diff options
author | Rob Crittenden <rcritten@redhat.com> | 2011-09-23 11:46:59 -0400 |
---|---|---|
committer | Martin Kosek <mkosek@redhat.com> | 2011-09-23 20:41:17 +0200 |
commit | 384d4e8f5018aa1f829139572fa29abef375c5a3 (patch) | |
tree | c9e2d43ec5c9f2ce3e8fcf30eee89fd71294a102 /install | |
parent | 060eea5f03eefb731ed6991cbdf811212e730b24 (diff) | |
download | freeipa-384d4e8f5018aa1f829139572fa29abef375c5a3.tar.gz freeipa-384d4e8f5018aa1f829139572fa29abef375c5a3.tar.xz freeipa-384d4e8f5018aa1f829139572fa29abef375c5a3.zip |
Always require SSL in the Kerberos authorization block.
This also corrects a slight bug where if add is True then we always
re-update the file.
https://fedorahosted.org/freeipa/ticket/1755
Diffstat (limited to 'install')
-rw-r--r-- | install/conf/ipa.conf | 3 | ||||
-rw-r--r-- | install/tools/ipa-upgradeconfig | 2 |
2 files changed, 3 insertions, 2 deletions
diff --git a/install/conf/ipa.conf b/install/conf/ipa.conf index 72e3e4c01..2339387a7 100644 --- a/install/conf/ipa.conf +++ b/install/conf/ipa.conf @@ -1,5 +1,5 @@ # -# VERSION 2 - DO NOT REMOVE THIS LINE +# VERSION 3 - DO NOT REMOVE THIS LINE # # LoadModule auth_kerb_module modules/mod_auth_kerb.so @@ -45,6 +45,7 @@ WSGIScriptReloading Off # Protect /ipa with Kerberos <Location "/ipa"> + NSSRequireSSL AuthType Kerberos AuthName "Kerberos Login" KrbMethodNegotiate on diff --git a/install/tools/ipa-upgradeconfig b/install/tools/ipa-upgradeconfig index 1b08382e4..cae0964d5 100644 --- a/install/tools/ipa-upgradeconfig +++ b/install/tools/ipa-upgradeconfig @@ -116,7 +116,7 @@ def upgrade(sub_dict, filename, template, add=False): if new < 0: print "%s not found." % template - if old < new or add: + if old < new: backup_file(filename, new) update_conf(sub_dict, filename, template) print "Upgraded %s to version %d" % (filename, new) |