NethServer 6

This is not needed at the moment, because the backup works right (even for nethserver-sogo).

But it's a really useful improvement.

MODIFIED

• Modified packages nethserver-{lib,base,directory,samba,mail-server}
• Password generation and persistence is provided by NethServer::Password module
• Functions genRandomPassword(), genRandomHash() from esmith::utils and getUserPassword(), configServiceAccount() from NethServer::Directory now relies on NethServer::Password and are backward-compatible
• Default directory to store secrets is /var/lib/nethserver/secrets

Release notes

1. Before upgrade (faster). Migrate secrets to new directory:

       # mkdir /var/lib/nethserver/secrets
       # for F in /etc/openldap/.*.pw; do N=`basename ${F} .pw`; D=/var/lib/nethserver/secrets/${N#.}; cp -v $F $D; done;
       # cp -v /etc/pam_ldap.secret /var/lib/nethserver/secrets/pam
   

2. After upgrade (slower). Reconfigure all, generating new passwords:

       # /etc/e-smith/events/actions/system-adjust
   

Whatever procedure you chose, at the end you can remove the old files /etc/openldap/.*.pw.

Test case

Execute one of the upgrade procedures described above.

Get the list of LDAP service accounts:

    # ldapsearch -Y EXTERNAL -LLL objectClass=simpleSecurityObject dn 2>/dev/null

Password in LDAP must be aligned with the contents of /var/lib/nethserver/secrets:

    # for F in /var/lib/nethserver/secrets/*; do echo -n "$F: "; ldapwhoami -D cn=`basename $F`,dc=directory,dc=nh -x -y $F || echo $F has FAILED; done
...

Some of the above tests can fail, if the file name does not correspond to a LDAP service account.

The following identities are registered on a system with all nethserver-* packages installed. This is a list of identity/test to execute after the upgrade:

• ejabberd
  check user login
• samba

      # net -d 10 sam list users
  ...
  ldap_connect_system: Binding to ldap server ldap://127.0.0.1 as "cn=samba,dc=directory,dc=nh" 
  ldap_connect_system: successful connection to the LDAP server
  ldap_connect_system: LDAP server does support paged results
  The LDAP server is successfully connected
  

• sogo
  check user login
• vmail (not an LDAP service account)
  read master user <PASSWORD> from /etc/dovecot/master-users. The password must be equal to /var/lib/nethserver/secrets/vmail contents. Replace it in the command below:

      # (sleep 1; echo "A LOGIN admin*vmail <PASSWORD>"; sleep 1; echo "B SELECT INBOX"; sleep 2) | nc -C localhost 143
  ...
  B OK [READ-WRITE] Select completed.
  

• libuser

      # id nsstest
  uid=501(nsstest) gid=501(nsstest) groups=501(nsstest)
  

• pam
  change user password with passwd command

In nethserver-testing:
nethserver-lib-1.3.2-18.0gitff4d2640.ns6.noarch.rpm
nethserver-base-1.4.3-11.0gitc6f6994a.ns6.noarch.rpm
nethserver-directory-1.2.3-8.0git7c628b91.ns6.noarch.rpm
nethserver-samba-1.3.6-3.0git7417c992.ns6.noarch.rpm
nethserver-mail-server-1.4.6-7.0gitefd1b71d.ns6.noarch.rpm

All tested services work fine.

Marking as VERIFIED.

In nethserver-updates:
nethserver-samba-1.4.0-1.ns6.noarch.rpm
nethserver-directory-1.3.0-1.ns6.noarch.rpm
nethserver-dnsmasq-1.1.0-1.ns6.noarch.rpm
nethserver-shorewall-1.0.3-1.ns6.noarch.rpm
nethserver-mail-server-1.5.0-1.ns6.noarch.rpm
nethserver-mail-filter-1.1.4-1.ns6.noarch.rpm
nethserver-nethgui-1.3.0-1.ns6.noarch.rpm
nethserver-base-1.5.0-1.ns6.noarch.rpm
nethserver-lib-1.4.0-1.ns6.noarch.rpm
nethserver-httpd-admin-1.1.0-1.ns6.noarch.rpm
nethserver-yum-1.2.0-1.ns6.noarch.rpm
nethserver-ntopng-1.1.0-1.ns6.noarch.rpm