summaryrefslogtreecommitdiff
path: root/docs
Commit message (Collapse)AuthorAge
* New upstream version 3.16Russ Allbery2019-10-26
|\
| * Release 3.16Russ Allbery2019-10-24
| |
| * Add support for Python 3Russ Allbery2019-09-02
| | | | | | | | | | | | | | | | | | The Python bindings now support Python 3. They have been tested only with Python 2.7 and Python 3.7, but should work with any version of Python 3 later than Python 3.1. Test both versions in Travis-CI and fix some problems with the Python coding style checks.
| * Add mypy typing to the Python bindingsRuss Allbery2019-09-02
| | | | | | | | | | | | | | | | | | This adds a dependency on the typing module, which won't matter in the long run since it's part of core in Python 3. Remove some useless checks that were just checking the behavior of Python. Replace a few comparisions with None with "is" or a truth check.
| * Switch to setuptools and pytest for PythonRuss Allbery2019-09-02
| | | | | | | | | | | | | | Switch from distutils to setuptools so that proper dependencies can be specified in setup.py. Require pytest and pytest-runner and set up an alias so that test runs pytest. Move the test script into the tests subdirectory so that it will be found by pytest.
| * Modernize and reformat Python bindingsRuss Allbery2019-09-02
| | | | | | | | | | | | | | | | The Python bindings have been modernized to remove obsolete syntax, which may mean that versions of Python back to Python 2.3 are no longer supported. The bindings are only tested with Python 2.7. Reformat all of the Python code with black.
| * Coding style, NEWS, and docs for -t flagRuss Allbery2018-08-24
| |
| * Re-order user documentation for web pageRuss Allbery2018-05-05
| | | | | | | | | | Put the manual pages for the main client and server programs before the language binding README files.
| * Add additional metadata for web pageRuss Allbery2018-05-05
| | | | | | | | | | Add summary information about the Debian packages, and extra packaging information about the Puppet module.
* | New upstream version 3.15Russ Allbery2018-05-05
|\|
| * Release 3.15Russ Allbery2018-05-05
| |
| * Update eyrie.org URLs to httpsRuss Allbery2018-04-29
| | | | | | | | | | Also removes my old affiliation and address from the protocol documentation.
| * Add SPDX-License-IdentifierRuss Allbery2018-04-29
| | | | | | | | | | | | Add SPDX-License-Identifier headers to all substantial source files. Also canonicalize copyright date formats and fix a few copyright notices that weren't in my standard layout.
| * Remove extraneous language tag in READMERuss Allbery2018-04-29
| |
| * Use a real link in Building with Windows sectionRuss Allbery2018-04-29
| | | | | | | | | | Rather than inlining the URL for the MIT Kerberos for Windows download, make it a real link in the Markdown documentation.
| * Convert documentation to DocKnotRuss Allbery2018-04-29
| | | | | | | | | | | | | | | | Move the THANKS section to a separate file to try to reduce the length of the top-level README a bit. Start providing a Markdown README.md as well for GitHub. Tweak a lot of documentation wording and move things around to bring the package documentation in line with my standard templates.
* | New upstream version 3.14Russ Allbery2018-04-01
|\|
| * Fix typos in remctl-shell's man pageLuke Faraone2017-04-29
| |
| * Fix typos in remctl-shell's man pageLuke Faraone2017-04-29
| |
* | New upstream version 3.13Russ Allbery2016-10-10
|\|
| * Add remctl-shell support for running as a forced commandRuss Allbery2016-10-03
| | | | | | | | | | | | | | remctl-shell now also supports being run as a forced command from authorized_keys (or other methods). This may be preferrable to using it as a shell since it doesn't require setting non-standard sshd options.
| * Coding style fixes for summary fixRuss Allbery2016-09-05
| | | | | | | | | | Clean up some long lines, trailing whitespace, and added blank lines, and clean up some comments.
| * Merge branch 'feature/summary_with_a_subcommand' of ↵Russ Allbery2016-09-05
| |\ | | | | | | | | | https://github.com/ccin2p3/remctl into ccin2p3-feature/summary_with_a_subcommand
| | * [github#3] Support summary with subcommand.Remi Ferrand2014-12-25
| | | | | | | | | | | | | | | | | | | | | * If a summary option is specified with a subcommand other than `ALL`, create a subcommand specific summary. * Adapt existing test suite. * Adapt existing summary option documentation.
* | | Imported Upstream version 3.12Russ Allbery2016-07-29
|\| |
| * | Document PermitUserEnvironment requirementRuss Allbery2016-07-29
| | |
* | | Imported Upstream version 3.12Russ Allbery2016-07-29
|\| |
| * | Add new sudo configuration optionRuss Allbery2016-07-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new configuration option, sudo, which tells remctld and remctl-shell to run the command as a different user using sudo. The path to the sudo binary is determined when remctld is compiled. Normally, it's more convenient to use the existing user option, but it relies on remctld running as root. If running the daemon as a non-root user, or when running remctl-shell as a non-root user, this option may work better.
| * | Add REMCTL_HOST support to remctl-shellRuss Allbery2016-07-28
| | | | | | | | | | | | | | | | | | Also add a warning to the documentation for both remctld and remctl-shell that this is based on a reverse DNS lookup and isn't reliable.
| * | Add documentation for remctl-shellRuss Allbery2016-07-27
| | |
* | | Imported Upstream version 3.11Russ Allbery2016-05-07
|\| |
* | | Imported Upstream version 3.10Russ Allbery2015-11-27
|\| |
| * | Add additional stopwords for spelling checkRuss Allbery2015-11-27
| | |
| * | Add anyuser:auth and anyuser:anonymous ACLsRuss Allbery2015-11-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Two new remctld ACLs are supported: anyuser:auth and anyuser:anonymous. The first is equivalent to ANYUSER, and indeed ANYUSER is now treated as a backwards-compatibility alias for anyuser:auth. This permits any authenticated user in either the local realm or any realm with which there is cross-realm trust. The new anyuser:anonymous ACL permits absolutely any user, even unauthenticated users, allowing anyone with network access to the server to run the command. (Note, however, that actually running commands anonymously requires anonymous PKINIT and anonymous service tickets be enabled for the local Kerberos realm. These are not common configurations, particularly the second.)
| * | Set REMCTL_EXPIRES when running commandsRuss Allbery2015-09-04
| |/ | | | | | | | | | | | | | | The remctld server now sets the REMOTE_EXPIRES environment variable to the time (in seconds since UNIX epoch) when the authenticated session used to run a command will expire. This will generally be the expiration time of the Kerberos ticket used to authenticate to the server.
* | Imported Upstream version 3.9Russ Allbery2014-07-02
|\|
| * Rename the unxgrp ACL type to localgroupRuss Allbery2014-06-16
| | | | | | | | | | | | | | | | | | | | | | No particularly strong reason other than I like it better aesthetically, although it does include the "local" part as a reference to krb5_aname_to_localname. Change-Id: I3b0bbb056271222e79b21cf2d96d04e9ef0bf1fe Reviewed-on: https://gerrit.stanford.edu/1502 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
| * Add stopwords and markup for spelling test of remctld.podRuss Allbery2014-06-16
| | | | | | | | | | | | | | Change-Id: I0849685dff2f5bc97a5315f770a83b2fd3c94f48 Reviewed-on: https://gerrit.stanford.edu/1498 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
| * New implementation of `unxgrp` ACL scheme.Remi Ferrand2014-06-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * As suggested by @rra, the principal is now converted to local user name with `krb5_aname_to_localname`. * Fix LICENSE issue by removing CeCILL headers and falling back to global remctl license. * Improve test suite to check for proper error handling. Implementation remarks: * As `krb5_aname_to_localname` requires principal to be from a known realm to work, test suite now had to be run with a kerberos configuration file that defines at least the realm `EXAMPLE.ORG`. I'd liked to use function `kerberos_generate_conf()` defined in `tests/tap/kerberos.c` but I wasn't able to find the script `tests/data/generate-krb5-conf`. My solution was to use the sample configuration file provided with the java bindings `java/k5.conf`. If no realm `EXAMPLE.ORG` could be found in kerberos configuration file, tests will fail like this: ```bash $ ./tests/runtests -o ./tests/server/acl-unxgrp 1..14 ok 1 - ... with empty group not ok 2 - ... with user within group ok 3 - ... with user not in group ok 4 - ... with principal with instances but main user in group ok 5 - ... with long_principal very very long ok 6 - ... match error message with principal too long ok 7 - ... with user from not supported REALM ok 8 - ... with getgrnam_r failing ok 9 - ... with getgrnam_r error handling ok 10 - ... with denied user in group ok 11 - ... with user not in denied group but not allowed not ok 12 - ... with user within group plus a deny pragma ok 13 - ... with user in denied group plus a allow group pragma ok 14 - ... with user neither in allowed or denied group ``` but with the sample configuration file shipped with the java bindings: ```bash $ KRB5_CONFIG=../java/k5.conf ./tests/runtests -o ./tests/server/acl-unxgrp 1..14 ok 1 - ... with empty group ok 2 - ... with user within group ok 3 - ... with user not in group ok 4 - ... with principal with instances but main user in group ok 5 - ... with long_principal very very long ok 6 - ... match error message with principal too long ok 7 - ... with user from not supported REALM ok 8 - ... with getgrnam_r failing ok 9 - ... with getgrnam_r error handling ok 10 - ... with denied user in group ok 11 - ... with user not in denied group but not allowed ok 12 - ... with user within group plus a deny pragma ok 13 - ... with user in denied group plus a allow group pragma ok 14 - ... with user neither in allowed or denied group ``` Change-Id: Iadb1b5f9f4e18297f08ac25cdc6c3a5510ecc584 Reviewed-on: https://gerrit.stanford.edu/1495 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
| * Add ACL scheme for checking that user belongs to nss groupRemi Ferrand2014-06-16
| | | | | | | | | | | | | | | | | | | | | | * Add documentation for *unxgrp* ACL scheme * Add *unxgrp* in supported ACL scheme in usage message * Add test suite for acl-unxgrp Change-Id: I7ed3008953e7751c02d81323e3c08cc9dddb9e49 Reviewed-on: https://gerrit.stanford.edu/1492 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
| * Add more stopwords in the POD documentationRuss Allbery2014-04-08
| | | | | | | | | | | | | | Change-Id: I7b6ea2acfb3e3e6e9cd463cfe2c81208205c52bf Reviewed-on: https://gerrit.stanford.edu/1480 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
| * Clean up various bugs and wording issues in protocol specsRuss Allbery2014-02-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Make sure that the protocol documents are consistent in how they refer to various protocol versions. Warn that the permitted behavior of splitting argument size across MESSAGE_COMMAND continuations is not guaranteed to continue to be supported. Fix documentation that said MESSAGE_NOOP couldn't be sent by the client. Fix various other minor issues and wording problems. Change-Id: I0f77f5adb780632aa990b376593fad9472662731 Reviewed-on: https://gerrit.stanford.edu/1431 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
| * Document versions for interfaces and featuresRuss Allbery2014-02-02
| | | | | | | | | | | | | | | | | | | | | | | | Add version and compatibility information to all manual pages. Command-line and configuration options, ACL methods, environment variables, client library APIs, and other major features are now annotated with the version of remctl in which they were added. Change-Id: I739e0d1fbb60f4c02cf309bb5d81561fa494bdad Reviewed-on: https://gerrit.stanford.edu/1429 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
* | Imported Upstream version 3.8Russ Allbery2014-01-28
|\|
* | Imported Upstream version 3.7Russ Allbery2014-01-06
|\|
| * Add support for systemd socket activation and notificationRuss Allbery2014-01-05
| | | | | | | | | | | | | | | | | | | | | | | | | | Add support for systemd. If built on a system with systemd installed, remctl will install (but not enable) systemd units to start remctld via socket activation. remctld will also notify systemd when its initialization is complete if started by systemd with service notification enabled. Change-Id: I91caa7a3a909c7e85454e43b4cf3b6d7bd4a6067 Reviewed-on: https://gerrit.stanford.edu/1356 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
| * Add support for upstart's expect stop protocolRuss Allbery2014-01-05
| | | | | | | | | | | | | | | | | | | | | | | | Add support for upstart's expect stop daemon synchronization method. When starting remctld in stand-alone mode with upstart, pass the new -Z option to remctld, and it will raise SIGSTOP when ready to accept connections, signaling to upstart that the daemon has fully started. Change-Id: Ief816224a80b0d7ff68033b454cf05bfa319cdeb Reviewed-on: https://gerrit.stanford.edu/1355 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
| * Change my email address to eagle@eyrie.orgRuss Allbery2014-01-05
| | | | | | | | | | | | | | Change-Id: Iba0376ea03a749d81abc2eeb49b0b5cf7d3e8847 Reviewed-on: https://gerrit.stanford.edu/1353 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
| * Update protocol specification for xml2rfc 2.xRuss Allbery2013-12-26
| | | | | | | | | | | | | | | | | | | | | | | | | | Add the additional required metadata to suppress warnings, which means this claims to be an Internet-Draft that's not been submitted. At some point, it should actually be submitted. Be clearer in the additional license section about the intended license grant. Adjust the xml2rfc calling convention for 2.x. Change-Id: I4f8b01ae180821be8adb964f0e45b27d3cddd634 Reviewed-on: https://gerrit.stanford.edu/1343 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
* | Imported Upstream version 3.6Russ Allbery2013-08-14
|\|
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-29 09:11:47 +0000