Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #1027761 > unrolled thread
| Started by | Mike Gabriel <mike.gabriel@das-netzwerkteam.de> |
|---|---|
| First post | 2020-10-07 09:10 +0200 |
| Last post | 2020-10-08 12:00 +0200 |
| Articles | 4 — 2 participants |
Back to article view | Back to linux.debian.bugs.dist
Bug#971780: debian-edu-config: adapt fetch-ldap-cert and fetch-rootca-cert Mike Gabriel <mike.gabriel@das-netzwerkteam.de> - 2020-10-07 09:10 +0200
Bug#971780: debian-edu-config: adapt fetch-ldap-cert and fetch-rootca-cert Wolfgang Schweer <w.schweer@gmx.de> - 2020-10-07 11:10 +0200
Bug#971780: debian-edu-config: adapt fetch-ldap-cert and fetch-rootca-cert Mike Gabriel <mike.gabriel@das-netzwerkteam.de> - 2020-10-07 19:30 +0200
Bug#971780: debian-edu-config: adapt fetch-ldap-cert and fetch-rootca-cert Mike Gabriel <mike.gabriel@das-netzwerkteam.de> - 2020-10-08 12:00 +0200
| From | Mike Gabriel <mike.gabriel@das-netzwerkteam.de> |
|---|---|
| Date | 2020-10-07 09:10 +0200 |
| Subject | Bug#971780: debian-edu-config: adapt fetch-ldap-cert and fetch-rootca-cert |
| Message-ID | <AXbKh-3Bq-3@gated-at.bofh.it> |
[Multipart message — attachments visible in raw view] — view raw
Package: debian-edu-config Severity: important Version: 2.11.31 Hi, while digging deeper once more into Debian Edu SSL stuff, I found that the two init scripts fetch-rooca-cert and fetch-ldap-cert are not working ok together. The Debian-Edu_rootCA file should nowadays obtained from TJENER via fetch-rootca-cert. This is ok (except from #971775). It pulls in the Debian-Edu_rootCA from TJENER, stores it into /usr/local/share/ca-certificates and runs update-ca-certificates. This gives a Debian-Edu_rootCA.pem file in /etc/ssl/certs and adds that CA cert also to /etc/ssl/certs/ca-certificates.crt. Very good. However, fetch-ldap-cert duplicates part of this and does it in a wrong way (an earlier approach I implemented). It downloads Debian-Edu_rootCA.crt and places it into /etc/ssl/certs/Debian-Edu_rootCA.crt (please note the file suffix). Thus, we end up with Debian-Edu_rootCA.pem and Debian-Edu_rootCA.crt, both in /etc/ssl/certs. IMHO, fetch-ldap-cert should not try to download the Debian-Edu_rootCA.crt anymore as that's handled by fetch-rootca-cert. The fetch-ldap-cert script should only handle situations where a Debian Edu clients runs against a TJENER from stretch (or earlier) or buster 10.0. Comments on that? Greets, Mike -- DAS-NETZWERKTEAM c\o Technik- und Ökologiezentrum Eckernförde Mike Gabriel, Marienthaler Str. 17, 24340 Eckernförde mobile: +49 (1520) 1976 148 landline: +49 (4351) 850 8940 GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31 mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de
[toc] | [next] | [standalone]
| From | Wolfgang Schweer <w.schweer@gmx.de> |
|---|---|
| Date | 2020-10-07 11:10 +0200 |
| Message-ID | <AXdCq-4IZ-7@gated-at.bofh.it> |
| In reply to | #1027761 |
[Multipart message — attachments visible in raw view] — view raw
Hi Mike, [ Mike Gabriel, 2020-10-07 ] > IMHO, fetch-ldap-cert should not try to download the Debian-Edu_rootCA.crt > anymore as that's handled by fetch-rootca-cert. The fetch-ldap-cert script > should only handle situations where a Debian Edu clients runs against a > TJENER from stretch (or earlier) or buster 10.0. > > Comments on that? Yes, it has only been kept for the purpose of older main servers, please fix the script. Wolfgang
[toc] | [prev] | [next] | [standalone]
| From | Mike Gabriel <mike.gabriel@das-netzwerkteam.de> |
|---|---|
| Date | 2020-10-07 19:30 +0200 |
| Message-ID | <AXlqh-ZD-5@gated-at.bofh.it> |
| In reply to | #1027772 |
Hi Wolfgang, thanks for your feedback. Am Mittwoch, 7. Oktober 2020 schrieb Wolfgang Schweer: > Hi Mike, > > [ Mike Gabriel, 2020-10-07 ] > > IMHO, fetch-ldap-cert should not try to download the Debian-Edu_rootCA.crt > > anymore as that's handled by fetch-rootca-cert. The fetch-ldap-cert script > > should only handle situations where a Debian Edu clients runs against a > > TJENER from stretch (or earlier) or buster 10.0. > > > > Comments on that? > > Yes, it has only been kept for the purpose of older main servers, please > fix the script. > > Wolfgang Ok, I'll take a look... Mike -- Sent from my Fairphone powered by SailfishOS
[toc] | [prev] | [next] | [standalone]
| From | Mike Gabriel <mike.gabriel@das-netzwerkteam.de> |
|---|---|
| Date | 2020-10-08 12:00 +0200 |
| Message-ID | <AXASm-2P3-9@gated-at.bofh.it> |
| In reply to | #1027772 |
[Multipart message — attachments visible in raw view] — view raw
Hi Wolfgang, On Mi 07 Okt 2020 11:01:59 CEST, Wolfgang Schweer wrote: > Hi Mike, > > [ Mike Gabriel, 2020-10-07 ] >> IMHO, fetch-ldap-cert should not try to download the Debian-Edu_rootCA.crt >> anymore as that's handled by fetch-rootca-cert. The fetch-ldap-cert script >> should only handle situations where a Debian Edu clients runs against a >> TJENER from stretch (or earlier) or buster 10.0. >> >> Comments on that? > > Yes, it has only been kept for the purpose of older main servers, please > fix the script. > > Wolfgang I have looked at the fetch-ldap-cert script and have also already started on dropping that code, but I won't have test machines available until about 1.5 weeks from now. So, don't expect any commits regarding this before then. Mike -- DAS-NETZWERKTEAM c\o Technik- und Ökologiezentrum Eckernförde Mike Gabriel, Marienthaler Str. 17, 24340 Eckernförde mobile: +49 (1520) 1976 148 landline: +49 (4351) 850 8940 GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31 mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.bugs.dist
csiph-web