diff options
| author | Petr Viktorin <pviktori@redhat.com> | 2014-05-30 18:35:31 +0200 |
|---|---|---|
| committer | Petr Viktorin <pviktori@redhat.com> | 2014-06-23 12:44:32 +0200 |
| commit | 8a5110305fafcb6d8770ef78cdff164b8ab1bc0c (patch) | |
| tree | 2a0ee72bd38f81822963d4d763062a174661a9ba /install/updates | |
| parent | ac8539bd344f2309f74efc6b42bddb3a925ff20f (diff) | |
| download | freeipa-8a5110305fafcb6d8770ef78cdff164b8ab1bc0c.tar.gz freeipa-8a5110305fafcb6d8770ef78cdff164b8ab1bc0c.tar.xz freeipa-8a5110305fafcb6d8770ef78cdff164b8ab1bc0c.zip | |
Convert Host default permissions to managed
Part of the work for: https://fedorahosted.org/freeipa/ticket/4346
Reviewed-By: Martin Kosek <mkosek@redhat.com>
Diffstat (limited to 'install/updates')
| -rw-r--r-- | install/updates/40-delegation.update | 29 |
1 files changed, 1 insertions, 28 deletions
diff --git a/install/updates/40-delegation.update b/install/updates/40-delegation.update index 6eef59d42..7d65e9e19 100644 --- a/install/updates/40-delegation.update +++ b/install/updates/40-delegation.update @@ -170,28 +170,9 @@ default:objectClass: top default:cn: Password Policy Administrator default:description: Password Policy Administrator -# Allow an admin to enroll a host that has a one-time password. -# When a host is created with a password no krbPrincipalName is set. -# This will let it be added if the client ends up enrolling with -# an administrator instead. -dn: cn=Add krbPrincipalName to a host,cn=permissions,cn=pbac,$SUFFIX -default:objectClass: top -default:objectClass: groupofnames -default:objectClass: ipapermission -default:cn: Add krbPrincipalName to a host -default:member: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX -default:member: cn=Host Enrollment,cn=privileges,cn=pbac,$SUFFIX - -dn: $SUFFIX -add:aci: '(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(targetfilter = "(!(krbprincipalname=*))")(targetattr = "krbprincipalname")(version 3.0;acl "permission:Add krbPrincipalName to a host"; allow (write) groupdn = "ldap:///cn=Add krbPrincipalName to a host,cn=permissions,cn=pbac,$SUFFIX";)' - dn: cn=Host Enrollment,cn=privileges,cn=pbac,$SUFFIX add:member: 'cn=admins,cn=groups,cn=accounts,$SUFFIX' -# Don't allow admins to update enrolledBy -dn: $SUFFIX -replace:aci:'(targetattr = "enrolledby || objectclass")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Enroll a host";allow (write) groupdn = "ldap:///cn=Enroll a host,cn=permissions,cn=pbac,$SUFFIX";)::(targetattr = "objectclass")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Enroll a host";allow (write) groupdn = "ldap:///cn=Enroll a host,cn=permissions,cn=pbac,$SUFFIX";)' - # The original DNS permissions lacked the tag. dn: $SUFFIX remove:aci:'(target = "ldap:///idnsname=*,cn=dns,$SUFFIX")(version 3.0;acl "Add DNS entries";allow (add) groupdn = "ldap:///cn=add dns entries,cn=permissions,cn=pbac,$SUFFIX";)' @@ -257,16 +238,7 @@ add:aci:'(targetattr = "automountkey || automountinformation || description")(ta replace:aci:'(target = "ldap:///automountkey=*,automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "permission:Add Automount keys";allow (add) groupdn = "ldap:///cn=Add Automount keys,cn=permissions,cn=pbac,$SUFFIX";)::(targetfilter = "(objectclass=automount)")(target = "ldap:///automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "permission:Add Automount keys";allow (add) groupdn = "ldap:///cn=Add Automount keys,cn=permissions,cn=pbac,$SUFFIX";)' replace:aci:'(target = "ldap:///automountkey=*,automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "permission:Remove Automount keys";allow (delete) groupdn = "ldap:///cn=Remove Automount keys,cn=permissions,cn=pbac,$SUFFIX";)::(targetfilter = "(objectclass=automount)")(target = "ldap:///automountmapname=*,cn=automount,$SUFFIX")(version 3.0;acl "permission:Remove Automount keys";allow (delete) groupdn = "ldap:///cn=Remove Automount keys,cn=permissions,cn=pbac,$SUFFIX";)' -dn: cn=Manage Host SSH Public Keys,cn=permissions,cn=pbac,$SUFFIX -default:objectClass: top -default:objectClass: groupofnames -default:objectClass: ipapermission -default:cn: Manage Host SSH Public Keys -default:member: cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX - dn: $SUFFIX -add:aci:'(targetattr = "ipasshpubkey")(target = "ldap:///fqdn=*,cn=computers,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Manage Host SSH Public Keys";allow (write) groupdn = "ldap:///cn=Manage Host SSH Public Keys,cn=permissions,cn=pbac,$SUFFIX";)' - # Don't allow the default 'manage group membership' to be able to manage the # admins group replace:aci:'(targetattr = "member")(target = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Group membership";allow (write) groupdn = "ldap:///cn=Modify Group membership,cn=permissions,cn=pbac,$SUFFIX";)::(targetfilter = "(!(cn=admins))")(targetattr = "member")(target = "ldap:///cn=*,cn=groups,cn=accounts,$SUFFIX")(version 3.0;acl "permission:Modify Group membership";allow (write) groupdn = "ldap:///cn=Modify Group membership,cn=permissions,cn=pbac,$SUFFIX";)' @@ -283,6 +255,7 @@ add: member: 'cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX' dn: cn=Revoke Certificate,cn=permissions,cn=pbac,$SUFFIX add: member: 'cn=Host Administrators,cn=privileges,cn=pbac,$SUFFIX' + # Automember tasks dn: cn=Automember Task Administrator,cn=privileges,cn=pbac,$SUFFIX default:objectClass: nestedgroup |