NethServer 6

Test case notes

1. Migration of admin's home directory both in empty and non-empty cases.
2. Group membership workflow: create/modify/delete with a member list of any length
3. Email delivery to root. root mailbox moved to admin when installed nethserver-mail-server. Email delivery to admin.
4. Check domain join when PDC (nethserver-samba). admin samba user should have granted SeMachineAccountPrivilege, that allow managing domain computer accounts.
5. admin user is default member of jabberadmins group nethserver-ejabberd
6. admin user is default member of faxmaster group nethserver-hylafax
7. IMAP admin login, SOGo admin login
8. server manager allows logging in as admin, even if nethserver-directory is not installed, providing the root's password. AdminIsNotRoot key must be honoured.

Release notes

When this issue is CLOSED, add the following release notes

nethserver-base¶

Before upgrade:

1. Stop httpd-admin (if still running as admin) then remove the admin account, if it's present in passwd:

       # service httpd-admin stop; killall httpd-admin; stop httpd-admin
       # grep -q admin /etc/passwd && userdel admin
   

2. Fix DB permissions:

       # chown -v root:adm /var/lib/nethserver/db/*
   

3. Move admin key in configuration DB to root:

       # sed -i 's/^admin=/root=/' /var/lib/nethserver/db/configuration
   

4. Clean up /etc/aliases:

       # sed -r -i '/^(# NethServer|root:|admin:)/ d' /etc/aliases
   

nethserver-directory¶

After upgrade:

1. Refresh group members:

       # /etc/e-smith/events/actions/group-modify-unix ev
   

2. Initialize locals group:

       # local_users=(`grep -F '=user|' /var/lib/nethserver/db/accounts | cut -d = -f 1`); lgroupmod -M "`echo ${local_users[*]} | tr ' ' ','`" locals
   

nethserver-ibays¶

• Before upgrade, remove shared group:

      # luserdel shared
  

• After upgrade change ownership to locals:

      # for IBAY in `grep -F '|OwningGroup|shared' /var/lib/nethserver/db/accounts  | cut -d = -f 1`; do db accounts setprop $IBAY OwningGroup locals; chgrp -Rv locals /var/lib/nethserver/ibay/$IBAY; done
  

nethserver-openvpn¶

• After upgrade change ownership of configuration files:
  

  # find /var/lib/nethserver/certs/ -group admin -exec chgrp adm '{}' \;
  # find /etc/openvpn/ -group admin -exec chgrp adm '{}' \;
  # find /var/lib/nethserver/certs/ -user admin -exec chown srvmgr '{}' \;
  # find /etc/openvpn/ -user admin -exec chown srvmgr '{}' \;
  

Testing upgraded machine¶

Test case 1
Home directory correctly created: /var/lib/nethserver/home/admin
Note: migration from NethService/SME not testd

Test case 2
The admin users is in LDAP, users and groups are correctly created:

root@test yum.repos.d]# ldapsearch -Y EXTERNAL uid=admin
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
# extended LDIF
#
# LDAPv3
# base <dc=directory,dc=nh> (default) with scope subtree
# filter: uid=admin
# requesting: ALL
#

# admin, People, directory.nh
dn: uid=admin,ou=People,dc=directory,dc=nh
uid: admin
shadowMin: 0
shadowWarning: 7
shadowExpire: -1
shadowInactive: -1
gecos: admin
shadowLastChange: 16085
shadowFlag: -1
uidNumber: 500
gidNumber: 500
homeDirectory: /var/lib/nethserver/home/admin
loginShell: /bin/bash
objectClass: posixAccount
objectClass: shadowAccount
objectClass: inetOrgPerson
telephoneNumber: 555-5555
o: XYZ Corporation
ou: Main
l: Ottawa
street: 123 Main Street
cn: System Administrator
givenName: System
sn: Administrator
shadowMax: 180
userPassword:: e0NSWVBUfSQ2JHhqVE5tVEtZJEY2S29RejBrQ3JHdzVIYUtlUS5QYlY1NnUxS2F
 NakRvaUhBZXJ4ckJOMWM3NFo1bzZqSWYuYi5ZZ0VvTUQ1Si40N3phckdQVnVGalcvaWNKREhMamEv

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

[root@test ~]# ldapsearch -Y EXTERNAL cn=test
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
# extended LDIF
#
# LDAPv3
# base <dc=directory,dc=nh> (default) with scope subtree
# filter: cn=test
# requesting: ALL
#

# test, Groups, directory.nh
dn: cn=test,ou=Groups,dc=directory,dc=nh
cn: test
gidNumber: 5001
objectClass: posixGroup
memberUid: giacomo

# test, People, directory.nh
dn: uid=test,ou=People,dc=directory,dc=nh
uid: test
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
shadowExpire: -1
homeDirectory: /home/test
shadowInactive: -1
userPassword:: e0NSWVBUfSEh
shadowLastChange: 16085
shadowFlag: -1
uidNumber: 5001
gidNumber: 5001
loginShell: /bin/false
sn: test
objectClass: posixAccount
objectClass: shadowAccount
objectClass: inetOrgPerson
cn: test
gecos: aa

# search result
search: 2
result: 0 Success

# numResponses: 3
# numEntries: 2

Test case 3
Mails are correctly delivered to admin user:

Jan 15 16:11:42 test dovecot: lmtp(30158): Connect from local
Jan 15 16:11:43 test dovecot: lmtp(30158, admin): UtJcOC6l1lLOdQAA6nEqjg: sieve: msgid=<20140115151142.D2136346E@test.test.loc>: stored mail into mailbox 'INBOX'
Jan 15 16:11:43 test postfix/lmtp[30157]: D2136346E: to=<admin@test.test.loc>, orig_to=<root@test.test.loc>, relay=test.test.loc[/var/run/dovecot/lmtp], delay=0.14, delays=0/0.04/0.04/0.06, dsn=2.0.0, status=sent (250 2.0.0 <admin@test.test.loc> UtJcOC6l1lLOdQAA6nEqjg Saved)
Jan 15 16:11:43 test dovecot: lmtp(30158): Disconnect from local: Client quit (in reset)
Jan 15 16:11:43 test postfix/qmgr[27420]: D2136346E: removed
Jan 15 16:12:22 test postfix/pickup[27419]: DEFE9346F: uid=0 from=<root>
Jan 15 16:12:22 test postfix/cleanup[30151]: DEFE9346F: message-id=<20140115151222.DEFE9346F@test.test.loc>
Jan 15 16:12:22 test postfix/qmgr[27420]: DEFE9346F: from=<root@test.test.loc>, size=420, nrcpt=1 (queue active)
Jan 15 16:12:22 test dovecot: lmtp(30158): Connect from local
Jan 15 16:12:22 test dovecot: lmtp(30158, admin): VtJcOC6l1lLOdQAA6nEqjg: sieve: msgid=<20140115151222.DEFE9346F@test.test.loc>: stored mail into mailbox 'INBOX'
Jan 15 16:12:22 test dovecot: lmtp(30158): Disconnect from local: Client quit (in reset)
Jan 15 16:12:22 test postfix/lmtp[30157]: DEFE9346F: to=<admin@test.test.loc>, orig_to=<admin>, relay=test.test.loc[/var/run/dovecot/lmtp], delay=0.06, delays=0.05/0/0/0.01, dsn=2.0.0, status=sent (250 2.0.0 <admin@test.test.loc> VtJcOC6l1lLOdQAA6nEqjg Saved)
Jan 15 16:12:22 test postfix/qmgr[27420]: DEFE9346F: removed
Jan 15 16:12:39 test dovecot: master: Warning: Killed with signal 15 (by pid=31959 uid=0 code=kill)
Jan 15 16:12:40 test dovecot: master: Dovecot v2.1.16 starting up (core dumps disabled)
Jan 15 16:12:49 test postfix/pickup[27419]: C1FCE3471: uid=0 from=<root>
Jan 15 16:12:49 test postfix/cleanup[30151]: C1FCE3471: message-id=<20140115151249.C1FCE3471@test.test.loc>
Jan 15 16:12:49 test postfix/qmgr[27420]: C1FCE3471: from=<root@test.test.loc>, size=419, nrcpt=1 (queue active)
Jan 15 16:12:49 test dovecot: lmtp(32163): Connect from local
Jan 15 16:12:49 test postfix/lmtp[30157]: C1FCE3471: to=<admin@test.test.loc>, orig_to=<root>, relay=test.test.loc[/var/run/dovecot/lmtp], delay=0.15, delays=0.1/0/0.01/0.04, dsn=2.0.0, status=sent (250 2.0.0 <admin@test.test.loc> S3F6MHGl1lKjfQAA6nEqjg Saved)
Jan 15 16:12:49 test dovecot: lmtp(32163, admin): S3F6MHGl1lKjfQAA6nEqjg: sieve: msgid=<20140115151249.C1FCE3471@test.test.loc>: stored mail into mailbox 'INBOX'
Jan 15 16:12:49 test dovecot: lmtp(32163): Disconnect from local: Client quit (in reset)
Jan 15 16:12:49 test postfix/qmgr[27420]: C1FCE3471: removed

Test case 4
Tested with WindowsXP client, it works.
Note: Samba access for admin user must be explicitly set, also admin user password must be set.

Test case 5 and 6

[root@test yum.repos.d]# getent group faxmaster
faxmaster:*:504:admin
[root@test yum.repos.d]# getent group jabberadmins
jabberadmins:*:503:admin
[root@test yum.repos.d]# getent group locals
locals:*:502:admin

Test case 7
The admin user can access SOGo and IMAP.
NOTE: on SOGo UI, the label for mail root directory is "0" instead of admin@domain (on the left of the screen). This is caused by the blank mail field inside LDAP user.

Test case 8
Access to WEB UI is always granted to root and admin users. AdminIsNotRoot is honored.

Giacomo Sanchietti wrote:

Test case 7
The admin user can access SOGo and IMAP.
NOTE: on SOGo UI, the label for mail root directory is "0" instead of admin@domain (on the left of the screen). This is caused by the blank mail field inside LDAP

Fixed.

In nethserver-testing:
nethserver-mail-server-1.5.0-9.0git7a2ea1cd.ns6.noarch.rpm

Marking this note as VERIFIED - Giacomo

Testing freshly installed machine¶

Test case 1
Home directory correctly created: /var/lib/nethserver/home/admin
Also tested migration from NethService/SME.

Test case 2
Group create/modify/delete OK.

Test case 3
Mail is not moved from root to admin user.

[root@localhost ~]# cat /var/spool/mail/root 
From root@localhost.localdomain  Wed Jan 15 18:25:33 2014
Return-Path: <root@localhost.localdomain>
X-Original-To: root
Delivered-To: root@localhost.localdomain
Received: by localhost.localdomain (Postfix, from userid 0)
    id 574ED3F43E; Wed, 15 Jan 2014 18:25:33 +0100 (CET)
Date: Wed, 15 Jan 2014 18:25:33 +0100
To: root@localhost.localdomain
Subject: hi
User-Agent: Heirloom mailx 12.4 7/29/08
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20140115172533.574ED3F43E@localhost.localdomain>
From: root@localhost.localdomain (root)

hi

[root@localhost ~]# cat /var/spool/mail/admin 

FAILED

Test case 4
Tested with WindowsXP client, it works.
Note: Samba access for admin user must be explicitly set, also admin user password must be set.

Test case 5 and 6
Groups are correct:

[root@localhost ~]# getent group faxmaster
faxmaster:*:503:admin
[root@localhost ~]# getent group jabberadmins
jabberadmins:*:504:admin
[root@localhost ~]# getent group locals
locals:*:502:admin,u1

[root@localhost ~]# ldapsearch -Y EXTERNAL uid=admin
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
# extended LDIF
#
# LDAPv3
# base <dc=directory,dc=nh> (default) with scope subtree
# filter: uid=admin
# requesting: ALL
#

# admin, People, directory.nh
dn: uid=admin,ou=People,dc=directory,dc=nh
uid: admin
shadowMin: 0
shadowWarning: 7
shadowExpire: -1
shadowInactive: -1
gecos: admin
shadowLastChange: 16085
shadowFlag: -1
uidNumber: 500
gidNumber: 500
homeDirectory: /var/lib/nethserver/home/admin
loginShell: /bin/bash
objectClass: posixAccount
objectClass: shadowAccount
objectClass: inetOrgPerson
objectClass: qmailUser
telephoneNumber: 555-5555
o: XYZ Corporation
ou: Main
l: Ottawa
street: 123 Main Street
cn: System Administrator
givenName: System
sn: Administrator
mail: admin@localhost.localdomain
accountStatus: active
shadowMax: 180
userPassword:: e0NSWVBUfSQ2JGZZSGVjSUFOYy5QRW9WaE0kbzUyTjI0d0NqTTFXQUlJTGxVUlJ
 VcXJVUmlkL01GbnAvN0tIcVJOSmhjdGpPVDZSd2hRMEt3dmJkU3FZLlA0Z0RRdUcuUFUxWWFHNW1W
 UGtIL296WDA=

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

Test case 7
Admin user can access SOGo and IMAP server. See also previous note.

Test case 8
Access to WEB UI is always granted to root and admin users. AdminIsNotRoot is honored.
NOTE: AdminIsNotRoot is honored only with this flow admin -> root