nss-pam-ldapd (0.9.6-3) unstable; urgency=medium

  * fix-ppolicy-expiration-warnings.patch: fix password policy expiration
    warnings (closes: #794068)

 -- Arthur de Jong <adejong@debian.org>  Sun, 30 Aug 2015 14:00:00 +0200

nss-pam-ldapd (0.9.6-2) unstable; urgency=medium

  * ensure proper return code of init script (closes: #794686)

 -- Arthur de Jong <adejong@debian.org>  Thu, 13 Aug 2015 21:00:00 +0200

nss-pam-ldapd (0.9.6-1) unstable; urgency=medium

  * new upstream release:
    - fix a race condition in signal handling during start-up that would
      cause nslcd to exit if a signal (such as SIGUSR1 that can be sent when
      network status changes) is received (closes: #759544)
    - fix signed integer overflow on 32bit systems when using objectSid
      (thanks Geoffrey McRae)
    - allow longer configuration values (thanks Jed Liu)
    - add an nss_getgrent_skipmembers option to disable retrieving group
      members to improve performance in specific environments
    - add an nss_disable_enumeration option to disable full listing of all
      users and groups to improve performance in specific environments
      (thanks Andrew Elble)
  * drop avoid-signal-race.patch which is part of 0.9.6
  * drop XS-Testsuite from debian/control
  * use pathfind from Developer's Reference instead of full path to nslcd and
    pynslcd

 -- Arthur de Jong <adejong@debian.org>  Fri, 19 Jun 2015 11:30:00 +0200

nss-pam-ldapd (0.9.5-2) unstable; urgency=medium

  * avoid-signal-race.patch: avoid a signal mask race condition that could
    prevent nslcd from starting correctly during boot (closes: #759544)

 -- Arthur de Jong <adejong@debian.org>  Thu, 16 Apr 2015 22:00:00 +0200

nss-pam-ldapd (0.9.5-1) unstable; urgency=medium

  * new upstream release:
    - handle situation better when server (or firewall) closed the connection
      (thanks Tim Harder)
    - make daemonising a little more robust and try to log more failures
    - fix integer format strings (thanks Jianhai Luan and Patrick McLean)
    - documentation updates (thanks Dalibor Pospíšil)
    - fix range check for search access (thanks David Binderma)
    - fix a bug in the NSS library when encountering IPv6 addresses in
      the hosts map (thanks Mark R Bannister)
    - adjust the Linux OOM (Out-Of-Memory) killer score to avoid killing
      nslcd (thanks Patrick McLean)
  * drop use-ip-range-for-tests.patch which is part of 0.9.5
  * debian/copyright: copyright year updates
  * upgrade to standards-version 3.9.6 (no changes needed)

 -- Arthur de Jong <adejong@debian.org>  Fri, 10 Apr 2015 16:00:00 +0200

nss-pam-ldapd (0.9.4-3) unstable; urgency=low

  * use-ip-range-for-tests.patch: use a different IP range for running the
    autopkgtest tests to avoid conflicts in test environments
  * debconf translation updates:
    - Norwegian Bokmål by Petter Reinholdtsen (closes: #758693)
  * prefer nslcd as nslcd-2 implementation (closes: #760287)
  * do not remove PAM profile when another architecture remains (taken from
    the libpam_ldap package)

 -- Arthur de Jong <adejong@debian.org>  Sun, 28 Sep 2014 15:00:00 +0200

nss-pam-ldapd (0.9.4-2) unstable; urgency=low

  * debconf translation updates:
    - Portuguese by Américo Monteiro (closes: #751047)
    - French by Christian Perrier (closes: #751100)
    - Japanese by Kenshi Muto (closes: #752515)
    - Russian by Yuri Kozlov (closes: #752550)
    - Dutch by Arthur de Jong
    - Swedish by Martin Bagge (closes: #753691)
      (with corrections by Anders Jonsson)
    - Czech by Miroslav Kure (closes: #753710)
    - Danish by Joe Hansen (closes: #753948)
    - Turkish by Mert Dirik (closes: #754101)
    - Slovak by Slavko (closes: #754284)
    - German by Chris Leick (closes: #754476)
    - Polish by Michał Kułach (closes: #754989)
    - Spanish by Matías A. Bellone (closes: #755037)
    - Italian by Beatrice Torracca (closes: #755282)
  * for new installs add tls_cacertfile /etc/ssl/certs/ca-certificates.crt to
    nslcd.conf (closes: #750949)
  * provide a debconf prompt for tls_cacertfile if TLS is enabled and reqcert
    is configured (closes: #750949, #661872)
  * update autopkgtest tests to dump daemon debug info if tests fail and not
    stop the tests on first failure

 -- Arthur de Jong <adejong@debian.org>  Wed, 23 Jul 2014 21:00:00 +0200

nss-pam-ldapd (0.9.4-1) unstable; urgency=medium

  * upload to unstable
  * new upstream release:
    - also handle password policy information on BIND failure (this makes it
      possible to distinguish between a wrong password and an expired
      password)
    - fix mapping the member attribute to an empty string
    - any buffers that may have held passwords are cleared before the memory
      is released
    - increase buffer size for passwords to support extremely long passwords
      (thanks ushi)
    - increase buffer size for DN to support very long names or names with
      non-ASCII characters
    - log an error in almost all places where a defined buffer is not large
      enough to hold the provided data instead of just (sometimes silently)
      failing
    - logging improvements (start-up problems, login failures)
  * add signature checking option to watch file
  * add a debian/upstream/metadata file

 -- Arthur de Jong <adejong@debian.org>  Sun, 08 Jun 2014 14:00:00 +0200

nss-pam-ldapd (0.9.3-1) experimental; urgency=low

  * new upstream release:
    - make the dn2uid cache lifetime configurable with the cache
      configuration option
    - have the nslcd process only exit after the service is completely
      available to avoid race conditions in the init script
    - the nslcd daemon now properly daemonises (double fork)
    - support mapping the member attribute to an empty string to disable the
      functionality to do extra lookups for member DN to member uid
      translations
    - implement deref control handling to request the LDAP server to
      dereference group member attribute values to uid values
    - support getting built-in groups from Active Directory (thanks Davy
      Defaud)
    - fix for pwdLastSet attribute value handling (thanks Joshua Shire)
    - fix a possible crash in the NSS module when retrieving large networks
      entries (thanks Lukas Slebodnik)
    - correct NSS h_errnop return value to indicate buffer too small (thanks
      Nalin Dahyabhai)
    - fix a bug with shadow values on 64-bit architectures (closes: #739330)
  * debian/copyright: copyright year updates
  * add build dependencies for used Python modules because the new upstream
    version checks them with configure script

 -- Arthur de Jong <adejong@debian.org>  Wed, 12 Mar 2014 23:00:00 +0100

nss-pam-ldapd (0.9.2-1) experimental; urgency=low

  * new upstream release:
    - increase password value buffer size (by Bersl)
    - avoid more broken pipe errors by using a low timeout when aborting
      reading requested information from nslcd (thanks John Sullivan)
    - only log broken pipe errors in debugging mode
    - fix buffer overflow on interrupted read that is hard to trigger (thanks
      John Sullivan)
    - use clock_gettime() with CLOCK_MONOTONIC for timeout calculations to
      avoid clock adjustments errors (thanks John Sullivan)
    - extend test suite to test for CLOCK_MONOTONIC and timed IO timeout
      calculations
    - increase the maximum number of base statements per map to 31
    - use larger nslcd send buffers to reduce the number of write operations
      in nslcd and consequently the number of reads in the NSS and PAM modules
      (thanks John Sullivan)
    - also run invalidators after first successful search
    - various clean-ups, portability improvements and fixes for compiler
      warnings
    - import configure checks of Python modules
    - provide a script for setting up slapd in a test environment,
      automatically loaded with the required test data
    - add script for evaluating test environment availability
    - portability improvements in the test scripts and test environment
  * avoid prompting to restart services on initial install
  * upgrade to standards-version 3.9.5 (no changes needed)
  * add DEP-8 autopkgtest end-to-end tests of installed packages running an
    LDAP server and performing NSS and PAM operations

 -- Arthur de Jong <adejong@debian.org>  Thu, 31 Oct 2013 23:00:00 +0100

# For older changelog entries, run 'apt-get changelog nslcd'
