2006-12-19 00:16:52 +01:00
|
|
|
#
|
2011-03-16 08:59:53 +01:00
|
|
|
# spec file for package krb5
|
2006-12-19 00:16:52 +01:00
|
|
|
#
|
2024-03-11 08:49:33 +01:00
|
|
|
# Copyright (c) 2024 SUSE LLC
|
2006-12-19 00:16:52 +01:00
|
|
|
#
|
2008-10-06 19:00:36 +02:00
|
|
|
# All modifications and additions to the file contributed by third parties
|
|
|
|
|
# remain the property of their copyright owners, unless otherwise agreed
|
|
|
|
|
# upon. The license for this file, and modifications and additions to the
|
|
|
|
|
# file, is the same license as for the pristine package itself (unless the
|
|
|
|
|
# license for the pristine package is not an Open Source License, in which
|
|
|
|
|
# case the license is the MIT License). An "Open Source License" is a
|
|
|
|
|
# license that conforms to the Open Source Definition (Version 1.9)
|
|
|
|
|
# published by the Open Source Initiative.
|
|
|
|
|
|
2019-02-14 09:52:23 +01:00
|
|
|
# Please submit bugfixes or comments via https://bugs.opensuse.org/
|
2006-12-19 00:16:52 +01:00
|
|
|
#
|
|
|
|
|
|
|
|
|
|
|
2017-11-23 15:51:34 +01:00
|
|
|
#Compat macro for new _fillupdir macro introduced in Nov 2017
|
|
|
|
|
%if ! %{defined _fillupdir}
|
2020-02-26 09:25:58 +01:00
|
|
|
%define _fillupdir %{_localstatedir}/adm/fillup-templates
|
2017-11-23 15:51:34 +01:00
|
|
|
%endif
|
2006-12-19 00:16:52 +01:00
|
|
|
Name: krb5
|
2023-12-21 00:21:24 +01:00
|
|
|
Version: 1.21.2
|
2011-12-25 22:43:39 +01:00
|
|
|
Release: 0
|
2017-10-03 01:37:48 +02:00
|
|
|
Summary: MIT Kerberos5 implementation
|
2012-02-08 09:11:14 +01:00
|
|
|
License: MIT
|
2021-02-19 14:42:58 +01:00
|
|
|
URL: https://kerberos.org/dist/
|
2023-07-15 20:25:31 +02:00
|
|
|
Source0: https://kerberos.org/dist/krb5/1.21/krb5-%{version}.tar.gz
|
|
|
|
|
Source1: https://kerberos.org/dist/krb5/1.21/krb5-%{version}.tar.gz.asc
|
2016-07-22 13:04:02 +02:00
|
|
|
Source2: krb5.keyring
|
|
|
|
|
Source3: vendor-files.tar.bz2
|
|
|
|
|
Source4: baselibs.conf
|
2011-08-21 11:43:02 +02:00
|
|
|
Source5: krb5-rpmlintrc
|
2016-11-24 15:43:00 +01:00
|
|
|
Source6: ksu-pam.d
|
Accepting request 670179 from home:scabrero:branches:network
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
OBS-URL: https://build.opensuse.org/request/show/670179
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=212
2019-02-13 18:01:33 +01:00
|
|
|
Source7: krb5.tmpfiles
|
Accepting request 777881 from home:scabrero:branches:network
- Upgrade to 1.18
Administrator experience:
* Remove support for single-DES encryption types.
* Change the replay cache format to be more efficient and robust.
Replay cache filenames using the new format end with ".rcache2"
by default.
* setuid programs will automatically ignore environment variables
that normally affect krb5 API functions, even if the caller does
not use krb5_init_secure_context().
* Add an "enforce_ok_as_delegate" krb5.conf relation to disable
credential forwarding during GSSAPI authentication unless the KDC
sets the ok-as-delegate bit in the service ticket.
* Use the permitted_enctypes krb5.conf setting as the default value
for default_tkt_enctypes and default_tgs_enctypes.
Developer experience:
* Implement krb5_cc_remove_cred() for all credential cache types.
* Add the krb5_pac_get_client_info() API to get the client account
name from a PAC.
Protocol evolution:
* Add KDC support for S4U2Self requests where the user is identified
by X.509 certificate. (Requires support for certificate lookup from
a third-party KDB module.)
* Remove support for an old ("draft 9") variant of PKINIT.
* Add support for Microsoft NegoEx. (Requires one or more third-party
GSS modules implementing NegoEx mechanisms.)
User experience:
* Add support for "dns_canonicalize_hostname=fallback", causing
host-based principal names to be tried first without DNS
canonicalization, and again with DNS canonicalization if the
un-canonicalized server is not found.
* Expand single-component hostnames in host-based principal names
when DNS canonicalization is not used, adding the system's first DNS
search path as a suffix. Add a "qualify_shortname" krb5.conf relation
to override this suffix or disable expansion.
* Honor the transited-policy-checked ticket flag on application servers,
eliminating the requirement to configure capaths on servers in some
scenarios.
Code quality:
* The libkrb5 serialization code (used to export and import krb5 GSS
security contexts) has been simplified and made type-safe.
* The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
messages has been revised to conform to current coding practices.
* The test suite has been modified to work with macOS System Integrity
Protection enabled.
* The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
can always be tested.
- Updated patches:
* 0002-krb5-1.9-manpaths.patch
* 0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* 0005-krb5-1.6.3-ktutil-manpage.patch
* 0006-krb5-1.12-api.patch
- Renamed patches:
* 0001-krb5-1.12-pam.patch => 0001-ksu-pam-integration.patch
* 0003-krb5-1.12-buildconf.patch => 0003-Adjust-build-configuration.patch
* 0008-krb5-1.12-selinux-label.patch => 0007-SELinux-integration.patch
* 0009-krb5-1.9-debuginfo.patch => 0008-krb5-1.9-debuginfo.patch
- Deleted patches:
* 0007-krb5-1.12-ksu-path.patch
- Upgrade to 1.18
Administrator experience:
* Remove support for single-DES encryption types.
* Change the replay cache format to be more efficient and robust.
Replay cache filenames using the new format end with ".rcache2"
by default.
* setuid programs will automatically ignore environment variables
that normally affect krb5 API functions, even if the caller does
not use krb5_init_secure_context().
* Add an "enforce_ok_as_delegate" krb5.conf relation to disable
credential forwarding during GSSAPI authentication unless the KDC
sets the ok-as-delegate bit in the service ticket.
* Use the permitted_enctypes krb5.conf setting as the default value
for default_tkt_enctypes and default_tgs_enctypes.
Developer experience:
* Implement krb5_cc_remove_cred() for all credential cache types.
* Add the krb5_pac_get_client_info() API to get the client account
name from a PAC.
Protocol evolution:
* Add KDC support for S4U2Self requests where the user is identified
by X.509 certificate. (Requires support for certificate lookup from
a third-party KDB module.)
* Remove support for an old ("draft 9") variant of PKINIT.
* Add support for Microsoft NegoEx. (Requires one or more third-party
GSS modules implementing NegoEx mechanisms.)
User experience:
* Add support for "dns_canonicalize_hostname=fallback", causing
host-based principal names to be tried first without DNS
canonicalization, and again with DNS canonicalization if the
un-canonicalized server is not found.
* Expand single-component hostnames in host-based principal names
when DNS canonicalization is not used, adding the system's first DNS
search path as a suffix. Add a "qualify_shortname" krb5.conf relation
to override this suffix or disable expansion.
* Honor the transited-policy-checked ticket flag on application servers,
eliminating the requirement to configure capaths on servers in some
scenarios.
Code quality:
* The libkrb5 serialization code (used to export and import krb5 GSS
security contexts) has been simplified and made type-safe.
* The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
messages has been revised to conform to current coding practices.
* The test suite has been modified to work with macOS System Integrity
Protection enabled.
* The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
can always be tested.
- Updated patches:
* 0002-krb5-1.9-manpaths.patch
* 0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* 0005-krb5-1.6.3-ktutil-manpage.patch
* 0006-krb5-1.12-api.patch
- Renamed patches:
* 0001-krb5-1.12-pam.patch => 0001-ksu-pam-integration.patch
* 0003-krb5-1.12-buildconf.patch => 0003-Adjust-build-configuration.patch
* 0008-krb5-1.12-selinux-label.patch => 0007-SELinux-integration.patch
* 0009-krb5-1.9-debuginfo.patch => 0008-krb5-1.9-debuginfo.patch
- Deleted patches:
* 0007-krb5-1.12-ksu-path.patch
OBS-URL: https://build.opensuse.org/request/show/777881
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=224
2020-02-25 08:55:08 +01:00
|
|
|
Patch1: 0001-ksu-pam-integration.patch
|
Accepting request 670179 from home:scabrero:branches:network
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
OBS-URL: https://build.opensuse.org/request/show/670179
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=212
2019-02-13 18:01:33 +01:00
|
|
|
Patch2: 0002-krb5-1.9-manpaths.patch
|
Accepting request 777881 from home:scabrero:branches:network
- Upgrade to 1.18
Administrator experience:
* Remove support for single-DES encryption types.
* Change the replay cache format to be more efficient and robust.
Replay cache filenames using the new format end with ".rcache2"
by default.
* setuid programs will automatically ignore environment variables
that normally affect krb5 API functions, even if the caller does
not use krb5_init_secure_context().
* Add an "enforce_ok_as_delegate" krb5.conf relation to disable
credential forwarding during GSSAPI authentication unless the KDC
sets the ok-as-delegate bit in the service ticket.
* Use the permitted_enctypes krb5.conf setting as the default value
for default_tkt_enctypes and default_tgs_enctypes.
Developer experience:
* Implement krb5_cc_remove_cred() for all credential cache types.
* Add the krb5_pac_get_client_info() API to get the client account
name from a PAC.
Protocol evolution:
* Add KDC support for S4U2Self requests where the user is identified
by X.509 certificate. (Requires support for certificate lookup from
a third-party KDB module.)
* Remove support for an old ("draft 9") variant of PKINIT.
* Add support for Microsoft NegoEx. (Requires one or more third-party
GSS modules implementing NegoEx mechanisms.)
User experience:
* Add support for "dns_canonicalize_hostname=fallback", causing
host-based principal names to be tried first without DNS
canonicalization, and again with DNS canonicalization if the
un-canonicalized server is not found.
* Expand single-component hostnames in host-based principal names
when DNS canonicalization is not used, adding the system's first DNS
search path as a suffix. Add a "qualify_shortname" krb5.conf relation
to override this suffix or disable expansion.
* Honor the transited-policy-checked ticket flag on application servers,
eliminating the requirement to configure capaths on servers in some
scenarios.
Code quality:
* The libkrb5 serialization code (used to export and import krb5 GSS
security contexts) has been simplified and made type-safe.
* The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
messages has been revised to conform to current coding practices.
* The test suite has been modified to work with macOS System Integrity
Protection enabled.
* The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
can always be tested.
- Updated patches:
* 0002-krb5-1.9-manpaths.patch
* 0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* 0005-krb5-1.6.3-ktutil-manpage.patch
* 0006-krb5-1.12-api.patch
- Renamed patches:
* 0001-krb5-1.12-pam.patch => 0001-ksu-pam-integration.patch
* 0003-krb5-1.12-buildconf.patch => 0003-Adjust-build-configuration.patch
* 0008-krb5-1.12-selinux-label.patch => 0007-SELinux-integration.patch
* 0009-krb5-1.9-debuginfo.patch => 0008-krb5-1.9-debuginfo.patch
- Deleted patches:
* 0007-krb5-1.12-ksu-path.patch
- Upgrade to 1.18
Administrator experience:
* Remove support for single-DES encryption types.
* Change the replay cache format to be more efficient and robust.
Replay cache filenames using the new format end with ".rcache2"
by default.
* setuid programs will automatically ignore environment variables
that normally affect krb5 API functions, even if the caller does
not use krb5_init_secure_context().
* Add an "enforce_ok_as_delegate" krb5.conf relation to disable
credential forwarding during GSSAPI authentication unless the KDC
sets the ok-as-delegate bit in the service ticket.
* Use the permitted_enctypes krb5.conf setting as the default value
for default_tkt_enctypes and default_tgs_enctypes.
Developer experience:
* Implement krb5_cc_remove_cred() for all credential cache types.
* Add the krb5_pac_get_client_info() API to get the client account
name from a PAC.
Protocol evolution:
* Add KDC support for S4U2Self requests where the user is identified
by X.509 certificate. (Requires support for certificate lookup from
a third-party KDB module.)
* Remove support for an old ("draft 9") variant of PKINIT.
* Add support for Microsoft NegoEx. (Requires one or more third-party
GSS modules implementing NegoEx mechanisms.)
User experience:
* Add support for "dns_canonicalize_hostname=fallback", causing
host-based principal names to be tried first without DNS
canonicalization, and again with DNS canonicalization if the
un-canonicalized server is not found.
* Expand single-component hostnames in host-based principal names
when DNS canonicalization is not used, adding the system's first DNS
search path as a suffix. Add a "qualify_shortname" krb5.conf relation
to override this suffix or disable expansion.
* Honor the transited-policy-checked ticket flag on application servers,
eliminating the requirement to configure capaths on servers in some
scenarios.
Code quality:
* The libkrb5 serialization code (used to export and import krb5 GSS
security contexts) has been simplified and made type-safe.
* The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
messages has been revised to conform to current coding practices.
* The test suite has been modified to work with macOS System Integrity
Protection enabled.
* The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
can always be tested.
- Updated patches:
* 0002-krb5-1.9-manpaths.patch
* 0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* 0005-krb5-1.6.3-ktutil-manpage.patch
* 0006-krb5-1.12-api.patch
- Renamed patches:
* 0001-krb5-1.12-pam.patch => 0001-ksu-pam-integration.patch
* 0003-krb5-1.12-buildconf.patch => 0003-Adjust-build-configuration.patch
* 0008-krb5-1.12-selinux-label.patch => 0007-SELinux-integration.patch
* 0009-krb5-1.9-debuginfo.patch => 0008-krb5-1.9-debuginfo.patch
- Deleted patches:
* 0007-krb5-1.12-ksu-path.patch
OBS-URL: https://build.opensuse.org/request/show/777881
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=224
2020-02-25 08:55:08 +01:00
|
|
|
Patch3: 0003-Adjust-build-configuration.patch
|
Accepting request 670179 from home:scabrero:branches:network
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
OBS-URL: https://build.opensuse.org/request/show/670179
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=212
2019-02-13 18:01:33 +01:00
|
|
|
Patch4: 0004-krb5-1.6.3-gssapi_improve_errormessages.patch
|
|
|
|
|
Patch5: 0005-krb5-1.6.3-ktutil-manpage.patch
|
|
|
|
|
Patch6: 0006-krb5-1.12-api.patch
|
Accepting request 777881 from home:scabrero:branches:network
- Upgrade to 1.18
Administrator experience:
* Remove support for single-DES encryption types.
* Change the replay cache format to be more efficient and robust.
Replay cache filenames using the new format end with ".rcache2"
by default.
* setuid programs will automatically ignore environment variables
that normally affect krb5 API functions, even if the caller does
not use krb5_init_secure_context().
* Add an "enforce_ok_as_delegate" krb5.conf relation to disable
credential forwarding during GSSAPI authentication unless the KDC
sets the ok-as-delegate bit in the service ticket.
* Use the permitted_enctypes krb5.conf setting as the default value
for default_tkt_enctypes and default_tgs_enctypes.
Developer experience:
* Implement krb5_cc_remove_cred() for all credential cache types.
* Add the krb5_pac_get_client_info() API to get the client account
name from a PAC.
Protocol evolution:
* Add KDC support for S4U2Self requests where the user is identified
by X.509 certificate. (Requires support for certificate lookup from
a third-party KDB module.)
* Remove support for an old ("draft 9") variant of PKINIT.
* Add support for Microsoft NegoEx. (Requires one or more third-party
GSS modules implementing NegoEx mechanisms.)
User experience:
* Add support for "dns_canonicalize_hostname=fallback", causing
host-based principal names to be tried first without DNS
canonicalization, and again with DNS canonicalization if the
un-canonicalized server is not found.
* Expand single-component hostnames in host-based principal names
when DNS canonicalization is not used, adding the system's first DNS
search path as a suffix. Add a "qualify_shortname" krb5.conf relation
to override this suffix or disable expansion.
* Honor the transited-policy-checked ticket flag on application servers,
eliminating the requirement to configure capaths on servers in some
scenarios.
Code quality:
* The libkrb5 serialization code (used to export and import krb5 GSS
security contexts) has been simplified and made type-safe.
* The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
messages has been revised to conform to current coding practices.
* The test suite has been modified to work with macOS System Integrity
Protection enabled.
* The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
can always be tested.
- Updated patches:
* 0002-krb5-1.9-manpaths.patch
* 0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* 0005-krb5-1.6.3-ktutil-manpage.patch
* 0006-krb5-1.12-api.patch
- Renamed patches:
* 0001-krb5-1.12-pam.patch => 0001-ksu-pam-integration.patch
* 0003-krb5-1.12-buildconf.patch => 0003-Adjust-build-configuration.patch
* 0008-krb5-1.12-selinux-label.patch => 0007-SELinux-integration.patch
* 0009-krb5-1.9-debuginfo.patch => 0008-krb5-1.9-debuginfo.patch
- Deleted patches:
* 0007-krb5-1.12-ksu-path.patch
- Upgrade to 1.18
Administrator experience:
* Remove support for single-DES encryption types.
* Change the replay cache format to be more efficient and robust.
Replay cache filenames using the new format end with ".rcache2"
by default.
* setuid programs will automatically ignore environment variables
that normally affect krb5 API functions, even if the caller does
not use krb5_init_secure_context().
* Add an "enforce_ok_as_delegate" krb5.conf relation to disable
credential forwarding during GSSAPI authentication unless the KDC
sets the ok-as-delegate bit in the service ticket.
* Use the permitted_enctypes krb5.conf setting as the default value
for default_tkt_enctypes and default_tgs_enctypes.
Developer experience:
* Implement krb5_cc_remove_cred() for all credential cache types.
* Add the krb5_pac_get_client_info() API to get the client account
name from a PAC.
Protocol evolution:
* Add KDC support for S4U2Self requests where the user is identified
by X.509 certificate. (Requires support for certificate lookup from
a third-party KDB module.)
* Remove support for an old ("draft 9") variant of PKINIT.
* Add support for Microsoft NegoEx. (Requires one or more third-party
GSS modules implementing NegoEx mechanisms.)
User experience:
* Add support for "dns_canonicalize_hostname=fallback", causing
host-based principal names to be tried first without DNS
canonicalization, and again with DNS canonicalization if the
un-canonicalized server is not found.
* Expand single-component hostnames in host-based principal names
when DNS canonicalization is not used, adding the system's first DNS
search path as a suffix. Add a "qualify_shortname" krb5.conf relation
to override this suffix or disable expansion.
* Honor the transited-policy-checked ticket flag on application servers,
eliminating the requirement to configure capaths on servers in some
scenarios.
Code quality:
* The libkrb5 serialization code (used to export and import krb5 GSS
security contexts) has been simplified and made type-safe.
* The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
messages has been revised to conform to current coding practices.
* The test suite has been modified to work with macOS System Integrity
Protection enabled.
* The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
can always be tested.
- Updated patches:
* 0002-krb5-1.9-manpaths.patch
* 0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* 0005-krb5-1.6.3-ktutil-manpage.patch
* 0006-krb5-1.12-api.patch
- Renamed patches:
* 0001-krb5-1.12-pam.patch => 0001-ksu-pam-integration.patch
* 0003-krb5-1.12-buildconf.patch => 0003-Adjust-build-configuration.patch
* 0008-krb5-1.12-selinux-label.patch => 0007-SELinux-integration.patch
* 0009-krb5-1.9-debuginfo.patch => 0008-krb5-1.9-debuginfo.patch
- Deleted patches:
* 0007-krb5-1.12-ksu-path.patch
OBS-URL: https://build.opensuse.org/request/show/777881
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=224
2020-02-25 08:55:08 +01:00
|
|
|
Patch7: 0007-SELinux-integration.patch
|
|
|
|
|
Patch8: 0008-krb5-1.9-debuginfo.patch
|
2024-05-01 07:54:37 +02:00
|
|
|
Patch9: 0009-Fix-three-memory-leaks.patch
|
2020-02-26 09:25:58 +01:00
|
|
|
BuildRequires: autoconf
|
|
|
|
|
BuildRequires: bison
|
2021-05-22 13:00:53 +02:00
|
|
|
BuildRequires: cyrus-sasl-devel
|
2020-02-26 09:25:58 +01:00
|
|
|
BuildRequires: keyutils
|
|
|
|
|
BuildRequires: keyutils-devel
|
|
|
|
|
BuildRequires: openldap2-devel
|
|
|
|
|
BuildRequires: pam-devel
|
|
|
|
|
BuildRequires: pkgconfig
|
|
|
|
|
BuildRequires: pkgconfig(com_err)
|
|
|
|
|
BuildRequires: pkgconfig(libselinux)
|
|
|
|
|
BuildRequires: pkgconfig(libssl)
|
|
|
|
|
BuildRequires: pkgconfig(libverto)
|
2024-05-14 09:54:34 +02:00
|
|
|
BuildRequires: pkgconfig(lmdb)
|
2020-02-26 09:25:58 +01:00
|
|
|
BuildRequires: pkgconfig(ncurses)
|
|
|
|
|
BuildRequires: pkgconfig(ss)
|
|
|
|
|
BuildRequires: pkgconfig(systemd)
|
2024-03-11 08:49:33 +01:00
|
|
|
%if 0%{?suse_version} >= 1550 || 0%{?sle_version} >= 150400
|
|
|
|
|
BuildRequires: crypto-policies
|
|
|
|
|
Requires: crypto-policies
|
|
|
|
|
%endif
|
2020-02-26 09:25:58 +01:00
|
|
|
Conflicts: krb5-mini
|
|
|
|
|
Obsoletes: krb5-plugin-preauth-pkinit-nss
|
2006-12-19 00:16:52 +01:00
|
|
|
|
|
|
|
|
%description
|
|
|
|
|
Kerberos V5 is a trusted-third-party network authentication system,
|
2017-10-03 01:37:48 +02:00
|
|
|
which can improve network security by eliminating the insecure
|
2006-12-19 00:16:52 +01:00
|
|
|
practice of clear text passwords.
|
|
|
|
|
|
|
|
|
|
%package client
|
2017-10-03 01:37:48 +02:00
|
|
|
Summary: Client programs of the MIT Kerberos5 implementation
|
2020-02-26 09:25:58 +01:00
|
|
|
Conflicts: krb5-mini
|
2006-12-19 00:16:52 +01:00
|
|
|
|
|
|
|
|
%description client
|
|
|
|
|
Kerberos V5 is a trusted-third-party network authentication system,
|
2017-10-03 01:37:48 +02:00
|
|
|
which can improve network security by eliminating the insecure
|
2006-12-19 00:16:52 +01:00
|
|
|
practice of cleartext passwords. This package includes some required
|
|
|
|
|
client programs, like kinit, kadmin, ...
|
|
|
|
|
|
|
|
|
|
%package server
|
2017-10-03 01:37:48 +02:00
|
|
|
Summary: Server program of the MIT Kerberos5 implementation
|
2015-06-01 11:44:23 +02:00
|
|
|
Requires: libverto-libev1
|
2012-06-06 16:55:51 +02:00
|
|
|
Requires: logrotate
|
2006-12-19 00:16:52 +01:00
|
|
|
Requires: perl-Date-Calc
|
2020-02-26 09:25:58 +01:00
|
|
|
Requires(post): %fillup_prereq
|
2012-10-05 16:25:10 +02:00
|
|
|
%{?systemd_requires}
|
2006-12-19 00:16:52 +01:00
|
|
|
|
|
|
|
|
%description server
|
|
|
|
|
Kerberos V5 is a trusted-third-party network authentication system,
|
2017-10-03 01:37:48 +02:00
|
|
|
which can improve network security by eliminating the insecure
|
2006-12-19 00:16:52 +01:00
|
|
|
practice of cleartext passwords. This package includes the kdc, kadmind
|
|
|
|
|
and more.
|
|
|
|
|
|
2009-07-08 19:41:43 +02:00
|
|
|
%package plugin-kdb-ldap
|
2017-10-03 01:37:48 +02:00
|
|
|
Summary: LDAP database plugin for MIT Kerberos5
|
2009-07-08 19:41:43 +02:00
|
|
|
Requires: krb5-server = %{version}
|
2006-12-19 00:16:52 +01:00
|
|
|
|
2009-07-08 19:41:43 +02:00
|
|
|
%description plugin-kdb-ldap
|
2006-12-19 00:16:52 +01:00
|
|
|
Kerberos V5 is a trusted-third-party network authentication system,
|
2017-10-03 01:37:48 +02:00
|
|
|
which can improve network security by eliminating the insecure
|
2009-07-08 19:41:43 +02:00
|
|
|
practice of clear text passwords. This package contains the LDAP
|
|
|
|
|
database plugin.
|
|
|
|
|
|
|
|
|
|
%package plugin-preauth-pkinit
|
2017-10-03 01:37:48 +02:00
|
|
|
Summary: PKINIT preauthentication plugin for MIT Kerberos5
|
2009-07-08 19:41:43 +02:00
|
|
|
|
|
|
|
|
%description plugin-preauth-pkinit
|
|
|
|
|
Kerberos V5 is a trusted-third-party network authentication system,
|
2017-10-03 01:37:48 +02:00
|
|
|
which can improve network security by eliminating the insecure
|
2009-07-08 19:41:43 +02:00
|
|
|
practice of cleartext passwords. This package includes a PKINIT plugin.
|
|
|
|
|
|
2014-01-15 15:14:20 +01:00
|
|
|
%package plugin-preauth-otp
|
2017-10-03 01:37:48 +02:00
|
|
|
Summary: OTP preauthentication plugin for MIT Kerberos5
|
2014-01-15 15:14:20 +01:00
|
|
|
|
|
|
|
|
%description plugin-preauth-otp
|
|
|
|
|
Kerberos V5 is a trusted-third-party network authentication system,
|
2017-10-03 01:37:48 +02:00
|
|
|
which can improve network security by eliminating the insecure
|
2014-01-15 15:14:20 +01:00
|
|
|
practice of cleartext passwords. This package includes a OTP plugin.
|
|
|
|
|
|
Accepting request 670179 from home:scabrero:branches:network
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
OBS-URL: https://build.opensuse.org/request/show/670179
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=212
2019-02-13 18:01:33 +01:00
|
|
|
%package plugin-preauth-spake
|
|
|
|
|
Summary: SPAKE preauthentication plugin for MIT Kerberos5
|
|
|
|
|
|
|
|
|
|
%description plugin-preauth-spake
|
|
|
|
|
Kerberos V5 is a trusted-third-party network authentication system,
|
|
|
|
|
which can improve network security by eliminating the insecure
|
|
|
|
|
practice of cleartext passwords. This package includes a SPAKE plugin.
|
|
|
|
|
|
2013-03-15 11:21:16 +01:00
|
|
|
%package doc
|
2017-10-03 01:37:48 +02:00
|
|
|
Summary: Documentation for the MIT Kerberos5 implementation
|
2013-03-15 11:21:16 +01:00
|
|
|
|
|
|
|
|
%description doc
|
|
|
|
|
Kerberos V5 is a trusted-third-party network authentication
|
2017-10-03 01:37:48 +02:00
|
|
|
system,which can improve network security by eliminating the
|
2013-03-15 11:21:16 +01:00
|
|
|
insecurepractice of clear text passwords. This package includes
|
|
|
|
|
extended documentation for MIT Kerberos.
|
|
|
|
|
|
2009-07-08 19:41:43 +02:00
|
|
|
%package devel
|
2017-10-03 01:37:48 +02:00
|
|
|
Summary: Development files for MIT Kerberos5
|
2020-02-26 09:25:58 +01:00
|
|
|
Requires: %{name} = %{version}
|
2009-07-08 19:41:43 +02:00
|
|
|
Requires: keyutils-devel
|
2020-02-26 09:25:58 +01:00
|
|
|
Requires: pkgconfig(com_err)
|
|
|
|
|
Requires: pkgconfig(libverto)
|
|
|
|
|
Requires: pkgconfig(ss)
|
2013-04-04 15:10:58 +02:00
|
|
|
Conflicts: krb5-mini-devel
|
2009-07-08 19:41:43 +02:00
|
|
|
|
|
|
|
|
%description devel
|
|
|
|
|
Kerberos V5 is a trusted-third-party network authentication system,
|
2017-10-03 01:37:48 +02:00
|
|
|
which can improve network security by eliminating the insecure
|
2009-07-08 19:41:43 +02:00
|
|
|
practice of cleartext passwords. This package includes Libraries and
|
|
|
|
|
Include Files for Development
|
2006-12-19 00:16:52 +01:00
|
|
|
|
2016-04-01 09:50:43 +02:00
|
|
|
%define srcRoot krb5-%{version}
|
|
|
|
|
%define vendorFiles %{_builddir}/%{srcRoot}/vendor-files/
|
|
|
|
|
%define krb5docdir %{_defaultdocdir}/krb5
|
|
|
|
|
|
2006-12-19 00:16:52 +01:00
|
|
|
%prep
|
2012-06-06 16:55:51 +02:00
|
|
|
%setup -q -n %{srcRoot}
|
2020-02-26 09:25:58 +01:00
|
|
|
%setup -q -a 3 -T -D -n %{srcRoot}
|
2020-03-30 12:04:03 +02:00
|
|
|
%autopatch -p1
|
2006-12-19 00:16:52 +01:00
|
|
|
|
|
|
|
|
%build
|
2012-06-07 13:40:00 +02:00
|
|
|
# needs to be re-generated
|
|
|
|
|
rm -f src/lib/krb5/krb/deltat.c
|
2006-12-19 00:16:52 +01:00
|
|
|
cd src
|
2016-12-05 18:34:31 +01:00
|
|
|
autoreconf -fi
|
2013-06-09 16:19:29 +02:00
|
|
|
DEFCCNAME=DIR:/run/user/%%{uid}/krb5cc; export DEFCCNAME
|
2020-02-26 09:25:58 +01:00
|
|
|
%configure \
|
2019-02-14 09:52:23 +01:00
|
|
|
CFLAGS="%{optflags} -I%{_includedir}/et -fno-strict-aliasing -D_GNU_SOURCE -fPIC $(getconf LFS_CFLAGS)" \
|
2013-06-09 16:19:29 +02:00
|
|
|
CPPFLAGS="-I%{_includedir}/et " \
|
|
|
|
|
SS_LIB="-lss" \
|
2020-02-26 09:25:58 +01:00
|
|
|
--sysconfdir=%{_sysconfdir} \
|
|
|
|
|
--mandir=%{_mandir} \
|
|
|
|
|
--infodir=%{_infodir} \
|
|
|
|
|
--libdir=%{_libdir} \
|
|
|
|
|
--includedir=%{_includedir} \
|
2016-07-22 13:04:02 +02:00
|
|
|
--localstatedir=%{_localstatedir}/lib/kerberos \
|
|
|
|
|
--localedir=%{_datadir}/locale \
|
2020-02-26 09:25:58 +01:00
|
|
|
--enable-shared \
|
|
|
|
|
--disable-static \
|
2016-07-22 13:04:02 +02:00
|
|
|
--enable-dns-for-realm \
|
|
|
|
|
--disable-rpath \
|
|
|
|
|
--with-ldap \
|
|
|
|
|
--with-pam \
|
|
|
|
|
--enable-pkinit \
|
Accepting request 670179 from home:scabrero:branches:network
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
OBS-URL: https://build.opensuse.org/request/show/670179
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=212
2019-02-13 18:01:33 +01:00
|
|
|
--with-crypto-impl=openssl \
|
2016-07-22 13:04:02 +02:00
|
|
|
--with-selinux \
|
|
|
|
|
--with-system-et \
|
|
|
|
|
--with-system-ss \
|
2024-05-14 09:54:34 +02:00
|
|
|
--with-system-verto \
|
|
|
|
|
--with-lmdb
|
2016-07-22 13:04:02 +02:00
|
|
|
|
2020-02-26 09:25:58 +01:00
|
|
|
%make_build
|
2016-07-22 13:04:02 +02:00
|
|
|
|
2015-10-29 19:14:03 +01:00
|
|
|
# Copy kadmin manual page into kadmin.local's due to the split between client and server package
|
|
|
|
|
cp man/kadmin.man man/kadmin.local.8
|
|
|
|
|
|
2006-12-19 00:16:52 +01:00
|
|
|
%install
|
2019-02-14 09:52:23 +01:00
|
|
|
mkdir -p %{buildroot}/%{_localstatedir}/log/krb5
|
|
|
|
|
%make_install -C src
|
2013-06-09 16:19:29 +02:00
|
|
|
# Munge krb5-config yet again. This is totally wrong for 64-bit, but chunks
|
|
|
|
|
# of the buildconf patch already conspire to strip out /usr/<anything> from the
|
|
|
|
|
# list of link flags, and it helps prevent file conflicts on multilib systems.
|
2020-06-15 11:07:04 +02:00
|
|
|
sed -r -i -e 's|^libdir=%{_prefix}/lib(64)?$|libdir=%{_prefix}/lib|g' %{buildroot}%{_bindir}/krb5-config
|
2013-06-09 16:19:29 +02:00
|
|
|
|
2012-02-28 10:04:15 +01:00
|
|
|
# install autoconf macro
|
|
|
|
|
mkdir -p %{buildroot}/%{_datadir}/aclocal
|
|
|
|
|
install -m 644 src/util/ac_check_krb5.m4 %{buildroot}%{_datadir}/aclocal/
|
2006-12-19 00:16:52 +01:00
|
|
|
# install sample config files
|
|
|
|
|
# I'll probably do something about this later on
|
Accepting request 670179 from home:scabrero:branches:network
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
OBS-URL: https://build.opensuse.org/request/show/670179
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=212
2019-02-13 18:01:33 +01:00
|
|
|
mkdir -p %{buildroot}%{_sysconfdir}
|
2018-05-01 05:19:15 +02:00
|
|
|
mkdir -p %{buildroot}%{_sysconfdir}/krb5.conf.d
|
2020-02-26 09:25:58 +01:00
|
|
|
mkdir -p %{buildroot}%{_localstatedir}/log/krb5
|
2007-04-20 01:22:05 +02:00
|
|
|
# create plugin directories
|
|
|
|
|
mkdir -p %{buildroot}/%{_libdir}/krb5/plugins/kdb
|
|
|
|
|
mkdir -p %{buildroot}/%{_libdir}/krb5/plugins/preauth
|
|
|
|
|
mkdir -p %{buildroot}/%{_libdir}/krb5/plugins/libkrb5
|
2015-01-06 11:58:20 +01:00
|
|
|
mkdir -p %{buildroot}/%{_libdir}/krb5/plugins/tls
|
2006-12-19 00:16:52 +01:00
|
|
|
install -m 644 %{vendorFiles}/krb5.conf %{buildroot}%{_sysconfdir}
|
Accepting request 670179 from home:scabrero:branches:network
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
OBS-URL: https://build.opensuse.org/request/show/670179
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=212
2019-02-13 18:01:33 +01:00
|
|
|
|
|
|
|
|
# Do not write directly to /var/lib/kerberos anymore as it breaks transactional
|
|
|
|
|
# updates. Use systemd-tmpfiles to copy the files there when it doesn't exist
|
2020-04-29 11:47:44 +02:00
|
|
|
install -d -m 0755 %{buildroot}%{_tmpfilesdir}
|
|
|
|
|
install -m 644 %{SOURCE7} %{buildroot}%{_tmpfilesdir}/krb5.conf
|
Accepting request 670179 from home:scabrero:branches:network
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
OBS-URL: https://build.opensuse.org/request/show/670179
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=212
2019-02-13 18:01:33 +01:00
|
|
|
mkdir -p %{buildroot}/%{_datadir}/kerberos/krb5kdc
|
|
|
|
|
# Where per-user keytabs live by default.
|
|
|
|
|
mkdir -p %{buildroot}/%{_datadir}/kerberos/krb5/user
|
|
|
|
|
install -m 600 %{vendorFiles}/kdc.conf %{buildroot}%{_datadir}/kerberos/krb5kdc/
|
|
|
|
|
install -m 600 %{vendorFiles}/kadm5.acl %{buildroot}%{_datadir}/kerberos/krb5kdc/
|
|
|
|
|
install -m 600 %{vendorFiles}/kadm5.dict %{buildroot}%{_datadir}/kerberos/krb5kdc/
|
|
|
|
|
|
2024-03-11 08:49:33 +01:00
|
|
|
%if 0%{?suse_version} >= 1550 || 0%{?sle_version} >= 150400
|
|
|
|
|
# Default include on this directory
|
|
|
|
|
ln -sv %{_sysconfdir}/crypto-policies/back-ends/krb5.config %{buildroot}%{_sysconfdir}/krb5.conf.d/crypto-policies
|
|
|
|
|
%endif
|
|
|
|
|
|
2020-02-26 09:25:58 +01:00
|
|
|
# all libs must have permissions 0755
|
2006-12-19 00:16:52 +01:00
|
|
|
for lib in `find %{buildroot}/%{_libdir}/ -type f -name "*.so*"`
|
2020-02-26 09:25:58 +01:00
|
|
|
do
|
|
|
|
|
chmod 0755 ${lib}
|
2006-12-19 00:16:52 +01:00
|
|
|
done
|
2007-06-15 00:30:00 +02:00
|
|
|
# and binaries too
|
2020-06-15 11:07:04 +02:00
|
|
|
chmod 0755 %{buildroot}%{_bindir}/ksu
|
2012-10-05 16:25:10 +02:00
|
|
|
# install systemd files
|
2012-10-05 17:26:30 +02:00
|
|
|
%if 0%{?suse_version} >= 1210
|
2012-10-05 16:25:10 +02:00
|
|
|
mkdir -p %{buildroot}%{_unitdir}
|
|
|
|
|
install -m 644 %{vendorFiles}/kadmind.service %{buildroot}%{_unitdir}
|
|
|
|
|
install -m 644 %{vendorFiles}/krb5kdc.service %{buildroot}%{_unitdir}
|
|
|
|
|
install -m 644 %{vendorFiles}/kpropd.service %{buildroot}%{_unitdir}
|
2014-02-18 18:40:34 +01:00
|
|
|
%else
|
|
|
|
|
# install init scripts
|
|
|
|
|
mkdir -p %{buildroot}%{_sysconfdir}/init.d
|
|
|
|
|
install -m 755 %{vendorFiles}/kadmind.init %{buildroot}%{_sysconfdir}/init.d/kadmind
|
|
|
|
|
install -m 755 %{vendorFiles}/krb5kdc.init %{buildroot}%{_sysconfdir}/init.d/krb5kdc
|
|
|
|
|
install -m 755 %{vendorFiles}/kpropd.init %{buildroot}%{_sysconfdir}/init.d/kpropd
|
2012-10-05 17:26:30 +02:00
|
|
|
%endif
|
2012-10-05 16:25:10 +02:00
|
|
|
# install sysconfig templates
|
2019-02-14 09:52:23 +01:00
|
|
|
mkdir -p %{buildroot}/%{_fillupdir}
|
|
|
|
|
install -m 644 %{vendorFiles}/sysconfig.kadmind %{buildroot}/%{_fillupdir}/
|
|
|
|
|
install -m 644 %{vendorFiles}/sysconfig.krb5kdc %{buildroot}/%{_fillupdir}/
|
2006-12-19 00:16:52 +01:00
|
|
|
# install logrotate files
|
|
|
|
|
mkdir -p %{buildroot}%{_sysconfdir}/logrotate.d
|
2007-06-15 00:26:00 +02:00
|
|
|
install -m 644 %{vendorFiles}/krb5-server.logrotate %{buildroot}%{_sysconfdir}/logrotate.d/krb5-server
|
2019-02-14 09:52:23 +01:00
|
|
|
find . -type f -name '*.ps' -exec gzip -9 {} +
|
2020-02-26 09:25:58 +01:00
|
|
|
# create rc* links
|
|
|
|
|
mkdir -p %{buildroot}%{_bindir}/
|
|
|
|
|
mkdir -p %{buildroot}%{_sbindir}/
|
|
|
|
|
ln -s service %{buildroot}%{_sbindir}/rckadmind
|
|
|
|
|
ln -s service %{buildroot}%{_sbindir}/rckrb5kdc
|
|
|
|
|
ln -s service %{buildroot}%{_sbindir}/rckpropd
|
2006-12-19 00:16:52 +01:00
|
|
|
# install doc
|
|
|
|
|
install -d -m 755 %{buildroot}/%{krb5docdir}
|
|
|
|
|
install -m 644 %{_builddir}/%{srcRoot}/README %{buildroot}/%{krb5docdir}/README
|
2019-05-08 12:10:09 +02:00
|
|
|
install -d -m 755 %{buildroot}/%{_datadir}/kerberos/ldap
|
|
|
|
|
install -m 644 %{_builddir}/%{srcRoot}/src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema %{buildroot}/%{_datadir}/kerberos/ldap/kerberos.schema
|
|
|
|
|
install -m 644 %{_builddir}/%{srcRoot}/src/plugins/kdb/ldap/libkdb_ldap/kerberos.ldif %{buildroot}/%{_datadir}/kerberos/ldap/kerberos.ldif
|
2020-02-26 09:25:58 +01:00
|
|
|
# link pam-config for su to ksu
|
2023-03-03 11:03:46 +01:00
|
|
|
%if 0%{?suse_version} > 1500
|
|
|
|
|
mkdir -p %{buildroot}%{_pam_vendordir}
|
|
|
|
|
install -m 644 %{SOURCE6} %{buildroot}%{_pam_vendordir}/ksu
|
|
|
|
|
%else
|
2020-02-26 09:25:58 +01:00
|
|
|
mkdir -p %{buildroot}%{_sysconfdir}/pam.d/
|
|
|
|
|
install -m 644 %{SOURCE6} %{buildroot}%{_sysconfdir}/pam.d/ksu
|
2023-03-03 11:03:46 +01:00
|
|
|
%endif
|
2016-11-24 15:43:00 +01:00
|
|
|
|
2006-12-19 00:16:52 +01:00
|
|
|
# cleanup
|
2020-02-26 09:25:58 +01:00
|
|
|
rm -f %{buildroot}%{_mandir}/man1/tmac.doc*
|
|
|
|
|
rm -f %{_mandir}/man1/tmac.doc* html/.doctrees/environment.pickle
|
2020-06-15 11:07:04 +02:00
|
|
|
rm -rf %{buildroot}%{_datadir}/examples
|
2016-01-10 17:41:42 +01:00
|
|
|
# manually remove test plugin since configure doesn't support disabling it at build time
|
|
|
|
|
rm -f %{buildroot}/%{_libdir}/krb5/plugins/preauth/test.so
|
2013-06-09 16:19:29 +02:00
|
|
|
|
2020-08-05 14:32:17 +02:00
|
|
|
%if "%{_lto_cflags}" != ""
|
2020-05-28 16:56:34 +02:00
|
|
|
# Don't add the lto flags to the public link flags.
|
2020-06-15 11:07:04 +02:00
|
|
|
sed -i "s/%{_lto_cflags}//" %{buildroot}%{_bindir}/krb5-config
|
2020-08-05 14:32:17 +02:00
|
|
|
%endif
|
2020-05-28 16:56:34 +02:00
|
|
|
|
2013-06-09 16:19:29 +02:00
|
|
|
%find_lang mit-krb5
|
2013-03-15 11:21:16 +01:00
|
|
|
|
2013-06-24 18:22:21 +02:00
|
|
|
%post -p /sbin/ldconfig
|
2016-07-02 09:38:07 +02:00
|
|
|
%postun -p /sbin/ldconfig
|
2021-04-12 14:07:29 +02:00
|
|
|
|
2012-10-05 16:25:10 +02:00
|
|
|
%preun server
|
|
|
|
|
%service_del_preun krb5kdc.service kadmind.service kpropd.service
|
2006-12-19 00:16:52 +01:00
|
|
|
|
|
|
|
|
%postun server
|
2012-10-05 16:25:10 +02:00
|
|
|
%service_del_postun krb5kdc.service kadmind.service kpropd.service
|
|
|
|
|
|
|
|
|
|
%post server
|
|
|
|
|
%service_add_post krb5kdc.service kadmind.service kpropd.service
|
Accepting request 670179 from home:scabrero:branches:network
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
OBS-URL: https://build.opensuse.org/request/show/670179
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=212
2019-02-13 18:01:33 +01:00
|
|
|
%tmpfiles_create krb5.conf
|
2012-10-05 16:25:10 +02:00
|
|
|
%{fillup_only -n kadmind}
|
|
|
|
|
%{fillup_only -n krb5kdc}
|
|
|
|
|
%{fillup_only -n kpropd}
|
|
|
|
|
|
|
|
|
|
%pre server
|
|
|
|
|
%service_add_pre krb5kdc.service kadmind.service kpropd.service
|
|
|
|
|
|
2012-10-15 15:04:28 +02:00
|
|
|
%post plugin-kdb-ldap -p /sbin/ldconfig
|
2016-07-02 09:38:07 +02:00
|
|
|
%postun plugin-kdb-ldap -p /sbin/ldconfig
|
2012-10-05 16:25:10 +02:00
|
|
|
|
2023-03-03 11:03:46 +01:00
|
|
|
%if 0%{?suse_version} > 1500
|
|
|
|
|
%pre client
|
|
|
|
|
# Prepare for migration to /usr/etc; save any old .rpmsave
|
|
|
|
|
for i in pam.d/ksu ; do
|
|
|
|
|
test -f %{_sysconfdir}/${i}.rpmsave && mv -v %{_sysconfdir}/${i}.rpmsave %{_sysconfdir}/${i}.rpmsave.old ||:
|
|
|
|
|
done
|
|
|
|
|
|
|
|
|
|
%posttrans client
|
|
|
|
|
# Migration to /usr/etc, restore just created .rpmsave
|
|
|
|
|
for i in pam.d/ksu ; do
|
|
|
|
|
test -f %{_sysconfdir}/${i}.rpmsave && mv -v %{_sysconfdir}/${i}.rpmsave %{_sysconfdir}/${i} ||:
|
|
|
|
|
done
|
|
|
|
|
%endif
|
|
|
|
|
|
2009-07-08 19:41:43 +02:00
|
|
|
%files devel
|
2012-02-28 10:04:15 +01:00
|
|
|
%dir %{_datadir}/aclocal
|
2009-07-08 19:41:43 +02:00
|
|
|
%{_libdir}/libgssrpc.so
|
|
|
|
|
%{_libdir}/libk5crypto.so
|
2010-03-23 12:40:55 +01:00
|
|
|
%{_libdir}/libkadm5clnt_mit.so
|
2009-07-08 19:41:43 +02:00
|
|
|
%{_libdir}/libkadm5clnt.so
|
2010-03-23 12:40:55 +01:00
|
|
|
%{_libdir}/libkadm5srv_mit.so
|
2009-07-08 19:41:43 +02:00
|
|
|
%{_libdir}/libkadm5srv.so
|
|
|
|
|
%{_libdir}/libkdb5.so
|
|
|
|
|
%{_libdir}/libkrb5.so
|
|
|
|
|
%{_libdir}/libkrb5support.so
|
2014-01-15 15:14:20 +01:00
|
|
|
%{_libdir}/libkrad.so
|
|
|
|
|
%{_libdir}/pkgconfig/gssrpc.pc
|
|
|
|
|
%{_libdir}/pkgconfig/kadm-client.pc
|
|
|
|
|
%{_libdir}/pkgconfig/kadm-server.pc
|
|
|
|
|
%{_libdir}/pkgconfig/kdb.pc
|
|
|
|
|
%{_libdir}/pkgconfig/krb5-gssapi.pc
|
|
|
|
|
%{_libdir}/pkgconfig/krb5.pc
|
|
|
|
|
%{_libdir}/pkgconfig/mit-krb5-gssapi.pc
|
|
|
|
|
%{_libdir}/pkgconfig/mit-krb5.pc
|
2009-07-08 19:41:43 +02:00
|
|
|
%{_includedir}/*
|
2020-06-15 11:07:04 +02:00
|
|
|
%{_bindir}/krb5-config
|
|
|
|
|
%{_sbindir}/krb5-send-pr
|
2020-02-26 09:25:58 +01:00
|
|
|
%{_mandir}/man1/krb5-config.1%{?ext_man}
|
2012-02-28 10:04:15 +01:00
|
|
|
%{_datadir}/aclocal/ac_check_krb5.m4
|
2012-10-05 16:25:10 +02:00
|
|
|
|
2013-06-09 16:19:29 +02:00
|
|
|
%files -f mit-krb5.lang
|
2006-12-19 00:16:52 +01:00
|
|
|
%dir %{krb5docdir}
|
2007-04-20 01:22:05 +02:00
|
|
|
# add plugin directories
|
|
|
|
|
%dir %{_libdir}/krb5
|
|
|
|
|
%dir %{_libdir}/krb5/plugins
|
|
|
|
|
%dir %{_libdir}/krb5/plugins/kdb
|
|
|
|
|
%dir %{_libdir}/krb5/plugins/preauth
|
|
|
|
|
%dir %{_libdir}/krb5/plugins/libkrb5
|
2015-01-06 11:58:20 +01:00
|
|
|
%dir %{_libdir}/krb5/plugins/tls
|
2007-04-20 01:22:05 +02:00
|
|
|
# add log directory
|
2020-02-26 09:25:58 +01:00
|
|
|
%attr(0700,root,root) %dir %{_localstatedir}/log/krb5
|
2009-07-08 19:41:43 +02:00
|
|
|
%doc %{krb5docdir}/README
|
2006-12-19 00:16:52 +01:00
|
|
|
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/krb5.conf
|
2018-05-01 05:19:15 +02:00
|
|
|
%dir %{_sysconfdir}/krb5.conf.d
|
2024-03-11 08:49:33 +01:00
|
|
|
%if 0%{?suse_version} >= 1550 || 0%{?sle_version} >= 150400
|
|
|
|
|
%config(noreplace,missingok) %{_sysconfdir}/krb5.conf.d/crypto-policies
|
|
|
|
|
%endif
|
2009-07-08 19:41:43 +02:00
|
|
|
%{_libdir}/libgssapi_krb5.*
|
|
|
|
|
%{_libdir}/libgssrpc.so.*
|
|
|
|
|
%{_libdir}/libk5crypto.so.*
|
2010-03-23 12:40:55 +01:00
|
|
|
%{_libdir}/libkadm5clnt_mit.so.*
|
|
|
|
|
%{_libdir}/libkadm5srv_mit.so.*
|
2009-07-08 19:41:43 +02:00
|
|
|
%{_libdir}/libkdb5.so.*
|
|
|
|
|
%{_libdir}/libkrb5.so.*
|
|
|
|
|
%{_libdir}/libkrb5support.so.*
|
2014-01-15 15:14:20 +01:00
|
|
|
%{_libdir}/libkrad.so.*
|
2018-06-18 13:26:07 +02:00
|
|
|
%{_libdir}/krb5/plugins/tls/*.so
|
2006-12-19 00:16:52 +01:00
|
|
|
|
|
|
|
|
%files server
|
2020-02-26 09:25:58 +01:00
|
|
|
%attr(0700,root,root) %dir %{_localstatedir}/log/krb5
|
2007-06-15 00:26:00 +02:00
|
|
|
%config(noreplace) %{_sysconfdir}/logrotate.d/krb5-server
|
2012-10-05 16:25:10 +02:00
|
|
|
%{_unitdir}/kadmind.service
|
|
|
|
|
%{_unitdir}/krb5kdc.service
|
|
|
|
|
%{_unitdir}/kpropd.service
|
2020-04-29 11:47:44 +02:00
|
|
|
%{_tmpfilesdir}/krb5.conf
|
2006-12-19 00:16:52 +01:00
|
|
|
%dir %{krb5docdir}
|
Accepting request 670179 from home:scabrero:branches:network
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
OBS-URL: https://build.opensuse.org/request/show/670179
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=212
2019-02-13 18:01:33 +01:00
|
|
|
%dir %{_datadir}/kerberos/
|
|
|
|
|
%dir %{_datadir}/kerberos/krb5kdc
|
|
|
|
|
%dir %{_datadir}/kerberos/krb5
|
|
|
|
|
%dir %{_datadir}/kerberos/krb5/user
|
2006-12-19 00:16:52 +01:00
|
|
|
%dir %{_libdir}/krb5
|
|
|
|
|
%dir %{_libdir}/krb5/plugins
|
|
|
|
|
%dir %{_libdir}/krb5/plugins/kdb
|
2015-01-06 11:58:20 +01:00
|
|
|
%dir %{_libdir}/krb5/plugins/tls
|
Accepting request 670179 from home:scabrero:branches:network
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
OBS-URL: https://build.opensuse.org/request/show/670179
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=212
2019-02-13 18:01:33 +01:00
|
|
|
%attr(0600,root,root) %config(noreplace) %{_datadir}/kerberos/krb5kdc/kdc.conf
|
|
|
|
|
%attr(0600,root,root) %config(noreplace) %{_datadir}/kerberos/krb5kdc/kadm5.acl
|
|
|
|
|
%attr(0600,root,root) %config(noreplace) %{_datadir}/kerberos/krb5kdc/kadm5.dict
|
|
|
|
|
%ghost %dir %{_sharedstatedir}/kerberos/
|
|
|
|
|
%ghost %dir %{_sharedstatedir}/kerberos/krb5kdc
|
|
|
|
|
%ghost %dir %{_sharedstatedir}/kerberos/krb5
|
|
|
|
|
%ghost %dir %{_sharedstatedir}/kerberos/krb5/user
|
|
|
|
|
%ghost %attr(0600,root,root) %config(noreplace) %{_sharedstatedir}/kerberos/krb5kdc/kdc.conf
|
|
|
|
|
%ghost %attr(0600,root,root) %config(noreplace) %{_sharedstatedir}/kerberos/krb5kdc/kadm5.acl
|
|
|
|
|
%ghost %attr(0600,root,root) %config(noreplace) %{_sharedstatedir}/kerberos/krb5kdc/kadm5.dict
|
2017-11-23 15:51:34 +01:00
|
|
|
%{_fillupdir}/sysconfig.*
|
2020-02-26 09:25:58 +01:00
|
|
|
%{_sbindir}/rc*
|
2020-06-15 11:07:04 +02:00
|
|
|
%{_sbindir}/kadmin.local
|
|
|
|
|
%{_sbindir}/kadmind
|
|
|
|
|
%{_sbindir}/kpropd
|
|
|
|
|
%{_sbindir}/kproplog
|
|
|
|
|
%{_sbindir}/kprop
|
|
|
|
|
%{_sbindir}/kdb5_util
|
|
|
|
|
%{_sbindir}/krb5kdc
|
|
|
|
|
%{_sbindir}/gss-server
|
|
|
|
|
%{_sbindir}/sim_server
|
|
|
|
|
%{_sbindir}/sserver
|
|
|
|
|
%{_sbindir}/uuserver
|
2009-07-08 19:41:43 +02:00
|
|
|
%{_libdir}/krb5/plugins/kdb/db2.so
|
2024-05-14 09:54:34 +02:00
|
|
|
%{_libdir}/krb5/plugins/kdb/klmdb.so
|
2020-02-26 09:25:58 +01:00
|
|
|
%{_mandir}/man5/kdc.conf.5%{?ext_man}
|
|
|
|
|
%{_mandir}/man5/kadm5.acl.5%{?ext_man}
|
|
|
|
|
%{_mandir}/man8/kadmind.8%{?ext_man}
|
|
|
|
|
%{_mandir}/man8/kadmin.local.8%{?ext_man}
|
|
|
|
|
%{_mandir}/man8/kpropd.8%{?ext_man}
|
|
|
|
|
%{_mandir}/man8/kprop.8%{?ext_man}
|
|
|
|
|
%{_mandir}/man8/kproplog.8%{?ext_man}
|
|
|
|
|
%{_mandir}/man8/kdb5_util.8%{?ext_man}
|
|
|
|
|
%{_mandir}/man8/krb5kdc.8%{?ext_man}
|
|
|
|
|
%{_mandir}/man8/sserver.8%{?ext_man}
|
2006-12-19 00:16:52 +01:00
|
|
|
|
|
|
|
|
%files client
|
2023-03-03 11:03:46 +01:00
|
|
|
%if 0%{?suse_version} > 1500
|
|
|
|
|
%attr(0644,root,root) %{_pam_vendordir}/ksu
|
|
|
|
|
%else
|
2020-02-26 09:25:58 +01:00
|
|
|
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/pam.d/ksu
|
2023-03-03 11:03:46 +01:00
|
|
|
%endif
|
2020-06-15 11:07:04 +02:00
|
|
|
%{_bindir}/kvno
|
|
|
|
|
%{_bindir}/kinit
|
|
|
|
|
%{_bindir}/kdestroy
|
|
|
|
|
%{_bindir}/kpasswd
|
|
|
|
|
%{_bindir}/klist
|
|
|
|
|
%{_bindir}/kadmin
|
|
|
|
|
%{_bindir}/ktutil
|
|
|
|
|
%{_bindir}/k5srvutil
|
|
|
|
|
%{_bindir}/gss-client
|
|
|
|
|
%{_bindir}/ksu
|
|
|
|
|
%{_bindir}/sclient
|
|
|
|
|
%{_bindir}/sim_client
|
|
|
|
|
%{_bindir}/uuclient
|
|
|
|
|
%{_bindir}/kswitch
|
2020-02-26 09:25:58 +01:00
|
|
|
%{_bindir}/kinit
|
|
|
|
|
%{_bindir}/klist
|
|
|
|
|
%{_mandir}/man1/kvno.1%{?ext_man}
|
|
|
|
|
%{_mandir}/man1/kinit.1%{?ext_man}
|
|
|
|
|
%{_mandir}/man1/kdestroy.1%{?ext_man}
|
|
|
|
|
%{_mandir}/man1/kpasswd.1%{?ext_man}
|
|
|
|
|
%{_mandir}/man1/klist.1%{?ext_man}
|
|
|
|
|
%{_mandir}/man1/kadmin.1%{?ext_man}
|
|
|
|
|
%{_mandir}/man1/ktutil.1%{?ext_man}
|
|
|
|
|
%{_mandir}/man1/k5srvutil.1%{?ext_man}
|
|
|
|
|
%{_mandir}/man1/kswitch.1%{?ext_man}
|
|
|
|
|
%{_mandir}/man5/krb5.conf.5%{?ext_man}
|
|
|
|
|
%{_mandir}/man5/.k5login.5%{?ext_man}
|
|
|
|
|
%{_mandir}/man5/.k5identity.5%{?ext_man}
|
|
|
|
|
%{_mandir}/man5/k5identity.5%{?ext_man}
|
|
|
|
|
%{_mandir}/man5/k5login.5%{?ext_man}
|
|
|
|
|
%{_mandir}/man1/ksu.1%{?ext_man}
|
|
|
|
|
%{_mandir}/man1/sclient.1%{?ext_man}
|
|
|
|
|
%{_mandir}/man7/kerberos.7%{?ext_man}
|
2006-12-19 00:16:52 +01:00
|
|
|
|
2009-07-08 19:41:43 +02:00
|
|
|
%files plugin-kdb-ldap
|
2021-04-12 14:07:29 +02:00
|
|
|
%{_sbindir}/kdb5_ldap_util
|
2019-05-08 12:10:09 +02:00
|
|
|
%dir %{_datadir}/kerberos
|
|
|
|
|
%dir %{_datadir}/kerberos/ldap
|
|
|
|
|
%config %{_datadir}/kerberos/ldap/kerberos.schema
|
|
|
|
|
%config %{_datadir}/kerberos/ldap/kerberos.ldif
|
2021-04-12 14:07:29 +02:00
|
|
|
%dir %{_libdir}/krb5
|
|
|
|
|
%dir %{_libdir}/krb5/plugins
|
|
|
|
|
%dir %{_libdir}/krb5/plugins/kdb
|
2009-07-08 19:41:43 +02:00
|
|
|
%{_libdir}/krb5/plugins/kdb/kldap.so
|
|
|
|
|
%{_libdir}/libkdb_ldap*
|
2020-02-26 09:25:58 +01:00
|
|
|
%{_mandir}/man8/kdb5_ldap_util.8%{?ext_man}
|
2009-07-08 19:41:43 +02:00
|
|
|
|
|
|
|
|
%files plugin-preauth-pkinit
|
|
|
|
|
%dir %{_libdir}/krb5
|
|
|
|
|
%dir %{_libdir}/krb5/plugins
|
|
|
|
|
%dir %{_libdir}/krb5/plugins/preauth
|
|
|
|
|
%{_libdir}/krb5/plugins/preauth/pkinit.so
|
2013-03-15 11:21:16 +01:00
|
|
|
|
2014-01-15 15:14:20 +01:00
|
|
|
%files plugin-preauth-otp
|
|
|
|
|
%dir %{_libdir}/krb5
|
|
|
|
|
%dir %{_libdir}/krb5/plugins
|
|
|
|
|
%dir %{_libdir}/krb5/plugins/preauth
|
|
|
|
|
%{_libdir}/krb5/plugins/preauth/otp.so
|
|
|
|
|
|
Accepting request 670179 from home:scabrero:branches:network
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
- Upgrade to 1.17. Major changes:
Administrator experience:
* A new Kerberos database module using the Lightning Memory-Mapped
Database library (LMDB) has been added. The LMDB KDB module should
be more performant and more robust than the DB2 module, and may
become the default module for new databases in a future release.
* "kdb5_util dump" will no longer dump policy entries when specific
principal names are requested.
Developer experience:
* The new krb5_get_etype_info() API can be used to retrieve enctype,
salt, and string-to-key parameters from the KDC for a client
principal.
* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
principal names to be used with GSS-API functions.
* KDC and kadmind modules which call com_err() will now write to the
log file in a format more consistent with other log messages.
* Programs which use large numbers of memory credential caches should
perform better.
Protocol evolution:
* The SPAKE pre-authentication mechanism is now supported. This
mechanism protects against password dictionary attacks without
requiring any additional infrastructure such as certificates. SPAKE
is enabled by default on clients, but must be manually enabled on
the KDC for this release.
* PKINIT freshness tokens are now supported. Freshness tokens can
protect against scenarios where an attacker uses temporary access to
a smart card to generate authentication requests for the future.
* Password change operations now prefer TCP over UDP, to avoid
spurious error messages about replays when a response packet is
dropped.
* The KDC now supports cross-realm S4U2Self requests when used with a
third-party KDB module such as Samba's. The client code for
cross-realm S4U2Self requests is also now more robust.
User experience:
* The new ktutil addent -f flag can be used to fetch salt information
from the KDC for password-based keys.
* The new kdestroy -p option can be used to destroy a credential cache
within a collection by client principal name.
* The Kerberos man page has been restored, and documents the
environment variables that affect programs using the Kerberos
library.
Code quality:
* Python test scripts now use Python 3.
* Python test scripts now display markers in verbose output, making it
easier to find where a failure occurred within the scripts.
* The Windows build system has been simplified and updated to work
with more recent versions of Visual Studio. A large volume of
unused Windows-specific code has been removed. Visual Studio 2013
or later is now required.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
by transactional updates; (bsc#1100126);
- Rename patches:
* krb5-1.12-pam.patch => 0001-krb5-1.12-pam.patch
* krb5-1.9-manpaths.dif => 0002-krb5-1.9-manpaths.patch
* krb5-1.12-buildconf.patch => 0003-krb5-1.12-buildconf.patch
* krb5-1.6.3-gssapi_improve_errormessages.dif to
0004-krb5-1.6.3-gssapi_improve_errormessages.patch
* krb5-1.6.3-ktutil-manpage.dif => 0005-krb5-1.6.3-ktutil-manpage.patch
* krb5-1.12-api.patch => 0006-krb5-1.12-api.patch
* krb5-1.12-ksu-path.patch => 0007-krb5-1.12-ksu-path.patch
* krb5-1.12-selinux-label.patch => 0008-krb5-1.12-selinux-label.patch
* krb5-1.9-debuginfo.patch => 0009-krb5-1.9-debuginfo.patch
OBS-URL: https://build.opensuse.org/request/show/670179
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=212
2019-02-13 18:01:33 +01:00
|
|
|
%files plugin-preauth-spake
|
|
|
|
|
%dir %{_libdir}/krb5
|
|
|
|
|
%dir %{_libdir}/krb5/plugins
|
|
|
|
|
%dir %{_libdir}/krb5/plugins/preauth
|
|
|
|
|
%{_libdir}/krb5/plugins/preauth/spake.so
|
|
|
|
|
|
2007-02-19 21:42:34 +01:00
|
|
|
%changelog
|
