Library/0042775000175300003300000000000010303736570011461 5ustar jillljeditLibrary/Preferences/0042775000175300003300000000000010303737257013725 5ustar jillljeditLibrary/Preferences/DirectoryService/0042775000175300003300000000000010303737156017210 5ustar jillljeditLibrary/Preferences/DirectoryService/DSLDAPv3PlugInConfig.plist0100664000175300003300000002743610303737112023751 0ustar jillljedit LDAP PlugIn Version DSLDAPv3PlugIn Version 1.5 LDAP Server Configs Attribute Type Map Native Map cn Standard Name dsAttrTypeStandard:RecordName Enable Use OpenClose Timeout in seconds 10 Port Number 636 Record Type Map Attribute Type Map Native Map uid cn Standard Name dsAttrTypeStandard:RecordName Native Map cn Standard Name dsAttrTypeStandard:RealName Native Map uidNumber Standard Name dsAttrTypeStandard:UniqueID Native Map gidNumber Standard Name dsAttrTypeStandard:PrimaryGroupID Native Map homeDirectory Standard Name dsAttrTypeStandard:NFSHomeDirectory Native Map userPassword Standard Name dsAttrTypeStandard:Password Native Map loginShell Standard Name dsAttrTypeStandard:UserShell Native Map description Standard Name dsAttrTypeStandard:Comment Native Map shadowLastChange Standard Name dsAttrTypeStandard:Change Native Map shadowExpire Standard Name dsAttrTypeStandard:Expire Native Map authAuthority Standard Name dsAttrTypeStandard:AuthenticationAuthority Native Map Group Object Classes OR Object Classes posixAccount inetOrgPerson shadowAccount One Level Search Scope Search Base ou=people,o=ci,dc=example,dc=com Standard Name dsRecTypeStandard:Users Attribute Type Map Native Map memberUid Standard Name dsAttrTypeStandard:GroupMembership Native Map memberUid Standard Name dsAttrTypeStandard:Member Native Map gidNumber Standard Name dsAttrTypeStandard:PrimaryGroupID Native Map Group Object Classes OR Object Classes posixGroup One Level Search Scope Search Base ou=group,o=ci,dc=example,dc=com Standard Name dsRecTypeStandard:Groups Attribute Type Map Native Map mountDirectory Standard Name dsAttrTypeStandard:VFSLinkDir Native Map mountOption Standard Name dsAttrTypeStandard:VFSOpts Native Map mountType Standard Name dsAttrTypeStandard:VFSType Native Map mountDumpFrequency Standard Name dsAttrTypeStandard:VFSDumpFreq Native Map mountPassNo Standard Name dsAttrTypeStandard:VFSPassNo Native Map Group Object Classes OR Object Classes mount One Level Search Scope Search Base ou=mounts,o=ci,dc=example,dc=com Standard Name dsRecTypeStandard:Mounts Attribute Type Map Native Map cn Standard Name dsAttrTypeStandard:RecordName Native Map cn Standard Name dsAttrTypeStandard:RealName Native Map sn Standard Name dsAttrTypeStandard:LastName Native Map givenName Standard Name dsAttrTypeStandard:FirstName Native Map mail Standard Name dsAttrTypeStandard:EMailAddress Native Map telephoneNumber Standard Name dsAttrTypeStandard:PhoneNumber Native Map fax Standard Name dsAttrTypeStandard:FAXNumber Native Map mobile Standard Name dsAttrTypeStandard:MobileNumber Native Map pager Standard Name dsAttrTypeStandard:PagerNumber Native Map street Standard Name dsAttrTypeStandard:AddressLine1 Native Map postalAddress Standard Name dsAttrTypeStandard:PostalAddress Native Map street Standard Name dsAttrTypeStandard:Street Native Map locality Standard Name dsAttrTypeStandard:City Native Map st Standard Name dsAttrTypeStandard:State Native Map postalCode Standard Name dsAttrTypeStandard:PostalCode Native Map c Standard Name dsAttrTypeStandard:Country Native Map o Standard Name dsAttrTypeStandard:OrganizationName Native Map departmentNumber Standard Name dsAttrTypeStandard:Department Native Map title Standard Name dsAttrTypeStandard:JobTitle Native Map buildingName Standard Name dsAttrTypeStandard:Building Native Map Group Object Classes OR Object Classes inetOrgPerson Search Base o=ci,dc=example,dc=com Standard Name dsRecTypeStandard:People Attribute Type Map Native Map Group Object Classes OR Search Base ou=hosts,o=ci,dc=example,dc=com Standard Name dsRecTypeStandard:Hosts Replica Hostname List ldap.example.com SSL Search Timeout in seconds 10 Server ldap.example.com Server Mappings Template Search Base Suffix o=ci,dc=example,dc=com UI Name james Writeable Hostname List ldap.example.com Sheet Expanded Library/Preferences/DirectoryService/SearchNodeConfig.plist0100664000175300003300000000077510303737124023425 0ustar jillljedit DHCP LDAP /Sets/0 Search Node Custom Path Array /LDAPv3/ldap.example.com Search Node PlugIn Version Search Node PlugIn Version 1.6 Search Policy 3 Library/Preferences/edu.mit.Kerberos0100664000175300003300000000073010303737257016763 0ustar jillljedit[libdefaults] ticket_lifetime = 600 default_realm = CI.EXAMPLE.COM default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc dnsfallback = no [realms] CI.EXAMPLE.COM = { kdc = kdc.example.com:88 kdc = ldap.example.com:88 admin_server = kdc.example.com:749 } [domain_realm] .example.com = CI.EXAMPLE.COM example.com = CI.EXAMPLE.COM etc/0042775000175300003300000000000010303741064010622 5ustar jillljeditetc/ssh/0042775000175300003300000000000010303740577011427 5ustar jillljeditetc/ssh/sshd_config0100664000175300003300000000471210303740542013627 0ustar jillljedit# $OpenBSD: sshd_config,v 1.68 2003/12/29 16:39:50 millert Exp $ # This is the sshd server system-wide configuration file. See # sshd_config(5) for more information. # This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin # The strategy used for options in the default sshd_config shipped with # OpenSSH is to specify options with their default value where # possible, but leave them commented. Uncommented options change a # default value. #Port 22 Protocol 2 #ListenAddress 0.0.0.0 #ListenAddress :: # HostKey for protocol version 1 #HostKey /etc/ssh/ssh_host_key # HostKeys for protocol version 2 #HostKey /etc/ssh/ssh_host_rsa_key #HostKey /etc/ssh/ssh_host_dsa_key # Lifetime and size of ephemeral version 1 server key #KeyRegenerationInterval 1h #ServerKeyBits 768 # Logging #obsoletes QuietMode and FascistLogging #SyslogFacility AUTH #LogLevel INFO # Authentication: #LoginGraceTime 2m PermitRootLogin yes #StrictModes yes #RSAAuthentication yes #PubkeyAuthentication yes #AuthorizedKeysFile .ssh/authorized_keys # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts #RhostsRSAAuthentication no # similar for protocol version 2 #HostbasedAuthentication no # Change to yes if you don't trust ~/.ssh/known_hosts for # RhostsRSAAuthentication and HostbasedAuthentication #IgnoreUserKnownHosts no # Don't read the user's ~/.rhosts and ~/.shosts files #IgnoreRhosts yes # To disable tunneled clear text passwords, change to no here! #PasswordAuthentication yes #PermitEmptyPasswords no # Change to no to disable s/key passwords #ChallengeResponseAuthentication yes # Kerberos options #KerberosAuthentication yes #KerberosOrLocalPasswd yes #KerberosTicketCleanup no #KerberosGetAFSToken no # GSSAPI options GSSAPIAuthentication yes GSSAPICleanupCredentials yes # Set this to 'yes' to enable PAM authentication (via challenge-response) # and session processing. Depending on your PAM configuration, this may # bypass the setting of 'PasswordAuthentication' and 'PermitEmptyPasswords' UsePAM yes #AllowTcpForwarding yes #GatewayPorts no X11Forwarding yes #X11DisplayOffset 10 #X11UseLocalhost yes #PrintMotd yes #PrintLastLog yes #TCPKeepAlive yes #UseLogin no #UsePrivilegeSeparation yes #PermitUserEnvironment no #Compression yes #ClientAliveInterval 0 #ClientAliveCountMax 3 #UseDNS yes #PidFile /var/run/sshd.pid #MaxStartups 10 # no default banner path #Banner /some/path # override default of no subsystems Subsystem sftp /usr/lib/misc/sftp-server etc/nsswitch.conf0100664000175300003300000000047710274253002013333 0ustar jillljeditpasswd: files ldap shadow: files group: files ldap hosts: files dns ldap networks: files dns services: db files ldap protocols: db files ldap rpc: db files ethers: db files netmasks: files netgroup: files ldap bootparams: files automount: files aliases: files etc/pam.d/0042775000175300003300000000000010303737677011640 5ustar jillljeditetc/pam.d/system-auth0100664000175300003300000000164510274253002014025 0ustar jillljeditauth required /lib/security/pam_env.so auth required /lib/security/pam_nologin.so auth sufficient /lib/security/pam_unix.so likeauth nullok auth sufficient /lib/security/pam_krb5.so use_first_pass tokens auth required /lib/security/pam_deny.so account required /lib/security/pam_access.so account sufficient /lib/security/pam_krb5.so account sufficient /lib/security/pam_unix.so password required /lib/security/pam_cracklib.so retry=3 password sufficient /lib/security/pam_unix.so nullok md5 shadow use_authtok password sufficient /lib/security/pam_krb5.so use_authtok password required /lib/security/pam_deny.so session required /lib/security/pam_mkhomedir.so skel=/etc/skel/ umask=0022 session required /lib/security/pam_limits.so session required /lib/security/pam_unix.so session optional /lib/security/pam_krb5.so etc/krb5.conf0100664000175300003300000000117510303737365012344 0ustar jillljedit[libdefaults] ticket_lifetime = 600 default_realm = CI.EXAMPLE.COM default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc [realms] CI.EXAMPLE.COM = { kdc = kdc.example.com:88 kdc = ldap.example.com:88 admin_server = kdc.example.com:749 } [domain_realm] .example.com = CI.EXAMPLE.COM example.com = CI.EXAMPLE.COM [kdc] profile = /etc/krb5kdc/kdc.conf [logging] kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmin.log default = FILE:/var/log/krb5lib.log etc/authorization0100664000175300003300000004301010303741063013435 0ustar jillljedit comment The name of the requested right is matched against the keys. An exact match has priority, otherwise the longest match from the start is used. Note that the right will only match wildcard rules (ending in a ".") during this reduction. allow rule: this is always allowed <key>com.apple.TestApp.benign</key> <string>allow</string> deny rule: this is always denied <key>com.apple.TestApp.dangerous</key> <string>deny</string> user rule: successful authentication as a user in the specified group(5) allows the associated right. The shared property specifies whether a credential generated on success is shared with other apps (same "session"). This property defaults to false if not specified. The timeout property specifies the maximum age of a (cached/shared) credential accepted for this rule. The allow-root property specifies whether a right should be allowed automatically if the requesting process is running with uid == 0. This defaults to false if not specified. See remaining rules for examples. rights class rule comment All other rights will be matched by this rule. rule default com.apple.Safari.parental-controls allow-root class user comment This right is checked when changing parental controls for Safari group ldap-admins shared timeout 0 com.apple.activitymonitor.kill class user comment Used by Activity Monitor to authorize killing processes not owned by the user group ldap-admins shared timeout 0 com.apple.airport.allow.computer-to-computer class rule comment Whether AirPort interactions are allowed or not k-of-n 1 rule is-admin allow com.apple.airport.allow.network.change class rule comment Whether AirPort interactions are allowed or not k-of-n 1 rule is-admin allow com.apple.appserver.privilege.admin class rule comment Used to determine administrative access to the Application Server management tool. rule appserver-admin com.apple.appserver.privilege.user class rule comment Used to determine user access to the Application Server management tool. k-of-n 1 rule appserver-admin appserver-user com.apple.builtin.confirm-access class evaluate-mechanisms mechanisms builtin:confirm-access com.apple.builtin.confirm-access-password class evaluate-mechanisms mechanisms builtin:confirm-access-password com.apple.builtin.generic-new-passphrase class evaluate-mechanisms mechanisms builtin:generic-new-passphrase com.apple.builtin.generic-unlock class evaluate-mechanisms mechanisms builtin:generic-unlock com.apple.desktopservices class user comment authorize privileged file operations from the finder group ldap-admins shared timeout 0 com.apple.server.admin.streaming allow-root class user comment Used for admin requests with the QuickTime Streaming Server. group ldap-admins shared timeout 0 config.add. class allow comment wildcard right for adding rights. Anyone is allowed to add any (non-wildcard) rights config.config. class deny comment wildcard right for any change to meta-rights for db modification. Not allowed programmatically (just edit this file) config.modify. class rule comment wildcard right for modifying rights. Admins are allowed to modify any (non-wildcard) rights. Root does not require authentication. k-of-n 1 rule is-root authenticate-admin config.remove. class rule comment wildcard right for deleting rights. Admins are allowed to delete any (non-wildcard) rights. Root does not require authentication. k-of-n 1 rule is-root authenticate-admin config.remove.system. class deny comment wildcard right for deleting system rights. sys.openfile. class user comment See authopen(1) for information on the use of this right. group ldap-admins shared timeout 300 system.burn class allow comment authorization to burn media system.device.dvd.setregion.initial class user comment Used by the dvd player to set the regioncode the first time. Note that changed the region code after it has been set requires a different right (system.device.dvd.setregion.change) Credentials remain valid indefinitely after they've been obtained. An acquired credential is shared amongst all clients. group ldap-admins shared system.install.admin.user class user comment Used by installer tool: user installling in admin domain (/Applications) group ldap-admins shared timeout 300 system.install.root.admin class user comment Used by installer tool: admin installling in root domain (/System) group ldap-admins shared timeout 300 system.install.root.user class user comment Used by installer tool: user installling in root domain (/System) group ldap-admins shared timeout 300 system.keychain.create.loginkc allow-root class evaluate-mechanisms comment Used by Security framework when you add an item to a unconfigured default keychain mechanisms loginKC:queryCreate loginKC:showPasswordUI authinternal session-owner shared system.keychain.modify class user comment Used by Keychain Access when editing a system keychain. group ldap-admins shared timeout 300 system.login.console class evaluate-mechanisms comment Login mechanism based rule. Not for general use, yet. builtin:krb5authenticate can be used to hinge local authentication on a successful kerberos authentication and kdc verification. builtin:krb5authnoverify skips the kdc verification. Both fall back on local authentication. mechanisms builtin:auto-login,privileged loginwindow_builtin:login builtin:reset-password,privileged authinternal builtin:getuserinfo,privileged builtin:sso,privileged HomeDirMechanism:login,privileged HomeDirMechanism:status MCXMechanism:login loginwindow_builtin:success loginwindow_builtin:done system.login.done class evaluate-mechanisms comment builtin:krb5login can be used to do kerberos authentication as a side-effect of logging in. Local username/password will be used. mechanisms system.login.pam class evaluate-mechanisms mechanisms push_hints_to_context authinternal tries 1 system.login.screensaver class rule comment the owner as well as any admin can unlock the screensaver;modify the group key to change this. rule authenticate-session-owner-or-admin system.login.tty class evaluate-mechanisms mechanisms push_hints_to_context authinternal tries 1 system.preferences allow-root class user comment This right is checked by the Admin framework when making changes to the system preferences. group ldap-admins shared system.preferences.accessibility allow-root class user comment This right is checked by the Admin framework when enabling or disabling the Accessibility APIs group ldap-admins shared timeout 0 system.preferences.accounts allow-root class user comment This right is checked by the Admin framework when making changes to the accounts preference pane group ldap-admins shared system.printingmanager class rule comment The following right is checked for printing to locked printers. rule authenticate-admin system.privilege.admin allow-root class user comment Used by AuthorizationExecuteWithPrivileges(...) AuthorizationExecuteWithPrivileges is used by programs requesting to run a tool as root (ie. some installers). Credentials remain valid 5 minutes after they've been obtained. An acquired credential isn't shared with other clients. Clients running as root will be granted this right automatically. group ldap-admins shared timeout 300 system.restart class evaluate-mechanisms comment Multisession restart mechanisms mechanisms RestartAuthorization:restart RestartAuthorization:authenticate RestartAuthorization:success system.services.directory.configure allow-root class user comment authorization to make directory service changes group ldap-admins shared timeout 300 system.shutdown class evaluate-mechanisms comment Multisession shutdown mechanisms mechanisms RestartAuthorization:shutdown RestartAuthorization:authenticate RestartAuthorization:success rules allow class allow comment allow anyone appserver-admin class user group appserveradm appserver-user class user group appserverusr authenticate class evaluate-mechanisms mechanisms builtin:authenticate authinternal authenticate-admin class user comment require the user asking for authorization to authenticate as an admin group ldap-admins shared timeout 0 authenticate-session-owner class user comment authenticate session owner session-owner authenticate-session-owner-or-admin allow-root class user comment the owner as well as any admin can authorize group ldap-admins session-owner shared authenticate-session-user class user comment authenticate session owner session-owner default class user comment All other rights will be matched by this rule. Credentials remain valid 5 minutes after they've been obtained. An acquired credential is shared amongst all clients. group ldap-admins shared timeout 300 is-admin authenticate-user class user comment verify the user asking for authorization is an admin group ldap-admins shared true is-root allow-root authenticate-user class user comment verify the process that created this authref is root etc/openldap/0042775000175300003300000000000010303737606012433 5ustar jillljeditetc/openldap/ldap.conf0100664000175300003300000000056410303737606014222 0ustar jillljedit# $OpenLDAP: pkg/ldap/libraries/libldap/ldap.conf,v 1.9 2000/09/04 19:57:01 kurt Exp $ # # LDAP Defaults # # See ldap.conf(5) for details # This file should be world readable but not world writable. BASE o=ci,dc=example,dc=com URI ldaps://ldap.example.com ldaps://kdc.example.com TLS_CACERTDIR /etc/ssl/certs TLS_REQCERT allow #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never etc/ldap.conf0100664000175300003300000000076010303737523012414 0ustar jillljedithost ldap.example.com kdc.example.com base o=ci,dc=example,dc=com ssl start_tls tls_checkpeer no tls_cacertdir /etc/ssl/certs nss_base_passwd ou=people,o=ci,dc=example,dc=com nss_base_group ou=group,o=ci,dc=example,dc=com nss_base_hosts ou=hosts,o=ci,dc=example,dc=com nss_base_services ou=services,o=ci,dc=example,dc=com nss_base_protocols ou=protocols,o=ci,dc=example,dc=com nss_base_netgroup ou=netgroups,o=ci,dc=example,dc=com nss_base_automount ou=mounts,o=ci,dc=example,dc=com usr/0042775000175300003300000000000010303736550010664 5ustar jillljeditusr/bin/0042775000175300003300000000000010303737705011437 5ustar jillljeditusr/bin/c_rehash0100775000175300003300000000707210303737705013142 0ustar jillljedit#!/usr/bin/perl # Perl c_rehash script, scan all files in a directory # and add symbolic links to their hash values. my $openssl; my $dir = "/etc/ssl"; if(defined $ENV{OPENSSL}) { $openssl = $ENV{OPENSSL}; } else { $openssl = "openssl"; $ENV{OPENSSL} = $openssl; } $ENV{PATH} .= ":$dir/bin"; if(! -x $openssl) { my $found = 0; foreach (split /:/, $ENV{PATH}) { if(-x "$_/$openssl") { $found = 1; last; } } if($found == 0) { print STDERR "c_rehash: rehashing skipped ('openssl' program not available)\n"; exit 0; } } if(@ARGV) { @dirlist = @ARGV; } elsif($ENV{SSL_CERT_DIR}) { @dirlist = split /:/, $ENV{SSL_CERT_DIR}; } else { $dirlist[0] = "$dir/certs"; } foreach (@dirlist) { if(-d $_ and -w $_) { hash_dir($_); } } sub hash_dir { my %hashlist; print "Doing $_[0]\n"; chdir $_[0]; opendir(DIR, "."); my @flist = readdir(DIR); # Delete any existing symbolic links foreach (grep {/^[\da-f]+\.r{0,1}\d+$/} @flist) { if(-l $_) { unlink $_; } } closedir DIR; FILE: foreach $fname (grep {/\.pem$/} @flist) { # Check to see if certificates and/or CRLs present. my ($cert, $crl) = check_file($fname); if(!$cert && !$crl) { print STDERR "WARNING: $fname does not contain a certificate or CRL: skipping\n"; next; } link_hash_cert($fname) if($cert); link_hash_crl($fname) if($crl); } } sub check_file { my ($is_cert, $is_crl) = (0,0); my $fname = $_[0]; open IN, $fname; while() { if(/^-----BEGIN (.*)-----/) { my $hdr = $1; if($hdr =~ /^(X509 |TRUSTED |)CERTIFICATE$/) { $is_cert = 1; last if($is_crl); } elsif($hdr eq "X509 CRL") { $is_crl = 1; last if($is_cert); } } } close IN; return ($is_cert, $is_crl); } # Link a certificate to its subject name hash value, each hash is of # the form . where n is an integer. If the hash value already exists # then we need to up the value of n, unless its a duplicate in which # case we skip the link. We check for duplicates by comparing the # certificate fingerprints sub link_hash_cert { my $fname = $_[0]; $fname =~ s/'/'\\''/g; my ($hash, $fprint) = `"$openssl" x509 -hash -fingerprint -noout -in '$fname'`; chomp $hash; chomp $fprint; $fprint =~ s/^.*=//; $fprint =~ tr/://d; my $suffix = 0; # Search for an unused hash filename while(exists $hashlist{"$hash.$suffix"}) { # Hash matches: if fingerprint matches its a duplicate cert if($hashlist{"$hash.$suffix"} eq $fprint) { print STDERR "WARNING: Skipping duplicate certificate $fname\n"; return; } $suffix++; } $hash .= ".$suffix"; print "$fname => $hash\n"; $symlink_exists=eval {symlink("",""); 1}; if ($symlink_exists) { symlink $fname, $hash; } else { system ("cp", $fname, $hash); } $hashlist{$hash} = $fprint; } # Same as above except for a CRL. CRL links are of the form .r sub link_hash_crl { my $fname = $_[0]; $fname =~ s/'/'\\''/g; my ($hash, $fprint) = `"$openssl" crl -hash -fingerprint -noout -in '$fname'`; chomp $hash; chomp $fprint; $fprint =~ s/^.*=//; $fprint =~ tr/://d; my $suffix = 0; # Search for an unused hash filename while(exists $hashlist{"$hash.r$suffix"}) { # Hash matches: if fingerprint matches its a duplicate cert if($hashlist{"$hash.r$suffix"} eq $fprint) { print STDERR "WARNING: Skipping duplicate CRL $fname\n"; return; } $suffix++; } $hash .= ".r$suffix"; print "$fname => $hash\n"; $symlink_exists=eval {symlink("",""); 1}; if ($symlink_exists) { symlink $fname, $hash; } else { system ("cp", $fname, $hash); } $hashlist{$hash} = $fprint; }