Password Hashes in Audit Log
by Trevor Fong
Hi All,
I noticed the audit logs capture all details about any change in the
directory, including password hashes when an account's password is
updated. This strikes me as a security risk and I'd like to stop password
hashes from being logged, or at least have them masked.
In reading
https://www.port389.org/docs/389ds/design/audit-log-entry-attrs-design.html
I see it might be possible to configure attributes to omit from the audit
log by setting:
cn=config
nsslapd-auditlog-display-attrs: [ATTR ATTR ATTR] | *
My reading of that is that you need to either allow all ("*"), or enumerate
each and every attribute you want in the audit log; you can't say "all,
except userPassword". Would that be correct? The problem with this is
that every time we update the schema to add a new attribute type, we'll
need to remember to update this list on every machine we capture audit logs
on.
Is there perhaps some other way that I may have missed in my research?
Thanks everyone,
Trevor
4 days, 21 hours
- 2
- 1
Automatically delete "linked" objects
by Julian Kippels
Hi,
I am looking for a way to automatically delete certain objects when I
delete a user object. For example:
* I have a user uid=user1,ou=users,dc=test,dc=tld
* I have a role cn=xyz,ou=roles,dc=test,dc=tld
* This role has the following atribute:
roleOccupant: uid=user1,ou=users,dc=test,dc=tld
I would like to delete the cn=xyz-object automatically when the
uid=user1-object is deleted. Is there a way to do this server side, or
do I have to implement it client side?
Thanks
Julian
1 week, 2 days
- 2
- 1
[389-announce] Announcing 389 Directory Server 3.1.0
by James Chapman
389 Directory Server 3.1.0
The 389 Directory Server team is proud to announce 389-ds-base version 3.1.0
Fedora packages are available on Rawhide.
https://koji.fedoraproject.org/koji/taskinfo?taskID=117712920 - Koji
https://bodhi.fedoraproject.org/updates/FEDORA-2024-1ca60183aa - Bodhi
The new package and version is:
- 389-ds-base-3.1.0
Source tarballs are available for download at GitHub Releases page
<https://github.com/389ds/389-ds-base/releases>:
- https://github.com/389ds/389-ds-base/releases/tag/389-ds-base-3.1.0
Highlights in 3.1.0
- LMDB updates
- Enhancements and Bug fixes
Installation and Upgrade
See Download <https://www.port389.org/docs/389ds/download.html> for
information about setting up your yum repositories.
To install the server use *dnf install 389-ds-base*
To install the Cockpit UI plugin use *dnf install cockpit-389-ds*
After rpm install completes, run *dscreate interactive*
For upgrades, simply install the package. There are no further
steps required.
There are no upgrade steps besides installing the new rpms
See Install_Guide
<https://www.port389.org/docs/389ds/howto/howto-install-389.html> for more
information about the initial installation and setup
See Source <https://www.port389.org/docs/389ds/development/source.html> for
information about source tarballs and SCM (git) access.
Feedback
We are very interested in your feedback!
Please provide feedback and comments to the 389-users mailing list:
https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject...
If you find a bug, or would like to see a new feature, file it in our
GitHub project: https://github.com/389ds/389-ds-base
- Bump version to 3.1.0
- Issue 6142 - Fix CI tests (#6161)
- Issue 6157 - Cockipt crashes when getting replication status if
topology contains an old 389ds version (#6158)
- Issue 5105 - lmdb - Cannot create entries with long rdn - fix covscan
(#6131)
- Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root
user
- Issue 6094 - Add coverity scan workflow
- Issue 5962 - Rearrange includes for 32-bit support logic
- Issue 6046 - Make dscreate to work during kickstart installations
- Issue 6073 - Improve error log when running out of memory (#6084)
- Issue 6071 - Instance creation/removal is slow
- Issue 6010 - 389 ds ignores nsslapd-maxdescriptors (#6027)
- Issue 6075 - Ignore build artifacts (#6076)
- Issue 6068 - Add dscontainer stop function
_______________________________________________
389-announce mailing list -- 389-announce(a)lists.fedoraproject.org
To unsubscribe send an email to 389-announce-leave(a)lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/389-announce@lists.fedorapr...
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
2 weeks, 6 days
- 1
- 0
- ← Newer
- 1
- Older →