389-users May 2024

389-users@lists.fedoraproject.org

5 participants
3 discussions

Password Hashes in Audit Log
by Trevor Fong 31 May '24

31 May '24

Hi All, I noticed the audit logs capture all details about any change in the directory, including password hashes when an account's password is updated. This strikes me as a security risk and I'd like to stop password hashes from being logged, or at least have them masked. In reading https://www.port389.org/docs/389ds/design/audit-log-entry-attrs-design.html I see it might be possible to configure attributes to omit from the audit log by setting: cn=config nsslapd-auditlog-display-attrs: [ATTR ATTR ATTR] | * My reading of that is that you need to either allow all ("*"), or enumerate each and every attribute you want in the audit log; you can't say "all, except userPassword". Would that be correct? The problem with this is that every time we update the schema to add a new attribute type, we'll need to remember to update this list on every machine we capture audit logs on. Is there perhaps some other way that I may have missed in my research? Thanks everyone, Trevor

2 1

Automatically delete "linked" objects
by Julian Kippels 27 May '24

27 May '24

Hi, I am looking for a way to automatically delete certain objects when I delete a user object. For example: * I have a user uid=user1,ou=users,dc=test,dc=tld * I have a role cn=xyz,ou=roles,dc=test,dc=tld * This role has the following atribute: roleOccupant: uid=user1,ou=users,dc=test,dc=tld I would like to delete the cn=xyz-object automatically when the uid=user1-object is deleted. Is there a way to do this server side, or do I have to implement it client side? Thanks Julian

2 1

[389-announce] Announcing 389 Directory Server 3.1.0
by James Chapman 15 May '24

15 May '24

389 Directory Server 3.1.0 The 389 Directory Server team is proud to announce 389-ds-base version 3.1.0 Fedora packages are available on Rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=117712920 - Koji https://bodhi.fedoraproject.org/updates/FEDORA-2024-1ca60183aa - Bodhi The new package and version is: - 389-ds-base-3.1.0 Source tarballs are available for download at GitHub Releases page <https://github.com/389ds/389-ds-base/releases>: - https://github.com/389ds/389-ds-base/releases/tag/389-ds-base-3.1.0 Highlights in 3.1.0 - LMDB updates - Enhancements and Bug fixes Installation and Upgrade See Download <https://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install the server use *dnf install 389-ds-base* To install the Cockpit UI plugin use *dnf install cockpit-389-ds* After rpm install completes, run *dscreate interactive* For upgrades, simply install the package. There are no further steps required. There are no upgrade steps besides installing the new rpms See Install_Guide <https://www.port389.org/docs/389ds/howto/howto-install-389.html> for more information about the initial installation and setup See Source <https://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… If you find a bug, or would like to see a new feature, file it in our GitHub project: https://github.com/389ds/389-ds-base - Bump version to 3.1.0 - Issue 6142 - Fix CI tests (#6161) - Issue 6157 - Cockipt crashes when getting replication status if topology contains an old 389ds version (#6158) - Issue 5105 - lmdb - Cannot create entries with long rdn - fix covscan (#6131) - Issue 6086 - Ambiguous warning about SELinux in dscreate for non-root user - Issue 6094 - Add coverity scan workflow - Issue 5962 - Rearrange includes for 32-bit support logic - Issue 6046 - Make dscreate to work during kickstart installations - Issue 6073 - Improve error log when running out of memory (#6084) - Issue 6071 - Instance creation/removal is slow - Issue 6010 - 389 ds ignores nsslapd-maxdescriptors (#6027) - Issue 6075 - Ignore build artifacts (#6076) - Issue 6068 - Add dscontainer stop function _______________________________________________ 389-announce mailing list -- 389-announce(a)lists.fedoraproject.org To unsubscribe send an email to 389-announce-leave(a)lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/389-announce@lists.fedoraproj… Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users May 2024