1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
|
Minor changes to the documentation
Wallet client man page
* Add the checksum command
* Add acl add examples
Update documentation for Object encryption in Config.pm
--- a/client/wallet.pod
+++ b/client/wallet.pod
@@ -181,7 +181,13 @@ For more information on attributes, see
=item acl add <id> <scheme> <identifier>
Add an entry with <scheme> and <identifier> to the ACL <id>. <id> may be
-either the name of an ACL or its numeric identifier.
+either the name of an ACL or its numeric identifier. Three schemes are
+supported: krb5, netdb, and ldap-attr. The netdb and ldap-attr must
+be configured before they can be used. Examples:
+
+ wallet acl add config/db krb5 mac@CA-ZEPHYR.ORG
+ wallet acl add config/db netdb host/keddie.ca-zephyr.org
+ wallet acl add config/db ldap-attr czPrivilegeGroup=admin
=item acl check <id>
@@ -257,6 +263,10 @@ already exist.
Check whether an object of type <type> and name <name> already exists. If
it does, prints C<yes>; if not, prints C<no>.
+=item checksum
+
+Returns the checksum for file objects.
+
=item comment <type> <name> [<comment>]
If <comment> is not given, displays the current comment for the object
@@ -390,7 +400,7 @@ will attempt to automatically create it
Prints to standard output the data associated with the object identified
by <type> and <name>, or stores it in a file if the B<-f> option was
-given. This will generate new data in the object, and only works for
+given. This will generate new data in the object, and only works for
objects that support generating new data automatically, such as keytabs or
passwords. Types that do not support generating new data will fail and
direct you to use get instead.
--- a/perl/lib/Wallet/Config.pm
+++ b/perl/lib/Wallet/Config.pm
@@ -723,6 +723,9 @@ specify the LDAP server and additional c
information required for the wallet to check for the existence of
attributes.
+The format for specifying an LDAP ACL is "acl-attr "<simple filter>"
+where a simple filter is of the form "attribute=value".
+
=over 4
=item LDAP_HOST
@@ -765,35 +768,6 @@ with this ACL type. This variable must
=cut
-our $LDAP_SECRET;
-
-=item LDAP_SECRET
-
-Specifies an LDAP URL that is used to retrieve the secret to use when
-encrypting and decrypting file objects. The url must not include the
-hostname. LDAP_HOST will be used as the hostname to bind to. The
-Kerberos ticket cache specified in LDAP_CACHE is used when connecting
-to the LDAP server. GSS-API authentication is always used; there is
-currently no support for any other type of bind. The ticket cache
-must be for a principal with access to retrieve the secret. This
-variable and LDAP_CACHE must be set to use file object encryption.
-
-=cut
-
-our $LDAP_SECRET_PREFIX;
-
-=item LDAP_SECRET_PREFIX
-
-Specifies the prefix to be used when generating storing an encrypted
-file object. The prefix is used to determine whether or not a file
-object has been stored encrypted. This allows the gradual transition
-from unencrypted file objects to encrypted file objects. When file
-object encryption is enable any "get" of an unencyrpted file object
-will result in the replacement of the unencrypted object with an
-encrypted object.
-
-=cut
-
our $LDAP_CACHE;
=back
@@ -825,13 +799,48 @@ Note that this example only removes the
Any principal from some other realm will be left fully qualified, and then
presumably will not be found in the directory.
-=head2 File Object Encryption
+=head1 FILE OBJECT ENCRYPTION
+
+=over 4
+
+=item LDAP_SECRET
+
+Specifies an LDAP URL that is used to retrieve the secret to use when
+encrypting and decrypting file objects. The url must not include the
+hostname. LDAP_HOST will be used as the hostname to bind to. The
+Kerberos ticket cache specified in LDAP_CACHE is used when connecting
+to the LDAP server. GSS-API authentication is always used; there is
+currently no support for any other type of bind. The ticket cache
+must be for a principal with access to retrieve the secret. This
+variable and LDAP_CACHE must be set to use file object encryption.
+
+=cut
+
+our $LDAP_SECRET;
+
+=item LDAP_SECRET_PREFIX
-The default encryption method use is based on the twofish cypher. If
+Specifies the prefix to be used when generating storing an encrypted
+file object. The prefix is used to determine whether or not a file
+object has been stored encrypted. This allows the gradual transition
+from unencrypted file objects to encrypted file objects. When file
+object encryption is enable any "get" of an unencyrpted file object
+will result in the replacement of the unencrypted object with an
+encrypted object.
+
+=cut
+
+our $LDAP_SECRET_PREFIX;
+
+=item file_crypt;
+
+This functionality has not been implmented yet.
+
+The default encryption method is based on the twofish cypher. If
another encryption method is desired then the perl function file_crypt
-should be defined. The function must accept three parameters: the
-action to preform, the encryption secret, and the string to encrypt or
-decrypt. For example:
+should be defined in the configuration file. The function must accept
+three parameters: the action to preform, the encryption secret, and
+the string to encrypt or decrypt. For example:
sub file_crypt {
use Crypt::RC4;
@@ -846,6 +855,21 @@ decrypt. For example:
return $return_string;
}
+=item file_crypt_secret
+
+This functionality has not been implmented yet.
+
+The default method use is based on the twofish cypher. If another
+method of retrieving a secret is desired then the perl function
+file_crypt_secret should be defined. The function accepts no
+parameters and returns the secret to be used. For example:
+
+ sub file_crypt_secret {
+ return "thisIsABadIdea";
+ }
+
+=back
+
=head1 NETDB ACL CONFIGURATION
These configuration variables are only needed if you intend to use the
|
