%bcond_with systemd %bcond_with test %if %{with test} BuildRequires: socket_wrapper %endif %define build_compat32 %{?_with_compat32:1}%{!?_with_compat32:0} %global WITH_LDAP 1 %global WITH_OPENSSL 1 %global WITH_DIRSRV 1 %global WITH_SYSVERTO 0 # This'll be pulled out at some point. %define build_static 0 # Set this so that find-lang.sh will recognize the .po files. %global gettext_domain mit-krb5 Summary: The Kerberos network authentication system Summary(ja): Kerberos ネットワーク認証システム Name: krb5 Version: 1.18.3 Release: 1%{_dist_release}%{?with_systemd:.systemd} Group: system Vendor: Project Vine Distribution: Vine Linux License: MIT URL: http://web.mit.edu/kerberos/www/ # Maybe we should explode from the now-available-to-everybody tarball instead? # http://web.mit.edu/kerberos/dist/krb5/1.11/krb5-1.11.1-signed.tar %global shortver %(echo "%{version}" | perl -p -e 's/^([0-9]+\.[0-9]+).*$/\\1/') Source0: https://web.mit.edu/kerberos/dist/krb5/%{shortver}/krb5-%{version}.tar.gz # Source1: krb5-%{version}.tar.gz.asc Source2: kpropd.init Source4: kadmind.init Source5: krb5kdc.init Source6: krb5.conf Source10: kdc.conf Source11: kadm5.acl Source19: krb5kdc.sysconfig Source20: kadmin.sysconfig Source21: kprop.sysconfig Source29: ksu.pamd Source30: kerberos-iv.portreserve Source31: kerberos-adm.portreserve Source32: krb5_prop.portreserve Source33: krb5kdc.logrotate Source34: kadmind.logrotate # Carry this locally until it's available in a packaged form. Source100: noport.c Source200: kprop.service Source201: kadmin.service Source202: krb5kdc.service Source203: krb5-krb5kdc.conf Patch0: downstream-ksu-pam-integration.patch Patch1: downstream-SELinux-integration.patch Patch2: downstream-Adjust-build-configuration.patch Patch3: downstream-netlib-and-dns.patch Patch4: downstream-fix-debuginfo-with-y.tab.c.patch Patch5: downstream-Remove-3des-support.patch #Patch6: downstream-Use-backported-version-of-OpenSSL-3-KDF-i.patch Patch7: downstream-FIPS-with-PRNG-and-RADIUS-and-MD4.patch #Patch8: Fix-AS-REQ-checking-of-KDB-modified-indicators.patch Patch9: Allow-certauth-modules-to-set-hw-authent-flag.patch #Patch10: Allow-deletion-of-require_auth-with-LDAP-KDB.patch Patch11: Refresh-manually-acquired-creds-from-client-keytab.patch #Patch12: Document-client-keytab-usage.patch Patch13: Add-finalization-safety-check-to-com_err.patch #Patch14: Eliminate-redundant-PKINIT-responder-invocation.patch Patch15: Correctly-import-service-GSS-host-based-name.patch Patch16: Do-expiration-warnings-for-all-init_creds-APIs.patch Patch17: Pass-gss_localname-through-SPNEGO.patch Patch18: Omit-KDC-indicator-check-for-S4U2Self-requests.patch Patch19: Fix-typo-in-in-in-the-ksu-man-page.patch Patch21: Replace-gssrpc-tests-with-a-Python-script.patch Patch22: Default-dns_canonicalize_hostname-to-fallback.patch Patch23: Remove-resolver-test-utility.patch Patch24: Omit-PA_FOR_USER-if-we-can-t-compute-its-checksum.patch Patch25: Improve-negoex_parse_token-code-hygiene.patch Patch26: Refactor-krb5-GSS-checksum-handling.patch Patch27: Implement-GSS_C_CHANNEL_BOUND_FLAG.patch Patch28: Implement-KERB_AP_OPTIONS_CBT-server-side.patch Patch29: Add-client_aware_channel_bindings-option.patch Patch30: Pass-channel-bindings-through-SPNEGO.patch Patch31: Add-channel-bindings-tests.patch Patch32: Use-two-queues-for-concurrent-t_otp.py-daemons.patch Patch34: Ignore-bad-enctypes-in-krb5_string_to_keysalts.patch Patch35: Fix-leak-in-KERB_AP_OPTIONS_CBT-server-support.patch Patch37: Add-three-kvno-options-from-Heimdal-kgetcred.patch Patch39: Improve-KDC-alias-checking-for-S4U-requests.patch Patch40: Adjust-KDC-alias-helper-function-contract.patch Patch41: Allow-aliases-when-matching-U2U-second-ticket.patch Patch42: Refactor-KDC-authdata-list-management-helpers.patch Patch43: Avoid-passing-DB-entry-structures-in-KDC.patch Patch44: Minimize-usage-of-tgs_server-in-KDC.patch Patch45: Fix-minor-static-analysis-defects.patch # Vine patch(es) BuildRoot: %{_tmppath}/%{name}-%{version}-root BuildRequires: autoconf, bison, flex, gawk # BuildRequires: libcom_err-devel, libss-devel BuildRequires: e2fsprogs-devel # BuildRequires: gzip, ncurses-devel, rsh, texinfo, texinfo-tex, tar BuildRequires: gzip, ncurses-devel, texinfo, tar, git BuildRequires: python3-sphinx # BuildRequires: texlive # BuildRequires: texlive-latexrecommended # BuildRequires: texlive-fontsrecommended BuildRequires: keyutils BuildRequires: keyutils-libs-devel # BuildRequires: libselinux-devel BuildRequires: pam-devel BuildRequires: tcl-devel %if 0%{?with_systemd} BuildRequires: systemd-units %endif %if %{WITH_LDAP} BuildRequires: openldap-devel %endif %if %{WITH_OPENSSL} BuildRequires: openssl-devel >= 1.0.0 %endif %if %{WITH_SYSVERTO} BuildRequires: libverto-devel %endif %description Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's security by eliminating the insecure practice of cleartext passwords. %package devel Summary: Development files needed to compile Kerberos 5 programs Group: programming Requires: %{name}-libs = %{version}-%{release} # Requires: keyutils-libs-devel, libselinux-devel Requires: keyutils-libs-devel Requires: e2fsprogs-devel %if %{WITH_SYSVERTO} Requires: libverto-devel %endif %description devel Kerberos is a network authentication system. The krb5-devel package contains the header files and libraries needed for compiling Kerberos 5 programs. If you want to develop Kerberos-aware programs, you need to install this package. %package libs Summary: The shared libraries used by Kerberos 5 Group: system %description libs Kerberos is a network authentication system. The krb5-libs package contains the shared libraries needed by Kerberos 5. If you are using Kerberos, you need to install this package. %package server Group: servers Summary: The KDC and related programs for Kerberos 5 Requires: %{name}-libs = %{version}-%{release} %if %{WITH_SYSVERTO} # for run-time, and for parts of the test suite BuildRequires: libverto-module-base Requires: libverto-module-base %endif Requires(preun): /sbin/install-info Requires(post): /sbin/install-info %if 0%{?with_systemd} Requires(post): systemd Requires(preun): systemd Requires(postun): systemd %else # we need 'status -l' to work, and that option was added in 8.91.3-1vl6 # portreserve is used by init scripts for kadmind, kpropd, and krb5kdc Requires: portreserve Requires: initscripts >= 8.91.3-1 Requires(post): chkconfig Requires(preun): chkconfig, initscripts Requires(postun): initscripts %endif %description server Kerberos is a network authentication system. The krb5-server package contains the programs that must be installed on a Kerberos 5 key distribution center (KDC). If you are installing a Kerberos 5 KDC, you need to install this package (in other words, most people should NOT install this package). %package server-ldap Group: servers Summary: The LDAP storage plugin for the Kerberos 5 KDC Requires: %{name}-server = %{version}-%{release} Requires: %{name}-libs = %{version}-%{release} %description server-ldap Kerberos is a network authentication system. The krb5-server package contains the programs that must be installed on a Kerberos 5 key distribution center (KDC). If you are installing a Kerberos 5 KDC, and you wish to use a directory server to store the data for your realm, you need to install this package. %package workstation Summary: Kerberos 5 programs for use on workstations Group: system Requires: %{name}-libs = %{version}-%{release} Requires(post): /sbin/install-info Requires(preun): /sbin/install-info # mktemp is used by krb5-send-pr Requires: mktemp Obsoletes: krb5-workstation-clients < %{version}-%{release} Obsoletes: krb5-workstation-servers < %{version}-%{release} %description workstation Kerberos is a network authentication system. The krb5-workstation package contains the basic Kerberos programs (kinit, klist, kdestroy, kpasswd). If your network uses Kerberos, this package should be installed on every workstation. %package pkinit-openssl Summary: The PKINIT module for Kerberos 5 Group: system Requires: %{name}-libs = %{version}-%{release} %description pkinit-openssl Kerberos is a network authentication system. The krb5-pkinit-openssl package contains the PKINIT plugin, which uses OpenSSL to allow clients to obtain initial credentials from a KDC using a private key and a certificate. # compat32 %package -n compat32-%{name}-devel Summary: Development files needed to compile Kerberos 5 programs. Summary(ja): Kerberos 5 プログラムをコンパイルするために必要な開発ファイル Group: programming Requires: compat32-%{name}-libs = %{version}-%{release} Requires: %{name}-devel = %{version}-%{release} Requires: compat32-e2fsprogs-devel %description -n compat32-%{name}-devel Kerberos is a network authentication system. The krb5-devel package contains the header files and libraries needed for compiling Kerberos 5 programs. If you want to develop Kerberos-aware programs, you need to install this package. %package -n compat32-%{name}-libs Summary: The shared libraries used by Kerberos 5. Summary(ja): Kerberos 5 の共有ライブラリ Group: system Requires(pre): /sbin/ldconfig Requires: %{name}-libs = %{version}-%{release} %description -n compat32-%{name}-libs Kerberos is a network authentication system. The krb5-libs package contains the shared libraries needed by Kerberos 5. If you are using Kerberos, you need to install this package. %package -n compat32-%{name}-pkinit-openssl Summary: The PKINIT module for Kerberos 5. Summary(ja): Kerberos 5 の PKINIT モジュール Group: system Requires: compat32-%{name}-libs = %{version}-%{release} Requires: %{name}-pkinit-openssl = %{version}-%{release} %description -n compat32-%{name}-pkinit-openssl Kerberos is a network authentication system. The krb5-pkinit-openssl package contains the PKINIT plugin, which uses OpenSSL to allow clients to obtain initial credentials from a KDC using a private key and a certificate. # end of compat32 package %debug_package %prep %autosetup -S git -n %{name}-%{version} ln -s NOTICE LICENSE # Generate an FDS-compatible LDIF file. inldif=src/plugins/kdb/ldap/libkdb_ldap/kerberos.ldif cat > '60kerberos.ldif' << EOF # This is a variation on kerberos.ldif which 389 Directory Server will like. dn: cn=schema EOF egrep -iv '(^$|^dn:|^changetype:|^add:)' $inldif | \ sed -r 's,^ , ,g' | \ sed -r 's,^ , ,g' >> 60kerberos.ldif touch -r $inldif 60kerberos.ldif # Rebuild the configure scripts. pushd src autoreconf -fiv popd # Mess with some of the default ports that we use for testing, so that multiple # builds going on the same host don't step on each other. cfg="src/kadmin/testing/proto/kdc.conf.proto \ src/kadmin/testing/proto/krb5.conf.proto \ src/lib/kadm5/unit-test/api.current/init-v2.exp \ src/util/k5test.py" LONG_BIT=`getconf LONG_BIT` PORT=`expr 61000 + $LONG_BIT - 48` sed -i -e s,61000,`expr "$PORT" + 0`,g $cfg PORT=`expr 1750 + $LONG_BIT - 48` sed -i -e s,1750,`expr "$PORT" + 0`,g $cfg sed -i -e s,1751,`expr "$PORT" + 1`,g $cfg sed -i -e s,1752,`expr "$PORT" + 2`,g $cfg PORT=`expr 8888 + $LONG_BIT - 48` sed -i -e s,8888,`expr "$PORT" - 0`,g $cfg sed -i -e s,8887,`expr "$PORT" - 1`,g $cfg sed -i -e s,8886,`expr "$PORT" - 2`,g $cfg PORT=`expr 7777 + $LONG_BIT - 48` sed -i -e s,7777,`expr "$PORT" + 0`,g $cfg sed -i -e s,7778,`expr "$PORT" + 1`,g $cfg %build source %{_libdir}/tclConfig.sh pushd src # Set this so that configure will have a value even if the current version of # autoconf doesn't set one. export runstatedir=%{_localstatedir}/run # Work out the CFLAGS and CPPFLAGS which we intend to use. INCLUDES=-I%{_includedir}/et CFLAGS="`echo $RPM_OPT_FLAGS $DEFINES $INCLUDES -fPIC -fno-strict-aliasing -fstack-protector-all`" CPPFLAGS="`echo $DEFINES $INCLUDES`" %configure \ CC="%{__cc}" \ CFLAGS="$CFLAGS" \ CPPFLAGS="$CPPFLAGS" \ LIBS="-ldl -lz -lpthread" \ SS_LIB="-lss" \ --with-selinux=no \ --enable-shared \ %if %{build_static} --enable-static \ %endif --localstatedir=%{_var}/kerberos \ --disable-rpath \ --without-krb5-config \ --with-system-et \ --with-system-ss \ --with-netlib=-lresolv \ --without-tcl \ --enable-dns-for-realm \ %if %{WITH_LDAP} --with-ldap \ %if %{WITH_DIRSRV} --with-dirsrv-account-locking \ %endif %endif %if %{WITH_OPENSSL} --enable-pkinit \ --with-crypto-impl=openssl \ --with-pkinit-crypto-impl=openssl \ --with-tls-impl=openssl \ %else --disable-pkinit \ %endif %if %{WITH_SYSVERTO} --with-system-verto \ %else --without-system-verto \ %endif --with-pam \ --with-prng-alg=os \ || (cat config.log; exit 1) # Now build it. make %{?_smp_mflags} popd # Sanity check the KDC_RUN_DIR. configured_kdcrundir=`grep KDC_RUN_DIR src/include/osconf.h | awk '{print $NF}'` configured_kdcrundir=`eval echo $configured_kdcrundir` if test "$configured_kdcrundir" != %{_localstatedir}/run/krb5kdc ; then exit 1 fi ## Build the docs. #LANG=C make -C src/doc paths.py version.py #cp src/doc/paths.py doc/ #mkdir -p build-man build-html build-pdf #sphinx-build -a -b man -t pathsubs doc build-man #sphinx-build -a -b html -t pathsubs doc build-html #rm -fr build-html/_sources #sphinx-build -a -b latex -t pathsubs doc build-pdf ## Build the PDFs if we didn't have pre-built ones. #for pdf in admin appdev basic build plugindev user ; do # test -s build-pdf/$pdf.pdf || make -C build-pdf #done ## new krb5-%{version}-pdf #tar -cf "krb5-%{version}-pdfs.tar.new" build-pdf/*.pdf cd src/man make -f Makefile.in top_srcdir=.. srcdir=. man # We need to cut off any access to locally-running nameservers, too. %{__cc} -fPIC -shared -o noport.so -Wall -Wextra $RPM_SOURCE_DIR/noport.c %check %if %{with test} mkdir nss_wrapper # Set things up to use the test wrappers. export NSS_WRAPPER_HOSTNAME=test.example.com export NSS_WRAPPER_HOSTS="$PWD/nss_wrapper/fakehosts" echo "127.0.0.1 $NSS_WRAPPER_HOSTNAME localhost" > $NSS_WRAPPER_HOSTS export NOPORT='53,111' export SOCKET_WRAPPER_DIR="$PWD/sockets" ; mkdir -p $SOCKET_WRAPPER_DIR export LD_PRELOAD="$PWD/noport.so:libnss_wrapper.so:libsocket_wrapper.so" # Run the test suite. We can't actually run the whole thing in the build # system, but we can at least run more than we used to. The build system may # give us a revoked session keyring, so run affected tests with a new one. make -C src runenv.py : make -C src check TMPDIR=%{_tmppath} keyctl session - make -C src/lib check TMPDIR=%{_tmppath} OFFLINE=yes make -C src/kdc check TMPDIR=%{_tmppath} keyctl session - make -C src/appl check TMPDIR=%{_tmppath} make -C src/clients check TMPDIR=%{_tmppath} keyctl session - make -C src/util check TMPDIR=%{_tmppath} %endif %install [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT # Sample KDC config files (bundled kdc.conf and kadm5.acl). mkdir -p $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc install -pm 600 %{SOURCE10} $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/ install -pm 600 %{SOURCE11} $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/ # Where per-user keytabs live by default. mkdir -p $RPM_BUILD_ROOT%{_var}/kerberos/krb5/user # Default configuration file for everything. mkdir -p $RPM_BUILD_ROOT/etc install -pm 644 %{SOURCE6} $RPM_BUILD_ROOT/etc/krb5.conf # Default include on this directory mkdir -p $RPM_BUILD_ROOT/etc/krb5.conf.d #ln -sv /etc/crypto-policies/back-ends/krb5.config $RPM_BUILD_ROOT/etc/krb5.conf.d/crypto-policies # Parent of configuration file for list of loadable GSS mechs ("mechs"). This # location is not relative to sysconfdir, but is hard-coded in g_initialize.c. mkdir -m 755 -p $RPM_BUILD_ROOT/etc/gss # Parent of groups of configuration files for a list of loadable GSS mechs # ("mechs"). This location is not relative to sysconfdir, and is also # hard-coded in g_initialize.c. mkdir -m 755 -p $RPM_BUILD_ROOT/etc/gss/mech.d # If the default configuration needs to start specifying a default cache # location, add it now, then fixup the timestamp so that it looks the same. %if 0%{?configure_default_ccache_name} export DEFCCNAME="%{configured_default_ccache_name}" awk '{print} /^# default_realm/{print " default_ccache_name =", ENVIRON["DEFCCNAME"]}' \ %{SOURCE6} > $RPM_BUILD_ROOT/etc/krb5.conf touch -r %{SOURCE6} $RPM_BUILD_ROOT/etc/krb5.conf grep default_ccache_name $RPM_BUILD_ROOT/etc/krb5.conf %endif # Server init scripts (krb5kdc,kadmind,kpropd) and their sysconfig files. %if %{with systemd} mkdir -p $RPM_BUILD_ROOT%{_unitdir} for unit in \ %{SOURCE200} \ %{SOURCE201} \ %{SOURCE202} ; do # In the past, the init script was supposed to be named after the service # that the started daemon provided. Changing their names is an # upgrade-time problem I'm in no hurry to deal with. install -pm 644 ${unit} $RPM_BUILD_ROOT%{_unitdir} done mkdir -p $RPM_BUILD_ROOT/%{_tmpfilesdir} install -pm 644 %{SOURCE203} $RPM_BUILD_ROOT/%{_tmpfilesdir}/ %else mkdir -p $RPM_BUILD_ROOT/etc/rc.d/init.d for init in \ %{SOURCE5}\ %{SOURCE4} \ %{SOURCE2} ; do # In the past, the init script was supposed to be named after the # service that the started daemon provided. Changing their names # is an upgrade-time problem I'm in no hurry to deal with. service=`basename ${init} .init` install -pm 755 ${init} \ $RPM_BUILD_ROOT/etc/rc.d/init.d/${service%d} done %endif mkdir -p $RPM_BUILD_ROOT/etc/sysconfig for sysconfig in \ %{SOURCE19}\ %{SOURCE20}\ %{SOURCE21} ; do install -pm 644 ${sysconfig} \ $RPM_BUILD_ROOT/etc/sysconfig/`basename ${sysconfig} .sysconfig` done %if !%{with systemd} # portreserve configuration files. mkdir -p $RPM_BUILD_ROOT/etc/portreserve for portreserve in \ %{SOURCE30} \ %{SOURCE31} \ %{SOURCE32} ; do install -pm 644 ${portreserve} \ $RPM_BUILD_ROOT/etc/portreserve/`basename ${portreserve} .portreserve` done %endif # logrotate configuration files mkdir -p $RPM_BUILD_ROOT/etc/logrotate.d/ for logrotate in \ %{SOURCE33} \ %{SOURCE34} ; do install -pm 644 ${logrotate} \ $RPM_BUILD_ROOT/etc/logrotate.d/`basename ${logrotate} .logrotate` done # PAM configuration files. mkdir -p $RPM_BUILD_ROOT/etc/pam.d/ for pam in \ %{SOURCE29} ; do install -pm 644 ${pam} \ $RPM_BUILD_ROOT/etc/pam.d/`basename ${pam} .pamd` done # Plug-in directories. install -pdm 755 $RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/preauth install -pdm 755 $RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/kdb install -pdm 755 $RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/authdata # The rest of the binaries, headers, libraries, and docs. make -C src DESTDIR=$RPM_BUILD_ROOT EXAMPLEDIR=%{_docdir}/krb5-libs-%{version}/examples install # Munge krb5-config yet again. This is totally wrong for 64-bit, but chunks # of the buildconf patch already conspire to strip out /usr/ from the # list of link flags, and it helps prevent file conflicts on multilib systems. sed -r -i -e 's|^libdir=/usr/lib(64)?$|libdir=/usr/lib|g' $RPM_BUILD_ROOT%{_bindir}/krb5-config # Temporay workaround for krb5-config reading too much from LDFLAGS. # Upstream: http://krbdev.mit.edu/rt/Ticket/Display.html?id=8159 sed -r -i -e "s/-specs=\/.+?\/redhat-hardened-ld//g" $RPM_BUILD_ROOT%{_bindir}/krb5-config if [[ "$(< $RPM_BUILD_ROOT%{_bindir}/krb5-config )" == *redhat-hardened-ld* ]] ; then printf '# redhat-hardened-ld for krb5-config failed' 1>&2 exit 1 fi # Install processed man pages. for section in 1 5 8 ; do install -m 644 src/man/rst_man/*.${section} \ $RPM_BUILD_ROOT/%{_mandir}/man${section}/ done # Move specific libraries from %{_libdir} to /%{_lib}, and fixup the symlinks. touch $RPM_BUILD_ROOT/rootfile rellibdir=.. while ! test -r $RPM_BUILD_ROOT/%{_libdir}/${rellibdir}/rootfile ; do rellibdir=../${rellibdir} done rm -f $RPM_BUILD_ROOT/rootfile mkdir -p $RPM_BUILD_ROOT/%{_lib} for library in libgssapi_krb5 libgssrpc libk5crypto libkrb5 libkrb5support ; do mv $RPM_BUILD_ROOT/%{_libdir}/${library}.so.* $RPM_BUILD_ROOT/%{_lib}/ pushd $RPM_BUILD_ROOT/%{_libdir} ln -fs ${rellibdir}/%{_lib}/${library}.so.*.* ${library}.so popd done # This script just tells you to send bug reports to krb5-bugs@mit.edu, but # since we don't have a man page for it, just drop it. rm -- "$RPM_BUILD_ROOT/%{_sbindir}/krb5-send-pr" # These files are already packaged elsewhere rm -f -- "$RPM_BUILD_ROOT/%{_docdir}/krb5-libs/examples/kdc.conf" rm -f -- "$RPM_BUILD_ROOT/%{_docdir}/krb5-libs/examples/krb5.conf" rm -f -- "$RPM_BUILD_ROOT/%{_docdir}/krb5-libs/examples/services.append" # This is only needed for tests rm -f -- "$RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/preauth/test.so" %find_lang %{gettext_domain} %clean [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT %post libs -p /sbin/ldconfig %postun libs -p /sbin/ldconfig %post server-ldap -p /sbin/ldconfig %postun server-ldap -p /sbin/ldconfig %post server # Remove the init script for older servers. %if %{with systemd} %systemd_post krb5kdc.service kadmin.service kprop.service # assert sanity. A cleaner solution probably exists but it is opaque /bin/systemctl daemon-reload %else [ -x /etc/rc.d/init.d/krb5server ] && /sbin/chkconfig --del krb5server # Install the new ones. /sbin/chkconfig --add krb5kdc /sbin/chkconfig --add kadmin /sbin/chkconfig --add kprop %endif exit 0 %preun server %if %{with systemd} %systemd_preun krb5kdc.service kadmin.service kprop.service %else if [ "$1" -eq "0" ] ; then /sbin/chkconfig --del krb5kdc /sbin/chkconfig --del kadmin /sbin/chkconfig --del kprop /sbin/service krb5kdc stop > /dev/null 2>&1 || : /sbin/service kadmin stop > /dev/null 2>&1 || : /sbin/service kprop stop > /dev/null 2>&1 || : fi %endif exit 0 %postun server %if %{with systemd} %systemd_postun_with_restart krb5kdc.service kadmin.service kprop.service %else if [ "$1" -ge 1 ] ; then /sbin/service krb5kdc condrestart > /dev/null 2>&1 || : /sbin/service kadmin condrestart > /dev/null 2>&1 || : /sbin/service kprop condrestart > /dev/null 2>&1 || : fi %endif exit 0 %triggerun server -- krb5-server < 1.6.3-100 %if !%{with systemd} if [ "$2" -eq "0" ] ; then /sbin/install-info --delete %{_infodir}/krb425.info.gz %{_infodir}/dir /sbin/service krb524 stop > /dev/null 2>&1 || : /sbin/chkconfig --del krb524 > /dev/null 2>&1 || : fi exit 0 %endif %triggerun libs -- krb5-libs < 1.16-2 if grep -q '^includedir /etc/krb5.conf.d' /etc/krb5.conf ; then perl -pi \ -e 's|^includedir /etc/krb5.conf.d|#includedir /etc/krb5.conf.d|' \ /etc/krb5.conf fi exit 0 %post -n compat32-%{name}-libs -p /sbin/ldconfig %postun -n compat32-%{name}-libs -p /sbin/ldconfig %files workstation %defattr(-,root,root,-) %doc src/config-files/services.append %doc src/config-files/krb5.conf %attr(0755,root,root) %doc src/config-files/convert-config-files # Clients of the KDC, including tools you're likely to need if you're running # app servers other than those built from this source package. %{_bindir}/kdestroy %{_mandir}/man1/kdestroy.1* %{_bindir}/kinit %{_mandir}/man1/kinit.1* %{_bindir}/klist %{_mandir}/man1/klist.1* %{_bindir}/kpasswd %{_mandir}/man1/kpasswd.1* %{_bindir}/kswitch %{_mandir}/man1/kswitch.1* %{_bindir}/kvno %{_mandir}/man1/kvno.1* %{_bindir}/kadmin %{_mandir}/man1/kadmin.1* %{_bindir}/k5srvutil %{_mandir}/man1/k5srvutil.1* %{_bindir}/ktutil %{_mandir}/man1/ktutil.1* # Doesn't really fit anywhere else. %attr(4755,root,root) %{_bindir}/ksu %{_mandir}/man1/ksu.1* %config(noreplace) /etc/pam.d/ksu %files server %defattr(-,root,root,-) %docdir %{_mandir} %doc src/config-files/kdc.conf %if %{with systemd} %{_unitdir}/krb5kdc.service %{_unitdir}/kadmin.service %{_unitdir}/kprop.service %{_tmpfilesdir}/krb5-krb5kdc.conf %else /etc/rc.d/init.d/krb5kdc /etc/rc.d/init.d/kadmin /etc/rc.d/init.d/kprop %dir /etc/portreserve %config(noreplace) /etc/portreserve/kerberos-iv %config(noreplace) /etc/portreserve/kerberos-adm %config(noreplace) /etc/portreserve/krb5_prop %endif %config(noreplace) /etc/sysconfig/krb5kdc %config(noreplace) /etc/sysconfig/kadmin %config(noreplace) /etc/sysconfig/kprop %config(noreplace) /etc/logrotate.d/krb5kdc %config(noreplace) /etc/logrotate.d/kadmind %dir %{_var}/kerberos %dir %{_var}/kerberos/krb5kdc %config(noreplace) %{_var}/kerberos/krb5kdc/kdc.conf %config(noreplace) %{_var}/kerberos/krb5kdc/kadm5.acl %dir %{_libdir}/krb5 %dir %{_libdir}/krb5/plugins %dir %{_libdir}/krb5/plugins/kdb %dir %{_libdir}/krb5/plugins/preauth %dir %{_libdir}/krb5/plugins/authdata %{_libdir}/krb5/plugins/preauth/otp.so %{_libdir}/krb5/plugins/kdb/db2.so # KDC binaries and configuration. %{_mandir}/man5/kadm5.acl.5* %{_mandir}/man5/kdc.conf.5* %{_sbindir}/kadmin.local %{_mandir}/man8/kadmin.local.8* %{_sbindir}/kadmind %{_mandir}/man8/kadmind.8* %{_sbindir}/kdb5_util %{_mandir}/man8/kdb5_util.8* %{_sbindir}/kprop %{_mandir}/man8/kprop.8* %{_sbindir}/kpropd %{_mandir}/man8/kpropd.8* %{_sbindir}/kproplog %{_mandir}/man8/kproplog.8* %{_sbindir}/krb5kdc %{_mandir}/man8/krb5kdc.8* # This is here for people who want to test their server, and also # included in devel package for similar reasons. %{_bindir}/sclient %{_mandir}/man1/sclient.1* %{_sbindir}/sserver %{_mandir}/man8/sserver.8* %if %{WITH_LDAP} %files server-ldap %defattr(-,root,root,-) %docdir %{_mandir} %doc src/plugins/kdb/ldap/libkdb_ldap/kerberos.ldif %doc src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema %doc 60kerberos.ldif %dir %{_libdir}/krb5 %dir %{_libdir}/krb5/plugins %dir %{_libdir}/krb5/plugins/kdb %{_libdir}/krb5/plugins/kdb/kldap.so %{_libdir}/libkdb_ldap.so %{_libdir}/libkdb_ldap.so.* %{_mandir}/man8/kdb5_ldap_util.8.gz %{_sbindir}/kdb5_ldap_util %endif %files libs -f %{gettext_domain}.lang %defattr(-,root,root,-) %doc README NOTICE LICENSE %docdir %{_mandir} %dir /etc/gss %dir /etc/gss/mech.d %dir /etc/krb5.conf.d %config(noreplace) /etc/krb5.conf /%{_mandir}/man5/.k5identity.5* /%{_mandir}/man5/.k5login.5* /%{_mandir}/man5/k5identity.5* /%{_mandir}/man5/k5login.5* /%{_mandir}/man5/krb5.conf.5* /%{_mandir}/man7/kerberos.7* /%{_lib}/libgssapi_krb5.so.* /%{_lib}/libgssrpc.so.* /%{_lib}/libk5crypto.so.* %{_libdir}/libkadm5clnt_mit.so.* %{_libdir}/libkadm5srv_mit.so.* %{_libdir}/libkdb5.so.* %{_libdir}/libkrad.so.* /%{_lib}/libkrb5.so.* /%{_lib}/libkrb5support.so.* %dir %{_libdir}/krb5 %dir %{_libdir}/krb5/plugins %dir %{_libdir}/krb5/plugins/* %{_libdir}/krb5/plugins/tls/k5tls.so %{_libdir}/krb5/plugins/preauth/spake.so %dir %{_var}/kerberos %dir %{_var}/kerberos/krb5 %dir %{_var}/kerberos/krb5/user %if ! %{WITH_SYSVERTO} %{_libdir}/libverto.so %{_libdir}/libverto.so.* %endif %if %{WITH_OPENSSL} %files pkinit-openssl %defattr(-,root,root,-) %dir %{_libdir}/krb5 %dir %{_libdir}/krb5/plugins %dir %{_libdir}/krb5/plugins/preauth %{_libdir}/krb5/plugins/preauth/pkinit.so %endif %files devel %defattr(-,root,root,-) %docdir %{_mandir} %{_includedir}/* %{_libdir}/libgssapi_krb5.so %{_libdir}/libgssrpc.so %{_libdir}/libk5crypto.so %{_libdir}/libkadm5clnt.so %{_libdir}/libkadm5clnt_mit.so %{_libdir}/libkadm5srv.so %{_libdir}/libkadm5srv_mit.so %{_libdir}/libkdb5.so %{_libdir}/libkrad.so %{_libdir}/libkrb5.so %{_libdir}/libkrb5support.so %if %{build_static} %{_libdir}/*.a %endif %{_libdir}/pkgconfig/* %{_bindir}/krb5-config %{_mandir}/man1/krb5-config.1* %{_bindir}/sclient %{_mandir}/man1/sclient.1* %{_mandir}/man8/sserver.8* %{_sbindir}/sserver # Protocol test clients. %{_bindir}/sim_client %{_bindir}/gss-client %{_bindir}/uuclient # Protocol test servers. %{_sbindir}/sim_server %{_sbindir}/gss-server %{_sbindir}/uuserver # compat32 %if %{build_compat32} %files -n compat32-%{name}-libs %defattr(-,root,root) /%{_lib}/libgssapi_krb5.so.* /%{_lib}/libgssrpc.so.* /%{_lib}/libk5crypto.so.* %{_libdir}/libkadm5clnt_mit.so.* %{_libdir}/libkadm5srv_mit.so.* %{_libdir}/libkdb5.so.* /%{_lib}/libkrb5.so.* /%{_lib}/libkrb5support.so.* %dir %{_libdir}/krb5 %dir %{_libdir}/krb5/plugins %dir %{_libdir}/krb5/plugins/* %{_libdir}/krb5/plugins/tls/k5tls.so %{_libdir}/krb5/plugins/preauth/spake.so %if %{WITH_OPENSSL} %files -n compat32-%{name}-pkinit-openssl %defattr(-,root,root) %dir %{_libdir}/krb5 %dir %{_libdir}/krb5/plugins %dir %{_libdir}/krb5/plugins/preauth %{_libdir}/krb5/plugins/preauth/pkinit.so %endif %files -n compat32-%{name}-devel %defattr(-,root,root) %{_libdir}/libgssapi_krb5.so %{_libdir}/libgssrpc.so %{_libdir}/libk5crypto.so %{_libdir}/libkadm5clnt.so %{_libdir}/libkadm5clnt_mit.so %{_libdir}/libkadm5srv.so %{_libdir}/libkadm5srv_mit.so %{_libdir}/libkdb5.so %{_libdir}/libkrad.so %{_libdir}/libkrb5.so %{_libdir}/libkrb5support.so %if %{build_static} %{_libdir}/*.a %endif %{_libdir}/pkgconfig/* %endif %changelog * Thu Nov 26 2020 Tomohiro "Tomo-p" KATO 1.18.3-1 - updated to 1.18.3. - dropped all patches. - imported patches from rawhide. * Wed Apr 08 2020 Tomohiro "Tomo-p" KATO 1.18-1 - updated to 1.18. - added systemd support (disabled as default). - dropped all patches. - imported patches from rawhide. * Thu Nov 01 2018 Tomohiro "Tomo-p" KATO 1.16.1-1 - updated to 1.16.1. * Wed Feb 28 2018 Tomohiro "Tomo-p" KATO 1.16-2 - fixed /etc/krb5.conf. * Wed Feb 28 2018 Tomohiro "Tomo-p" KATO 1.16-1 - updated to 1.16. * Mon Aug 1 2016 Tomohiro "Tomo-p" KATO 1.14.3-1 - updated to 1.14.3. * Wed May 25 2016 Tomohiro "Tomo-p" KATO 1.14.2-1 - updated to 1.14.2. * Tue Mar 19 2013 Daisuke SUZUKI 1.11.1-1 - update to 1.11.1 * Thu Sep 20 2012 Satoshi IWAMOTO 1.8.2-7 - add patch83 for fix CVE-2012-1015 (MITKRB5-SA-2012-001) - add patch84 for fix CVE-2012-1013 (kadmind) * Thu Jan 5 2012 Satoshi IWAMOTO 1.8.2-6 - add patch82 for fix CVE-2011-1528,29 and CVE-2011-4151 - add Vendor/Distribution tags * Wed Apr 20 2011 IWAI, Masaharu 1.8.2-5 - add MITKRB5SA-2011-004 patch (Patch81, CVE-2011-0285) * Wed Mar 23 2011 Daisuke SUZUKI 1.8.2-4 - add BR: e2fsprogs-devel - add R: e2fsprogs-devel to -devel subpackage - fix krb5-server dependency - R: initscripts >= 8.91.3-1 * Mon Mar 21 2011 Satoshi IWAMOTO 1.8.2-3 - fix compat32-devel package missing... * Mon Mar 21 2011 Satoshi IWAMOTO 1.8.2-2 - add Obsoletes: krb5-workstation-clients, krb5-workstation-servers into workstation pkg * Sun Mar 20 2011 Satoshi IWAMOTO 1.8.2-1 - new upstream release 1.8 - this package based on rhel6 * Mon Mar 14 2011 Nalin Dahyabhai 1.8.2-3.6 - add revised upstream patch to fix double-free in KDC while returning typed-data with errors (CVE-2011-0284, #681564) * Mon Jan 10 2011 Yoji TOYODA 1.6.3-8 - rebuild with openssl-1.0.0c - add Patch500 (krb5-1.6.3-openssl-1.0.0-vine.patch) - change BuildRequires: texlive instead of tetex-latex * Fri May 21 2010 Satoshi IWAMOTO 1.6.3-7 - add patch87 for fix CVE-2010-1321 (GSS API Null pointer def) * Sat Apr 10 2010 Satoshi IWAMOTO 1.6.3-6 - add patch86 for fix CVE-2010-0629 (kadmind DoS) - add Vendor/Distribution tags * Thu Jan 14 2010 Satoshi IWAMOTO 1.6.3-5 - add Patch85 for fix CVE-2009-4212 (AES and RC4 Decryption) * Sat Jun 27 2009 NAKAMURA Kenta 1.6.3-4 - added compat32 package for x86_64 arch support * Wed Apr 22 2009 Daisuke SUZUKI 1.6.3-3 - add Patch80: update backport of the preauth module interface - add Patch82: fix CVE-2009-0844,0845 - add Patch83: fix CVE-2009-0846 - add Patch84: fix CVE-2009-0847 * Sat Apr 04 2009 Daisuke SUZUKI 1.6.3-2 - rebuild with openldap-2.4.11 * Thu Oct 02 2008 Daisuke SUZUKI 1.6.3-1 - initial build for Vine Linux * Tue Aug 5 2008 Tom "spot" Callaway 1.6.3-16 - fix license tag * Wed Jul 16 2008 Nalin Dahyabhai - clear fuzz out of patches, dropping a man page patch which is no longer necessary - quote %%{__cc} where needed because it includes whitespace now - define ASN1BUF_OMIT_INLINE_FUNCS at compile-time (for now) to keep building * Fri Jul 11 2008 Nalin Dahyabhai 1.6.3-15 - build with -fno-strict-aliasing, which is needed because the library triggers these warnings - don't forget to label principal database lock files - fix the labeling patch so that it doesn't break bootstrapping * Sat Jun 14 2008 Tom "spot" Callaway 1.6.3-14 - generate src/include/krb5/krb5.h before building - fix conditional for sparcv9 * Wed Apr 16 2008 Nalin Dahyabhai 1.6.3-13 - ftp: use the correct local filename during mget when the 'case' option is enabled (#442713) * Fri Apr 4 2008 Nalin Dahyabhai 1.6.3-12 - stop exporting kadmin keys to a keytab file when kadmind starts -- the daemon's been able to use the database directly for a long long time now - belatedly add aes128,aes256 to the default set of supported key types * Tue Apr 1 2008 Nalin Dahyabhai 1.6.3-11 - libgssapi_krb5: properly export the acceptor subkey when creating a lucid context (Kevin Coffman, via the nfs4 mailing list) * Tue Mar 18 2008 Nalin Dahyabhai 1.6.3-10 - add fixes from MITKRB5-SA-2008-001 for use of null or dangling pointer when v4 compatibility is enabled on the KDC (CVE-2008-0062, CVE-2008-0063, #432620, #432621) - add fixes from MITKRB5-SA-2008-002 for array out-of-bounds accesses when high-numbered descriptors are used (CVE-2008-0947, #433596) - add backport bug fix for an attempt to free non-heap memory in libgssapi_krb5 (CVE-2007-5901, #415321) - add backport bug fix for a double-free in out-of-memory situations in libgssapi_krb5 (CVE-2007-5971, #415351) * Tue Mar 18 2008 Nalin Dahyabhai 1.6.3-9 - rework file labeling patch to not depend on fragile preprocessor trickery, in another attempt at fixing #428355 and friends * Tue Feb 26 2008 Nalin Dahyabhai 1.6.3-8 - ftp: add patch to fix "runique on" case when globbing fixes applied - stop adding a redundant but harmless call to initialize the gssapi internals * Mon Feb 25 2008 Nalin Dahyabhai - add patch to suppress double-processing of /etc/krb5.conf when we build with --sysconfdir=/etc, thereby suppressing double-logging (#231147) * Mon Feb 25 2008 Nalin Dahyabhai - remove a patch, to fix problems with interfaces which are "up" but which have no address assigned, which conflicted with a different fix for the same problem in 1.5 (#200979) * Mon Feb 25 2008 Nalin Dahyabhai - ftp: don't lose track of a descriptor on passive get when the server fails to open a file * Mon Feb 25 2008 Nalin Dahyabhai - in login, allow PAM to interact with the user when they've been strongly authenticated - in login, signal PAM when we're changing an expired password that it's an expired password, so that when cracklib flags a password as being weak it's treated as an error even if we're running as root * Mon Feb 18 2008 Nalin Dahyabhai 1.6.3-7 - drop netdb patch - kdb_ldap: add patch to treat 'nsAccountLock: true' as an indication that the DISALLOW_ALL_TIX flag is set on an entry, for better interop with Fedora, Netscape, Red Hat Directory Server (Simo Sorce) * Wed Feb 13 2008 Nalin Dahyabhai 1.6.3-6 - patch to avoid depending on to define NI_MAXHOST and NI_MAXSERV * Tue Feb 12 2008 Nalin Dahyabhai 1.6.3-5 - enable patch for key-expiration reporting - enable patch to make kpasswd fall back to TCP if UDP fails (#251206) - enable patch to make kpasswd use the right sequence number on retransmit - enable patch to allow mech-specific creds delegated under spnego to be found when searching for creds * Wed Jan 2 2008 Nalin Dahyabhai 1.6.3-4 - some init script cleanups - drop unquoted check and silent exit for "$NETWORKING" (#426852, #242502) - krb524: don't barf on missing database if it looks like we're using kldap, same as for kadmin - return non-zero status for missing files which cause startup to fail (#242502) * Tue Dec 18 2007 Nalin Dahyabhai 1.6.3-3 - allocate space for the nul-terminator in the local pathname when looking up a file context, and properly free a previous context (Jose Plans, #426085) * Wed Dec 5 2007 Nalin Dahyabhai 1.6.3-2 - rebuild * Tue Oct 23 2007 Nalin Dahyabhai 1.6.3-1 - update to 1.6.3, dropping now-integrated patches for CVE-2007-3999 and CVE-2007-4000 (the new pkinit module is built conditionally and goes into the -pkinit-openssl package, at least for now, to make a buildreq loop with openssl avoidable) * Wed Oct 17 2007 Nalin Dahyabhai 1.6.2-10 - make proper use of pam_loginuid and pam_selinux in rshd and ftpd * Fri Oct 12 2007 Nalin Dahyabhai - make krb5.conf %%verify(not md5 size mtime) in addition to %%config(noreplace), like /etc/nsswitch.conf (#329811) * Mon Oct 1 2007 Nalin Dahyabhai 1.6.2-9 - apply the fix for CVE-2007-4000 instead of the experimental patch for setting ok-as-delegate flags * Tue Sep 11 2007 Nalin Dahyabhai 1.6.2-8 - move the db2 kdb plugin from -server to -libs, because a multilib libkdb might need it * Tue Sep 11 2007 Nalin Dahyabhai 1.6.2-7 - also perform PAM session and credential management when ftpd accepts a client using strong authentication, missed earlier - also label kadmind log files and files created by the db2 plugin * Thu Sep 6 2007 Nalin Dahyabhai 1.6.2-6 - incorporate updated fix for CVE-2007-3999 (CVE-2007-4743) - fix incorrect call to "test" in the kadmin init script (#252322,#287291) * Tue Sep 4 2007 Nalin Dahyabhai 1.6.2-5 - incorporate fixes for MITKRB5-SA-2007-006 (CVE-2007-3999, CVE-2007-4000) * Sat Aug 25 2007 Nalin Dahyabhai 1.6.2-4 - cover more cases in labeling files on creation - add missing gawk build dependency * Thu Aug 23 2007 Nalin Dahyabhai 1.6.2-3 - rebuild * Thu Jul 26 2007 Nalin Dahyabhai 1.6.2-2 - kdc.conf: default to listening for TCP clients, too (#248415) * Thu Jul 19 2007 Nalin Dahyabhai 1.6.2-1 - update to 1.6.2 - add "buildrequires: texinfo-tex" to get texi2pdf * Wed Jun 27 2007 Nalin Dahyabhai 1.6.1-8 - incorporate fixes for MITKRB5-SA-2007-004 (CVE-2007-2442,CVE-2007-2443) and MITKRB5-SA-2007-005 (CVE-2007-2798) * Mon Jun 25 2007 Nalin Dahyabhai 1.6.1-7 - reintroduce missing %%postun for the non-split_workstation case * Mon Jun 25 2007 Nalin Dahyabhai 1.6.1-6 - rebuild * Mon Jun 25 2007 Nalin Dahyabhai 1.6.1-5.1 - rebuild * Sun Jun 24 2007 Nalin Dahyabhai 1.6.1-5 - add missing pam-devel build requirement, force selinux-or-fail build * Sun Jun 24 2007 Nalin Dahyabhai 1.6.1-4 - rebuild * Sun Jun 24 2007 Nalin Dahyabhai 1.6.1-3 - label all files at creation-time according to the SELinux policy (#228157) * Fri Jun 22 2007 Nalin Dahyabhai - perform PAM account / session management in krshd (#182195,#195922) - perform PAM authentication and account / session management in ftpd - perform PAM authentication, account / session management, and password- changing in login.krb5 (#182195,#195922) * Fri Jun 22 2007 Nalin Dahyabhai - preprocess kerberos.ldif into a format FDS will like better, and include that as a doc file as well * Fri Jun 22 2007 Nalin Dahyabhai - switch man pages to being generated with the right paths in them - drop old, incomplete SELinux patch - add patch from Greg Hudson to make srvtab routines report missing-file errors at same point that keytab routines do (#241805) * Thu May 24 2007 Nalin Dahyabhai 1.6.1-2 - pull patch from svn to undo unintentional chattiness in ftp - pull patch from svn to handle NULL krb5_get_init_creds_opt structures better in a couple of places where they're expected * Wed May 23 2007 Nalin Dahyabhai 1.6.1-1 - update to 1.6.1 - drop no-longer-needed patches for CVE-2007-0956,CVE-2007-0957,CVE-2007-1216 - drop patch for sendto bug in 1.6, fixed in 1.6.1 * Fri May 18 2007 Nalin Dahyabhai - kadmind.init: don't fail outright if the default principal database isn't there if it looks like we might be using the kldap plugin - kadmind.init: attempt to extract the key for the host-specific kadmin service when we try to create the keytab * Wed May 16 2007 Nalin Dahyabhai 1.6-6 - omit dependent libraries from the krb5-config --libs output, as using shared libraries (no more static libraries) makes them unnecessary and they're not part of the libkrb5 interface (patch by Rex Dieter, #240220) (strips out libkeyutils, libresolv, libdl) * Fri May 4 2007 Nalin Dahyabhai 1.6-5 - pull in keyutils as a build requirement to get the "KEYRING:" ccache type, because we've merged * Fri May 4 2007 Nalin Dahyabhai 1.6-4 - fix an uninitialized length value which could cause a crash when parsing key data coming from a directory server - correct a typo in the krb5.conf man page ("ldap_server"->"ldap_servers") * Fri Apr 13 2007 Nalin Dahyabhai - move the default acl_file, dict_file, and admin_keytab settings to the part of the default/example kdc.conf where they'll actually have an effect (#236417) * Thu Apr 5 2007 Nalin Dahyabhai 1.5-24 - merge security fixes from RHSA-2007:0095 * Tue Apr 3 2007 Nalin Dahyabhai 1.6-3 - add patch to correct unauthorized access via krb5-aware telnet daemon (#229782, CVE-2007-0956) - add patch to fix buffer overflow in krb5kdc and kadmind (#231528, CVE-2007-0957) - add patch to fix double-free in kadmind (#231537, CVE-2007-1216) * Thu Mar 22 2007 Nalin Dahyabhai - back out buildrequires: keyutils-libs-devel for now * Thu Mar 22 2007 Nalin Dahyabhai 1.6-2 - add buildrequires: on keyutils-libs-devel to enable use of keyring ccaches, dragging keyutils-libs in as a dependency * Mon Mar 19 2007 Nalin Dahyabhai 1.5-23 - fix bug ID in changelog * Thu Mar 15 2007 Nalin Dahyabhai 1.5-22 * Thu Mar 15 2007 Nalin Dahyabhai 1.5-21 - add preliminary patch to fix buffer overflow in krb5kdc and kadmind (#231528, CVE-2007-0957) - add preliminary patch to fix double-free in kadmind (#231537, CVE-2007-1216) * Wed Feb 28 2007 Nalin Dahyabhai - add patch to build semi-useful static libraries, but don't apply it unless we need them * Tue Feb 27 2007 Nalin Dahyabhai - 1.5-20 - temporarily back out %%post changes, fix for #143289 for security update - add preliminary patch to correct unauthorized access via krb5-aware telnet * Mon Feb 19 2007 Nalin Dahyabhai - make profile.d scriptlets mode 644 instead of 755 (part of #225974) * Tue Jan 30 2007 Nalin Dahyabhai 1.6-1 - clean up quoting of command-line arguments passed to the krsh/krlogin wrapper scripts * Mon Jan 22 2007 Nalin Dahyabhai - initial update to 1.6, pre-package-reorg - move workstation daemons to a new subpackage (#81836, #216356, #217301), and make the new subpackage require xinetd (#211885) * Mon Jan 22 2007 Nalin Dahyabhai - 1.5-18 - make use of install-info more failsafe (Ville Skyttä, #223704) - preserve timestamps on shell scriptlets at %%install-time * Tue Jan 16 2007 Nalin Dahyabhai - 1.5-17 - move to using pregenerated PDF docs to cure multilib conflicts (#222721) * Fri Jan 12 2007 Nalin Dahyabhai - 1.5-16 - update backport of the preauth module interface (part of #194654) * Tue Jan 9 2007 Nalin Dahyabhai - 1.5-14 - apply fixes from Tom Yu for MITKRB5-SA-2006-002 (CVE-2006-6143) (#218456) - apply fixes from Tom Yu for MITKRB5-SA-2006-003 (CVE-2006-6144) (#218456) * Wed Dec 20 2006 Nalin Dahyabhai - 1.5-12 - update backport of the preauth module interface * Mon Oct 30 2006 Nalin Dahyabhai - update backport of the preauth module interface - add proposed patches 4566, 4567 - add proposed edata reporting interface for KDC - add temporary placeholder for module global context fixes * Mon Oct 23 2006 Nalin Dahyabhai - 1.5-11 - don't bail from the KDC init script if there's no database, it may be in a different location than the default (fenlason) - remove the [kdc] section from the default krb5.conf -- doesn't seem to have been applicable for a while * Wed Oct 18 2006 Nalin Dahyabhai - 1.5-10 - rename krb5.sh and krb5.csh so that they don't overlap (#210623) - way-late application of added error info in kadmind.init (#65853) * Wed Oct 18 2006 Nalin Dahyabhai - 1.5-9.pal_18695 - add backport of in-development preauth module interface (#208643) * Mon Oct 9 2006 Nalin Dahyabhai - 1.5-9 - provide docs in PDF format instead of as tex source (Enrico Scholz, #209943) * Wed Oct 4 2006 Nalin Dahyabhai - 1.5-8 - add missing shebang headers to krsh and krlogin wrapper scripts (#209238) * Wed Sep 6 2006 Nalin Dahyabhai - 1.5-7 - set SS_LIB at configure-time so that libss-using apps get working readline support (#197044) * Fri Aug 18 2006 Nalin Dahyabhai - 1.5-6 - switch to the updated patch for MITKRB-SA-2006-001 * Tue Aug 8 2006 Nalin Dahyabhai - 1.5-5 - apply patch to address MITKRB-SA-2006-001 (CVE-2006-3084) * Mon Aug 7 2006 Nalin Dahyabhai - 1.5-4 - ensure that the gssapi library's been initialized before walking the internal mechanism list in gss_release_oid(), needed if called from gss_release_name() right after a gss_import_name() (#198092) * Tue Jul 25 2006 Nalin Dahyabhai - 1.5-3 - rebuild * Tue Jul 25 2006 Nalin Dahyabhai - 1.5-2 - pull up latest revision of patch to reduce lockups in rsh/rshd * Mon Jul 17 2006 Nalin Dahyabhai - 1.5-1.2 - rebuild * Wed Jul 12 2006 Jesse Keating - 1.5-1.1 - rebuild * Thu Jul 6 2006 Nalin Dahyabhai 1.5-1 - build * Wed Jul 5 2006 Nalin Dahyabhai 1.5-0 - update to 1.5 * Fri Jun 23 2006 Nalin Dahyabhai 1.4.3-9 - mark profile.d config files noreplace (Laurent Rineau, #196447) * Thu Jun 8 2006 Nalin Dahyabhai 1.4.3-8 - add buildprereq for autoconf * Mon May 22 2006 Nalin Dahyabhai 1.4.3-7 - further munge krb5-config so that 'libdir=/usr/lib' is given even on 64-bit architectures, to avoid multilib conflicts; other changes will conspire to strip out the -L flag which uses this, so it should be harmless (#192692) * Fri Apr 28 2006 Nalin Dahyabhai 1.4.3-6 - adjust the patch which removes the use of rpath to also produce a krb5-config which is okay in multilib environments (#190118) - make the name-of-the-tempfile comment which compile_et adds to error code headers always list the same file to avoid conflicts on multilib installations - strip SIZEOF_LONG out of krb5.h so that it doesn't conflict on multilib boxes - strip GSS_SIZEOF_LONG out of gssapi.h so that it doesn't conflict on mulitlib boxes * Fri Apr 14 2006 Stepan Kasal 1.4.3-5 - Fix formatting typo in kinit.1 (krb5-kinit-man-typo.patch) * Fri Feb 10 2006 Jesse Keating 1.4.3-4.1 - bump again for double-long bug on ppc(64) * Mon Feb 6 2006 Nalin Dahyabhai 1.4.3-4 - give a little bit more information to the user when kinit gets the catch-all I/O error (#180175) * Thu Jan 19 2006 Nalin Dahyabhai 1.4.3-3 - rebuild properly when pthread_mutexattr_setrobust_np() is defined but not declared, such as with recent glibc when _GNU_SOURCE isn't being used * Thu Jan 19 2006 Matthias Clasen 1.4.3-2 - Use full paths in krb5.sh to avoid path lookups * Fri Dec 09 2005 Jesse Keating - rebuilt * Thu Dec 1 2005 Nalin Dahyabhai - login: don't truncate passwords before passing them into crypt(), in case they're significant (#149476) * Thu Nov 17 2005 Nalin Dahyabhai 1.4.3-1 - update to 1.4.3 - make ksu setuid again (#137934, others) * Tue Sep 13 2005 Nalin Dahyabhai 1.4.2-4 - mark %%{krb5prefix}/man so that files which are packaged within it are flagged as %%doc (#168163) * Tue Sep 6 2005 Nalin Dahyabhai 1.4.2-3 - add an xinetd configuration file for encryption-only telnetd, parallelling the kshell/ekshell pair (#167535) * Wed Aug 31 2005 Nalin Dahyabhai 1.4.2-2 - change the default configured encryption type for KDC databases to the compiled-in default of des3-hmac-sha1 (#57847) * Thu Aug 11 2005 Nalin Dahyabhai 1.4.2-1 - update to 1.4.2, incorporating the fixes for MIT-KRB5-SA-2005-002 and MIT-KRB5-SA-2005-003 * Wed Jun 29 2005 Nalin Dahyabhai 1.4.1-6 - rebuild * Wed Jun 29 2005 Nalin Dahyabhai 1.4.1-5 - fix telnet client environment variable disclosure the same way NetKit's telnet client did (CAN-2005-0488) (#159305) - keep apps which call krb5_principal_compare() or krb5_realm_compare() with malformed or NULL principal structures from crashing outright (Thomas Biege) (#161475) * Tue Jun 28 2005 Nalin Dahyabhai - apply fixes from draft of MIT-KRB5-SA-2005-002 (CAN-2005-1174,CAN-2005-1175) (#157104) - apply fixes from draft of MIT-KRB5-SA-2005-003 (CAN-2005-1689) (#159755) * Fri Jun 24 2005 Nalin Dahyabhai 1.4.1-4 - fix double-close in keytab handling - add port of fixes for CAN-2004-0175 to krb5-aware rcp (#151612) * Fri May 13 2005 Nalin Dahyabhai 1.4.1-3 - prevent spurious EBADF in krshd when stdin is closed by the client while the command is running (#151111) * Fri May 13 2005 Martin Stransky 1.4.1-2 - add deadlock patch, removed old patch * Fri May 6 2005 Nalin Dahyabhai 1.4.1-1 - update to 1.4.1, incorporating fixes for CAN-2005-0468 and CAN-2005-0469 - when starting the KDC or kadmind, if KRB5REALM is set via the /etc/sysconfig file for the service, pass it as an argument for the -r flag * Wed Mar 23 2005 Nalin Dahyabhai 1.4-3 - drop krshd patch for now * Thu Mar 17 2005 Nalin Dahyabhai - add draft fix from Tom Yu for slc_add_reply() buffer overflow (CAN-2005-0469) - add draft fix from Tom Yu for env_opt_add() buffer overflow (CAN-2005-0468) * Wed Mar 16 2005 Nalin Dahyabhai 1.4-2 - don't include into the telnet client when we're not using curses * Thu Feb 24 2005 Nalin Dahyabhai 1.4-1 - update to 1.4 - v1.4 kadmin client requires a v1.4 kadmind on the server, or use the "-O" flag to specify that it should communicate with the server using the older protocol - new libkrb5support library - v5passwdd and kadmind4 are gone - versioned symbols - pick up $KRB5KDC_ARGS from /etc/sysconfig/krb5kdc, if it exists, and pass it on to krb5kdc - pick up $KADMIND_ARGS from /etc/sysconfig/kadmin, if it exists, and pass it on to kadmind - pick up $KRB524D_ARGS from /etc/sysconfig/krb524, if it exists, and pass it on to krb524d *instead of* "-m" - set "forwardable" in [libdefaults] in the default krb5.conf to match the default setting which we supply for pam_krb5 - set a default of 24h for "ticket_lifetime" in [libdefaults], reflecting the compiled-in default * Mon Dec 20 2004 Nalin Dahyabhai 1.3.6-3 - rebuild * Mon Dec 20 2004 Nalin Dahyabhai 1.3.6-2 - rebuild * Mon Dec 20 2004 Nalin Dahyabhai 1.3.6-1 - update to 1.3.6, which includes the previous fix * Mon Dec 20 2004 Nalin Dahyabhai 1.3.5-8 - apply fix from Tom Yu for MITKRB5-SA-2004-004 (CAN-2004-1189) * Fri Dec 17 2004 Martin Stransky 1.3.5-7 - fix deadlock during file transfer via rsync/krsh - thanks goes to James Antill for hint * Fri Nov 26 2004 Nalin Dahyabhai 1.3.5-6 - rebuild * Mon Nov 22 2004 Nalin Dahyabhai 1.3.5-3 - fix predictable-tempfile-name bug in krb5-send-pr (CAN-2004-0971, #140036) * Tue Nov 16 2004 Nalin Dahyabhai - silence compiler warning in kprop by using an in-memory ccache with a fixed name instead of an on-disk ccache with a name generated by tmpnam() * Tue Nov 16 2004 Nalin Dahyabhai 1.3.5-2 - fix globbing patch port mode (#139075) * Mon Nov 1 2004 Nalin Dahyabhai 1.3.5-1 - fix segfault in telnet due to incorrect checking of gethostbyname_r result codes (#129059) * Fri Oct 15 2004 Nalin Dahyabhai - remove rc4-hmac:norealm and rc4-hmac:onlyrealm from the default list of supported keytypes in kdc.conf -- they produce exactly the same keys as rc4-hmac:normal because rc4 string-to-key ignores salts - nuke kdcrotate -- there are better ways to balance the load on KDCs, and the SELinux policy for it would have been scary-looking - update to 1.3.5, mainly to include MITKRB5SA 2004-002 and 2004-003 * Tue Aug 31 2004 Nalin Dahyabhai 1.3.4-7 - rebuild * Tue Aug 24 2004 Nalin Dahyabhai 1.3.4-6 - rebuild * Tue Aug 24 2004 Nalin Dahyabhai 1.3.4-5 - incorporate revised fixes from Tom Yu for CAN-2004-0642, CAN-2004-0644, CAN-2004-0772 * Mon Aug 23 2004 Nalin Dahyabhai 1.3.4-4 - rebuild * Mon Aug 23 2004 Nalin Dahyabhai 1.3.4-3 - incorporate fixes from Tom Yu for CAN-2004-0642, CAN-2004-0772 (MITKRB5-SA-2004-002, #130732) - incorporate fixes from Tom Yu for CAN-2004-0644 (MITKRB5-SA-2004-003, #130732) * Tue Jul 27 2004 Nalin Dahyabhai 1.3.4-2 - fix indexing error in server sorting patch (#127336) * Tue Jun 15 2004 Elliot Lee - rebuilt * Mon Jun 14 2004 Nalin Dahyabhai 1.3.4-0.1 - update to 1.3.4 final * Mon Jun 7 2004 Nalin Dahyabhai 1.3.4-0 - update to 1.3.4 beta1 - remove MITKRB5-SA-2004-001, included in 1.3.4 * Mon Jun 7 2004 Nalin Dahyabhai 1.3.3-8 - rebuild * Fri Jun 4 2004 Nalin Dahyabhai 1.3.3-7 - rebuild * Fri Jun 4 2004 Nalin Dahyabhai 1.3.3-6 - apply updated patch from MITKRB5-SA-2004-001 (revision 2004-06-02) * Tue Jun 1 2004 Nalin Dahyabhai 1.3.3-5 - rebuild * Tue Jun 1 2004 Nalin Dahyabhai 1.3.3-4 - apply patch from MITKRB5-SA-2004-001 (#125001) * Wed May 12 2004 Thomas Woerner 1.3.3-3 - removed rpath * Thu Apr 15 2004 Nalin Dahyabhai 1.3.3-2 - re-enable large file support, fell out in 1.3-1 - patch rcp to use long long and %%lld format specifiers when reporting file sizes on large files * Tue Apr 13 2004 Nalin Dahyabhai 1.3.3-1 - update to 1.3.3 * Wed Mar 10 2004 Nalin Dahyabhai 1.3.2-1 - update to 1.3.2 * Mon Mar 8 2004 Nalin Dahyabhai 1.3.1-12 - rebuild * Tue Mar 02 2004 Elliot Lee 1.3.1-11.1 - rebuilt * Fri Feb 13 2004 Elliot Lee 1.3.1-11 - rebuilt * Mon Feb 9 2004 Nalin Dahyabhai 1.3.1-10 - catch krb4 send_to_kdc cases in kdc preference patch * Mon Feb 2 2004 Nalin Dahyabhai 1.3.1-9 - remove patch to set TERM in klogind which, combined with the upstream fix in 1.3.1, actually produces the bug now (#114762) * Mon Jan 19 2004 Nalin Dahyabhai 1.3.1-8 - when iterating over lists of interfaces which are "up" from getifaddrs(), skip over those which have no address (#113347) * Mon Jan 12 2004 Nalin Dahyabhai - prefer the kdc which last replied to a request when sending requests to kdcs * Mon Nov 24 2003 Nalin Dahyabhai 1.3.1-7 - fix combination of --with-netlib and --enable-dns (#82176) * Tue Nov 18 2003 Nalin Dahyabhai - remove libdefault ticket_lifetime option from the default krb5.conf, it is ignored by libkrb5 * Thu Sep 25 2003 Nalin Dahyabhai 1.3.1-6 - fix bug in patch to make rlogind start login with a clean environment a la netkit rlogin, spotted and fixed by Scott McClung * Tue Sep 23 2003 Nalin Dahyabhai 1.3.1-5 - include profile.d scriptlets in krb5-devel so that krb5-config will be in the path if krb5-workstation isn't installed, reported by Kir Kolyshkin * Mon Sep 8 2003 Nalin Dahyabhai - add more etypes (arcfour) to the default enctype list in kdc.conf - don't apply previous patch, refused upstream * Fri Sep 5 2003 Nalin Dahyabhai 1.3.1-4 - fix 32/64-bit bug storing and retrieving the issue_date in v4 credentials * Wed Sep 3 2003 Dan Walsh 1.3.1-3 - Don't check for write access on /etc/krb5.conf if SELinux * Tue Aug 26 2003 Nalin Dahyabhai 1.3.1-2 - fixup some int/pointer varargs wackiness * Tue Aug 5 2003 Nalin Dahyabhai 1.3.1-1 - rebuild * Mon Aug 4 2003 Nalin Dahyabhai 1.3.1-0 - update to 1.3.1 * Thu Jul 24 2003 Nalin Dahyabhai 1.3-2 - pull fix for non-compliant encoding of salt field in etype-info2 preauth data from 1.3.1 beta 1, until 1.3.1 is released. * Mon Jul 21 2003 Nalin Dahyabhai 1.3-1 - update to 1.3 * Mon Jul 7 2003 Nalin Dahyabhai 1.2.8-4 - correctly use stdargs * Wed Jun 18 2003 Nalin Dahyabhai 1.3-0.beta.4 - test update to 1.3 beta 4 - ditch statglue build option - krb5-devel requires e2fsprogs-devel, which now provides libss and libcom_err * Wed Jun 04 2003 Elliot Lee - rebuilt * Wed May 21 2003 Jeremy Katz 1.2.8-2 - gcc 3.3 doesn't implement varargs.h, include stdarg.h instead * Wed Apr 9 2003 Nalin Dahyabhai 1.2.8-1 - update to 1.2.8 * Mon Mar 31 2003 Nalin Dahyabhai 1.2.7-14 - fix double-free of enc_part2 in krb524d * Fri Mar 21 2003 Nalin Dahyabhai 1.2.7-13 - update to latest patch kit for MITKRB5-SA-2003-004 * Wed Mar 19 2003 Nalin Dahyabhai 1.2.7-12 - add patch included in MITKRB5-SA-2003-003 (CAN-2003-0028) * Mon Mar 17 2003 Nalin Dahyabhai 1.2.7-11 - add patches from patchkit from MITKRB5-SA-2003-004 (CAN-2003-0138 and CAN-2003-0139) * Thu Mar 6 2003 Nalin Dahyabhai 1.2.7-10 - rebuild * Thu Mar 6 2003 Nalin Dahyabhai 1.2.7-9 - fix buffer underrun in unparsing certain principals (CAN-2003-0082) * Tue Feb 4 2003 Nalin Dahyabhai 1.2.7-8 - add patch to document the reject-bad-transited option in kdc.conf * Mon Feb 3 2003 Nalin Dahyabhai - add patch to fix server-side crashes when principals have no components (CAN-2003-0072) * Thu Jan 23 2003 Nalin Dahyabhai 1.2.7-7 - add patch from Mark Cox for exploitable bugs in ftp client * Wed Jan 22 2003 Tim Powers - rebuilt * Wed Jan 15 2003 Nalin Dahyabhai 1.2.7-5 - use PICFLAGS when building code from the ktany patch * Thu Jan 9 2003 Bill Nottingham 1.2.7-4 - debloat * Tue Jan 7 2003 Jeremy Katz 1.2.7-3 - include .so.* symlinks as well as .so.*.* * Mon Dec 9 2002 Jakub Jelinek 1.2.7-2 - always #include to access errno, never do it directly - enable LFS on a bunch of other 32-bit arches * Wed Dec 4 2002 Nalin Dahyabhai - increase the maximum name length allowed by kuserok() to the higher value used in development versions * Mon Dec 2 2002 Nalin Dahyabhai - install src/krb524/README as README.krb524 in the -servers package, includes information about converting for AFS principals * Fri Nov 15 2002 Nalin Dahyabhai 1.2.7-1 - update to 1.2.7 - disable use of tcl * Mon Nov 11 2002 Nalin Dahyabhai - update to 1.2.7-beta2 (internal only, not for release), dropping dnsparse and kadmind4 fixes * Wed Oct 23 2002 Nalin Dahyabhai 1.2.6-5 - add patch for buffer overflow in kadmind4 (not used by default) * Fri Oct 11 2002 Nalin Dahyabhai 1.2.6-4 - drop a hunk from the dnsparse patch which is actually redundant (thanks to Tom Yu) * Wed Oct 9 2002 Nalin Dahyabhai 1.2.6-3 - patch to handle truncated dns responses * Mon Oct 7 2002 Nalin Dahyabhai 1.2.6-2 - remove hashless key types from the default kdc.conf, they're not supposed to be there, noted by Sam Hartman on krbdev * Fri Sep 27 2002 Nalin Dahyabhai 1.2.6-1 - update to 1.2.6 * Fri Sep 13 2002 Nalin Dahyabhai 1.2.5-7 - use %%{_lib} for the sake of multilib systems * Fri Aug 2 2002 Nalin Dahyabhai 1.2.5-6 - add patch from Tom Yu for exploitable bugs in rpc code used in kadmind * Tue Jul 23 2002 Nalin Dahyabhai 1.2.5-5 - fix bug in krb5.csh which would cause the path check to always succeed * Fri Jul 19 2002 Jakub Jelinek 1.2.5-4 - build even libdb.a with -fPIC and $RPM_OPT_FLAGS. * Fri Jun 21 2002 Tim Powers - automated rebuild * Sun May 26 2002 Tim Powers - automated rebuild * Wed May 1 2002 Nalin Dahyabhai 1.2.5-1 - update to 1.2.5 - disable statglue * Fri Mar 1 2002 Nalin Dahyabhai 1.2.4-1 - update to 1.2.4 * Wed Feb 20 2002 Nalin Dahyabhai 1.2.3-5 - rebuild in new environment - reenable statglue * Sat Jan 26 2002 Florian La Roche - prereq chkconfig for the server subpackage * Wed Jan 16 2002 Nalin Dahyabhai 1.2.3-3 - build without -g3, which gives us large static libraries in -devel * Tue Jan 15 2002 Nalin Dahyabhai 1.2.3-2 - reintroduce ld.so.conf munging in the -libs %%post * Thu Jan 10 2002 Nalin Dahyabhai 1.2.3-1 - rename the krb5 package back to krb5-libs; the previous rename caused something of an uproar - update to 1.2.3, which includes the FTP and telnetd fixes - configure without --enable-dns-for-kdc --enable-dns-for-realm, which now set the default behavior instead of enabling the feature (the feature is enabled by --enable-dns, which we still use) - reenable optimizations on Alpha - support more encryption types in the default kdc.conf (heads-up from post to comp.protocols.kerberos by Jason Heiss) * Fri Aug 3 2001 Nalin Dahyabhai 1.2.2-14 - rename the krb5-libs package to krb5 (naming a subpackage -libs when there is no main package is silly) - move defaults for PAM to the appdefaults section of krb5.conf -- this is the area where the krb5_appdefault_* functions look for settings) - disable statglue (warning: breaks binary compatibility with previous packages, but has to be broken at some point to work correctly with unpatched versions built with newer versions of glibc) * Fri Aug 3 2001 Nalin Dahyabhai 1.2.2-13 - bump release number and rebuild * Wed Aug 1 2001 Nalin Dahyabhai - add patch to fix telnetd vulnerability * Fri Jul 20 2001 Nalin Dahyabhai - tweak statglue.c to fix stat/stat64 aliasing problems - be cleaner in use of gcc to build shlibs * Wed Jul 11 2001 Nalin Dahyabhai - use gcc to build shared libraries * Wed Jun 27 2001 Nalin Dahyabhai - add patch to support "ANY" keytab type (i.e., "default_keytab_name = ANY:FILE:/etc/krb5.keytab,SRVTAB:/etc/srvtab" patch from Gerald Britton, #42551) - build with -D_FILE_OFFSET_BITS=64 to get large file I/O in ftpd (#30697) - patch ftpd to use long long and %%lld format specifiers to support the SIZE command on large files (also #30697) - don't use LOG_AUTH as an option value when calling openlog() in ksu (#45965) - implement reload in krb5kdc and kadmind init scripts (#41911) - lose the krb5server init script (not using it any more) * Sun Jun 24 2001 Elliot Lee - Bump release + rebuild. * Tue May 29 2001 Nalin Dahyabhai - pass some structures by address instead of on the stack in krb5kdc * Tue May 22 2001 Nalin Dahyabhai - rebuild in new environment * Thu Apr 26 2001 Nalin Dahyabhai - add patch from Tom Yu to fix ftpd overflows (#37731) * Wed Apr 18 2001 Than Ngo - disable optimizations on the alpha again * Fri Mar 30 2001 Nalin Dahyabhai - add in glue code to make sure that libkrb5 continues to provide a weak copy of stat() * Thu Mar 15 2001 Nalin Dahyabhai - build alpha with -O0 for now * Thu Mar 8 2001 Nalin Dahyabhai - fix the kpropd init script * Mon Mar 5 2001 Nalin Dahyabhai - update to 1.2.2, which fixes some bugs relating to empty ETYPE-INFO - re-enable optimization on Alpha * Thu Feb 8 2001 Nalin Dahyabhai - build alpha with -O0 for now - own %{_var}/kerberos * Tue Feb 6 2001 Nalin Dahyabhai - own the directories which are created for each package (#26342) * Tue Jan 23 2001 Nalin Dahyabhai - gettextize init scripts * Fri Jan 19 2001 Nalin Dahyabhai - add some comments to the ksu patches for the curious - re-enable optimization on alphas * Mon Jan 15 2001 Nalin Dahyabhai - fix krb5-send-pr (#18932) and move it from -server to -workstation - buildprereq libtermcap-devel - temporariliy disable optimization on alphas - gettextize init scripts * Tue Dec 5 2000 Nalin Dahyabhai - force -fPIC * Fri Dec 1 2000 Nalin Dahyabhai - rebuild in new environment * Tue Oct 31 2000 Nalin Dahyabhai - add bison as a BuildPrereq (#20091) * Mon Oct 30 2000 Nalin Dahyabhai - change /usr/dict/words to /usr/share/dict/words in default kdc.conf (#20000) * Thu Oct 5 2000 Nalin Dahyabhai - apply kpasswd bug fixes from David Wragg * Wed Oct 4 2000 Nalin Dahyabhai - make krb5-libs obsolete the old krb5-configs package (#18351) - don't quit from the kpropd init script if there's no principal database so that you can propagate the first time without running kpropd manually - don't complain if /etc/ld.so.conf doesn't exist in the -libs %post * Tue Sep 12 2000 Nalin Dahyabhai - fix credential forwarding problem in klogind (goof in KRB5CCNAME handling) (#11588) - fix heap corruption bug in FTP client (#14301) * Wed Aug 16 2000 Nalin Dahyabhai - fix summaries and descriptions - switched the default transfer protocol from PORT to PASV as proposed on bugzilla (#16134), and to match the regular ftp package's behavior * Wed Jul 19 2000 Jeff Johnson - rebuild to compress man pages. * Sat Jul 15 2000 Bill Nottingham - move initscript back * Fri Jul 14 2000 Nalin Dahyabhai - disable servers by default to keep linuxconf from thinking they need to be started when they don't * Thu Jul 13 2000 Prospector - automatic rebuild * Mon Jul 10 2000 Nalin Dahyabhai - change cleanup code in post to not tickle chkconfig - add grep as a Prereq: for -libs * Thu Jul 6 2000 Nalin Dahyabhai - move condrestarts to postun - make xinetd configs noreplace - add descriptions to xinetd configs - add /etc/init.d as a prereq for the -server package - patch to properly truncate $TERM in krlogind * Fri Jun 30 2000 Nalin Dahyabhai - update to 1.2.1 - back out Tom Yu's patch, which is a big chunk of the 1.2 -> 1.2.1 update - start using the official source tarball instead of its contents * Thu Jun 29 2000 Nalin Dahyabhai - Tom Yu's patch to fix compatibility between 1.2 kadmin and 1.1.1 kadmind - pull out 6.2 options in the spec file (sonames changing in 1.2 means it's not compatible with other stuff in 6.2, so no need) * Wed Jun 28 2000 Nalin Dahyabhai - tweak graceful start/stop logic in post and preun * Mon Jun 26 2000 Nalin Dahyabhai - update to the 1.2 release - ditch a lot of our patches which went upstream - enable use of DNS to look up things at build-time - disable use of DNS to look up things at run-time in default krb5.conf - change ownership of the convert-config-files script to root.root - compress PS docs - fix some typos in the kinit man page - run condrestart in server post, and shut down in preun * Mon Jun 19 2000 Nalin Dahyabhai - only remove old krb5server init script links if the init script is there * Sat Jun 17 2000 Nalin Dahyabhai - disable kshell and eklogin by default * Thu Jun 15 2000 Nalin Dahyabhai - patch mkdir/rmdir problem in ftpcmd.y - add condrestart option to init script - split the server init script into three pieces and add one for kpropd * Wed Jun 14 2000 Nalin Dahyabhai - make sure workstation servers are all disabled by default - clean up krb5server init script * Fri Jun 9 2000 Nalin Dahyabhai - apply second set of buffer overflow fixes from Tom Yu - fix from Dirk Husung for a bug in buffer cleanups in the test suite - work around possibly broken rev binary in running test suite - move default realm configs from /var/kerberos to %{_var}/kerberos * Tue Jun 6 2000 Nalin Dahyabhai - make ksu and v4rcp owned by root * Sat Jun 3 2000 Nalin Dahyabhai - use %%{_infodir} to better comply with FHS - move .so files to -devel subpackage - tweak xinetd config files (bugs #11833, #11835, #11836, #11840) - fix package descriptions again * Wed May 24 2000 Nalin Dahyabhai - change a LINE_MAX to 1024, fix from Ken Raeburn - add fix for login vulnerability in case anyone rebuilds without krb4 compat - add tweaks for byte-swapping macros in krb.h, also from Ken - add xinetd config files - make rsh and rlogin quieter - build with debug to fix credential forwarding - add rsh as a build-time req because the configure scripts look for it to determine paths * Wed May 17 2000 Nalin Dahyabhai - fix config_subpackage logic * Tue May 16 2000 Nalin Dahyabhai - remove setuid bit on v4rcp and ksu in case the checks previously added don't close all of the problems in ksu - apply patches from Jeffrey Schiller to fix overruns Chris Evans found - reintroduce configs subpackage for use in the errata - add PreReq: sh-utils * Mon May 15 2000 Nalin Dahyabhai - fix double-free in the kdc (patch merged into MIT tree) - include convert-config-files script as a documentation file * Wed May 03 2000 Nalin Dahyabhai - patch ksu man page because the -C option never works - add access() checks and disable debug mode in ksu - modify default ksu build arguments to specify more directories in CMD_PATH and to use getusershell() * Wed May 03 2000 Bill Nottingham - fix configure stuff for ia64 * Mon Apr 10 2000 Nalin Dahyabhai - add LDCOMBINE=-lc to configure invocation to use libc versioning (bug #10653) - change Requires: for/in subpackages to include %{version} * Wed Apr 05 2000 Nalin Dahyabhai - add man pages for kerberos(1), kvno(1), .k5login(5) - add kvno to -workstation * Mon Apr 03 2000 Nalin Dahyabhai - Merge krb5-configs back into krb5-libs. The krb5.conf file is marked as a %%config file anyway. - Make krb5.conf a noreplace config file. * Thu Mar 30 2000 Nalin Dahyabhai - Make klogind pass a clean environment to children, like NetKit's rlogind does. * Wed Mar 08 2000 Nalin Dahyabhai - Don't enable the server by default. - Compress info pages. - Add defaults for the PAM module to krb5.conf * Mon Mar 06 2000 Nalin Dahyabhai - Correct copyright: it's exportable now, provided the proper paperwork is filed with the government. * Fri Mar 03 2000 Nalin Dahyabhai - apply Mike Friedman's patch to fix format string problems - don't strip off argv[0] when invoking regular rsh/rlogin * Thu Mar 02 2000 Nalin Dahyabhai - run kadmin.local correctly at startup * Mon Feb 28 2000 Nalin Dahyabhai - pass absolute path to kadm5.keytab if/when extracting keys at startup * Sat Feb 19 2000 Nalin Dahyabhai - fix info page insertions * Wed Feb 9 2000 Nalin Dahyabhai - tweak server init script to automatically extract kadm5 keys if /var/kerberos/krb5kdc/kadm5.keytab doesn't exist yet - adjust package descriptions * Thu Feb 3 2000 Nalin Dahyabhai - fix for potentially gzipped man pages * Fri Jan 21 2000 Nalin Dahyabhai - fix comments in krb5-configs * Fri Jan 7 2000 Nalin Dahyabhai - move /usr/kerberos/bin to end of PATH * Tue Dec 28 1999 Nalin Dahyabhai - install kadmin header files * Tue Dec 21 1999 Nalin Dahyabhai - patch around TIOCGTLC defined on alpha and remove warnings from libpty.h - add installation of info docs - remove krb4 compat patch because it doesn't fix workstation-side servers * Mon Dec 20 1999 Nalin Dahyabhai - remove hesiod dependency at build-time * Sun Dec 19 1999 Nalin Dahyabhai - rebuild on 1.1.1 * Thu Oct 7 1999 Nalin Dahyabhai - clean up init script for server, verify that it works [jlkatz] - clean up rotation script so that rc likes it better - add clean stanza * Mon Oct 4 1999 Nalin Dahyabhai - backed out ncurses and makeshlib patches - update for krb5-1.1 - add KDC rotation to rc.boot, based on ideas from Michael's C version * Sun Sep 26 1999 Nalin Dahyabhai - added -lncurses to telnet and telnetd makefiles * Mon Jul 5 1999 Nalin Dahyabhai - added krb5.csh and krb5.sh to /etc/profile.d * Tue Jun 22 1999 Nalin Dahyabhai - broke out configuration files * Mon Jun 14 1999 Nalin Dahyabhai - fixed server package so that it works now * Sat May 15 1999 Nalin Dahyabhai - started changelog (previous package from zedz.net) - updated existing 1.0.5 RPM from Eos Linux to krb5 1.0.6 - added --force to makeinfo commands to skip errors during build