Bug#1057125: bookworm-pu: package debian-edu-config/2.12.40~deb12u1

Package: release.debian.org
Severity: normal
Tags: bookworm
User: [email protected]
Usertags: pu
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:debian-edu-config

This uploads provides debian-edu-config for Debian bookworm.
Unfortunately, our development is quite delayed, getting Debian Edu 12
released requires this package to be accepted into Debian bookworm.

[ Reason ]

Over the past months Guido Berhörster at Fre(i)e Software GmbH has
dedicated many hours to getting Debian Edu fixed / ready for the Debian
Edu 12 release.

The adaptations / changes in this upload compared to debian-edu-config
2.12.32 are massive but most of them are required. (Only a few are
nice-to-have). The d/changelog file documents all changes in depth (see
below).

[ Impact ]
No Debian Edu 12, if this upload gets rejected.

[ Tests ]
Manually. Also via post-installation test-suite (which also got fixed
where needed).

[ Risks ]
Only for Debian Edu users.


[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]

+debian-edu-config (2.12.40~deb12u1) bookworm; urgency=medium
+
+  * Upload to bookworm.
+
+ -- Mike Gabriel <[email protected]>  Thu, 30 Nov 2023 08:36:15 +0100
+
+debian-edu-config (2.12.40) unstable; urgency=medium
+
+  * share/debian-edu-config/gosa.conf.template:
+    + Deploy GOsæ² based on its classic theming, the Materialize CSS theme is
+      too immature to be used in production.

-> We (company staff + myself) just finished a GOsa² development project
where we developed a plugin and provided Materialize CSS theming for the
plugin. While doing this, we came to the conclusion that the new default
theming in GOsa² is too immature for Debian Edu.

+ -- Mike Gabriel <[email protected]>  Thu, 30 Nov 2023 08:32:34 +0100
+
+debian-edu-config (2.12.39) unstable; urgency=medium
+
+  * ldap-bootstrap/root.ldif: Fix gosaAclEntry of BaseDN object.
+
+ -- Mike Gabriel <[email protected]>  Sun, 19 Nov 2023 09:56:39 +0100
+
+debian-edu-config (2.12.38) unstable; urgency=medium
+
+  [ Wolfgang Schweer ]
+  * Fix main server network setup. Closes: #1055647.
+
+ -- Holger Levsen <[email protected]>  Fri, 10 Nov 2023 16:42:11 +0100
+
+debian-edu-config (2.12.37) unstable; urgency=medium
+
+  [ Guido Berhoerster ]
+  * Discard excessive nullmailer logging.
+    Filter out log messages coming from a client running nullmailer since it is
+    very verbose and can easily fill up the filesystem under /var/log.
+    (Closes: #1003728).
+  * ldap-createuser-krb5: fix password prompt.
+  * Disable cfengine3 systemd service.
+    Disabling only cf-execd in 75b4e3f7 (see #1041323) did not work as it gets
+    pulled in as a dependency of cfengine3. Thus disable the cfengine3 service
+    instead.
+  * Rewrite testsuite/filesystems, add exception for /boot
+    Rewrite for clarity and robustness. Add exception for /boot which may use
+    ext2.
+  * testsuite/ldap-{server,client}: Fix invocation of ldapsearch.
+    The -h command line option has been removed, ldapsearch now only accepts a
+    LDAP URI via the -H option.
+    Also do not use the deprecated egrep and get rid of unnecessary wc.
+    Use dig and awk instead of host and interpret the SRV record properly.
+  * testsuite/ldap-client: Improve error message on PAM modules.
+  * Fix remaining invocations of ldapsearch.
+  * Disable using the LDAP PAM module (we use pam_krb5.so instead).
+  * setup-freeradius-server: Set commonName and subjectAltNames on the server
+    cert.
+    (Closes: #1010159).
+  * setup-freeradius-server: Improve robustness
+    Use update-ini-file for OpenSSL config files.
+    Use more precise sed substitutions which do not rely on example values.
+    Increase password length from 8 to 16 characters.
+  * Change minimum UID/GID for LDAP user to 2000 (Closes: #1003192)
+    With this change local user accounts now use the UID/GID range 1000-1999
+    instead of 500-999 whereas LDAP user accounts use 2000-59999 instead of
+    1000-59999.  This is to reserve UID/GID 0-999 for system users which is the
+    default in Debian and not conforming to it is increasingly problematic as
+    packages are beginning to use systemd-sysusers for creating system user
+    accounts which does not obey /etc/addusers.conf or /etc/login.defs by default.
+    The first user account created during installation now has UID/GID 2000 instead
+    of 1000.
+    Configure gosa and adjust ldap-createuser-krb5 accordingly.
+
+ -- Mike Gabriel <[email protected]>  Wed, 27 Sep 2023 09:57:06 +0200
+
+debian-edu-config (2.12.36) unstable; urgency=medium
+
+  [ Mike Gabriel ]
+  * ldap-bootstrap/gosa.ldif:
+    + Provide ou=incoming potentially used by GOsa²'s class 'newArpDevice'.
+      This is esp. to silence GOsa² error messages but might be useful at a
+      later point of time.
+
+  [ Guido Berhoerster ]
+  * Update proxy settings in dconf.
+    This adds support in update-proxy-from-wpad for setting the proxy default
+    values in dconf (used by e.g. GNOME components). The values are added to
+    a site database, it also packages an empty local database in order to
+    obviate the need to modify the user profile. (Closes: #955702)
+  * Remove use of obsolete grep aliases. These have been obsolete forever and
+    have been removed from GNU grep upstream.
+  * Use command -v builtin over external which command
+  * Do not solely rely on the presence of init scripts in maintainer scripts.
+    Check also for systemd service files.
+  * Remove direct invocation of wlan init script. This no longer exists in
+    Debian.
+  * Replace invocation of fetch-ldap-cert init script in DHCP hooks and rename.
+    dhclient hook in Makefile.
+    This has been replaced by fetch-rootca-cert (see #971780).
+  * Silence exim4 warnings in logfile.
+    The lack of keep_environment in the exim4 configuration for clients leads to
+    continuous warnings in the logfile:
+    'Warning: purging the environment. Suggested action: use keep_environment.'
+    Setting it to an empty value (which is the default) silences that.
+  * Ship PAM group.conf for workstations. LDAP users should be members of
+    several system groups on networked (roaming) workstations.
+  * Add missing dependency on iptables
+    This is required by debian-edu-update-netblock (Closes: #1051446).
+
+ -- Mike Gabriel <[email protected]>  Sat, 09 Sep 2023 23:04:46 +0200
+
+debian-edu-config (2.12.35) unstable; urgency=medium
+
+  [ Guido Berhoerster ]
+  * Remove configure-edu-gateway. (Closes: #1043407).
+    The script is obsoleted by the more sophisticated configuration
+    abilities provided by the debian-edu-router-config package.
+  * Do not hardcode X2Go desktop to Xfce. (Closes: #1049396).
+    Add a commandline option --x2go_desktop for specifying the default desktop
+    and make a best effort finding a usable desktop if none is specified.
+  * Disable cf-execd on installation. (Closes: #1041323).
+    Currently cf-execd is enabled by default if systemd is used (see #1043353)
+    but the agent should only be run on installation.
+  * Do not attempt to fetch the rootCA cert outside of a DebianEdu network
+    An error should only be reported if the machine is inside a DebianEdu
+    network, i.e. www.intern is resolvable, but the download fails. (Closes:
+    #1008599).
+
+  [ Mike Gabriel ]
+  * debian/tests/control: Remove configure-edu-gateway from list of tests.
+    Script and testscript are now gone. (Related to closure of #1043407, see
+    above).
+  * Silence lintian warnings of type 'bash-term-in-posix-shell' by using
+    variable names that lintian can't confuse with bash-only pre-set
+    variables (e.g. $HOSTNAME or $UID).
+
+ -- Mike Gabriel <[email protected]>  Sat, 19 Aug 2023 17:00:36 +0200
+
+debian-edu-config (2.12.34) unstable; urgency=medium
+
+  [ Mike Gabriel ]
+  * Start 2.12.34 development.
+  * debian/debian-edu-config.lintian-overrides:
+    + Update existing overrides (line numbers and such).
+    + Drop missing-systemd-service-for-init.d-script overrides. Systemd service
+      files are now provided.
+    + Drop init.d-script-does-not-implement-status-option override for
+      fetch-ldap-cert. Init script is now gone.
+  * testsuite: Install to pkglibexecdir rather than libexecdir. Thanks lintian.
+  * Makefile: Adjust white-spacing in variable declarations.
+  * Makefile: Use $(NULL) variable at end of file lists. Allow for better git-
+    patch readability.
+  * Convert CRON configuration to systemd timers.
+  * sbin/*-for-netgroup-hosts: Some noop + white-spacing beautifications.
+  * Move d-e-c-*-for-netgroup-hosts scripts to pkglibexecdir.
+  * debian/debian-edu-config.postinst:
+    + Assure runlevel de-registering of init script fetch-ldap-cert.
+  * debian/debian-edu-config.maintscript:
+    + Assure removal of /etc/init.d/fetch-ldap-cert conffile.
+  * debian/debian-edu-config.cron.*:
+    + Only run scripts if they exist. Thanks piuparts.
+
+  [ Daniel Teichmann ]
+  * etc/dhcp/dhcp-debian-edu.conf:
+    + ldap-server. 'ldap' -> 'ldap.intern'. (Closes: #1039966).
+  * share/debian-edu-config/tools/gosa-remove:
+    + Fix kadmin.local, Use '-force' to disable interaction via stdin.
+
+  [ Guido Berhoerster ]
+  * ldap-tools/ldap-createuser-krb5:
+    + Fix user creation. (Closes: #1042456).
+      Remove Samba NT4 domain support, add samba user using smbpasswd.
+      Add root CA for new users (copied from gosa-create).
+    + Fix new UID/GID selection.
+      Exclude special users (UID/GID >= 10000) when looking for the highest
+      UID/GID.
+    + Add CLI options for uid/gid/department.
+      Also ensure script is run as root.
+    + Add additional attributes based on template users.
+    + Add support for additional groups.
+    + Send welcome email in order to create maildir.
+      Without this the maildir in /var/mail/<user> will not exist and Dovecot
+      will refuse to let the user log in as it cannot create this directory.
+    + Set LDAP password when creating users.
+      This allows users to use GOsa² to change their password.
+  * Add systemd services for configuring Chromium/Firefox from LDAP.
+    Factor out logic from init script into separate script which are then called
+    from both the init script and systemd services.
+  * Add systemd service enabling NAT for thin clients.
+  * Add systemd service for fetching the RootCA file from the main server.
+  * Drop init script for fetching LDAP SSL public key from legacy main servers.
+    This drops support for clients running behind a main server based on Debian
+    Edu stretch. (Closes: #1030116).
+  * Update debian/rules for init scripts and systemd services. (Closes:
+    #1039166).
+  * Generate a random password for the icinga/icingaweb databases.
+    (Closes: #1040015).
+  * update-dlw-krb5-keytabs: Handle missing/empty diskless-workstation-hosts.
+  * Followup fixes for ntpsec transition.
+  * Add systemd support to debian-edu-restart-services: This uses a list
+    of service units which was compiled on a main server + ltsp
+    installation. Uses stop and start to force restart
+    reverse-dependencies. It also makes sure that drop in files are
+    recognized. (Closes: #1042940).
+  * Configure gosa not to use STARTTLS since TLS is already used. ldapTLS
+    configures the use of STARTTLS, not TLS per se which is enabled by the
+    use of ldaps: protocol in URLs. (Closes: #1041322).
+  * Allow root access to cups via SystemGroups. 'root' access is allowed in
+    the default configuration and e.g. necessary for services like
+    debian-edu-cups-queue-autoflush.service to work. (Closes: #1043397).
+  * cf3/promises.cf: fix typo and allow connections from localhost and network.
+
+ -- Mike Gabriel <[email protected]>  Thu, 10 Aug 2023 16:47:59 +0200
+
+debian-edu-config (2.12.33) unstable; urgency=medium
+
+  [ Guido Berhoerster ]
+  * Adapt ntp configuration for ntpsec. Closes: #1038881.
+    ntpsec has replaced ntp in bookworm, adapt configuration and add a
+    drop-in file instead of editing the configuration file. Drop insserv
+    overrides for ntp, the ntpsec systemd unit has an ordering dependency
+    on nss-lookup.target equivalent to the "$named" facility.
+  * Set up database for icingaweb2
+    Starting with version 2.11 user preferences must be stored in the DB.
+  * Fix permissions issue preventing icingaweb2 from reading the backend config
+    The /etc/icingaweb2/modules directory ends up with "drwxrwSrwx" permissions,
+    missing the "x" bit preventing icingaweb2 from reading the monitoring backend
+    configuration in /etc/icingaweb2/modules/monitoring/. Instead of adjusting
+    single files and directories, enforce sensible permissions on all directories
+    and configuration files. Closes: #1039475.
+
+ -- Mike Gabriel <[email protected]>  Sat, 01 Jul 2023 05:41:56 +0200


[ Other info ]
As mentioned above, having this upload accepted to bookworm is crucial for the upcoming Debian Edu 12 release.