diff options
| author | Cy Schubert <cy@FreeBSD.org> | 2022-03-28 17:02:13 +0000 |
|---|---|---|
| committer | Cy Schubert <cy@FreeBSD.org> | 2022-03-28 17:02:13 +0000 |
| commit | 49af073ed77202a54dfdd773cbcbbf7835c75baf (patch) | |
| tree | b180dbeab238a3d30b8d99d05c9cf0e30fbadd5a /kadmin | |
| parent | d684f11da759490a8d98d7b790796106285f4084 (diff) | |
heimdal: Vendor import 7.7.0vendor/heimdal/7.7.0
Diffstat (limited to 'kadmin')
| -rw-r--r-- | kadmin/cpw.c | 4 | ||||
| -rw-r--r-- | kadmin/kadmin.1 | 10 | ||||
| -rw-r--r-- | kadmin/kadmin.cat1 | 9 | ||||
| -rw-r--r-- | kadmin/kadmind.8 | 2 | ||||
| -rw-r--r-- | kadmin/kadmind.cat8 | 2 | ||||
| -rw-r--r-- | kadmin/load.c | 6 | ||||
| -rw-r--r-- | kadmin/random_password.c | 5 |
7 files changed, 27 insertions, 11 deletions
diff --git a/kadmin/cpw.c b/kadmin/cpw.c index 425575d8953c..28cd30b52b16 100644 --- a/kadmin/cpw.c +++ b/kadmin/cpw.c @@ -76,7 +76,7 @@ set_random_password (krb5_principal principal, int keepold) printf ("%s's password set to \"%s\"\n", princ_name, pw); free (princ_name); } - memset (pw, 0, sizeof(pw)); + memset_s(pw, sizeof(pw), 0, sizeof(pw)); return ret; } @@ -108,7 +108,7 @@ set_password (krb5_principal principal, char *password, int keepold) if(ret == 0) ret = kadm5_chpass_principal_3(kadm_handle, principal, keepold, 0, NULL, password); - memset(pwbuf, 0, sizeof(pwbuf)); + memset_s(pwbuf, sizeof(pwbuf), 0, sizeof(pwbuf)); return ret; } diff --git a/kadmin/kadmin.1 b/kadmin/kadmin.1 index ef5c87e434c1..296f9f8004f2 100644 --- a/kadmin/kadmin.1 +++ b/kadmin/kadmin.1 @@ -250,7 +250,7 @@ kadmin -l modify -a -disallow-proxiable user Changes the password of an existing principal. .Ed .Pp -.Nm password-quality +.Nm verify-password-quality .Ar principal .Ar password .Bd -ragged -offset indent @@ -258,7 +258,13 @@ Run the password quality check function locally. You can run this on the host that is configured to run the kadmind process to verify that your configuration file is correct. The verification is done locally, if kadmin is run in remote mode, -no rpc call is done to the server. +no rpc call is done to the server. NOTE: if the environment has +verify-password-quality configured to use a back-end that stores +password history (such as heimdal-history), running +verify-quality-password will cause an update to the password +database meaning that merely verifying the quality of the password +using verify-quality-password invalidates the use of that +principal/password in the future. .Ed .Pp .Nm privileges diff --git a/kadmin/kadmin.cat1 b/kadmin/kadmin.cat1 index 0c6c0405cfd1..e93a1ee6a74a 100644 --- a/kadmin/kadmin.cat1 +++ b/kadmin/kadmin.cat1 @@ -125,13 +125,18 @@ DDEESSCCRRIIPPTTIIOONN Changes the password of an existing principal. - ppaasssswwoorrdd--qquuaalliittyy _p_r_i_n_c_i_p_a_l _p_a_s_s_w_o_r_d + vveerriiffyy--ppaasssswwoorrdd--qquuaalliittyy _p_r_i_n_c_i_p_a_l _p_a_s_s_w_o_r_d Run the password quality check function locally. You can run this on the host that is configured to run the kadmind process to verify that your configuration file is correct. The verification is done locally, if kadmin is run in remote mode, no rpc call is done to - the server. + the server. NOTE: if the environment has verify-password-quality + configured to use a back-end that stores password history (such as + heimdal-history), running verify-quality-password will cause an + update to the password database meaning that merely verifying the + quality of the password using verify-quality-password invalidates + the use of that principal/password in the future. pprriivviilleeggeess diff --git a/kadmin/kadmind.8 b/kadmin/kadmind.8 index f66615932c3a..411fc5f9a89f 100644 --- a/kadmin/kadmind.8 +++ b/kadmin/kadmind.8 @@ -109,7 +109,7 @@ get .It get-keys .It -all +all (everything except get-keys) .El .Pp And the optional diff --git a/kadmin/kadmind.cat8 b/kadmin/kadmind.cat8 index d1607c9a4e4c..b344db7c270d 100644 --- a/kadmin/kadmind.cat8 +++ b/kadmin/kadmind.cat8 @@ -38,7 +38,7 @@ DDEESSCCRRIIPPTTIIOONN ++oo add ++oo get ++oo get-keys - ++oo all + ++oo all (everything except get-keys) And the optional _p_r_i_n_c_i_p_a_l_-_p_a_t_t_e_r_n restricts the rights to operations on principals that match the glob-style pattern. diff --git a/kadmin/load.c b/kadmin/load.c index f448710b8646..a9273dbf20f1 100644 --- a/kadmin/load.c +++ b/kadmin/load.c @@ -453,6 +453,7 @@ doit(const char *filename, int mergep) fclose(f); return 1; } + (void) db->hdb_set_sync(context, db, 0); for (lineno = 1; (ret2 = my_fgetln(f, &line, &linesz, &linelen)) == 0 && linelen > 0; ++lineno) { @@ -608,7 +609,10 @@ doit(const char *filename, int mergep) } free(line); if (ret2) - ret = ret2; + ret = ret2; + ret2 = db->hdb_set_sync(context, db, 1); + if (ret2) + krb5_err(context, 1, ret, "failed to sync the HDB"); (void) kadm5_log_end(kadm_handle); ret2 = db->hdb_close(context, db); if (ret2) diff --git a/kadmin/random_password.c b/kadmin/random_password.c index 970e99d34adb..bf8bf8b3f1c0 100644 --- a/kadmin/random_password.c +++ b/kadmin/random_password.c @@ -68,7 +68,8 @@ random_password(char *pw, size_t len) "ABCDEFGHIJKLMNOPQRSTUVWXYZ", 2, "@$%&*()-+=:,/<>1234567890", 1); strlcpy(pw, pass, len); - memset(pass, 0, strlen(pass)); + len = strlen(pass); + memset_s(pass, len, 0, len); free(pass); #endif } @@ -155,7 +156,7 @@ generate_password(char **pw, int num_classes, ...) } } (*pw)[len] = '\0'; - memset(rbuf, 0, sizeof(rbuf)); + memset_s(rbuf, sizeof(rbuf), 0, sizeof(rbuf)); free(classes); } #endif |