saving uncommitted changes in /etc prior to emerge run

diff --git a/.etckeeper b/.etckeeper
index 40cbf8cb31bf72975331e9d37784cb22ea98294d..04e2e7aea893bd48c30d455a9f6c4a57e027a5d4 100755 (executable)
--- a/.etckeeper
+++ b/.etckeeper
@@ -2043,8 +2043,7 @@ maybe chmod 0644 'openldap/schema/samba.schema'
 maybe chmod 0644 'openldap/schema/sudo.schema'
 maybe chgrp 'ldap' 'openldap/slapd.conf'
 maybe chmod 0640 'openldap/slapd.conf'
-maybe chgrp 'ldap' 'openldap/slapd.conf.default'
-maybe chmod 0640 'openldap/slapd.conf.default'
+maybe chmod 0600 'openldap/slapd.conf.default'
 maybe chmod 0600 'openldap/slapd.ldif'
 maybe chmod 0600 'openldap/slapd.ldif.default'
 maybe chmod 0755 'openldap/ssl'

diff --git a/init.d/slapd b/init.d/slapd
index 3982aad41fb8bd330f6e9d42e10ac7fce709864d..da3e34876336b87e9126049d741b5ee71a5b99a0 100755 (executable)
--- a/init.d/slapd
+++ b/init.d/slapd
@@ -1,11 +1,13 @@
 #!/sbin/openrc-run
-# Copyright 1999-2012 Gentoo Foundation
+# Copyright 1999-2015 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
 # $Id$
 
 extra_commands="checkconfig"
 
 [ -z "$INSTANCE" ] && INSTANCE="openldap${SVCNAME#slapd}"
+PIDDIR=/run/openldap
+PIDFILE=$PIDDIR/$SVCNAME.pid
 
 depend() {
        need net
@@ -14,23 +16,50 @@ depend() {
 }
 
 start() {
-       checkpath -q -d /var/run/openldap/ -o ldap:ldap 
+       checkpath -q -d ${PIDDIR} -o ldap:ldap 
        if ! checkconfig -Q ; then
                eerror "There is a problem with your slapd.conf!"
                return 1
        fi
        ebegin "Starting ldap-server"
        [ -n "$KRB5_KTNAME" ] && export KRB5_KTNAME
-       eval start-stop-daemon --start --pidfile /var/run/openldap/${SVCNAME}.pid --exec /usr/lib64/openldap/slapd -- -u ldap -g ldap "${OPTS}"
+       eval start-stop-daemon --start --pidfile ${PIDFILE} --exec /usr/lib64/openldap/slapd -- -u ldap -g ldap "${OPTS}"
        eend $?
 }
 
 stop() {
        ebegin "Stopping ldap-server"
-       start-stop-daemon --stop --signal 2 --quiet --pidfile /var/run/openldap/${SVCNAME}.pid
+       start-stop-daemon --stop --signal 2 --quiet --pidfile ${PIDFILE}
        eend $?
 }
 
 checkconfig() {
+       # checks requested by bug #502948
+       # Step 1: extract the last valid config file or config dir
+       set -- $OPTS
+       while [ -n "$*" ]; do
+               opt=$1 ; shift
+               if [ "$opt" = "-f" -o "$opt" = "-F" ] ; then
+                       CONF=$1
+                       shift
+               fi
+       done
+       set --
+       # Fallback
+       CONF=${CONF-/etc/openldap/slapd.conf}
+       [ -d $CONF ] && CONF=${CONF}/*
+       DBDIRS=`eval awk '"/^(directory|olcDbDirectory:)/{print \\$2}"' $CONF`
+       for d in $DBDIRS; do
+               if [ ! -d $d ]; then
+                       eerror "Directory $d in config does not exist!"
+                       return 1
+               fi
+               /usr/bin/find $d ! -name DB_CONFIG ! -user ldap -o ! -group ldap |grep -sq .
+               if [ $? -ne 0 ]; then
+                       ewarn "You have files in $d not owned by the ldap user, you must ensure they are accessible to the slapd instance!"
+               fi
+               [ ! -e $d/DB_CONFIG ] && ewarn "$d/DB_CONFIG does not exist, slapd performance may be sub-optimal" 
+       done
+       # now test the config fully
        /usr/sbin/slaptest -u "$@" ${OPTS_CONF}
 }

diff --git a/openldap/schema/README b/openldap/schema/README
index e2e2c76d0910294722eb998d71c3fd8b28bf7b79..aa05a02a04e9435009cd310b971591de96009df7 100644 (file)
--- a/openldap/schema/README
+++ b/openldap/schema/README
@@ -34,7 +34,7 @@ convert schema files in general.
 
 This notice applies to all files in this directory.
 
-Copyright 1998-2013 The OpenLDAP Foundation, Redwood City, California, USA
+Copyright 1998-2015 The OpenLDAP Foundation, Redwood City, California, USA
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/collective.ldif b/openldap/schema/collective.ldif
index 49e8d0549e1710198755a9fd80a07aabdc5280f1..a762cc609fe9ff939963026da10d83469de58305 100644 (file)
--- a/openldap/schema/collective.ldif
+++ b/openldap/schema/collective.ldif
@@ -2,7 +2,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/collective.schema b/openldap/schema/collective.schema
index 1f0feb6cf8f1322415a7bb6daa748bcd6b11276d..4912b75d3aff324e3772bc5f3367b192179accd1 100644 (file)
--- a/openldap/schema/collective.schema
+++ b/openldap/schema/collective.schema
@@ -2,7 +2,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/corba.ldif b/openldap/schema/corba.ldif
index 285f1700d0ac4b5a31bb4a27b848d53a2f8aad8c..47675a594803538484289b68eb955aa93f4fce32 100644 (file)
--- a/openldap/schema/corba.ldif
+++ b/openldap/schema/corba.ldif
@@ -3,7 +3,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/corba.schema b/openldap/schema/corba.schema
index eb0e144c9e61a3d87891e0acaa7d1b18b3b607f0..731080e03489d61ca3ba883a68e232199aa31845 100644 (file)
--- a/openldap/schema/corba.schema
+++ b/openldap/schema/corba.schema
@@ -4,7 +4,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/core.ldif b/openldap/schema/core.ldif
index 7ea6ae736686dd7d7b2cc029bc216414ce07862c..aed7349e00844c81f79268265b71710a0735cf5e 100644 (file)
--- a/openldap/schema/core.ldif
+++ b/openldap/schema/core.ldif
@@ -2,7 +2,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/core.schema b/openldap/schema/core.schema
index 8828caa02ba03b0a64e7b2427d4cd3f7ec1aacdb..0257cff2528e3295d334e07ea52b28a3a613f2a7 100644 (file)
--- a/openldap/schema/core.schema
+++ b/openldap/schema/core.schema
@@ -2,7 +2,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/cosine.ldif b/openldap/schema/cosine.ldif
index 428b7a346e7977b093935bd38ae5c56e8c9facf9..340ca11fdd9ec4ea5287f0d43145c5f4a35c975d 100644 (file)
--- a/openldap/schema/cosine.ldif
+++ b/openldap/schema/cosine.ldif
@@ -2,7 +2,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/cosine.schema b/openldap/schema/cosine.schema
index 9b16419f9c12c579fbf68cc40381ae7a240359f1..bc1d7f7e38c7a2841cb49255c34f3bdee76b5db0 100644 (file)
--- a/openldap/schema/cosine.schema
+++ b/openldap/schema/cosine.schema
@@ -2,7 +2,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/duaconf.ldif b/openldap/schema/duaconf.ldif
index ea053275054f440e342d459f7078f57311a0157e..840965a9a595a1cdc590ba51807733479798ab54 100644 (file)
--- a/openldap/schema/duaconf.ldif
+++ b/openldap/schema/duaconf.ldif
@@ -1,7 +1,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/duaconf.schema b/openldap/schema/duaconf.schema
index 06b5ad01bc8f4a153dbbb21c8ea4db44d798a593..c0cdaa5897ac5da5da3ab8f67f10db633e41f7fe 100644 (file)
--- a/openldap/schema/duaconf.schema
+++ b/openldap/schema/duaconf.schema
@@ -1,7 +1,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/dyngroup.ldif b/openldap/schema/dyngroup.ldif
index c38cbc0abc83e26a456248d66d848da1143cd999..595ae614f1ec00ccda62bf8584ec0d6b133cce86 100644 (file)
--- a/openldap/schema/dyngroup.ldif
+++ b/openldap/schema/dyngroup.ldif
@@ -2,7 +2,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/dyngroup.schema b/openldap/schema/dyngroup.schema
index 9c0c2adb165d59ec18834009f1b2ed25ff3ef2b8..035e23f7a113947450f6aad903b873342602818e 100644 (file)
--- a/openldap/schema/dyngroup.schema
+++ b/openldap/schema/dyngroup.schema
@@ -2,7 +2,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/inetorgperson.ldif b/openldap/schema/inetorgperson.ldif
index 0cf6e14fa8cce0c84c25199a44012963ee2e6061..d91b2bd9e5e5431a05159be5a4749977625210e9 100644 (file)
--- a/openldap/schema/inetorgperson.ldif
+++ b/openldap/schema/inetorgperson.ldif
@@ -2,7 +2,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/inetorgperson.schema b/openldap/schema/inetorgperson.schema
index bbab28712a37777951410dc04ecc6406ebb64c1f..24c242106dd93ff37e4985e9293e6b37acba72a8 100644 (file)
--- a/openldap/schema/inetorgperson.schema
+++ b/openldap/schema/inetorgperson.schema
@@ -2,7 +2,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/java.ldif b/openldap/schema/java.ldif
index 862939b349b7e324c0c35d15f5e8165581579a8a..e39723d8b265c81a014025ad41331fa22769cb4f 100644 (file)
--- a/openldap/schema/java.ldif
+++ b/openldap/schema/java.ldif
@@ -2,7 +2,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/java.schema b/openldap/schema/java.schema
index d1bcfb9fc16b5c335474d8657165ac669e5d060f..bb9c01c167c8faff56b5d116b805bc57708497c9 100644 (file)
--- a/openldap/schema/java.schema
+++ b/openldap/schema/java.schema
@@ -2,7 +2,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/misc.ldif b/openldap/schema/misc.ldif
index e3a7bd00273b1e69c68cc1c81c816bace807ee3a..5117fd24d75cf1cb1ff94174c1c1aa1cef7e5105 100644 (file)
--- a/openldap/schema/misc.ldif
+++ b/openldap/schema/misc.ldif
@@ -2,7 +2,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/misc.schema b/openldap/schema/misc.schema
index 76a92a76a06510e89674a0956f2af4e1b4095cfb..e636135590d24443df72adc3653d949df7b7ccd6 100644 (file)
--- a/openldap/schema/misc.schema
+++ b/openldap/schema/misc.schema
@@ -2,7 +2,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/nis.ldif b/openldap/schema/nis.ldif
index 13099de411ab79d181553a451eb8e7732986cc35..9d7f19c0fb22c7a3016fa28aff0c20d800467ce9 100644 (file)
--- a/openldap/schema/nis.ldif
+++ b/openldap/schema/nis.ldif
@@ -2,7 +2,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/nis.schema b/openldap/schema/nis.schema
index ec5b32c0b9e4dbff3b0809f18894195b5f1a02e6..6e83c7e6e7725779771f9e25d7346b7865af3ceb 100644 (file)
--- a/openldap/schema/nis.schema
+++ b/openldap/schema/nis.schema
@@ -1,7 +1,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/openldap.ldif b/openldap/schema/openldap.ldif
index ffd99b57648782d224278ece1524c64c76e7f43f..79ccac5dd51ff110748bb0d3c2b19b4b5845ab4e 100644 (file)
--- a/openldap/schema/openldap.ldif
+++ b/openldap/schema/openldap.ldif
@@ -1,7 +1,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/openldap.schema b/openldap/schema/openldap.schema
index af6b51e55919ef98e83dd6556abd75ad21d2f14f..cd00946a0593644ac3b9f9f3e594c288238c0b2e 100644 (file)
--- a/openldap/schema/openldap.schema
+++ b/openldap/schema/openldap.schema
@@ -1,7 +1,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/pmi.ldif b/openldap/schema/pmi.ldif
index e14948c314cdb16c9e9f2f371616992857746cc6..b2afb5df96014021fa529ac563525c1dc7a62bc7 100644 (file)
--- a/openldap/schema/pmi.ldif
+++ b/openldap/schema/pmi.ldif
@@ -2,7 +2,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/pmi.schema b/openldap/schema/pmi.schema
index 0ec247865b29828dea67af3bf7b9e6c5c229188e..5452a221ba5d1a01cd308a9997a30eb7a85782a0 100644 (file)
--- a/openldap/schema/pmi.schema
+++ b/openldap/schema/pmi.schema
@@ -2,7 +2,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 1998-2013 The OpenLDAP Foundation.
+## Copyright 1998-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without

diff --git a/openldap/schema/ppolicy.ldif b/openldap/schema/ppolicy.ldif
index 677330b5819af2763020beb3d147cd4eb4a0932c..759c96daae84fe99ff9ce37da59fb3125e45bf52 100644 (file)
--- a/openldap/schema/ppolicy.ldif
+++ b/openldap/schema/ppolicy.ldif
@@ -1,7 +1,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 2004-2013 The OpenLDAP Foundation.
+## Copyright 2004-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without
@@ -35,28 +35,37 @@ cn: ppolicy
 olcAttributeTypes: {0}( 1.3.6.1.4.1.42.2.27.8.1.1 NAME 'pwdAttribute' EQUALITY
   objectIdentifierMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )
 olcAttributeTypes: {1}( 1.3.6.1.4.1.42.2.27.8.1.2 NAME 'pwdMinAge' EQUALITY in
- tegerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+ tegerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+  SINGLE-VALUE )
 olcAttributeTypes: {2}( 1.3.6.1.4.1.42.2.27.8.1.3 NAME 'pwdMaxAge' EQUALITY in
- tegerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+ tegerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+  SINGLE-VALUE )
 olcAttributeTypes: {3}( 1.3.6.1.4.1.42.2.27.8.1.4 NAME 'pwdInHistory' EQUALITY
-  integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+  integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1
+ .27 SINGLE-VALUE )
 olcAttributeTypes: {4}( 1.3.6.1.4.1.42.2.27.8.1.5 NAME 'pwdCheckQuality' EQUAL
- ITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+ ITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.12
+ 1.1.27 SINGLE-VALUE )
 olcAttributeTypes: {5}( 1.3.6.1.4.1.42.2.27.8.1.6 NAME 'pwdMinLength' EQUALITY
-  integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+  integerMatch ORDERING integerOrderingMatch  SYNTAX 1.3.6.1.4.1.1466.115.121.
+ 1.27 SINGLE-VALUE )
 olcAttributeTypes: {6}( 1.3.6.1.4.1.42.2.27.8.1.7 NAME 'pwdExpireWarning' EQUA
- LITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+ LITY integerMatch ORDERING integerOrderingMatch  SYNTAX 1.3.6.1.4.1.1466.115.
+ 121.1.27 SINGLE-VALUE )
 olcAttributeTypes: {7}( 1.3.6.1.4.1.42.2.27.8.1.8 NAME 'pwdGraceAuthNLimit' EQ
- UALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+ UALITY integerMatch ORDERING integerOrderingMatch  SYNTAX 1.3.6.1.4.1.1466.11
+ 5.121.1.27 SINGLE-VALUE )
 olcAttributeTypes: {8}( 1.3.6.1.4.1.42.2.27.8.1.9 NAME 'pwdLockout' EQUALITY b
  ooleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
 olcAttributeTypes: {9}( 1.3.6.1.4.1.42.2.27.8.1.10 NAME 'pwdLockoutDuration' E
- QUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+ QUALITY integerMatch ORDERING integerOrderingMatch  SYNTAX 1.3.6.1.4.1.1466.1
+ 15.121.1.27 SINGLE-VALUE )
 olcAttributeTypes: {10}( 1.3.6.1.4.1.42.2.27.8.1.11 NAME 'pwdMaxFailure' EQUAL
- ITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
+ ITY integerMatch ORDERING integerOrderingMatch  SYNTAX 1.3.6.1.4.1.1466.115.1
+ 21.1.27 SINGLE-VALUE )
 olcAttributeTypes: {11}( 1.3.6.1.4.1.42.2.27.8.1.12 NAME 'pwdFailureCountInter
- val' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE 
- )
+ val' EQUALITY integerMatch ORDERING integerOrderingMatch  SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.27 SINGLE-VALUE )
 olcAttributeTypes: {12}( 1.3.6.1.4.1.42.2.27.8.1.13 NAME 'pwdMustChange' EQUAL
  ITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
 olcAttributeTypes: {13}( 1.3.6.1.4.1.42.2.27.8.1.14 NAME 'pwdAllowUserChange' 
@@ -66,10 +75,13 @@ olcAttributeTypes: {14}( 1.3.6.1.4.1.42.2.27.8.1.15 NAME 'pwdSafeModify' EQUAL
 olcAttributeTypes: {15}( 1.3.6.1.4.1.4754.1.99.1 NAME 'pwdCheckModule' DESC 'L
  oadable module that instantiates "check_password() function' EQUALITY caseExa
  ctIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+olcAttributeTypes: {16}( 1.3.6.1.4.1.42.2.27.8.1.30 NAME 'pwdMaxRecordedFailur
+ e' EQUALITY integerMatch ORDERING integerOrderingMatch  SYNTAX 1.3.6.1.4.1.
+ 1466.115.121.1.27 SINGLE-VALUE )
 olcObjectClasses: {0}( 1.3.6.1.4.1.4754.2.99.1 NAME 'pwdPolicyChecker' SUP top
   AUXILIARY MAY pwdCheckModule )
 olcObjectClasses: {1}( 1.3.6.1.4.1.42.2.27.8.2.1 NAME 'pwdPolicy' SUP top AUXI
  LIARY MUST pwdAttribute MAY ( pwdMinAge $ pwdMaxAge $ pwdInHistory $ pwdCheck
  Quality $ pwdMinLength $ pwdExpireWarning $ pwdGraceAuthNLimit $ pwdLockout $
   pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountInterval $ pwdMustChange
-  $ pwdAllowUserChange $ pwdSafeModify ) )
+  $ pwdAllowUserChange $ pwdSafeModify $ pwdMaxRecordedFailure ) )

diff --git a/openldap/schema/ppolicy.schema b/openldap/schema/ppolicy.schema
index 15bc837d32a290f54f92bb99f523a81a0d42ac0b..5cfe81b8bfbda920e2ca4ba680ea1d49122443b5 100644 (file)
--- a/openldap/schema/ppolicy.schema
+++ b/openldap/schema/ppolicy.schema
@@ -1,7 +1,7 @@
 # $OpenLDAP$
 ## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 ##
-## Copyright 2004-2013 The OpenLDAP Foundation.
+## Copyright 2004-2015 The OpenLDAP Foundation.
 ## All rights reserved.
 ##
 ## Redistribution and use in source and binary forms, with or without
@@ -110,6 +110,7 @@ attributetype ( 1.3.6.1.4.1.42.2.27.8.1.1
 attributetype ( 1.3.6.1.4.1.42.2.27.8.1.2
       NAME 'pwdMinAge'
       EQUALITY integerMatch
+      ORDERING integerOrderingMatch
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
       SINGLE-VALUE )
 
@@ -125,6 +126,7 @@ attributetype ( 1.3.6.1.4.1.42.2.27.8.1.2
 attributetype ( 1.3.6.1.4.1.42.2.27.8.1.3
       NAME 'pwdMaxAge'
       EQUALITY integerMatch
+      ORDERING integerOrderingMatch
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
       SINGLE-VALUE )
 
@@ -140,6 +142,7 @@ attributetype ( 1.3.6.1.4.1.42.2.27.8.1.3
 attributetype ( 1.3.6.1.4.1.42.2.27.8.1.4
       NAME 'pwdInHistory'
       EQUALITY integerMatch
+      ORDERING integerOrderingMatch
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
       SINGLE-VALUE )
 
@@ -166,6 +169,7 @@ attributetype ( 1.3.6.1.4.1.42.2.27.8.1.4
 attributetype ( 1.3.6.1.4.1.42.2.27.8.1.5
       NAME 'pwdCheckQuality'
       EQUALITY integerMatch
+      ORDERING integerOrderingMatch
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
       SINGLE-VALUE )
 
@@ -182,6 +186,7 @@ attributetype ( 1.3.6.1.4.1.42.2.27.8.1.5
 attributetype ( 1.3.6.1.4.1.42.2.27.8.1.6
       NAME 'pwdMinLength'
       EQUALITY integerMatch
+      ORDERING integerOrderingMatch
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
       SINGLE-VALUE )
 
@@ -198,6 +203,7 @@ attributetype ( 1.3.6.1.4.1.42.2.27.8.1.6
 attributetype ( 1.3.6.1.4.1.42.2.27.8.1.7
       NAME 'pwdExpireWarning'
       EQUALITY integerMatch
+      ORDERING integerOrderingMatch
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
       SINGLE-VALUE )
 
@@ -210,6 +216,7 @@ attributetype ( 1.3.6.1.4.1.42.2.27.8.1.7
 attributetype ( 1.3.6.1.4.1.42.2.27.8.1.8
       NAME 'pwdGraceAuthNLimit'
       EQUALITY integerMatch
+      ORDERING integerOrderingMatch
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
       SINGLE-VALUE )
 
@@ -241,6 +248,7 @@ attributetype ( 1.3.6.1.4.1.42.2.27.8.1.9
 attributetype ( 1.3.6.1.4.1.42.2.27.8.1.10
       NAME 'pwdLockoutDuration'
       EQUALITY integerMatch
+      ORDERING integerOrderingMatch
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
       SINGLE-VALUE )
 
@@ -254,6 +262,7 @@ attributetype ( 1.3.6.1.4.1.42.2.27.8.1.10
 attributetype ( 1.3.6.1.4.1.42.2.27.8.1.11
       NAME 'pwdMaxFailure'
       EQUALITY integerMatch
+      ORDERING integerOrderingMatch
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
       SINGLE-VALUE )
 
@@ -269,6 +278,7 @@ attributetype ( 1.3.6.1.4.1.42.2.27.8.1.11
 attributetype ( 1.3.6.1.4.1.42.2.27.8.1.12
       NAME 'pwdFailureCountInterval'
       EQUALITY integerMatch
+      ORDERING integerOrderingMatch
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
       SINGLE-VALUE )
 
@@ -315,6 +325,20 @@ attributetype ( 1.3.6.1.4.1.42.2.27.8.1.15
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
       SINGLE-VALUE )
 
+#ITS#8185  pwdMaxRecordedFailure
+#
+#   This attribute specifies the maximum number of consecutive failed bind
+#   attempts to record.  If this attribute is not present, or if the value
+#      is 0, it defaults to the value of pwdMaxFailure. If that value is also
+#      0, this value defaults to 5.
+
+attributetype ( 1.3.6.1.4.1.42.2.27.8.1.30
+      NAME 'pwdMaxRecordedFailure'
+      EQUALITY integerMatch
+      ORDERING integerOrderingMatch
+      SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+      SINGLE-VALUE )
+
 # HP extensions
 #
 # pwdCheckModule
@@ -332,7 +356,7 @@ attributetype ( 1.3.6.1.4.1.4754.1.99.1
      NAME 'pwdCheckModule'
      EQUALITY caseExactIA5Match
      SYNTAX 1.3.6.1.4.1.1466.115.121.1.26
-     DESC 'Loadable module that instantiates "check_password() function'
+     DESC 'Loadable module that instantiates check_password() function'
      SINGLE-VALUE )
 
 objectclass ( 1.3.6.1.4.1.4754.2.99.1
@@ -356,7 +380,8 @@ objectclass ( 1.3.6.1.4.1.42.2.27.8.2.1
       MAY ( pwdMinAge $ pwdMaxAge $ pwdInHistory $ pwdCheckQuality $
       pwdMinLength $ pwdExpireWarning $ pwdGraceAuthNLimit $ pwdLockout
       $ pwdLockoutDuration $ pwdMaxFailure $ pwdFailureCountInterval $
-      pwdMustChange $ pwdAllowUserChange $ pwdSafeModify ) )
+      pwdMustChange $ pwdAllowUserChange $ pwdSafeModify $
+      pwdMaxRecordedFailure ) )
 
 #5.3  Attribute Types for Password Policy State Information
 #

diff --git a/openldap/slapd.conf.default b/openldap/slapd.conf.default
index ea9e489bb825b3b4c1784e2da37785f6ea773bde..d536b1f1e72fb50c05cb9c70f1cfab568414dd7d 100644 (file)
--- a/openldap/slapd.conf.default
+++ b/openldap/slapd.conf.default
@@ -10,8 +10,8 @@ include               /etc/openldap/schema/core.schema
 # service AND an understanding of referrals.
 #referral      ldap://root.openldap.org
 
-pidfile                /var/run/openldap/slapd.pid
-argsfile       /var/run/openldap/slapd.args
+pidfile                /run/openldap/slapd.pid
+argsfile       /run/openldap/slapd.args
 
 # Load dynamic backend modules:
 # modulepath   /usr/lib64/openldap/openldap
@@ -24,6 +24,7 @@ argsfile      /var/run/openldap/slapd.args
 # moduleload   back_null.so
 # moduleload   back_monitor.so
 # moduleload   back_meta.so
+# moduleload   back_mdb.so
 # moduleload   back_ldap.so
 # moduleload   back_dnssrv.so
 

diff --git a/openldap/slapd.ldif b/openldap/slapd.ldif
index afb1d520401aada9e91f03ea484cad03a255e1f7..3cee8b147da0ec7cb46d73e2c8a11c78ce1afc67 100644 (file)
--- a/openldap/slapd.ldif
+++ b/openldap/slapd.ldif
@@ -1,5 +1,5 @@
 #
-# See slapd.d(5) for details on configuration options.
+# See slapd-config(5) for details on configuration options.
 # This file should NOT be world readable.
 #
 dn: cn=config
@@ -47,6 +47,7 @@ include: file:///etc/openldap/schema/core.ldif
 #
 dn: olcDatabase=frontend,cn=config
 objectClass: olcDatabaseConfig
+objectClass: olcFrontendConfig
 olcDatabase: frontend
 #
 # Sample global access control policy:
@@ -73,13 +74,13 @@ olcDatabase: frontend
 
 
 #######################################################################
-# BDB database definitions
+# LMDB database definitions
 #######################################################################
 #
-dn: olcDatabase=bdb,cn=config
+dn: olcDatabase=mdb,cn=config
 objectClass: olcDatabaseConfig
-objectClass: olcBdbConfig
-olcDatabase: bdb
+objectClass: olcMdbConfig
+olcDatabase: mdb
 olcSuffix: dc=my-domain,dc=com
 olcRootDN: cn=Manager,dc=my-domain,dc=com
 # Cleartext passwords, especially for the rootdn, should

diff --git a/openldap/slapd.ldif.default b/openldap/slapd.ldif.default
index afb1d520401aada9e91f03ea484cad03a255e1f7..3cee8b147da0ec7cb46d73e2c8a11c78ce1afc67 100644 (file)
--- a/openldap/slapd.ldif.default
+++ b/openldap/slapd.ldif.default
@@ -1,5 +1,5 @@
 #
-# See slapd.d(5) for details on configuration options.
+# See slapd-config(5) for details on configuration options.
 # This file should NOT be world readable.
 #
 dn: cn=config
@@ -47,6 +47,7 @@ include: file:///etc/openldap/schema/core.ldif
 #
 dn: olcDatabase=frontend,cn=config
 objectClass: olcDatabaseConfig
+objectClass: olcFrontendConfig
 olcDatabase: frontend
 #
 # Sample global access control policy:
@@ -73,13 +74,13 @@ olcDatabase: frontend
 
 
 #######################################################################
-# BDB database definitions
+# LMDB database definitions
 #######################################################################
 #
-dn: olcDatabase=bdb,cn=config
+dn: olcDatabase=mdb,cn=config
 objectClass: olcDatabaseConfig
-objectClass: olcBdbConfig
-olcDatabase: bdb
+objectClass: olcMdbConfig
+olcDatabase: mdb
 olcSuffix: dc=my-domain,dc=com
 olcRootDN: cn=Manager,dc=my-domain,dc=com
 # Cleartext passwords, especially for the rootdn, should