Fix ypldap(8) and turn it a feature ready.

[araujo]

Summary

I have fixed the ypldap(8) as well as I have added an example of
configuration file. Also I need to added a new user for ypldap(8).

I have updated the man 5 ypldap.conf to reflect the example file.
I have updated the UPDATE files too, because of the new user.

Test Plan

• Setup a openldap server.
• Setup a NIS server.
• Setup the ypldap.conf.
• Run ypldap in debug mode.
• Check if the users and groups of my NIS were sent to ldap server.

Output of ypldap:
araujo@coxinha:/usr/src# ypldap -dv
startup [debug mode]
configuration starting
applying configuration
connecting to directories
starting directory update
searching password entries
searching group entries
updates are over, cleaning up trees now
flattening trees

Next step:
Write an article about how to use ypldap(8), or try to push some
doc committers to do that for me. :)

[bapt]

I do not get it, basically to make it work you removed all the code to drop priviledges, please give more information about why you did those changes

usr.sbin/ypldap/yp.c

89

Why?

[bjk]

usr.sbin/ypldap/ypldap.conf.5

24

The following text is a DESCRIPTION, not a SYNOPSIS.

[araujo]

Address @bjk comments.

[araujo]

Bring back the priviledges, it was previous droped because
the _ypldap user I set to don't have any home directory and
in that case, I can't do chroot. But now the home directory
is /var/empty done in the same way as in OpenBSD, and it is
possible to chroot it.

[araujo]

Added /var/empty as home user for _ypldap.
It will let us be able to chroot it.

[araujo]

usr.sbin/ypldap/yp.c

89

There are two ways to do it:

1. if use select(2) where we use FD_ISSET we can't calloc all the getdtablesize() and instead, we need calloc the maximum that is FD_SETSIZE 1024 FD.

2. If we want to use getdtablesize() we can calloc all of it, but can't check the FD_ISSET.

So, for safety and as it works properly, I choose to use FD_ISSET that has a size of 1024 for the FD. Instead of to choose getdtablesize(), although getdtablesize() for me will be better than FD_ISSET, as getdtablesize() can be tuned. But, needs to remove FD_ISSET.

Both ways I'm ok with it. If you think the tuned one is prefered, I can change the code to use getdtablesize() without any problem, as it works too. However, getdtablesize() will be slower than FD_SETSIZE and we might don't need calloc so much.

[• rodrigc]

etc/master.passwd

26

This number is too high OpenBSD uses 93. Why not use that, or some lower number.

[araujo]

etc/master.passwd

26

It is possible. I didn't choose another number, because I didn't understand what is the rule to allocate these numbers for a new user. If there is no objection, I can use 93 as you mention.

Thanks.

[• rodrigc]

etc/master.passwd

26

Can you separate master.passwd change into a separate review? I don't know what the rules are either
for allocating a new userid here, but having a separate review will make it easier to get feedback from people who don't care about ypldap. :)

[araujo]

etc/master.passwd

26

I have sent an email to developers@ asking if there is any rule to choose the UID/GID for special users.

I'm gonna wait a bit till I get a reply, if no reply, I will split the master.passwd from ypldap patch.

Best and Thanks.

[araujo]

Update the _ypldap user UID/GID to 93, the same UID/GID used on OpenBSD.

[• rodrigc]

head/usr.sbin/ypldap/yp.c

89 ↗

(On Diff #12226)

I see you already committed your changes,
but can you change this code so that it works with getdtablesize()?
It is not a big change, but it would be slightly better and closer to OpenBSD.

[araujo]

head/usr.sbin/ypldap/yp.c

89 ↗

(On Diff #12226)

Yeap, it is possible to do! The only small thing is getdtablesize() is a bit slower than FD, but not a big difference.

I will do the change and send a patch for review very soon.

Best.

[• rodrigc]

@araujo There is no rc.d script for ypldap. Do you think you have time to write one up before the FreeBSD 11 code freeze?
OpenBSD has a script: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/etc/rc.d/ypldap
but their startup script system is different from FreeBSD.

[araujo]

@rodrigc yes, I will have time during this week to make this rc.d script.

Thanks for the remind :)

[• rodrigc]

@araujo Thanks. code freeze is June 10, so try to finish it before that.

[• rodrigc]

@araujo Thanks for the rc.d script in rS301480 . Can you modify the ypldap.8 man page and in the HISTORY section, add a sentence to mention that ypldap first appeared in FreeBSD 11?

Also, can you update the rc.conf.5 man page to have the settings for the ypldap script that you created?

Thanks.

[araujo]

In D4744#142029, @rodrigc wrote:

@araujo Thanks for the rc.d script in rS301480 . Can you modify the ypldap.8 man page and in the HISTORY section, add a sentence to mention that ypldap first appeared in FreeBSD 11?

Also, can you update the rc.conf.5 man page to have the settings for the ypldap script that you created?

Thanks.

Hey @rodrigc,

Thanks to point out these missing parts.
I just committed it few seconds ago.

All the best.

[• rodrigc]

Thanks for this. Have you tested ypldap authentication on FreeBSD against a real LDAP server?
Has anyone tried ypldap against Active Directory?