Your message dated Fri, 27 Apr 2012 09:34:46 +0000
with message-id <e1snhze-00057w...@franck.debian.org>
and subject line Bug#670133: fixed in nss-pam-ldapd 0.8.8-1
has caused the Debian Bug report #670133,
regarding nslcd: /etc/nslcd.conf's binddn/bindpw removed during upgrade
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
670133: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=670133
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: nslcd
Version: 0.8.7-1
Severity: critical
Tags: patch
Usertags: pca.it-authentication
Hi there!
Basically, with today's upgrade, my /etc/nslcd.conf was automatically
changed and the LDAP setup completely broke:
=====
root@gismo:/etc# cat /var/log/syslog
[...]
Apr 23 10:27:29 gismo nslcd[5209]: version 0.8.7 starting
Apr 23 10:27:29 gismo nslcd[5209]: accepting connections
Apr 23 10:27:37 gismo nslcd[5209]: [8b4567] <group/member="luca"> ldap_result()
failed: Insufficient access
[...]
root@gismo:/etc# git log -p -1
commit abc0c29950469771617ffd0be132456669b7d305
Author: Luca Capello <l...@pca.it>
Date: Mon Apr 23 10:27:35 2012 +0200
committing changes in /etc after apt run
Package changes:
[...]
-nslcd 0.8.6-1
+nslcd 0.8.7-1
[...]
diff --git a/nslcd.conf b/nslcd.conf
index 8ea8f0c..db2131d 100644
--- a/nslcd.conf
+++ b/nslcd.conf
@@ -16,8 +16,8 @@ base dc=pca,dc=it
#ldap_version 3
# The DN to bind with for normal lookups.
-binddn HIDDEN
-bindpw HIDDEN
+#binddn HIDDEN
+#bindpw *removed*
# The DN used for password modifications by root.
#rootpwmoddn cn=admin,dc=example,dc=com
=====
I was quite surprised by that and then discovered the reason:
/etc/nslcd.conf is not a dpkg's conffile (it does not show up with
`dpkg-query -s nslcd`), thus any modification done is not automatically
preserved during upgrades, which is a bug according to
debian-policy_3.9.3.1's ยง 10.7.3:
<http://www.debian.org/doc/debian-policy/ch-files.html#s10.7.3>
10.7 Configuration files
[...]
10.7.3 Behavior
Configuration file handling must conform to the following behavior:
* local changes must be preserved during a package upgrade,
NB, the Severity: of this bug is critical (and not serious) because no
more LDAP users can work with the system.
Strangely enough, this should have already been fixed by #610117. Some
debugging and the problem in my case was clear: I did not used
debconf/dpkg-reconfigure to configure nslcd (which is perfectly fine, no
configuration method is mandatory in Debian), thus given that debconf's
nslcd/ldap-auth-type was empty /var/lib/dpkg/info/nslcd.postinst:212
thinks that there is no authentication at all.
This is easily fixed with the following patch, but further investigation
is still needed, given that bindpw is still removed, again if you do not
use debconf/dpkg-reconfigure:
--8<---------------cut here---------------start------------->8---
--- nslcd.postinst.ORG 2012-04-23 01:22:29.000000000 +0200
+++ nslcd.postinst 2012-04-23 12:04:15.180373883 +0200
@@ -211,6 +211,10 @@
update_config nslcd/ldap-base base
db_get nslcd/ldap-auth-type
authtype="$RET"
+ db_get nslcd/ldap-binddn
+ if [ -n "$RET" ] && [ "$authtype" = none ]; then
+ authtype=simple
+ fi
case "$authtype" in
simple)
update_config nslcd/ldap-binddn binddn
--8<---------------cut here---------------end--------------->8---
The problem is present on the debconf's side as well, reproducible with:
=====
root@gismo:/etc# debconf-show nslcd
* nslcd/ldap-bindpw: (password omitted)
nslcd/ldap-sasl-realm:
* nslcd/ldap-starttls: false
nslcd/ldap-sasl-krb5-ccname: /var/run/nslcd/nslcd.tkt
nslcd/ldap-auth-type: none
nslcd/ldap-reqcert:
* nslcd/ldap-uris: ldap://ldap.pca.it
nslcd/ldap-sasl-secprops:
* nslcd/ldap-binddn: HIDDEN
nslcd/ldap-sasl-authcid:
nslcd/ldap-sasl-mech:
* nslcd/ldap-base: dc=pca,dc=it
nslcd/ldap-sasl-authzid:
root@gismo:/etc# git diff
diff --git a/nslcd.conf b/nslcd.conf
index db2131d..2984a50 100644
--- a/nslcd.conf
+++ b/nslcd.conf
@@ -16,8 +16,8 @@ base dc=pca,dc=it
#ldap_version 3
# The DN to bind with for normal lookups.
-#binddn HIDDEN
-#bindpw *removed*
+binddn test
+bindpw test
# The DN used for password modifications by root.
#rootpwmoddn cn=admin,dc=example,dc=com
root@gismo:/etc# dpkg-reconfigure nslcd
[...]
root@gismo:/etc# git diff | less
diff --git a/nslcd.conf b/nslcd.conf
index db2131d..41b888f 100644
--- a/nslcd.conf
+++ b/nslcd.conf
@@ -16,7 +16,7 @@ base dc=pca,dc=it
#ldap_version 3
# The DN to bind with for normal lookups.
-#binddn HIDDEN
+#binddn test
#bindpw *removed*
# The DN used for password modifications by root.
root@gismo:/etc# debconf-show nslcd
* nslcd/ldap-bindpw: (password omitted)
nslcd/ldap-sasl-realm:
* nslcd/ldap-starttls: false
nslcd/ldap-sasl-krb5-ccname: /var/run/nslcd/nslcd.tkt
* nslcd/ldap-auth-type: none
nslcd/ldap-reqcert:
* nslcd/ldap-uris: ldap://ldap.pca.it
nslcd/ldap-sasl-secprops:
* nslcd/ldap-binddn: test
nslcd/ldap-sasl-authcid:
nslcd/ldap-sasl-mech:
* nslcd/ldap-base: dc=pca,dc=it
nslcd/ldap-sasl-authzid:
root@gismo:/etc#
=====
It seems the /etc/nslcd.conf handling is in some way broken :-(
Thx, bye,
Gismo / Luca
-- System Information:
Debian Release: wheezy/sid
APT prefers unstable
APT policy: (990, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 3.2.0-2-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages nslcd depends on:
ii adduser 3.113+nmu1
ii debconf [debconf-2.0] 1.5.42
ii libc6 2.13-30
ii libgssapi-krb5-2 1.10+dfsg~beta1-2
ii libldap-2.4-2 2.4.28-1.2
Versions of packages nslcd recommends:
ii bind9-host [host] 1:9.8.1.dfsg.P1-4
ii host 1:9.8.1.dfsg.P1-4
ii ldap-utils 2.4.28-1.2
ii libnss-ldapd [libnss-ldap] 0.8.7-1
ii libpam-ldapd [libpam-ldap] 0.8.7-1
ii nscd 2.13-30
Versions of packages nslcd suggests:
pn kstart <none>
-- debconf information:
nslcd/ldap-sasl-realm:
* nslcd/ldap-starttls: false
nslcd/ldap-sasl-krb5-ccname: /var/run/nslcd/nslcd.tkt
nslcd/ldap-auth-type: none
nslcd/ldap-reqcert:
* nslcd/ldap-uris: ldap://ldap.pca.it
nslcd/ldap-sasl-secprops:
* nslcd/ldap-binddn: HIDDEN
nslcd/ldap-sasl-authcid:
nslcd/ldap-sasl-mech:
* nslcd/ldap-base: dc=pca,dc=it
nslcd/ldap-sasl-authzid:
pgpTJkkdBFvws.pgp
Description: PGP signature
--- End Message ---
--- Begin Message ---
Source: nss-pam-ldapd
Source-Version: 0.8.8-1
We believe that the bug you reported is fixed in the latest version of
nss-pam-ldapd, which is due to be installed in the Debian FTP archive:
libnss-ldapd_0.8.8-1_i386.deb
to main/n/nss-pam-ldapd/libnss-ldapd_0.8.8-1_i386.deb
libpam-ldapd_0.8.8-1_i386.deb
to main/n/nss-pam-ldapd/libpam-ldapd_0.8.8-1_i386.deb
nslcd_0.8.8-1_i386.deb
to main/n/nss-pam-ldapd/nslcd_0.8.8-1_i386.deb
nss-pam-ldapd_0.8.8-1.debian.tar.gz
to main/n/nss-pam-ldapd/nss-pam-ldapd_0.8.8-1.debian.tar.gz
nss-pam-ldapd_0.8.8-1.dsc
to main/n/nss-pam-ldapd/nss-pam-ldapd_0.8.8-1.dsc
nss-pam-ldapd_0.8.8.orig.tar.gz
to main/n/nss-pam-ldapd/nss-pam-ldapd_0.8.8.orig.tar.gz
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 670...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Arthur de Jong <adej...@debian.org> (supplier of updated nss-pam-ldapd package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Fri, 27 Apr 2012 11:20:00 +0200
Source: nss-pam-ldapd
Binary: nslcd libnss-ldapd libpam-ldapd
Architecture: source i386
Version: 0.8.8-1
Distribution: unstable
Urgency: low
Maintainer: Arthur de Jong <adej...@debian.org>
Changed-By: Arthur de Jong <adej...@debian.org>
Description:
libnss-ldapd - NSS module for using LDAP as a naming service
libpam-ldapd - PAM module for using LDAP as an authentication service
nslcd - Daemon for NSS and PAM lookups using LDAP
Closes: 669680 670133 670419
Changes:
nss-pam-ldapd (0.8.8-1) unstable; urgency=low
.
* new upstream release:
- fix a problem in the handling of PAM requests in nslcd (closes: #670419)
- install the ldapns.schema in nslcd docs (closes: #669680)
* use the configuration file contents to determine the authentication
type, not the debconf database (closes: #670133)
* switch PAM account type to primary because it now does all the
authorisation checks that pam_unix also does
* drop functionality to check whether shadow information is exposed
in /etc/nsswitch.conf, it was no longer needed sine 0.8.4
* ensure that /var/run/nslcd is not removed during upgrades
Checksums-Sha1:
69563a30a974136131cbb87336e7d892b498c36d 1510 nss-pam-ldapd_0.8.8-1.dsc
d607eb2c17b7fc757aaa52f14035bca6998fdcde 473002 nss-pam-ldapd_0.8.8.orig.tar.gz
42a5ad7d85f9b1bda141f479b6c057774066b4f2 87920
nss-pam-ldapd_0.8.8-1.debian.tar.gz
3077b2486e120092a409a5f77aa3a22a037dec9a 167332 nslcd_0.8.8-1_i386.deb
08dc3680ec96027ba8dfcbcb313afb0deb6bf837 62522 libnss-ldapd_0.8.8-1_i386.deb
570a954ea18dab4186a74d5e39f335f06401cb74 48528 libpam-ldapd_0.8.8-1_i386.deb
Checksums-Sha256:
7ca72718f690a1541d649264c0f14271d4a5e50a546ffce9efb3edaff6833830 1510
nss-pam-ldapd_0.8.8-1.dsc
880538e5507992b9067f5b20e7e290f8bd3a994569b3f41b4db5047775bb73fa 473002
nss-pam-ldapd_0.8.8.orig.tar.gz
f2b213241a04327414d8d29fe73e2d089c10d04f8dc34a426669126cdbf1d00c 87920
nss-pam-ldapd_0.8.8-1.debian.tar.gz
7944b85352509d6ab880ce459ecc3c99a72b3a3ae8b34d9fc1bf7eeb0a8fb198 167332
nslcd_0.8.8-1_i386.deb
08af8fdb8c9e946ca20095990b139b3cb3a9a3fc2342133c6129dc6c43b792db 62522
libnss-ldapd_0.8.8-1_i386.deb
eb039bf2af608cd4d4562801f29309815d518cc5c98185ec42af3977c0a8d86f 48528
libpam-ldapd_0.8.8-1_i386.deb
Files:
2bd6ad2a5e0f18f6b98b589c3965f0e8 1510 admin extra nss-pam-ldapd_0.8.8-1.dsc
50e4ac6180275b9c2287e4323a1cd4c6 473002 admin extra
nss-pam-ldapd_0.8.8.orig.tar.gz
b34be877d35aa919692cd4d6d46ac729 87920 admin extra
nss-pam-ldapd_0.8.8-1.debian.tar.gz
e488d7f4dbff689c4a811dd42b55fe25 167332 admin extra nslcd_0.8.8-1_i386.deb
f3b771f2a2ccc0afeddecf6d0a49adc0 62522 admin extra
libnss-ldapd_0.8.8-1_i386.deb
0306c547cbfeb99c73f254d0bf27d791 48528 admin extra
libpam-ldapd_0.8.8-1_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iEYEARECAAYFAk+aZjEACgkQVYan35+NCKd09ACeJbkgP4LtGvMpTbtUqJ87Asnj
G1UAn3xegRhOvG1icSSqxP2i5C3HPrLu
=k5DB
-----END PGP SIGNATURE-----
--- End Message ---