[git.ipfire.org] IPFire 3.x development tree branch, master, updated. f2dfd5778e2494e16376ef4535422d3d17783370

[git@ipfire.org]

[-- Attachment #1: Type: text/plain, Size: 4740 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 3.x development tree".

The branch, master has been updated
       via  f2dfd5778e2494e16376ef4535422d3d17783370 (commit)
      from  5f4bab7077947a4695744fdbf4c0c3b19ae7fe13 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit f2dfd5778e2494e16376ef4535422d3d17783370
Author: Stefan Schantl <stefan.schantl(a)ipfire.org>
Date:   Sun Mar 31 20:50:24 2013 +0200

    openldap: Enable ldaps on default.
    
    * Enable ldaps at default.
    * Add a script to generate the required certificates.

-----------------------------------------------------------------------

Summary of changes:
 openldap/ldapcert.sh              | 34 ++++++++++++++++++++++++++++++++++
 openldap/openldap-conf.ldif       |  4 ++--
 openldap/openldap.nm              | 13 +++++++++++--
 openldap/systemd/openldap.service |  3 ++-
 4 files changed, 49 insertions(+), 5 deletions(-)
 create mode 100644 openldap/ldapcert.sh

Difference in files:
diff --git a/openldap/ldapcert.sh b/openldap/ldapcert.sh
new file mode 100644
index 0000000..614a8b9
--- /dev/null
+++ b/openldap/ldapcert.sh
@@ -0,0 +1,34 @@
+#!/bin/sh
+#
+# This is a temporary script to generate a self-signet certificate for the openLDAP service.
+#
+LDAPCERTDIR=/etc/openldap/certs
+
+# Check if a server key allready exists.
+if [ ! -f $LDAPCERTDIR/server.key ]; then
+	echo "Generating openLDAP server key."
+	openssl genrsa -out $LDAPCERTDIR/server.key 2048
+
+	# Fix ownership and permissions.
+	chown ldap:ldap $LDAPCERTDIR/server.key
+	chmod 0600 $LDAPCERTDIR/server.key
+fi
+
+# Check if the certificate allready exists.
+if [ ! -f $LDAPCERTDIR/server.pem ]; then
+	echo "Generating CSR"
+	openssl req -new -key $LDAPCERTDIR/server.key \
+		-out $LDAPCERTDIR/server.csr
+
+	echo "Signing certificate"
+	openssl x509 -req -days 365 -in \
+		$LDAPCERTDIR/server.csr -signkey $LDAPCERTDIR/server.key \
+		-out $LDAPCERTDIR/server.pem
+
+	# Remove unneeded csr file.
+	rm -rvf $LDAPCERTDIR/server.csr
+
+	# Fix ownership and file permissions.
+	chown ldap:ldap $LDAPCERTDIR/server.pem
+	chmod 0600 $LDAPCERTDIR/server.pem
+fi
diff --git a/openldap/openldap-conf.ldif b/openldap/openldap-conf.ldif
index a34fa04..c660434 100644
--- a/openldap/openldap-conf.ldif
+++ b/openldap/openldap-conf.ldif
@@ -11,8 +11,8 @@ olcPidFile: /run/openldap/slapd.pid
 # TLS settings
 #
 #olcTLSCACertificateFile: /etc/pki/CA/cacert.pem
-#olcTLSCertificateFile: /etc/openldap/certs/server.pem
-#olcTLSCertificateKeyFile: /etc/openldap/certs/server.pem
+olcTLSCertificateFile: /etc/openldap/certs/server.pem
+olcTLSCertificateKeyFile: /etc/openldap/certs/server.key
 #
 # Do not enable referrals until AFTER you have a working directory
 # service AND an understanding of referrals.
diff --git a/openldap/openldap.nm b/openldap/openldap.nm
index a0fdd96..2588061 100644
--- a/openldap/openldap.nm
+++ b/openldap/openldap.nm
@@ -5,7 +5,7 @@
 
 name       = openldap
 version    = 2.4.32
-release    = 4
+release    = 5
 
 groups     = System/Daemons
 url        = http://www.openldap.org/
@@ -84,8 +84,13 @@ build
 		cp -vf %{DIR_SOURCE}/openldap-conf.ldif \
 			 %{BUILDROOT}%{datadir}/%{name}/
 
+		# Install ldapcert.sh script.
+		install -m 0755 %{DIR_SOURCE}/ldapcert.sh \
+			%{BUILDROOT}%{datadir}/%{name}/
+
 		# Create directoires.
 		mkdir -pv %{BUILDROOT}%{sysconfdir}/%{name}/slapd.d
+		mkdir -pv %{BUILDROOT}%{sysconfdir}/%{name}/certs
 		mkdir -pv %{BUILDROOT}/run/%{name}
 		mkdir -pv %{BUILDROOT}%{sharedstatedir}/ldap
 
@@ -105,7 +110,10 @@ end
 
 packages
 	package %{name}
-		prerequires += shadow-utils
+		prerequires
+			openssl
+			shadow-utils
+		end
 
 		script prein
 			%{create_user}
@@ -113,6 +121,7 @@ packages
 
 		datafiles
 			%{sysconfdir}/%{name}/slapd.d
+			%{sysconfdir}/%{name}/certs
 			%{sharedstatedir}/ldap
 		end
 
diff --git a/openldap/systemd/openldap.service b/openldap/systemd/openldap.service
index a6960d3..c21bd3a 100644
--- a/openldap/systemd/openldap.service
+++ b/openldap/systemd/openldap.service
@@ -3,4 +3,5 @@ Description=OpenLDAP
 After=basic.target sockets.target
 
 [Service]
-ExecStart=/usr/sbin/slapd -u ldap -h 'ldapi://'
+Type=forking
+ExecStart=/usr/sbin/slapd -u ldap -h 'ldapi:// ldaps://'


hooks/post-receive
--
IPFire 3.x development tree