RHBA-2005:282 - Bug Fix Advisory

Topic

An updated nss_ldap package that corrects a documentation bug and removes
an inconsistency in the default tls_checkpeer setting is now available.

Description

The nss_ldap module is an extension for use with GNU libc which allows
applications to, without internal modification, consult a directory service
using LDAP to supplement information which would be read from local files
such as /etc/passwd, /etc/group, and /etc/shadow.

The pam_ldap module allows PAM-enabled applications to authenticate users
using a directory service.

Both modules support use of either LDAP-over-SSL or LDAP with the StartTLS
extension when connecting to directory servers. When a client application
negotiates SSL or TLS with any server, a client application should verify
the signature and subject name of the certificate which the server provides
as proof of its identity.

In nss_ldap and pam_ldap, whether or not this validation is performed is
controlled by the "tls_checkpeer" setting in /etc/ldap.conf. If set to
"yes", validation is performed. If set to "no", validation is disabled.
If "tls_checkpeer" were left unset, nss_ldap would by default disable
validation, and pam_ldap would allow libldap's default behavior to be
followed. In Red Hat Enterprise Linux 4, these defaults conflict, which
could produce difficult-to-diagnose failures in the login process.

This update backports a fix to nss_ldap which makes its behavior match that
of pam_ldap.

All users of nss_ldap should upgrade to this updated package, which
resolves these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

CVEs

(none)

References

(none)