kpriv/pkgsrc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
pkgsrc/security/heimdal/options.mk

67 lines
2 KiB
Makefile
Raw Normal View History

security/heimdal: Prefix kerberos commands by default It has long been an issue that heimdal installs "su" which shadows system su and behaves differently. Now, with openssl 1.1, many people are getting heimdal installed that did not expect it or ask for it. (Really, heimdal should be split into libraries and apps, so that programs can have kerberos support without adding commands to the user's namespace, but this is vastly easier.) (In response to on-list complaints, and believing this will not be contoversial.)
2020-03-18 14:18:57 +01:00
# $NetBSD: options.mk,v 1.4 2020/03/18 13:18:57 gdt Exp $
Update security/heimdal to version 1.1. Changes from version 0.7.2 include: * Read-only PKCS11 provider built-in to hx509. * Better compatibilty with Windows 2008 Server pre-releases and Vista. * Add RFC3526 modp group14 as default. * Handle [kdc] database = { } entries without realm = stanzas. * Add gss_pseudo_random() for mechglue and krb5. * Make session key for the krbtgt be selected by the best encryption type of the client. * Better interoperability with other PK-INIT implementations. * Alias support for inital ticket requests. * Make ASN.1 library less paranoid to with regard to NUL in string to make it inter-operate with MIT Kerberos again. * PK-INIT support. * HDB extensions support, used by PK-INIT. * New ASN.1 compiler. * GSS-API mechglue from FreeBSD. * Updated SPNEGO to support RFC4178. * Support for Cryptosystem Negotiation Extension (RFC 4537). * A new X.509 library (hx509) and related crypto functions. * A new ntlm library (heimntlm) and related crypto functions. * KDC will return the "response too big" error to force TCP retries for large (default 1400 bytes) UDP replies. This is common for PK-INIT requests. * Libkafs defaults to use 2b tokens. * krb5_kuserok() also checks ~/.k5login.d directory for acl files. * Fix memory leaks. * Bugs fixes
2008-02-28 15:11:55 +01:00
PKG_OPTIONS_VAR= PKG_OPTIONS.heimdal
PKG_SUPPORTED_OPTIONS= inet6 kerberos-prefix-cmds ldap
security/heimdal: Prefix kerberos commands by default It has long been an issue that heimdal installs "su" which shadows system su and behaves differently. Now, with openssl 1.1, many people are getting heimdal installed that did not expect it or ask for it. (Really, heimdal should be split into libraries and apps, so that programs can have kerberos support without adding commands to the user's namespace, but this is vastly easier.) (In response to on-list complaints, and believing this will not be contoversial.)
2020-03-18 14:18:57 +01:00
PKG_SUGGESTED_OPTIONS= inet6 kerberos-prefix-cmds
Update security/heimdal to version 1.1. Changes from version 0.7.2 include: * Read-only PKCS11 provider built-in to hx509. * Better compatibilty with Windows 2008 Server pre-releases and Vista. * Add RFC3526 modp group14 as default. * Handle [kdc] database = { } entries without realm = stanzas. * Add gss_pseudo_random() for mechglue and krb5. * Make session key for the krbtgt be selected by the best encryption type of the client. * Better interoperability with other PK-INIT implementations. * Alias support for inital ticket requests. * Make ASN.1 library less paranoid to with regard to NUL in string to make it inter-operate with MIT Kerberos again. * PK-INIT support. * HDB extensions support, used by PK-INIT. * New ASN.1 compiler. * GSS-API mechglue from FreeBSD. * Updated SPNEGO to support RFC4178. * Support for Cryptosystem Negotiation Extension (RFC 4537). * A new X.509 library (hx509) and related crypto functions. * A new ntlm library (heimntlm) and related crypto functions. * KDC will return the "response too big" error to force TCP retries for large (default 1400 bytes) UDP replies. This is common for PK-INIT requests. * Libkafs defaults to use 2b tokens. * krb5_kuserok() also checks ~/.k5login.d directory for acl files. * Fix memory leaks. * Bugs fixes
2008-02-28 15:11:55 +01:00
.include "../../mk/bsd.options.mk"
###
### IPv6 support.
###
.if !empty(PKG_OPTIONS:Minet6)
CONFIGURE_ARGS+= --with-ipv6
.else
CONFIGURE_ARGS+= --without-ipv6
.endif
###
### Support using LDAP as a KDC backend.
###
Convert to use PLIST_VARS instead of manually passing "@comment " through PLIST_SUBST to the plist module.
2008-04-13 00:42:57 +02:00
PLIST_VARS+= ldap
Update security/heimdal to version 1.1. Changes from version 0.7.2 include: * Read-only PKCS11 provider built-in to hx509. * Better compatibilty with Windows 2008 Server pre-releases and Vista. * Add RFC3526 modp group14 as default. * Handle [kdc] database = { } entries without realm = stanzas. * Add gss_pseudo_random() for mechglue and krb5. * Make session key for the krbtgt be selected by the best encryption type of the client. * Better interoperability with other PK-INIT implementations. * Alias support for inital ticket requests. * Make ASN.1 library less paranoid to with regard to NUL in string to make it inter-operate with MIT Kerberos again. * PK-INIT support. * HDB extensions support, used by PK-INIT. * New ASN.1 compiler. * GSS-API mechglue from FreeBSD. * Updated SPNEGO to support RFC4178. * Support for Cryptosystem Negotiation Extension (RFC 4537). * A new X.509 library (hx509) and related crypto functions. * A new ntlm library (heimntlm) and related crypto functions. * KDC will return the "response too big" error to force TCP retries for large (default 1400 bytes) UDP replies. This is common for PK-INIT requests. * Libkafs defaults to use 2b tokens. * krb5_kuserok() also checks ~/.k5login.d directory for acl files. * Fix memory leaks. * Bugs fixes
2008-02-28 15:11:55 +01:00
.if !empty(PKG_OPTIONS:Mldap)
. include "../../databases/openldap-client/buildlink3.mk"
CONFIGURE_ARGS+= --with-openldap=${BUILDLINK_PREFIX.openldap-client}
Convert to use PLIST_VARS instead of manually passing "@comment " through PLIST_SUBST to the plist module.
2008-04-13 00:42:57 +02:00
PLIST.ldap= yes
Changes 1.4: New features * Support for reading MIT database file directly * KCM is polished up and now used in production * NTLM first class citizen, credentials stored in KCM * Table driven ASN.1 compiler, smaller!, not enabled by default * Native Windows client support Notes * Disabled write support NDBM hdb backend (read still in there) since it can't handle large records, please migrate to a diffrent backend (like BDB4) Changes 1.3.3: Bug fixes * Check the GSS-API checksum exists before trying to use it [CVE-2010-1321] * Check NULL pointers before dereference them [kdc] Changes 1.3.2: Bug fixes * Don't mix length when clearing hmac (could memset too much) * More paranoid underrun checking when decrypting packets * Check the password change requests and refuse to answer empty packets * Build on OpenSolaris * Renumber AD-SIGNED-TICKET since it was stolen from US * Don't cache /dev/*random file descriptor, it doesn't get unloaded * Make C++ safe * Misc warnings
2011-07-08 11:49:21 +02:00
INSTALLATION_DIRS+= share/examples/heimdal
Update security/heimdal to version 1.1. Changes from version 0.7.2 include: * Read-only PKCS11 provider built-in to hx509. * Better compatibilty with Windows 2008 Server pre-releases and Vista. * Add RFC3526 modp group14 as default. * Handle [kdc] database = { } entries without realm = stanzas. * Add gss_pseudo_random() for mechglue and krb5. * Make session key for the krbtgt be selected by the best encryption type of the client. * Better interoperability with other PK-INIT implementations. * Alias support for inital ticket requests. * Make ASN.1 library less paranoid to with regard to NUL in string to make it inter-operate with MIT Kerberos again. * PK-INIT support. * HDB extensions support, used by PK-INIT. * New ASN.1 compiler. * GSS-API mechglue from FreeBSD. * Updated SPNEGO to support RFC4178. * Support for Cryptosystem Negotiation Extension (RFC 4537). * A new X.509 library (hx509) and related crypto functions. * A new ntlm library (heimntlm) and related crypto functions. * KDC will return the "response too big" error to force TCP retries for large (default 1400 bytes) UDP replies. This is common for PK-INIT requests. * Libkafs defaults to use 2b tokens. * krb5_kuserok() also checks ~/.k5login.d directory for acl files. * Fix memory leaks. * Bugs fixes
2008-02-28 15:11:55 +01:00
post-install: heimdal-ldap-schema
heimdal-ldap-schema:
${INSTALL_DATA} ${WRKSRC}/lib/hdb/hdb.schema \
${DESTDIR}${PREFIX}/share/examples/heimdal
.endif
###
### Rename some of Heimdal's applications so they won't conflict with
### other packages.
###
.if !empty(PKG_OPTIONS:Mkerberos-prefix-cmds)
KRB5_PREFIX= k
HEIMDAL_TRANSFORM= s/^ftp/${KRB5_PREFIX}&/; \
s/^login/${KRB5_PREFIX}&/; \
s/^${KRB5_PREFIX}login.access/login.access/; \
s/^rcp/${KRB5_PREFIX}&/; \
s/^rsh/${KRB5_PREFIX}&/; \
s/^su/${KRB5_PREFIX}&/; \
s/^telnet/${KRB5_PREFIX}&/
.else
KRB5_PREFIX= # empty
HEIMDAL_TRANSFORM= s/^ftp/k&/
.endif
PLIST_SUBST+= KRB5_PREFIX=${KRB5_PREFIX:Q}
CONFIGURE_ARGS+= --program-transform-name=${HEIMDAL_TRANSFORM:Q}
#
# Fix some places in the Heimdal sources that don't point to the correct
# Kerberized binaries when exec'ing programs.
#
SUBST_CLASSES+= heimdal
SUBST_STAGE.heimdal= pre-configure
Changes 1.4: New features * Support for reading MIT database file directly * KCM is polished up and now used in production * NTLM first class citizen, credentials stored in KCM * Table driven ASN.1 compiler, smaller!, not enabled by default * Native Windows client support Notes * Disabled write support NDBM hdb backend (read still in there) since it can't handle large records, please migrate to a diffrent backend (like BDB4) Changes 1.3.3: Bug fixes * Check the GSS-API checksum exists before trying to use it [CVE-2010-1321] * Check NULL pointers before dereference them [kdc] Changes 1.3.2: Bug fixes * Don't mix length when clearing hmac (could memset too much) * More paranoid underrun checking when decrypting packets * Check the password change requests and refuse to answer empty packets * Build on OpenSolaris * Renumber AD-SIGNED-TICKET since it was stolen from US * Don't cache /dev/*random file descriptor, it doesn't get unloaded * Make C++ safe * Misc warnings
2011-07-08 11:49:21 +02:00
SUBST_FILES.heimdal= appl/rcp/rcp.c appl/rcp/rcp_locl.h
SUBST_FILES.heimdal+= appl/rsh/rsh_locl.h
SUBST_FILES.heimdal+= appl/telnet/telnetd/telnetd.h
SUBST_SED.heimdal= -e "/RSH_PROGRAM/s,rsh,${KRB5_PREFIX}rsh,g"
SUBST_SED.heimdal+= -e "/PATH_RSH/s,\"/usr/bin/rsh\",BINDIR \"${KRB5_PREFIX}rsh\",g"
SUBST_SED.heimdal+= -e "/PATH_RSH/s,/rsh,/${KRB5_PREFIX}rsh,g"
SUBST_SED.heimdal+= -e "/PATH_LOGIN/s,/login,/${KRB5_PREFIX}login,g"
Reference in a new issue Copy permalink