This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 3.x development tree".
The branch, master has been updated via f2dfd5778e2494e16376ef4535422d3d17783370 (commit) from 5f4bab7077947a4695744fdbf4c0c3b19ae7fe13 (commit)
Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.
- Log ----------------------------------------------------------------- commit f2dfd5778e2494e16376ef4535422d3d17783370 Author: Stefan Schantl stefan.schantl@ipfire.org Date: Sun Mar 31 20:50:24 2013 +0200
openldap: Enable ldaps on default.
* Enable ldaps at default. * Add a script to generate the required certificates.
-----------------------------------------------------------------------
Summary of changes: openldap/ldapcert.sh | 34 ++++++++++++++++++++++++++++++++++ openldap/openldap-conf.ldif | 4 ++-- openldap/openldap.nm | 13 +++++++++++-- openldap/systemd/openldap.service | 3 ++- 4 files changed, 49 insertions(+), 5 deletions(-) create mode 100644 openldap/ldapcert.sh
Difference in files: diff --git a/openldap/ldapcert.sh b/openldap/ldapcert.sh new file mode 100644 index 0000000..614a8b9 --- /dev/null +++ b/openldap/ldapcert.sh @@ -0,0 +1,34 @@ +#!/bin/sh +# +# This is a temporary script to generate a self-signet certificate for the openLDAP service. +# +LDAPCERTDIR=/etc/openldap/certs + +# Check if a server key allready exists. +if [ ! -f $LDAPCERTDIR/server.key ]; then + echo "Generating openLDAP server key." + openssl genrsa -out $LDAPCERTDIR/server.key 2048 + + # Fix ownership and permissions. + chown ldap:ldap $LDAPCERTDIR/server.key + chmod 0600 $LDAPCERTDIR/server.key +fi + +# Check if the certificate allready exists. +if [ ! -f $LDAPCERTDIR/server.pem ]; then + echo "Generating CSR" + openssl req -new -key $LDAPCERTDIR/server.key \ + -out $LDAPCERTDIR/server.csr + + echo "Signing certificate" + openssl x509 -req -days 365 -in \ + $LDAPCERTDIR/server.csr -signkey $LDAPCERTDIR/server.key \ + -out $LDAPCERTDIR/server.pem + + # Remove unneeded csr file. + rm -rvf $LDAPCERTDIR/server.csr + + # Fix ownership and file permissions. + chown ldap:ldap $LDAPCERTDIR/server.pem + chmod 0600 $LDAPCERTDIR/server.pem +fi diff --git a/openldap/openldap-conf.ldif b/openldap/openldap-conf.ldif index a34fa04..c660434 100644 --- a/openldap/openldap-conf.ldif +++ b/openldap/openldap-conf.ldif @@ -11,8 +11,8 @@ olcPidFile: /run/openldap/slapd.pid # TLS settings # #olcTLSCACertificateFile: /etc/pki/CA/cacert.pem -#olcTLSCertificateFile: /etc/openldap/certs/server.pem -#olcTLSCertificateKeyFile: /etc/openldap/certs/server.pem +olcTLSCertificateFile: /etc/openldap/certs/server.pem +olcTLSCertificateKeyFile: /etc/openldap/certs/server.key # # Do not enable referrals until AFTER you have a working directory # service AND an understanding of referrals. diff --git a/openldap/openldap.nm b/openldap/openldap.nm index a0fdd96..2588061 100644 --- a/openldap/openldap.nm +++ b/openldap/openldap.nm @@ -5,7 +5,7 @@
name = openldap version = 2.4.32 -release = 4 +release = 5
groups = System/Daemons url = http://www.openldap.org/ @@ -84,8 +84,13 @@ build cp -vf %{DIR_SOURCE}/openldap-conf.ldif \ %{BUILDROOT}%{datadir}/%{name}/
+ # Install ldapcert.sh script. + install -m 0755 %{DIR_SOURCE}/ldapcert.sh \ + %{BUILDROOT}%{datadir}/%{name}/ + # Create directoires. mkdir -pv %{BUILDROOT}%{sysconfdir}/%{name}/slapd.d + mkdir -pv %{BUILDROOT}%{sysconfdir}/%{name}/certs mkdir -pv %{BUILDROOT}/run/%{name} mkdir -pv %{BUILDROOT}%{sharedstatedir}/ldap
@@ -105,7 +110,10 @@ end
packages package %{name} - prerequires += shadow-utils + prerequires + openssl + shadow-utils + end
script prein %{create_user} @@ -113,6 +121,7 @@ packages
datafiles %{sysconfdir}/%{name}/slapd.d + %{sysconfdir}/%{name}/certs %{sharedstatedir}/ldap end
diff --git a/openldap/systemd/openldap.service b/openldap/systemd/openldap.service index a6960d3..c21bd3a 100644 --- a/openldap/systemd/openldap.service +++ b/openldap/systemd/openldap.service @@ -3,4 +3,5 @@ Description=OpenLDAP After=basic.target sockets.target
[Service] -ExecStart=/usr/sbin/slapd -u ldap -h 'ldapi://' +Type=forking +ExecStart=/usr/sbin/slapd -u ldap -h 'ldapi:// ldaps://'
hooks/post-receive -- IPFire 3.x development tree