meta-starlingx/meta-stx-integ/recipes-support/openldap/files/0021-openldap-and-stx-source-and-config-files.patch

   1 From 2adc9fa71e3a47542793e61c7794629fa9255a57 Mon Sep 17 00:00:00 2001
   2 From: babak sarashki <babak.sarashki@windriver.com>
   3 Date: Tue, 5 Nov 2019 14:49:06 -0800
   4 Subject: [PATCH] openldap and stx source and config files
   5
   6 From stx 1901 openldap-2.4.44-21.el7_6.src.rpm
   7 ---
   8  stx-sources/ldap.conf                        |  18 +++
   9  stx-sources/libexec-check-config.sh          |  91 ++++++++++++
  10  stx-sources/libexec-convert-config.sh        |  79 ++++++++++
  11  stx-sources/libexec-create-certdb.sh         |  70 +++++++++
  12  stx-sources/libexec-functions                | 136 +++++++++++++++++
  13  stx-sources/libexec-generate-server-cert.sh  | 118 +++++++++++++++
  14  stx-sources/libexec-update-ppolicy-schema.sh | 142 ++++++++++++++++++
  15  stx-sources/libexec-upgrade-db.sh            |  40 +++++
  16  stx-sources/openldap.tmpfiles                |   3 +
  17  stx-sources/slapd.ldif                       | 148 +++++++++++++++++++
  18  stx-sources/slapd.service                    |  19 +++
  19  stx-sources/slapd.sysconfig                  |  15 ++
  20  stx-sources/slapd.tmpfiles                   |   2 +
  21  13 files changed, 881 insertions(+)
  22  create mode 100644 stx-sources/ldap.conf
  23  create mode 100755 stx-sources/libexec-check-config.sh
  24  create mode 100755 stx-sources/libexec-convert-config.sh
  25  create mode 100755 stx-sources/libexec-create-certdb.sh
  26  create mode 100644 stx-sources/libexec-functions
  27  create mode 100755 stx-sources/libexec-generate-server-cert.sh
  28  create mode 100755 stx-sources/libexec-update-ppolicy-schema.sh
  29  create mode 100755 stx-sources/libexec-upgrade-db.sh
  30  create mode 100644 stx-sources/openldap.tmpfiles
  31  create mode 100644 stx-sources/slapd.ldif
  32  create mode 100644 stx-sources/slapd.service
  33  create mode 100644 stx-sources/slapd.sysconfig
  34  create mode 100644 stx-sources/slapd.tmpfiles
  35
  36 diff --git a/stx-sources/ldap.conf b/stx-sources/ldap.conf
  37 new file mode 100644
  38 index 0000000..aa6f8fd
  39 --- /dev/null
  40 +++ b/stx-sources/ldap.conf
  41 @@ -0,0 +1,18 @@
  42 +#
  43 +# LDAP Defaults
  44 +#
  45 +
  46 +# See ldap.conf(5) for details
  47 +# This file should be world readable but not world writable.
  48 +
  49 +#BASE  dc=example,dc=com
  50 +#URI   ldap://ldap.example.com ldap://ldap-master.example.com:666
  51 +
  52 +#SIZELIMIT     12
  53 +#TIMELIMIT     15
  54 +#DEREF         never
  55 +
  56 +TLS_CACERTDIR  /etc/openldap/certs
  57 +
  58 +# Turning this off breaks GSSAPI used with krb5 when rdns = false
  59 +SASL_NOCANON   on
  60 diff --git a/stx-sources/libexec-check-config.sh b/stx-sources/libexec-check-config.sh
  61 new file mode 100755
  62 index 0000000..87e377f
  63 --- /dev/null
  64 +++ b/stx-sources/libexec-check-config.sh
  65 @@ -0,0 +1,91 @@
  66 +#!/bin/sh
  67 +# Author: Jan Vcelak <jvcelak@redhat.com>
  68 +
  69 +. /usr/libexec/openldap/functions
  70 +
  71 +function check_config_syntax()
  72 +{
  73 +       retcode=0
  74 +       tmp_slaptest=`mktemp --tmpdir=/var/run/openldap`
  75 +       run_as_ldap "/usr/sbin/slaptest $SLAPD_GLOBAL_OPTIONS -u" &>$tmp_slaptest
  76 +       if [ $? -ne 0 ]; then
  77 +               error "Checking configuration file failed:"
  78 +               cat $tmp_slaptest >&2
  79 +               retcode=1
  80 +       fi
  81 +       rm $tmp_slaptest
  82 +       return $retcode
  83 +}
  84 +
  85 +function check_certs_perms()
  86 +{
  87 +       retcode=0
  88 +       for cert in `certificates`; do
  89 +               run_as_ldap "/usr/bin/test -e \"$cert\""
  90 +               if [ $? -ne 0 ]; then
  91 +                       error "TLS certificate/key/DB '%s' was not found." "$cert"
  92 +                       retcoder=1
  93 +                       continue
  94 +               fi
  95 +               run_as_ldap "/usr/bin/test -r \"$cert\""
  96 +               if [ $? -ne 0 ]; then
  97 +                       error "TLS certificate/key/DB '%s' is not readable." "$cert"
  98 +                       retcode=1
  99 +               fi
 100 +       done
 101 +       return $retcode
 102 +}
 103 +
 104 +function check_db_perms()
 105 +{
 106 +       retcode=0
 107 +       for dbdir in `databases`; do
 108 +               [ -d "$dbdir" ] || continue
 109 +               for dbfile in `find ${dbdir} -maxdepth 1 -name "*.dbb" -or -name "*.gdbm" -or -name "*.bdb" -or -name "__db.*" -or -name "log.*" -or -name "alock"`; do
 110 +                       run_as_ldap "/usr/bin/test -r \"$dbfile\" -a -w \"$dbfile\""
 111 +                       if [ $? -ne 0 ]; then
 112 +                               error "Read/write permissions for DB file '%s' are required." "$dbfile"
 113 +                               retcode=1
 114 +                       fi
 115 +               done
 116 +       done
 117 +       return $retcode
 118 +}
 119 +
 120 +function check_everything()
 121 +{
 122 +       retcode=0
 123 +       check_config_syntax || retcode=1
 124 +       # TODO: need support for Mozilla NSS, disabling temporarily
 125 +       #check_certs_perms || retcode=1
 126 +       check_db_perms || retcode=1
 127 +       return $retcode
 128 +}
 129 +
 130 +if [ `id -u` -ne 0 ]; then
 131 +       error "You have to be root to run this script."
 132 +       exit 4
 133 +fi
 134 +
 135 +load_sysconfig
 136 +
 137 +if [ -n "$SLAPD_CONFIG_DIR" ]; then
 138 +       if [ ! -d "$SLAPD_CONFIG_DIR" ]; then
 139 +               error "Configuration directory '%s' does not exist." "$SLAPD_CONFIG_DIR"
 140 +       else
 141 +               check_everything
 142 +               exit $?
 143 +       fi
 144 +fi
 145 +
 146 +if [ -n "$SLAPD_CONFIG_FILE" ]; then
 147 +       if [ ! -f "$SLAPD_CONFIG_FILE" ]; then
 148 +               error "Configuration file '%s' does not exist." "$SLAPD_CONFIG_FILE"
 149 +       else
 150 +               error "Warning: Usage of a configuration file is obsolete!"
 151 +               check_everything
 152 +               exit $?
 153 +       fi
 154 +fi
 155 +
 156 +exit 1
 157 diff --git a/stx-sources/libexec-convert-config.sh b/stx-sources/libexec-convert-config.sh
 158 new file mode 100755
 159 index 0000000..824c3b1
 160 --- /dev/null
 161 +++ b/stx-sources/libexec-convert-config.sh
 162 @@ -0,0 +1,79 @@
 163 +#!/bin/sh
 164 +# Author: Jan Vcelak <jvcelak@redhat.com>
 165 +
 166 +. /usr/libexec/openldap/functions
 167 +
 168 +function help()
 169 +{
 170 +       error "usage: %s [-f config-file] [-F config-dir]\n" "`basename $0`"
 171 +       exit 2
 172 +}
 173 +
 174 +load_sysconfig
 175 +
 176 +while getopts :f:F: opt; do
 177 +       case "$opt" in
 178 +       f)
 179 +               SLAPD_CONFIG_FILE="$OPTARG"
 180 +               ;;
 181 +       F)
 182 +               SLAPD_CONFIG_DIR="$OPTARG"
 183 +               ;;
 184 +       *)
 185 +               help
 186 +               ;;
 187 +       esac
 188 +done
 189 +shift $((OPTIND-1))
 190 +[ -n "$1" ] && help
 191 +
 192 +# check source, target
 193 +
 194 +if [ ! -f "$SLAPD_CONFIG_FILE" ]; then
 195 +       error "Source configuration file '%s' not found." "$SLAPD_CONFIG_FILE"
 196 +       exit 1
 197 +fi
 198 +
 199 +if grep -iq '^dn: cn=config$' "$SLAPD_CONFIG_FILE"; then
 200 +       SLAPD_CONFIG_FILE_FORMAT=ldif
 201 +else
 202 +       SLAPD_CONFIG_FILE_FORMAT=conf
 203 +fi
 204 +
 205 +if [ -d "$SLAPD_CONFIG_DIR" ]; then
 206 +       if [ `find "$SLAPD_CONFIG_DIR" -maxdepth 0 -empty | wc -l` -eq 0 ]; then
 207 +               error "Target configuration directory '%s' is not empty." "$SLAPD_CONFIG_DIR"
 208 +               exit 1
 209 +       fi
 210 +fi
 211 +
 212 +# perform the conversion
 213 +
 214 +tmp_convert=`mktemp --tmpdir=/var/run/openldap`
 215 +
 216 +if [ `id -u` -eq 0 ]; then
 217 +       install -d --owner $SLAPD_USER --group `id -g $SLAPD_USER` --mode 0750 "$SLAPD_CONFIG_DIR" &>>$tmp_convert
 218 +       if [ $SLAPD_CONFIG_FILE_FORMAT = ldif ]; then
 219 +               run_as_ldap "/usr/sbin/slapadd -F \"$SLAPD_CONFIG_DIR\" -n 0 -l \"$SLAPD_CONFIG_FILE\"" &>>$tmp_convert
 220 +       else
 221 +               run_as_ldap "/usr/sbin/slaptest -f \"$SLAPD_CONFIG_FILE\" -F \"$SLAPD_CONFIG_DIR\"" &>>$tmp_convert
 222 +       fi
 223 +       retcode=$?
 224 +else
 225 +       error "You are not root! Permission will not be set."
 226 +       install -d --mode 0750 "$SLAPD_CONFIG_DIR" &>>$tmp_convert
 227 +       if [ $SLAPD_CONFIG_FILE_FORMAT = ldif ]; then
 228 +               /usr/sbin/slapadd -F "$SLAPD_CONFIG_DIR" -n 0 -l "$SLAPD_CONFIG_FILE" &>>$tmp_convert
 229 +       else
 230 +               /usr/sbin/slaptest -f "$SLAPD_CONFIG_FILE" -F "$SLAPD_CONFIG_DIR" &>>$tmp_convert
 231 +       fi
 232 +       retcode=$?
 233 +fi
 234 +
 235 +if [ $retcode -ne 0 ]; then
 236 +       error "Configuration conversion failed:"
 237 +       cat $tmp_convert >&2
 238 +fi
 239 +
 240 +rm $tmp_convert
 241 +exit $retcode
 242 diff --git a/stx-sources/libexec-create-certdb.sh b/stx-sources/libexec-create-certdb.sh
 243 new file mode 100755
 244 index 0000000..2377fdd
 245 --- /dev/null
 246 +++ b/stx-sources/libexec-create-certdb.sh
 247 @@ -0,0 +1,70 @@
 248 +#!/bin/bash
 249 +# Author: Jan Vcelak <jvcelak@redhat.com>
 250 +
 251 +set -e
 252 +
 253 +# default options
 254 +
 255 +CERTDB_DIR=/etc/openldap/certs
 256 +
 257 +# internals
 258 +
 259 +MODULE_CKBI="$(rpm --eval %{_libdir})/libnssckbi.so"
 260 +RANDOM_SOURCE=/dev/urandom
 261 +PASSWORD_BYTES=32
 262 +
 263 +# parse arguments
 264 +
 265 +usage() {
 266 +       printf "usage: create-certdb.sh [-d certdb]\n" >&2
 267 +       exit 1
 268 +}
 269 +
 270 +while getopts "d:" opt; do
 271 +       case "$opt" in
 272 +       d)
 273 +               CERTDB_DIR="$OPTARG"
 274 +               ;;
 275 +       \?)
 276 +               usage
 277 +               ;;
 278 +       esac
 279 +done
 280 +
 281 +[ "$OPTIND" -le "$#" ] && usage
 282 +
 283 +# verify target location
 284 +
 285 +if [ ! -d "$CERTDB_DIR" ]; then
 286 +       printf "Directory '%s' does not exist.\n" "$CERTDB_DIR" >&2
 287 +       exit 1
 288 +fi
 289 +
 290 +if [ ! "$(find "$CERTDB_DIR"  -maxdepth 0 -empty | wc -l)" -eq 1 ]; then
 291 +       printf "Directory '%s' is not empty.\n" "$CERTDB_DIR" >&2
 292 +       exit 1
 293 +fi
 294 +
 295 +# create the database
 296 +
 297 +printf "Creating certificate database in '%s'.\n" "$CERTDB_DIR" >&2
 298 +
 299 +PASSWORD_FILE="$CERTDB_DIR/password"
 300 +OLD_UMASK="$(umask)"
 301 +umask 0377
 302 +dd if=$RANDOM_SOURCE bs=$PASSWORD_BYTES count=1 2>/dev/null | base64 > "$PASSWORD_FILE"
 303 +umask "$OLD_UMASK"
 304 +
 305 +certutil -d "$CERTDB_DIR" -N -f "$PASSWORD_FILE" &>/dev/null
 306 +
 307 +# load module with builtin CA certificates
 308 +
 309 +echo | modutil -dbdir "$CERTDB_DIR" -add "Root Certs" -libfile "$MODULE_CKBI" &>/dev/null
 310 +
 311 +# tune permissions
 312 +
 313 +for dbfile in "$CERTDB_DIR"/*.db; do
 314 +       chmod 0644 "$dbfile"
 315 +done
 316 +
 317 +exit 0
 318 diff --git a/stx-sources/libexec-functions b/stx-sources/libexec-functions
 319 new file mode 100644
 320 index 0000000..98c8631
 321 --- /dev/null
 322 +++ b/stx-sources/libexec-functions
 323 @@ -0,0 +1,136 @@
 324 +# Author: Jan Vcelak <jvcelak@redhat.com>
 325 +
 326 +SLAPD_USER=
 327 +SLAPD_CONFIG_FILE=
 328 +SLAPD_CONFIG_DIR=
 329 +SLAPD_CONFIG_CUSTOM=
 330 +SLAPD_GLOBAL_OPTIONS=
 331 +SLAPD_SYSCONFIG_FILE=
 332 +
 333 +function default_config()
 334 +{
 335 +       SLAPD_USER=ldap
 336 +       SLAPD_CONFIG_FILE=/etc/openldap/slapd.conf
 337 +       SLAPD_CONFIG_DIR=/etc/openldap/slapd.d
 338 +       SLAPD_CONFIG_CUSTOM=
 339 +       SLAPD_GLOBAL_OPTIONS=
 340 +       SLAPD_SYSCONFIG_FILE=/etc/sysconfig/slapd
 341 +}
 342 +
 343 +function parse_config_options()
 344 +{
 345 +       user=
 346 +       config_file=
 347 +       config_dir=
 348 +       while getopts :u:f:F: opt; do
 349 +               case "$opt" in
 350 +               u)
 351 +                       user="$OPTARG"
 352 +                       ;;
 353 +               f)
 354 +                       config_file="$OPTARG"
 355 +                       ;;
 356 +               F)
 357 +                       config_dir="$OPTARG"
 358 +                       ;;
 359 +               esac
 360 +       done
 361 +
 362 +       unset OPTIND
 363 +
 364 +       if [ -n "$user" ]; then
 365 +               SLAPD_USER="$user"
 366 +       fi
 367 +
 368 +       if [ -n "$config_dir" ]; then
 369 +               SLAPD_CONFIG_DIR="$config_dir"
 370 +               SLAPD_CONFIG_FILE=
 371 +               SLAPD_CONFIG_CUSTOM=1
 372 +               SLAPD_GLOBAL_OPTIONS="-F '$config_dir'"
 373 +       elif [ -n "$config_file" ]; then
 374 +               SLAPD_CONFIG_DIR=
 375 +               SLAPD_CONFIG_FILE="$config_file"
 376 +               SLAPD_CONFIG_CUSTOM=1
 377 +               SLAPD_GLOBAL_OPTIONS="-f '$config_file'"
 378 +       fi
 379 +}
 380 +
 381 +function uses_new_config()
 382 +{
 383 +       [ -n "$SLAPD_CONFIG_DIR" ]
 384 +       return $?
 385 +}
 386 +
 387 +function run_as_ldap()
 388 +{
 389 +       /sbin/runuser --shell /bin/sh --session-command "$1" "$SLAPD_USER"
 390 +       return $?
 391 +}
 392 +
 393 +function ldif_unbreak()
 394 +{
 395 +       sed ':a;N;s/\n //;ta;P;D'
 396 +}
 397 +
 398 +function ldif_value()
 399 +{
 400 +       sed 's/^[^:]*: //'
 401 +}
 402 +
 403 +function databases_new()
 404 +{
 405 +       slapcat $SLAPD_GLOBAL_OPTIONS -c \
 406 +       -H 'ldap:///cn=config???(|(objectClass=olcBdbConfig)(objectClass=olcHdbConfig))' 2>/dev/null | \
 407 +               ldif_unbreak | \
 408 +               grep '^olcDbDirectory: ' | \
 409 +               ldif_value
 410 +}
 411 +
 412 +function databases_old()
 413 +{
 414 +       awk     'begin { database="" }
 415 +               $1 == "database" { database=$2 }
 416 +               $1 == "directory" { if (database == "bdb" || database == "hdb") print $2}' \
 417 +               "$SLAPD_CONFIG_FILE"
 418 +}
 419 +
 420 +function certificates_new()
 421 +{
 422 +       slapcat $SLAPD_GLOBAL_OPTIONS -c -H 'ldap:///cn=config???(cn=config)' 2>/dev/null | \
 423 +               ldif_unbreak | \
 424 +               grep '^olcTLS\(CACertificateFile\|CACertificatePath\|CertificateFile\|CertificateKeyFile\): ' | \
 425 +               ldif_value
 426 +}
 427 +
 428 +function certificates_old()
 429 +{
 430 +       awk '$1 ~ "^TLS(CACertificate(File|Path)|CertificateFile|CertificateKeyFile)$" { print $2 } ' \
 431 +               "$SLAPD_CONFIG_FILE"
 432 +}
 433 +
 434 +function certificates()
 435 +{
 436 +       uses_new_config && certificates_new || certificates_old
 437 +}
 438 +
 439 +function databases()
 440 +{
 441 +       uses_new_config && databases_new || databases_old
 442 +}
 443 +
 444 +
 445 +function error()
 446 +{
 447 +       format="$1\n"; shift
 448 +       printf "$format" $@ >&2
 449 +}
 450 +
 451 +function load_sysconfig()
 452 +{
 453 +       [ -r "$SLAPD_SYSCONFIG_FILE" ] || return
 454 +
 455 +       . "$SLAPD_SYSCONFIG_FILE"
 456 +       [ -n "$SLAPD_OPTIONS" ] && parse_config_options $SLAPD_OPTIONS
 457 +}
 458 +
 459 +default_config
 460 diff --git a/stx-sources/libexec-generate-server-cert.sh b/stx-sources/libexec-generate-server-cert.sh
 461 new file mode 100755
 462 index 0000000..e2f4974
 463 --- /dev/null
 464 +++ b/stx-sources/libexec-generate-server-cert.sh
 465 @@ -0,0 +1,118 @@
 466 +#!/bin/bash
 467 +# Author: Jan Vcelak <jvcelak@redhat.com>
 468 +
 469 +set -e
 470 +
 471 +# default options
 472 +
 473 +CERTDB_DIR=/etc/openldap/certs
 474 +CERT_NAME="OpenLDAP Server"
 475 +PASSWORD_FILE=
 476 +HOSTNAME_FQDN="$(hostname --fqdn)"
 477 +ALT_NAMES=
 478 +ONCE=0
 479 +
 480 +# internals
 481 +
 482 +RANDOM_SOURCE=/dev/urandom
 483 +CERT_RANDOM_BYTES=256
 484 +CERT_KEY_TYPE=rsa
 485 +CERT_KEY_SIZE=1024
 486 +CERT_VALID_MONTHS=12
 487 +
 488 +# parse arguments
 489 +
 490 +usage() {
 491 +       printf "usage: generate-server-cert.sh [-d certdb-dir] [-n cert-name]\n" >&2
 492 +       printf "                               [-p password-file] [-h hostnames]\n" >&2
 493 +       printf "                               [-a dns-alt-names] [-o]\n" >&2
 494 +       exit 1
 495 +}
 496 +
 497 +while getopts "d:n:p:h:a:o" opt; do
 498 +       case "$opt" in
 499 +       d)
 500 +               CERTDB_DIR="$OPTARG"
 501 +               ;;
 502 +       n)
 503 +               CERT_NAME="$OPTARG"
 504 +               ;;
 505 +       p)
 506 +               PASSWORD_FILE="$OPTARG"
 507 +               ;;
 508 +       h)
 509 +               HOSTNAME_FQDN="$OPTARG"
 510 +               ;;
 511 +       a)
 512 +               ALT_NAMES="$OPTARG"
 513 +               ;;
 514 +       o)
 515 +               ONCE=1
 516 +               ;;
 517 +       \?)
 518 +               usage
 519 +               ;;
 520 +       esac
 521 +done
 522 +
 523 +[ "$OPTIND" -le "$#" ] && usage
 524 +
 525 +# generated options
 526 +
 527 +ONCE_FILE="$CERTDB_DIR/.slapd-leave"
 528 +PASSWORD_FILE="${PASSWORD_FILE:-${CERTDB_DIR}/password}"
 529 +ALT_NAMES="${ALT_NAMES:-${HOSTNAME_FQDN},localhost,localhost.localdomain}"
 530 +
 531 +# verify target location
 532 +
 533 +if [ "$ONCE" -eq 1 -a -f "$ONCE_FILE" ]; then
 534 +       printf "Skipping certificate generating, '%s' exists.\n" "$ONCE_FILE" >&2
 535 +       exit 0
 536 +fi
 537 +
 538 +if ! certutil -d "$CERTDB_DIR" -U &>/dev/null; then
 539 +       printf "Directory '%s' is not a valid certificate database.\n" "$CERTDB_DIR" >&2
 540 +       exit 1
 541 +fi
 542 +
 543 +printf "Creating new server certificate in '%s'.\n" "$CERTDB_DIR" >&2
 544 +
 545 +if [ ! -r "$PASSWORD_FILE" ]; then
 546 +       printf "Password file '%s' is not readable.\n" "$PASSWORD_FILE" >&2
 547 +       exit 1
 548 +fi
 549 +
 550 +if certutil -d "$CERTDB_DIR" -L -a -n "$CERT_NAME" &>/dev/null; then
 551 +       printf "Certificate '%s' already exists in the certificate database.\n" "$CERT_NAME" >&2
 552 +       exit 1
 553 +fi
 554 +
 555 +# generate server certificate (self signed)
 556 +
 557 +
 558 +CERT_RANDOM=$(mktemp --tmpdir=/var/run/openldap)
 559 +dd if=$RANDOM_SOURCE bs=$CERT_RANDOM_BYTES count=1 of=$CERT_RANDOM &>/dev/null
 560 +
 561 +certutil -d "$CERTDB_DIR" -f "$PASSWORD_FILE" -z "$CERT_RANDOM" \
 562 +       -S -x -n "$CERT_NAME" \
 563 +       -s "CN=$HOSTNAME_FQDN" \
 564 +       -t TC,, \
 565 +       -k $CERT_KEY_TYPE -g $CERT_KEY_SIZE \
 566 +       -v $CERT_VALID_MONTHS \
 567 +       -8 "$ALT_NAMES" \
 568 +       &>/dev/null
 569 +
 570 +rm -f $CERT_RANDOM
 571 +
 572 +# tune permissions
 573 +
 574 +if [ "$(id -u)" -eq 0 ]; then
 575 +       chgrp ldap "$PASSWORD_FILE"
 576 +       chmod g+r "$PASSWORD_FILE"
 577 +else
 578 +       printf "WARNING: The server requires read permissions on the password file in order to\n" >&2
 579 +       printf "         load it's private key from the certificate database.\n" >&2
 580 +fi
 581 +
 582 +touch "$ONCE_FILE"
 583 +exit 0
 584 diff --git a/stx-sources/libexec-update-ppolicy-schema.sh b/stx-sources/libexec-update-ppolicy-schema.sh
 585 new file mode 100755
 586 index 0000000..a853b27
 587 --- /dev/null
 588 +++ b/stx-sources/libexec-update-ppolicy-schema.sh
 589 @@ -0,0 +1,142 @@
 590 +#!/bin/bash
 591 +# This script serves one purpose, to add a possibly missing attribute
 592 +# to a ppolicy schema in a dynamic configuration of OpenLDAP. This
 593 +# attribute was introduced in openldap-2.4.43 and slapd will not
 594 +# start without it later on.
 595 +#
 596 +# The script tries to update in a directory given as first parameter,
 597 +# or in /etc/openldap/slapd.d implicitly.
 598 +#
 599 +# Author: Matus Honek <mhonek@redhat.com>
 600 +# Bugzilla: #1487857
 601 +
 602 +function log {
 603 +    echo "Update dynamic configuration: " $@
 604 +    true
 605 +}
 606 +
 607 +function iferr {
 608 +    if [ $? -ne 0 ]; then
 609 +       log "ERROR: " $@
 610 +       true
 611 +    else
 612 +       false
 613 +    fi
 614 +}
 615 +
 616 +function update {
 617 +    set -u
 618 +    shopt -s extglob
 619 +
 620 +    ORIGINAL="${1:-/etc/openldap/slapd.d}"
 621 +    ORIGINAL="${ORIGINAL%*(/)}"
 622 +
 623 +    ### check if necessary
 624 +    grep -r "pwdMaxRecordedFail" "${ORIGINAL}/cn=config/cn=schema" >/dev/null
 625 +    [ $? -eq 0 ] && log "Schemas look up to date. Ok. Quitting." && return 0
 626 +
 627 +    ### prep
 628 +    log "Prepare environment."
 629 +
 630 +    TEMPDIR=$(mktemp -d)
 631 +    iferr "Could not create a temporary directory. Quitting." && return 1
 632 +    DBDIR="${TEMPDIR}/db"
 633 +    SUBDBDIR="${DBDIR}/cn=temporary"
 634 +
 635 +    mkdir "${DBDIR}"
 636 +    iferr "Could not create temporary configuration directory. Quitting." && return 1
 637 +    cp -r --no-target-directory "${ORIGINAL}" "${SUBDBDIR}"
 638 +    iferr "Could not copy configuration. Quitting." && return 1
 639 +
 640 +    pushd "$TEMPDIR" >/dev/null
 641 +
 642 +    cat > temp.conf <<EOF
 643 +database ldif
 644 +suffix cn=temporary
 645 +directory db
 646 +access to * by * manage
 647 +EOF
 648 +
 649 +    SOCKET="$(pwd)/socket"
 650 +    LISTENER="ldapi://${SOCKET//\//%2F}"
 651 +    CONN_PARAMS=("-Y" "EXTERNAL" "-H" "${LISTENER}")
 652 +
 653 +    slapd -f temp.conf -h "$LISTENER" -d 0 >/dev/null 2>&1 &
 654 +    SLAPDPID="$!"
 655 +    sleep 2
 656 +
 657 +    ldapadd ${CONN_PARAMS[@]} -d 0 >/dev/null 2>&1 <<EOF
 658 +dn: cn=temporary
 659 +objectClass: olcGlobal
 660 +cn: temporary
 661 +EOF
 662 +    iferr "Could not populate the temporary database. Quitting." && return 1
 663 +
 664 +    ### update
 665 +    log "Update with new pwdMaxRecordedFailure attribute."
 666 +    FILTER="(&"
 667 +    FILTER+="(olcObjectClasses=*'pwdPolicy'*)"
 668 +    FILTER+="(!(olcObjectClasses=*'pwdPolicy'*'pwdMaxRecordedFailure'*))"
 669 +    FILTER+="(!(olcAttributeTypes=*'pwdMaxRecordedFailure'*))"
 670 +    FILTER+=")"
 671 +    RES=$(ldapsearch ${CONN_PARAMS[@]} \
 672 +                    -b cn=schema,cn=config,cn=temporary \
 673 +                    -LLL \
 674 +                    -o ldif-wrap=no \
 675 +                    "$FILTER" \
 676 +                    dn olcObjectClasses \
 677 +                    2>/dev/null \
 678 +             | sed '/^$/d')
 679 +    DN=$(printf "$RES" | grep '^dn:')
 680 +    OC=$(printf "$RES" | grep "^olcObjectClasses:.*'pwdPolicy'")
 681 +    NEWOC="${OC//$ pwdSafeModify /$ pwdSafeModify $ pwdMaxRecordedFailure }"
 682 +
 683 +    test $(echo "$DN" | wc -l) = 1
 684 +    iferr "Received more than one DN. Cannot continue. Quitting." && return 1
 685 +    test "$NEWOC" != "$OC"
 686 +    iferr "Updating pwdPolicy objectClass definition failed. Quitting." && return 1
 687 +
 688 +    ldapmodify ${CONN_PARAMS[@]} -d 0 >/dev/null 2>&1 <<EOF
 689 +$DN
 690 +changetype: modify
 691 +add: olcAttributeTypes
 692 +olcAttributeTypes: ( 1.3.6.1.4.1.42.2.27.8.1.30 NAME 'pwdMaxRecordedFailur
 693 + e' EQUALITY integerMatch ORDERING integerOrderingMatch  SYNTAX 1.3.6.1.4.1.
 694 + 1466.115.121.1.27 SINGLE-VALUE )
 695 +-
 696 +delete: olcObjectClasses
 697 +$OC
 698 +-
 699 +add: olcObjectClasses
 700 +$NEWOC
 701 +EOF
 702 +    iferr "Updating with new attribute failed. Quitting." && return 1
 703 +
 704 +    popd >/dev/null
 705 +
 706 +    ### apply
 707 +    log "Apply changes."
 708 +    cp -r --no-target-directory "$ORIGINAL" "$ORIGINAL~backup"
 709 +    iferr "Backing up old configuration failed. Quitting." && return 1
 710 +    cp -r --no-target-directory "$SUBDBDIR" "$ORIGINAL"
 711 +    iferr "Applying new configuration failed. Quitting." && return 1
 712 +
 713 +    ### clean up
 714 +    log "Clean up."
 715 +    kill "$SLAPDPID"
 716 +    SLAPDPID=
 717 +    rm -rf "$TEMPDIR"
 718 +    TEMPDIR=
 719 +}
 720 +
 721 +SLAPDPID=
 722 +TEMPDIR=
 723 +update "$1"
 724 +if [ $? -ne 0 ]; then
 725 +    log "Clean up."
 726 +    echo "$SLAPDPID"
 727 +    echo "$TEMPDIR"
 728 +    kill "$SLAPDPID"
 729 +    rm -rf "$TEMPDIR"
 730 +fi
 731 +log "Finished."
 732 diff --git a/stx-sources/libexec-upgrade-db.sh b/stx-sources/libexec-upgrade-db.sh
 733 new file mode 100755
 734 index 0000000..1543c80
 735 --- /dev/null
 736 +++ b/stx-sources/libexec-upgrade-db.sh
 737 @@ -0,0 +1,40 @@
 738 +#!/bin/sh
 739 +# Author: Jan Vcelak <jvcelak@redhat.com>
 740 +
 741 +. /usr/libexec/openldap/functions
 742 +
 743 +if [ `id -u` -ne 0 ]; then
 744 +       error "You have to be root to run this command."
 745 +       exit 4
 746 +fi
 747 +
 748 +load_sysconfig
 749 +retcode=0
 750 +
 751 +for dbdir in `databases`; do
 752 +       upgrade_log="$dbdir/db_upgrade.`date +%Y%m%d%H%M%S`.log"
 753 +       bdb_files=`find "$dbdir" -maxdepth 1 -name "*.bdb" -printf '"%f" '`
 754 +
 755 +       # skip uninitialized database
 756 +       [ -z "$bdb_files"]  || continue
 757 +
 758 +       printf "Updating '%s', logging into '%s'\n" "$dbdir" "$upgrade_log"
 759 +
 760 +       # perform the update
 761 +       for command in \
 762 +               "/usr/bin/db_recover -v -h \"$dbdir\"" \
 763 +               "/usr/bin/db_upgrade -v -h \"$dbdir\" $bdb_files" \
 764 +               "/usr/bin/db_checkpoint -v -h \"$dbdir\" -1" \
 765 +       ; do
 766 +               printf "Executing: %s\n" "$command" &>>$upgrade_log
 767 +               run_as_ldap "$command" &>>$upgrade_log
 768 +               result=$?
 769 +               printf "Exit code: %d\n" $result >>"$upgrade_log"
 770 +               if [ $result -ne 0 ]; then
 771 +                       printf "Upgrade failed: %d\n" $result
 772 +                       retcode=1
 773 +               fi
 774 +       done
 775 +done
 776 +
 777 +exit $retcode
 778 diff --git a/stx-sources/openldap.tmpfiles b/stx-sources/openldap.tmpfiles
 779 new file mode 100644
 780 index 0000000..aa0e805
 781 --- /dev/null
 782 +++ b/stx-sources/openldap.tmpfiles
 783 @@ -0,0 +1,3 @@
 784 +# OpenLDAP TLSMC runtime directories
 785 +x /tmp/openldap-tlsmc-*
 786 +X /tmp/openldap-tlsmc-*
 787 diff --git a/stx-sources/slapd.ldif b/stx-sources/slapd.ldif
 788 new file mode 100644
 789 index 0000000..7b7f328
 790 --- /dev/null
 791 +++ b/stx-sources/slapd.ldif
 792 @@ -0,0 +1,148 @@
 793 +#
 794 +# See slapd-config(5) for details on configuration options.
 795 +# This file should NOT be world readable.
 796 +#
 797 +
 798 +dn: cn=config
 799 +objectClass: olcGlobal
 800 +cn: config
 801 +olcArgsFile: /var/run/openldap/slapd.args
 802 +olcPidFile: /var/run/openldap/slapd.pid
 803 +#
 804 +# TLS settings
 805 +#
 806 +olcTLSCACertificatePath: /etc/openldap/certs
 807 +olcTLSCertificateFile: "OpenLDAP Server"
 808 +olcTLSCertificateKeyFile: /etc/openldap/certs/password
 809 +#
 810 +# Do not enable referrals until AFTER you have a working directory
 811 +# service AND an understanding of referrals.
 812 +#
 813 +#olcReferral: ldap://root.openldap.org
 814 +#
 815 +# Sample security restrictions
 816 +#      Require integrity protection (prevent hijacking)
 817 +#      Require 112-bit (3DES or better) encryption for updates
 818 +#      Require 64-bit encryption for simple bind
 819 +#
 820 +#olcSecurity: ssf=1 update_ssf=112 simple_bind=64
 821 +
 822 +
 823 +#
 824 +# Load dynamic backend modules:
 825 +# - modulepath is architecture dependent value (32/64-bit system)
 826 +# - back_sql.la backend requires openldap-servers-sql package
 827 +# - dyngroup.la and dynlist.la cannot be used at the same time
 828 +#
 829 +
 830 +#dn: cn=module,cn=config
 831 +#objectClass: olcModuleList
 832 +#cn: module
 833 +#olcModulepath:        /usr/lib/openldap
 834 +#olcModulepath:        /usr/lib64/openldap
 835 +#olcModuleload: accesslog.la
 836 +#olcModuleload: auditlog.la
 837 +#olcModuleload: back_dnssrv.la
 838 +#olcModuleload: back_ldap.la
 839 +#olcModuleload: back_mdb.la
 840 +#olcModuleload: back_meta.la
 841 +#olcModuleload: back_null.la
 842 +#olcModuleload: back_passwd.la
 843 +#olcModuleload: back_relay.la
 844 +#olcModuleload: back_shell.la
 845 +#olcModuleload: back_sock.la
 846 +#olcModuleload: collect.la
 847 +#olcModuleload: constraint.la
 848 +#olcModuleload: dds.la
 849 +#olcModuleload: deref.la
 850 +#olcModuleload: dyngroup.la
 851 +#olcModuleload: dynlist.la
 852 +#olcModuleload: memberof.la
 853 +#olcModuleload: pcache.la
 854 +#olcModuleload: ppolicy.la
 855 +#olcModuleload: refint.la
 856 +#olcModuleload: retcode.la
 857 +#olcModuleload: rwm.la
 858 +#olcModuleload: seqmod.la
 859 +#olcModuleload: smbk5pwd.la
 860 +#olcModuleload: sssvlv.la
 861 +#olcModuleload: syncprov.la
 862 +#olcModuleload: translucent.la
 863 +#olcModuleload: unique.la
 864 +#olcModuleload: valsort.la
 865 +
 866 +
 867 +#
 868 +# Schema settings
 869 +#
 870 +
 871 +dn: cn=schema,cn=config
 872 +objectClass: olcSchemaConfig
 873 +cn: schema
 874 +
 875 +include: file:///etc/openldap/schema/core.ldif
 876 +
 877 +#
 878 +# Frontend settings
 879 +#
 880 +
 881 +dn: olcDatabase=frontend,cn=config
 882 +objectClass: olcDatabaseConfig
 883 +objectClass: olcFrontendConfig
 884 +olcDatabase: frontend
 885 +#
 886 +# Sample global access control policy:
 887 +#      Root DSE: allow anyone to read it
 888 +#      Subschema (sub)entry DSE: allow anyone to read it
 889 +#      Other DSEs:
 890 +#              Allow self write access
 891 +#              Allow authenticated users read access
 892 +#              Allow anonymous users to authenticate
 893 +#
 894 +#olcAccess: to dn.base="" by * read
 895 +#olcAccess: to dn.base="cn=Subschema" by * read
 896 +#olcAccess: to *
 897 +#      by self write
 898 +#      by users read
 899 +#      by anonymous auth
 900 +#
 901 +# if no access controls are present, the default policy
 902 +# allows anyone and everyone to read anything but restricts
 903 +# updates to rootdn.  (e.g., "access to * by * read")
 904 +#
 905 +# rootdn can always read and write EVERYTHING!
 906 +#
 907 +
 908 +#
 909 +# Configuration database
 910 +#
 911 +
 912 +dn: olcDatabase=config,cn=config
 913 +objectClass: olcDatabaseConfig
 914 +olcDatabase: config
 915 +olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,c
 916 + n=auth" manage by * none
 917 +
 918 +#
 919 +# Server status monitoring
 920 +#
 921 +
 922 +dn: olcDatabase=monitor,cn=config
 923 +objectClass: olcDatabaseConfig
 924 +olcDatabase: monitor
 925 +olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,c
 926 + n=auth" read by dn.base="cn=Manager,dc=my-domain,dc=com" read by * none
 927 +
 928 +#
 929 +# Backend database definitions
 930 +#
 931 +
 932 +dn: olcDatabase=hdb,cn=config
 933 +objectClass: olcDatabaseConfig
 934 +objectClass: olcHdbConfig
 935 +olcDatabase: hdb
 936 +olcSuffix: dc=my-domain,dc=com
 937 +olcRootDN: cn=Manager,dc=my-domain,dc=com
 938 +olcDbDirectory:        /var/lib/ldap
 939 +olcDbIndex: objectClass eq,pres
 940 +olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
 941 diff --git a/stx-sources/slapd.service b/stx-sources/slapd.service
 942 new file mode 100644
 943 index 0000000..8a3a722
 944 --- /dev/null
 945 +++ b/stx-sources/slapd.service
 946 @@ -0,0 +1,19 @@
 947 +[Unit]
 948 +Description=OpenLDAP Server Daemon
 949 +After=syslog.target network-online.target
 950 +Documentation=man:slapd
 951 +Documentation=man:slapd-config
 952 +Documentation=man:slapd-hdb
 953 +Documentation=man:slapd-mdb
 954 +Documentation=file:///usr/share/doc/openldap-servers/guide.html
 955 +
 956 +[Service]
 957 +Type=forking
 958 +PIDFile=/var/run/openldap/slapd.pid
 959 +Environment="SLAPD_URLS=ldap:/// ldapi:///" "SLAPD_OPTIONS="
 960 +EnvironmentFile=/etc/sysconfig/slapd
 961 +ExecStartPre=/usr/libexec/openldap/check-config.sh
 962 +ExecStart=/usr/sbin/slapd -u ldap -h ${SLAPD_URLS} $SLAPD_OPTIONS
 963 +
 964 +[Install]
 965 +WantedBy=multi-user.target
 966 diff --git a/stx-sources/slapd.sysconfig b/stx-sources/slapd.sysconfig
 967 new file mode 100644
 968 index 0000000..68091a5
 969 --- /dev/null
 970 +++ b/stx-sources/slapd.sysconfig
 971 @@ -0,0 +1,15 @@
 972 +# OpenLDAP server configuration
 973 +# see 'man slapd' for additional information
 974 +
 975 +# Where the server will run (-h option)
 976 +# - ldapi:/// is required for on-the-fly configuration using client tools
 977 +#   (use SASL with EXTERNAL mechanism for authentication)
 978 +# - default: ldapi:/// ldap:///
 979 +# - example: ldapi:/// ldap://127.0.0.1/ ldap://10.0.0.1:1389/ ldaps:///
 980 +SLAPD_URLS="ldapi:/// ldap:///"
 981 +
 982 +# Any custom options
 983 +#SLAPD_OPTIONS=""
 984 +
 985 +# Keytab location for GSSAPI Kerberos authentication
 986 +#KRB5_KTNAME="FILE:/etc/openldap/ldap.keytab"
 987 diff --git a/stx-sources/slapd.tmpfiles b/stx-sources/slapd.tmpfiles
 988 new file mode 100644
 989 index 0000000..56aa32e
 990 --- /dev/null
 991 +++ b/stx-sources/slapd.tmpfiles
 992 @@ -0,0 +1,2 @@
 993 +# openldap runtime directory for slapd.arg and slapd.pid
 994 +d /var/run/openldap 0755 ldap ldap -
 995 --
 996 2.17.1
 997