
you develop a front-end for the authselect library.
|
||||
|
||||
-%if %{with_compat}
|
||||
-%package compat
|
||||
-Summary: Tool to provide minimum backwards compatibility with authconfig
|
||||
-Obsoletes: authconfig < 7.0.1-6
|
||||
-Provides: authconfig
|
||||
-Requires: authselect%{?_isa} = %{version}-%{release}
|
||||
-Recommends: oddjob-mkhomedir
|
||||
-Suggests: sssd
|
||||
-Suggests: realmd
|
||||
-Suggests: samba-winbind
|
||||
-
|
||||
-%description compat
|
||||
-This package will replace %{_sbindir}/authconfig with a tool that will
|
||||
-translate some of the authconfig calls into authselect calls. It provides
|
||||
-only minimum backward compatibility and users are encouraged to migrate
|
||||
-to authselect completely.
|
||||
-%endif
|
||||
-
|
||||
-
|
||||
%prep
|
||||
%setup -q
|
||||
|
||||
@@ -123,16 +75,7 @@ done
|
||||
|
||||
%build
|
||||
autoreconf -if
|
||||
-%configure \
|
||||
-%if %{with_compat}
|
||||
- --with-pythonbin="%{__python3}" \
|
||||
- --with-compat \
|
||||
-%endif
|
||||
-%if %{with_user_nsswitch}
|
||||
- --with-user-nsswitch \
|
||||
-%endif
|
||||
- %{nil}
|
||||
-
|
||||
+%configure
|
||||
%make_build
|
||||
|
||||
%check
|
||||
@@ -168,20 +111,14 @@ find $RPM_BUILD_ROOT -name "*.a" -exec %__rm -f {} \;
|
||||
%ghost %attr(0644,root,root) %{_sysconfdir}/authselect/postlogin
|
||||
%ghost %attr(0644,root,root) %{_sysconfdir}/authselect/smartcard-auth
|
||||
%ghost %attr(0644,root,root) %{_sysconfdir}/authselect/system-auth
|
||||
-%if %{enforce_authselect}
|
||||
%ghost %attr(0644,root,root) %{_sysconfdir}/nsswitch.conf
|
||||
%ghost %attr(0644,root,root) %{_sysconfdir}/pam.d/fingerprint-auth
|
||||
%ghost %attr(0644,root,root) %{_sysconfdir}/pam.d/password-auth
|
||||
%ghost %attr(0644,root,root) %{_sysconfdir}/pam.d/postlogin
|
||||
%ghost %attr(0644,root,root) %{_sysconfdir}/pam.d/smartcard-auth
|
||||
%ghost %attr(0644,root,root) %{_sysconfdir}/pam.d/system-auth
|
||||
-%endif
|
||||
%dir %{_localstatedir}/lib/authselect
|
||||
%ghost %attr(0755,root,root) %{_localstatedir}/lib/authselect/backups/
|
||||
-%if %{with_user_nsswitch}
|
||||
-%ghost %attr(0644,root,root) %{_sysconfdir}/authselect/user-nsswitch.conf
|
||||
-%ghost %attr(0644,root,root) %{_localstatedir}/lib/authselect/user-nsswitch-created
|
||||
-%endif
|
||||
%dir %{_datadir}/authselect
|
||||
%dir %{_datadir}/authselect/vendor
|
||||
%dir %{_datadir}/authselect/default
|
||||
@@ -241,12 +178,6 @@ find $RPM_BUILD_ROOT -name "*.a" -exec %__rm -f {} \;
|
||||
%{_libdir}/libauthselect.so
|
||||
%{_libdir}/pkgconfig/authselect.pc
|
||||
|
||||
-%if %{with_compat}
|
||||
-%files compat
|
||||
-%{_sbindir}/authconfig
|
||||
-%{python3_sitelib}/authselect/
|
||||
-%endif
|
||||
-
|
||||
%files -f %{name}.8.lang -f %{name}-migration.7.lang
|
||||
%{_bindir}/authselect
|
||||
%{_mandir}/man8/authselect.8*
|
||||
@@ -265,47 +196,21 @@ if [ $1 == 0 ] ; then
|
||||
fi
|
||||
|
||||
%pre libs
|
||||
-%if %{enforce_authselect}
|
||||
# Check if this is a new installation.
|
||||
%__rm -f %{forcefile}
|
||||
if [ $1 -eq 1 ] ; then
|
||||
touch %{forcefile}
|
||||
fi
|
||||
-
|
||||
-# Check if we are upgrading from older version then authselect-1.3.0
|
||||
-# The version command is not available on earlier versions
|
||||
-if [ $1 -gt 1 ] ; then
|
||||
- %{_bindir}/authselect check &> /dev/null
|
||||
- if [ $? -ne 0 ]; then
|
||||
- %{_bindir}/authselect version &> /dev/null
|
||||
- if [ $? -ne 0 ]; then
|
||||
- touch %{forcefile}
|
||||
- fi
|
||||
- fi
|
||||
-fi
|
||||
-%endif
|
||||
-
|
||||
exit 0
|
||||
|
||||
%posttrans libs
|
||||
-# Copy nsswitch.conf to user-nsswitch.conf if it was not yet created
|
||||
-%if %{with_user_nsswitch}
|
||||
-if [ ! -f %{_localstatedir}/lib/authselect/user-nsswitch-created ]; then
|
||||
- %__cp -n %{_sysconfdir}/nsswitch.conf %{_sysconfdir}/authselect/user-nsswitch.conf &> /dev/null
|
||||
- touch %{_localstatedir}/lib/authselect/user-nsswitch-created &> /dev/null
|
||||
-fi
|
||||
-%endif
|
||||
|
||||
# Keep nss-altfiles for all rpm-ostree based systems.
|
||||
# See https://github.com/authselect/authselect/issues/48
|
||||
if test -e /run/ostree-booted; then
|
||||
for PROFILE in `ls %{_datadir}/authselect/default`; do
|
||||
%{_bindir}/authselect create-profile $PROFILE --vendor --base-on $PROFILE --symlink-pam --symlink-dconf --symlink=REQUIREMENTS --symlink=README &> /dev/null
|
||||
-%if %{with_user_nsswitch}
|
||||
- %__sed -ie "s/^\(passwd\|group\):\(.*\)systemd\(.*\)/\1:\2systemd altfiles\3/g" %{_datadir}/authselect/vendor/$PROFILE/nsswitch.conf &> /dev/null
|
||||
-%else
|
||||
%__sed -ie 's/{if "with-altfiles":altfiles }/altfiles /g' %{_datadir}/authselect/vendor/$PROFILE/nsswitch.conf &> /dev/null
|
||||
-%endif
|
||||
done
|
||||
fi
|
||||
|
||||
@@ -314,8 +219,7 @@ if [ $? -eq 6 ]; then
|
||||
NOBACKUP="--nobackup"
|
||||
fi
|
||||
|
||||
-# If we are upgrading from pre authselect-1.3.0 or this is a new installation
|
||||
-# select the default configuration.
|
||||
+# If this is a new installation select the default configuration.
|
||||
if [ -f %{forcefile} ]; then
|
||||
%{_bindir}/authselect select %{default_profile} --force $NOBACKUP &> /dev/null
|
||||
%__rm -f %{forcefile}
|
||||
--
|
||||
2.42.0
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,177 +0,0 @@
|
||||
From 9321126e20898b23c19e168177d8a383a750fefb Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
|
||||
Date: Fri, 23 Feb 2024 12:51:37 +0100
|
||||
Subject: [PATCH 04/11] nis: install nis profile conditionally
|
||||
|
||||
NIS profile is installed only if --with-nis-profile configure flag is
|
||||
given.
|
||||
---
|
||||
profiles/Makefile.am | 2 ++
|
||||
rpm/authselect.spec.in | 37 +++++++++++++++++++----------
|
||||
scripts/manpages-build.sh.in | 1 +
|
||||
src/conf_macros.m4 | 10 ++++++++
|
||||
src/man/authselect-migration.7.adoc | 7 ++++++
|
||||
5 files changed, 45 insertions(+), 12 deletions(-)
|
||||
|
||||
diff --git a/profiles/Makefile.am b/profiles/Makefile.am
|
||||
index bc437c158f6922afdba4ab261c73f31c93846118..61728cab77022ddc0bb35a3649a38123dc4987cf 100644
|
||||
--- a/profiles/Makefile.am
|
||||
+++ b/profiles/Makefile.am
|
||||
@@ -15,6 +15,7 @@ dist_profile_local_DATA = \
|
||||
$(top_srcdir)/profiles/local/dconf-locks \
|
||||
$(NULL)
|
||||
|
||||
+if WITH_NIS_PROFILE
|
||||
profile_nisdir = $(authselect_profile_dir)/nis
|
||||
dist_profile_nis_DATA = \
|
||||
$(top_srcdir)/profiles/nis/nsswitch.conf \
|
||||
@@ -28,6 +29,7 @@ dist_profile_nis_DATA = \
|
||||
$(top_srcdir)/profiles/nis/dconf-db \
|
||||
$(top_srcdir)/profiles/nis/dconf-locks \
|
||||
$(NULL)
|
||||
+endif
|
||||
|
||||
profile_sssddir = $(authselect_profile_dir)/sssd
|
||||
dist_profile_sssd_DATA = \
|
||||
diff --git a/rpm/authselect.spec.in b/rpm/authselect.spec.in
|
||||
index e2c0482f1e7cfceac4aed3a3a4375bca031ac8c1..350ca953632f21be861c1ee75f25f71d107ca1ee 100644
|
||||
--- a/rpm/authselect.spec.in
|
||||
+++ b/rpm/authselect.spec.in
|
||||
@@ -12,6 +12,13 @@ Source0: %{url}/archive/%{version}/%{name}-%{version}.tar.gz
|
||||
|
||||
%global makedir %{_builddir}/%{name}-%{version}
|
||||
|
||||
+# Disable NIS profile on RHEL
|
||||
+%if 0%{?rhel}
|
||||
+%global with_nis_profile 0
|
||||
+%else
|
||||
+%global with_nis_profile 1
|
||||
+%endif
|
||||
+
|
||||
# Set the default profile
|
||||
%{?fedora:%global default_profile local with-silent-lastlog}
|
||||
%{?rhel:%global default_profile local}
|
||||
@@ -75,7 +82,11 @@ done
|
||||
|
||||
%build
|
||||
autoreconf -if
|
||||
-%configure
|
||||
+%configure \
|
||||
+%if %{with_nis_profile}
|
||||
+ --with-nis-profile \
|
||||
+%endif
|
||||
+ %{nil}
|
||||
%make_build
|
||||
|
||||
%check
|
||||
@@ -123,7 +134,6 @@ find $RPM_BUILD_ROOT -name "*.a" -exec %__rm -f {} \;
|
||||
%dir %{_datadir}/authselect/vendor
|
||||
%dir %{_datadir}/authselect/default
|
||||
%dir %{_datadir}/authselect/default/local/
|
||||
-%dir %{_datadir}/authselect/default/nis/
|
||||
%dir %{_datadir}/authselect/default/sssd/
|
||||
%dir %{_datadir}/authselect/default/winbind/
|
||||
%{_datadir}/authselect/default/local/dconf-db
|
||||
@@ -136,16 +146,6 @@ find $RPM_BUILD_ROOT -name "*.a" -exec %__rm -f {} \;
|
||||
%{_datadir}/authselect/default/local/REQUIREMENTS
|
||||
%{_datadir}/authselect/default/local/smartcard-auth
|
||||
%{_datadir}/authselect/default/local/system-auth
|
||||
-%{_datadir}/authselect/default/nis/dconf-db
|
||||
-%{_datadir}/authselect/default/nis/dconf-locks
|
||||
-%{_datadir}/authselect/default/nis/fingerprint-auth
|
||||
-%{_datadir}/authselect/default/nis/nsswitch.conf
|
||||
-%{_datadir}/authselect/default/nis/password-auth
|
||||
-%{_datadir}/authselect/default/nis/postlogin
|
||||
-%{_datadir}/authselect/default/nis/README
|
||||
-%{_datadir}/authselect/default/nis/REQUIREMENTS
|
||||
-%{_datadir}/authselect/default/nis/smartcard-auth
|
||||
-%{_datadir}/authselect/default/nis/system-auth
|
||||
%{_datadir}/authselect/default/sssd/dconf-db
|
||||
%{_datadir}/authselect/default/sssd/dconf-locks
|
||||
%{_datadir}/authselect/default/sssd/fingerprint-auth
|
||||
@@ -166,6 +166,19 @@ find $RPM_BUILD_ROOT -name "*.a" -exec %__rm -f {} \;
|
||||
%{_datadir}/authselect/default/winbind/REQUIREMENTS
|
||||
%{_datadir}/authselect/default/winbind/smartcard-auth
|
||||
%{_datadir}/authselect/default/winbind/system-auth
|
||||
+%if %{with_nis_profile}
|
||||
+%dir %{_datadir}/authselect/default/nis/
|
||||
+%{_datadir}/authselect/default/nis/dconf-db
|
||||
+%{_datadir}/authselect/default/nis/dconf-locks
|
||||
+%{_datadir}/authselect/default/nis/fingerprint-auth
|
||||
+%{_datadir}/authselect/default/nis/nsswitch.conf
|
||||
+%{_datadir}/authselect/default/nis/password-auth
|
||||
+%{_datadir}/authselect/default/nis/postlogin
|
||||
+%{_datadir}/authselect/default/nis/README
|
||||
+%{_datadir}/authselect/default/nis/REQUIREMENTS
|
||||
+%{_datadir}/authselect/default/nis/smartcard-auth
|
||||
+%{_datadir}/authselect/default/nis/system-auth
|
||||
+%endif
|
||||
%{_libdir}/libauthselect.so.*
|
||||
%{_mandir}/man5/authselect-profiles.5*
|
||||
%{_datadir}/doc/authselect/COPYING
|
||||
diff --git a/scripts/manpages-build.sh.in b/scripts/manpages-build.sh.in
|
||||
index 314bb2b2a0e4432632478230ab5ff5b3dce2943f..9e553f755a64717f854f3aba33c62140130ce18f 100755
|
||||
--- a/scripts/manpages-build.sh.in
|
||||
+++ b/scripts/manpages-build.sh.in
|
||||
@@ -233,6 +233,7 @@ ATTR+=" -a AUTHSELECT_PROFILE_DIR=\"@AUTHSELECT_PROFILE_DIR@\""
|
||||
ATTR+=" -a AUTHSELECT_VENDOR_DIR=\"@AUTHSELECT_VENDOR_DIR@\""
|
||||
ATTR+=" -a AUTHSELECT_BACKUP_DIR=\"@AUTHSELECT_BACKUP_DIR@\""
|
||||
ATTR+=" -a BUILD_USER_NSSWITCH=\"@BUILD_USER_NSSWITCH@\""
|
||||
+ATTR+=" -a WITH_NIS_PROFILE=\"@WITH_NIS_PROFILE@\""
|
||||
|
||||
manpages-translate
|
||||
|
||||
diff --git a/src/conf_macros.m4 b/src/conf_macros.m4
|
||||
index 17c1629723066b0c4e354051366ce209428af6c1..9a81a6e194d16ecc0408e8631530cf7048fd9241 100644
|
||||
--- a/src/conf_macros.m4
|
||||
+++ b/src/conf_macros.m4
|
||||
@@ -99,3 +99,13 @@ if test x"$with_user_nsswitch" = xyes; then
|
||||
AC_DEFINE(BUILD_USER_NSSWITCH, 1, [whether to build with user nsswitch support])
|
||||
AC_SUBST(BUILD_USER_NSSWITCH, 1)
|
||||
fi
|
||||
+
|
||||
+AC_ARG_WITH([nis-profile],
|
||||
+ [AC_HELP_STRING([--with-nis-profile], [Install NIS profile [no]])],
|
||||
+ [], with_nis_profile=no
|
||||
+)
|
||||
+AM_CONDITIONAL([WITH_NIS_PROFILE], [test x$with_nis_profile = xyes])
|
||||
+AC_SUBST(WITH_NIS_PROFILE, 0)
|
||||
+if test x"$with_nis_profile" = xyes; then
|
||||
+ AC_SUBST(WITH_NIS_PROFILE, 1)
|
||||
+fi
|
||||
diff --git a/src/man/authselect-migration.7.adoc b/src/man/authselect-migration.7.adoc
|
||||
index 3513a7e7cd3d7cc0045167e8224248c5be90ab2c..8cc58e60301925974fdb738c5b9a746749981df8 100644
|
||||
--- a/src/man/authselect-migration.7.adoc
|
||||
+++ b/src/man/authselect-migration.7.adoc
|
||||
@@ -72,7 +72,12 @@ configuration file for required services.
|
||||
|--enablesssd --enablesssdauth |sssd
|
||||
|--enablekrb5 |sssd
|
||||
|--enablewinbind --enablewinbindauth |winbind
|
||||
+ifeval::[{WITH_NIS_PROFILE} == 1]
|
||||
|--enablenis |nis
|
||||
+endif::[]
|
||||
+ifeval::[{WITH_NIS_PROFILE} != 1]
|
||||
+|--enablenis |none
|
||||
+endif::[]
|
||||
|=========================================================
|
||||
|
||||
.Relation of authconfig options to authselect profile features
|
||||
@@ -199,6 +204,7 @@ will perform an initial setup which involves creating a Kerberos keytab and
|
||||
running `adcli` to join the domain. It also makes changes to `smb.conf`. You
|
||||
can then tune it up by modifying {sysconfdir}/samba/smb.conf.
|
||||
|
||||
+ifeval::[{WITH_NIS_PROFILE} == 1]
|
||||
NIS
|
||||
~~~
|
||||
There are several places that needs to be configured in order to make
|
||||
@@ -227,6 +233,7 @@ $ domainname mydomain
|
||||
$ setsebool -P allow_ypbind 1
|
||||
----
|
||||
|
||||
+endif::[]
|
||||
PASSWORD QUALITY
|
||||
~~~~~~~~~~~~~~~~
|
||||
Authselect enables `pam_pwquality` module to enforce password quality
|
||||
--
|
||||
2.42.0
|
||||
|
||||
@ -1,349 +0,0 @@
|
||||
From 923fd37712eae8d99d514708e35894b6ea056628 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
|
||||
Date: Fri, 23 Feb 2024 13:24:25 +0100
|
||||
Subject: [PATCH 05/11] configure: drop user-nsswitch.conf support
|
||||
|
||||
user-nsswitch.conf support is now completely dropped, it can no
|
||||
longer be enabled via configure flag
|
||||
---
|
||||
scripts/manpages-build.sh.in | 1 -
|
||||
src/cli/main.c | 9 --
|
||||
src/conf_macros.m4 | 10 --
|
||||
src/lib/files/nsswitch.c | 156 -----------------------------
|
||||
src/lib/paths.h | 3 -
|
||||
src/man/authselect-profiles.5.adoc | 7 --
|
||||
src/man/authselect.8.adoc | 61 -----------
|
||||
7 files changed, 247 deletions(-)
|
||||
|
||||
diff --git a/scripts/manpages-build.sh.in b/scripts/manpages-build.sh.in
|
||||
index 9e553f755a64717f854f3aba33c62140130ce18f..f4ac71e3a22723a52101bb9cbbadd79740515070 100755
|
||||
--- a/scripts/manpages-build.sh.in
|
||||
+++ b/scripts/manpages-build.sh.in
|
||||
@@ -232,7 +232,6 @@ ATTR+=" -a AUTHSELECT_PAM_DIR=\"@AUTHSELECT_PAM_DIR@\""
|
||||
ATTR+=" -a AUTHSELECT_PROFILE_DIR=\"@AUTHSELECT_PROFILE_DIR@\""
|
||||
ATTR+=" -a AUTHSELECT_VENDOR_DIR=\"@AUTHSELECT_VENDOR_DIR@\""
|
||||
ATTR+=" -a AUTHSELECT_BACKUP_DIR=\"@AUTHSELECT_BACKUP_DIR@\""
|
||||
-ATTR+=" -a BUILD_USER_NSSWITCH=\"@BUILD_USER_NSSWITCH@\""
|
||||
ATTR+=" -a WITH_NIS_PROFILE=\"@WITH_NIS_PROFILE@\""
|
||||
|
||||
manpages-translate
|
||||
diff --git a/src/cli/main.c b/src/cli/main.c
|
||||
index 18486b50bc42f9937cc7294c3e5e2b32cafab5e0..fe06a5d8ababa58209690a97e84ae254b859cdc6 100644
|
||||
--- a/src/cli/main.c
|
||||
+++ b/src/cli/main.c
|
||||
@@ -186,15 +186,6 @@ static errno_t activate(struct cli_cmdline *cmdline)
|
||||
goto done;
|
||||
}
|
||||
|
||||
-#ifdef BUILD_USER_NSSWITCH
|
||||
- maps = authselect_profile_nsswitch_maps(profile, features);
|
||||
- if (maps == NULL) {
|
||||
- ERROR("Unable to obtain nsswitch maps!");
|
||||
- ret = EFAULT;
|
||||
- goto done;
|
||||
- }
|
||||
-#endif
|
||||
-
|
||||
if (backup || backup_name != NULL || (enforce && !nobackup)) {
|
||||
ret = perform_backup(quiet, 1, backup_name);
|
||||
if (ret != EOK) {
|
||||
diff --git a/src/conf_macros.m4 b/src/conf_macros.m4
|
||||
index 9a81a6e194d16ecc0408e8631530cf7048fd9241..ae8fa0274e038e98115d000717487dbdbc04df4c 100644
|
||||
--- a/src/conf_macros.m4
|
||||
+++ b/src/conf_macros.m4
|
||||
@@ -90,16 +90,6 @@ if test x"$with_compat" = xyes; then
|
||||
fi
|
||||
AM_CONDITIONAL([BUILD_COMPAT], [test x$with_compat = xyes])
|
||||
|
||||
-AC_ARG_WITH([user-nsswitch],
|
||||
- [AC_HELP_STRING([--with-user-nsswitch], [Build with user nsswitch support [no]])],
|
||||
- [], with_user_nsswitch=no
|
||||
-)
|
||||
-AC_SUBST(BUILD_USER_NSSWITCH, 0)
|
||||
-if test x"$with_user_nsswitch" = xyes; then
|
||||
- AC_DEFINE(BUILD_USER_NSSWITCH, 1, [whether to build with user nsswitch support])
|
||||
- AC_SUBST(BUILD_USER_NSSWITCH, 1)
|
||||
-fi
|
||||
-
|
||||
AC_ARG_WITH([nis-profile],
|
||||
[AC_HELP_STRING([--with-nis-profile], [Install NIS profile [no]])],
|
||||
[], with_nis_profile=no
|
||||
diff --git a/src/lib/files/nsswitch.c b/src/lib/files/nsswitch.c
|
||||
index 9598ea5cc5d5e30678acd91354629a87fc727be9..0e35380a2603316483cd6bcfdc58742c25b6a2b1 100644
|
||||
--- a/src/lib/files/nsswitch.c
|
||||
+++ b/src/lib/files/nsswitch.c
|
||||
@@ -87,160 +87,6 @@ done:
|
||||
return ret;
|
||||
}
|
||||
|
||||
-#ifdef BUILD_USER_NSSWITCH
|
||||
-
|
||||
-static errno_t
|
||||
-authselect_nsswitch_delete_maps(char **maps,
|
||||
- char *content)
|
||||
-{
|
||||
- char *match_string;
|
||||
- const char *map_name;
|
||||
- size_t map_len;
|
||||
- size_t orig_len;
|
||||
- regmatch_t m[RE_NSS_MATCHES];
|
||||
- regex_t regex;
|
||||
- errno_t ret;
|
||||
- int reret;
|
||||
- int i;
|
||||
-
|
||||
- if (string_is_empty(content)) {
|
||||
- return EOK;
|
||||
- }
|
||||
-
|
||||
- orig_len = strlen(content);
|
||||
-
|
||||
- reret = regcomp(®ex, RE_NSS, REG_EXTENDED | REG_NEWLINE);
|
||||
- if (reret != REG_NOERROR) {
|
||||
- ERROR("Unable to compile regular expression: regex error %d", reret);
|
||||
- ret = EFAULT;
|
||||
- goto done;
|
||||
- }
|
||||
-
|
||||
- match_string = content;
|
||||
- while ((reret = regexec(®ex, match_string, 2, m, 0)) == REG_NOERROR) {
|
||||
- map_name = match_string + m[1].rm_so;
|
||||
- map_len = m[1].rm_eo - m[1].rm_so;
|
||||
- for (i = 0; maps[i] != NULL; i++) {
|
||||
- if (strncmp(map_name, maps[i], map_len) == 0) {
|
||||
- string_remove_line(content, match_string, m[1].rm_so);
|
||||
- break;
|
||||
- }
|
||||
- }
|
||||
-
|
||||
- /* Since the whole line could have been removed, we have to find first
|
||||
- * non-zero position. */
|
||||
- match_string += m[0].rm_eo;
|
||||
- while (*match_string == '\0' && match_string - content < orig_len) {
|
||||
- match_string++;
|
||||
- }
|
||||
- }
|
||||
-
|
||||
- if (reret != REG_NOMATCH) {
|
||||
- ERROR("Unable to search string: regex error %d", reret);
|
||||
- ret = EFAULT;
|
||||
- goto done;
|
||||
- }
|
||||
-
|
||||
- string_replace_shake(content, orig_len);
|
||||
-
|
||||
- ret = EOK;
|
||||
-
|
||||
-done:
|
||||
- regfree(®ex);
|
||||
-
|
||||
- return ret;
|
||||
-}
|
||||
-
|
||||
-errno_t
|
||||
-authselect_nsswitch_generate(const char *template,
|
||||
- const char **features,
|
||||
- char **_content)
|
||||
-{
|
||||
- static const char *preambule = \
|
||||
- "# If you want to make changes to nsswitch.conf please modify\n"
|
||||
- "# " PATH_USER_NSSWITCH " and run 'authselect apply-changes'.\n"
|
||||
- "#\n"
|
||||
- "# Note that your changes may not be applied as they may be\n"
|
||||
- "# overwritten by selected profile. Maps set in the authselect\n"
|
||||
- "# profile takes always precedence and overwrites the same maps\n"
|
||||
- "# set in the user file. Only maps that are not set by the profile\n"
|
||||
- "# are applied from the user file.\n"
|
||||
- "#\n"
|
||||
- "# For example, if the profile sets:\n"
|
||||
- "# passwd: sss files\n"
|
||||
- "# and " PATH_USER_NSSWITCH " contains:\n"
|
||||
- "# passwd: files\n"
|
||||
- "# hosts: files dns\n"
|
||||
- "# the resulting generated nsswitch.conf will be:\n"
|
||||
- "# passwd: sss files # from profile\n"
|
||||
- "# hosts: files dns # from user file\n\n";
|
||||
- char *user_content = NULL;
|
||||
- char *generated = NULL;
|
||||
- char *content = NULL;
|
||||
- char **maps = NULL;
|
||||
- errno_t ret;
|
||||
-
|
||||
- generated = template_generate(template, features);
|
||||
- if (generated == NULL) {
|
||||
- ret = ENOMEM;
|
||||
- goto done;
|
||||
- }
|
||||
-
|
||||
- ret = textfile_read(PATH_USER_NSSWITCH, AUTHSELECT_FILE_SIZE_LIMIT,
|
||||
- &user_content);
|
||||
- switch (ret) {
|
||||
- case EOK:
|
||||
- ret = authselect_nsswitch_find_maps(generated, &maps);
|
||||
- if (ret != EOK) {
|
||||
- goto done;
|
||||
- }
|
||||
-
|
||||
- ret = authselect_nsswitch_delete_maps(maps, user_content);
|
||||
- if (ret != EOK) {
|
||||
- goto done;
|
||||
- }
|
||||
-
|
||||
- if (string_is_empty(user_content)) {
|
||||
- content = format("%s%s", preambule, generated);
|
||||
- break;
|
||||
- }
|
||||
-
|
||||
- content = format("%s%s\n# Included from %s\n\n%s",
|
||||
- preambule, generated, PATH_USER_NSSWITCH,
|
||||
- user_content);
|
||||
- break;
|
||||
- case ENOENT:
|
||||
- content = format("%s%s", preambule, generated);
|
||||
- break;
|
||||
- default:
|
||||
- ERROR("Unable to read [%s] [%d]: %s", PATH_USER_NSSWITCH,
|
||||
- ret, strerror(ret));
|
||||
- goto done;
|
||||
- }
|
||||
-
|
||||
- if (content == NULL) {
|
||||
- ret = ENOMEM;
|
||||
- goto done;
|
||||
- }
|
||||
-
|
||||
- *_content = content;
|
||||
-
|
||||
- ret = EOK;
|
||||
-
|
||||
-done:
|
||||
- if (ret != EOK) {
|
||||
- ERROR("Unable to generate nsswitch.conf [%d]: %s", ret, strerror(ret));
|
||||
- }
|
||||
-
|
||||
- free(user_content);
|
||||
- free(generated);
|
||||
- string_array_free(maps);
|
||||
-
|
||||
- return ret;
|
||||
-}
|
||||
-
|
||||
-#else /* BUILD_USER_NSSWITCH */
|
||||
-
|
||||
errno_t
|
||||
authselect_nsswitch_generate(const char *template,
|
||||
const char **features,
|
||||
@@ -257,5 +103,3 @@ authselect_nsswitch_generate(const char *template,
|
||||
|
||||
return EOK;
|
||||
}
|
||||
-
|
||||
-#endif /* BUILD_USER_NSSWITCH */
|
||||
diff --git a/src/lib/paths.h b/src/lib/paths.h
|
||||
index ca30b784f8bc63150f46ef08a26ec2bc5bcb3d67..41e4534b2efd421be8b9fea3b1fa9ebc3a699749 100644
|
||||
--- a/src/lib/paths.h
|
||||
+++ b/src/lib/paths.h
|
||||
@@ -53,9 +53,6 @@
|
||||
#define PATH_DCONF_DB AUTHSELECT_CONFIG_DIR "/" FILE_DCONF_DB
|
||||
#define PATH_DCONF_LOCK AUTHSELECT_CONFIG_DIR "/" FILE_DCONF_LOCK
|
||||
|
||||
-/* Path to files that can be modified by user. */
|
||||
-#define PATH_USER_NSSWITCH AUTHSELECT_CONFIG_DIR "/user-nsswitch.conf"
|
||||
-
|
||||
/* Names of symbolic links that points to generated files. */
|
||||
#define PATH_SYMLINK_SYSTEM AUTHSELECT_PAM_DIR "/" FILE_SYSTEM
|
||||
#define PATH_SYMLINK_PASSWORD AUTHSELECT_PAM_DIR "/" FILE_PASSWORD
|
||||
diff --git a/src/man/authselect-profiles.5.adoc b/src/man/authselect-profiles.5.adoc
|
||||
index 76a48fa25a13a7052eeac662d7f5f1b11f1f9493..648b7980cfaabeb02913650a35dfffa8e17b0aaa 100644
|
||||
--- a/src/man/authselect-profiles.5.adoc
|
||||
+++ b/src/man/authselect-profiles.5.adoc
|
||||
@@ -53,14 +53,7 @@ done to the system.
|
||||
the modules in the system-auth configuration file._
|
||||
|
||||
*nsswitch.conf*::
|
||||
-ifeval::[{BUILD_USER_NSSWITCH} == 0]
|
||||
Name Service Switch configuration file.
|
||||
-endif::[]
|
||||
-ifeval::[{BUILD_USER_NSSWITCH} == 1]
|
||||
- Name Service Switch configuration file. Only maps relevant to the profile
|
||||
- must be set. Maps that are not specified by the profile are included from
|
||||
- {AUTHSELECT_CONFIG_DIR}/user-nsswitch.conf.
|
||||
-endif::[]
|
||||
|
||||
*dconf-db*::
|
||||
Changes to dconf database. The main uses case of this file is to set
|
||||
diff --git a/src/man/authselect.8.adoc b/src/man/authselect.8.adoc
|
||||
index 39758a6ca71e962ae942ce3608ac3bd0ffd3fabf..5d695cced0fbdc2cda78d61eb3f7b8d929cae692 100644
|
||||
--- a/src/man/authselect.8.adoc
|
||||
+++ b/src/man/authselect.8.adoc
|
||||
@@ -261,67 +261,6 @@ These options are available with all commands.
|
||||
the program execution but may indicate some undesired situations
|
||||
(e.g. unexpected file in a profile directory).
|
||||
|
||||
-ifeval::[{BUILD_USER_NSSWITCH} == 1]
|
||||
-NSSWITCH.CONF MANAGEMENT
|
||||
-------------------------
|
||||
-Authselect generates {AUTHSELECT_NSSWITCH_CONF} and does not allow any user
|
||||
-changes to this file. Such changes are detected and authselect will refuse to
|
||||
-write any system configuration unless a *--force* option is provided to
|
||||
-the *select* command. This mechanism prevents authselect from overwriting
|
||||
-anything that does not match any available profile.
|
||||
-
|
||||
-Any user changes to nsswitch maps must be done in file
|
||||
-{AUTHSELECT_CONFIG_DIR}/user-nsswitch.conf. When authselect generates
|
||||
-new _nsswitch.conf_ it reads this file and combines it with configuration
|
||||
-from selected profile. The profile configuration takes always precedence.
|
||||
-In other words, profiles do not have to set all nsswitch maps but can set only
|
||||
-those that are relevant to the profile. If a map is set within a profile,
|
||||
-it always overwrites the same map from _user-nsswitch.conf_.
|
||||
-
|
||||
-.Example 1
|
||||
-[subs="attributes"]
|
||||
-----
|
||||
-# "sssd" profile
|
||||
-$ cat {AUTHSELECT_PROFILE_DIR}/sssd/nsswitch.conf
|
||||
-passwd: sss files systemd
|
||||
-group: sss files systemd
|
||||
-netgroup: sss files
|
||||
-automount: sss files
|
||||
-services: sss files
|
||||
-sudoers: files sss {include if "with-sudo"}
|
||||
-
|
||||
-$ cat {AUTHSELECT_CONFIG_DIR}/user-nsswitch.conf
|
||||
-passwd: files sss
|
||||
-group: files sss
|
||||
-hosts: files dns myhostname
|
||||
-sudoers: files
|
||||
-
|
||||
-$ authselect select sssd
|
||||
-
|
||||
-# passwd and group maps from user-nsswitch.conf are ignored
|
||||
-$ cat {AUTHSELECT_NSSWITCH_CONF}
|
||||
-passwd: sss files systemd
|
||||
-group: sss files systemd
|
||||
-netgroup: sss files
|
||||
-automount: sss files
|
||||
-services: sss files
|
||||
-hosts: files dns myhostname
|
||||
-sudoers: files
|
||||
-
|
||||
-$ authselect select sssd with-sudo
|
||||
-
|
||||
-# passwd, group and sudoers maps from user-nsswitch.conf are ignored
|
||||
-$ cat {AUTHSELECT_NSSWITCH_CONF}
|
||||
-passwd: sss files systemd
|
||||
-group: sss files systemd
|
||||
-netgroup: sss files
|
||||
-automount: sss files
|
||||
-services: sss files
|
||||
-sudoers: files sss
|
||||
-hosts: files dns myhostname
|
||||
-----
|
||||
-endif::[]
|
||||
-
|
||||
TROUBLESHOOTING
|
||||
---------------
|
||||
|
||||
--
|
||||
2.42.0
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,46 +0,0 @@
|
||||
From 23936036c5b6cd51843a7f964998f5345877fa8e Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
|
||||
Date: Fri, 23 Feb 2024 13:34:31 +0100
|
||||
Subject: [PATCH 07/11] ci: remove python checks
|
||||
|
||||
With the compat tool gone, there is no other python script.
|
||||
---
|
||||
.github/workflows/analyze.yml | 18 +-----------------
|
||||
1 file changed, 1 insertion(+), 17 deletions(-)
|
||||
|
||||
diff --git a/.github/workflows/analyze.yml b/.github/workflows/analyze.yml
|
||||
index 37682f068b586dc0e7ba34f1098f4009b88e7254..16b48b031519b81221de9248d65f076b2616b2f7 100644
|
||||
--- a/.github/workflows/analyze.yml
|
||||
+++ b/.github/workflows/analyze.yml
|
||||
@@ -25,7 +25,7 @@ jobs:
|
||||
- name: Initialize CodeQL
|
||||
uses: github/codeql-action/init@v1
|
||||
with:
|
||||
- languages: cpp, python
|
||||
+ languages: cpp
|
||||
queries: +security-and-quality
|
||||
|
||||
- name: Autobuild
|
||||
@@ -33,19 +33,3 @@ jobs:
|
||||
|
||||
- name: Perform CodeQL Analysis
|
||||
uses: github/codeql-action/analyze@v1
|
||||
-
|
||||
- flake8:
|
||||
- runs-on: ubuntu-latest
|
||||
- permissions:
|
||||
- contents: read
|
||||
- steps:
|
||||
- - name: Checkout repository
|
||||
- uses: actions/checkout@v2
|
||||
-
|
||||
- - name: Install flake8
|
||||
- run: |
|
||||
- sudo apt update
|
||||
- sudo apt install -y flake8
|
||||
-
|
||||
- - name: Execute flake8 on the repository
|
||||
- run: flake8 --ignore=W503,E501 src/compat/authcompat.py.in.in .
|
||||
--
|
||||
2.42.0
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,78 +0,0 @@
|
||||
From 8d8adbd35c741d9038588386414ccbddb99bd31d Mon Sep 17 00:00:00 2001
|
||||
From: Lennart Poettering <lennart@poettering.net>
|
||||
Date: Thu, 14 Dec 2023 14:16:11 +0100
|
||||
Subject: [PATCH 09/11] profiles: merge groups records with [SUCCESS=merge]
|
||||
|
||||
Services such as systemd-homed would like to advertise users which are
|
||||
part of system groups, such as "wheel". That only works if glibc's
|
||||
[SUCCESS=merge] feature is used in nsswitch.conf, so that group records
|
||||
from multiple sources are merged.
|
||||
|
||||
This is documented here:
|
||||
|
||||
https://www.freedesktop.org/software/systemd/man/latest/nss-systemd.html#Configuration%20in%20/etc/nsswitch.conf
|
||||
|
||||
This hence adds [SUCCESS=merge] expressions to all NSS modules listed in
|
||||
the "groups" lines.
|
||||
---
|
||||
profiles/local/nsswitch.conf | 2 +-
|
||||
profiles/nis/nsswitch.conf | 2 +-
|
||||
profiles/sssd/nsswitch.conf | 2 +-
|
||||
profiles/winbind/nsswitch.conf | 2 +-
|
||||
4 files changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/profiles/local/nsswitch.conf b/profiles/local/nsswitch.conf
|
||||
index c63692fc00c0815c5ba303ec5b48b6c9d7577df2..8582a955c8d03ea1d122a34cd273326d985bdcfb 100644
|
||||
--- a/profiles/local/nsswitch.conf
|
||||
+++ b/profiles/local/nsswitch.conf
|
||||
@@ -1,7 +1,7 @@
|
||||
# In order of likelihood of use to accelerate lookup.
|
||||
passwd: files {if "with-altfiles":altfiles }systemd
|
||||
shadow: files
|
||||
-group: files {if "with-altfiles":altfiles }systemd
|
||||
+group: files [SUCCESS=merge] {if "with-altfiles":altfiles [SUCCESS=merge] }systemd
|
||||
hosts: files myhostname {if "with-libvirt":libvirt libvirt_guest }{if "with-mdns4" and "with-mdns6":mdns_minimal [NOTFOUND=return] }{if "with-mdns4" and not "with-mdns6":mdns4_minimal [NOTFOUND=return] }{if not "with-mdns4" and "with-mdns6":mdns6_minimal [NOTFOUND=return] }resolve [!UNAVAIL=return] dns
|
||||
services: files
|
||||
netgroup: files
|
||||
diff --git a/profiles/nis/nsswitch.conf b/profiles/nis/nsswitch.conf
|
||||
index 685f92c326bc7767ee167a77b7ba782672bf801f..c033812facee9159c76e2d514ac652e4de2e0b6b 100644
|
||||
--- a/profiles/nis/nsswitch.conf
|
||||
+++ b/profiles/nis/nsswitch.conf
|
||||
@@ -1,7 +1,7 @@
|
||||
# In order of likelihood of use to accelerate lookup.
|
||||
passwd: files {if "with-altfiles":altfiles }nis systemd
|
||||
shadow: files nis
|
||||
-group: files {if "with-altfiles":altfiles }nis systemd
|
||||
+group: files [SUCCESS=merge] {if "with-altfiles":altfiles [SUCCESS=merge] }nis [SUCCESS=merge] systemd
|
||||
hosts: files myhostname {if "with-libvirt":libvirt libvirt_guest }{if "with-mdns4" and "with-mdns6":mdns_minimal [NOTFOUND=return] }{if "with-mdns4" and not "with-mdns6":mdns4_minimal [NOTFOUND=return] }{if not "with-mdns4" and "with-mdns6":mdns6_minimal [NOTFOUND=return] }resolve [!UNAVAIL=return] nis dns
|
||||
services: files nis
|
||||
netgroup: files nis
|
||||
diff --git a/profiles/sssd/nsswitch.conf b/profiles/sssd/nsswitch.conf
|
||||
index 58844a62c8f52f8f25477a811b02a5e401120f30..9f194bc82cee52d4e12779def95afa2f794f66bf 100644
|
||||
--- a/profiles/sssd/nsswitch.conf
|
||||
+++ b/profiles/sssd/nsswitch.conf
|
||||
@@ -1,7 +1,7 @@
|
||||
# In order of likelihood of use to accelerate lookup.
|
||||
passwd: {if "with-tlog":sss }files {if "with-altfiles":altfiles }{if not "with-tlog":sss }systemd
|
||||
shadow: files
|
||||
-group: {if "with-tlog":sss }files {if "with-altfiles":altfiles }{if not "with-tlog":sss }systemd
|
||||
+group: {if "with-tlog":sss [SUCCESS=merge] }files [SUCCESS=merge] {if "with-altfiles":altfiles [SUCCESS=merge] }{if not "with-tlog":sss [SUCCESS=merge] }systemd
|
||||
hosts: files myhostname {if "with-libvirt":libvirt libvirt_guest }{if "with-mdns4" and "with-mdns6":mdns_minimal [NOTFOUND=return] }{if "with-mdns4" and not "with-mdns6":mdns4_minimal [NOTFOUND=return] }{if not "with-mdns4" and "with-mdns6":mdns6_minimal [NOTFOUND=return] }resolve [!UNAVAIL=return] dns
|
||||
services: files sss
|
||||
netgroup: files sss
|
||||
diff --git a/profiles/winbind/nsswitch.conf b/profiles/winbind/nsswitch.conf
|
||||
index f0a97e42e084f94fddd329d4cb93d5b5d1da3360..1591ccb3ffa8bd10b8ff06a0620328e275d09241 100644
|
||||
--- a/profiles/winbind/nsswitch.conf
|
||||
+++ b/profiles/winbind/nsswitch.conf
|
||||
@@ -1,7 +1,7 @@
|
||||
# In order of likelihood of use to accelerate lookup.
|
||||
passwd: files {if "with-altfiles":altfiles }winbind systemd
|
||||
shadow: files
|
||||
-group: files {if "with-altfiles":altfiles }winbind systemd
|
||||
+group: files [SUCCESS=merge] {if "with-altfiles":altfiles [SUCCESS=merge] }winbind [SUCCESS=merge] systemd
|
||||
hosts: files myhostname {if "with-libvirt":libvirt libvirt_guest }{if "with-mdns4" and "with-mdns6":mdns_minimal [NOTFOUND=return] }{if "with-mdns4" and not "with-mdns6":mdns4_minimal [NOTFOUND=return] }{if not "with-mdns4" and "with-mdns6":mdns6_minimal [NOTFOUND=return] }resolve [!UNAVAIL=return] dns
|
||||
services: files
|
||||
netgroup: files
|
||||
--
|
||||
2.42.0
|
||||
|
||||
@ -1,26 +0,0 @@
|
||||
From 565d8a76f1d6ec6c23cd38f7aa4812426e8cb460 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
|
||||
Date: Fri, 23 Feb 2024 14:18:00 +0100
|
||||
Subject: [PATCH 10/11] spec: use altfiles with success=merge on ostree systems
|
||||
as well
|
||||
|
||||
---
|
||||
rpm/authselect.spec.in | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/rpm/authselect.spec.in b/rpm/authselect.spec.in
|
||||
index 350ca953632f21be861c1ee75f25f71d107ca1ee..39c4ca66058e0749e6d3aea6e7ff76a7a06c4ecc 100644
|
||||
--- a/rpm/authselect.spec.in
|
||||
+++ b/rpm/authselect.spec.in
|
||||
@@ -223,7 +223,7 @@ exit 0
|
||||
if test -e /run/ostree-booted; then
|
||||
for PROFILE in `ls %{_datadir}/authselect/default`; do
|
||||
%{_bindir}/authselect create-profile $PROFILE --vendor --base-on $PROFILE --symlink-pam --symlink-dconf --symlink=REQUIREMENTS --symlink=README &> /dev/null
|
||||
- %__sed -ie 's/{if "with-altfiles":altfiles }/altfiles /g' %{_datadir}/authselect/vendor/$PROFILE/nsswitch.conf &> /dev/null
|
||||
+ %__sed -ie 's/{if "with-altfiles":altfiles \[SUCCESS=merge\] }/altfiles [SUCCESS=merge] /g' %{_datadir}/authselect/vendor/$PROFILE/nsswitch.conf &> /dev/null
|
||||
done
|
||||
fi
|
||||
|
||||
--
|
||||
2.42.0
|
||||
|
||||
@ -1,72 +0,0 @@
|
||||
From 7b7889507928610b37b73641d28d5bbe3f763a4a Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
|
||||
Date: Fri, 23 Feb 2024 17:22:45 +0100
|
||||
Subject: [PATCH 11/11] profiles: put myhostname before dns
|
||||
|
||||
To allow `hostname --fqdn` to work correctly. Putting myhostname early
|
||||
prevents lookup of canonical hostname if only shortname is provided.
|
||||
|
||||
myhostname has been moved back and forth several times, it looks
|
||||
like this place is now functional and works as expected.
|
||||
---
|
||||
profiles/local/nsswitch.conf | 2 +-
|
||||
profiles/nis/nsswitch.conf | 2 +-
|
||||
profiles/sssd/nsswitch.conf | 2 +-
|
||||
profiles/winbind/nsswitch.conf | 2 +-
|
||||
4 files changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/profiles/local/nsswitch.conf b/profiles/local/nsswitch.conf
|
||||
index 8582a955c8d03ea1d122a34cd273326d985bdcfb..538926e4d5cc8c190a7b2d10fd3756ad3269a720 100644
|
||||
--- a/profiles/local/nsswitch.conf
|
||||
+++ b/profiles/local/nsswitch.conf
|
||||
@@ -2,7 +2,7 @@
|
||||
passwd: files {if "with-altfiles":altfiles }systemd
|
||||
shadow: files
|
||||
group: files [SUCCESS=merge] {if "with-altfiles":altfiles [SUCCESS=merge] }systemd
|
||||
-hosts: files myhostname {if "with-libvirt":libvirt libvirt_guest }{if "with-mdns4" and "with-mdns6":mdns_minimal [NOTFOUND=return] }{if "with-mdns4" and not "with-mdns6":mdns4_minimal [NOTFOUND=return] }{if not "with-mdns4" and "with-mdns6":mdns6_minimal [NOTFOUND=return] }resolve [!UNAVAIL=return] dns
|
||||
+hosts: files {if "with-libvirt":libvirt libvirt_guest }{if "with-mdns4" and "with-mdns6":mdns_minimal [NOTFOUND=return] }{if "with-mdns4" and not "with-mdns6":mdns4_minimal [NOTFOUND=return] }{if not "with-mdns4" and "with-mdns6":mdns6_minimal [NOTFOUND=return] }resolve [!UNAVAIL=return] myhostname dns
|
||||
services: files
|
||||
netgroup: files
|
||||
automount: files
|
||||
diff --git a/profiles/nis/nsswitch.conf b/profiles/nis/nsswitch.conf
|
||||
index c033812facee9159c76e2d514ac652e4de2e0b6b..488476e91879b549fe605008d500b1810360f3be 100644
|
||||
--- a/profiles/nis/nsswitch.conf
|
||||
+++ b/profiles/nis/nsswitch.conf
|
||||
@@ -2,7 +2,7 @@
|
||||
passwd: files {if "with-altfiles":altfiles }nis systemd
|
||||
shadow: files nis
|
||||
group: files [SUCCESS=merge] {if "with-altfiles":altfiles [SUCCESS=merge] }nis [SUCCESS=merge] systemd
|
||||
-hosts: files myhostname {if "with-libvirt":libvirt libvirt_guest }{if "with-mdns4" and "with-mdns6":mdns_minimal [NOTFOUND=return] }{if "with-mdns4" and not "with-mdns6":mdns4_minimal [NOTFOUND=return] }{if not "with-mdns4" and "with-mdns6":mdns6_minimal [NOTFOUND=return] }resolve [!UNAVAIL=return] nis dns
|
||||
+hosts: files {if "with-libvirt":libvirt libvirt_guest }{if "with-mdns4" and "with-mdns6":mdns_minimal [NOTFOUND=return] }{if "with-mdns4" and not "with-mdns6":mdns4_minimal [NOTFOUND=return] }{if not "with-mdns4" and "with-mdns6":mdns6_minimal [NOTFOUND=return] }resolve [!UNAVAIL=return] nis myhostname dns
|
||||
services: files nis
|
||||
netgroup: files nis
|
||||
automount: files nis
|
||||
diff --git a/profiles/sssd/nsswitch.conf b/profiles/sssd/nsswitch.conf
|
||||
index 9f194bc82cee52d4e12779def95afa2f794f66bf..b98094d9e0eaeb1559347b81a9505822ff713034 100644
|
||||
--- a/profiles/sssd/nsswitch.conf
|
||||
+++ b/profiles/sssd/nsswitch.conf
|
||||
@@ -2,7 +2,7 @@
|
||||
passwd: {if "with-tlog":sss }files {if "with-altfiles":altfiles }{if not "with-tlog":sss }systemd
|
||||
shadow: files
|
||||
group: {if "with-tlog":sss [SUCCESS=merge] }files [SUCCESS=merge] {if "with-altfiles":altfiles [SUCCESS=merge] }{if not "with-tlog":sss [SUCCESS=merge] }systemd
|
||||
-hosts: files myhostname {if "with-libvirt":libvirt libvirt_guest }{if "with-mdns4" and "with-mdns6":mdns_minimal [NOTFOUND=return] }{if "with-mdns4" and not "with-mdns6":mdns4_minimal [NOTFOUND=return] }{if not "with-mdns4" and "with-mdns6":mdns6_minimal [NOTFOUND=return] }resolve [!UNAVAIL=return] dns
|
||||
+hosts: files {if "with-libvirt":libvirt libvirt_guest }{if "with-mdns4" and "with-mdns6":mdns_minimal [NOTFOUND=return] }{if "with-mdns4" and not "with-mdns6":mdns4_minimal [NOTFOUND=return] }{if not "with-mdns4" and "with-mdns6":mdns6_minimal [NOTFOUND=return] }resolve [!UNAVAIL=return] myhostname dns
|
||||
services: files sss
|
||||
netgroup: files sss
|
||||
sudoers: files sss {include if "with-sudo"}
|
||||
diff --git a/profiles/winbind/nsswitch.conf b/profiles/winbind/nsswitch.conf
|
||||
index 1591ccb3ffa8bd10b8ff06a0620328e275d09241..cc966b34464bb28776b903d61fff1f6a94a1eb6f 100644
|
||||
--- a/profiles/winbind/nsswitch.conf
|
||||
+++ b/profiles/winbind/nsswitch.conf
|
||||
@@ -2,7 +2,7 @@
|
||||
passwd: files {if "with-altfiles":altfiles }winbind systemd
|
||||
shadow: files
|
||||
group: files [SUCCESS=merge] {if "with-altfiles":altfiles [SUCCESS=merge] }winbind [SUCCESS=merge] systemd
|
||||
-hosts: files myhostname {if "with-libvirt":libvirt libvirt_guest }{if "with-mdns4" and "with-mdns6":mdns_minimal [NOTFOUND=return] }{if "with-mdns4" and not "with-mdns6":mdns4_minimal [NOTFOUND=return] }{if not "with-mdns4" and "with-mdns6":mdns6_minimal [NOTFOUND=return] }resolve [!UNAVAIL=return] dns
|
||||
+hosts: files {if "with-libvirt":libvirt libvirt_guest }{if "with-mdns4" and "with-mdns6":mdns_minimal [NOTFOUND=return] }{if "with-mdns4" and not "with-mdns6":mdns4_minimal [NOTFOUND=return] }{if not "with-mdns4" and "with-mdns6":mdns6_minimal [NOTFOUND=return] }resolve [!UNAVAIL=return] myhostname dns
|
||||
services: files
|
||||
netgroup: files
|
||||
automount: files
|
||||
--
|
||||
2.42.0
|
||||
|
||||
@ -1,376 +0,0 @@
|
||||
From 054c83d1a40d5e0f98230d0f6ac34bd7ecdf383e Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
|
||||
Date: Fri, 23 Feb 2024 15:49:09 +0100
|
||||
Subject: [PATCH 1/3] rhel10: remove systemd-homed
|
||||
|
||||
systemd-homed is not present in rhel.
|
||||
---
|
||||
profiles/local/README | 3 ---
|
||||
profiles/local/password-auth | 4 ----
|
||||
profiles/local/system-auth | 4 ----
|
||||
profiles/nis/README | 3 ---
|
||||
profiles/nis/REQUIREMENTS | 3 ---
|
||||
profiles/nis/password-auth | 4 ----
|
||||
profiles/nis/system-auth | 4 ----
|
||||
profiles/sssd/README | 3 ---
|
||||
profiles/sssd/REQUIREMENTS | 3 ---
|
||||
profiles/sssd/password-auth | 4 ----
|
||||
profiles/sssd/system-auth | 4 ----
|
||||
profiles/winbind/README | 3 ---
|
||||
profiles/winbind/REQUIREMENTS | 3 ---
|
||||
profiles/winbind/password-auth | 4 ----
|
||||
profiles/winbind/system-auth | 4 ----
|
||||
15 files changed, 53 deletions(-)
|
||||
|
||||
diff --git a/profiles/local/README b/profiles/local/README
|
||||
index 03f602441fe95ee280b575508f20d1f1de949b25..eedb298090b5b7c068ee1dfec0ee36c8b3086af4 100644
|
||||
--- a/profiles/local/README
|
||||
+++ b/profiles/local/README
|
||||
@@ -54,9 +54,6 @@ with-mdns4::
|
||||
with-mdns6::
|
||||
Enable multicast DNS over IPv6.
|
||||
|
||||
-with-systemd-homed::
|
||||
- If set, pam_systemd_homed is enabled for all pam operations.
|
||||
-
|
||||
with-libvirt::
|
||||
Enable connecting to libvirt VMs using the hostname configured in the
|
||||
guest OS or, as a fallback, their name.
|
||||
diff --git a/profiles/local/password-auth b/profiles/local/password-auth
|
||||
index 13e10d93b1d43ade8c45c32c50c613f6cf2abcca..d50d7e1fefaf257b8ddcdd1610004ffca9d93634 100644
|
||||
--- a/profiles/local/password-auth
|
||||
+++ b/profiles/local/password-auth
|
||||
@@ -4,17 +4,14 @@ auth required pam_faillock.so preauth
|
||||
auth sufficient pam_u2f.so cue {include if "with-pam-u2f"}
|
||||
auth required pam_u2f.so cue {if not "without-pam-u2f-nouserok":nouserok} {include if "with-pam-u2f-2fa"}
|
||||
auth sufficient pam_unix.so {if not "without-nullok":nullok}
|
||||
-auth sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
auth required pam_faillock.so authfail {include if "with-faillock"}
|
||||
auth optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"}
|
||||
auth required pam_deny.so
|
||||
|
||||
account required pam_access.so {include if "with-pamaccess"}
|
||||
account required pam_faillock.so {include if "with-faillock"}
|
||||
-account sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
account required pam_unix.so
|
||||
|
||||
-password sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
password requisite pam_pwquality.so
|
||||
password [default=1 ignore=ignore success=ok] pam_localuser.so {include if "with-pwhistory"}
|
||||
password requisite pam_pwhistory.so use_authtok {include if "with-pwhistory"}
|
||||
@@ -24,7 +21,6 @@ password required pam_deny.so
|
||||
session optional pam_keyinit.so revoke
|
||||
session required pam_limits.so
|
||||
session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
|
||||
-session optional pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
-session optional pam_systemd.so
|
||||
session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
|
||||
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
|
||||
diff --git a/profiles/local/system-auth b/profiles/local/system-auth
|
||||
index 7f3c56adb2329dd4a08b1cb08b63e8d0d9b13c86..290cd24eb9c50f196d6fc68a3688f097f49159fe 100644
|
||||
--- a/profiles/local/system-auth
|
||||
+++ b/profiles/local/system-auth
|
||||
@@ -5,17 +5,14 @@ auth sufficient pam_fprintd.so
|
||||
auth sufficient pam_u2f.so cue {include if "with-pam-u2f"}
|
||||
auth required pam_u2f.so cue {if not "without-pam-u2f-nouserok":nouserok} {include if "with-pam-u2f-2fa"}
|
||||
auth sufficient pam_unix.so {if not "without-nullok":nullok}
|
||||
-auth sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
auth required pam_faillock.so authfail {include if "with-faillock"}
|
||||
auth optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"}
|
||||
auth required pam_deny.so
|
||||
|
||||
account required pam_access.so {include if "with-pamaccess"}
|
||||
account required pam_faillock.so {include if "with-faillock"}
|
||||
-account sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
account required pam_unix.so
|
||||
|
||||
-password sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
password requisite pam_pwquality.so
|
||||
password [default=1 ignore=ignore success=ok] pam_localuser.so {include if "with-pwhistory"}
|
||||
password requisite pam_pwhistory.so use_authtok {include if "with-pwhistory"}
|
||||
@@ -25,7 +22,6 @@ password required pam_deny.so
|
||||
session optional pam_keyinit.so revoke
|
||||
session required pam_limits.so
|
||||
session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
|
||||
-session optional pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
-session optional pam_systemd.so
|
||||
session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
|
||||
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
|
||||
diff --git a/profiles/nis/README b/profiles/nis/README
|
||||
index e3a1a0b986689bfd43d9531464bcd8fa7a0f5237..745138bbdb1e045db41990dcb8864477d3408e36 100644
|
||||
--- a/profiles/nis/README
|
||||
+++ b/profiles/nis/README
|
||||
@@ -65,9 +65,6 @@ with-mdns4::
|
||||
with-mdns6::
|
||||
Enable multicast DNS over IPv6.
|
||||
|
||||
-with-systemd-homed::
|
||||
- If set, pam_systemd_homed is enabled for all pam operations.
|
||||
-
|
||||
without-nullok::
|
||||
Do not add nullok parameter to pam_unix.
|
||||
|
||||
diff --git a/profiles/nis/REQUIREMENTS b/profiles/nis/REQUIREMENTS
|
||||
index 3e32879eba37e1bd2692aa2852c87036bfa78ed5..d8fe0456ee2b351e98af374fc0206717e6994031 100644
|
||||
--- a/profiles/nis/REQUIREMENTS
|
||||
+++ b/profiles/nis/REQUIREMENTS
|
||||
@@ -16,6 +16,3 @@ Make sure that NIS service is configured and enabled. See NIS documentation for
|
||||
- systemctl enable --now oddjobd.service {include if "with-mkhomedir"}
|
||||
{include if "with-libvirt"}
|
||||
- with-libvirt is selected, make sure that the libvirt NSS plugins are installed {include if "with-libvirt"}
|
||||
- {include if "with-systemd-homed"}
|
||||
-- with-systemd-homed is selected, make sure that the system-homed service is enabled {include if "with-systemd-homed"}
|
||||
- - systemctl enable --now systemd-homed.service {include if "with-systemd-homed"}
|
||||
diff --git a/profiles/nis/password-auth b/profiles/nis/password-auth
|
||||
index 45af4792df9f661fe04e1060e32cc6c0aa38c7c4..927fbcbda8fa4e910e29c88a3806fb5265bbc7bc 100644
|
||||
--- a/profiles/nis/password-auth
|
||||
+++ b/profiles/nis/password-auth
|
||||
@@ -4,17 +4,14 @@ auth required pam_faillock.so preauth
|
||||
auth sufficient pam_u2f.so cue {include if "with-pam-u2f"}
|
||||
auth required pam_u2f.so cue {if not "without-pam-u2f-nouserok":nouserok} {include if "with-pam-u2f-2fa"}
|
||||
auth sufficient pam_unix.so {if not "without-nullok":nullok}
|
||||
-auth sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
auth required pam_faillock.so authfail {include if "with-faillock"}
|
||||
auth optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"}
|
||||
auth required pam_deny.so
|
||||
|
||||
account required pam_access.so {include if "with-pamaccess"}
|
||||
account required pam_faillock.so {include if "with-faillock"}
|
||||
-account sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
account required pam_unix.so broken_shadow
|
||||
|
||||
-password sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
password requisite pam_pwquality.so {if not "with-nispwquality":local_users_only}
|
||||
password [default=1 ignore=ignore success=ok] pam_localuser.so {include if "with-pwhistory"}
|
||||
password requisite pam_pwhistory.so use_authtok {include if "with-pwhistory"}
|
||||
@@ -24,7 +21,6 @@ password required pam_deny.so
|
||||
session optional pam_keyinit.so revoke
|
||||
session required pam_limits.so
|
||||
session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
|
||||
-session optional pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
-session optional pam_systemd.so
|
||||
session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
|
||||
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
|
||||
diff --git a/profiles/nis/system-auth b/profiles/nis/system-auth
|
||||
index 0bd022ee2286f37a5becb0daba2a5813693300a9..40a1bf74aaf3d721c4d720938e57766bfe651e47 100644
|
||||
--- a/profiles/nis/system-auth
|
||||
+++ b/profiles/nis/system-auth
|
||||
@@ -5,17 +5,14 @@ auth sufficient pam_fprintd.so
|
||||
auth sufficient pam_u2f.so cue {include if "with-pam-u2f"}
|
||||
auth required pam_u2f.so cue {if not "without-pam-u2f-nouserok":nouserok} {include if "with-pam-u2f-2fa"}
|
||||
auth sufficient pam_unix.so {if not "without-nullok":nullok}
|
||||
-auth sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
auth required pam_faillock.so authfail {include if "with-faillock"}
|
||||
auth optional pam_gnome_keyring.so only_if=login auto_start {include if "with-pam-gnome-keyring"}
|
||||
auth required pam_deny.so
|
||||
|
||||
account required pam_access.so {include if "with-pamaccess"}
|
||||
account required pam_faillock.so {include if "with-faillock"}
|
||||
-account sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
account required pam_unix.so broken_shadow
|
||||
|
||||
-password sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
password requisite pam_pwquality.so {if not "with-nispwquality":local_users_only}
|
||||
password [default=1 ignore=ignore success=ok] pam_localuser.so {include if "with-pwhistory"}
|
||||
password requisite pam_pwhistory.so use_authtok {include if "with-pwhistory"}
|
||||
@@ -25,7 +22,6 @@ password required pam_deny.so
|
||||
session optional pam_keyinit.so revoke
|
||||
session required pam_limits.so
|
||||
session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
|
||||
-session optional pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
-session optional pam_systemd.so
|
||||
session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
|
||||
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
|
||||
diff --git a/profiles/sssd/README b/profiles/sssd/README
|
||||
index f7aaba8ecca4bc18a0e57d2334c2030fd26fda0d..a497da5dcffd0a03a122677c49ee2f8021927b04 100644
|
||||
--- a/profiles/sssd/README
|
||||
+++ b/profiles/sssd/README
|
||||
@@ -106,9 +106,6 @@ with-gssapi::
|
||||
with-subid::
|
||||
Enable SSSD as a source of subid database in /etc/nsswitch.conf.
|
||||
|
||||
-with-systemd-homed::
|
||||
- If set, pam_systemd_homed is enabled for all pam operations.
|
||||
-
|
||||
without-nullok::
|
||||
Do not add nullok parameter to pam_unix.
|
||||
|
||||
diff --git a/profiles/sssd/REQUIREMENTS b/profiles/sssd/REQUIREMENTS
|
||||
index 6aaf7c771f7c1bcbf2aee7152422acc9d53c71f5..b36f6069a54a5f711a10aa0700f33e1a8e37794e 100644
|
||||
--- a/profiles/sssd/REQUIREMENTS
|
||||
+++ b/profiles/sssd/REQUIREMENTS
|
||||
@@ -25,6 +25,3 @@ Make sure that SSSD service is configured and enabled. See SSSD documentation fo
|
||||
- with-tlog is selected, make sure that session recording is enabled in SSSD {include if "with-tlog"}
|
||||
{include if "with-libvirt"}
|
||||
- with-libvirt is selected, make sure that the libvirt NSS plugins are installed {include if "with-libvirt"}
|
||||
- {include if "with-systemd-homed"}
|
||||
-- with-systemd-homed is selected, make sure that the system-homed service is enabled {include if "with-systemd-homed"}
|
||||
- - systemctl enable --now systemd-homed.service {include if "with-systemd-homed"}
|
||||
diff --git a/profiles/sssd/password-auth b/profiles/sssd/password-auth
|
||||
index 97c33b678706e7eeb86bf45251baa41739f2940f..f468507b938ea2a7ac305a65f5fdea14a1ae10f1 100644
|
||||
--- a/profiles/sssd/password-auth
|
||||
+++ b/profiles/sssd/password-auth
|
||||
@@ -7,7 +7,6 @@ auth required pam_u2f.so cue {if not
|
||||
auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular
|
||||
auth [default=1 ignore=ignore success=ok] pam_localuser.so
|
||||
auth sufficient pam_unix.so {if not "without-nullok":nullok}
|
||||
-auth sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular
|
||||
auth sufficient pam_sss.so forward_pass
|
||||
auth required pam_faillock.so authfail {include if "with-faillock"}
|
||||
@@ -16,14 +15,12 @@ auth required pam_deny.so
|
||||
|
||||
account required pam_access.so {include if "with-pamaccess"}
|
||||
account required pam_faillock.so {include if "with-faillock"}
|
||||
-account sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
account required pam_unix.so
|
||||
account sufficient pam_localuser.so {exclude if "with-files-access-provider"}
|
||||
account sufficient pam_usertype.so issystem
|
||||
account [default=bad success=ok user_unknown=ignore] pam_sss.so
|
||||
account required pam_permit.so
|
||||
|
||||
-password sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
password requisite pam_pwquality.so local_users_only
|
||||
password [default=1 ignore=ignore success=ok] pam_localuser.so {include if "with-pwhistory"}
|
||||
password requisite pam_pwhistory.so use_authtok {include if "with-pwhistory"}
|
||||
@@ -35,7 +32,6 @@ password required pam_deny.so
|
||||
session optional pam_keyinit.so revoke
|
||||
session required pam_limits.so
|
||||
session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
|
||||
-session optional pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
-session optional pam_systemd.so
|
||||
session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
|
||||
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
|
||||
diff --git a/profiles/sssd/system-auth b/profiles/sssd/system-auth
|
||||
index 90c3504a414f0a151475cc207285b230fec381b1..870e4d7024066e3e40786bde6c3c39c7ba8d62c0 100644
|
||||
--- a/profiles/sssd/system-auth
|
||||
+++ b/profiles/sssd/system-auth
|
||||
@@ -12,7 +12,6 @@ auth [default=1 ignore=ignore success=ok] pam_localuser.so
|
||||
auth [default=2 ignore=ignore success=ok] pam_localuser.so {include if "with-smartcard"}
|
||||
auth [success=done authinfo_unavail=ignore user_unknown=ignore ignore=ignore default=die] pam_sss.so try_cert_auth {include if "with-smartcard"}
|
||||
auth sufficient pam_unix.so {if not "without-nullok":nullok}
|
||||
-auth sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular {include if "with-gssapi"}
|
||||
auth sufficient pam_sss_gss.so {include if "with-gssapi"}
|
||||
auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular
|
||||
@@ -23,14 +22,12 @@ auth required pam_deny.so
|
||||
|
||||
account required pam_access.so {include if "with-pamaccess"}
|
||||
account required pam_faillock.so {include if "with-faillock"}
|
||||
-account sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
account required pam_unix.so
|
||||
account sufficient pam_localuser.so {exclude if "with-files-access-provider"}
|
||||
account sufficient pam_usertype.so issystem
|
||||
account [default=bad success=ok user_unknown=ignore] pam_sss.so
|
||||
account required pam_permit.so
|
||||
|
||||
-password sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
password requisite pam_pwquality.so local_users_only
|
||||
password [default=1 ignore=ignore success=ok] pam_localuser.so {include if "with-pwhistory"}
|
||||
password requisite pam_pwhistory.so use_authtok {include if "with-pwhistory"}
|
||||
@@ -42,7 +39,6 @@ password required pam_deny.so
|
||||
session optional pam_keyinit.so revoke
|
||||
session required pam_limits.so
|
||||
session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
|
||||
-session optional pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
-session optional pam_systemd.so
|
||||
session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
|
||||
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
|
||||
diff --git a/profiles/winbind/README b/profiles/winbind/README
|
||||
index f65870d1d03da6465ad446dac87ed141d7115d8b..8844e1da2003a0266dfe8937774d6d6f7dad0210 100644
|
||||
--- a/profiles/winbind/README
|
||||
+++ b/profiles/winbind/README
|
||||
@@ -75,9 +75,6 @@ with-mdns4::
|
||||
with-mdns6::
|
||||
Enable multicast DNS over IPv6.
|
||||
|
||||
-with-systemd-homed::
|
||||
- If set, pam_systemd_homed is enabled for all pam operations.
|
||||
-
|
||||
without-nullok::
|
||||
Do not add nullok parameter to pam_unix.
|
||||
|
||||
diff --git a/profiles/winbind/REQUIREMENTS b/profiles/winbind/REQUIREMENTS
|
||||
index 232f6ee986ac66c5fed972c91c17080e0740e5c7..31a37d74ca5a4c46415545b8f6e0f61e8ad3b433 100644
|
||||
--- a/profiles/winbind/REQUIREMENTS
|
||||
+++ b/profiles/winbind/REQUIREMENTS
|
||||
@@ -16,6 +16,3 @@ Make sure that winbind service is configured and enabled. See winbind documentat
|
||||
- systemctl enable --now oddjobd.service {include if "with-mkhomedir"}
|
||||
{include if "with-libvirt"}
|
||||
- with-libvirt is selected, make sure that the libvirt NSS plugins are installed {include if "with-libvirt"}
|
||||
- {include if "with-systemd-homed"}
|
||||
-- with-systemd-homed is selected, make sure that the system-homed service is enabled {include if "with-systemd-homed"}
|
||||
- - systemctl enable --now systemd-homed.service {include if "with-systemd-homed"}
|
||||
diff --git a/profiles/winbind/password-auth b/profiles/winbind/password-auth
|
||||
index 8d74149dd48643dbb4b80d62600d3ece0868ec30..8d1682b9301c2b9c92292a41120f69611f148108 100644
|
||||
--- a/profiles/winbind/password-auth
|
||||
+++ b/profiles/winbind/password-auth
|
||||
@@ -4,7 +4,6 @@ auth required pam_faillock.so preauth
|
||||
auth sufficient pam_u2f.so cue {include if "with-pam-u2f"}
|
||||
auth required pam_u2f.so cue {if not "without-pam-u2f-nouserok":nouserok} {include if "with-pam-u2f-2fa"}
|
||||
auth sufficient pam_unix.so {if not "without-nullok":nullok}
|
||||
-auth sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular
|
||||
auth sufficient pam_winbind.so {if "with-krb5":krb5_auth} use_first_pass
|
||||
auth required pam_faillock.so authfail {include if "with-faillock"}
|
||||
@@ -13,14 +12,12 @@ auth required pam_deny.so
|
||||
|
||||
account required pam_access.so {include if "with-pamaccess"}
|
||||
account required pam_faillock.so {include if "with-faillock"}
|
||||
-account sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
account required pam_unix.so broken_shadow
|
||||
account sufficient pam_localuser.so
|
||||
account sufficient pam_usertype.so issystem
|
||||
account [default=bad success=ok user_unknown=ignore] pam_winbind.so {if "with-krb5":krb5_auth}
|
||||
account required pam_permit.so
|
||||
|
||||
-password sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
password requisite pam_pwquality.so local_users_only
|
||||
password [default=1 ignore=ignore success=ok] pam_localuser.so {include if "with-pwhistory"}
|
||||
password requisite pam_pwhistory.so use_authtok {include if "with-pwhistory"}
|
||||
@@ -31,7 +28,6 @@ password required pam_deny.so
|
||||
session optional pam_keyinit.so revoke
|
||||
session required pam_limits.so
|
||||
session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
|
||||
-session optional pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
-session optional pam_systemd.so
|
||||
session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
|
||||
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
|
||||
diff --git a/profiles/winbind/system-auth b/profiles/winbind/system-auth
|
||||
index 2326c859284c5823c5a6d34390d794dbf33110d2..612143d10fe502d7f6ed636b4fba6cc639aa66b0 100644
|
||||
--- a/profiles/winbind/system-auth
|
||||
+++ b/profiles/winbind/system-auth
|
||||
@@ -5,7 +5,6 @@ auth sufficient pam_fprintd.so
|
||||
auth sufficient pam_u2f.so cue {include if "with-pam-u2f"}
|
||||
auth required pam_u2f.so cue {if not "without-pam-u2f-nouserok":nouserok} {include if "with-pam-u2f-2fa"}
|
||||
auth sufficient pam_unix.so {if not "without-nullok":nullok}
|
||||
-auth sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
auth [default=1 ignore=ignore success=ok] pam_usertype.so isregular
|
||||
auth sufficient pam_winbind.so {if "with-krb5":krb5_auth} use_first_pass
|
||||
auth required pam_faillock.so authfail {include if "with-faillock"}
|
||||
@@ -14,14 +13,12 @@ auth required pam_deny.so
|
||||
|
||||
account required pam_access.so {include if "with-pamaccess"}
|
||||
account required pam_faillock.so {include if "with-faillock"}
|
||||
-account sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
account required pam_unix.so broken_shadow
|
||||
account sufficient pam_localuser.so
|
||||
account sufficient pam_usertype.so issystem
|
||||
account [default=bad success=ok user_unknown=ignore] pam_winbind.so {if "with-krb5":krb5_auth}
|
||||
account required pam_permit.so
|
||||
|
||||
-password sufficient pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
password requisite pam_pwquality.so local_users_only
|
||||
password [default=1 ignore=ignore success=ok] pam_localuser.so {include if "with-pwhistory"}
|
||||
password requisite pam_pwhistory.so use_authtok {include if "with-pwhistory"}
|
||||
@@ -32,7 +29,6 @@ password required pam_deny.so
|
||||
session optional pam_keyinit.so revoke
|
||||
session required pam_limits.so
|
||||
session optional pam_ecryptfs.so unwrap {include if "with-ecryptfs"}
|
||||
-session optional pam_systemd_home.so {include if "with-systemd-homed"}
|
||||
-session optional pam_systemd.so
|
||||
session optional pam_oddjob_mkhomedir.so {include if "with-mkhomedir"}
|
||||
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
|
||||
--
|
||||
2.42.0
|
||||
|
||||
@ -0,0 +1,25 @@
|
||||
From c3c2c3b7ffe04dc2e810c9fffdd82689543a94df Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
|
||||
Date: Tue, 30 Oct 2018 14:08:12 +0100
|
||||
Subject: [PATCH 1/4] rhel9: remove mention of Fedora Change page in compat
|
||||
tool
|
||||
|
||||
---
|
||||
src/compat/authcompat.py.in.in | 1 -
|
||||
1 file changed, 1 deletion(-)
|
||||
|
||||
diff --git a/src/compat/authcompat.py.in.in b/src/compat/authcompat.py.in.in
|
||||
index 1a68d95c71b51beabe80e9b07c084ea9c2f3580d..8334293911d1d4c2d98a6d233b91fc348cf06575 100755
|
||||
--- a/src/compat/authcompat.py.in.in
|
||||
+++ b/src/compat/authcompat.py.in.in
|
||||
@@ -471,7 +471,6 @@ class AuthCompat:
|
||||
"It does not provide all capabilities of authconfig.\n"))
|
||||
print(_("IMPORTANT: authconfig is replaced by authselect, "
|
||||
"please update your scripts."))
|
||||
- print(_("See Fedora 28 Change Page: https://fedoraproject.org/wiki/Changes/AuthselectAsDefault"))
|
||||
print(_("See man authselect-migration(7) to help you with migration to authselect"))
|
||||
|
||||
options = self.options.getSetButUnsupported()
|
||||
--
|
||||
2.34.1
|
||||
|
||||
@ -1,68 +0,0 @@
|
||||
From b259ca399de497e0fc5e0763257e89bcc2e5a902 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
|
||||
Date: Fri, 23 Feb 2024 16:01:58 +0100
|
||||
Subject: [PATCH 3/3] rhel10: remove systemd-resolved
|
||||
|
||||
systemd-resolved should not be enabled by default in rhel.
|
||||
---
|
||||
profiles/local/nsswitch.conf | 2 +-
|
||||
profiles/nis/nsswitch.conf | 2 +-
|
||||
profiles/sssd/nsswitch.conf | 2 +-
|
||||
profiles/winbind/nsswitch.conf | 2 +-
|
||||
4 files changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/profiles/local/nsswitch.conf b/profiles/local/nsswitch.conf
|
||||
index 538926e4d5cc8c190a7b2d10fd3756ad3269a720..1ad4276566f775086fc091d8e1c35d4ac94a9786 100644
|
||||
--- a/profiles/local/nsswitch.conf
|
||||
+++ b/profiles/local/nsswitch.conf
|
||||
@@ -2,7 +2,7 @@
|
||||
passwd: files {if "with-altfiles":altfiles }systemd
|
||||
shadow: files
|
||||
group: files [SUCCESS=merge] {if "with-altfiles":altfiles [SUCCESS=merge] }systemd
|
||||
-hosts: files {if "with-libvirt":libvirt libvirt_guest }{if "with-mdns4" and "with-mdns6":mdns_minimal [NOTFOUND=return] }{if "with-mdns4" and not "with-mdns6":mdns4_minimal [NOTFOUND=return] }{if not "with-mdns4" and "with-mdns6":mdns6_minimal [NOTFOUND=return] }resolve [!UNAVAIL=return] myhostname dns
|
||||
+hosts: files {if "with-libvirt":libvirt libvirt_guest }{if "with-mdns4" and "with-mdns6":mdns_minimal [NOTFOUND=return] }{if "with-mdns4" and not "with-mdns6":mdns4_minimal [NOTFOUND=return] }{if not "with-mdns4" and "with-mdns6":mdns6_minimal [NOTFOUND=return] }myhostname dns
|
||||
services: files
|
||||
netgroup: files
|
||||
automount: files
|
||||
diff --git a/profiles/nis/nsswitch.conf b/profiles/nis/nsswitch.conf
|
||||
index 488476e91879b549fe605008d500b1810360f3be..88110258a69e7366980944ec3ccd9c79c0a1b323 100644
|
||||
--- a/profiles/nis/nsswitch.conf
|
||||
+++ b/profiles/nis/nsswitch.conf
|
||||
@@ -2,7 +2,7 @@
|
||||
passwd: files {if "with-altfiles":altfiles }nis systemd
|
||||
shadow: files nis
|
||||
group: files [SUCCESS=merge] {if "with-altfiles":altfiles [SUCCESS=merge] }nis [SUCCESS=merge] systemd
|
||||
-hosts: files {if "with-libvirt":libvirt libvirt_guest }{if "with-mdns4" and "with-mdns6":mdns_minimal [NOTFOUND=return] }{if "with-mdns4" and not "with-mdns6":mdns4_minimal [NOTFOUND=return] }{if not "with-mdns4" and "with-mdns6":mdns6_minimal [NOTFOUND=return] }resolve [!UNAVAIL=return] nis myhostname dns
|
||||
+hosts: files {if "with-libvirt":libvirt libvirt_guest }{if "with-mdns4" and "with-mdns6":mdns_minimal [NOTFOUND=return] }{if "with-mdns4" and not "with-mdns6":mdns4_minimal [NOTFOUND=return] }{if not "with-mdns4" and "with-mdns6":mdns6_minimal [NOTFOUND=return] }nis myhostname dns
|
||||
services: files nis
|
||||
netgroup: files nis
|
||||
automount: files nis
|
||||
diff --git a/profiles/sssd/nsswitch.conf b/profiles/sssd/nsswitch.conf
|
||||
index b98094d9e0eaeb1559347b81a9505822ff713034..89a1f230487a18d12ff9c3862e3394035bf17cff 100644
|
||||
--- a/profiles/sssd/nsswitch.conf
|
||||
+++ b/profiles/sssd/nsswitch.conf
|
||||
@@ -2,7 +2,7 @@
|
||||
passwd: {if "with-tlog":sss }files {if "with-altfiles":altfiles }{if not "with-tlog":sss }systemd
|
||||
shadow: files
|
||||
group: {if "with-tlog":sss [SUCCESS=merge] }files [SUCCESS=merge] {if "with-altfiles":altfiles [SUCCESS=merge] }{if not "with-tlog":sss [SUCCESS=merge] }systemd
|
||||
-hosts: files {if "with-libvirt":libvirt libvirt_guest }{if "with-mdns4" and "with-mdns6":mdns_minimal [NOTFOUND=return] }{if "with-mdns4" and not "with-mdns6":mdns4_minimal [NOTFOUND=return] }{if not "with-mdns4" and "with-mdns6":mdns6_minimal [NOTFOUND=return] }resolve [!UNAVAIL=return] myhostname dns
|
||||
+hosts: files {if "with-libvirt":libvirt libvirt_guest }{if "with-mdns4" and "with-mdns6":mdns_minimal [NOTFOUND=return] }{if "with-mdns4" and not "with-mdns6":mdns4_minimal [NOTFOUND=return] }{if not "with-mdns4" and "with-mdns6":mdns6_minimal [NOTFOUND=return] }myhostname dns
|
||||
services: files sss
|
||||
netgroup: files sss
|
||||
sudoers: files sss {include if "with-sudo"}
|
||||
diff --git a/profiles/winbind/nsswitch.conf b/profiles/winbind/nsswitch.conf
|
||||
index cc966b34464bb28776b903d61fff1f6a94a1eb6f..5315640e39f7c84b4c138f393fa3b5c970e4afa5 100644
|
||||
--- a/profiles/winbind/nsswitch.conf
|
||||
+++ b/profiles/winbind/nsswitch.conf
|
||||
@@ -2,7 +2,7 @@
|
||||
passwd: files {if "with-altfiles":altfiles }winbind systemd
|
||||
shadow: files
|
||||
group: files [SUCCESS=merge] {if "with-altfiles":altfiles [SUCCESS=merge] }winbind [SUCCESS=merge] systemd
|
||||
-hosts: files {if "with-libvirt":libvirt libvirt_guest }{if "with-mdns4" and "with-mdns6":mdns_minimal [NOTFOUND=return] }{if "with-mdns4" and not "with-mdns6":mdns4_minimal [NOTFOUND=return] }{if not "with-mdns4" and "with-mdns6":mdns6_minimal [NOTFOUND=return] }resolve [!UNAVAIL=return] myhostname dns
|
||||
+hosts: files {if "with-libvirt":libvirt libvirt_guest }{if "with-mdns4" and "with-mdns6":mdns_minimal [NOTFOUND=return] }{if "with-mdns4" and not "with-mdns6":mdns4_minimal [NOTFOUND=return] }{if not "with-mdns4" and "with-mdns6":mdns6_minimal [NOTFOUND=return] }myhostname dns
|
||||
services: files
|
||||
netgroup: files
|
||||
automount: files
|
||||
--
|
||||
2.42.0
|
||||
|
||||
@ -0,0 +1,42 @@
|
||||
From 6381b49e90b3850fade68c8af03b17d0cc016d3c Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
|
||||
Date: Wed, 25 Nov 2020 14:05:00 +0100
|
||||
Subject: [PATCH 3/4] rhel9: Revert "profiles: add support for resolved"
|
||||
|
||||
systemd-resolved should not be enabled by default on rhel8.
|
||||
|
||||
This reverts commit c5294c508a940291440eb32d5d750f33baf1ae54.
|
||||
---
|
||||
profiles/minimal/nsswitch.conf | 2 +-
|
||||
profiles/nis/nsswitch.conf | 2 +-
|
||||
2 files changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/profiles/minimal/nsswitch.conf b/profiles/minimal/nsswitch.conf
|
||||
index a9e4bc79a1090304542ccd8b43d1107eeb5304df..a39e4d32ebf79e8bf05f2db5753b01596222dc35 100644
|
||||
--- a/profiles/minimal/nsswitch.conf
|
||||
+++ b/profiles/minimal/nsswitch.conf
|
||||
@@ -2,7 +2,7 @@ aliases: files {exclude if "with-custom
|
||||
automount: files {exclude if "with-custom-automount"}
|
||||
ethers: files {exclude if "with-custom-ethers"}
|
||||
group: files {if "with-altfiles":altfiles }systemd {exclude if "with-custom-group"}
|
||||
-hosts: resolve [!UNAVAIL=return] files myhostname dns {exclude if "with-custom-hosts"}
|
||||
+hosts: files dns myhostname {exclude if "with-custom-hosts"}
|
||||
initgroups: files {exclude if "with-custom-initgroups"}
|
||||
netgroup: files {exclude if "with-custom-netgroup"}
|
||||
networks: files {exclude if "with-custom-networks"}
|
||||
diff --git a/profiles/nis/nsswitch.conf b/profiles/nis/nsswitch.conf
|
||||
index 50a3ffb7431a91b88b4bfef4c09df19310fac7e7..9bee7d839f84ff39d54cb6ead9dea38e51736b4d 100644
|
||||
--- a/profiles/nis/nsswitch.conf
|
||||
+++ b/profiles/nis/nsswitch.conf
|
||||
@@ -2,7 +2,7 @@ aliases: files nis {exclude if "with-custom-aliases"}
|
||||
automount: files nis {exclude if "with-custom-automount"}
|
||||
ethers: files nis {exclude if "with-custom-ethers"}
|
||||
group: files nis systemd {exclude if "with-custom-group"}
|
||||
-hosts: resolve [!UNAVAIL=return] files nis myhostname dns {exclude if "with-custom-hosts"}
|
||||
+hosts: files nis dns myhostname {exclude if "with-custom-hosts"}
|
||||
initgroups: files nis {exclude if "with-custom-initgroups"}
|
||||
netgroup: files nis {exclude if "with-custom-netgroup"}
|
||||
networks: files nis {exclude if "with-custom-networks"}
|
||||
--
|
||||
2.34.1
|
||||
|
||||
@ -0,0 +1,297 @@
|
||||
From fde1c60f1e87383596ee7060f4d748675b2efae9 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina@redhat.com>
|
||||
Date: Wed, 9 Jun 2021 13:59:01 +0200
|
||||
Subject: [PATCH 4/4] rhel9: remove nis support
|
||||
|
||||
NIS is no longer supported in RHEL9.
|
||||
---
|
||||
profiles/Makefile.am | 14 -----
|
||||
profiles/nis/dconf-db | 3 -
|
||||
profiles/nis/dconf-locks | 2 -
|
||||
profiles/nis/nsswitch.conf | 14 -----
|
||||
profiles/nis/postlogin | 4 --
|
||||
rpm/authselect.spec.in | 11 ----
|
||||
src/compat/authcompat.py.in.in | 95 -----------------------------
|
||||
src/compat/authcompat_Options.py | 8 ++-
|
||||
src/man/authselect-migration.7.adoc | 2 +-
|
||||
9 files changed, 6 insertions(+), 147 deletions(-)
|
||||
delete mode 100644 profiles/nis/dconf-db
|
||||
delete mode 100644 profiles/nis/dconf-locks
|
||||
delete mode 100644 profiles/nis/nsswitch.conf
|
||||
delete mode 100644 profiles/nis/postlogin
|
||||
|
||||
diff --git a/profiles/Makefile.am b/profiles/Makefile.am
|
||||
index 7191b2604ca2c9ebaba3a4f1beb950e7d0e03970..4ab613f42a581df02c427636a0070092b58ec418 100644
|
||||
--- a/profiles/Makefile.am
|
||||
+++ b/profiles/Makefile.am
|
||||
@@ -15,20 +15,6 @@ dist_profile_minimal_DATA = \
|
||||
$(top_srcdir)/profiles/minimal/dconf-locks \
|
||||
$(NULL)
|
||||
|
||||
-profile_nisdir = $(authselect_profile_dir)/nis
|
||||
-dist_profile_nis_DATA = \
|
||||
- $(top_srcdir)/profiles/nis/nsswitch.conf \
|
||||
- $(top_srcdir)/profiles/nis/password-auth \
|
||||
- $(top_srcdir)/profiles/nis/postlogin \
|
||||
- $(top_srcdir)/profiles/nis/README \
|
||||
- $(top_srcdir)/profiles/nis/REQUIREMENTS \
|
||||
- $(top_srcdir)/profiles/nis/smartcard-auth \
|
||||
- $(top_srcdir)/profiles/nis/system-auth \
|
||||
- $(top_srcdir)/profiles/nis/fingerprint-auth \
|
||||
- $(top_srcdir)/profiles/nis/dconf-db \
|
||||
- $(top_srcdir)/profiles/nis/dconf-locks \
|
||||
- $(NULL)
|
||||
-
|
||||
profile_sssddir = $(authselect_profile_dir)/sssd
|
||||
dist_profile_sssd_DATA = \
|
||||
$(top_srcdir)/profiles/sssd/nsswitch.conf \
|
||||
diff --git a/profiles/nis/dconf-db b/profiles/nis/dconf-db
|
||||
deleted file mode 100644
|
||||
index bd32b2819f66acdc75ab0fc522ec85673d10ed72..0000000000000000000000000000000000000000
|
||||
--- a/profiles/nis/dconf-db
|
||||
+++ /dev/null
|
||||
@@ -1,3 +0,0 @@
|
||||
-[org/gnome/login-screen]
|
||||
-enable-smartcard-authentication=false
|
||||
-enable-fingerprint-authentication={if "with-fingerprint":true|false}
|
||||
diff --git a/profiles/nis/dconf-locks b/profiles/nis/dconf-locks
|
||||
deleted file mode 100644
|
||||
index 8a36fa9568344338272786394aece872185d0ab3..0000000000000000000000000000000000000000
|
||||
--- a/profiles/nis/dconf-locks
|
||||
+++ /dev/null
|
||||
@@ -1,2 +0,0 @@
|
||||
-/org/gnome/login-screen/enable-smartcard-authentication
|
||||
-/org/gnome/login-screen/enable-fingerprint-authentication
|
||||
diff --git a/profiles/nis/nsswitch.conf b/profiles/nis/nsswitch.conf
|
||||
deleted file mode 100644
|
||||
index 9bee7d839f84ff39d54cb6ead9dea38e51736b4d..0000000000000000000000000000000000000000
|
||||
--- a/profiles/nis/nsswitch.conf
|
||||
+++ /dev/null
|
||||
@@ -1,14 +0,0 @@
|
||||
-aliases: files nis {exclude if "with-custom-aliases"}
|
||||
-automount: files nis {exclude if "with-custom-automount"}
|
||||
-ethers: files nis {exclude if "with-custom-ethers"}
|
||||
-group: files nis systemd {exclude if "with-custom-group"}
|
||||
-hosts: files nis dns myhostname {exclude if "with-custom-hosts"}
|
||||
-initgroups: files nis {exclude if "with-custom-initgroups"}
|
||||
-netgroup: files nis {exclude if "with-custom-netgroup"}
|
||||
-networks: files nis {exclude if "with-custom-networks"}
|
||||
-passwd: files nis systemd {exclude if "with-custom-passwd"}
|
||||
-protocols: files nis {exclude if "with-custom-protocols"}
|
||||
-publickey: files nis {exclude if "with-custom-publickey"}
|
||||
-rpc: files nis {exclude if "with-custom-rpc"}
|
||||
-services: files nis {exclude if "with-custom-services"}
|
||||
-shadow: files nis {exclude if "with-custom-shadow"}
|
||||
diff --git a/profiles/nis/postlogin b/profiles/nis/postlogin
|
||||
deleted file mode 100644
|
||||
index 04a11f049bc1e220c9064fba7b46eb243ddd4996..0000000000000000000000000000000000000000
|
||||
--- a/profiles/nis/postlogin
|
||||
+++ /dev/null
|
||||
@@ -1,4 +0,0 @@
|
||||
-session optional pam_umask.so silent
|
||||
-session [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet
|
||||
-session [default=1] pam_lastlog.so nowtmp {if "with-silent-lastlog":silent|showfailed}
|
||||
-session optional pam_lastlog.so silent noupdate showfailed
|
||||
diff --git a/rpm/authselect.spec.in b/rpm/authselect.spec.in
|
||||
index f8539d5a028da1a7184b47609a8efdb5ce0be14e..95da183a41a29f7913a0a255a94070908ed9a66c 100644
|
||||
--- a/rpm/authselect.spec.in
|
||||
+++ b/rpm/authselect.spec.in
|
||||
@@ -165,7 +165,6 @@ find $RPM_BUILD_ROOT -name "*.a" -exec %__rm -f {} \;
|
||||
%dir %{_datadir}/authselect/vendor
|
||||
%dir %{_datadir}/authselect/default
|
||||
%dir %{_datadir}/authselect/default/minimal/
|
||||
-%dir %{_datadir}/authselect/default/nis/
|
||||
%dir %{_datadir}/authselect/default/sssd/
|
||||
%dir %{_datadir}/authselect/default/winbind/
|
||||
%{_datadir}/authselect/default/minimal/dconf-db
|
||||
@@ -178,16 +177,6 @@ find $RPM_BUILD_ROOT -name "*.a" -exec %__rm -f {} \;
|
||||
%{_datadir}/authselect/default/minimal/REQUIREMENTS
|
||||
%{_datadir}/authselect/default/minimal/smartcard-auth
|
||||
%{_datadir}/authselect/default/minimal/system-auth
|
||||
-%{_datadir}/authselect/default/nis/dconf-db
|
||||
-%{_datadir}/authselect/default/nis/dconf-locks
|
||||
-%{_datadir}/authselect/default/nis/fingerprint-auth
|
||||
-%{_datadir}/authselect/default/nis/nsswitch.conf
|
||||
-%{_datadir}/authselect/default/nis/password-auth
|
||||
-%{_datadir}/authselect/default/nis/postlogin
|
||||
-%{_datadir}/authselect/default/nis/README
|
||||
-%{_datadir}/authselect/default/nis/REQUIREMENTS
|
||||
-%{_datadir}/authselect/default/nis/smartcard-auth
|
||||
-%{_datadir}/authselect/default/nis/system-auth
|
||||
%{_datadir}/authselect/default/sssd/dconf-db
|
||||
%{_datadir}/authselect/default/sssd/dconf-locks
|
||||
%{_datadir}/authselect/default/sssd/fingerprint-auth
|
||||
diff --git a/src/compat/authcompat.py.in.in b/src/compat/authcompat.py.in.in
|
||||
index 55e205bae2c0b1f7892f8b286c288dfeaa26a60d..c6d1f2786c233f7ebdbfe5f2503aa0016012aee0 100755
|
||||
--- a/src/compat/authcompat.py.in.in
|
||||
+++ b/src/compat/authcompat.py.in.in
|
||||
@@ -243,20 +243,6 @@ class Configuration:
|
||||
|
||||
config.write(keys)
|
||||
|
||||
- class Network(Base):
|
||||
- def __init__(self, options):
|
||||
- super(Configuration.Network, self).__init__(options)
|
||||
-
|
||||
- def write(self):
|
||||
- nisdomain = self.get("nisdomain")
|
||||
- config = EnvironmentFile(Path.System('network'))
|
||||
-
|
||||
- if nisdomain is None:
|
||||
- return
|
||||
-
|
||||
- config.set("NISDOMAIN", nisdomain)
|
||||
- config.write()
|
||||
-
|
||||
class SSSD(Base):
|
||||
def __init__(self, options):
|
||||
super(Configuration.SSSD, self).__init__(options, ServiceName="sssd")
|
||||
@@ -378,83 +364,6 @@ class Configuration:
|
||||
# other applications may depend on it.
|
||||
return
|
||||
|
||||
- class NIS(Base):
|
||||
- def __init__(self, options):
|
||||
- super(Configuration.NIS, self).__init__(options)
|
||||
- self.rpcbind = Service("rpcbind")
|
||||
- self.ypbind = Service("ypbind")
|
||||
-
|
||||
- def isEnabled(self):
|
||||
- if not self.isset("nis"):
|
||||
- return None
|
||||
-
|
||||
- return self.getBool("nis")
|
||||
-
|
||||
- def enableService(self, nostart):
|
||||
- if not self.isset("nisdomain"):
|
||||
- return
|
||||
-
|
||||
- nisdom = self.get("nisdomain")
|
||||
-
|
||||
- if not nostart:
|
||||
- cmd = Command(Path.System('cmd-domainname'), [nisdom])
|
||||
- cmd.run()
|
||||
-
|
||||
- cmd = Command(Path.System('cmd-setsebool'),
|
||||
- ['-P', 'allow_ypbind', '1'])
|
||||
- cmd.run()
|
||||
-
|
||||
- self.rpcbind.enable()
|
||||
- self.ypbind.enable()
|
||||
-
|
||||
- if not nostart:
|
||||
- self.rpcbind.start(Restart=False)
|
||||
- self.ypbind.start()
|
||||
-
|
||||
- def disableService(self, nostop):
|
||||
- if not nostop:
|
||||
- cmd = Command(Path.System('cmd-domainname'), ["(none)"])
|
||||
- cmd.run()
|
||||
-
|
||||
- cmd = Command(Path.System('cmd-setsebool'),
|
||||
- ['-P', 'allow_ypbind', '0'])
|
||||
- cmd.run()
|
||||
-
|
||||
- self.rpcbind.disable()
|
||||
- self.ypbind.disable()
|
||||
-
|
||||
- if not nostop:
|
||||
- self.rpcbind.stop()
|
||||
- self.ypbind.stop()
|
||||
-
|
||||
- def write(self):
|
||||
- if not self.isset("nisdomain"):
|
||||
- return
|
||||
-
|
||||
- output = "domain " + self.get("nisdomain")
|
||||
-
|
||||
- additional_servers = []
|
||||
- if self.isset("nisserver"):
|
||||
- servers = self.get("nisserver").split(",")
|
||||
- additional_servers = servers[1:]
|
||||
- output += " server " + servers[0] + "\n"
|
||||
- else:
|
||||
- output += " broadcast\n"
|
||||
-
|
||||
- for server in additional_servers:
|
||||
- output += "ypserver " + server + "\n"
|
||||
-
|
||||
- filename = Path.System('yp.conf')
|
||||
- if self.getBool("test-call"):
|
||||
- print("========== BEGIN Content of [%s] ==========" % filename)
|
||||
- print(output)
|
||||
- print("========== END Content of [%s] ==========\n" % filename)
|
||||
- return
|
||||
-
|
||||
- with open(filename, "w") as f:
|
||||
- f.write(output)
|
||||
-
|
||||
-
|
||||
class AuthCompat:
|
||||
def __init__(self):
|
||||
self.sysconfig = EnvironmentFile(Path.System('authconfig'))
|
||||
@@ -538,8 +447,6 @@ class AuthCompat:
|
||||
or self.options.getBool("sssd")
|
||||
or self.options.getBool("sssdauth")):
|
||||
profile = "sssd"
|
||||
- elif self.options.getBool("nis"):
|
||||
- profile = "nis"
|
||||
elif self.options.getBool("winbind"):
|
||||
profile = "winbind"
|
||||
|
||||
@@ -596,13 +503,11 @@ class AuthCompat:
|
||||
def writeConfiguration(self):
|
||||
configs = [
|
||||
Configuration.LDAP(self.options),
|
||||
- Configuration.Network(self.options),
|
||||
Configuration.Kerberos(self.options),
|
||||
Configuration.SSSD(self.options),
|
||||
Configuration.Winbind(self.options),
|
||||
Configuration.PWQuality(self.options),
|
||||
Configuration.MakeHomedir(self.options),
|
||||
- Configuration.NIS(self.options)
|
||||
]
|
||||
|
||||
for config in configs:
|
||||
diff --git a/src/compat/authcompat_Options.py b/src/compat/authcompat_Options.py
|
||||
index 5c8b21b55014198d6d9dfc98bd807c3c922b06f4..79ead60fa9edc1244227e3b69df025471b7c7991 100644
|
||||
--- a/src/compat/authcompat_Options.py
|
||||
+++ b/src/compat/authcompat_Options.py
|
||||
@@ -79,9 +79,6 @@ class Options:
|
||||
# However, they will just make sure that an authentication against
|
||||
# expected service is working. They may not result in the exact same
|
||||
# configuration as authconfig would generate.
|
||||
- Option.Feature("nis", _("NIS for user information by default")),
|
||||
- Option.Valued("nisdomain", _("<domain>"), _("default NIS domain")),
|
||||
- Option.Valued("nisserver", _("<server>"), _("default NIS server")),
|
||||
Option.Feature("ldap", _("LDAP for user information by default")),
|
||||
Option.Feature("ldapauth", _("LDAP for authentication by default")),
|
||||
Option.Valued("ldapserver", _("<server>"), _("default LDAP server hostname or URI")),
|
||||
@@ -164,6 +161,11 @@ class Options:
|
||||
Option.UnsupportedFeature("locauthorize"),
|
||||
Option.UnsupportedFeature("sysnetauth"),
|
||||
Option.UnsupportedValued("faillockargs", _("<options>")),
|
||||
+
|
||||
+ # NIS is no longer supported
|
||||
+ Option.UnsupportedFeature("nis"),
|
||||
+ Option.UnsupportedValued("nisdomain", _("<domain>")),
|
||||
+ Option.UnsupportedValued("nisserver", _("<server>")),
|
||||
]
|
||||
|
||||
Map = {
|
||||
diff --git a/src/man/authselect-migration.7.adoc b/src/man/authselect-migration.7.adoc
|
||||
index 888cd4e5a0750d4e1aa5898887f5f7fd42472741..d9777b9b473859d7ec532f39f7e14bd81c4f1b90 100644
|
||||
--- a/src/man/authselect-migration.7.adoc
|
||||
+++ b/src/man/authselect-migration.7.adoc
|
||||
@@ -72,7 +72,7 @@ configuration file for required services.
|
||||
|--enablesssd --enablesssdauth |sssd
|
||||
|--enablekrb5 |sssd
|
||||
|--enablewinbind --enablewinbindauth |winbind
|
||||
-|--enablenis |nis
|
||||
+|--enablenis |none
|
||||
|=========================================================
|
||||
|
||||
.Relation of authconfig options to authselect profile features
|
||||
--
|
||||
2.34.1
|
||||
|
||||
Loading…
Reference in new issue