* Sun Jan 26 2025 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-12.sme

- some scripts requires setuidgid from daemontools to run [SME: 12566]

.gitignore

@@ -2,3 +2,4 @@
 *.log
 *spec-20*
 *.tar.xz
+*.bak

README.md

@@ -6,7 +6,14 @@ SMEServer Koozali developed git repo for smeserver-ldap smeserver
 <br />https://wiki.koozali.org/
 
 ## Bugzilla
-Show list of outstanding bugs: [here](https://bugs.koozali.org/buglist.cgi?component=smeserver-ldap&product=SME%20Server%2010.X&query_format=advanced&limit=0&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&bug_status=CONFIRMED)\
+Show list of outstanding bugs:
+[All](https://bugs.koozali.org/buglist.cgi?action=wrap&bug_status=UNCONFIRMED&bug_status=CONFIRMED&bug_status=NEEDINFO&bug_status=IN_PROGRESS&bug_status=RESOLVED&bug_status=VERIFIED&cf_package=smeserver-ldap&classification=SME+Server&list_id=105756&order=changeddate+DESC%2Ccomponent%2Cpriority%2Cbug_severity&query_format=advanced)  
+[Confirmed](https://bugs.koozali.org/buglist.cgi?action=wrap&bug_status=CONFIRMED&cf_package=smeserver-ldap&classification=SME+Server&order=changeddate+DESC%2Ccomponent%2Cpriority%2Cbug_severity&query_format=advanced)  
+[Unconfirmed](https://bugs.koozali.org/buglist.cgi?action=wrap&bug_status=UNCONFIRMED&cf_package=smeserver-ldap&classification=SME+Server&order=changeddate+DESC%2Ccomponent%2Cpriority%2Cbug_severity&query_format=advanced)  
+[Need info](https://bugs.koozali.org/buglist.cgi?action=wrap&bug_status=NEEDINFO&cf_package=smeserver-ldap&classification=SME+Server&order=changeddate+DESC%2Ccomponent%2Cpriority%2Cbug_severity&query_format=advanced)  
+[In progress](https://bugs.koozali.org/buglist.cgi?action=wrap&bug_status=IN_PROGRESS&cf_package=smeserver-ldap&classification=SME+Server&order=changeddate+DESC%2Ccomponent%2Cpriority%2Cbug_severity&query_format=advanced)  
+[Resolved](https://bugs.koozali.org/buglist.cgi?action=wrap&bug_status=RESOLVED&cf_package=smeserver-ldap&classification=SME+Server&order=changeddate+DESC%2Ccomponent%2Cpriority%2Cbug_severity&query_format=advanced)  
+[Verified](https://bugs.koozali.org/buglist.cgi?action=wrap&bug_status=VERIFIED&cf_package=smeserver-ldap&classification=SME+Server&order=changeddate+DESC%2Ccomponent%2Cpriority%2Cbug_severity&query_format=advanced)
 And a list of outstanding Legacy bugs: (e-smith-ldap) [here](https://bugs.koozali.org/buglist.cgi?component=e-smith-ldap&product=SME%20Server%2010.X&query_format=advanced&limit=0&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&bug_status=CONFIRMED)
 
 ## Description

contriborbase

@@ -1 +0,0 @@
-sme10

root/etc/e-smith/templates/etc/openldap/slapd.conf/12tls

@@ -1,15 +1,8 @@
-
-TLSCipherSuite         { $ldap{CipherSuite} || $modSSL{CipherSuite} || 'ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:HIGH@STRENGTH:!SSLv2:!ADH:!aNULL:!MD5:!RC4' }
-TLSProtocolMin         { my $TLSProtocolMin = $ldap{TLSProtocolMin} || 'TLSv1.2';
-if ( $TLSProtocolMin eq 'SSLv3' ){
-        $OUT = " 3.0";
-} elsif ( $TLSProtocolMin eq 'TLSv1.0' || $TLSProtocolMin eq 'TLSv1' ){
-        $OUT = " 3.1";
-} elsif ( $TLSProtocolMin eq 'TLSv1.1' ){
-        $OUT = " 3.2";
-} elsif ( $TLSProtocolMin eq 'TLSv1.2' ){
-        $OUT = " 3.3";
-}
+{
+ use esmith::ssl;
+ $OUT =  "TLSCipherSuite         ". ( $ldap{CipherSuite} || $modSSL{CipherSuite} || $smeCiphers ) ."\n"; 
+ my $TLSProtocolMin = ( (exists $ldap{'TLSProtocolMin'} ) && (exists $existingSSLprotos{$ldap{'TLSProtocolMin'}} ) ) ? SSLprotoLDAP($ldap{'TLSProtocolMin'}) : SSLprotoLDAP(); 
+ $OUT .= "TLSProtocolMin         ". $TLSProtocolMin ."\n";
 }
 TLSCACertificateFile   /etc/openldap/ssl/slapd.pem
 TLSCertificateFile     /etc/openldap//ssl/slapd.pem

root/etc/e-smith/templates/etc/rsyslog.conf/32ldap

@@ -1,4 +1,6 @@
 #ldap
 :programname, isequal, "slapd"            /var/log/ldap/ldap.log
 & stop
+:programname, isequal, "ldap"            /var/log/ldap/ldap.log
+& stop
 

root/etc/logrotate.d/ldap

@@ -6,6 +6,6 @@
 	sharedscripts
 	postrotate
 		# OpenLDAP logs via syslog, restart syslog if running
-		/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
+		/usr/bin/systemctl -s HUP kill rsyslog.service  2> /dev/null || true
 	endscript
 }

root/etc/tmpfiles.d/slapd.conf

@@ -0,0 +1,3 @@
+# openldap runtime directory for slapd.arg and slapd.pid
+d /run/openldap 0755 ldap ldap -
+

root/sbin/e-smith/ldif-fix

@@ -8,6 +8,8 @@ use Date::Parse;
 use esmith::ConfigDB;
 use esmith::AccountsDB;
 use esmith::util;
+use utf8;
+use esmith::util::ldap;
 use Getopt::Long qw(:config bundling);
 
 $ENV{'PATH'} = '/bin:/usr/bin:/sbin:/usr/sbin';
@@ -97,8 +99,8 @@ foreach my $acct ($a->get('admin'), $a->users, $a->groups, $a->ibays, $a->get_al
             push @{$data->{$dn}->{objectclass}}, 'inetOrgPerson';
             $data->{$dn}->{mail} = "$key\@$domain";
             @{$data->{$dn}}{qw/givenname sn telephonenumber o ou l street/} =
-                map { $acct->prop($_) || [] } qw/FirstName LastName Phone Company Dept City Street/;
-            $data->{$dn}->{cn} = $acct->prop('FirstName').' '.$acct->prop('LastName');
+                map { stringToASCII($acct->prop($_)) || [] } qw/FirstName LastName Phone Company Dept City Street/;
+            $data->{$dn}->{cn} = stringToASCII($acct->prop('FirstName').' '.$acct->prop('LastName'));
         }
         else {
             push @{$data->{$dn}->{objectclass}}, 'account';

root/usr/lib/systemd/system/ldap.init.service

@@ -1,6 +1,6 @@
 [Unit]
 Description=Koozali SME Server ldap.init
-After=syslog.target network-online.target ldap.service
+After=syslog.target network-online.target ldap.service smbd.service nmbd.service
 
 [Service]
 Type=forking

root/usr/lib/systemd/system/ldap.service

@@ -21,6 +21,7 @@ TimeoutStartSec=300
 Restart=always
 
 ExecStopPost=/sbin/e-smith/systemd/ldap-finish
+SyslogIdentifier=ldap
 
 [Install]
 WantedBy=sme-server.target

root/usr/lib/systemd/system/slapd.service.d/50koozali.conf

@@ -1,6 +1,7 @@
 [Service]
 # disabled
 # we are using ldap.service
+ExecStart=
 ExecStart=/usr/bin/true
 ExecStartPre=
 PIDFile=

smeserver-ldap.spec

@@ -4,7 +4,7 @@ Summary: smeserver server and gateway - LDAP module
 %define name smeserver-ldap
 Name: %{name}
 %define version 11.0.0
-%define release 5
+%define release 12
 Version: %{version}
 Release: %{release}%{?dist}
 License: GPL
@@ -14,13 +14,15 @@ Source: %{name}-%{version}.tar.xz
 BuildRoot: /var/tmp/%{name}-%{version}-%{release}-buildroot
 BuildArchitectures: noarch
 Requires: smeserver-base
-Requires: smeserver-lib >= 1.15.1-16
+Requires: smeserver-lib >= 11.0.0-7 
 Requires: openldap >= 2.0.0
 Requires: openldap-clients
 Requires: openldap-servers
 Requires: perl(Net::LDAP)
 Requires: libdb4-utils
 Requires: smeserver-formmagick >= 1.4.0-9
+# daemontools bins in use 
+Requires: /usr/bin/setuidgid
 BuildRequires: smeserver-devtools >= 1.13.1-03
 AutoReqProv: no
 
@@ -29,11 +31,35 @@ Provides: e-smith-ldap
 smeserver server and gateway software - LDAP module.
 
 %changelog
+* Sun Jan 26 2025 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-12.sme
+- some scripts requires setuidgid from daemontools to run [SME: 12566]
+
+* Sat Jan 18 2025 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-11.sme
+- use esmith::ssl to set ciphers and protocol [SME: 12824]
+
+* Tue Nov 12 2024 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-10.sme
+- send ldap logs to dedicated rsyslog file [SME: 12771]
+
+* Sun Sep 22 2024 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-9.sme
+- el8 workaround to avoid noise with /var/run /run path [SME: 12619]
+  /etc/tmpfiles.d/slapd.conf to remove when fixed upstream
+
+* Tue Aug 13 2024 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-8.sme
+- ldif-fix filter string accepting only ascii [SME: 12720]
+- fix logrotate does not fill new log [SME: 12673]
+- fix prestart script logs to messages [SME: 12693]
+
+* Wed Apr 17 2024 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-7.sme
+- fix ldap.init fails as starts before samba [SME: 12570]
+
+* Fri Apr 12 2024 John Crisp <jcrisp@safeandsoundit.co.uk> 11.0.0-6.sme
+- Fix dropin file  [SME: 12610]
+
 * Sat Apr 06 2024 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-5.sme
 - drop rssh group reverting  patch of 11753  [SME: 12510]
 
 * Thu Apr 04 2024 Brian Read <brianr@koozali.org> 11.0.0-4.sme
-- Update createlinks to create smeserver-package-update event[SME: 12579]
+- Update createlinks to create smeserver-package-update event  [SME: 12579]
 
 * Thu Apr 04 2024 Brian Read <brianr@koozali.org> 11.0.0-3.sme
 - Set license file to GPL2.0  [SME: 12577]