July 2018 - FreeIPA-devel - Fedora mailing-lists

[freeipa PR#2161][opened] Mark DL0 TestReplicaManageDel tests as xfail
by Rezney 17 Jul '18

17 Jul '18

URL: https://github.com/freeipa/freeipa/pull/2161 Author: Rezney Title: #2161: Mark DL0 TestReplicaManageDel tests as xfail Action: opened PR body: """ Mark failing DL0 TestReplicaManageDel tests as xfail until issue 7622 is fixed. https://pagure.io/freeipa/issue/7622 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2161/head:pr2161 git checkout pr2161

2 1

[freeipa PR#2158][opened] [Backport][ipa-4-6] Disable Pylint 2.0 violations
by tiran 17 Jul '18

17 Jul '18

URL: https://github.com/freeipa/freeipa/pull/2158 Author: tiran Title: #2158: [Backport][ipa-4-6] Disable Pylint 2.0 violations Action: opened PR body: """ This PR was opened automatically because PR #2150 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2158/head:pr2158 git checkout pr2158

1 1

[freeipa PR#2155][opened] [testing_master] Nightly PR
by freeipa-pr-ci 16 Jul '18

16 Jul '18

URL: https://github.com/freeipa/freeipa/pull/2155 Author: freeipa-pr-ci Title: #2155: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2155/head:pr2155 git checkout pr2155

1 1

[freeipa PR#2150][opened] Disable Pylint 2.0 violations
by netoarmando 16 Jul '18

16 Jul '18

URL: https://github.com/freeipa/freeipa/pull/2150 Author: netoarmando Title: #2150: Disable Pylint 2.0 violations Action: opened PR body: """ Opening this Pull Request to discuss if this violations should be ignored or addressed any other way. Specifically `bad-mcs-classmethod-argument` (C0204) seems to be caused by a bug in the current version of Pylint (2.0.0.dev2), setting `valid-metaclass-classmethod-first-arg` to its default value (`mcs`) fixed the issue. Globally disabling the following violations: - `consider-using-get` (R1715): Consider using dict.get for getting values from a dict if a key is present or a default if not Using the builtin dict.get for getting a value from a dictionary if a key is present or a default if not, is simpler and considered more idiomatic, although sometimes a bit slower - `assignment-from-no-return` (E1111): Assigning to function call which doesn't return. Used when an assignment is done on a function call but the inferred function doesn't return anything. Locally disabling the following: - `subprocess-popen-preexec-fn` (W1509): Using preexec_fn keyword which may be unsafe in the presence of threads The preexec_fn parameter is not safe to use in the presence of threads in your application. The child process could deadlock before exec is called. If you must use it, keep it trivial! Minimize the number of libraries you call into. https://docs.python.org/3/library/subprocess.html#popen-constructor - `missing-format-attribute` (W1306): Missing format attribute %r in format specifier %r Used when a PEP 3101 format string uses an attribute specifier ({0.length}), but the argument passed for formatting doesn't have that attribute. This message can't be emitted when using Python < 2.7. - `consider-using-set-comprehension` (R1718): Consider using a set comprehension Although there is nothing syntactically wrong with this code, it is hard to read and can be simplified to a set comprehension.Also it is faster since you don't need to create another transient list - `keyword-arg-before-vararg` (W1113): Keyword argument before variable positional arguments list in the definition of %s function When defining a keyword argument before variable positional arguments, one can end up in having multiple values passed for the aforementioned parameter in case the method is called with keyword arguments. - `dict-keys-not-iterating` (W1655): dict.keys referenced when not iterating Used when dict.keys is referenced in a non-iterating context (returns an iterator in Python 3) - `comprehension-escape` (W1662): Using a variable that was bound inside a comprehension Emitted when using a variable, that was bound in a comprehension handler, outside of the comprehension itself. On Python 3 these variables will be deleted outside of the comprehension. Issue: https://pagure.io/freeipa/issue/7614 Signed-off-by: Armando Neto <abiagion(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2150/head:pr2150 git checkout pr2150

2 1

[freeipa PR#2156][opened] [Backport][ipa-4-6] Fix Pylint 2.0 violations
by tiran 16 Jul '18

16 Jul '18

URL: https://github.com/freeipa/freeipa/pull/2156 Author: tiran Title: #2156: [Backport][ipa-4-6] Fix Pylint 2.0 violations Action: opened PR body: """ Manual backport of PR #2149 to 4.6 branch Fix the following violations aiming to support Pylint 2.0 - `unneeded-not` (C0113): Consider changing "not item in items" to "item not in items" used when a boolean expression contains an unneeded negation. - `useless-import-alias` (C0414): Import alias does not rename original package Used when an import alias is same as original package.e.g using import numpy as numpy instead of import numpy as np - `raising-format-tuple` (W0715): Exception arguments suggest string formatting might be intended Used when passing multiple arguments to an exception constructor, the first of them a string literal containing what appears to be placeholders intended for formatting - `bad-continuation` (C0330): This was already included on the disable list, although with current version of pylint (2.0.0.dev2) violations at the end of the files are not being ignored. See: https://github.com/PyCQA/pylint/issues/2278 - `try-except-raise` (E0705): The except handler raises immediately Used when an except handler uses raise as its first or only operator. This is useless because it raises back the exception immediately. Remove the raise operator or the entire try-except-raise block! - `consider-using-set-comprehension` (R1718): Consider using a set comprehension Although there is nothing syntactically wrong with this code, it is hard to read and can be simplified to a set comprehension.Also it is faster since you don't need to create another transient list - `dict-keys-not-iterating` (W1655): dict.keys referenced when not iterating Used when dict.keys is referenced in a non-iterating context (returns an iterator in Python 3) - `comprehension-escape` (W1662): Using a variable that was bound inside a comprehension Emitted when using a variable, that was bound in a comprehension handler, outside of the comprehension itself. On Python 3 these variables will be deleted outside of the comprehension. Issue: https://pagure.io/freeipa/issue/7614 Signed-off-by: Armando Neto <abiagion(a)redhat.com> Reviewed-By: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2156/head:pr2156 git checkout pr2156

1 1

[freeipa PR#2153][opened] Fedora 29: No longer build python2-ipaserver
by tiran 16 Jul '18

16 Jul '18

URL: https://github.com/freeipa/freeipa/pull/2153 Author: tiran Title: #2153: Fedora 29: No longer build python2-ipaserver Action: opened PR body: """ Some Python 2 dependencies such as python2-pki are no longer available on Fedora 29. The pki package is a required dependency of python2-ipaserver. It's not yet feasible to remove all Python 2 packages, since fleetcommander is not fully ported to Python 3 yet. On Fedora 29, python2-ipaserver and python2-ipatests are no longer built. The Python 3 packages replace the Python 2 packages. Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2153/head:pr2153 git checkout pr2153

1 1

[freeipa PR#2154][opened] [Backport][ipa-4-6] Teach pylint how our api works
by tiran 14 Jul '18

14 Jul '18

URL: https://github.com/freeipa/freeipa/pull/2154 Author: tiran Title: #2154: [Backport][ipa-4-6] Teach pylint how our api works Action: opened PR body: """ This PR was opened automatically because PR #2152 was pushed to master and backport to ipa-4-6 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2154/head:pr2154 git checkout pr2154

1 1

[freeipa PR#2149][opened] Fix Pylint 2.0 violations
by netoarmando 14 Jul '18

14 Jul '18

URL: https://github.com/freeipa/freeipa/pull/2149 Author: netoarmando Title: #2149: Fix Pylint 2.0 violations Action: opened PR body: """ Fix the following violations aiming to support Pylint 2.0 - `unneeded-not` (C0113): Consider changing "not item in items" to "item not in items" used when a boolean expression contains an unneeded negation. - `useless-import-alias` (C0414): Import alias does not rename original package Used when an import alias is same as original package.e.g using import numpy as numpy instead of import numpy as np - `raising-format-tuple` (W0715): Exception arguments suggest string formatting might be intended Used when passing multiple arguments to an exception constructor, the first of them a string literal containing what appears to be placeholders intended for formatting - `bad-continuation' (C0330): This was already included on the disable list, although with current version of pylint (2.0.0.dev2) violations at the end of the files are not being ignored. See: https://github.com/PyCQA/pylint/issues/2278 - `try-except-raise` (E0705): The except handler raises immediately Used when an except handler uses raise as its first or only operator. This is useless because it raises back the exception immediately. Remove the raise operator or the entire try-except-raise block! Issue: https://pagure.io/freeipa/issue/7614 Signed-off-by: Armando Neto <abiagion(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2149/head:pr2149 git checkout pr2149

2 1

[freeipa PR#2142][opened] [testing_master] Nightly PR
by freeipa-pr-ci 13 Jul '18

13 Jul '18

URL: https://github.com/freeipa/freeipa/pull/2142 Author: freeipa-pr-ci Title: #2142: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/2142/head:pr2142 git checkout pr2142

1 1

Proposal for new password syntax checking in FreeIPA
by Mark Reynolds 13 Jul '18

13 Jul '18

Hello, I've written up a basic design doc below of what I am proposing for FreeIPA. This work has already been done in 389 Directory Server, and it can be easily ported to FreeIPA (which I am volunteering to do). While there are other features we would like to add, these are the features that most customers are "asking" for today, and these are the features that we can easily "add" today. Please look it over, and share your thoughts if this design is acceptable. Thanks, Mark Enhance Password Policy Features in FreeIPA =========================================== Customers have been requesting a richer set of password policy syntax checking features. Mainly everybody wants the feature set from pam_pwquality, and one particular customer has explicitly asked for a feature to reject duplicate sequences of a particular length. Not all of the pam_pwquality features can be ported to FreeIPA because some of the features require you have the current password in clear text. The following list contains the features that need to be added (and can be added) to FreeIPA. New Feature List ---------------------------------------- - Palindrome Checks (on/off)- password can not be a palindrome. (pam_pwquality) - Sequence Checks (length) - password can not have a monotonic sequence (1234, abcd, 4321, dcba) of set length in password. (pam_pwquality) - Sequence Sets (length) - password can not have duplicate monotonic sequences of set length: ma123_123jF (customer request) - Consecutive Character Classes (length) - Password can not have consecutive characters from the same class/category greater than the length. If set to 3, then this password is invalid: azd5555_f -> there are 4 consecutive digits which exceeds the limit of 3. (pam_pwquality) - Dictionary Check (on/off) - Checks password against CrackLib. (pam_pwquality) - Outstanding SELinux issue is blocking the dictionary check from working: https://Bugzilla.redhat.com/show_bug.cgi?id=1599726et - Dictionary Path (string) - Path to custom CrackLib dictionary files. (pam_pwquality) - Bad Words (string) - space separated list of words that are not allowed to be in passwords. (pam_pwquality) - User Attributes (string) - space separated list of attributes whose values (tokens of values) are not allowed in the new password. (pam_pwquality) - This requires another setting (krbPwdMinTokenLength) that does not currently exist in FreeIPA. - Minimum number of digits (length) - (pam_pwquality) - Minimum number of alphas (length) - (pam_pwquality) - Minimum number of special characters (length) - (pam_pwquality) - Minimum number of 8-bit characters (length) - (pam_pwquality) - Minimum number of uppercase (length) - (pam_pwquality) - Minimum number of lowercase (length) - (pam_pwquality) - Maximum repeated characters (length) - (pam_pwquality) Configuration ----------------------------------------- Current FreeIPA Password Policy Configuration: dn: cn=global_policy,cn=MARKFREE.COM,cn=kerberos,dc=markfree,dc=com objectClass: top objectClass: nsContainer objectClass: krbPwdPolicy krbMinPwdLife: 3600 krbPwdMinDiffChars: 0 krbPwdMinLength: 8 krbPwdHistoryLength: 0 krbMaxPwdLife: 7776000 krbPwdMaxFailure: 6 krbPwdFailureCountInterval: 60 krbPwdLockoutDuration: 600 cn: global_policy New Attributes to add to objectclass "krbPwdPolicy": krbPwdPalindrome: on krbPwdMaxSequence: 4 krbPwdMaxSeqSets: 2 krbPwdMaxCharClass: 3 krbPwdMinDigits: 1 krbPwdMinAlphas: 1 krbPwdMinSpecial: 1 krbPwdMin8bit: 0 krbPwdMinUppers: 1 krbPwdMinLowers: 1 krbPwdMaxRepeated: 3 krbPwdDictCheck: on krbPwdDictPath: /path/to/custom/cracklib/dict/files krbPwdBadWords: redhat fedora krbPwdUserAttrs: uid cn sn givenname mail krbPwdMinTokenLength: 3 **works only with "krbPwdUserAttrs". Example: if any 3 consecutive characters from "uid" (and friends) are in the new password then it is rejected Implementation ------------------------------------------- Dictionary Checks require linking with CrackLib as follows: diff --git a/freeipa.spec.in b/freeipa.spec.in index 0ebc6df3e..ba573a00f 100755 --- a/freeipa.spec.in +++ b/freeipa.spec.in @@ -148,6 +148,7 @@ BuildRequires: libini_config-devel BuildRequires: cyrus-sasl-devel %if ! %{ONLY_CLIENT} BuildRequires: 389-ds-base-devel >= %{ds_version} +BuildRequires: cracklib-devel diff --git a/util/Makefile.am b/util/Makefile.am index be40e8699..5c24be2b9 100644 --- a/util/Makefile.am +++ b/util/Makefile.am @@ -14,3 +14,4 @@ libutil_la_SOURCES = ipa_krb5.c \ ipa_pwd_ntlm.c libutil_la_LIBADD = $(CRYPTO_LIBS) $(KRB5_LIBS) $(LDAP_LIBS) $(NSS_LIBS) +libutil_la_LDFLAGS = -lcrack pam_pwquality is open sourced and has been ported to 389 Directory Server. The changes in 389 DS can basically be copied and pasted into FreeIPA source (around ipapwd_CheckPolicy() in daemons/ipa-slapi-plugins/ipa-pwd-extop/common.c). The major change here is that we need to provide the Slapi_Entry to ipapwd_CheckPolicy() so you can check its attributes/values for the "User Attribute" comparison feature (I've actually already coded this in a beta patch).

2 10

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel July 2018