[Git][debian-edu/debian-edu-config][mr/followup-40_change-default-cert-algo] 14 commits: debian/control: Add to D: (debian-edu-config): procps. (Closes: #1136493).

Daniel Teichmann pushed to branch mr/followup-40_change-default-cert-algo at Debian Edu / debian-edu-config


Commits:
9710a70a by Mike Gabriel at 2026-08-19T23:25:59+02:00
debian/control: Add to D: (debian-edu-config): procps. (Closes: #1136493).

- - - - -
760801e3 by Wolfgang Schweer at 2026-08-19T23:42:53+02:00
share/debian-edu-config/d-i/pre-pkgsel: Cleanup pre-pkgsel from cruft. (Closes: #1055648).

- - - - -
63575146 by Mike Gabriel at 2026-08-20T18:10:19+02:00
ldap-tools/ldap-debian-edu-install: Make sure interactions with debconf are UTF-8 based.

This resolves GECOS field transliteration after having retrieved
debian-edu-config/first-user-fullname from the debconf db.

(Closes: #939717).

- - - - -
6e60cafb by Daniel Teichmann at 2026-08-21T11:22:45+02:00
debian/debian-edu-config.lintian-overrides: Fix stale reference. (Fixes commit: 63575146)

https://jenkins.debian.net/job/edu-packages_sid_debian-edu-config/1078/console

- - - - -
0033de22 by Daniel Teichmann at 2026-08-21T14:49:39+00:00
Drop unused wicd preconnect hook

wicd is no longer in Debian. The hook was the only remaining wicd
integration and is not referenced anywhere else in the package.

- - - - -
63442a25 by Mike Gabriel at 2026-08-21T20:09:31+02:00
share/debian-edu-config/d-i/pre-pkgsel: white-space cleanup

- - - - -
62717ef0 by Mike Gabriel at 2026-08-21T20:09:31+02:00
share/debian-edu-config/d-i/pre-pkgsel: Use 'tjener' in /etc/hostname and derive FQDN from /etc/hosts. (Closes: #893394).

- - - - -
c618de32 by Mike Gabriel at 2026-08-21T20:09:31+02:00
testsuite/hostname: Test that /etc/hostname on installation profile Main-Server is set correctly

- - - - -
88aae95c by Daniel Teichmann at 2026-08-21T20:22:00+02:00
testsuite/hostname: escape regex dot and exit non-zero on failure

The unescaped dot in the 'tjener.intern' grep matched any character.
Escape it so the FQDN check is exact. Both error paths now exit 1 so a
broken hostname fails the test instead of silently passing.

- - - - -
06e2bd3d by Daniel Teichmann at 2026-08-21T20:22:41+02:00
share/debian-edu-config/d-i/pre-pkgsel: resolve leftover merge conflict

Commit 63442a25 committed a merge-conflict block around the
create_initial_localadmin_user() function. That function was removed
from master by 760801e3 (cruft cleanup, #1055648). Drop the conflict
markers and the cruft to match master.

- - - - -
d319a79f by Mike Gabriel at 2026-08-21T20:48:57+02:00
cf3/cf.cfengine3: Stop cfengine3 service on all Debian Edu machines

Esp. cf-execd (calling cf-agent command) clobbers the log on all Debian
Edu clients (Debian Edu 12 and onwards) and thus on syslog.intern (aka
tjener).

In Debian Edu, we use cfengine3 for managing configuration adjustments
via manual invocation of the cf-agent command, but we don't support
(yet?) to use cfengine3 for constant system management.

Partially addresses #1051834.

- - - - -
05f45aa1 by Daniel Teichmann at 2026-08-21T21:12:15+02:00
tools/create-debian-edu-certs: Switch root CA and server key generation to ECDSA prime256v1

RSA with 2048 bits is the bare minimum with OpenSSL 3. Replace
'openssl genrsa' with 'openssl genpkey -algorithm EC' using the
prime256v1 (secp256r1 / NIST P-256) curve.

- - - - -
e2183282 by Daniel Teichmann at 2026-08-21T21:12:15+02:00
tools/create-server-cert: Switch key generation to ECDSA prime256v1 and drop keyEncipherment key usage

keyEncipherment is only meaningful for RSA keys. For ECDSA server
certificates only the digitalSignature key usage is applicable
(RFC 5480).

- - - - -
b3d1e221 by Daniel Teichmann at 2026-08-21T21:12:15+02:00
v3.cnf: Drop keyEncipherment from server cert key usage

keyEncipherment is not applicable to ECDSA keys (RFC 5480), only
digitalSignature is required for TLS server certificates.

- - - - -


12 changed files:

- Makefile
- cf3/cf.cfengine3
- debian/control
- debian/debian-edu-config.lintian-overrides
- debian/debian-edu-config.maintscript
- − etc/wicd/scripts/preconnect/set_wireless_mac_from_eth0
- ldap-tools/ldap-debian-edu-install
- share/debian-edu-config/d-i/pre-pkgsel
- share/debian-edu-config/tools/create-debian-edu-certs
- share/debian-edu-config/tools/create-server-cert
- share/debian-edu-config/v3.cnf
- + testsuite/hostname


Changes:

=====================================
Makefile
=====================================
@@ -158,7 +158,6 @@ SYSCONFSCRIPTS = \
 	mklocaluser.d/20-debian-edu-config \
 	shutdown-at-night/clients-generator \
 	resolvconf/update.d/bind-debian-edu \
-	wicd/scripts/preconnect/set_wireless_mac_from_eth0 \
 	X11/Xsession-debian-edu \
 	$(NULL)
 


=====================================
cf3/cf.cfengine3
=====================================
@@ -4,7 +4,7 @@ bundle agent cfengine3
 
 services:
 
-  debian.systemd.(server|ltspserver).installation::
+  debian.systemd.installation::
 
     "cfengine3.service"
       service_policy => "stop";


=====================================
debian/control
=====================================
@@ -54,6 +54,7 @@ Depends: ${misc:Depends},
          ng-utils,
          openssl,
          patch,
+         procps,
          python3,
          python3-notify2,
          ssl-cert,


=====================================
debian/debian-edu-config.lintian-overrides
=====================================
@@ -1,5 +1,5 @@
 debian-edu-config: non-standard-apache2-configuration-name debian-edu-config-doc.conf != debian-edu-config.conf [etc/apache2/conf-available/debian-edu-config-doc.conf]
-debian-edu-config: debconf-is-not-a-registry [usr/bin/ldap-debian-edu-install:12]
+debian-edu-config: debconf-is-not-a-registry [usr/bin/ldap-debian-edu-install:15]
 debian-edu-config: debconf-is-not-a-registry [usr/share/debian-edu-config/d-i/finish-install:10]
 debian-edu-config: debconf-is-not-a-registry [usr/share/debian-edu-config/d-i/pre-pkgsel:9]
 debian-edu-config: debconf-is-not-a-registry [usr/share/debian-edu-config/tools/edu-icinga-setup:24]


=====================================
debian/debian-edu-config.maintscript
=====================================
@@ -4,3 +4,4 @@ rm_conffile /etc/cfengine3/debian-edu/cf.ldapscripts 2.12.6~
 dir_to_symlink /etc/debian-edu/host-keytabs /var/lib/debian-edu/host-keytabs 2.12.18~
 rm_conffile /etc/init.d/fetch-ldap-cert 2.12.34~
 rm_conffile /etc/dhcp/dhclient-exit-hooks.d/fetch-ldap-cert 2.12.44~
+rm_conffile /etc/wicd/scripts/preconnect/set_wireless_mac_from_eth0 2.13.1~


=====================================
etc/wicd/scripts/preconnect/set_wireless_mac_from_eth0 deleted
=====================================
@@ -1,24 +0,0 @@
-#!/bin/sh
-#
-# Make sure wifi MAC is the same as wired MAC, to get DHCP to work with
-# static assignment.
-
-set -e
-
-PATH=/sbin:$PATH
-export PATH
-
-iface_mac() {
-    IF="$1"
-    LC_ALL=C ifconfig $IF | grep HWa | cut -c39-55
-}
-
-MAC1=$(iface_mac eth0)
-MACW0=$(iface_mac wlan0)
-if [ "$MACW0" ] ; then
-    logger -t wicd/set_wireless_mac_from_eth0 \
-	"changing MAC address of wlan0 from $MACW0 to $MAC1"
-    ifconfig wlan0 down
-    ifconfig wlan0 hw ether $MAC1
-    ifconfig wlan0 up
-fi


=====================================
ldap-tools/ldap-debian-edu-install
=====================================
@@ -1,6 +1,9 @@
 #!/bin/bash
 set -e
 
+# Assure that interactions with debconf database are UTF-8 interactions.
+export LANG=C.UTF-8
+
 # This script is run during installation of the main server inside Debian Installer.
 # Don't ever use it manually! You will definitely ruin your main server!
 
@@ -111,7 +114,7 @@ fi
 ################# password available now ##################
 
 lookup_mac_addrs() {
-    PATH=/sbin:$PATH LANG=C ifconfig 2>/dev/null | grep -i hwaddr | awk '{print $5}' | sort -u
+    PATH=/sbin:$PATH ifconfig 2>/dev/null | grep -i hwaddr | awk '{print $5}' | sort -u
 }
 
 slapd_stop() {


=====================================
share/debian-edu-config/d-i/pre-pkgsel
=====================================
@@ -21,7 +21,7 @@ error() {
 configure_network() {
 # Write a functional /target/etc/network/interfaces
     if [ -z "$PROFILE" ]; then
-	PROFILE=Workstation
+        PROFILE=Workstation
     fi
 
     # Default hostname is 'localhost'
@@ -44,21 +44,21 @@ configure_network() {
     # Hm, what if both server and workstation is choosen?  Choose the
     # server config for eth0.
     for value in `echo $PROFILE |sed 's/ /-/g' | sed 's/,-/ /g'`; do
-	case $value in
-	    Roaming-Workstation)
-		# Configure network-manager to connect to eth0 by
-		# default, to be able to look up user information in
-		# LDAP.
-		eth0=none
-		autoeth0=""
-		eth1=none
-		autoeth1=""
-		DNSDOMAIN=
-		MAILNAME=
-		MY_HOSTNAME=
-		eth0uuid=$(chroot /target uuid)
-		mkdir -p /target/etc/NetworkManager/system-connections
-		cat > /target/etc/NetworkManager/system-connections/eth0 <<EOF
+        case $value in
+           Roaming-Workstation)
+                # Configure network-manager to connect to eth0 by
+                # default, to be able to look up user information in
+                # LDAP.
+                eth0=none
+                autoeth0=""
+                eth1=none
+                autoeth1=""
+                DNSDOMAIN=
+                MAILNAME=
+                MY_HOSTNAME=
+                eth0uuid=$(chroot /target uuid)
+                mkdir -p /target/etc/NetworkManager/system-connections
+                cat > /target/etc/NetworkManager/system-connections/eth0 <<EOF
 [connection]
 id=eth0
 uuid=$eth0uuid
@@ -70,46 +70,46 @@ method=auto
 [ipv4]
 method=auto
 EOF
-		;;
-	    Standalone)
- 	        # Leave network configuration to network-manager on
- 	        # Standalone
-		eth0=none
-		autoeth0=""
-		eth1=none
-		autoeth1=""
-		DNSDOMAIN=
-		MAILNAME=
-		MY_HOSTNAME=
-		;;
-	    Workstation)
-   	        # Use this unless Server also was choosen.
-		if [ -z "$eth0" ] ; then
-		    eth0=none
-		    autoeth0=""
-		    eth1=none
-		    autoeth1=""
-		fi
-		;;
-	    Main-Server)
- 	        # Override for workstations combining as servers
-		eth0=10.0.2.2:255.0.0.0:10.255.255.255:10.0.0.1
-		MY_HOSTNAME=tjener.intern
-		NAMESERVER=127.0.0.1
-		autoeth0="auto eth0"
-		;;
-	    LTSP-Server)
- 	        # Use this unless Server also was choosen.
-		if [ -z "$eth0" ] ; then
-		    eth0=none
-		    autoeth0=""
-		fi
-		eth1=192.168.0.254:255.255.255.0:192.168.0.255:none
-		autoeth1="auto eth1"
-		;;
-	esac
+                ;;
+            Standalone)
+                # Leave network configuration to network-manager on
+                # Standalone
+                eth0=none
+                autoeth0=""
+                eth1=none
+                autoeth1=""
+                DNSDOMAIN=
+                MAILNAME=
+                MY_HOSTNAME=
+                ;;
+            Workstation)
+                # Use this unless Server also was choosen.
+                if [ -z "$eth0" ] ; then
+                    eth0=none
+                    autoeth0=""
+                    eth1=none
+                    autoeth1=""
+                fi
+                ;;
+            Main-Server)
+                # Override for workstations combining as servers
+                eth0=10.0.2.2:255.0.0.0:10.255.255.255:10.0.0.1
+                MY_HOSTNAME=tjener
+                NAMESERVER=127.0.0.1
+                autoeth0="auto eth0"
+                ;;
+            LTSP-Server)
+                # Use this unless Server also was choosen.
+                if [ -z "$eth0" ] ; then
+                    eth0=none
+                    autoeth0=""
+                fi
+                eth1=192.168.0.254:255.255.255.0:192.168.0.255:none
+                autoeth1="auto eth1"
+                ;;
+        esac
     done
-  
+
     # Every host need the loopback interface
     cat > $interfaces <<EOF
 # Created by debian-edu-profile during the Debian installation.
@@ -123,24 +123,24 @@ iface lo inet loopback
 EOF
 
     for interface in eth0 eth1 ; do
-	eval "ifinfo=\$$interface"
-	eval "ifauto=\$auto$interface"
-	log "setting up network interface $interface using $ifinfo"
-	case $ifinfo in
-	    dhcp)
-		cat >> $interfaces <<EOF
+        eval "ifinfo=\$$interface"
+        eval "ifauto=\$auto$interface"
+        log "setting up network interface $interface using $ifinfo"
+        case $ifinfo in
+            dhcp)
+                cat >> $interfaces <<EOF
 
 $ifauto
 iface $interface inet dhcp
 EOF
 
-		;;
-	    [0-9]*)
-	        address=`echo $ifinfo | cut -d: -f1`
-		netmask=`echo $ifinfo | cut -d: -f2`
-		broadcast=`echo $ifinfo | cut -d: -f3`
-		gateway=`echo $ifinfo | cut -d: -f4`
-		cat >> $interfaces <<EOF
+                ;;
+            [0-9]*)
+                address=`echo $ifinfo | cut -d: -f1`
+                netmask=`echo $ifinfo | cut -d: -f2`
+                broadcast=`echo $ifinfo | cut -d: -f3`
+                gateway=`echo $ifinfo | cut -d: -f4`
+                cat >> $interfaces <<EOF
 
 auto $interface
 iface $interface inet static
@@ -148,35 +148,35 @@ iface $interface inet static
     netmask $netmask
     broadcast $broadcast
 EOF
-		if [ none != "$gateway" ] ; then
-		    cat >> $interfaces <<EOF
+                if [ none != "$gateway" ] ; then
+                    cat >> $interfaces <<EOF
     gateway $gateway
 EOF
-		fi
-	    if [ "$DNSDOMAIN" ] && [ "$NAMESERVER" = "127.0.0.1" ] ; then
-			cat >> $interfaces <<EOF
+                fi
+                if [ "$DNSDOMAIN" ] && [ "$NAMESERVER" = "127.0.0.1" ] ; then
+                    cat >> $interfaces <<EOF
     dns-search $DNSDOMAIN
     dns-nameservers $NAMESERVER
 EOF
-	    fi
-		cat >> $interfaces <<EOF
+                fi
+                cat >> $interfaces <<EOF
 # The commented lines below is to be used if a DHCP server is in use
 #iface $interface inet dhcp
 EOF
-		;;
-	    *)
-	        # Nothing to do?
-	        ;;
-	esac
+                ;;
+            *)
+                # Nothing to do?
+                ;;
+        esac
     done
     (
-	echo "127.0.0.1       localhost.localdomain localhost" 
-	echo "::1             localhost       ip6-localhost ip6-loopback"
-	echo "fe00::0         ip6-localnet"
-	echo "ff00::0         ip6-mcastprefix"
-	echo "ff02::1         ip6-allnodes"
-	echo "ff02::2         ip6-allrouters"
-	echo "ff02::3         ip6-allhosts"
+        echo "127.0.0.1       localhost.localdomain localhost"
+        echo "::1             localhost       ip6-localhost ip6-loopback"
+        echo "fe00::0         ip6-localnet"
+        echo "ff00::0         ip6-mcastprefix"
+        echo "ff02::1         ip6-allnodes"
+        echo "ff02::2         ip6-allrouters"
+        echo "ff02::3         ip6-allhosts"
     ) > /target/etc/hosts
 
     if [ ! -z "$MY_HOSTNAME" ] ; then
@@ -187,37 +187,37 @@ EOF
     # Update hostname based on reverse DNS entry of current IP or
     # generate from MAC address, unless installing main-server.
     if echo $PROFILE | grep -q Main-Server ; then
-	:
+        :
     elif [ -x /target/usr/sbin/update-hostname-from-ip ] ; then
-	in-target /usr/sbin/update-hostname-from-ip -m || true
+        in-target /usr/sbin/update-hostname-from-ip -m || true
     fi
 
     # Avoid hardcoding entries on the clients, to make sure IP address
     # range can be changed on the clients by changing DHCP
     # configuration on the server.
-    if [ "tjener.intern" = "$MY_HOSTNAME" ] ; then
-	(
-	    echo
-	    echo "10.0.2.2        tjener.intern tjener" 
-	) >> /target/etc/hosts
+    if [ "tjener" = "$MY_HOSTNAME" ] ; then
+        (
+            echo
+            echo "10.0.2.2        ${MY_HOSTNAME}.${DNSDOMAIN} ${MY_HOSTNAME}"
+        ) >> /target/etc/hosts
     fi
 
     # Set /etc/mailname if it is missing
     if [ "$MAILNAME" ] && [ ! -f /target/etc/mailname ] ; then
-	echo "$MAILNAME" > /target/etc/mailname
+        echo "$MAILNAME" > /target/etc/mailname
     fi
 
     # Make sure that the interfaces are there for the cfengine run if
     # network isn't already configured
     if route | grep -q default ; then
-	log "Not restarting network, as it seem to be up already."
+        log "Not restarting network, as it seem to be up already."
     else
-	log "Restarting network to prepare for cfengine run."
-	# Redirecting fd 3 as a workaround for skolelinux bug #1229.
-	# make sure the redirecting happen inside the chroot, as
-	# in-target need to talk to debconf.
-	in-target /bin/sh -c "/etc/init.d/networking start 3> /dev/null" || true
-	touch /tmp/debian-edu-nonetwork
+        log "Restarting network to prepare for cfengine run."
+        # Redirecting fd 3 as a workaround for skolelinux bug #1229.
+        # make sure the redirecting happen inside the chroot, as
+        # in-target need to talk to debconf.
+        in-target /bin/sh -c "/etc/init.d/networking start 3> /dev/null" || true
+        touch /tmp/debian-edu-nonetwork
     fi
 }
 
@@ -225,32 +225,32 @@ EOF
 # finish-install hook.
 set_kerberos_ldap_passwords() {
     if db_get passwd/root-password-crypted && [ "$RET" ] ; then
-	log "No clear text root password, unable to pass it on to Kerberos/LDAP."
+        log "No clear text root password, unable to pass it on to Kerberos/LDAP."
     else
-	log "Fetching password for Kerberos KDC and LDAP." 1>&2
-	db_get passwd/root-password
-	ROOTPWD="$RET"
-
-	log "Fetching info for first user." 1>&2
-	
-	if db_get passwd/username && [ "$RET" ] ; then
-	    FIRSTUSERNAME="$RET"
-	else
-	    FIRSTUSERNAME="localadmin"
-	fi
-	if db_get passwd/user-fullname && [ "$RET" ] ; then
-	    FIRSTUSERGECOS="$RET"
-	else
-	    FIRSTUSERGECOS="LDAP initial admin user"
-	fi
-	if db_get passwd/user-password && [ "$RET" ] ; then
-	    FIRSTUSERPWD="$RET"
-	else
-	    FIRSTUSERPWD="$ROOTPWD"
-	fi
-
-	file=/tmp/passwords-preseed
-	cat > $file <<EOF
+        log "Fetching password for Kerberos KDC and LDAP." 1>&2
+        db_get passwd/root-password
+        ROOTPWD="$RET"
+
+        log "Fetching info for first user." 1>&2
+
+        if db_get passwd/username && [ "$RET" ] ; then
+            FIRSTUSERNAME="$RET"
+        else
+            FIRSTUSERNAME="localadmin"
+        fi
+        if db_get passwd/user-fullname && [ "$RET" ] ; then
+            FIRSTUSERGECOS="$RET"
+        else
+            FIRSTUSERGECOS="LDAP initial admin user"
+        fi
+        if db_get passwd/user-password && [ "$RET" ] ; then
+            FIRSTUSERPWD="$RET"
+        else
+            FIRSTUSERPWD="$ROOTPWD"
+        fi
+
+        file=/tmp/passwords-preseed
+        cat > $file <<EOF
 debian-edu-config debian-edu-config/kdc-password password $ROOTPWD
 debian-edu-config debian-edu-config/kdc-password-again password $ROOTPWD
 debian-edu-config debian-edu-config/ldap-password password $ROOTPWD
@@ -259,41 +259,10 @@ debian-edu-config debian-edu-config/first-user-name string $FIRSTUSERNAME
 debian-edu-config debian-edu-config/first-user-fullname string $FIRSTUSERGECOS
 debian-edu-config debian-edu-config/first-user-password password $FIRSTUSERPWD
 EOF
-	# Pass user and password information into the target
-	cat $file | LANG=C chroot /target debconf-set-selections || \
-	    error "Failed to load preseed values from $file."
-	rm $file
-    fi
-}
-
-create_initial_localadmin_user() {
-    LOCAL_USER_ID="localadmin"
-    LOCAL_USER_GECOS="Local Administrator"
-    LOCAL_USER_UIDNUMBER="1000"
-    LOCAL_USER_PRIMGIDNUMBER="1000"
-
-    LOCAL_USER_INGROUPS="$LOCAL_USER_INGROUPS adm sudo"
-
-    if db_get passwd/root-password-crypted && [ "$RET" ] ; then
-	log "No clear text root password, unable to use it for creating the initial local user"
-    else
-	# retrieve root password
-	db_get passwd/root-password
-	LOCAL_USER_PASSWD=$RET
-	# create initial local user
-	in-target /usr/sbin/addgroup --gid $LOCAL_USER_PRIMGIDNUMBER $LOCAL_USER_ID 1>&2 || true
-	in-target /usr/sbin/adduser --gid $LOCAL_USER_PRIMGIDNUMBER \
-		--firstuid $LOCAL_USER_UIDNUMBER \
-		--home /home/$LOCAL_USER_ID \
-		--shell /bin/bash \
-		--disabled-login \
-		--gecos "$LOCAL_USER_GECOS" $LOCAL_USER_ID 1>&2 || true
-	# add initial local user to some standard system groups
-	for group in ${LOCAL_USER_INGROUPS}; do
-		in-target /usr/sbin/adduser $LOCAL_USER_ID $group 1>&2 || true
-	done
-	# set password (batch mode)
-	in-target /bin/sh -c "echo ${LOCAL_USER_ID}:${LOCAL_USER_PASSWD} | /usr/sbin/chpasswd" 1>&2 || true
+        # Pass user and password information into the target
+        cat $file | LANG=C chroot /target debconf-set-selections || \
+            error "Failed to load preseed values from $file."
+        rm $file
     fi
 }
 
@@ -311,15 +280,15 @@ workaround_grub_issue() {
     # want.
     db_get grub-installer/choose_bootdev || true
     if [ "$RET" ] && [ "manual" != "$RET" ]; then
-	log "not overriding grub-installer/choose_bootdev to $grubdev, its value was '$RET'"
-	return
+        log "not overriding grub-installer/choose_bootdev to $grubdev, its value was '$RET'"
+        return
     fi
 
     case "$bootdev" in
-	/dev/sd*|/dev/vd*|/dev/hd*|/dev/xvd*)
-	    log "overriding grub-installer/choose_bootdev, setting it to $grubdev"
-	    db_set grub-installer/choose_bootdev "$grubdev" || true
-	    ;;
+        /dev/sd*|/dev/vd*|/dev/hd*|/dev/xvd*)
+            log "overriding grub-installer/choose_bootdev, setting it to $grubdev"
+            db_set grub-installer/choose_bootdev "$grubdev" || true
+            ;;
     esac
 }
 
@@ -341,20 +310,19 @@ configure_network
 edu-etcvcs commit
 
 if echo "$PROFILE" | grep -q Main-Server ; then
-	set_kerberos_ldap_passwords
+        set_kerberos_ldap_passwords
 fi
 
 for p in $(echo $PROFILE | tr , " ") ; do
     case $p in
-	# Only do this for the networked tasks, not for standalone
-	Main-Server|Workstation|Roaming-Workstation|LTSP-Server|Minimal)
-	    #create_initial_localadmin_user
-	    in-target /usr/share/debian-edu-config/tools/preseed-ldap-kerberos
-	    in-target /usr/share/debian-edu-config/tools/preseed-sitesummary
-
-	    # Tell user-setup to not create a user, needed on
-	    # Main-Server to be able to create the user in LDAP.
-	    db_set passwd/make-user boolean false
-	    ;;
+        # Only do this for the networked tasks, not for standalone
+        Main-Server|Workstation|Roaming-Workstation|LTSP-Server|Minimal)
+            in-target /usr/share/debian-edu-config/tools/preseed-ldap-kerberos
+            in-target /usr/share/debian-edu-config/tools/preseed-sitesummary
+
+            # Tell user-setup to not create a user, needed on
+            # Main-Server to be able to create the user in LDAP.
+            db_set passwd/make-user boolean false
+            ;;
     esac
 done


=====================================
share/debian-edu-config/tools/create-debian-edu-certs
=====================================
@@ -32,12 +32,12 @@ SERVER_KEY="$KEY_DIR/debian-edu-server.key"
 
 generate() {
     # Generate Debian Edu root CA private key.
-    openssl genrsa -out $CA_KEY 2048
+    openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:prime256v1 -out $CA_KEY
     # Request rootCA CSR and self-sign it to apply v3 extensions.
     openssl req -new -nodes -key $CA_KEY -out $TMP/ca.csr -config $SSL_CA_CONF
     openssl x509 -req -in $TMP/ca.csr -signkey $CA_KEY -days 3650 -out $CA_CERT -extfile $V3_CA_CONF
     # Request web server key.
-    openssl req -new -nodes -out $TMP/server.csr -newkey rsa:2048 -keyout $SERVER_KEY -config $SSL_CONF
+    openssl req -new -nodes -out $TMP/server.csr -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -keyout $SERVER_KEY -config $SSL_CONF
     # Request web server certificate.
     openssl x509 -req -in $TMP/server.csr -CA $CA_CERT -CAkey $CA_KEY -CAcreateserial -out $SERVER_CERT -days 3650 -extfile $V3_CONF
     # Adjust owner and rights.


=====================================
share/debian-edu-config/tools/create-server-cert
=====================================
@@ -139,7 +139,7 @@ tempdir=$(mktemp -d)
 cat > "${tempdir}/v3.conf"  <<EOF
 # v3.ext
 authorityKeyIdentifier=keyid,issuer
-keyUsage = digitalSignature, keyEncipherment
+keyUsage = digitalSignature
 extendedKeyUsage = serverAuth
 subjectAltName = @alt_names
 
@@ -165,7 +165,7 @@ else
 	echo "Creating new key file: ${keydir}/${keyfile}"
 	echo
 	openssl  req  -config "${tempdir}/ssl.cnf" \
-	              -nodes  -new -newkey rsa:2048 \
+	              -nodes  -new -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \
 	              -keyout "${keydir}/${keyfile}" \
 	              -out "${tempdir}/${csrfile}"
 fi


=====================================
share/debian-edu-config/v3.cnf
=====================================
@@ -1,6 +1,6 @@
 # v3.ext
 authorityKeyIdentifier=keyid,issuer
-keyUsage = digitalSignature, keyEncipherment
+keyUsage = digitalSignature
 extendedKeyUsage = serverAuth
 subjectAltName = @alt_names
 


=====================================
testsuite/hostname
=====================================
@@ -0,0 +1,27 @@
+#!/bin/sh
+#
+# Check that Main-Server's hostname is set to short hostname 'tjener', not FQDN 'tjener.intern'.
+
+if test -r /etc/debian-edu/config ; then
+    . /etc/debian-edu/config
+fi
+
+LC_ALL=C
+export LC_ALL
+
+scriptname="$0"
+
+case $PROFILE in
+*Main-Server*)
+    # Check that the hostname of the Main-Server is set to its short hostname (not FQDN)
+    if [ -e /etc/hostname ] && grep -q -E "^tjener\$" /etc/hostname; then
+        printf "success: %s: Main-Server's hostname is set to 'tjener'\n" "${scriptname}"
+    elif [ -e /etc/hostname ] && grep -q -E "^tjener\.intern\$" /etc/hostname; then
+        printf "error: %s: Main-Server's hostname is (still) set to 'tjener.intern', please drop the DNS domain part from it\n" "${scriptname}"
+        exit 1
+    else
+        printf "error: %s: Main-Server's hostname is not 'tjener'\n" "${scriptname}"
+        exit 1
+    fi
+    ;;
+esac



View it on GitLab: https://salsa.debian.org/debian-edu/debian-edu-config/-/compare/947e39c48f308291b2bdc383492de8980846192d...b3d1e22193bcf1396be39aad702f226295404c0f

-- 
View it on GitLab: https://salsa.debian.org/debian-edu/debian-edu-config/-/compare/947e39c48f308291b2bdc383492de8980846192d...b3d1e22193bcf1396be39aad702f226295404c0f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help

_______________________________________________
debian-edu-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-edu-commits