This project provides a set of daemons to manage access to remote
directories and authentication mechanisms, it provides an NSS and
PAM interface toward the system and a pluggable backend system to
connect to multiple different account sources. It is also the
basis to provide client auditing and policy services for projects
like FreeIPA. sssd also features caching, which can allow for
offline use to assist laptop users.
===> The following configuration options are available for sssd-1.16.5_14:
DOCS=on: Build and/or install documentation
===> Use 'make config' to modify these settings
================================================================================
Copy /usr/local/etc/sssd/sssd.conf.sample to /usr/local/etc/sssd/sssd.conf
and edit /usr/local/etc/sssd/sssd.conf (see man sssd.conf for details)
To load sssd at startup, add sssd_enable="YES" to /etc/rc.conf
To enable pam integration, add a line similar to the following to
/etc/pam.d/system:
login auth sufficient /usr/local/lib/pam_sss.so
To enable NSS integration, update /etc/nsswitch.conf as follows:
group: sss files
passwd: sss files
For additional details, please see the man pages for pam.conf and nsswitch.conf
An sssd HOWTO is also available:
https://fedorahosted.org/sssd/wiki/HOWTO_Configure_1_0_2
================================================================================
security/sssd*: Use an absolute path in sssd_prestart()
I believe this script worked by accident before.
PR: 279255
Approved by: maintainer
Sponsored by: Klara, Inc.
security/sssd-devel: rename to security/sssd2
- Rename to avoid confusion, port is stable
- Update MOVED
- Update security/sssd/Makefile with name change
security/sssd: disable po4a
Disable po4a. It is not an explicit build dependency, nor should
it be. There is no need to use it to rebuild man pages with the
current (1.16.5) distribution tarball. And using po4a (currently
0.68) somehow fails to create man pages for some locales.
PR: 267415
Approved by: portmgr (maintainer timeout, 4+ months)
security/sssd: Fix pkg-plist and chase krb5 update
This patch fixes two issues.
The first issue was presence of missing files of the SSSDConfig Python
module: PKG-INFO, SOURCES.txt, dependency_links., and top_level.txt. It
looks like those files are not installed anymore so let's just remove
them from pkg-plist.
The other issue was the build system not accepting the new version of
secruity/krb5. The fix is to patch sssd's build system to accept the new
version. This is how we fixed previous incarnations of this bug in the
past.
PR: 271939
Reported by: ddrinnon@cdor.net
Fixes: 7228a09df016 security/krb5: krb5-121 is now default
MFH: 2023Q3
Sponsored by: Klara Inc.
all: remove explicit versions in USES=python for "3.x+"
The logic in USES=python will automatically convert this to 3.8+ by
itself.
Adjust two ports that only had Python 3.7 mentioned but build fine
on Python 3.8 too.
finance/quickfix: mark BROKEN with PYTHON
libtool: compile: c++ -DHAVE_CONFIG_H -I. -I../.. -I -I. -I.. -I../.. -I../C++
-DLIBICONV_PLUG -DPYTHON_MAJOR_VERSION=3 -Wno-unused-variable
-Wno-maybe-uninitialized -O2 -pipe -DLIBICONV_PLUG -fstack-protector-strong
-fno-strict-aliasing -DLIBICONV_PLUG -Wall -ansi
-Wno-unused-command-line-argument -Wpointer-arith -Wwrite-strings
-Wno-overloaded-virtual -Wno-deprecated-declarations -Wno-deprecated -std=c++0x
-MT _quickfix_la-QuickfixPython.lo -MD -MP -MF
.deps/_quickfix_la-QuickfixPython.Tpo -c QuickfixPython.cpp -fPIC -DPIC -o
.libs/_quickfix_la-QuickfixPython.o
warning: unknown warning option '-Wno-maybe-uninitialized'; did you mean
'-Wno-uninitialized'? [-Wunknown-warning-option]
QuickfixPython.cpp:175:11: fatal error: 'Python.h' file not found
^~~~~~~~~~
1 warning and 1 error generated.
Reviewed by: portmgr, vishwin, yuri
Differential Revision: <https://reviews.freebsd.org/D40568>
Mk/**ldap.mk: Convert USE_LDAP to USES=ldap
Convert the USE_LDAP=yes to USES=ldap and adds the following features:
- Adds the argument USES=ldap:server to add openldap2{4|5|6}-server as
RUN_DEPENDS
- Adds the argument USES=ldap<version> and replaces WANT_OPENLDAP_VER
- Adds OPENLDAP versions in bsd.default-versions.mk
- Adds USE_OPENLDAP/WANT_OPENLDAP_VER in Mk/bsd.sanity.mk
- Changes consumers to use the features
Reviewed by: delphij
Approved by: portmgr
Differential Revision: https://reviews.freebsd.org/D38233
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security/sssd: implement detection of mempcpy at configure-time
Newer versions of FreeBSD provide mempcpy, which conflicts with the port's
own implementation -- meant for the older versions.
While here, fix compilation with newer Python -- not just 3.7 -- and relax
the requirement for Python-version. This necessitated bumping PORTREVISION --
because the default Python is 3.8 nowadays.
Also, define TEST_TARGET -- and fix one of the test to compile. This needs
further work, however.
PR: 257866
security/sssd: Fix installation with automake 1.16.4
Patch the configure script so it evaluates a variable that uses
PYTHON_PREFIX (since automake 1.16.4) before PYTHON_PREFIX is unset.
PR: 258898
Approved by: maintainer timeout (2 weeks)
net/openldap24-client: bump all dependent port
In the earlier net/openldap24-server commit, only those which depend on
net/openldap24-sasl-client were bumped. Bumping all dependent port that
didn't get a bump to force a rebuild of these packages.
Suggested by: kib
security/sssd: Fix package with SMB=on
While here, add comment in security/krb5 to remember the obscure dependency in
security/sssd so it does not break again.
PR: 244778
Reported by: tommyhp2@gmail.com
Tested by: tommyhp2@gmail.com
MFH: 2021Q2 (build fix)
security/sssd: update to 1.16.5
This fixes several security vulnerabilities and unexpires
the port because it moves to Python 3.
PR: 241347
Submitted by: lukas.slebodnik@intrak.sk (initial patch)
MFH: 2020Q4
Security: CVE-2018-16838
Security: CVE-2019-3811
security/sssd: Fix pkg-plist to include PAC files
In PR 244778 this port was reported to fail during package. sssd_pac and others
were not generated by the build process. They were removed from the pkg-plist
and the issue closed (maintainer timed out).
Recently joerg@ reported sssd_pac should be included. It turns out,
files/patch-src_external_pac__responder.m4 needs to be updated whenever a
version bump of security/krb5 occurs[1]. This is kind of obscure since building
security/sssd with default options does not reproduce the problem (SMB=on is
needed).
[1] https://svnweb.freebsd.org/changeset/ports/526479
PR: 244778
Reported by: joerg@
Approved by: maintainer (timeout)
MFH: 2020Q3 (plist fix)
security/sssd: fix package with SMB=on
When the option SMB is ON, the port fails to package.
While here:
* Reorder Makefile variables
* Change obsolete @unexec to @postexec
* Rework patches to comply with makepatch format
PR: 244778
Submitted by: tommyhp2@gmail.com
Approved by: lukas.slebodnik@intrak.sk (maintainer, timeout)
Remove conflicts from bind-tools and the server ports.
All servers now depend on the same bind-tools, from the latest BIND9
release.
Chase dependencies to make sure they now depend on the correct port.
Differential Revision: https://reviews.freebsd.org/D19922
Switch default version of samba to 4.7
Samba 4.6 will be discontinued in a few weeks
Reviewed by: mat
Differential Revision: https://reviews.freebsd.org/D16904
security/sssd: upstream has moved from fedorahosted to pagure.io
PR: 218082
Reviewed by: lukas.slebodnik@intrak.sk (maintainer)
Approved by: brd (ports)
Use USES=pathfix where applicable.
PR: 213195
Submitted by: mat
Exp-run by: antoine
Sponsored by: Absolight
Differential Revision: https://reviews.freebsd.org/D8093
devel/nspr, security/nss: drop version from SONAME
No other downstream appends synthetic library version, and doing so
causes underlinking due to fragile build system (see below). Not to
mention being unable to swap out bundled libs from upstream builds.
$ cc -lplds4 -L/usr/local/lib
/usr/lib/crt1.o: In function `_start1':
crt1_c.c:(.text+0xa6): undefined reference to `main'
/usr/local/lib/libplds4.so: undefined reference to `pthread_set_name_np'
/usr/local/lib/libplds4.so: undefined reference to `pthread_create'
/usr/local/lib/libplds4.so: undefined reference to `pthread_condattr_init'
/usr/local/lib/libplds4.so: undefined reference to `pthread_setschedparam'
/usr/local/lib/libplds4.so: undefined reference to `pthread_getschedparam'
PR: 213144
Exp-run by: antoine
- Remove BROKEN statement for Tier-2 systems (tested on PowerPC only due
to lots of dependencies and lack of hardware or working SPARC emulation
to perform tinderbox tests; c.f. https://reviews.freebsd.org/D2791)
- Clean up `post-install' target and fix numerous whitespace issues
libkrb5.so, what was being used as reference to security/krb5 dependency, is
present in base, then port was detecting it and not registering dependency
correctly. After installation, libsss_ldap.so was linked against libk5crypto.so
but it was not present in the system. Replace explicit dependency by USES
gssapi:mit and bump PORTREVISION
Approved by: portmgr (blanket)
- Update devel/automake to 1.15
- Update devel/gettext to 0.19.4
- Update devel/libtool and devel/libltdl to 2.4.5
- This version of libtool has been fixed to pass -fstack-protector to the
compiler during linking. Add the same fix to USES=libtool. This should
improve SSP support on FreeBSD/i386 8 and 9.
- databases/libmemcached, security/sssd: patch configure.ac so
AC_CONFIG_AUX_DIR appears earlier.
For databases/libmemcached changing configure.ac causes manpages to be
regenerated which requires extra dependencies so patch a makefile to
prevent that.
- devel/xfce4-dev-tools: only depend on recent versions of autoconf and
automake
PR: 196938
Exp-run by: antoine
Approved by: portmgr (antoine)
dns/c-ares:
- Add USES=libtool and bump dependent ports
- Move variable definitions in front of include bsd.port.options.mk
- Replace patch with USES=pathfix
Approved by: portmgr (implicit, bump unstaged port)
net/openldap24-*:
- Convert to USES=libtool and bump dependent ports
- Avoid USE_AUTOTOOLS
- Don't use PTHREAD_LIBS
- Use MAKE_CMD
databases/glom:
- Drop :keepla
- Add INSTALL_TARGET=install-strip
databases/libgda4* databases/libgda5*:
- Convert to USES=libtool and bump dependent ports
- USES=tar:xz
- Use INSTALL_TARGET=install-strip
- Use @sample
(Only the first 15 lines of the commit message are shown above )
Remove two libtool fixes from Mk/Uses/libtool.mk. They don't always work
when an older version of a package is installed. This is the case when an
executable links with installed libraries and with uninstalled libraries
that link with other uninstalled libraries. For each of the directly
linked libraries the executable will have an rpath (/usr/local/lib for the
installed libraries and a path under WRKDIR for each of the uninstalled
libraries), but not for the indirect libraries. Both ld(1) and rtld(1)
search the rpath of the executable first before any rpath of libraries, so
the indirectly linked libraries will be found in /usr/local/lib if they are
installed instead of in WRKDIR.
With this commit executables will overlink with uninstalled indirect
libraries again so their location is added to the rpath of the executable.
This partially reverts r358784.
PR: 191611
Approved by: portmgr (bapt)
Add 4 new sed commands to USES=libtool. The first two apply some of the
changes that Debian made to their libtool. The first command applies to
libtool versions 1.4 and up. The second command is somewhat more elaborate
but essentially it uses the sed hold space to move an "elif...fi" block
down. It applies to 2.x. Together these reduce overlinking to unpatched
.la files (from ports that don't have USES=libtool yet but also .la files
in the work directory).
The third and fourth command fix relinking. During staging libtool may
relink libA when it links to another library in the work directory libB.
The reason is that libA created during build phase has its runpath set to
the location of libB in the work directory. This allows running an
executable that links to libA from within the work directory. The relink
removes this extra runpath.
(Only the first 15 lines of the commit message are shown above )
- USES=libtool pathfix.
- Add missing USE_AUTOTOOLS=libtoolize autoheader.
- Don't patch configure and Makefile.in because they are regenerated.
- Sort pkg-plist and use @sample.
- rc script now passes rclint
- rc script creates dirs in /var before launching daemon
- add patch from upstream to match behavior of sssd on Linux
https://fedorahosted.org/sssd/ticket/2232
PR: ports/186545
Sponsored by: SupraNet Communications, Inc
Remove libldap.so from LIB_DEPENDS, it is already added by USE_OPENLDAP.
PR: ports/188942
Approved by: Lukas Slebodnik <lukas.slebodnik@intrak.sk> (maintainer)
The FreeBSD x11@ and graphics team proudly presents
a zeising, kwm production, with help from dumbbell, bdrewery:
NEW XORG ON FREEBSD 9-STABLE AND 10-STABLE
This update switches over to use the new xorg stack by default on FreeBSD 9
and 10 stable, on osversions where vt(9) is available.
It is still possible to use the old stack by specifying WITHOUT_NEW_XORG in
/etc/make.conf .
FreeBSD 8-STABLE and released versions of FreeBSD still use
the old version.
A package repository with binary packages for new xorg will
be available soon.
This patch also contains updates of libxcb and related ports, pixman, as well
(Only the first 15 lines of the commit message are shown above )
Eradicate USE_GNOME=pkgconfig from security
While here:
- Trim headers
- Convert USE_GMAKE to USES=gmake
- Convert USE_GNOME=gnomehack to USES=pathfix
- Convert USE_PERL5 to USES=perl5
