Index: tags/fc15-eol/COPYRIGHT
===================================================================
--- tags/fc15-eol/COPYRIGHT	(revision 2244)
+++ tags/fc15-eol/COPYRIGHT	(revision 2244)
@@ -0,0 +1,358 @@
+scripts.mit.edu repository
+Copyright (C) 2006  Jeff Arnold and Joe Presbrey,
+                    unless noted otherwise
+
+These programs are free software; you can redistribute them and/or
+modify them under the terms of the GNU General Public License
+as published by the Free Software Foundation; either version 2
+of the License, or (at your option) any later version.
+
+These programs are distributed in the hope that they will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program; if not, write to the Free Software
+Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA
+
+		    GNU GENERAL PUBLIC LICENSE
+		       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.
+ 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+			    Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Library General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+		    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+			    NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+		     END OF TERMS AND CONDITIONS
+
+	    How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA
+
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.
Index: tags/fc15-eol/README
===================================================================
--- tags/fc15-eol/README	(revision 2244)
+++ tags/fc15-eol/README	(revision 2244)
@@ -0,0 +1,11 @@
+locker:
+  files associated with the scripts Athena locker
+
+noc:
+  configuration for a scripts monitoring NOC
+
+selinux:
+  selinux strict policy modules for a scripts.mit.edu server
+
+server:
+  files needed to run a scripts.mit.edu server
Index: tags/fc15-eol/host/credit-card/host.py
===================================================================
--- tags/fc15-eol/host/credit-card/host.py	(revision 2244)
+++ tags/fc15-eol/host/credit-card/host.py	(revision 2244)
@@ -0,0 +1,184 @@
+import os
+import optparse
+import socket
+import tempfile
+import shutil
+import errno
+import csv
+
+import shell
+
+HOST = socket.gethostname()
+
+# XXX test server and wizard server
+
+# UIDs (sketchy):
+#   signup 102
+#   fedora-ds 103 (sketchy, not true for b-b)
+#   logview 501 (really sketchy, since it's in the dynamic range)
+
+# Works for passwd and group, but be careful! They're different things!
+def lookup(filename):
+    # Super-safe to assume and volume IDs (expensive to check)
+    r = {
+        'root': 0,
+        'sql': 537704221,
+    }
+    with open(filename, 'rb') as f:
+        reader = csv.reader(f, delimiter=':', quoting=csv.QUOTE_NONE)
+        for row in reader:
+            r[row[0]] = int(row[2])
+    return r
+
+# Format here assumes that we always chmod $USER:$USER ...
+# but note the latter refers to group...
+COMMON_CREDS = [
+    ('root', 0o600, 'root/.bashrc'),
+    ('root', 0o600, 'root/.screenrc'),
+    ('root', 0o600, 'root/.ssh/authorized_keys'),
+    ('root', 0o600, 'root/.ssh/authorized_keys2'),
+    ('root', 0o600, 'root/.vimrc'),
+    ('root', 0o600, 'root/.k5login'),
+    # punted /root/.ssh/known_hosts
+
+    # XXX user must be created in Kickstart
+    ('logview', 0o600, 'home/logview/.k5login'),
+    ]
+
+COMMON_PROD_CREDS = [ # important: no leading slashes!
+    ('root', 0o600, 'root/.ldapvirc'),
+    ('root', 0o600, 'etc/ssh/ssh_host_dsa_key'),
+    ('root', 0o600, 'etc/ssh/ssh_host_key'),
+    ('root', 0o600, 'etc/ssh/ssh_host_rsa_key'),
+    ('root', 0o600, 'etc/pki/tls/private/scripts-1024.key'),
+    ('root', 0o600, 'etc/pki/tls/private/scripts.key'),
+    ('root', 0o600, 'etc/whoisd-password'),
+    ('afsagent', 0o600, 'etc/daemon.keytab'),
+
+    ('root', 0o644, 'etc/ssh/ssh_host_dsa_key.pub'),
+    ('root', 0o644, 'etc/ssh/ssh_host_key.pub'),
+    ('root', 0o644, 'etc/ssh/ssh_host_rsa_key.pub'),
+
+    ('sql', 0o600, 'etc/sql-mit-edu.cfg.php'),
+    ('signup', 0o600, 'etc/signup-ldap-pw'),
+    ]
+
+MACHINE_PROD_CREDS = [
+    # XXX NEED TO CHECK THAT THESE ARE SENSIBLE
+    ('root', 0o600, 'etc/krb5.keytab'),
+    ('fedora-ds', 0o600, 'etc/dirsrv/keytab')
+    ]
+
+def mkdir_p(path): # it's like mkdir -p
+    try:
+        os.makedirs(path)
+    except OSError as e:
+        if e.errno == errno.EEXIST:
+            pass
+        else: raise
+
+# XXX This code is kind of dangerous, because we are directly using the
+# kernel modules to manipulate possibly untrusted disk images.  This
+# means that if an attacker can corrupt the disk, and exploit a problem
+# in the kernel vfs driver, he can escalate a guest root exploit
+# to a host root exploit.  Ultimately we should use libguestfs
+# which makes this attack harder to pull off, but at the time of writing
+# squeeze didn't package libguestfs.
+#
+# We try to minimize attack surface by explicitly specifying the
+# expected filesystem type.
+class WithMount(object):
+    """Context for running code with an extra mountpoint."""
+    guest = None
+    types = None # comma separated, like the mount argument -t
+    mount = None
+    dev = None
+    def __init__(self, guest, types):
+        self.guest = guest
+        self.types = types
+    def __enter__(self):
+        self.dev = "/dev/%s/%s-root" % (HOST, self.guest)
+
+        mapper_name = shell.eval("kpartx", "-l", self.dev).split()[0]
+        shell.call("kpartx", "-a", self.dev)
+        mapper = "/dev/mapper/%s" % mapper_name
+
+        # this is why bracketing functions and hanging lambdas are a good idea
+        try:
+            self.mount = tempfile.mkdtemp("-%s" % self.guest, 'vm-', '/mnt') # no trailing slash
+            try:
+                shell.call("mount", "--types", self.types, mapper, self.mount)
+            except:
+                os.rmdir(self.mount)
+                raise
+        except:
+            shell.call("kpartx", "-d", self.dev)
+            raise
+
+        return self.mount
+    def __exit__(self, _type, _value, _traceback):
+        shell.call("umount", self.mount)
+        os.rmdir(self.mount)
+        shell.call("kpartx", "-d", self.dev)
+
+def main():
+    usage = """usage: %prog [push|pull|pull-common] GUEST"""
+
+    parser = optparse.OptionParser(usage)
+    # ext3 will probably supported for a while yet and a pretty
+    # reasonable thing to always try
+    parser.add_option('-t', '--types', dest="types", default="ext4,ext3",
+            help="filesystem type(s)")
+    parser.add_option('--creds-dir', dest="creds_dir", default="/root/creds",
+            help="directory to store/fetch credentials in")
+    options, args = parser.parse_args()
+
+    if not os.path.isdir(options.creds_dir):
+        raise Exception("/root/creds does not exist") # XXX STRING
+    # XXX check owned by root and appropriately chmodded
+
+    os.umask(0o077) # overly restrictive
+
+    if len(args) != 2:
+        parser.print_help()
+        raise Exception("Wrong number of arguments")
+
+    command = args[0]
+    guest   = args[1]
+
+    with WithMount(guest, options.types) as tmp_mount:
+        uid_lookup = lookup("%s/etc/passwd" % tmp_mount)
+        gid_lookup = lookup("%s/etc/group" % tmp_mount)
+        def push_files(files, type):
+            for (usergroup, perms, f) in files:
+                dest = "%s/%s" % (tmp_mount, f)
+                mkdir_p(os.path.dirname(dest)) # useful for .ssh
+                # assuming OK to overwrite
+                # XXX we could compare the files before doing anything...
+                shutil.copyfile("%s/%s/%s" % (options.creds_dir, type, f), dest)
+                try:
+                    os.chown(dest, uid_lookup[usergroup], gid_lookup[usergroup])
+                    os.chmod(dest, perms)
+                except:
+                    # never ever leave un-chowned files lying around
+                    os.unlink(dest)
+                    raise
+        def pull_files(files, type):
+            for (_, _, f) in files:
+                dest = "%s/%s/%s" % (options.creds_dir, type, f)
+                mkdir_p(os.path.dirname(dest))
+                # error if doesn't exist
+                shutil.copyfile("%s/%s" % (tmp_mount, f), dest)
+
+        if command == "push":
+            push_files(COMMON_CREDS, 'common')
+            push_files(COMMON_PROD_CREDS,  'common')
+            push_files(MACHINE_PROD_CREDS, 'machine/%s' % guest)
+        elif command == "pull":
+            pull_files(MACHINE_PROD_CREDS, 'machine/%s' % guest)
+        elif command == "pull-common":
+            pull_files(COMMON_CREDS, 'common')
+            pull_files(COMMON_PROD_CREDS,  'common')
+
+if __name__ == "__main__":
+    main()
Index: tags/fc15-eol/host/credit-card/shell.py
===================================================================
--- tags/fc15-eol/host/credit-card/shell.py	(revision 2244)
+++ tags/fc15-eol/host/credit-card/shell.py	(revision 2244)
@@ -0,0 +1,301 @@
+"""
+Wrappers around subprocess functionality that simulate an actual shell.
+"""
+
+import subprocess
+import logging
+import sys
+import os
+import errno
+
+class Shell(object):
+    """
+    An advanced shell that performs logging.  If ``dry`` is ``True``,
+    no commands are actually run.
+    """
+    def __init__(self, dry = False):
+        self.dry = dry
+        self.cwd = None
+    def call(self, *args, **kwargs):
+        """
+        Performs a system call.  The actual executable and options should
+        be passed as arguments to this function.  Several keyword arguments
+        are also supported:
+
+        :param input: input to feed the subprocess on standard input.
+        :param interactive: whether or not directly hook up all pipes
+            to the controlling terminal, to allow interaction with subprocess.
+        :param strip: if ``True``, instead of returning a tuple,
+            return the string stdout output of the command with trailing newlines
+            removed.  This emulates the behavior of backticks and ``$()`` in Bash.
+            Prefer to use :meth:`eval` instead (you should only need to explicitly
+            specify this if you are using another wrapper around this function).
+        :param log: if True, we log the call as INFO, if False, we log the call
+            as DEBUG, otherwise, we detect based on ``strip``.
+        :param stdout:
+        :param stderr:
+        :param stdin: a file-type object that will be written to or read from as a pipe.
+        :returns: a tuple of strings ``(stdout, stderr)``, or a string ``stdout``
+            if ``strip`` is specified.
+
+        >>> sh = Shell()
+        >>> sh.call("echo", "Foobar")
+        ('Foobar\\n', '')
+        >>> sh.call("cat", input='Foobar')
+        ('Foobar', '')
+        """
+        self._wait()
+        kwargs.setdefault("interactive", False)
+        kwargs.setdefault("strip", False)
+        kwargs.setdefault("python", None)
+        kwargs.setdefault("log", None)
+        kwargs.setdefault("stdout", subprocess.PIPE)
+        kwargs.setdefault("stdin", subprocess.PIPE)
+        kwargs.setdefault("stderr", subprocess.PIPE)
+        msg = "Running `" + ' '.join(args) + "`"
+        if kwargs["strip"] and not kwargs["log"] is True or kwargs["log"] is False:
+            logging.debug(msg)
+        else:
+            logging.info(msg)
+        if self.dry:
+            if kwargs["strip"]:
+                return ''
+            return None, None
+        kwargs.setdefault("input", None)
+        if kwargs["interactive"]:
+            stdout=sys.stdout
+            stdin=sys.stdin
+            stderr=sys.stderr
+        else:
+            stdout=kwargs["stdout"]
+            stdin=kwargs["stdin"]
+            stderr=kwargs["stderr"]
+        # XXX: There is a possible problem here where we can fill up
+        # the kernel buffer if we have 64KB of data.  This shouldn't
+        # be a problem, and the fix for such case would be to write to
+        # temporary files instead of a pipe.
+        # Another possible way of fixing this is converting from a
+        # waitpid() pump to a select() pump, creating a pipe to
+        # ourself, and then setting up a
+        # SIGCHILD handler to write a single byte to the pipe to get
+        # us out of select() when a subprocess exits.
+        proc = subprocess.Popen(args, stdout=stdout, stderr=stderr, stdin=stdin, cwd=self.cwd, )
+        if self._async(proc, args, **kwargs):
+            return proc
+        stdout, stderr = proc.communicate(kwargs["input"])
+        # can occur if we were doing interactive communication; i.e.
+        # we didn't pass in PIPE.
+        if stdout is None:
+            stdout = ""
+        if stderr is None:
+            stderr = ""
+        if not kwargs["interactive"]:
+            if kwargs["strip"]:
+                self._log(None, stderr)
+            else:
+                self._log(stdout, stderr)
+        if proc.returncode:
+            raise CallError(proc.returncode, args, stdout, stderr)
+        if kwargs["strip"]:
+            return str(stdout).rstrip("\n")
+        return (stdout, stderr)
+    def _log(self, stdout, stderr):
+        """Logs the standard output and standard input from a command."""
+        if stdout:
+            logging.debug("STDOUT:\n" + stdout)
+        if stderr:
+            logging.debug("STDERR:\n" + stderr)
+    def _wait(self):
+        pass
+    def _async(self, *args, **kwargs):
+        return False
+    def callAsUser(self, *args, **kwargs):
+        """
+        Performs a system call as a different user.  This is only possible
+        if you are running as root.  Keyword arguments
+        are the same as :meth:`call` with the following additions:
+
+        :param user: name of the user to run command as.
+        :param uid: uid of the user to run command as.
+
+        .. note::
+
+            The resulting system call internally uses :command:`sudo`,
+            and as such environment variables will get scrubbed.  We
+            manually preserve :envvar:`SSH_GSSAPI_NAME`.
+        """
+        user = kwargs.pop("user", None)
+        uid = kwargs.pop("uid", None)
+        if not user and not uid: return self.call(*args, **kwargs)
+        if os.getenv("SSH_GSSAPI_NAME"):
+            # This might be generalized as "preserve some environment"
+            args = list(args)
+            args.insert(0, "SSH_GSSAPI_NAME=" + os.getenv("SSH_GSSAPI_NAME"))
+        if uid: return self.call("sudo", "-u", "#" + str(uid), *args, **kwargs)
+        if user: return self.call("sudo", "-u", user, *args, **kwargs)
+    def safeCall(self, *args, **kwargs):
+        """
+        Checks if the owner of the current working directory is the same
+        as the current user, and if it isn't, attempts to sudo to be
+        that user.  The intended use case is for calling Git commands
+        when running as root, but this method should be used when
+        interfacing with any moderately complex program that depends
+        on working directory context.  Keyword arguments are the
+        same as :meth:`call`.
+        """
+        if os.getuid():
+            return self.call(*args, **kwargs)
+        uid = os.stat(os.getcwd()).st_uid
+        # consider also checking ruid?
+        if uid != os.geteuid():
+            kwargs['uid'] = uid
+            return self.callAsUser(*args, **kwargs)
+        else:
+            return self.call(*args, **kwargs)
+    def eval(self, *args, **kwargs):
+        """
+        Evaluates a command and returns its output, with trailing newlines
+        stripped (like backticks in Bash).  This is a convenience method for
+        calling :meth:`call` with ``strip``.
+
+            >>> sh = Shell()
+            >>> sh.eval("echo", "Foobar") 
+            'Foobar'
+        """
+        kwargs["strip"] = True
+        return self.call(*args, **kwargs)
+    def setcwd(self, cwd):
+        """
+        Sets the directory processes are executed in. This sets a value
+        to be passed as the ``cwd`` argument to ``subprocess.Popen``.
+        """
+        self.cwd = cwd
+
+class ParallelShell(Shell):
+    """
+    Modifies the semantics of :class:`Shell` so that
+    commands are queued here, and executed in parallel using waitpid
+    with ``max`` subprocesses, and result in callback execution
+    when they finish.
+
+    .. method:: call(*args, **kwargs)
+
+        Enqueues a system call for parallel processing.  If there are
+        no openings in the queue, this will block.  Keyword arguments
+        are the same as :meth:`Shell.call` with the following additions:
+
+        :param on_success: Callback function for success (zero exit status).
+            The callback function should accept two arguments,
+            ``stdout`` and ``stderr``.
+        :param on_error: Callback function for failure (nonzero exit status).
+            The callback function should accept one argument, the
+            exception that would have been thrown by the synchronous
+            version.
+        :return: The :class:`subprocess.Proc` object that was opened.
+
+    .. method:: callAsUser(*args, **kwargs)
+
+        Enqueues a system call under a different user for parallel
+        processing.  Keyword arguments are the same as
+        :meth:`Shell.callAsUser` with the additions of keyword
+        arguments from :meth:`call`.
+
+    .. method:: safeCall(*args, **kwargs)
+
+        Enqueues a "safe" call for parallel processing.  Keyword
+        arguments are the same as :meth:`Shell.safeCall` with the
+        additions of keyword arguments from :meth:`call`.
+
+    .. method:: eval(*args, **kwargs)
+
+        No difference from :meth:`call`.  Consider having a
+        non-parallel shell if the program you are shelling out
+        to is fast.
+
+    """
+    def __init__(self, dry = False, max = 10):
+        super(ParallelShell, self).__init__(dry=dry)
+        self.running = {}
+        self.max = max # maximum of commands to run in parallel
+    @staticmethod
+    def make(no_parallelize, max):
+        """Convenience method oriented towards command modules."""
+        if no_parallelize:
+            return DummyParallelShell()
+        else:
+            return ParallelShell(max=max)
+    def _async(self, proc, args, python, on_success, on_error, **kwargs):
+        """
+        Gets handed a :class:`subprocess.Proc` object from our deferred
+        execution.  See :meth:`Shell.call` source code for details.
+        """
+        self.running[proc.pid] = (proc, args, python, on_success, on_error)
+        return True # so that the parent function returns
+    def _wait(self):
+        """
+        Blocking call that waits for an open subprocess slot.  This is
+        automatically called by :meth:`Shell.call`.
+        """
+        # XXX: This API sucks; the actual call/callAsUser call should
+        # probably block automatically (unless I have a good reason not to)
+        # bail out immediately on initial ramp up
+        if len(self.running) < self.max: return
+        # now, wait for open pids.
+        try:
+            self.reap(*os.waitpid(-1, 0))
+        except OSError as e:
+            if e.errno == errno.ECHILD: return
+            raise
+    def join(self):
+        """Waits for all of our subprocesses to terminate."""
+        try:
+            while True:
+                self.reap(*os.waitpid(-1, 0))
+        except OSError as e:
+            if e.errno == errno.ECHILD: return
+            raise
+    def reap(self, pid, status):
+        """Reaps a process."""
+        # ooh, zombie process. reap it
+        proc, args, python, on_success, on_error = self.running.pop(pid)
+        # XXX: this is slightly dangerous; should actually use
+        # temporary files
+        stdout = proc.stdout.read()
+        stderr = proc.stderr.read()
+        self._log(stdout, stderr)
+        if status:
+            on_error(CallError(proc.returncode, args, stdout, stderr))
+            return
+        on_success(stdout, stderr)
+
+# Setup a convenience global instance
+shell = Shell()
+call = shell.call
+callAsUser = shell.callAsUser
+safeCall = shell.safeCall
+eval = shell.eval
+
+class DummyParallelShell(ParallelShell):
+    """Same API as :class:`ParallelShell`, but doesn't actually
+    parallelize (i.e. all calls to :meth:`wait` block.)"""
+    def __init__(self, dry = False):
+        super(DummyParallelShell, self).__init__(dry=dry, max=1)
+
+class CallError:
+    """Indicates that a subprocess call returned a nonzero exit status."""
+    #: The exit code of the failed subprocess.
+    code = None
+    #: List of the program and arguments that failed.
+    args = None
+    #: The stdout of the program.
+    stdout = None
+    #: The stderr of the program.
+    stderr = None
+    def __init__(self, code, args, stdout, stderr):
+        self.code = code
+        self.args = args
+        self.stdout = stdout
+        self.stderr = stderr
+    def __str__(self):
+        compact = self.stderr.rstrip().split("\n")[-1]
+        return "%s (exited with %d)\n%s" % (compact, self.code, self.stderr)
Index: tags/fc15-eol/host/debian/scripts-syslog-ng-config/d_zroot.pl
===================================================================
--- tags/fc15-eol/host/debian/scripts-syslog-ng-config/d_zroot.pl	(revision 2244)
+++ tags/fc15-eol/host/debian/scripts-syslog-ng-config/d_zroot.pl	(revision 2244)
@@ -0,0 +1,149 @@
+#!/usr/bin/perl
+
+use strict;
+use warnings;
+use Sys::Hostname;
+use Time::HiRes qw(ualarm);
+use File::Temp;
+
+our $ZCLASS = "scripts-auto";
+our @USERS = qw/root logview/;
+my $k5login;
+open $k5login, '/root/.k5login';
+our @RECIPIENTS = map {chomp; m|([^/@]*)| && $1} <$k5login>;
+close $k5login;
+
+our %USERS;
+@USERS{@USERS} = undef;
+
+sub zwrite($;$$\@) {
+    my ($message, $class, $instance, $recipref) = @_;
+    my @recipients = ();
+    if (defined($recipref)) {
+        if (@$recipref) {
+            @recipients = @$recipref;
+        } else {
+            $message = '@b(Empty recipient list specified, message redacted)';
+            $class = $ZCLASS;
+        }
+    }
+    $class ||= $ZCLASS;
+    $instance ||= 'root.'.hostname;
+    open(ZWRITE, "|-", qw|/usr/bin/zwrite -d -n -O log -c|, $class, '-i', $instance, '-s', hostname, @recipients) or die "Couldn't open zwrite";
+    print ZWRITE $message;
+    close(ZWRITE);
+}
+
+unless (@RECIPIENTS) {
+    # Also give a warning at startup
+    zwrite('@b(No .k5login found, sensitive logs will not be zephyred)', $ZCLASS);
+}
+
+my %toclass;
+
+my %sshkeys;
+
+sub buildKeyMap($) {
+    my ($file) = @_;
+    open (KEYS, $file) or (warn "Couldn't open $file: $!\n" and return);
+    while (<KEYS>) {
+	chomp;
+	my ($fingerprint, $comment) = parseKey($_);
+	$sshkeys{$fingerprint} = $comment;
+    }
+    close(KEYS);
+}
+
+sub parseKey($) {
+    my ($key) = @_;
+    my $tmp = new File::Temp;
+    print $tmp $key;
+    close $tmp;
+    open (KEYGEN, "-|", qw(/usr/bin/ssh-keygen -l -f), $tmp) or die "Couldn't call ssh-keygen: $!";
+    my ($line) = <KEYGEN>;
+    close(KEYGEN);
+    my (undef, $fingerprint, undef) = split(' ', $line, 3);
+    my (undef, undef, $comment) = split(' ', $key, 3);
+    #print "$fingerprint $comment";
+    return ($fingerprint, $comment);
+}
+
+buildKeyMap("/root/.ssh/authorized_keys");
+buildKeyMap("/root/.ssh/authorized_keys2");
+
+my @message;
+
+while (my $line = <>) {
+    @message = $line;
+    eval {
+        local $SIG{ALRM} = sub { die "alarm\n" }; # NB: \n required
+        ualarm(500*1000);
+        while (<>) { push @message, $_; }
+    };
+    chomp @message;
+    map { s/^(.*?): // } @message;
+    %toclass = ();
+    foreach my $message (@message) {
+	sub sendmsg ($;$) {
+	    my ($message, $class) = @_;
+	    $class ||= $ZCLASS;
+	    $toclass{$class} .= $message."\n";
+	}
+	if ($message =~ m|Accepted (\S+) for (\S+)|) {
+	    sendmsg($message) if exists $USERS{$2}
+	} elsif ($message =~ m|Authorized to (\S+),|) {
+	    sendmsg($message) if exists $USERS{$1};
+	} elsif ($message =~ m|Root (\S+) shell|) {
+	    sendmsg($message);
+	} elsif ($message =~ m|pam_unix\(([^:]+):session\): session \S+ for user (\S+)|) {
+	    sendmsg($message) if $1 ne "cron" and exists $USERS{$2};
+	} elsif ($message =~ m|^Found matching (\w+) key: (\S+)|) {
+	    if ($sshkeys{$2}) {
+		sendmsg($message." (".$sshkeys{$2}.")");
+	    } else {
+		sendmsg($message." (UNKNOWN KEY)");
+	    }
+	} elsif ($message =~ m|^Out of memory:|) {
+	    sendmsg($message);
+	} elsif ($message =~ m|^giving \S+ admin rights|) {
+	    sendmsg($message);
+	} elsif ($message =~ m|^Connection closed|) {
+	    # Do nothing
+	} elsif ($message =~ m|^Closing connection to |) {
+	} elsif ($message =~ m|^Connection from (\S+) port (\S+)|) {
+	} elsif ($message =~ m|^Invalid user|) {
+	} elsif ($message =~ m|^input_userauth_request: invalid user|) {
+	} elsif ($message =~ m|^Received disconnect from|) {
+	} elsif ($message =~ m|^Postponed keyboard-interactive|) {
+	} elsif ($message =~ m|^Failed keyboard-interactive/pam|) {
+	} elsif ($message =~ m|^fatal: Read from socket failed: Connection reset by peer$|) {
+	} elsif ($message =~ m|^reverse mapping checking getaddrinfo|) {
+	} elsif ($message =~ m|^pam_succeed_if\(sshd\:auth\)\:|) {
+	} elsif ($message =~ m|^error: PAM: Authentication failure|) {
+	} elsif ($message =~ m|^pam_unix\(sshd:auth\): authentication failure|) {
+	} elsif ($message =~ m|^pam_unix\(sshd:auth\): check pass; user unknown|) {
+	} elsif ($message =~ m|^Postponed keyboard-interactive for invalid user |) {
+	} elsif ($message =~ m|^Failed keyboard-interactive/pam for invalid user |) {
+	} elsif ($message =~ m|^Postponed gssapi-with-mic for |) {
+	} elsif ($message =~ m|^Address \S+ maps to \S+, but this does not map back to the address|) {
+	} elsif ($message =~ m|^Nasty PTR record .* is set up for .*, ignoring|) {
+	} elsif ($message =~ m|^User child is on pid \d+$|) {
+	} elsif ($message =~ m|^Transferred: sent \d+, received \d+ bytes$|) {
+	} elsif ($message =~ m|^Setting tty modes failed: Invalid argument$|) {
+	} elsif ($message =~ m|^ *nrpe .* COMMAND=/etc/nagios/check_ldap_mmr.real$|) {
+	} elsif ($message =~ m|^ *root : TTY=|) {
+	} elsif ($message =~ m|^Set /proc/self/oom_adj to |) {
+	} elsif ($message =~ m|^fatal: mm_request_receive: read: Connection reset by peer$|) {
+	} else {
+	    sendmsg($message, "scripts-spew");
+	}
+    }
+
+    foreach my $class (keys %toclass) {
+	if ($class eq $ZCLASS) {
+	    zwrite($toclass{$class}, $class);
+	} else {
+	    zwrite($toclass{$class}, $class, undef, @RECIPIENTS);
+	}
+    }
+}
Index: tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/changelog
===================================================================
--- tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/changelog	(revision 2244)
+++ tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/changelog	(revision 2244)
@@ -0,0 +1,25 @@
+scripts-syslog-ng-config (0.4) stable; urgency=low
+
+  * Synchronize filtered logs with Fedora copy (r2095).
+  * Avoid accidentally sending sensitive logs to a public class (r2096).
+
+ -- Geoffrey Thomas <geofft@mit.edu>  Sat, 17 Dec 2011 03:06:59 -0500
+
+scripts-syslog-ng-config (0.3) stable; urgency=low
+
+  * Depend on debathena-zephyr-config
+
+ -- Alexander Chernyakhovsky <achernya@mit.edu>  Sat, 12 Nov 2011 23:27:51 -0500
+  
+scripts-syslog-ng-config (0.2) stable; urgency=low
+
+  * Move d_zroot into /usr/lib
+
+ -- Quentin Smith <quentin@mit.edu>  Mon, 05 Sep 2011 15:01:04 -0400
+
+scripts-syslog-ng-config (0.1) stable; urgency=low
+
+  * Initial release
+
+ -- Alexander Chernyakhovsky <achernya@mit.edu>  Mon, 05 Sep 2011 14:45:27 -0400
+
Index: tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/compat
===================================================================
--- tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/compat	(revision 2244)
+++ tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/compat	(revision 2244)
@@ -0,0 +1,1 @@
+7
Index: tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/control
===================================================================
--- tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/control	(revision 2244)
+++ tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/control	(revision 2244)
@@ -0,0 +1,14 @@
+Source: scripts-syslog-ng-config
+Section: misc
+Priority: extra
+Maintainer: scripts team <scripts-team@mit.edu>
+Build-Depends: cdbs, debhelper (>= 7.0.50~), config-package-dev, syslog-ng,
+Standards-Version: 3.9.1
+Homepage: http://scripts.mit.edu/
+
+Package: scripts-syslog-ng-config
+Architecture: all
+Depends: ${misc:Depends},
+ syslog-ng, debathena-zephyr-config
+Description: Configures syslog-ng for zephyr logging
+ Configures a machine to log messages sent to syslog-ng to zephyr.
Index: tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/copyright
===================================================================
--- tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/copyright	(revision 2244)
+++ tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/copyright	(revision 2244)
@@ -0,0 +1,22 @@
+This work was packaged for Debian by:
+
+    Alexander Chernyakhovsky <achernya@mit.edu> on Mon, 05 Sep 2011 14:42:37 -0400
+
+It was downloaded from:
+
+    http://scripts.mit.edu
+
+Copyright:
+
+    Copyright (C) 2011 Alexander Chernyakhovsky
+
+License:
+
+    GPLv2+
+
+The Debian packaging is:
+
+    Copyright (C) 2011 Alexander Chernyakhovsky <achernya@mit.edu>
+
+and is licensed under the GPL version 2
+see "/usr/share/common-licenses/GPL-2".
Index: tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/rules
===================================================================
--- tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/rules	(revision 2244)
+++ tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/rules	(revision 2244)
@@ -0,0 +1,7 @@
+#!/usr/bin/make -f
+
+DEB_TRANSFORM_FILES_scripts-syslog-ng-config = /etc/syslog-ng/syslog-ng.conf.divert
+
+include /usr/share/cdbs/1/rules/debhelper.mk
+include /usr/share/cdbs/1/rules/config-package.mk
+
Index: tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/scripts-syslog-ng-config.install
===================================================================
--- tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/scripts-syslog-ng-config.install	(revision 2244)
+++ tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/scripts-syslog-ng-config.install	(revision 2244)
@@ -0,0 +1,1 @@
+d_zroot.pl /usr/lib/scripts-syslog-ng-config/
Index: tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/scripts-syslog-ng-config.postinst
===================================================================
--- tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/scripts-syslog-ng-config.postinst	(revision 2244)
+++ tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/scripts-syslog-ng-config.postinst	(revision 2244)
@@ -0,0 +1,44 @@
+#!/bin/sh
+# postinst script for scripts-syslog-ng-config
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postinst> `configure' <most-recently-configured-version>
+#        * <old-postinst> `abort-upgrade' <new version>
+#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
+#          <new-version>
+#        * <postinst> `abort-remove'
+#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
+#          <failed-install-package> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see http://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+
+case "$1" in
+    configure)
+	if hash invoke-rc.d > /dev/null 2>&1; then
+	    invoke-rc.d syslog-ng restart || :
+	else
+	    /etc/init.d/syslog-ng restart || :
+	fi
+    ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+    ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
Index: tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/transform_syslog-ng.conf.divert
===================================================================
--- tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/transform_syslog-ng.conf.divert	(revision 2244)
+++ tags/fc15-eol/host/debian/scripts-syslog-ng-config/debian/transform_syslog-ng.conf.divert	(revision 2244)
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+cat
+cat <<EOF
+
+# Zephyr to scripts
+destination d_zroot { program("/usr/lib/scripts-syslog-ng-config/d_zroot.pl"); };
+filter f_oom { facility(kern) and (message("Out of memory:") or message("Killed process")); };
+log { source(s_src); filter(f_auth); destination(d_zroot); };
+log { source(s_src); filter(f_oom); destination(d_zroot); };
+EOF
Index: tags/fc15-eol/host/debian/scripts-vm-host/conserver-sudoers
===================================================================
--- tags/fc15-eol/host/debian/scripts-vm-host/conserver-sudoers	(revision 2244)
+++ tags/fc15-eol/host/debian/scripts-vm-host/conserver-sudoers	(revision 2244)
@@ -0,0 +1,1 @@
+conservr ALL=(ALL) NOPASSWD: /usr/sbin/xm console *
Index: tags/fc15-eol/host/debian/scripts-vm-host/conserver.cf.divert
===================================================================
--- tags/fc15-eol/host/debian/scripts-vm-host/conserver.cf.divert	(revision 2244)
+++ tags/fc15-eol/host/debian/scripts-vm-host/conserver.cf.divert	(revision 2244)
@@ -0,0 +1,21 @@
+config * {
+       sslrequired no;
+}
+default full {
+	rw *;
+}
+default * {
+	logfile /var/log/conserver/&.log;
+	timestamp "1lab";
+	include full;
+	sslrequired no;
+	options reinitoncc;
+}
+default xen {
+        type exec;
+        exec sudo xm console f;
+        execsubst f=cs;
+}
+access * {
+       trusted 127.0.0.1;
+}
Index: tags/fc15-eol/host/debian/scripts-vm-host/debian/changelog
===================================================================
--- tags/fc15-eol/host/debian/scripts-vm-host/debian/changelog	(revision 2244)
+++ tags/fc15-eol/host/debian/scripts-vm-host/debian/changelog	(revision 2244)
@@ -0,0 +1,29 @@
+scripts-vm-host (0.5) stable; urgency=low
+
+  * Add useful dependencies
+
+ -- Quentin Smith <quentin@mit.edu>  Sun, 11 Sep 2011 23:44:32 -0400
+
+scripts-vm-host (0.4) stable; urgency=low
+
+  * Depend on scripts-syslog-ng-config
+
+ -- Alexander Chernaykhovsky <achernya@mit.edu>  Mon, 05 Sep 2011 15:19:01 -0400
+
+scripts-vm-host (0.3) stable; urgency=low
+
+  * Rebuild for inclusion in Scripts APT repository
+
+ -- Alexander Chernyakhovsky <achernya@mit.edu>  Sun, 04 Sep 2011 20:57:55 -0400
+
+scripts-vm-host (0.2) unstable; urgency=low
+
+  * Uhh, actually depend on c-p-d
+
+ -- Quentin Smith <quentin@mit.edu>  Sat, 18 Jun 2011 15:36:44 -0400
+
+scripts-vm-host (0.1) unstable; urgency=low
+
+  * Initial release
+
+ -- Quentin Smith <quentin@mit.edu>  Wed, 08 Jun 2011 23:22:31 -0400
Index: tags/fc15-eol/host/debian/scripts-vm-host/debian/compat
===================================================================
--- tags/fc15-eol/host/debian/scripts-vm-host/debian/compat	(revision 2244)
+++ tags/fc15-eol/host/debian/scripts-vm-host/debian/compat	(revision 2244)
@@ -0,0 +1,1 @@
+7
Index: tags/fc15-eol/host/debian/scripts-vm-host/debian/control
===================================================================
--- tags/fc15-eol/host/debian/scripts-vm-host/debian/control	(revision 2244)
+++ tags/fc15-eol/host/debian/scripts-vm-host/debian/control	(revision 2244)
@@ -0,0 +1,52 @@
+Source: scripts-vm-host
+Section: misc
+Priority: extra
+Maintainer: scripts team <scripts-team@mit.edu>
+Build-Depends: cdbs, debhelper (>= 7.0.50~), config-package-dev, munin-node
+Standards-Version: 3.9.1
+Homepage: http://scripts.mit.edu/
+
+Package: scripts-vm-host
+Architecture: all
+Depends: ${misc:Depends},
+ apticron,
+ build-essential,
+ bwm-ng,
+ bzip2,
+ emacs23-nox,
+ ethtool,
+ git,
+ htop,
+ i2c-tools,
+ ipmitool,
+ kpartx,
+ lm-sensors,
+ memtest86+,
+ memtest86,
+ mii-diag,
+ molly-guard,
+ mtr-tiny,
+ nbd-client,
+ nbd-server,
+ ntp,
+ ntpdate,
+ rlwrap,
+ smartmontools,
+ strace,
+ tcpdump,
+ tree,
+ vim,
+ xen-linux-system,
+ debathena-clients,
+ debathena-ssh-server-config,
+ sudo,
+ conserver-client,
+ conserver-server,
+ munin-node,
+ subversion,
+ screen,
+ scripts-syslog-ng-config,
+ sysstat,
+Description: Configures a machine to be a scripts VM host
+ Configures a machine to be a scripts VM host, installing all
+ appropriate dependencies.
Index: tags/fc15-eol/host/debian/scripts-vm-host/debian/copyright
===================================================================
--- tags/fc15-eol/host/debian/scripts-vm-host/debian/copyright	(revision 2244)
+++ tags/fc15-eol/host/debian/scripts-vm-host/debian/copyright	(revision 2244)
@@ -0,0 +1,22 @@
+This work was packaged for Debian by:
+
+    Quentin Smith <quentin@mit.edu> on Wed, 08 Jun 2011 23:22:31 -0400
+
+It was downloaded from:
+
+    http://scripts.mit.edu
+
+Copyright:
+
+    Copyright (C) 2011 Quentin Smith
+
+License:
+
+    GPLv2+
+
+The Debian packaging is:
+
+    Copyright (C) 2011 Quentin Smith <quentin@mit.edu>
+
+and is licensed under the GPL version 2
+see "/usr/share/common-licenses/GPL-2".
Index: tags/fc15-eol/host/debian/scripts-vm-host/debian/rules
===================================================================
--- tags/fc15-eol/host/debian/scripts-vm-host/debian/rules	(revision 2244)
+++ tags/fc15-eol/host/debian/scripts-vm-host/debian/rules	(revision 2244)
@@ -0,0 +1,8 @@
+#!/usr/bin/make -f
+
+DEB_DIVERT_FILES_scripts-vm-host = /etc/conserver/conserver.cf.divert
+DEB_TRANSFORM_FILES_scripts-vm-host = /etc/munin/munin-node.conf.divert
+
+include /usr/share/cdbs/1/rules/debhelper.mk
+include /usr/share/cdbs/1/rules/config-package.mk
+
Index: tags/fc15-eol/host/debian/scripts-vm-host/debian/scripts-vm-host.install
===================================================================
--- tags/fc15-eol/host/debian/scripts-vm-host/debian/scripts-vm-host.install	(revision 2244)
+++ tags/fc15-eol/host/debian/scripts-vm-host/debian/scripts-vm-host.install	(revision 2244)
@@ -0,0 +1,3 @@
+gitconfig /etc
+conserver.cf.divert /etc/conserver
+conserver-sudoers /etc/sudoers.d
Index: tags/fc15-eol/host/debian/scripts-vm-host/debian/scripts-vm-host.postinst
===================================================================
--- tags/fc15-eol/host/debian/scripts-vm-host/debian/scripts-vm-host.postinst	(revision 2244)
+++ tags/fc15-eol/host/debian/scripts-vm-host/debian/scripts-vm-host.postinst	(revision 2244)
@@ -0,0 +1,47 @@
+#!/bin/sh
+# postinst script for #PACKAGE#
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postinst> `configure' <most-recently-configured-version>
+#        * <old-postinst> `abort-upgrade' <new version>
+#        * <conflictor's-postinst> `abort-remove' `in-favour' <package>
+#          <new-version>
+#        * <postinst> `abort-remove'
+#        * <deconfigured's-postinst> `abort-deconfigure' `in-favour'
+#          <failed-install-package> <version> `removing'
+#          <conflicting-package> <version>
+# for details, see http://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+
+case "$1" in
+    configure)
+	debconf-set-selections <<EOF
+exim4-config	exim4/dc_eximconfig_configtype	select	mail sent by smarthost; no local mail
+exim4-config	exim4/dc_postmaster	string	scripts-root@mit.edu
+exim4-config	exim4/dc_smarthost	string	outgoing.mit.edu
+exim4-config	exim4/use_split_config	boolean	false
+exim4-config	exim4/dc_minimaldns	boolean	false
+EOF
+	invoke-rc.d munin-node restart
+    ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+    ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
Index: tags/fc15-eol/host/debian/scripts-vm-host/debian/transform_munin-node.conf.divert
===================================================================
--- tags/fc15-eol/host/debian/scripts-vm-host/debian/transform_munin-node.conf.divert	(revision 2244)
+++ tags/fc15-eol/host/debian/scripts-vm-host/debian/transform_munin-node.conf.divert	(revision 2244)
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+cat
+cat <<EOF
+allow ^127\.0\.0\.1$
+allow ^18\.187\.1\.128$
+allow ^18\.181\.0\.65$
+allow ^18\.181\.0\.51$
+EOF
Index: tags/fc15-eol/host/debian/scripts-vm-host/gitconfig
===================================================================
--- tags/fc15-eol/host/debian/scripts-vm-host/gitconfig	(revision 2244)
+++ tags/fc15-eol/host/debian/scripts-vm-host/gitconfig	(revision 2244)
@@ -0,0 +1,2 @@
+[color]
+	ui = auto
Index: tags/fc15-eol/host/doc/install-xen
===================================================================
--- tags/fc15-eol/host/doc/install-xen	(revision 2244)
+++ tags/fc15-eol/host/doc/install-xen	(revision 2244)
@@ -0,0 +1,52 @@
+# install Squeeze
+ # Configure each drive with a 1G partition and a rest-of-the-space partition, as RAID
+ # Create a RAID1 for the 1G partitions
+ # Create a RAID1 for each pair of rest-of-the-space partitions
+ # Create an ext3 /boot on the 1G RAID1
+ # Create an LVM volume group named after the machine's short hostname
+ # Create an LV called "swap" that is the same size as the machine's physical RAM
+ # Create an LV called "root" that is 50G ext4
+
+# ??? F11 will suggest ext4, DON'T USE IT.
+#   - New filesystem, so it's scary
+#   - The hosts can't mount it
+#   - Grub can't cope with it
+
+# download Debathena archive key, verify
+  (aptitude install debian-keyring &&
+  cd /tmp &&
+  wget http://debathena.mit.edu/apt/debathena-archive.asc &&
+  kcr_fingerprint=$(gpg --keyring /usr/share/keyrings/debian-keyring.gpg --no-default-keyring --list-keys --with-colons kcr@debian.org | grep ^pub | cut -f 5 -d :) &&
+  gpg --primary-keyring /tmp/debathena.gpg --no-default-keyring --import debathena-archive.asc &&
+  gpg --primary-keyring /tmp/debathena.gpg --no-default-keyring --refresh-keys &&
+  gpg --primary-keyring /tmp/debathena.gpg --no-default-keyring --keyring /usr/share/keyrings/debian-keyring.gpg --check-sigs --with-colons debathena@mit.edu | grep '^sig:!' | cut -d: -f5 | grep -q $kcr_fingerprint &&
+  gpg --primary-keyring /tmp/debathena.gpg --no-default-keyring --export debathena@mit.edu | apt-key adv --import)
+
+# add Debathena repos to etc/apt/sources.list.d
+  cat <<EOF > /etc/apt/sources.list.d/debathena.list
+deb http://debathena.mit.edu/apt squeeze debathena debathena-config debathena-system openafs
+deb-src http://debathena.mit.edu/apt squeeze debathena debathena-config debathena-system openafs
+EOF
+
+# (on HPs) add HP repos to etc/apt/sources.list.d
+  cat <<EOF > /etc/apt/sources.list.d/hp.list
+deb http://downloads.linux.hp.com/SDR/downloads/ProLiantSupportPack/ maverick/current non-free
+EOF
+
+# install host keytab
+  cp $keytab /etc/krb5.keytab
+  k5srvutil change
+  k5srvutil delold
+# install ~/.k5login
+# clone the xen config (/etc/xen)
+    git clone -b squeeze ssh://scripts@scripts.mit.edu/mit/scripts/git/xen.git /etc/xen
+
+# Install scripts-vm-host
+  aptitude update
+  aptitude install scripts-vm-host
+
+# (on HPs) install HP software
+  aptitude install hpacucli hp-health
+
+# Configure exim4 to use smarthost (outgoing.mit.edu), no local mail
+dpkg-reconfigure exim4-config
Index: tags/fc15-eol/locker/bin/cronload
===================================================================
--- tags/fc15-eol/locker/bin/cronload	(revision 2244)
+++ tags/fc15-eol/locker/bin/cronload	(revision 2244)
@@ -0,0 +1,41 @@
+#!/bin/sh
+
+usage="Usage \"$0 [-l lockername] [-h] crontab\""
+while getopts "l:h" options; do
+    case $options in 
+        l ) lname=$OPTARG;;
+        h ) echo "$usage"; exit 0;;
+        * ) echo "$usage"; exit 1;;
+    esac
+done
+shift `expr $OPTIND - 1`
+if [ -z "$1" ]; then
+    echo "$usage"
+    exit 1
+fi
+
+echo "This program should print your new crontab below."
+echo "If it does not do so, something is wrong."
+echo "Feel free to contact scripts@mit.edu for assistance."
+echo
+
+
+cwd=`pwd`
+if [ -z "$lname" ]; then
+    lname=`perl -e "\\\$temp = \"$cwd\"; \\\$temp =~ /\\\/([^\\\/]+)\\\/cron_scripts/; print \\\$1"`
+fi
+if [ -z "$lname" ]; then
+    echo "ERROR: Could not detect locker name. Make sure to run"
+    echo "cronload from within /mit/lockername/cron_scripts/"
+    echo "(or pass the -l lockername option)"
+    exit 1
+fi
+athrun scripts scripts-ssh "$lname" /usr/local/bin/cronload "$1" "$cwd" 2>/dev/null
+if ! grep -q "^MAILTO=" "$1"; then
+    echo "WARNING: You have no MAILTO= variable set. This means any"
+    echo "cron errors will go to $lname@scripts.mit.edu (your mail_scripts"
+    echo "account), which is almost certainly not what you want!"
+    echo "Please add a MAILTO= line, e.g., MAILTO=${EMAIL:-${ATHENA_USER:-$USER}@mit.edu},"
+    echo "to your crontab. If you do not want to receive errors, set"
+    echo 'MAILTO="".'
+fi
Index: tags/fc15-eol/locker/bin/crontab
===================================================================
--- tags/fc15-eol/locker/bin/crontab	(revision 2244)
+++ tags/fc15-eol/locker/bin/crontab	(revision 2244)
@@ -0,0 +1,35 @@
+# scripts.mit.edu sample crontab as of SCRIPTS_DATE
+# To load this crontab, run "cronload crontab" in your cron_scripts directory
+# (On athena, you must run "add scripts" before cronload)
+
+# This line sets a reasonable default path
+PATH=/mit/SCRIPTS_USER/cron_scripts:/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/X11R6/bin
+
+# This line mails the STDOUT and STDERR of every cron script to a person
+# (can be useful for debugging)
+# You can always redirect the output of individual commands to /dev/null
+MAILTO="ATHENA_USER@mit.edu"
+# If you do not want to receive any mail from cron, use the line below instead
+#MAILTO=""
+
+# Add your cron lines here:
+
+
+# Here's a reminder of the cron line format:
+
+#  * * * * * command to be executed
+#  - - - - -
+#  | | | | |
+#  | | | | ----- day of week (0 - 6) (Sunday=0)
+#  | | | ------- month (1 - 12)
+#  | | --------- day of month (1 - 31)
+#  | ----------- hour (0 - 23)
+#  ------------- min (0 - 59)
+
+# For example, the following cron line would write "Work harder!" to STDOUT
+# every 20 minutes from 8am - 5pm on weekdays
+# (and this message would thus be e-mailed to the address above on each run) 
+
+# 0,20,40 8-17 * * 1-5 echo "Work harder!"
+
+# See http://en.wikipedia.org/wiki/Cron (or google for crontab) for more info
Index: tags/fc15-eol/locker/bin/disable-scripts-test
===================================================================
--- tags/fc15-eol/locker/bin/disable-scripts-test	(revision 2244)
+++ tags/fc15-eol/locker/bin/disable-scripts-test	(revision 2244)
@@ -0,0 +1,5 @@
+#!/bin/sh
+echo Removing iptables rules.
+iptables -t nat -D OUTPUT -d 18.181.0.46 -j DNAT --to-destination 18.181.0.229
+iptables -t nat -D OUTPUT -d 18.181.0.43 -j DNAT --to-destination 18.181.0.229
+iptables -t nat -D OUTPUT -d 18.181.0.50 -j DNAT --to-destination 18.181.0.229
Index: tags/fc15-eol/locker/bin/enable-scripts-test
===================================================================
--- tags/fc15-eol/locker/bin/enable-scripts-test	(revision 2244)
+++ tags/fc15-eol/locker/bin/enable-scripts-test	(revision 2244)
@@ -0,0 +1,5 @@
+#!/bin/sh
+echo Adding iptables rules.
+iptables -t nat -A OUTPUT -d 18.181.0.46 -j DNAT --to-destination 18.181.0.229
+iptables -t nat -A OUTPUT -d 18.181.0.43 -j DNAT --to-destination 18.181.0.229
+iptables -t nat -A OUTPUT -d 18.181.0.50 -j DNAT --to-destination 18.181.0.229
Index: tags/fc15-eol/locker/bin/firefox-test
===================================================================
--- tags/fc15-eol/locker/bin/firefox-test	(revision 2244)
+++ tags/fc15-eol/locker/bin/firefox-test	(revision 2244)
@@ -0,0 +1,5 @@
+#!/bin/sh
+attach -q scripts
+LD_PRELOAD=/mit/scripts/scripts-test/@sys/scripts-test-preload.so
+export LD_PRELOAD
+exec firefox -no-remote
Index: tags/fc15-eol/locker/bin/fix-php-ini
===================================================================
--- tags/fc15-eol/locker/bin/fix-php-ini	(revision 2244)
+++ tags/fc15-eol/locker/bin/fix-php-ini	(revision 2244)
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+# This script is meant to help people who have somehow lost their
+# php.ini files.  It is meant to be run in the top level directory
+# of an application once a reasonable php.ini file has been placed
+# there, and will make the symlinks to it in all child directories.
+
+if [ -f php.ini ]; then
+	echo "Creating php.ini symlinks in child directories..."
+	athrun scripts gfind . -mindepth 1 -type d \( -not -name .svn -not -name .git -or -not -prune \) -exec sh -c 'ln -sf "`echo "$1" | sed '\''s,[^/],,g; s,/,../,g'\''`php.ini" "$1/"' -- {} \;
+	echo "Done!"
+else
+	echo "There is no php.ini file in this directory.  You should first"
+	echo "put a valid php.ini file in the top level directory of your"
+	echo "application, then change to that directory, and then run this"
+	echo "script to make the symlinks to your php.ini file from all the"
+	echo "child directories."
+	exit 1
+fi
+
Index: tags/fc15-eol/locker/bin/fix-php-ini-scripts
===================================================================
--- tags/fc15-eol/locker/bin/fix-php-ini-scripts	(revision 2244)
+++ tags/fc15-eol/locker/bin/fix-php-ini-scripts	(revision 2244)
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+# This script is meant to help people who have somehow lost their
+# php.ini files.  It is meant to be run in the top level directory
+# of an application once a reasonable php.ini file has been placed
+# there, and will make the symlinks to it in all child directories.
+
+if [ -f php.ini ]; then
+	echo "Creating php.ini symlinks in child directories..."
+	find . -mindepth 1 -type d -exec sh -c 'ln -sf "`echo "$1" | sed '\''s,[^/],,g; s,/,../,g'\''`php.ini" "$1/"' -- {} \;
+	echo "Done!"
+else
+	echo "There is no php.ini file in this directory.  You should first"
+	echo "put a valid php.ini file in the top level directory of your"
+	echo "application, then change to that directory, and then run this"
+	echo "script to make the symlinks to your php.ini file from all the"
+	echo "child directories."
+	exit 1
+fi
+
Index: tags/fc15-eol/locker/bin/for-each-server
===================================================================
--- tags/fc15-eol/locker/bin/for-each-server	(revision 2244)
+++ tags/fc15-eol/locker/bin/for-each-server	(revision 2244)
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+for server in `finger @scripts.mit.edu | sed -n -e "1,5d" -e "s/  -> \([^:]*\):.*/\1/p" | sort -u`; do
+    ssh "$server" "$@"
+done
Index: tags/fc15-eol/locker/bin/fssar
===================================================================
--- tags/fc15-eol/locker/bin/fssar	(revision 2244)
+++ tags/fc15-eol/locker/bin/fssar	(revision 2244)
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+exec athrun consult fsr sa . "$@"
Index: tags/fc15-eol/locker/bin/gfind
===================================================================
--- tags/fc15-eol/locker/bin/gfind	(revision 2244)
+++ tags/fc15-eol/locker/bin/gfind	(revision 2244)
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+if find / -maxdepth 0 >/dev/null >&2; then
+	exec find "$@"
+else
+	exec athrun gnu gfind "$@"
+fi
Index: tags/fc15-eol/locker/bin/gtar
===================================================================
--- tags/fc15-eol/locker/bin/gtar	(revision 2244)
+++ tags/fc15-eol/locker/bin/gtar	(revision 2244)
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+gnu=`tar --version 2>/dev/null | grep -i gnu`
+if [ "$gnu" != "" ]; then
+	exec tar "$@"
+else
+	exec athrun gnu gtar "$@"
+fi
Index: tags/fc15-eol/locker/bin/procmailrc
===================================================================
--- tags/fc15-eol/locker/bin/procmailrc	(revision 2244)
+++ tags/fc15-eol/locker/bin/procmailrc	(revision 2244)
@@ -0,0 +1,3 @@
+:0
+*
+! SCRIPTS_USER@mit.edu
Index: tags/fc15-eol/locker/bin/scripts
===================================================================
--- tags/fc15-eol/locker/bin/scripts	(revision 2244)
+++ tags/fc15-eol/locker/bin/scripts	(revision 2244)
@@ -0,0 +1,30 @@
+#!/bin/sh
+
+choices () {
+    echo 'scripts-start Begin a Quick-Start autoinstall (wikis, blogs, etc.)'
+    echo 'signup-web Enable the web scripts service'
+    echo 'signup-cron Enable the cron scripts service'
+    echo 'signup-mail Enable the mail scripts service'
+    echo 'signup-sql Sign up for a sql.mit.edu account'
+}
+
+nchoices=`choices | wc -l`
+
+echo
+echo "Welcome to scripts.mit.edu. Which service would you like to use?"
+echo
+choices | sed 's/^[^ ]* //' | cat -n
+echo
+printf "Please enter a number 1-%d: " "$nchoices"
+read num
+echo
+
+attach scripts 2>/dev/null
+choice=`choices | sed -n "$num { s/ .*$//; p; }"`
+if [ -n "$choice" ]; then
+  . "/mit/scripts/bin$scriptsdev/$choice"
+else
+  echo "ERROR:"
+  echo "You must enter a number 1 through $nchoices."
+  exit 1
+fi
Index: tags/fc15-eol/locker/bin/scripts-django
===================================================================
--- tags/fc15-eol/locker/bin/scripts-django	(revision 2244)
+++ tags/fc15-eol/locker/bin/scripts-django	(revision 2244)
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+sname="Django"
+deploy="django"
+prompt_username=1
+create_scripts_dir=1
+. /mit/scripts/deploy$scriptsdev/bin/onathena
Index: tags/fc15-eol/locker/bin/scripts-gallery2
===================================================================
--- tags/fc15-eol/locker/bin/scripts-gallery2	(revision 2244)
+++ tags/fc15-eol/locker/bin/scripts-gallery2	(revision 2244)
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+sname="Gallery2"
+deploy="gallery2"
+prompt_username=1
+create_dir=1
+
+. /mit/scripts/deploy$scriptsdev/bin/onathena
Index: tags/fc15-eol/locker/bin/scripts-git
===================================================================
--- tags/fc15-eol/locker/bin/scripts-git	(revision 2244)
+++ tags/fc15-eol/locker/bin/scripts-git	(revision 2244)
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+sname="git repository"
+deploy="git"
+create_scripts_dir=1
+requires_sql=0
+prompt_username=1
+prompt_password=0
+. /mit/scripts/deploy$scriptsdev/bin/onathena
Index: tags/fc15-eol/locker/bin/scripts-joomla
===================================================================
--- tags/fc15-eol/locker/bin/scripts-joomla	(revision 2244)
+++ tags/fc15-eol/locker/bin/scripts-joomla	(revision 2244)
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+sname="Joomla"
+deploy="joomla"
+. /mit/scripts/deploy$scriptsdev/bin/onathena
Index: tags/fc15-eol/locker/bin/scripts-mediawiki
===================================================================
--- tags/fc15-eol/locker/bin/scripts-mediawiki	(revision 2244)
+++ tags/fc15-eol/locker/bin/scripts-mediawiki	(revision 2244)
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+sname="MediaWiki"
+deploy="mediawiki"
+prompt_username=1
+wizard="mediawiki"
+. /mit/scripts/deploy$scriptsdev/bin/onathena
Index: tags/fc15-eol/locker/bin/scripts-phpbb
===================================================================
--- tags/fc15-eol/locker/bin/scripts-phpbb	(revision 2244)
+++ tags/fc15-eol/locker/bin/scripts-phpbb	(revision 2244)
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+sname="phpBB"
+deploy="phpbb"
+. /mit/scripts/deploy$scriptsdev/bin/onathena
Index: tags/fc15-eol/locker/bin/scripts-rails
===================================================================
--- tags/fc15-eol/locker/bin/scripts-rails	(revision 2244)
+++ tags/fc15-eol/locker/bin/scripts-rails	(revision 2244)
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+sname="Ruby on Rails"
+deploy="rails"
+prompt_password=0
+# The following is sort of a lie.  Rails wants three databases (dev/test/prod),
+# so the rails script will handle it manually.
+requires_sql=0
+. /mit/scripts/deploy$scriptsdev/bin/onathena
Index: tags/fc15-eol/locker/bin/scripts-remove
===================================================================
--- tags/fc15-eol/locker/bin/scripts-remove	(revision 2244)
+++ tags/fc15-eol/locker/bin/scripts-remove	(revision 2244)
@@ -0,0 +1,162 @@
+#!/bin/bash
+
+if [ "$scriptsdev" != "" -a "$scriptsdev" != "dev" ]; then 
+    echo "ERROR:"
+    echo "The \$scriptsdev variable is set to an invalid value."
+    echo "(The variable should not be set.)"
+    echo "Please contact scripts@mit.edu."
+fi
+
+sshrun() {
+    athrun scripts scripts-ssh "$lname" "/mit/scripts/$@" 2>/dev/null
+}
+
+checksqlpass() {
+    errors=`sshrun "sql/bin$scriptsdev/test-password"`
+    if [ "$errors" != "" ]; then
+        if [ "$1" -eq 1 ]; then
+          rm -f "$lroot/.sql/my.cnf"
+        fi
+        echo
+        echo "ERROR:"
+        printf "$2"
+        exit 1
+    fi
+}
+attach scripts sql 2>/dev/null
+
+echo "Welcome to the scripts.mit.edu uninstaller. This program will"
+echo "help you cleanly remove software that you have auto-installed."
+echo
+echo "Are you removing an installation from:"
+echo "1. Your personal Athena account"
+echo "2. A locker that you control (a club, a course, etc.)"
+echo "If you do not understand this question, you should answer 1."
+printf "Please enter either 1 or 2: "
+read whofor
+if [ "$whofor" = 1 ]; then
+    lname=$USER
+    lroot=$HOME
+elif [ "$whofor" = 2 ]; then
+    echo
+    echo "Please enter the name of the selected locker below."
+    echo "(For the locker /mit/sipb, you would enter sipb.)"
+    read lname
+    lroot="/mit/$lname"
+else
+    echo
+    echo "ERROR:"
+    echo "You must select either 1 or 2."
+    exit 1
+fi
+attach "$lname" 2>/dev/null
+
+echo 
+echo "When you installed the software, you chose a URL"
+echo "that starts with http://$lname.scripts.mit.edu/"
+echo "(for software installed after March 2009) or"
+echo "http://scripts.mit.edu/~$lname/ (for software"
+echo "installed before then)."
+echo "Please enter the new-style full URL where this"
+echo "software was installed.  (This should correspond"
+echo "to a directory in /mit/$lname/web_scripts/.)"
+printf "%s" "URL: http://$lname.scripts.mit.edu/"
+read addrend
+
+addrend=`perl -0e 'print $ARGV[0] =~ /^([\w\/-]*[\w-])\/*$/' -- "$addrend"`
+if [ "$addrend" = "" ]; then
+    echo
+    echo "ERROR:"
+    echo "You must enter one or more characters after mit.edu/"
+    echo "The completed address must only contain a-z, 0-9, and /."
+    exit 1
+fi
+
+if [ ! -d "$lroot/web_scripts/$addrend" ]; then
+    echo
+    echo "ERROR:"
+    echo "The directory $lroot/web_scripts/$addrend"
+    echo "does not exist. Please make sure that this is the"
+    echo "correct installation directory, and try again, or"
+    echo "contact scripts@mit.edu for assistance."
+    exit 1
+fi
+
+echo
+
+sqlinfo=`sshrun "sql/bin$scriptsdev/get-password"`
+if [ "$sqlinfo" = "" ]; then
+    echo 
+    echo "You have a MySQL account but you do not have a .my.cnf file."
+    echo "If you do not remember your MySQL account password, you can change it"
+    echo "at http://sql.mit.edu using MIT certificates."
+    printf "Please type your MySQL password and press [enter]: "
+    stty -echo
+    read sqlpass
+    stty echo
+    echo
+    sqlhost="sql.mit.edu"
+    sqluser=$lname
+    . "/mit/scripts/sql/bin$scriptsdev/save-password"
+    checksqlpass 1 'The MySQL password that you typed appears to be incorrect.\n'
+    echo
+    echo "OK.  Continuing with the uninstaller..."
+else
+    checksqlpass 0 'The MySQL login information in your .my.cnf file\nappears to be incorrect.\n'
+fi
+
+sqldb=`sshrun "sql/bin$scriptsdev/get-next-database" "$addrend"`
+if [ "$sqldb" != "${addrend}1" -a "$sqldb" != "$addrend" ]; then
+    echo
+    echo "ERROR:"
+    echo "The auto-uninstaller was unable to find the appropriate"
+    echo "database to drop. Please examine the installation to"
+    echo "find the database it uses, drop the database from"
+    echo "http://sql.mit.edu/, and manually remove the $addrend"
+    echo "directory (or re-run the auto-installer). Contact"
+    echo "scripts@mit.edu if you need assistance."
+    exit 1
+fi
+
+echo "Removing files. Please wait..."
+echo "(This may take several seconds for large software.)"
+if rm -rf "$lroot/web_scripts/$addrend"; then
+    echo "The directory $lroot/web_scripts/$addrend"
+    echo "was successfully removed."
+    if [ -d "$lroot/OldFiles/web_scripts/$addrend" ]; then
+        echo "A one-day-old backup of the installation is"
+        echo "available from $lroot/OldFiles/web_scripts/$addrend".
+    fi
+else
+    echo "ERROR:"
+    echo "The directory $lroot/web_scripts/$addrend"
+    echo "could not be removed. Please ensure that you have"
+    echo "access to this directory and try again, or"
+    echo "contact scripts@mit.edu for assistance."
+    exit 1
+fi
+
+echo 
+if [ "$sqldb" = "${addrend}1" ]; then
+    sqldb="$lname+$addrend"
+    dropped=`sshrun "sql/bin$scriptsdev/drop-database" "$sqldb"`
+    if [ "$dropped" ]; then
+        echo "The database $sqldb"
+        echo "was successfully removed."
+        attach sql 2>/dev/null
+	if [ -f "/mit/sql/backup/$lname/$sqldb.sql.gz" ]; then
+            echo "A one-day-old backup of your SQL database is"
+            echo "available in /mit/sql/backup/$lname".
+        fi
+    else
+        echo "ERROR:"
+        echo "The database $lname+$addrend"
+        echo "could not be automatically removed. You can"
+        echo "try removing it from http://sql.mit.edu/,"
+        echo "or you can contact sql@mit.edu for assistance."
+        exit 1
+    fi
+fi
+echo
+echo "The installation in http://$lname.scripts.mit.edu/$addrend"
+echo "has been successfully uninstalled."
Index: tags/fc15-eol/locker/bin/scripts-ssh
===================================================================
--- tags/fc15-eol/locker/bin/scripts-ssh	(revision 2244)
+++ tags/fc15-eol/locker/bin/scripts-ssh	(revision 2244)
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+lname=$1
+shift
+
+exec ssh \
+	-o GSSAPIAuthentication=yes \
+	-o GSSAPIDelegateCredentials=no \
+	-o PreferredAuthentications=gssapi-with-mic \
+	-o ForwardX11=no \
+	-o GlobalKnownHostsFile=/afs/athena.mit.edu/contrib/scripts/etc/known_hosts \
+	-o UserKnownHostsFile=/dev/null \
+	-t \
+	scripts.mit.edu -l "$lname" "$(printf "''%q " "$@")"
+
+# ssh gets quoting wrong, so we do it ourself with printf "%q ".
+# Except bash 2 gets printf "%q " wrong for empty arguments, so we use
+# printf "''%q " instead.
+# Isn't software fun?
Index: tags/fc15-eol/locker/bin/scripts-start
===================================================================
--- tags/fc15-eol/locker/bin/scripts-start	(revision 2244)
+++ tags/fc15-eol/locker/bin/scripts-start	(revision 2244)
@@ -0,0 +1,35 @@
+#!/bin/sh
+
+choices () {
+    echo 'mediawiki MediaWiki'
+    echo 'wordpress WordPress'
+    echo 'gallery2 Gallery2'
+    echo 'phpbb phpBB'
+    echo 'joomla Joomla'
+    echo 'git Git repository'
+    echo 'trac Trac'
+    echo 'turbogears TurboGears'
+    echo 'django Django'
+    echo 'rails Ruby on Rails'
+}
+
+nchoices=`choices | wc -l`
+
+echo
+echo "What piece of software would you like to install?"
+echo
+choices | sed 's/^[^ ]* //' | cat -n
+echo
+printf "Please enter a number 1-%d: " "$nchoices"
+read num
+echo
+
+attach scripts 2>/dev/null
+choice=`choices | sed -n "$num { s/ .*$//; p; }"`
+if [ -n "$choice" ]; then
+  . "/mit/scripts/bin$scriptsdev/scripts-$choice"
+else
+  echo "ERROR:"
+  echo "You must enter a number 1 through $nchoices."
+  exit 1
+fi
Index: tags/fc15-eol/locker/bin/scripts-trac
===================================================================
--- tags/fc15-eol/locker/bin/scripts-trac	(revision 2244)
+++ tags/fc15-eol/locker/bin/scripts-trac	(revision 2244)
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+sname="Trac"
+deploy="trac"
+prompt_password=0
+. /mit/scripts/deploy$scriptsdev/bin/onathena
Index: tags/fc15-eol/locker/bin/scripts-turbogears
===================================================================
--- tags/fc15-eol/locker/bin/scripts-turbogears	(revision 2244)
+++ tags/fc15-eol/locker/bin/scripts-turbogears	(revision 2244)
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+sname="TurboGears"
+deploy="turbogears"
+prompt_password=0
+create_scripts_dir=1
+. /mit/scripts/deploy$scriptsdev/bin/onathena
Index: tags/fc15-eol/locker/bin/scripts-wordpress
===================================================================
--- tags/fc15-eol/locker/bin/scripts-wordpress	(revision 2244)
+++ tags/fc15-eol/locker/bin/scripts-wordpress	(revision 2244)
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+sname="WordPress"
+deploy="wordpress"
+prompt_password=0
+wizard="wordpress"
+. /mit/scripts/deploy$scriptsdev/bin/onathena
Index: tags/fc15-eol/locker/bin/signup
===================================================================
--- tags/fc15-eol/locker/bin/signup	(revision 2244)
+++ tags/fc15-eol/locker/bin/signup	(revision 2244)
@@ -0,0 +1,18 @@
+#!/bin/sh
+
+if [ "$1" = "web" ]; then
+    athrun scripts signup-web
+elif [ "$1" = "cron" ]; then
+    athrun scripts signup-cron
+elif [ "$1" = "mail" ]; then
+    athrun scripts signup-mail
+elif [ "$1" = "sql" ]; then
+    athrun scripts signup-sql
+else
+    echo "Scripts has multiple services you can sign up for:"
+    echo "    signup-web    Web script hosting"
+    echo "    signup-cron   Scheduled jobs"
+    echo "    signup-mail   Mail scripts"
+    echo "    signup-sql    MySQL hosting"
+    exit 1
+fi
Index: tags/fc15-eol/locker/bin/signup-cron
===================================================================
--- tags/fc15-eol/locker/bin/signup-cron	(revision 2244)
+++ tags/fc15-eol/locker/bin/signup-cron	(revision 2244)
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+attach -q scripts
+. /mit/scripts/bin$scriptsdev/signup-minimal
+
+if [ ! -d "/mit/$lname/cron_scripts/" ]; then
+  mkdir -p /mit/$lname/cron_scripts
+  fs sa /mit/$lname/cron_scripts system:anyuser l
+  fs sa /mit/$lname/cron_scripts system:authuser none
+  fs sa /mit/$lname/cron_scripts daemon.scripts write
+  DATE=`date`
+  signupuser=`echo "$principal" | sed 's/[/@].*$//'`
+  sed '/SCRIPTS_USER/s//'"$lname"'/g' /mit/scripts/bin$scriptsdev/crontab | sed '/ATHENA_USER/s//'"$signupuser"'/g' | sed '/SCRIPTS_DATE/s//'"$DATE"'/g' > /mit/$lname/cron_scripts/crontab
+  echo "By default, output from cron jobs for the $lname locker will be mailed"
+  echo "to $signupuser@mit.edu.  You should edit /mit/$lname/cron_scripts/crontab"
+  echo "to change this and set up your cron jobs."
+  success "the cron script service" "The directory /mit/$lname/cron_scripts has been created."
+else
+  success "the cron script service" "The directory /mit/$lname/cron_scripts already exists." 
+fi
Index: tags/fc15-eol/locker/bin/signup-mail
===================================================================
--- tags/fc15-eol/locker/bin/signup-mail	(revision 2244)
+++ tags/fc15-eol/locker/bin/signup-mail	(revision 2244)
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+attach -q scripts
+. /mit/scripts/bin$scriptsdev/signup-minimal
+
+if [ ! -d "/mit/$lname/mail_scripts/" ]; then
+  mkdir -p /mit/$lname/mail_scripts
+  fs sa /mit/$lname/mail_scripts system:anyuser l
+  fs sa /mit/$lname/mail_scripts system:authuser none
+  fs sa /mit/$lname/mail_scripts daemon.scripts read
+  signupuser=`echo "$principal" | sed 's/[/@].*$//'`
+  sed /SCRIPTS_USER/s//$signupuser/ /mit/scripts/bin/procmailrc > /mit/$lname/mail_scripts/procmailrc
+  echo "By default, mail sent to $lname@scripts.mit.edu will be forwarded to"
+  echo "$signupuser@mit.edu.  You should edit /mit/$lname/mail_scripts/procmailrc"
+  echo "to change this and customize your procmail configuration."
+  success "the mail script service" "The directory /mit/$lname/mail_scripts has been created."
+else
+  success "the mail script service" "The directory /mit/$lname/mail_scripts already exists."
+fi
Index: tags/fc15-eol/locker/bin/signup-minimal
===================================================================
--- tags/fc15-eol/locker/bin/signup-minimal	(revision 2244)
+++ tags/fc15-eol/locker/bin/signup-minimal	(revision 2244)
@@ -0,0 +1,126 @@
+#!/bin/bash
+
+if [ "$initlname" = "" ]; then
+  if [ "$lname" = "" ]; then
+    initlname=0
+  else
+    initlname=1
+  fi
+fi
+
+if type wget >/dev/null 2>/dev/null; then
+  WGET=wget
+else
+  WGET="athrun gnu wget"
+fi
+
+if [ "$lname" = "" ]; then
+  if [ "$1" = "" ]; then
+    echo
+    echo "Would you like to sign up:"
+    echo "1. Your personal Athena account"
+    echo "2. A locker that you control (a club, a course, etc)"
+    echo "If you do not understand this question, you should answer '1'."
+    printf "Please enter either '1' or '2' (without quotes): "
+    read whofor
+    if [ "$whofor" = 1 ]; then
+        lname="${ATHENA_USER:-$USER}"
+    elif [ "$whofor" = 2 ]; then
+        echo
+        echo "OK.  A locker of your choice that you control will be signed up."
+        echo "Please enter the name of the selected locker below."
+        echo "(For the locker /mit/sipb, you would enter sipb)."
+        printf "Locker name: "
+        read lname
+    else
+        echo
+        echo "ERROR:"
+        echo "You must select either '1' or '2'."
+        exit 1
+    fi
+    while true; do
+        if attach "$lname"; then
+            break
+        fi
+        echo "$lname is not a valid locker name."
+        printf "Locker name: "
+        read lname
+    done
+  else
+    lname="$1"
+  fi
+fi
+lroot="/mit/$lname" 
+
+attach "$lname" 2>/dev/null
+
+ans=`$WGET -q -O- "http://scripts.mit.edu/~signup/fsla.php/mit/$lname"`
+if [ "$ans" != "0" ]; then
+  echo
+  echo "ERROR:"
+  echo "The scripts servers cannot verify the permissions of the locker <$lname>."
+  echo "This is probably because your locker is not publicly listable."
+  echo "You can remedy this signup problem and make your locker publicly"
+  echo "listable by running \"fs setacl /mit/$lname system:anyuser l\""
+  echo "(that's a lowercase L at the end)."
+  echo ""
+  echo "NOTE: This will make it possible for the public (including anyone"
+  echo "viewing http://web.mit.edu/$lname) to see the names of your files"
+  echo "and the list of people who have access to them, though it will not"
+  echo "cause the contents of your files to be publicly readable.  If you"
+  echo "are unwilling to have your locker listable by the public, please"
+  echo "contact scripts@mit.edu for information about other ways to work"
+  echo "around the problem, or see http://scripts.mit.edu/faq/122 for more"
+  echo "detailed information."
+  exit 1
+fi
+
+principal=`klist -5 | sed -n 's/^Default principal: // p'`
+ans=`$WGET -q -O- "http://scripts.mit.edu/~signup/admof.php/$lname/$principal"`
+if [ "$ans" != "yes" ]; then
+  afsuser=`echo "$principal" | sed 's/@ATHENA.MIT.EDU$//'`
+  echo
+  echo "ERROR:"
+  echo "It appears as though you are not an administrator of the locker <$lname>."
+  echo "Try running \"fs setacl /mit/$lname $afsuser all\" and starting over."
+  echo "Contact scripts@mit.edu if you are unable to solve the problem."
+  exit 1
+fi
+
+mkdir -p "/mit/$lname/.scripts-signup"
+
+if [ ! -d "/mit/$lname/.scripts-signup" ]; then
+  echo
+  echo "ERROR:"
+  echo "It appears as though you do not have write access to the locker <$lname>."
+  echo "Contact scripts@mit.edu if you are unable to solve the problem."
+  exit 1
+fi
+
+ans=`$WGET -q -O- "http://scripts.mit.edu/~signup/$lname"`
+rmdir "/mit/$lname/.scripts-signup"
+
+if [ "$ans" = "done" ]; then
+  # nscd caches account nonexistence with a 5-second TTL.
+  # (LDAP updates are more or less instant.)
+  # Somehow, the server can wait up to 10 seconds...
+  echo "Creating scripts.mit.edu account for $lname..."
+  sleep 10
+fi
+
+if [ "$ans" != "done" ] && [ "$ans" != "username already taken" ]; then
+  echo "ERROR:"
+  echo "Signup reported the following error: \"$ans\"."
+  echo "Contact scripts@mit.edu for assistance."
+  exit 1
+fi
+
+success() {
+  if [ "$initlname" -eq 0 ]; then
+    echo
+    echo "== SUCCESS =="
+    echo "$lname is now signed up for $1."
+    echo "$2"
+    echo
+  fi
+}
Index: tags/fc15-eol/locker/bin/signup-sql
===================================================================
--- tags/fc15-eol/locker/bin/signup-sql	(revision 2244)
+++ tags/fc15-eol/locker/bin/signup-sql	(revision 2244)
@@ -0,0 +1,119 @@
+#!/bin/sh
+
+checkfailed() {
+  if [ -f "$lroot/web_scripts/$addrend/.failed" ]; then
+    rm -f $lroot/web_scripts/$addrend/.failed
+    exit 1
+  fi
+}
+
+sshrun() {
+  athrun scripts scripts-ssh "$lname" "/mit/scripts/$@" 2>/dev/null
+}
+
+vsshrun() {
+  athrun scripts scripts-ssh "$lname" "/mit/scripts/$@"
+}
+
+checksqlpass() {
+    errors=`sshrun "sql/bin$scriptsdev/test-password"`
+    if [ "$errors" != "" ]; then
+        if [ "$1" -eq 1 ]; then
+          rm -f $lroot/.sql/my.cnf
+        fi
+        echo
+        echo ERROR:
+        printf "$2"
+        printf "$3"
+        exit
+    fi
+}
+
+echo 
+echo == Welcome to the sql.mit.edu signup process ==
+echo
+
+echo "For documentation, including a link to the Athena rules of use,"
+echo "see <http://sql.mit.edu>."
+echo
+echo Please report problems with this signup process to sql@mit.edu.
+echo
+echo Are you performing this signup for:
+echo 1. Your personal Athena account
+echo 2. A locker that you control \(a club, a course, etc\)
+echo "If you do not understand this question, you should answer '1'".
+printf "Please enter either '1' or '2' (without quotes): "
+read whofor
+if [ "$whofor" -eq 1 ]; then
+    lname=$USER
+    lroot=$HOME 
+elif [ "$whofor" -eq 2 ]; then
+    echo
+    echo OK.  A MySQL account will be created for a locker of your choice that
+    echo you control.  Please enter the name of the selected locker below.
+    echo "(For the locker /mit/sipb, you would enter sipb)."
+    while true; do
+        printf "Locker name: "
+        read lname
+        if attach "$lname"; then
+            break
+        fi
+        echo "$lname is not a valid locker name."
+    done
+    lroot="/mit/$lname"
+else
+    echo
+    echo ERROR:
+    echo You must select either '1' or '2'.
+    exit 1
+fi
+
+# Users need to sign up for scripts.mit.edu so that they can
+# authenticate themselves to sql.mit.edu
+attach scripts
+. /mit/scripts/bin$scriptsdev/signup-web
+
+if [ "$requires_sql" = "" ]; then
+  requires_sql=1
+fi
+
+if [ ! -f "$lroot/.my.cnf" ]; then
+  mkdir -p $lroot/.sql
+  fs sa $lroot/.sql system:anyuser none
+  fs sa $lroot/.sql system:authuser none
+  fs sa $lroot/.sql daemon.scripts write
+  fs sa $lroot/.sql daemon.sql write
+  ln -nfs .sql/my.cnf $lroot/.my.cnf
+fi
+
+if [ "$requires_sql" -eq 1 ]; then
+  sqlinfo=`sshrun "sql/bin$scriptsdev/get-password"`
+  if [ "$sqlinfo" = "" ]; then
+      echo 
+      echo You already have a MySQL account but you do not have a .my.cnf file.
+      echo If you do not remember your MySQL account password, you can change it
+      echo at http://sql.mit.edu using MIT certificates. 
+      printf "Please type your MySQL password and press [enter]: "
+      stty -echo
+      read sqlpass
+      stty echo
+      echo
+      sqlhost="sql.mit.edu"
+      sqluser=$lname
+      . /mit/scripts/sql/bin$scriptsdev/save-password
+      checksqlpass 1 'The MySQL password that you typed appears to be incorrect.\n' ''
+      echo
+      echo OK.  Continuing with the install...
+  else
+      checksqlpass 0 'The MySQL login information in your .my.cnf file\n' 'appears to be incorrect.\n'
+  fi
+fi
+
+echo
+echo == Setup complete! ==
+echo Your MySQL login information has been written to the file
+echo "</mit/$lname/.sql/my.cnf>."
+echo You must use the sql.mit.edu web interface to add or drop databases.
+echo If you have trouble with your MySQL account, feel free to contact
+echo the sql.mit.edu team by e-mailing sql@mit.edu
+exit 0
Index: tags/fc15-eol/locker/bin/signup-web
===================================================================
--- tags/fc15-eol/locker/bin/signup-web	(revision 2244)
+++ tags/fc15-eol/locker/bin/signup-web	(revision 2244)
@@ -0,0 +1,18 @@
+#!/bin/sh
+
+attach -q scripts
+. "/mit/scripts/bin$scriptsdev/signup-minimal"
+
+if [ ! -d "/mit/$lname/web_scripts/" ]; then
+    mkdir -p "/mit/$lname/web_scripts"
+    fs sa "/mit/$lname/web_scripts" system:anyuser l
+    fs sa "/mit/$lname/web_scripts" system:authuser none
+    fs sa "/mit/$lname/web_scripts" system:scripts-security-upd rl
+    fs sa "/mit/$lname/web_scripts" daemon.scripts write
+    success "the web script service" "The directory /mit/$lname/web_scripts has been created."
+else 
+    success "the web script service" "The directory /mit/$lname/web_scripts already exists."
+fi
+if [ ! -f "/mit/$lname/web_scripts/.htaccess.mit" ]; then
+    ln -ns /afs/athena.mit.edu/contrib/scripts/www/web_scripts-.htaccess.mit /mit/$lname/web_scripts/.htaccess.mit
+fi
Index: tags/fc15-eol/locker/bin/ssh
===================================================================
--- tags/fc15-eol/locker/bin/ssh	(revision 2244)
+++ tags/fc15-eol/locker/bin/ssh	(revision 2244)
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+# add -r scripts
+if [ -x /bin/athena/attach ]; then
+  eval $(/bin/athena/attach -Padd -b -r scripts)
+fi
+
+exec ssh \
+	-o GSSAPIAuthentication=yes \
+	-o GSSAPIDelegateCredentials=no \
+	-o PreferredAuthentications=gssapi-with-mic \
+	-o ForwardX11=no \
+	-o GlobalKnownHostsFile=/afs/athena.mit.edu/contrib/scripts/etc/known_hosts \
+	-o UserKnownHostsFile=/dev/null \
+	"$@"
Index: tags/fc15-eol/locker/bin/sshmic
===================================================================
--- tags/fc15-eol/locker/bin/sshmic	(revision 2244)
+++ tags/fc15-eol/locker/bin/sshmic	(revision 2244)
@@ -0,0 +1,1 @@
+link ssh
Index: tags/fc15-eol/locker/bin/webaccess
===================================================================
--- tags/fc15-eol/locker/bin/webaccess	(revision 2244)
+++ tags/fc15-eol/locker/bin/webaccess	(revision 2244)
@@ -0,0 +1,223 @@
+#!/bin/bash
+
+# webaccess
+# Manage access control for scripts.mit.edu in .htaccess and .htpasswd files.
+# Anders Kaseorg <andersk@mit.edu>
+
+set -e
+
+on_exit=
+trap 'eval "$on_exit"' EXIT
+
+dir="$(pwd)"
+htaccess=$dir/.htaccess
+authuserfile=$dir/.htpasswd
+
+add_users=
+del_users=
+enable_auth=1
+def_authname=\"Private\"
+
+begin_section="### BEGIN webaccess directives"
+end_section="### END webaccess directives"
+
+usage () {
+    cat <<EOF >&2
+usage:
+  webaccess -a <user>   Allow access from <user> and set password.
+  webaccess -d <user>   Deny access from <user>.
+  webaccess -r          Reset default access control.
+EOF
+    exit 1
+}
+
+getpass () {
+    user=$1
+    (
+	echo -n "New password for $user: " >/dev/tty
+	trap 'stty echo; echo >/dev/tty' EXIT
+	stty -echo
+	perl -e 'chop($_ = <>); print crypt($_, "\$1\$" . join "", (".", "/", "0".."9", "A".."Z", "a".."z") [rand 64, rand 64, rand 64, rand 64, rand 64, rand 64, rand 64, rand 64])' </dev/tty
+    )
+}
+
+if [ $# -eq 0 ]; then usage; fi
+
+while [ $# -gt 0 ]; do
+    arg="$1"; shift
+    case "$arg" in
+	-a*)
+	    user="${arg#-a}"
+	    if [ -z "$user" ]; then user=$1; shift; fi
+	    if [ -z "$user" ]; then usage; fi
+	    add_users=$add_users\ $user
+	    ;;
+	allow)
+	    user="$1"; shift
+	    if [ -z "$user" ]; then usage; fi
+	    add_users=$add_users\ $user
+	    ;;
+	-d*)
+	    user="${arg#-d}"
+	    if [ -z "$user" ]; then user=$1; shift; fi
+	    if [ -z "$user" ]; then usage; fi
+	    del_users=$del_users\ $user
+	    ;;
+	remove)
+	    user="$1"; shift
+	    if [ -z "$user" ]; then usage; fi
+	    del_users=$del_users\ $user
+	    ;;
+	-r|reset)
+	    enable_auth=0
+	    ;;
+	-n*)
+	    authname="${arg#-n}"
+	    if [ -z "$authname" ]; then authname=\"$1\"; shift; fi
+	    if [ -z "$authname" ]; then usage; fi
+	    ;;
+	*)
+	    usage
+	    ;;
+    esac
+done
+
+tmp_htaccess=$htaccess.webaccess-new
+trap 'rm -f "$tmp_htaccess"' EXIT
+exec 3>"$tmp_htaccess"
+
+config_written=0
+write_config () {
+    if [ $config_written -eq 1 ]; then return 0; fi
+    config_written=1
+    if [ $enable_auth -eq 1 ]; then
+	echo "$begin_section" >&3
+	echo "# See http://scripts.mit.edu/faq/23" >&3
+	echo "AuthUserFile $authuserfile" >&3
+	echo "AuthName ${authname:-$def_authname}" >&3
+	echo "AuthType Basic" >&3
+	echo "Require valid-user" >&3
+	echo "$end_section" >&3
+    fi
+}
+
+if [ -e "$htaccess" ]; then
+    exec 4<"$htaccess"
+    
+    oldconfig_state=0
+    oldconfig_buffer=__END__
+    
+    while read -r line <&4; do
+	oldconfig_newstate=0
+	case "$line" in
+	    "AuthUserFile "*)     oldconfig_newstate=1 ;;
+	    "AuthName "*)         oldconfig_newstate=2; oldconfig_authname=${line#AuthName } ;;
+	    "AuthType Basic")     oldconfig_newstate=3 ;;
+	    "<Limit GET>")        oldconfig_newstate=4 ;;
+	    "require valid-user") oldconfig_newstate=5 ;;
+	    "</Limit>")           oldconfig_newstate=6 ;;
+	esac
+	
+	if [ $oldconfig_newstate -ne $(($oldconfig_state + 1)) ]; then
+	    if [ $oldconfig_state -ne 0 ]; then
+		echo "${oldconfig_buffer%
+__END__}" >&3
+		oldconfig_state=0
+		oldconfig_buffer=__END__
+	    fi
+	fi
+	
+	if [ "$line" = "$begin_section" ]; then
+	    while read -r line <&4 && [ "$line" != "$end_section" ]; do
+		case "$line" in
+		    "AuthName "*)
+			def_authname=${line#AuthName }
+			;;
+		esac
+	    done
+	    write_config
+	elif [ $oldconfig_newstate -eq $(($oldconfig_state + 1)) ]; then
+	    oldconfig_buffer=$(echo "${oldconfig_buffer%__END__}$line"; echo __END__)
+	    oldconfig_state=$oldconfig_newstate
+	    if [ $oldconfig_state -eq 6 ]; then
+		echo "Replacing obsolete webaccess configuration." >&2
+		oldconfig_state=0
+		oldconfig_buffer=__END__
+		def_authname=$oldconfig_authname
+	    fi
+	else
+	    echo "$line" >&3
+	fi
+    done
+    
+    if [ $oldconfig_state -ne 0 ]; then
+	echo "${oldconfig_buffer%
+__END__}"
+	oldconfig_state=0
+	oldconfig_buffer=__END__
+    fi
+    
+    exec 4<&-
+fi
+
+write_config
+
+exec 3>&-
+if ! cmp -s "$htaccess" "$tmp_htaccess"; then
+    if [ -s "$tmp_htaccess" ]; then
+	echo "Updating $htaccess" >&2
+	mv -f "$tmp_htaccess" "$htaccess"
+    else
+	if [ -e "$htaccess" ]; then
+	    echo "Deleting $htaccess" >&2
+	    rm -f "$htaccess"
+	fi
+	rm -f "$tmp_htaccess"
+    fi
+fi
+trap - EXIT
+
+if [ $enable_auth -eq 1 ]; then
+    if [ ! -e "$authuserfile" ]; then touch "$authuserfile"; fi
+    
+    tmp_authuserfile=$authuserfile.webaccess-new
+    trap 'rm -f "$tmp_authuserfile"' EXIT
+    exec 3>"$tmp_authuserfile"
+
+    exec 4<"$authuserfile"
+    while IFS=: read user pass <&4; do
+	for del_user in $del_users; do
+	    if [ "$del_user" = "$user" ]; then
+		echo "Deleting user $del_user:" >&2
+		pass=
+	    fi
+	done
+	new_add_users=
+	for add_user in $add_users; do
+	    if [ "$add_user" = "$user" ]; then
+		pass=$(getpass "$user")
+	    else
+		new_add_users=$new_add_users\ $add_user
+	    fi
+	done
+	add_users=$new_add_users
+	if [ -n "$pass" ]; then
+	    echo "$user:$pass" >&3
+	fi
+    done
+    exec 4<&-
+    
+    for add_user in $add_users; do
+	pass=$(getpass "$add_user")
+	echo "$add_user:$pass" >&3
+    done
+    
+    exec 3>&-
+    mv -f "$tmp_authuserfile" "$authuserfile"
+    trap - EXIT
+    
+    echo "Done.  New list of valid users:" >&2
+    sed -n 's/^\([^:]*\):.*$/  \1/ p' "$authuserfile"
+else
+    rm -f "$authuserfile"
+fi
Index: tags/fc15-eol/locker/cron/bin/cronload
===================================================================
--- tags/fc15-eol/locker/cron/bin/cronload	(revision 2244)
+++ tags/fc15-eol/locker/cron/bin/cronload	(revision 2244)
@@ -0,0 +1,135 @@
+#!/usr/bin/perl
+
+# Author: <quentin@mit.edu>
+
+use strict;
+use warnings;
+
+use File::Spec::Functions;
+use Getopt::Long;
+
+use constant {
+    CRON_DIR => "cron_scripts",
+    CRONTAB_FILE => "crontab",
+    AUTO_DIR => "AUTO",
+    SPOOL_DIR => "/mit/scripts/cron/crontabs",
+};
+
+my $force = 0;
+my $list = 0;
+my $pretend = 0;
+
+sub get_crontabs() {
+    my $crontab = catfile($ENV{"HOME"}, CRON_DIR, CRONTAB_FILE);
+    my $crontabdir = catdir($ENV{"HOME"}, CRON_DIR, AUTO_DIR);
+    
+    my @crontabs;
+    
+    opendir(CRONTABS, $crontabdir) or print "You don't have a ".CRON_DIR."/".AUTO_DIR."/ directory\n";
+    push(@crontabs, grep { -r $_ } map { catfile($crontabdir, $_) } grep { !/^[\.#]/ } readdir(CRONTABS));
+    closedir(CRONTABS);
+    
+    push (@crontabs, $crontab) if (-r $crontab);
+    return @crontabs;
+}
+
+sub read_crontab($) {
+    my ($file) = @_;
+    # local $/;
+    
+    open(CRONTAB, $file) or die "Couldn't read crontab $file!";
+    my @lines = <CRONTAB>;
+    close(CRONTAB);
+    
+    return @lines;
+}
+
+sub check_crontab(@) {
+    my (@lines) = @_;
+    
+    my @errors;
+    
+    foreach my $line (@lines) {
+        $line =~ s|#.*$||; # Remove comments
+        $line =~ s|^\s*(.*?)\s*$|$1|; # Remove whitespace
+        
+        if ($line =~ m|^\w[\w\d]*=|) {
+            # Comment
+            next;
+        } elsif ($line =~ m|^(?:(\S+)\s+){5}(.*)|) {
+            # Crontab line
+            my ($minute, $hour, $day, $month, $dow) = ($1,$2,$3,$4,$5);
+            # FIXME: Validate the time fields.
+            next;
+        } elsif ($line =~ m|^\s*$|) {
+            # Whitespace
+            next;
+        } else {
+            push(@errors, "Unrecognized crontab line:\n$line\n");
+        }
+    }
+    return @errors;
+}
+
+
+
+GetOptions("force|f+" => \$force,
+	   "list|l" => \$list,
+	   "pretend|p" => \$pretend);
+
+if ($list) {
+    my $file = catfile(SPOOL_DIR, $ENV{"USER"});
+    local $/;
+    open (CRONTAB, $file) or die "No crontab installed.\n";
+    print <CRONTAB>;
+    close (CRONTAB);
+    exit;
+}
+
+my @crontabs = get_crontabs();
+my @all_errors;
+my @final_crontab;
+my ($numvalid, $numinvalid) = (0,0);
+
+foreach my $crontab (@crontabs) {
+    push(@final_crontab, "### $crontab\n");
+    my @crontab = read_crontab($crontab);
+    my @errors = check_crontab(@crontab);
+    if (@errors == 0) {
+        print "$crontab is a valid crontab\n";
+        push(@final_crontab, @crontab);
+        $numvalid++;
+    } else {
+        print "$crontab has errors:\n";
+        push(@all_errors, scalar(@errors)." errors in $crontab:\n", @errors);
+        print join("\n", @errors);
+        $numinvalid++;
+        if ($force >= 2) {
+            push(@final_crontab, @crontab);
+        } else {
+            my $errors = join("\n", @errors);
+            $errors =~ s|^|# |mg;
+            push(@final_crontab, "## $crontab was not installed due to errors:\n", $errors);
+        }
+    }
+}
+if ($pretend) {
+    print "Would install this crontab:\n";
+    print @final_crontab;
+    exit;
+}
+
+if ($force < 1 && @all_errors) {
+    print "Not loading new crontab. Use -f to force.\n";
+    exit;
+}
+if ($force >= 2 && @all_errors) {
+    print "Loading $numvalid crontab ($numinvalid BROKEN!) files...\n";
+} else {
+    print "Loading $numvalid crontab files...\n";
+}
+
+# FIXME
+# Load @final_crontab somehow
+
+print "done.\n";
Index: tags/fc15-eol/locker/cron/bin/crontab
===================================================================
--- tags/fc15-eol/locker/cron/bin/crontab	(revision 2244)
+++ tags/fc15-eol/locker/cron/bin/crontab	(revision 2244)
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+# Author: <quentin@mit.edu>
+
+if [[ "$1" = "-l" ]]; then
+	`dirname $0`/cronload -l;
+else
+	cat <<EOF;
+To edit your user-specific crontab, edit ~/cron_scripts/crontab and run
+cronload. cronload will concatenate ~/cron_scripts/crontab with the
+contents of ~/cron_scripts/AUTO/ and load them into the cron
+system. To see the full contents of your crontab on the server, use
+crontab -l
+EOF
+fi
Index: tags/fc15-eol/locker/cron/bin/heartbeat
===================================================================
--- tags/fc15-eol/locker/cron/bin/heartbeat	(revision 2244)
+++ tags/fc15-eol/locker/cron/bin/heartbeat	(revision 2244)
@@ -0,0 +1,67 @@
+#!/bin/bash
+
+CRONROOT=/afs/athena.mit.edu/contrib/scripts/cron
+
+# Find our real hostname
+
+# This big long mess just results in a list of ip/name.
+for i in `/sbin/ip addr show dev eth0 | grep ' inet ' | cut -f 6 -d ' ' | cut -f 1 -d '/' | xargs -n 1 host | cut -f 1,5 -d ' ' | sed 'y/ /\//'`; do 
+	hostip=`echo $i | cut -f 1 -d '.'`
+	name=`echo $i | cut -f 2 -d '/'`
+	case $name in
+		SCRIPTS*) echo "$name";;
+		*) echo "Heartbeat for $name ($hostip)"; HOSTNAME=$name; HOSTIP=$hostip;;
+	esac;
+done
+
+# Tell everyone who's watching that we're alive
+touch $CRONROOT/servers/$HOSTNAME
+
+# Sleep based on our IP, in an attempt to not collide with another server also trying to gain control of the mirroring
+sleep $(($HOSTIP - 50))
+
+# Find the current master
+MASTER="DOES-NOT-EXIST"
+current_server () {
+	for i in $CRONROOT/server-crontabs/*; do
+		if [ -h $i ]; then
+			MASTER=`basename $i`
+			echo "Current master $MASTER"
+		fi
+	done
+}
+if lockfile -1 -r10 -l90 $CRONROOT/lock/heartbeat.lock; then
+    current_server
+
+	# The only way to compare times in bash is to compare the modtimes of two files.
+	compare=`mktemp /tmp/heartbeat-compare.XXXXXXXXXX`
+	touch -d '2 minutes ago' $compare
+	
+	if [[ $CRONROOT/servers/$MASTER -ot $compare ]]; then
+		# Master died! Take over.
+		echo "Master '$MASTER' died! Taking over."
+		for i in $CRONROOT/server-crontabs/*; do
+			if [ -h $i ]; then
+				echo rm $i
+				rm $i
+			else
+				echo rmdir $i
+				rmdir $i
+			fi
+		done
+		for i in $CRONROOT/servers/*; do
+			server=`basename $i`
+			case $server in
+				$HOSTNAME)
+					echo ln -s ../crontabs/ $CRONROOT/server-crontabs/$HOSTNAME
+					ln -s ../crontabs/ $CRONROOT/server-crontabs/$HOSTNAME;;
+				*)
+					echo mkdir $CRONROOT/server-crontabs/$server
+					mkdir $CRONROOT/server-crontabs/$server;;
+			esac;
+		done;
+	fi
+
+	rm $compare
+    rm -f $CRONROOT/lock/heartbeat.lock
+fi
Index: tags/fc15-eol/locker/cron/doc/cron-commands.txt
===================================================================
--- tags/fc15-eol/locker/cron/doc/cron-commands.txt	(revision 2244)
+++ tags/fc15-eol/locker/cron/doc/cron-commands.txt	(revision 2244)
@@ -0,0 +1,74 @@
+$ crontab *
+
+To edit your user-specific crontab, edit ~/cron_scripts/crontab and run
+cronload. cronload will concatenate ~/cron_scripts/crontab with the
+contents of ~/cron_scripts/AUTO/ and load them into the cron
+system. To see the full contents of your crontab on the server, use
+crontab -l
+
+$ crontab -l
+$ cronload -l
+
+#### Generated by cronload. See crontab -h.
+### ~/cron_scripts/AUTO/cacti
+foo
+### ~/cron_scripts/AUTO/gallery
+bar
+### ~/cron_scripts/crontab
+baz
+
+$ cronload
+
+~/cron_scripts/AUTO/cacti is a valid crontab
+~/cron_scripts/AUTO/gallery is a valid crontab
+~/cron_scripts/crontab has errors:
+Invalid month "foo".
+
+Not loading new crontab. Use -f to force.
+
+$ cronload -f
+
+~/cron_scripts...
+...
+
+Loading 2 crontab files... done.
+
+$ cronload -f -f
+
+~/cron_scripts...
+...
+
+Loading 3 crontab (1 BROKEN!) files... done.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Index: tags/fc15-eol/locker/cron/src/Makefile
===================================================================
--- tags/fc15-eol/locker/cron/src/Makefile	(revision 2244)
+++ tags/fc15-eol/locker/cron/src/Makefile	(revision 2244)
@@ -0,0 +1,27 @@
+# Makefile for dillon's cron and crontab
+#
+
+DESTDIR ?= /usr/local
+CC  = gcc
+CFLAGS = -O2 -Wall -Wstrict-prototypes
+LIB = 
+D_SRCS = cronload.real.c subs.c
+D_OBJS = cronload.real.o subs.o
+
+all:	cronload.real
+
+cronload.real:  ${D_OBJS}
+	${CC} ${CFLAGS} -o cronload.real ${D_OBJS}
+	strip cronload.real
+
+clean:  cleano
+	rm -f cronload.real
+
+cleano:
+	rm -f *.o
+
+install:
+	install -o root -g wheel -m 4755 cronload.real ${DESTDIR}/bin/cronload.real
+#	install -o root -g wheel -m 0644 crontab.1 ${DESTDIR}/man/man1/crontab.1
+
+
Index: tags/fc15-eol/locker/cron/src/cronload.real.c
===================================================================
--- tags/fc15-eol/locker/cron/src/cronload.real.c	(revision 2244)
+++ tags/fc15-eol/locker/cron/src/cronload.real.c	(revision 2244)
@@ -0,0 +1,262 @@
+
+/*
+ * cronload.real.c
+ *
+ * CRONTAB
+ *
+ * usually setuid root, -c option only works if getuid() == geteuid()
+ *
+ * Copyright 1994 Matthew Dillon (dillon@apollo.backplane.com)
+ * May be distributed under the GNU General Public License
+ */
+
+#include "defs.h"
+
+#define VERSION	"$Revision$"
+
+const char *CDir = SCRIPTS_CRONTABS;
+int   UserId;
+short LogLevel = 9;
+
+int GetReplaceStream(const char *user, const char *file);
+extern int ChangeUser(const char *user, short dochdir);
+
+int
+main(int ac, char **av)
+{
+    enum { NONE, LIST, REPLACE, DELETE } option = NONE;
+    struct passwd *pas;
+    char *repFile = NULL;
+    int repFd = 0;
+    int i;
+    char caller[256];		/* user that ran program */
+
+    UserId = getuid();
+    if ((pas = getpwuid(UserId)) == NULL) {
+        perror("getpwuid");
+        exit(1);
+    }
+    snprintf(caller, sizeof(caller), "%s", pas->pw_name);
+
+    i = 1;
+    if (ac > 1) {
+        if (av[1][0] == '-' && av[1][1] == 0) {
+            option = REPLACE;
+            ++i;
+	} else if (av[1][0] != '-') {
+            option = REPLACE;
+            ++i;
+            repFile = av[1];
+	}
+    }
+
+    for (; i < ac; ++i) {
+        char *ptr = av[i];
+
+        if (*ptr != '-')
+            break;
+	ptr += 2;
+
+	switch(ptr[-1]) {
+	case 'l':
+	    if (ptr[-1] == 'l')
+		option = LIST;
+	    /* fall through */
+	case 'd':
+	    if (ptr[-1] == 'd')
+		option = DELETE;
+	    /* fall through */
+	case 'u':
+	    if (i + 1 < ac && av[i+1][0] != '-') {
+	        ++i;
+	        if (getuid() == geteuid()) {
+		    pas = getpwnam(av[i]);
+		    if (pas) {
+			UserId = pas->pw_uid;
+		    } else {
+			errx(1, "user %s unknown\n", av[i]);
+		    }
+		} else {
+		    errx(1, "only the superuser may specify a user\n");
+		}
+	    }
+	    break;
+	case 'c':
+	    if ((getuid() == geteuid()) && (0 == getuid())) {
+		CDir = (*ptr) ? ptr : av[++i];
+	    } else {
+	        errx(1, "-c option: superuser only\n");
+	    }
+	    break;
+	default:
+	    i = ac;
+	    break;
+	}
+    }
+    if (i != ac || option == NONE) {
+	printf("cronload.real " VERSION "\n");
+	printf("cronload.real file <opts>  replace crontab from file\n");
+	printf("cronload.real -    <opts>  replace crontab from stdin\n");
+	printf("cronload.real -u user      specify user\n");
+	printf("cronload.real -l [user]    list crontab for user\n");
+	printf("cronload.real -d [user]    delete crontab for user\n");
+	printf("cronload.real -c dir       specify crontab directory\n");
+	exit(0);
+    }
+
+    /*
+     * Get password entry
+     */
+
+    if ((pas = getpwuid(UserId)) == NULL) {
+        perror("getpwuid");
+        exit(1);
+    }
+
+    /*
+     * If there is a replacement file, obtain a secure descriptor to it.
+     */
+
+    if (repFile) {
+        repFd = GetReplaceStream(caller, repFile);
+        if (repFd < 0) {
+            errx(1, "unable to read replacement file\n");
+        }
+    }
+
+    /*
+     * Change directory to our crontab directory
+     */
+
+    if (chdir(CDir) < 0) {
+        errx(1, "cannot change dir to %s: %s\n", CDir, strerror(errno));
+    }
+
+    /*
+     * Handle options as appropriate
+     */
+
+    switch(option) {
+    case LIST:
+	{
+	    FILE *fi;
+	    char buf[1024];
+
+	    if ((fi = fopen(pas->pw_name, "r"))) {
+		while (fgets(buf, sizeof(buf), fi) != NULL)
+		    fputs(buf, stdout);
+		fclose(fi);
+	    } else {
+		fprintf(stderr, "no crontab for %s\n", pas->pw_name);
+	    }
+	}
+	break;
+    case REPLACE:
+	{
+	    char buf[1024];
+	    char path[1024];
+	    int fd;
+	    int n;
+
+	    snprintf(path, sizeof(path), "%s.new", pas->pw_name);
+	    if ((fd = open(path, O_CREAT|O_TRUNC|O_EXCL|O_APPEND|O_WRONLY, 0600)) >= 0) {
+		while ((n = read(repFd, buf, sizeof(buf))) > 0) {
+		    write(fd, buf, n);
+		}
+		close(fd);
+		rename(path, pas->pw_name);
+	    } else {
+		fprintf(stderr, "unable to create %s/%s: %s\n", 
+		    CDir,
+		    path,
+		    strerror(errno)
+		);
+	    }
+	    close(repFd);
+	}
+	break;
+    case DELETE:
+        remove(pas->pw_name);
+        break;
+    case NONE:
+    default: 
+        break;
+    }
+
+    /*
+     *  Bump notification file.  Handle window where crond picks file up
+     *  before we can write our entry out.
+     */
+	/* // only applicable to dcron
+    if (option == REPLACE || option == DELETE) {
+        FILE *fo;
+        struct stat st;
+
+        while ((fo = fopen(CRONUPDATE, "a"))) {
+			fprintf(fo, "%s\n", pas->pw_name);
+			fflush(fo);
+			if (fstat(fileno(fo), &st) != 0 || st.st_nlink != 0) {
+			fclose(fo);
+			break;
+			}
+			fclose(fo);
+			// * loop * /
+		}
+		if (fo == NULL) {
+			fprintf(stderr, "unable to append to %s/%s\n", CDir, CRONUPDATE);
+		}
+    }
+    */
+    (volatile void)exit(0);
+    /* not reached */
+}
+
+int
+GetReplaceStream(const char *user, const char *file)
+{
+    int filedes[2];
+    int pid;
+    int fd;
+    int n;
+    char buf[1024];
+
+    if (pipe(filedes) < 0) {
+        perror("pipe");
+        return(-1);
+    }
+    if ((pid = fork()) < 0) {
+        perror("fork");
+        return(-1);
+    }
+    if (pid > 0) {
+        /*
+         * PARENT
+         */
+
+	close(filedes[1]);
+	if (read(filedes[0], buf, 1) != 1) {
+	    close(filedes[0]);
+	    filedes[0] = -1;
+	}
+	return(filedes[0]);
+    }
+
+    /*
+     * CHILD
+     */
+
+    close(filedes[0]);
+
+    if (ChangeUser(user, 0) < 0)
+        exit(0);
+
+    fd = open(file, O_RDONLY);
+    if (fd < 0)
+        errx(0, "unable to open %s\n", file);
+    buf[0] = 0;
+    write(filedes[1], buf, 1);
+    while ((n = read(fd, buf, sizeof(buf))) > 0) {
+        write(filedes[1], buf, n);
+    }
+    exit(0);
+}
Index: tags/fc15-eol/locker/cron/src/defs.h
===================================================================
--- tags/fc15-eol/locker/cron/src/defs.h	(revision 2244)
+++ tags/fc15-eol/locker/cron/src/defs.h	(revision 2244)
@@ -0,0 +1,46 @@
+
+/*
+ * DEFS.H
+ *
+ * Copyright 1994-1998 Matthew Dillon (dillon@backplane.com)
+ * May be distributed under the GNU General Public License
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/ioctl.h>
+#include <sys/wait.h>
+#include <sys/resource.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdarg.h>
+#include <string.h>
+#include <errno.h>
+#include <time.h>
+#include <dirent.h>
+#include <fcntl.h>
+#include <pwd.h>
+#include <unistd.h>
+#include <grp.h>
+#include <err.h>
+
+#define Prototype extern
+#define arysize(ary)	(sizeof(ary)/sizeof((ary)[0]))
+
+#ifndef SCRIPTS_CRONTABS
+#define SCRIPTS_CRONTABS	"/mit/scripts/cron/crontabs"
+#endif
+#ifndef TMPDIR
+#define TMPDIR		"/tmp"
+#endif
+#ifndef OPEN_MAX
+#define OPEN_MAX	256
+#endif
+
+#ifndef CRONUPDATE
+#define CRONUPDATE	"cron.update"
+#endif
+
+#ifndef MAXLINES
+#define MAXLINES	256		/* max lines in non-root crontabs */
+#endif
Index: tags/fc15-eol/locker/cron/src/subs.c
===================================================================
--- tags/fc15-eol/locker/cron/src/subs.c	(revision 2244)
+++ tags/fc15-eol/locker/cron/src/subs.c	(revision 2244)
@@ -0,0 +1,147 @@
+
+/*
+ * SUBS.C
+ *
+ * Copyright 1994 Matthew Dillon (dillon@apollo.backplane.com)
+ * May be distributed under the GNU General Public License
+ */
+
+#include "defs.h"
+
+Prototype void logn(int level, const char *ctl, ...);
+Prototype void log9(const char *ctl, ...);
+Prototype void logfd(int fd, const char *ctl, ...);
+Prototype void fdprintf(int fd, const char *ctl, ...);
+Prototype int ChangeUser(const char *user, short dochdir);
+Prototype void vlog(int level, int fd, const char *ctl, va_list va);
+Prototype int slog(char *buf, const char *ctl, int nmax, va_list va, short useDate);
+
+extern short LogLevel;
+
+void 
+log9(const char *ctl, ...)
+{
+    va_list va;
+
+    va_start(va, ctl);
+    vlog(9, 2, ctl, va);
+    va_end(va);
+}
+
+void 
+logn(int level, const char *ctl, ...)
+{
+    va_list va;
+
+    va_start(va, ctl);
+    vlog(level, 2, ctl, va);
+    va_end(va);
+}
+
+void 
+logfd(int fd, const char *ctl, ...)
+{
+    va_list va;
+
+    va_start(va, ctl);
+    vlog(9, fd, ctl, va);
+    va_end(va);
+}
+
+void 
+fdprintf(int fd, const char *ctl, ...)
+{
+    va_list va;
+    char buf[2048];
+
+    va_start(va, ctl);
+    vsnprintf(buf, sizeof(buf), ctl, va);
+    write(fd, buf, strlen(buf));
+    va_end(va);
+}
+
+void
+vlog(int level, int fd, const char *ctl, va_list va)
+{
+    char buf[2048];
+    short n;
+    static short useDate = 1;
+
+    if (level >= LogLevel) {
+        write(fd, buf, n = slog(buf, ctl, sizeof(buf), va, useDate));
+	useDate = (n && buf[n-1] == '\n');
+    }
+}
+
+int
+slog(char *buf, const char *ctl, int nmax, va_list va, short useDate)
+{
+    time_t t = time(NULL);
+    struct tm *tp = localtime(&t);
+
+    buf[0] = 0;
+    if (useDate)
+	strftime(buf, 128, "%d-%b-%y %H:%M  ", tp);
+    vsnprintf(buf + strlen(buf), nmax, ctl, va);
+    return(strlen(buf));
+}
+
+int
+ChangeUser(const char *user, short dochdir)
+{
+    struct passwd *pas;
+
+    /*
+     * Obtain password entry and change privilages
+     */
+
+    if ((pas = getpwnam(user)) == 0) {
+        logn(9, "failed to get uid for %s", user);
+        return(-1);
+    }
+    setenv("USER", pas->pw_name, 1);
+    setenv("HOME", pas->pw_dir, 1);
+    setenv("SHELL", "/bin/sh", 1);
+
+    /*
+     * Change running state to the user in question
+     */
+
+    if (initgroups(user, pas->pw_gid) < 0) {
+	logn(9, "initgroups failed: %s %s", user, strerror(errno));
+	return(-1);
+    }
+    if (setregid(pas->pw_gid, pas->pw_gid) < 0) {
+	logn(9, "setregid failed: %s %d", user, pas->pw_gid);
+	return(-1);
+    }
+    if (setreuid(pas->pw_uid, pas->pw_uid) < 0) {
+	logn(9, "setreuid failed: %s %d", user, pas->pw_uid);
+	return(-1);
+    }
+    if (dochdir) {
+	if (chdir(pas->pw_dir) < 0) {
+	    logn(8, "chdir failed: %s %s", user, pas->pw_dir);
+	    if (chdir(TMPDIR) < 0) {
+		logn(9, "chdir failed: %s %s", user, pas->pw_dir);
+		logn(9, "chdir failed: %s " TMPDIR, user);
+		return(-1);
+	    }
+	}
+    }
+    return(pas->pw_uid);
+}
+
+#if 0
+
+char *
+strdup(const char *str)
+{
+    char *ptr = malloc(strlen(str) + 1);
+
+    if (ptr)
+        strcpy(ptr, str);
+    return(ptr);
+}
+
+#endif
Index: tags/fc15-eol/locker/deploy/bin/django
===================================================================
--- tags/fc15-eol/locker/deploy/bin/django	(revision 2244)
+++ tags/fc15-eol/locker/deploy/bin/django	(revision 2244)
@@ -0,0 +1,130 @@
+#!/usr/bin/perl
+use strict;
+use FindBin qw($Bin);
+use lib $Bin;
+use onserver;
+
+setup();
+
+print "\nEnter the code name for your project (a valid Python package name).\n";
+print "Do not use 'django' or the name of any other Python library.\n";
+print "Project name: ";
+my $name = <STDIN>;
+chomp $name;
+
+open FASTCGI, ">index.fcgi";
+print FASTCGI <<EOF;
+#!/usr/bin/env python
+import sys, os, time, threading, django.utils.autoreload
+sys.path.insert(0, "/mit/$USER/Scripts/django")
+os.chdir("/mit/$USER/Scripts/django/$name")
+os.environ['DJANGO_SETTINGS_MODULE'] = "$name.settings"
+
+def reloader_thread():
+  while True:
+    if django.utils.autoreload.code_changed():
+      os._exit(3)
+    time.sleep(1)
+t = threading.Thread(target=reloader_thread)
+t.daemon = True
+t.start()
+
+from django.core.servers.fastcgi import runfastcgi
+runfastcgi(method="threaded", daemonize="false")
+EOF
+close FASTCGI;
+chmod 0755, "index.fcgi";
+
+open HTACCESS, ">.htaccess";
+print HTACCESS <<EOF;
+RewriteEngine On
+
+RewriteRule ^\$ index.fcgi/ [QSA,L]
+
+RewriteCond %{REQUEST_FILENAME} !-f
+RewriteCond %{REQUEST_FILENAME} !-d
+RewriteRule ^(.*)\$ index.fcgi/\$1 [QSA,L]
+EOF
+close HTACCESS;
+chmod 0777, ".htaccess";
+
+chdir "/mit/$USER/Scripts/django/";
+system(qw{django-admin startproject}, $name)==0 or die "\nFailed to create app.\n\n";
+chdir "$name";
+
+open SETTINGS, "settings.py";
+open NEWSETTINGS, ">settings.py.new";
+while (<SETTINGS>) {
+  chomp;
+  if (/Your Name/) {
+    $_ = "    ('$USER', '$email'),";
+  } elsif (/'ENGINE'/) {
+    $_ = "        'ENGINE': 'django.db.backends.mysql',";
+  } elsif  (/'NAME'/) {
+    $_ = "        'NAME': '$sqldb',";
+  } elsif (/'USER'/) {
+    $_ = "        'USER': '$sqluser',";
+  } elsif (/'PASSWORD'/) {
+    $_ = "        'PASSWORD': '$sqlpass',";
+  } elsif (/'HOST'/) {
+    $_ = "        'HOST': '$sqlhost',";
+  } elsif (/Chicago/) {
+    $_ =~ s/Chicago/New_York/;
+  } elsif (/^ADMIN_MEDIA_PREFIX/) {
+    $_ = "ADMIN_MEDIA_PREFIX = '/__scripts/django/media/'";
+  } elsif (/^INSTALLED_APPS/) {
+    print NEWSETTINGS "$_\n";
+    while (<SETTINGS>) {
+      if (/^\)/) {
+        print NEWSETTINGS "    'django.contrib.admin',\n";
+        print NEWSETTINGS "    'django.contrib.admindocs',\n";
+      }
+      print NEWSETTINGS $_;
+    }
+  }
+  print NEWSETTINGS "$_\n";
+}
+close NEWSETTINGS;
+close SETTNGS;
+rename "settings.py.new", "settings.py";
+
+open URLS, "urls.py";
+open NEWURLS, ">urls.py.new";
+while (<URLS>) {
+  chomp;
+  if (/^#.*from django\.contrib import admin/) {
+    $_ =~ s/^# *//;
+  } elsif (/^#.*admin.autodiscover/) {
+    $_ =~ s/^# *//;
+  } elsif (/^ *# *\(r\'\^admin\//) {
+    $_ =~ s/# *//;
+  }
+  print NEWURLS "$_\n";
+}
+close NEWURLS;
+close URLS;
+rename "urls.py.new", "urls.py";
+
+print "Initializing your project's SQL database schema...\n";
+system qw{./manage.py syncdb --noinput};
+print "...done\n";
+
+print "Creating your superuser account... ";
+system qw{./manage.py createsuperuser --username}, $admin_username, "--email", $email, "--noinput";
+print "done\n";
+print "Setting your superuser password... ";
+system qw{mysql -D}, "$USER+$addrlast", "-e", "UPDATE auth_user SET password=MD5(\'$admin_password\') WHERE username=\'$admin_username\'";
+print "done\n";
+
+print "\nDjango has been installed. The setup is roughly what's described\n";
+print "in the shared-hosting section of\n";
+print "  http://docs.djangoproject.com/en/dev/howto/deployment/fastcgi/\n";
+print "We've also enabled the admin app. You can start from the 'Creating\n";
+print "models' step of the Django tutorial:\n";
+print "  http://docs.djangoproject.com/en/dev/intro/tutorial01/#id3\n\n";
+print "Your project is located in:\n";
+print "  /mit/$USER/Scripts/django/$name/\n";
+print "To access manage.py, run 'ssh -k $USER\@scripts' and cd to the above directory.\n\n";
+press_enter;
+
+exit 0;
Index: tags/fc15-eol/locker/deploy/bin/gallery2
===================================================================
--- tags/fc15-eol/locker/deploy/bin/gallery2	(revision 2244)
+++ tags/fc15-eol/locker/deploy/bin/gallery2	(revision 2244)
@@ -0,0 +1,62 @@
+#!/usr/bin/perl
+use strict;
+use FindBin qw($Bin);
+use lib $Bin;
+use onserver_star;
+use File::Path
+
+setup();
+
+my $dir = "/mit/$USER/scripts-gallery2/$sqldb";
+if (-e $dir) {
+    print STDERR "ERROR: The directory $dir already exists.\nTry selecting a different name.";
+    exit 1;
+}
+mkpath($dir);
+
+system("patch", "install/steps/AuthenticateStep.class",
+       "/mit/scripts/deploy$scriptsdev/gallery2.patch");
+
+$ua->cookie_jar({file => '.cookies'});
+
+fetch_uri('install/index.php');
+fetch_uri('install/index.php', {step => 1},
+	  {language => 'en_US'});
+fetch_uri('install/index.php', {step => 2}, {});
+fetch_uri('install/index.php', {step => 3}, {});
+
+my $post4 = {isMultisite => 0,
+	    dir => $dir,
+	    action => 'save'};
+fetch_uri('install/index.php', {step => 4}, $post4);
+fetch_uri('install/index.php', {step => 4}, $post4);
+
+my $post5 = {type => 'mysql',
+	     hostname => $sqlhost,
+	     action => 'save',
+	     confirmReuseTables => '',
+	     confirmCleanInstall => '',
+	     username => $sqluser,
+	     password => $sqlpass,
+	     database => $sqldb,
+	     tablePrefix => 'g2_',
+	     columnPrefix => 'g_'};
+fetch_uri('install/index.php', {step => 5}, $post5);
+fetch_uri('install/index.php', {step => 5}, $post5);
+
+fetch_uri('install/index.php', {step => 6},
+	  {adminName => $admin_username,
+	   passwordA => $admin_password,
+	   action => 'create',
+	   passwordB => $admin_password,
+	   email => $email,
+	   fullName => $USER});
+fetch_uri('install/index.php', {step => 7}, {});
+fetch_uri('install/index.php', {step => 8}, {});
+fetch_uri('install/index.php', {step => 9},
+	  {'module[imagemagick]' => 'on',
+	   activate => 1});
+fetch_uri('install/index.php', {step => 10}, {});
+fetch_uri('install/index.php', {step => 11}, {});
+
+unlink '.cookies';
Index: tags/fc15-eol/locker/deploy/bin/git
===================================================================
--- tags/fc15-eol/locker/deploy/bin/git	(revision 2244)
+++ tags/fc15-eol/locker/deploy/bin/git	(revision 2244)
@@ -0,0 +1,83 @@
+#!/usr/bin/perl
+use strict;
+use FindBin qw($Bin);
+use lib $Bin;
+use onserver;
+
+setup();
+
+my $gitbase = "$scriptsdir/git";
+my $htpasswd = "$gitbase/$addrend.git/.htpasswd";
+
+open HTACCESS, ">.htaccess";
+print HTACCESS <<EOF;
+RewriteEngine On
+
+RewriteCond %{QUERY_STRING} =service=git-receive-pack [OR]
+RewriteCond %{REQUEST_URI} /git-receive-pack\$
+RewriteRule ^($addrend\\.git/.*)\$ /~$USER/$addrend/_git-auth.cgi/\$1
+<Files _git-auth.cgi>
+    AuthName "Git Access"
+    AuthType basic
+    AuthUserFile $htpasswd
+    Require user $admin_username
+
+    # Alternatively, replace "require user" with:
+    #Require group somegroup
+    #AuthGroupFile $gitbase/$addrend/.htgroup
+    # and set up .htgroup appropriately
+</Files>
+
+RewriteRule ^($addrend\\.git/.*)\$ /~$USER/$addrend/_git.cgi/\$1
+EOF
+close HTACCESS;
+chmod 0777, ".htaccess";
+
+open GIT_CGI, ">_git.cgi";
+print GIT_CGI <<EOF;
+#!/bin/sh
+case "\$PATH_INFO" in
+    .. | ../* | */.. | */../*)
+        echo "Content-type: text/plain"
+        echo "Status: 403 Forbidden"
+        echo ""
+        echo "Error: Illegally found '..' in PATH_INFO='\$PATH_INFO'"
+        echo "gitautoinstaller: \$HOME: found '..' in PATH_INFO='\$PATH_INFO'" >&2
+        exit 1;;
+    /$addrend.git/*)
+        # pass
+        ;;
+    *)
+        echo "Content-type: text/plain"
+        echo "Status: 403 Forbidden"
+        echo ""
+        echo "Error: PATH_INFO='\$PATH_INFO' must start with /$addrend.git/"
+        echo "gitautoinstaller: \$HOME: found bad start in PATH_INFO='\$PATH_INFO'" >&2
+        exit 1;;
+esac
+export GIT_PROJECT_ROOT="$gitbase"
+export PATH_TRANSLATED="\$GIT_PROJECT_ROOT\$PATH_INFO"
+exec git http-backend
+EOF
+close GIT_CGI;
+chmod 0755, "_git.cgi";
+symlink "_git.cgi","_git-auth.cgi";
+
+chdir $gitbase;
+system qw{git init --bare}, "$addrend.git";
+chdir "$addrend.git";
+
+open ENABLE, ">git-daemon-export-ok";
+print ENABLE "";
+close ENABLE;
+
+system qw{htpasswd -c}, $htpasswd, $admin_username;
+
+print "Your git repository is located in:\n";
+print "  $gitbase/$addrend.git/\n";
+print "To clone, run\n  git clone https://$USER.scripts.mit.edu/$addrend/$addrend.git\n\n";
+print "Note: Push over HTTP is a relatively new feature in Git, so if git push fails\n";
+print "try a newer version of Git, e.g. if you're on Athena, 'add -f git' and try again.\n\n";
+press_enter;
+
+exit 0;
Index: tags/fc15-eol/locker/deploy/bin/joomla
===================================================================
--- tags/fc15-eol/locker/deploy/bin/joomla	(revision 2244)
+++ tags/fc15-eol/locker/deploy/bin/joomla	(revision 2244)
@@ -0,0 +1,86 @@
+#!/usr/bin/perl
+use strict;
+use FindBin qw($Bin);
+use lib $Bin;
+use onserver;
+use File::Path;
+
+setup();
+
+print "\nPlease decide upon a title for your site and enter it below.\n";
+print "Desired title: ";
+my $title = <STDIN>;
+chomp($title);
+
+print "\nSetting up your configuration file...\n";
+open CONFIGTEMPLATE, "configuration.php-dist";
+open CONFIGURATION, ">configuration.php";
+while (<CONFIGTEMPLATE>) {
+  chomp;
+  if (/var \$sitename /) {
+    $_ = "	var \$sitename = '$title';";
+  } elsif (/var \$dbtype /) {
+    $_ = "	var \$dbtype = 'mysql';";
+  } elsif (/var \$host /) {
+    $_ = "	var \$host = '$sqlhost';";
+  } elsif (/var \$user /) {
+    $_ = "	var \$user = '$sqluser';";
+  } elsif (/var \$password /) {
+    $_ = "	var \$password = '$sqlpass';";
+  } elsif (/var \$db /) {
+    $_ = "	var \$db = '$sqldb';";
+  } elsif (/var \$dbprefix /) {
+    $_ = "	var \$dbprefix = 'jos_';";
+  } elsif (/var \$secret /) {
+    my $random = `dd if=/dev/urandom bs=1k count=1 | md5sum | cut -c1-32`;
+    $random =~ s/\n//;
+    $_ = "	var \$secret = '$random';";
+  } elsif (/var \$mailfrom /) {
+    $_ = "	var \$mailfrom = '$email';";
+  } elsif (/var \$fromname /) {
+    $_ = "	var \$fromname = '$title';";
+  }
+  print CONFIGURATION "$_\n";
+}
+close CONFIGURATION;
+close CONFIGTEMPLATE;
+
+print "\nInitializing database schema...\n";
+my $schemafile = "installation/sql/mysql/joomla-real.sql";
+open SCHEMATEMPLATE, "installation/sql/mysql/joomla.sql";
+open SCHEMA, ">$schemafile";
+while (<SCHEMATEMPLATE>) {
+  if (/#__/) {
+    $_ =~ s/#__/jos_/g;
+  }
+  print SCHEMA "$_";
+}
+close SCHEMA;
+close SCHEMATEMPLATE;
+system("cat $schemafile | mysql $sqldb");
+
+print "\nLoading sample data...\n";
+my $sampledatafile = "installation/sql/mysql/sample_data-real.sql";
+open SAMPLETEMPLATE, "installation/sql/mysql/sample_data.sql";
+open SAMPLE, ">$sampledatafile";
+while (<SAMPLETEMPLATE>) {
+  if (/#__/) {
+    $_ =~ s/#__/jos_/g;
+  }
+  print SAMPLE "$_";
+}
+close SAMPLE;
+close SAMPLETEMPLATE;
+system("cat $sampledatafile | mysql $sqldb");
+
+print "\nCreating your admin account...\n";
+system("mysql -e \"INSERT INTO jos_users VALUES (62, 'Administrator', '$admin_username', '$email', MD5('$admin_password'), 'Super Administrator', 0, 1, 25, NOW(), NOW(), '', '')\" $sqldb");
+system("mysql -e \"INSERT INTO jos_core_acl_aro VALUES (10, 'users', '62', 0, 'Administrator', 0)\" $sqldb");
+system("mysql -e \"INSERT INTO jos_core_acl_groups_aro_map VALUES (25, '', 10)\" $sqldb");
+
+print "\nCleaning up installation tree...\n";
+rmtree('installation');
+
+print "\nDone!\n";
+exit 0;
+
Index: tags/fc15-eol/locker/deploy/bin/mediawiki
===================================================================
--- tags/fc15-eol/locker/deploy/bin/mediawiki	(revision 2244)
+++ tags/fc15-eol/locker/deploy/bin/mediawiki	(revision 2244)
@@ -0,0 +1,36 @@
+#!/usr/bin/perl
+use strict;
+use FindBin qw($Bin);
+use lib $Bin;
+use onserver;
+
+setup();
+
+`cp skins/common/images/mediawiki.png skins/common/images/wiki.png`;
+`patch -s -p1 < /mit/scripts/deploy/mediawiki.patch`;
+
+print "\nPlease decide upon a title for your wiki and enter it below.\n";
+print "Desired title: ";
+my $title=<STDIN>;
+chomp($title);
+
+my $html = fetch_uri(
+    'config/index.php',
+    {},
+    {Sitename => $title,
+     EmergencyContact => $email,
+     LanguageCode => 'en',
+     DBserver => $sqlhost,
+     DBname => $sqldb,
+     DBuser => $sqluser,
+     DBpassword => $sqlpass,
+     DBpassword2 => $sqlpass,
+     defaultEmail => $email,
+     SysopName => $admin_username,
+     SysopPass => $admin_password,
+     SysopPass2 => $admin_password});
+unless ($html =~ /Installation successful/) {
+    print STDERR "ERROR: Automatic MediaWiki configuration failed.  You will need to configure\nyour MediaWiki manually, or email scripts\@mit.edu for help.\n";
+    exit;
+}
+`cp config/LocalSettings.php .`;
Index: tags/fc15-eol/locker/deploy/bin/onathena
===================================================================
--- tags/fc15-eol/locker/deploy/bin/onathena	(revision 2244)
+++ tags/fc15-eol/locker/deploy/bin/onathena	(revision 2244)
@@ -0,0 +1,290 @@
+#!/bin/sh
+
+: ${aicontact:=scripts@mit.edu}
+: ${aimaintainer:=scripts.mit.edu}
+: ${ailocker:=scripts}
+
+
+checkfailed() {
+  if [ -f "$lroot/web_scripts/$addrend/.failed" ]; then
+    rm -f "$lroot/web_scripts/$addrend/.failed"
+    exit 1
+  fi
+}
+
+die() {
+  echo "== INSTALLATION FAILED =="
+  echo "Sorry, the installation failed:"
+  echo "$@"
+  echo "Please contact $aicontact and provide a copy of the output of this installer."
+  exit 1
+}
+
+attach scripts
+[ "$ailocker" != "scripts" ] && attach "$ailocker"
+
+sshrun() {
+  /afs/athena.mit.edu/contrib/scripts/bin$scriptsdev/scripts-ssh "$lname" "$@" 2>/dev/null
+}
+
+vsshrun() {
+  /afs/athena.mit.edu/contrib/scripts/bin$scriptsdev/scripts-ssh "$lname" "$@"
+}
+
+checksqlpass() {
+    errors=`sshrun "/mit/scripts/sql/bin$scriptsdev/test-password"`
+    if [ "$errors" != "" ]; then
+        if [ "$1" -eq 1 ]; then
+          rm -f "$lroot/.sql/my.cnf"
+        fi
+        echo
+        echo "ERROR:"
+        printf "$2"
+        exit
+    fi
+}
+
+override=1
+if [ "$override" = "" ]; then
+echo "The $aimaintainer automatic installers are currently unavailable."
+echo "We hope to make them available again soon."
+echo "If you would like us to notify you as soon as they are available again,"
+echo "let us know by sending us an e-mail at $aicontact"
+exit 
+fi
+
+echo 
+echo "== Welcome to the $aimaintainer installer for $sname =="
+echo
+
+echo "For documentation, including a link to the Athena rules of use,"
+echo "see <http://scripts.mit.edu/start>."
+echo
+echo "Please report problems with this installer to $aicontact."
+
+if [ -n "$SCRIPTS_INSTALL_LOCKER" ]; then
+    lname=$SCRIPTS_INSTALL_LOCKER
+else
+    echo
+    echo "Are you performing this install for:"
+    echo "1. Your personal Athena account"
+    echo "2. A locker that you control (a club, a course, etc)"
+    echo "If you do not understand this question, you should answer '1'."
+    printf "Please enter either '1' or '2' (without quotes): "
+    read whofor
+    if [ "$whofor" = 1 ]; then
+        lname="${ATHENA_USER:-$USER}"
+    elif [ "$whofor" = 2 ]; then
+        echo
+        echo "OK.  $sname will be installed into a locker of your choice that"
+        echo "you control.  Please enter the name of the selected locker below."
+        echo "(For the locker /mit/lsc -- which has a full path of"
+        echo "/afs/athena.mit.edu/activity/l/lsc -- you would simply enter lsc)."
+        printf "Locker name: "
+        read lname
+    else
+        echo
+        echo "ERROR:"
+        echo "You must select either '1' or '2'."
+        exit 1
+    fi
+    while true; do
+        if attach "$lname"; then
+            break
+        fi
+        echo "$lname is not a valid locker name."
+        printf "Locker name: "
+        read lname
+    done
+    unset whofor
+fi
+lroot="/mit/$lname" 
+
+echo
+echo Checking the status of your scripts.mit.edu account...
+
+attach scripts 2>/dev/null
+. "/mit/scripts/bin$scriptsdev/signup-web"
+
+if [ -n "$SCRIPTS_INSTALL_ADDREND" ]; then
+    addrend=$SCRIPTS_INSTALL_ADDREND
+else
+    echo
+    echo "Your new copy of $sname will appear on the web at a URL"
+    echo "that starts with http://$lname.scripts.mit.edu/"
+    echo "Please decide upon a complete URL and enter it below."
+    echo "You must enter one or more characters after mit.edu/"
+    echo "The completed address must only contain a-z, 0-9, and /."
+    printf "Desired address: http://$lname.scripts.mit.edu/"
+    read addrend
+fi
+
+addrend=`perl -0e 'print $ARGV[0] =~ /^([\w\/-]*[\w-])\/*$/' -- "$addrend"`
+if [ "$addrend" = "" ]; then
+	echo
+	echo "ERROR:"
+	echo "You must enter one or more characters after mit.edu/"
+	echo "The completed address must only contain a-z, 0-9, and /."
+	exit 1
+fi
+
+if [ -d "$lroot/web_scripts/$addrend" ]; then
+    echo
+    echo "ERROR:"
+    echo "You already have a directory corresponding to that web address."
+    echo "Please remove that directory, choose a different address, or"
+    echo "contact $aicontact for assistance."
+    exit 1
+fi
+
+if [ "$requires_sql" = "" ]; then
+  requires_sql=1
+fi
+
+if [ ! -f "$lroot/.my.cnf" ]; then
+  mkdir "$lroot/.sql" 2>/dev/null
+  fs sa "$lroot/.sql" daemon.scripts write
+  fs sa "$lroot/.sql" daemon.sql write
+  ln -nfs "$lroot/.sql/my.cnf" "$lroot/.my.cnf" 2>/dev/null
+fi
+
+fs sa "$lroot/.sql" system:anyuser none
+fs sa "$lroot/.sql" system:authuser none
+
+if [ "$requires_sql" -eq 1 ]; then
+  sqlinfo=`sshrun "/mit/scripts/sql/bin$scriptsdev/get-password"`
+  if [ "$sqlinfo" = "" ]; then
+      echo 
+      echo "You already have a MySQL account but you do not have a .my.cnf file."
+      echo "If you do not remember your MySQL account password, you can change it"
+      echo "at http://sql.mit.edu using MIT certificates."
+      printf "Please type your MySQL password and press [enter]: "
+      stty -echo
+      read sqlpass
+      stty echo
+      echo
+      sqlhost="sql.mit.edu"
+      sqluser=$lname
+      . "/mit/scripts/sql/bin$scriptsdev/save-password"
+      checksqlpass 1 'The MySQL password that you typed appears to be incorrect.\n'
+      echo
+      echo "OK.  Continuing with the install..."
+  else
+      checksqlpass 0 'The MySQL login information in your .my.cnf file\nappears to be incorrect.\n'
+  fi
+fi
+
+origdir=`pwd`
+mkdir -p "$lroot/web_scripts_tmp"
+cd "$lroot/web_scripts_tmp"
+fs sa . system:anyuser none
+fs sa . system:authuser none
+fs sa . daemon.scripts write
+fs sa . system:scripts-security-upd write
+echo "This directory is necessary to store login sessions and other transient files for auto-installed packages from scripts.mit.edu." > DO_NOT_DELETE.txt
+mkdir -p "$lroot/web_scripts/$addrend"
+cd "$lroot/web_scripts/$addrend"
+fs sa . system:anyuser none
+fs sa . system:authuser none
+fs sa . daemon.scripts write
+fs sa . system:scripts-security-upd write
+
+# This version is deprecated, use create_scripts_dir instead
+
+if [ "$create_dir" = "" ]; then
+  create_dir=0
+fi
+
+if [ "$create_dir" -eq 1 ]; then
+  mkdir -p "$lroot/scripts-$deploy"
+  fs sa "$lroot/scripts-$deploy" system:anyuser none
+  fs sa "$lroot/scripts-$deploy" system:authuser none
+  fs sa "$lroot/scripts-$deploy" daemon.scripts write
+  fs sa "$lroot/scripts-$deploy" system:scripts-security-upd write
+fi
+
+# This is the better version
+
+if [ "$create_scripts_dir" = "" ]; then
+  create_scripts_dir=0
+fi
+
+if [ "$create_scripts_dir" -eq 1 ]; then
+  mkdir -p "$lroot/Scripts/$deploy"
+  fs sa "$lroot/Scripts/$deploy" system:anyuser none
+  fs sa "$lroot/Scripts/$deploy" system:authuser none
+  fs sa "$lroot/Scripts/$deploy" daemon.scripts write
+  fs sa "$lroot/Scripts/$deploy" system:scripts-security-upd write
+fi
+
+if [ "$wizard" != "" ]; then
+  if [ "$create_scripts_dir" -eq 1 ]; then
+    vsshrun "/mit/$ailocker/wizard/bin/wizard" "install" "--web-stub-path" "$lroot/web_scripts/$addrend" "$@" "$wizard" "$lroot/Scripts/$deploy/$addrend"
+  else
+    vsshrun "/mit/$ailocker/wizard/bin/wizard" "install" "$@" "$wizard" "$lroot/web_scripts/$addrend"
+  fi
+  exit 0
+fi
+
+if [ "$prompt_username" = "" ]; then
+  admin_username="admin"
+  prompt_username=0
+fi
+if [ "$prompt_password" = "" ]; then
+  prompt_password=1
+fi
+
+if [ "$prompt_username" -eq 1 ]; then
+    echo
+    echo "You will be able to log in to $sname using a username of your choice."
+    echo "Please decide upon a username and enter it below."
+    echo "Your username must contain only alphanumeric characters (a-z, 0-9)."
+    printf "Desired username: "
+    read admin_username
+    admin_username=`perl -0e 'print $ARGV[0] =~ /^([[:alnum:]]+)$/' -- "$admin_username"`
+    if [ "$admin_username" = "" ]; then
+        echo
+        echo ERROR:
+        echo "Your username must contain only alphanumeric characters (a-z, 0-9)."
+        echo "You will need to run the installer again and choose a different username."
+        exit 1
+    fi
+fi
+
+if [ "$prompt_password" -eq 1 ]; then
+    stty -echo
+    sshrun "/mit/$ailocker/deploy$scriptsdev/bin/prompt-password" "$sname" "$deploy" "$addrend" "$admin_username"
+    stty echo
+fi
+
+echo
+echo "Unpacking $sname... (this step might take several minutes)"
+# xavid: use p to keep the same permissions as in the file
+athrun scripts gtar zxpf "/mit/$ailocker/deploy$scriptsdev/$deploy.tar.gz"
+files=`athrun scripts gfind . -mindepth 1 -maxdepth 1 | grep -v .admin`
+numfiles=`echo "$files" | wc -l`
+if [ ! -z "$files" ]; then
+    if [ "$numfiles" -eq 1 ]; then
+        athrun scripts gfind . -mindepth 2 -maxdepth 2 | xargs -i mv \{} .
+        rmdir "$files"
+    fi
+fi
+if [ -f "/mit/$ailocker/deploy$scriptsdev/php.ini/$deploy" ]; then
+        nodot=`echo "$lname" | sed "/\./s///"`;
+        sed -e "/SCRIPTS_USER/ s//$lname/" -e "/SCRIPTS_NODOT/ s//$nodot/" "/mit/$ailocker/deploy$scriptsdev/php.ini/$deploy" > php.ini
+        athrun scripts gfind . -mindepth 1 -type d -exec sh -c 'ln -sf "`echo "$1" | sed '\''s,[^/],,g; s,/,../,g'\''`php.ini" "$1/"' -- {} \;
+fi
+cd "$origdir"
+
+vsshrun "/mit/$ailocker/deploy$scriptsdev/bin/$deploy" "$sname" "$deploy" "$addrend" "$admin_username" "$requires_sql" "$scriptsdev" "${ATHENA_USER:-$USER}" || die "Unknown failure during configuration"
+rm -f "$lroot/web_scripts/$addrend/.scripts-tmp"
+checkfailed
+
+echo
+echo "== Installation complete! =="
+echo "You should now be able to access your new copy of $sname at"
+echo "http://$lname.scripts.mit.edu/$addrend/"
+echo "(You can replace the http with https if you want to use encryption)"
+echo "If you have trouble accessing it, feel free to contact"
+echo "the $aimaintainer team by e-mailing $aicontact"
+exit 0
Index: tags/fc15-eol/locker/deploy/bin/onserver.pm
===================================================================
--- tags/fc15-eol/locker/deploy/bin/onserver.pm	(revision 2244)
+++ tags/fc15-eol/locker/deploy/bin/onserver.pm	(revision 2244)
@@ -0,0 +1,145 @@
+package onserver;
+use strict;
+use Exporter;
+use Sys::Hostname;
+use File::Spec::Functions;
+use File::Basename;
+use Socket;
+use Cwd qw(abs_path);
+use POSIX qw(strftime);
+use LWP::UserAgent;
+use URI;
+our @ISA = qw(Exporter);
+our @EXPORT = qw(setup totmp fetch_uri print_login_info press_enter $server $tmp $USER $HOME $scriptsdir $sname $deploy $addrend $base_uri $ua $admin_username $requires_sql $addrlast $sqlhost $sqluser $sqlpass $sqldb $admin_password $scriptsdev $human $email);
+
+our $server = "scripts.mit.edu";
+
+our ($tmp, $USER, $HOME, $scriptsdir, $sname, $deploy, $addrend, $base_uri, $ua, $admin_username, $requires_sql, $addrlast, $sqlhost, $sqluser, $sqlpass, $sqldb, $admin_password, $scriptsdev, $human, $email);
+
+$tmp = ".scripts-tmp";
+sub totmp {
+  open(FILE, ">$tmp");
+  print FILE $_[0];
+  close(FILE);
+}
+
+$ua = LWP::UserAgent->new;
+push @{$ua->requests_redirectable}, 'POST';
+
+sub fetch_uri {
+    my ($uri, $get, $post) = @_;
+    my $u = URI->new($uri);
+    my $req;
+    if (defined $post) {
+	$u->query_form($post);
+	my $content = $u->query;
+	$u->query_form($get);
+	$req = HTTP::Request->new(POST => $u->abs($base_uri));
+	$req->content_type('application/x-www-form-urlencoded');
+	$req->content($content);
+    } else {
+	$u->query_form($get) if (defined $get);
+	$req = HTTP::Request->new(GET => $u->abs($base_uri));
+    }
+    my $res = $ua->request($req);
+    if ($res->is_success) {
+	return $res->content;
+    } else {
+	print STDERR "Error fetching configuration page: ", $res->status_line, "\n";
+	return undef;
+    }
+}
+
+sub print_login_info {
+  print "\nYou will be able to log in to $sname using the following:\n";
+  print "  username: $admin_username\n";
+  print "  password: $admin_password\n";
+}
+
+sub getclienthostname {
+    if (my $sshclient = $ENV{"SSH_CLIENT"}) {
+	my ($clientip) = split(' ', $sshclient);
+	my $hostname = gethostbyaddr(inet_aton($clientip), AF_INET);
+	return $hostname || $clientip;
+    } else {
+	return hostname();
+    }
+}
+
+sub press_enter {
+  local $/ = "\n";
+  print "Press [enter] to continue with the install.";
+  my $enter = <STDIN>; 
+}
+
+sub setup {
+  $ENV{PATH} = '/bin:/usr/bin';
+  $USER = $ENV{USER};
+  $HOME = $ENV{HOME};
+  $scriptsdir = $HOME;
+  $scriptsdir =~ s/\/Scripts$//;
+  $scriptsdir .= "/Scripts";
+  
+  ($sname, $deploy, $addrend, $admin_username, $requires_sql, $scriptsdev, $human) = @ARGV;
+  chdir "$HOME/web_scripts/$addrend";
+  $email = "$human\@mit.edu";
+  
+  if($addrend =~ /^(.*)\/$/) {
+    $addrend = $1;
+  }
+  ($addrlast) = ($addrend =~ /([^\/]*)$/);
+  
+  $base_uri = "http://$server/~$USER/$addrend/";
+  
+  if($requires_sql) {
+    print "\nCreating SQL database for $sname...\n";
+   
+    open GETPWD, '-|', "/mit/scripts/sql/bin$scriptsdev/get-password";
+    ($sqlhost, $sqluser, $sqlpass) = split(/\s/, <GETPWD>);
+    close GETPWD;
+    open SQLDB, '-|', "/mit/scripts/sql/bin$scriptsdev/get-next-database", $addrlast;
+    $sqldb = <SQLDB>;
+    close SQLDB;
+    open SQLDB, '-|', "/mit/scripts/sql/bin$scriptsdev/create-database", $sqldb;
+    $sqldb = <SQLDB>;
+    close SQLDB;
+    if($sqldb eq "") {
+      print "\nERROR:\n";
+      print "Your SQL account failed to create a SQL database.\n";
+      print "You should log in at http://sql.mit.edu to check whether\n";
+      print "your SQL account is at its database limit or its storage limit.\n";
+      print "If you cannot determine the cause of the problem, please\n";
+      print "feel free to contact sql\@mit.edu for assistance.\n";
+      open FAILED, ">.failed";
+      close FAILED;
+      exit 1;
+    }
+  }
+ 
+  if(-e "$HOME/web_scripts/$addrend/.admin") { 
+    open ADMIN, "<$HOME/web_scripts/$addrend/.admin";
+    $admin_password=<ADMIN>;
+    chomp($admin_password);
+    close ADMIN;
+    unlink "$HOME/web_scripts/$addrend/.admin";
+  } 
+
+  print "\nConfiguring $sname...\n";
+  if($requires_sql) {
+    print "A copy of ${USER}'s SQL login info will be placed in\n/mit/$USER/web_scripts/$addrend.\n";
+  }
+  
+  open(VERSION, ">.scripts-version") or die "Can't write scripts-version file: $!\n";
+  print VERSION strftime("%F %T %z\n", localtime);
+  print VERSION $ENV{'USER'}, '@', getclienthostname(), "\n";
+  my $tarball = abs_path("/mit/scripts/deploy$scriptsdev/$deploy.tar.gz");
+  print VERSION $tarball, "\n";
+  $tarball =~ s|/deploydev/|/deploy/|;
+  print VERSION dirname($tarball), "\n";
+  close(VERSION);
+
+  select STDOUT;
+  $| = 1; # STDOUT is *hot*!
+}
+
+1;
Index: tags/fc15-eol/locker/deploy/bin/onserver_star.pm
===================================================================
--- tags/fc15-eol/locker/deploy/bin/onserver_star.pm	(revision 2244)
+++ tags/fc15-eol/locker/deploy/bin/onserver_star.pm	(revision 2244)
@@ -0,0 +1,142 @@
+package onserver_star;
+use strict;
+use Exporter;
+use Sys::Hostname;
+use File::Spec::Functions;
+use File::Basename;
+use Socket;
+use Cwd qw(abs_path);
+use POSIX qw(strftime);
+use LWP::UserAgent;
+use URI;
+our @ISA = qw(Exporter);
+our @EXPORT = qw(setup totmp fetch_uri print_login_info press_enter $server $tmp $USER $HOME $sname $deploy $addrend $base_uri $ua $admin_username $requires_sql $addrlast $sqlhost $sqluser $sqlpass $sqldb $admin_password $scriptsdev $human $email);
+
+our $server = "scripts.mit.edu";
+
+our ($tmp, $USER, $HOME, $sname, $deploy, $addrend, $base_uri, $ua, $admin_username, $requires_sql, $addrlast, $sqlhost, $sqluser, $sqlpass, $sqldb, $admin_password, $scriptsdev, $human, $email);
+
+$tmp = ".scripts-tmp";
+sub totmp {
+  open(FILE, ">$tmp");
+  print FILE $_[0];
+  close(FILE);
+}
+
+$ua = LWP::UserAgent->new;
+push @{$ua->requests_redirectable}, 'POST';
+
+sub fetch_uri {
+    my ($uri, $get, $post) = @_;
+    my $u = URI->new($uri);
+    my $req;
+    if (defined $post) {
+	$u->query_form($post);
+	my $content = $u->query;
+	$u->query_form($get);
+	$req = HTTP::Request->new(POST => $u->abs($base_uri));
+	$req->content_type('application/x-www-form-urlencoded');
+	$req->content($content);
+    } else {
+	$u->query_form($get) if (defined $get);
+	$req = HTTP::Request->new(GET => $u->abs($base_uri));
+    }
+    my $res = $ua->request($req);
+    if ($res->is_success) {
+	return $res->content;
+    } else {
+	print STDERR "Error fetching configuration page: ", $res->status_line, "\n";
+	return undef;
+    }
+}
+
+sub print_login_info {
+  print "\nYou will be able to log in to $sname using the following:\n";
+  print "  username: $admin_username\n";
+  print "  password: $admin_password\n";
+}
+
+sub getclienthostname {
+    if (my $sshclient = $ENV{"SSH_CLIENT"}) {
+	my ($clientip) = split(' ', $sshclient);
+	my $hostname = gethostbyaddr(inet_aton($clientip), AF_INET);
+	return $hostname || $clientip;
+    } else {
+	return hostname();
+    }
+}
+
+sub press_enter {
+  local $/ = "\n";
+  print "Press [enter] to continue with the install.";
+  my $enter = <STDIN>; 
+}
+
+sub setup {
+  $ENV{PATH} = '/bin:/usr/bin';
+  $USER = $ENV{USER};
+  $HOME = $ENV{HOME};
+  
+  ($sname, $deploy, $addrend, $admin_username, $requires_sql, $scriptsdev, $human) = @ARGV;
+  chdir "$HOME/web_scripts/$addrend";
+  $email = "$human\@mit.edu";
+  
+  if($addrend =~ /^(.*)\/$/) {
+    $addrend = $1;
+  }
+  ($addrlast) = ($addrend =~ /([^\/]*)$/);
+  
+  $base_uri = "http://$USER.$server/$addrend/";
+  
+  if($requires_sql) {
+    print "\nCreating SQL database for $sname...\n";
+   
+    open GETPWD, '-|', "/mit/scripts/sql/bin$scriptsdev/get-password";
+    ($sqlhost, $sqluser, $sqlpass) = split(/\s/, <GETPWD>);
+    close GETPWD;
+    open SQLDB, '-|', "/mit/scripts/sql/bin$scriptsdev/get-next-database", $addrlast;
+    $sqldb = <SQLDB>;
+    close SQLDB;
+    open SQLDB, '-|', "/mit/scripts/sql/bin$scriptsdev/create-database", $sqldb;
+    $sqldb = <SQLDB>;
+    close SQLDB;
+    if($sqldb eq "") {
+      print "\nERROR:\n";
+      print "Your SQL account failed to create a SQL database.\n";
+      print "You should log in at http://sql.mit.edu to check whether\n";
+      print "your SQL account is at its database limit or its storage limit.\n";
+      print "If you cannot determine the cause of the problem, please\n";
+      print "feel free to contact sql\@mit.edu for assistance.\n";
+      open FAILED, ">.failed";
+      close FAILED;
+      exit 1;
+    }
+  }
+ 
+  if(-e "$HOME/web_scripts/$addrend/.admin") { 
+    open ADMIN, "<$HOME/web_scripts/$addrend/.admin";
+    $admin_password=<ADMIN>;
+    chomp($admin_password);
+    close ADMIN;
+    unlink "$HOME/web_scripts/$addrend/.admin";
+  } 
+
+  print "\nConfiguring $sname...\n";
+  if($requires_sql) {
+    print "A copy of ${USER}'s SQL login info will be placed in\n/mit/$USER/web_scripts/$addrend.\n";
+  }
+  
+  open(VERSION, ">.scripts-version") or die "Can't write scripts-version file: $!\n";
+  print VERSION strftime("%F %T %z\n", localtime);
+  print VERSION $ENV{'USER'}, '@', getclienthostname(), "\n";
+  my $tarball = abs_path("/mit/scripts/deploy$scriptsdev/$deploy.tar.gz");
+  print VERSION $tarball, "\n";
+  $tarball =~ s|/deploydev/|/deploy/|;
+  print VERSION dirname($tarball), "\n";
+  close(VERSION);
+
+  select STDOUT;
+  $| = 1; # STDOUT is *hot*!
+}
+
+1;
Index: tags/fc15-eol/locker/deploy/bin/phpbb
===================================================================
--- tags/fc15-eol/locker/deploy/bin/phpbb	(revision 2244)
+++ tags/fc15-eol/locker/deploy/bin/phpbb	(revision 2244)
@@ -0,0 +1,203 @@
+#!/usr/bin/perl
+use strict;
+use FindBin qw($Bin);
+use lib $Bin;
+use onserver_star;
+use File::Path;
+
+setup();
+
+# Initial installation page
+fetch_uri(
+    'install/index.php',
+    {mode => 'install',
+     language => 'en'},
+    {});
+print "Loaded initial installation page\n";
+
+# Requirements page
+fetch_uri(
+    'install/index.php',
+    {mode => 'install',
+     sub => 'requirements',
+     language => 'en'},
+    {});
+print "Loaded requirements page\n";
+
+# Database page
+fetch_uri(
+    'install/index.php',
+    {mode => 'install',
+     sub => 'database',
+     language => 'en'},
+    {img_imagick => '/usr/bin/'});
+print "Loaded database page\n";
+
+# Database again
+fetch_uri(
+    'install/index.php',
+    {mode => 'install',
+     sub => 'database'},
+    {dbms => 'mysql',
+     dbhost => $sqlhost,
+     dbname => $sqldb,
+     dbuser => $sqluser,
+     dbpasswd => $sqlpass,
+     table_prefix => '',
+     img_imagick => '/usr/bin/',
+     language => 'en',
+     testdb => 'true'});
+print "Loaded database page (part 2)\n";
+
+# Administrator page
+fetch_uri(
+    'install/index.php',
+    {mode => 'install',
+     sub => 'administrator'},
+    {img_imagick => '/usr/bin/',
+     language => 'en',
+     dbms => 'mysql',
+     dbhost => $sqlhost,
+     dbport => '',
+     dbname => $sqldb,
+     dbuser => $sqluser,
+     dbpasswd => $sqlpass,
+     table_prefix => ''});
+print "Loaded administrator page\n";
+
+# Administrator page again
+fetch_uri(
+    'install/index.php',
+    {mode => 'install',
+     sub => 'administrator'},
+    {default_lang => 'en',
+     admin_name => $admin_username,
+     admin_pass1 => $admin_password,
+     admin_pass2 => $admin_password,
+     board_email1 => $email,
+     board_email2 => $email,
+     img_imagick => '/usr/bin/',
+     language => 'en',
+     dbms => 'mysql',
+     dbhost => $sqlhost,
+     dbport => '',
+     dbname => $sqldb,
+     dbuser => $sqluser,
+     dbpasswd => $sqlpass,
+     table_prefix => '',
+     check => 'true'});
+print "Loaded administrator page (part 2)\n";
+
+# Config file page
+fetch_uri(
+    'install/index.php',
+    {mode => 'install',
+     sub => 'config_file'},
+    {img_imagick => '/usr/bin/',
+     default_lang => 'en',
+     admin_name => $admin_username,
+     admin_pass1 => $admin_password,
+     admin_pass2 => $admin_password,
+     board_email1 => $email,
+     board_email2 => $email,
+     language => 'en',
+     dbms => 'mysql',
+     dbhost => $sqlhost,
+     dbport => '',
+     dbname => $sqldb,
+     dbuser => $sqluser,
+     dbpasswd => $sqlpass,
+     table_prefix => ''});
+print "Loaded config file page\n";
+
+# Advanced page
+fetch_uri(
+    'install/index.php',
+    {mode => 'install',
+     sub => 'advanced'},
+    {img_imagick => '/usr/bin/',
+     language => 'en',
+     dbms => 'mysql',
+     dbhost => $sqlhost,
+     dbport => '',
+     dbname => $sqldb,
+     dbuser => $sqluser,
+     dbpasswd => $sqlpass,
+     table_prefix => '',
+     default_lang => 'en',
+     admin_name => $admin_username,
+     admin_pass1 => $admin_password,
+     admin_pass2 => $admin_password,
+     board_email1 => $email,
+     board_email2 => $email});
+print "Loaded advanced setup page\n";
+
+# Create database tables
+fetch_uri(
+    'install/index.php',
+    {mode => 'install',
+     sub => 'create_table'},
+    {email_enable => '1',
+     smtp_delivery => '0',
+     smtp_auth => 'PLAIN',
+     cookie_secure => '0',
+     force_server_vars => '0',
+     server_protocol => 'http://',
+     server_name => "$USER.scripts.mit.edu",
+     server_port => '80',
+     script_path => "/$addrend",
+     img_imagick => '/usr/bin/',
+     language => 'en',
+     dbms => 'mysql',
+     dbhost => $sqlhost,
+     dbport => '',
+     dbname => $sqldb,
+     dbuser => $sqluser,
+     dbpasswd => $sqlpass,
+     table_prefix => '',
+     default_lang => 'en',
+     admin_name => $admin_username,
+     admin_pass1 => $admin_password,
+     admin_pass2 => $admin_password,
+     board_email1 => $email,
+     board_email2 => $email});
+print "Loaded database table creation page\n";
+
+# Final page
+fetch_uri(
+    'install/index.php',
+    {mode => 'install',
+     sub => 'final'},
+    {language => 'en',
+     dbms => 'mysql',
+     dbhost => $sqlhost,
+     dbport => '',
+     dbuser => $sqluser,
+     dbpasswd => $sqlpass,
+     dbname => $sqldb,
+     table_prefix => '',
+     default_lang => 'en',
+     admin_name => $admin_username,
+     admin_pass1 => $admin_password,
+     admin_pass2 => $admin_password,
+     board_email1 => $email,
+     board_email2 => $email,
+     img_imagick => '/usr/bin/',
+     ftp_path => '',
+     ftp_user => '',
+     ftp_pass => '',
+     email_enable => '1',
+     smtp_delivery => '0',
+     smtp_host => '',
+     smtp_auth => 'PLAIN',
+     smtp_user => '',
+     smtp_pass => '',
+     cookie_secure => '0',
+     force_server_vars => '0',
+     server_protocol => 'http://',
+     server_name => "$USER.scripts.mit.edu",
+     server_port => '80',
+     script_path => "/$addrend"});
+print "Loaded installation finalization page\n";
+
+rmtree(['install']);
Index: tags/fc15-eol/locker/deploy/bin/prompt-password
===================================================================
--- tags/fc15-eol/locker/deploy/bin/prompt-password	(revision 2244)
+++ tags/fc15-eol/locker/deploy/bin/prompt-password	(revision 2244)
@@ -0,0 +1,40 @@
+#!/bin/sh
+
+name=$1
+deploy=$2
+addrend=$3
+admin_username=$4
+cd $HOME/web_scripts/$addrend
+
+echo
+echo You will be able to control your copy of $name by logging in to
+echo $name using username \"$admin_username\".  This account will have a
+echo password of your choice.  You should not use your Athena account password.
+
+done="0"
+while [ "$done" = "0" ]
+do
+  echo "Please decide upon an admin password, type it, and press [enter]."
+  echo "This password may only contain a-z, A-Z, and 0-9."
+  printf "As you type your password, the cursor will not move: "
+  read admin_pass1
+  echo
+  echo
+  echo "Now please type the same password again and press [enter]."
+  printf "As you type your password, the cursor will not move: "
+  read admin_pass2
+  echo
+
+  if [ "$admin_pass1" = "$admin_pass2" ]; then
+    done="1"
+  else
+    echo
+    echo == Sorry, those passwords do not match.  Please try again. ==
+  fi
+done
+
+echo
+echo OK.  Continuing with the install...
+cat <<EOF > $HOME/web_scripts/$addrend/.admin
+$admin_pass1
+EOF
Index: tags/fc15-eol/locker/deploy/bin/rails
===================================================================
--- tags/fc15-eol/locker/deploy/bin/rails	(revision 2244)
+++ tags/fc15-eol/locker/deploy/bin/rails	(revision 2244)
@@ -0,0 +1,239 @@
+#!/usr/bin/perl
+use strict;
+use FindBin qw($Bin);
+use lib $Bin;
+use onserver;
+use Tie::File;
+use Cwd;
+
+setup();
+
+sub make_db {
+    my($type) = @_;
+    print "\nCreating $type SQL database for $sname...\n";
+    open GETPWD, '-|', "/mit/scripts/sql/bin$scriptsdev/get-password";
+    ($sqlhost, $sqluser, $sqlpass) = split(/\s/, <GETPWD>);
+    close GETPWD;
+    open SQLDB, '-|', "/mit/scripts/sql/bin$scriptsdev/get-next-database", "${addrlast}_${type}";
+    $sqldb = <SQLDB>;
+    close SQLDB;
+    open SQLDB, '-|', "/mit/scripts/sql/bin$scriptsdev/create-database", $sqldb;
+    $sqldb = <SQLDB>;
+    close SQLDB;
+    if($sqldb eq "") {
+        print "\nERROR:\n";
+        print "Your SQL account failed to create a SQL database.\n";
+        print "You should log in at http://sql.mit.edu to check whether\n";
+        print "your SQL account is at its database limit or its storage limit.\n";
+        print "If you cannot determine the cause of the problem, please\n";
+        print "feel free to contact sql\@mit.edu for assistance.\n";
+        open FAILED, ">.failed";
+        close FAILED;
+        exit 1;
+    }
+    return $sqldb;
+}
+
+my $dev_db = make_db("development");
+my $test_db = make_db("test");
+my $prod_db = make_db("production");
+
+my $cwd = getcwd;
+system("rails", "new", $cwd ,"-d", "mysql");
+my $appdir = `basename $cwd`;
+chomp $appdir;
+my $appclass = ucfirst $appdir;
+
+open PUBLIC_HTACCESS, ">public/.htaccess";
+print PUBLIC_HTACCESS <<EOF;
+# General Apache options
+Options +FollowSymLinks +ExecCGI
+
+# If you don't want Rails to look in certain directories,
+# use the following rewrite rules so that Apache won't rewrite certain requests
+#
+# Example:
+#   RewriteCond %{REQUEST_URI} ^/notrails.*
+#   RewriteRule .* - [L]
+
+# Redirect all requests not available on the filesystem to Rails
+# By default the cgi dispatcher is used which is very slow
+#
+# For better performance replace the dispatcher with the fastcgi one
+#
+# Example:
+#   RewriteRule ^(.*)\$ dispatch.fcgi [QSA,L]
+RewriteEngine On
+
+# If your Rails application is accessed via an Alias directive,
+# then you MUST also set the RewriteBase in this htaccess file.
+#
+# Example:
+#   Alias /myrailsapp /path/to/myrailsapp/public
+#   RewriteBase /myrailsapp
+
+RewriteRule ^\$ index.html [QSA]
+RewriteRule ^([^.]+)\$ \$1.html [QSA]
+RewriteCond %{REQUEST_FILENAME} !-f
+RewriteRule ^(.*)\$ dispatch.fcgi [QSA,L]
+
+# In case Rails experiences terminal errors
+# Instead of displaying this message you can supply a file here which will be rendered instead
+#
+# Example:
+#   ErrorDocument 500 /500.html
+
+RewriteBase /$addrend/public/
+EOF
+
+open HTACCESS, ">.htaccess";
+print HTACCESS <<EOF;
+RewriteEngine On
+RewriteRule ^(.*)\$ public/\$1 [QSA,L]
+RewriteBase /$addrend/
+EOF
+
+tie my @railsenv, 'Tie::File', 'config/environment.rb';
+unshift @railsenv, "# ENV['RAILS_ENV'] ||= 'production'";
+unshift @railsenv, "# Uncomment below to put Rails into production mode";
+unshift @railsenv, "";
+unshift @railsenv, "ENV['RAILS_RELATIVE_URL_ROOT'] = \"/$addrend\"";
+untie @railsenv;
+
+tie my @railsdb, 'Tie::File', 'config/database.yml';
+for (@railsdb) {
+    s/username:.*$/username: $sqluser/;
+    s/password:.*$/password: $sqlpass/;
+    s/host:.*$/host: $sqlhost/;
+    s/database:.*_development.*/database: $dev_db/;
+    s/database:.*_test.*/database: $test_db/;
+    s/database:.*_production.*/database: $prod_db/;
+}
+untie @railsdb;
+
+tie my @railswelcome, 'Tie::File', 'public/index.html';
+for (@railswelcome) {
+    s/Create your database/Sync your database/;
+    s/to create your database\..*/to create tables in your database.<\/p>/;
+}
+untie @railswelcome;
+
+tie my @railsfcgi, 'Tie::File', 'public/dispatch.fcgi';
+for (@railsfcgi) {
+    s/^[^#]*RailsFCGIHandler/## Commented out by scripts.mit.edu autoinstaller\n## RailsFCGIHandler/;
+}
+untie @railsfcgi;
+open RAILSFCGI, ">>public/dispatch.fcgi";
+print RAILSFCGI "#!/usr/bin/ruby\n";
+print RAILSFCGI <<EOF;
+require File.join(File.dirname(__FILE__), '../config/environment')       
+require 'rack'
+
+## Added by scripts.mit.edu autoinstaller to reload when app code changes
+Thread.abort_on_exception = true
+
+class Rack::PathInfoRewriter
+  def initialize(app)
+    \@app = app
+  end
+
+  def call(env)
+    env["SCRIPT_NAME"] = ""
+    parts = env['REQUEST_URI'].split('?')
+    env['PATH_INFO'] = parts[0]
+    env['QUERY_STRING'] = parts[1].to_s
+    \@app.call(env)
+  end
+end
+
+
+t1 = Thread.new do
+  dispatch_logger = Logger.new(File.join(Rails.root,'log/dispatcher.log'))
+
+  begin
+    Rack::Handler::FastCGI.run Rack::PathInfoRewriter.new(Rack::URLMap.new("/$appdir" => ${appclass}::Application))
+  rescue => e
+   dispatch_logger.error(e)
+   raise e
+  end
+end
+t2 = Thread.new do
+   # List of directories to watch for changes before reload.
+   # You may want to also watch public or vendor, depending on your needs.
+   Thread.current[:watched_dirs] = ['app', 'config', 'db', 'lib']
+
+   # List of specific files to watch for changes.
+   Thread.current[:watched_files] = ['public/dispatch.fcgi',
+				     'public/.htaccess']
+   # Sample filter: /(\.rb|\.erb)\$/.  Default filter: watch all files
+   Thread.current[:watched_extensions] = //
+   # Iterations since last reload
+   Thread.current[:iterations] = 0
+
+   def modified(file)
+     begin
+       mtime = File.stat(file).mtime
+     rescue
+       false
+     else
+       if Thread.current[:iterations] == 0
+         Thread.current[:modifications][file] = mtime
+       end
+       Thread.current[:modifications][file] != mtime
+     end
+   end
+
+   # Don't symlink yourself into a loop.  Please.  Things will still work
+   # (Linux limits your symlink depth) but you will be sad
+   def modified_dir(dir)
+     Dir.new(dir).each do |file|
+       absfile = File.join(dir, file)
+       if FileTest.directory? absfile
+         next if file == '.' or file == '..'
+         return true if modified_dir(absfile)
+       else
+         return true if Thread.current[:watched_extensions] =~ absfile &&
+	   modified(absfile)
+       end
+     end
+     false
+   end
+
+   def reload
+     Thread.current[:modifications] = {}
+     Thread.current[:iterations] = 0
+     # This is a kludge, but at the same time it works.
+     # Will kill the current FCGI process so that it is reloaded
+     # at next request.
+     raise RuntimeError
+   end
+
+   Thread.current[:modifications] = {}
+   # Wait until the modify time changes, then reload.
+   while true
+     dir_modified = Thread.current[:watched_dirs].inject(false) {|z, dir| z || modified_dir(File.join(File.dirname(__FILE__), '..', dir))}
+     file_modified = Thread.current[:watched_files].inject(false) {|z, file| z || modified(File.join(File.dirname(__FILE__), '..', file))}
+     reload if dir_modified || file_modified
+     Thread.current[:iterations] += 1
+     sleep 1
+   end
+end
+
+t1.join
+t2.join
+## End of scripts.mit.edu autoinstaller additions
+EOF
+chmod 0755,'public/dispatch.fcgi';
+
+# have to explicitly take a dependency on fcgi
+open GEMFILE, ">>Gemfile";
+print GEMFILE "gem 'fcgi'\n";
+close GEMFILE;
+
+print "Your application is located in:\n";
+print "  /mit/$USER/web_scripts/$addrend/\n";
+print "To run programs like rake or script/generate, run\n";
+print "  'ssh -k $USER\@scripts' and cd to the above directory.\n\n";
+press_enter;
+
+exit 0;
Index: tags/fc15-eol/locker/deploy/bin/scripts-chipmunkpoll
===================================================================
--- tags/fc15-eol/locker/deploy/bin/scripts-chipmunkpoll	(revision 2244)
+++ tags/fc15-eol/locker/deploy/bin/scripts-chipmunkpoll	(revision 2244)
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+sname="Chipmunk Poll"
+deploy="chipmunkpoll"
+prompt_username=1
+. /mit/scripts/deploy/bin$scriptsdev/install-onathena
Index: tags/fc15-eol/locker/deploy/bin/scripts-exponent
===================================================================
--- tags/fc15-eol/locker/deploy/bin/scripts-exponent	(revision 2244)
+++ tags/fc15-eol/locker/deploy/bin/scripts-exponent	(revision 2244)
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+sname="Exponent"
+deploy="exponent"
+prompt_username=1
+. /mit/scripts/deploy/bin$scriptsdev/install-onathena
Index: tags/fc15-eol/locker/deploy/bin/trac
===================================================================
--- tags/fc15-eol/locker/deploy/bin/trac	(revision 2244)
+++ tags/fc15-eol/locker/deploy/bin/trac	(revision 2244)
@@ -0,0 +1,69 @@
+#!/usr/bin/perl
+use strict;
+use FindBin qw($Bin);
+use lib $Bin;
+use onserver;
+use Cwd;
+use File::Path;
+use URI::Escape;
+use DBI;
+use Config::IniFiles;
+
+setup();
+
+print "\nEnter the name of your project (the title of this Trac instance).\n";
+print "Project name: ";
+my $name=<STDIN>;
+chomp($name);
+
+my $dbh = DBI->connect("DBI:mysql:database=$sqldb;host=$sqlhost", $sqluser, $sqlpass, {RaiseError => 1});
+$dbh->do('alter database collate utf8_general_ci');
+
+my $dbstring = "mysql://" . uri_escape($sqluser) . ":" . uri_escape($sqlpass) . "\@$sqlhost/$sqldb";
+
+print "\nEnter the type of version-control repository this project uses.\n";
+print "You'll have to set up the repo yourself; feel free to ask scripts@ for help.\n";
+print "If you don't want version-control integration, take the default.\n";
+print "Repository type (default svn; also bzr, git, hg): ";
+my $repotype=<STDIN>;
+chomp($repotype);
+$repotype = $repotype ? $repotype : 'svn';
+
+print "\nEnter the path to the version-control repository.\n";
+print "If you don't want version-control integration, leave blank.\n";
+print "Path to repository: ";
+my $repopath=<STDIN>;
+chomp($repopath);
+
+print STDERR "running trac-admin:\n";
+system(qw(/usr/bin/trac-admin tracdata initenv),
+       $name, $dbstring, $repotype, $repopath);
+# XXX this exposes the SQL password on the command line
+
+#aka perl -pe 's/\@ADDREND\@/$addrend/g' <.htaccess.in >.htaccess
+open IN, '<.htaccess.in'; open OUT, '>.htaccess';
+while (<IN>) {
+    s/\@ADDREND\@/~$USER\/$addrend/g;
+    print OUT $_;
+}
+close IN; close OUT;
+
+my $cfg = Config::IniFiles->new(-file => 'tracdata/conf/trac.ini');
+$cfg->setval('trac', 'default_charset', 'utf-8');
+$cfg->AddSection('components');
+$cfg->newval('components', 'webadmin.*', 'enabled');
+$cfg->newval('components', 'tracext.git.*', 'enabled') if $repotype eq "git";
+$cfg->newval('components', 'tracext.hg.*', 'enabled') if $repotype eq "hg";
+$cfg->RewriteConfig();
+
+system(qw(/usr/bin/trac-admin tracdata permission add), $human, 'TRAC_ADMIN');
+
+chmod 0777, '.htaccess';
+unlink '.htaccess.in';
+
+open OUT, '>tracdata/.htaccess';
+print OUT "Deny from all\n";
+close OUT;
+chmod 0777, 'tracdata/.htaccess';
+
+exit 0;
Index: tags/fc15-eol/locker/deploy/bin/turbogears
===================================================================
--- tags/fc15-eol/locker/deploy/bin/turbogears	(revision 2244)
+++ tags/fc15-eol/locker/deploy/bin/turbogears	(revision 2244)
@@ -0,0 +1,189 @@
+#!/usr/bin/perl
+use strict;
+use FindBin qw($Bin);
+use lib $Bin;
+use onserver;
+use Cwd;
+use File::Path;
+use URI::Escape;
+use DBI;
+use Config::IniFiles;
+use FileHandle;
+
+setup();
+
+print "\nEnter the name of your project (the title of this TurboGears instance).\n";
+my $name;
+while (1) {
+    print "Project name: ";
+    $name=<STDIN>;
+    chomp($name);
+    if ($name =~ /^[a-zA-Z][a-zA-Z0-9_ -]+$/) {
+	last;
+    }
+    print "Invalid project name; it should start with a letter and not contain\npunctuation other than dashes or underscores.\n";
+}	
+
+# quickstart turns spaces or underscores into dashes...
+$name =~ s/[ _-]+/-/g;
+
+my $defpack=lc($name);
+$defpack =~ s/[ -]/_/g;
+$defpack =~ s/[^a-z0-9_]//g;
+if (! ($defpack =~ /^[a-zA-Z]/)) {
+    $defpack = "p$defpack";
+}
+print "\nEnter the name for your project's python package.\n";
+my $pack;
+while (1) {
+    print "Package name [${defpack}]: ";
+    $pack=<STDIN>;
+    chomp($pack);
+    if (!($pack)) {
+	$pack=$defpack;
+	last;
+    } elsif ($pack =~ /^[a-zA-Z][a-zA-Z0-9_]+$/) {
+	last;
+    }
+    print "Invalid package name; it should start with a letter and contain only letters,\nnumbers, and underscores.\n";
+}
+
+print "\nWhat ORM (Object-Relational Mapper) do you want to use with this TurboGears\ninstance?  Select from the following list:\n";
+print "1. SQLAlchemy Elixir\n";
+print "2. SQLAlchemy\n";
+print "3. SQLObject\n";
+my $orm;
+while (1) {
+    print "ORM [1]: ";
+    my $ormnum=<STDIN>;
+    chomp($ormnum);
+    if ((!$ormnum) || $ormnum == 1) {
+	$orm = "elixir";
+	last;
+    } elsif ($ormnum == 2) {
+	$orm = "sqlalchemy";
+	last;
+    } elsif ($ormnum == 3) {
+	$orm = "sqlobject";
+	last;
+    }
+    print "Please choose 1, 2, or 3.\n";
+}
+
+print "\nWhat template do you want to use with this TurboGears instance?  Select from\nthe following list:\n";
+print "1. turbogears: normal template, recommended for most projects\n";
+print "2. tgbig:  a more complex directory structure for big projects\n";
+my $templ;
+while (1) {
+    print "Template [1]: ";
+    my $templnum=<STDIN>;
+    chomp($templnum);
+    if ((!$templnum) || $templnum == 1) {
+	$templ = "turbogears";
+	last;
+    } elsif ($templnum == 2) {
+	$templ = "tgbig";
+	last;
+    }
+    print "Please choose 1, 2, or 3.\n";
+}
+
+print "\nDo you want to use Identity (usernames/passwords) in this project?\n(These would be separate from Athena usernames/passwords.)\n";
+print "1. no identity: no logins, everyone sees the same pages\n";
+print "2. standard identity: users log in with site-specific usernames and passwords\n";
+#print "3. certificates: users are identified by their MIT certificates\n";
+my $ident;
+my $certpatch=0;
+while (1) {
+    print "Identity [1]: ";
+    my $identnum=<STDIN>;
+    chomp($identnum);
+    if ((!$identnum) || $identnum == 1) {
+	$ident = "no";
+	last;
+    } elsif ($identnum == 2) {
+	$ident = "yes";
+	last;
+    } elsif ($identnum == 3) {
+	$ident = "yes";
+	$certpatch = 1;
+	last;
+    }
+}
+
+open (FLUPCONF, ">flupconfig.py");
+print FLUPCONF <<EOF;
+code_dir = "/mit/$USER/Scripts/turbogears/$name/"
+project_name = "$name"
+package_name = "$pack"
+EOF
+close (FLUPCONF);
+
+system("ln","-s","/mit/$USER/Scripts/turbogears/$name/$pack","./$pack");
+system("ln","-s","/mit/$USER/Scripts/turbogears/$name/$pack/static",
+    "./static");
+
+chdir("/mit/$USER/Scripts/turbogears/");
+print "\nRunning tg-admin quickstart...\n";
+open(QS, "|/usr/bin/tg-admin quickstart $name --package=$pack --$orm --templates=$templ")
+    or die("tg-admin quickstart failed open!");
+QS->autoflush(1);
+print QS "$ident\n" or die("tg-admin quickstart failed specify ident!");
+close(QS) or die("tg-admin quickstart failed close!");
+
+# Put in the sqldb
+if ($orm eq "sqlobject") {
+    my $uriuser = uri_escape($sqluser);
+    my $uripass = uri_escape($sqlpass);
+    foreach my $fil (("$name/dev.cfg", "$name/sample-prod.cfg"))
+    {
+	open my $in, '<', $fil or die "Can't read old file: $!";
+	open my $out, '>', "$fil.new" or die "Can't write new file: $!";
+
+	while (<$in>) {
+	    s/^sqlobject\.dburi(.*)$/#sqlobject.dburi\2\nsqlobject.dburi="mysql:\/\/$uriuser:$uripass\@$sqlhost\/$sqldb"/;
+	    print $out $_;
+	}
+	close $out;
+	rename "$fil.new", $fil
+	    or die "Cannot rename: $!";
+    }
+} else {
+    system(qw(sed -ri),"s&^sql(alchemy|object)\.dburi(.*)\$&#sql\\1.dburi\\2\\nsql\\1.dburi=\"mysql://$sqlhost/$sqldb?read_default_file=~/.my.cnf\"&","$name/dev.cfg", "$name/sample-prod.cfg") == 0 or die "sed db failed!";
+}
+system(qw(sed -ri),'s/^#? *autoreload\.on.*$/autoreload.on = False # breaks the scripts flup setup/',"$name/dev.cfg") == 0 or die "sed autoreload failed!";
+my $addrendescsl = $addrend;
+$addrendescsl =~ s|/|\\/|g;
+# Obviated by a TurboGears upgrade
+#system(qw(sed -ri),'s/^(\[global\] *)$/\1\nserver.webpath = "\/'."$addrendescsl".'"/',"$name/dev.cfg") == 0 or die "sed webpath failed!";
+if ($orm eq "elixir" or $orm eq "sqlalchemy") {
+    system(qw(sed -ri),'s/^(\[global\] *)$/\1\nsqlalchemy.pool_recycle = 30 # Need a short timeout for sql.mit.edu/',"$name/$pack/config/app.cfg") == 0 or die "sed pool_recycle failed!";
+}
+
+# Make logdir
+system('mkdir','-p',"$name/log");
+
+# Cert patch
+if ($certpatch) {
+    # comment out the password = line in model
+    system(qw(sed -ri),
+	   's/^(.*password.*)$/#\1 -- we use certs, not passwords/',
+	   "$name/$pack/model.py") == 0 or die "sed model for certs failed!";
+    
+    # Stick cert.py in
+    system('cp',"/mit/scripts/deploy$scriptsdev/turbogears-certs/certs.py",
+	   "$name/$pack/") == 0 or die "cp certs.py failed!";
+    
+    # Add the certness to controllers.py
+    system(qw(sed -ri),
+	   's/^(from cherrypy.*)$/\1\nfrom '."$pack".'.certs import with_mit_certs/',
+	   "$name/$pack/controllers.py") == 0 or die "sed controllers import for certs failed!";
+    system(qw(sed -ri),
+	   's/^(\s+)(def login.*)$/\1@with_mit_certs\n\1\2',
+	   "$name/$pack/model.py") == 0 or die "sed model for certs failed!";
+    #-! replace login body
+    #-! replace logout body
+    #-! replace login.kid
+}
+
+exit 0;
Index: tags/fc15-eol/locker/deploy/bin/wordpress
===================================================================
--- tags/fc15-eol/locker/deploy/bin/wordpress	(revision 2244)
+++ tags/fc15-eol/locker/deploy/bin/wordpress	(revision 2244)
@@ -0,0 +1,42 @@
+#!/usr/bin/perl
+use strict;
+use FindBin qw($Bin);
+use lib $Bin;
+use onserver;
+use DBI;
+
+setup();
+
+fetch_uri(
+    'wp-admin/setup-config.php',
+    {step => 2},
+    {dbhost => $sqlhost,
+     uname => $sqluser,
+     dbname => $sqldb,
+     pwd => $sqlpass,
+     prefix => '',
+     submit => 'Submit',
+     step => 2});
+
+my $html = fetch_uri(
+    'wp-admin/install.php',
+    {step => 2},
+    {weblog_title => 'My Blog',
+     admin_email => $email,
+     submit => 'Continue',
+     step => 2});
+while ($html =~ /<code>(.*)<\/code>/g) {
+    $admin_username = $admin_password;
+    $admin_password = $1;
+}
+
+my $dbh = DBI->connect("dbi:mysql:database=$sqldb;host=$sqlhost", $sqluser, $sqlpass);
+$dbh->do("update wp_options set option_value = ? where option_name = 'siteurl'",
+         {}, "/~$USER/$addrend");
+$dbh->do("update wp_options set option_value = ? where option_name = 'home'",
+         {}, "http://$USER.$server/$addrend");
+$dbh->disconnect;
+
+print_login_info();
+print "You will also receive this login information at your MIT email address.\n";
+press_enter();
Index: tags/fc15-eol/locker/deploy/mediawiki-1.11.0/mediawiki-1.11.0.patch
===================================================================
--- tags/fc15-eol/locker/deploy/mediawiki-1.11.0/mediawiki-1.11.0.patch	(revision 2244)
+++ tags/fc15-eol/locker/deploy/mediawiki-1.11.0/mediawiki-1.11.0.patch	(revision 2244)
@@ -0,0 +1,24 @@
+diff -Nur mediawiki-1.11.0.old/AdminSettings.php mediawiki-1.11.0/AdminSettings.php
+--- mediawiki-1.11.0.old/AdminSettings.php	1969-12-31 19:00:00.000000000 -0500
++++ mediawiki-1.11.0/AdminSettings.php	2007-10-09 17:32:52.000000000 -0400
+@@ -0,0 +1,20 @@
++<?php
++/**
++ * On scripts.mit.edu, the user's sole account can be used
++ * both for regular operation of the wiki and for any
++ * maintenance.  Therefore, we just use the username and
++ * password already set in LocalSettings.php.
++ *
++ * @package MediaWiki
++ */
++          
++$wgDBadminuser      = $wgDBuser;
++$wgDBadminpassword  = $wgDBpassword;
++          
++/*
++ * Whether to enable the profileinfo.php script.
++ * (False is the default.)
++ */
++$wgEnableProfileInfo = false;
++          
++?>
Index: tags/fc15-eol/locker/deploy/mediawiki-1.5.6/mediawiki-1.5.6.patch
===================================================================
--- tags/fc15-eol/locker/deploy/mediawiki-1.5.6/mediawiki-1.5.6.patch	(revision 2244)
+++ tags/fc15-eol/locker/deploy/mediawiki-1.5.6/mediawiki-1.5.6.patch	(revision 2244)
@@ -0,0 +1,15 @@
+--- includes/Setup.php	Fri Aug 26 10:05:43 2005
++++ includes/Setup.php	Fri Sep 23 18:46:34 2005
+@@ -117,12 +117,6 @@
+ wfProfileOut( $fname.'-memcached' );
+ wfProfileIn( $fname.'-SetupSession' );
+ 
+-if ( $wgDBprefix ) {
+-	session_name( $wgDBname . '_' . $wgDBprefix . '_session' );
+-} else {
+-	session_name( $wgDBname . '_session' );
+-}
+-
+ if( !$wgCommandLineMode && ( isset( $_COOKIE[session_name()] ) || isset( $_COOKIE[$wgDBname.'Token'] ) ) ) {
+ 	User::SetupSession();
+ 	$wgSessionStarted = true;
Index: tags/fc15-eol/locker/deploy/mediawiki-1.5.8/mediawiki-1.5.8.patch
===================================================================
--- tags/fc15-eol/locker/deploy/mediawiki-1.5.8/mediawiki-1.5.8.patch	(revision 2244)
+++ tags/fc15-eol/locker/deploy/mediawiki-1.5.8/mediawiki-1.5.8.patch	(revision 2244)
@@ -0,0 +1,17 @@
+diff -uNr mediawiki-1.5.8/includes/Setup.php mw-scripts-158/includes/Setup.php
+--- includes/Setup.php	2006-02-11 02:26:47.000000000 -0500
++++ includes/Setup.php	2006-04-14 18:28:29.000000000 -0400
+@@ -118,11 +118,11 @@
+ wfProfileIn( $fname.'-SetupSession' );
+ 
+ if ( $wgDBprefix ) {
+-	$wgCookiePrefix = $wgDBname . '_' . $wgDBprefix;
++	$wgCookiePrefix = str_replace("+", "", $wgDBname . '_' . $wgDBprefix);
+ } elseif ( $wgSharedDB ) {
+ 	$wgCookiePrefix = $wgSharedDB;
+ } else {
+-	$wgCookiePrefix = $wgDBname;
++	$wgCookiePrefix = str_replace("+", "", $wgDBname);
+ }
+ 
+ session_name( $wgCookiePrefix . '_session' );
Index: tags/fc15-eol/locker/deploy/trac/Makefile
===================================================================
--- tags/fc15-eol/locker/deploy/trac/Makefile	(revision 2244)
+++ tags/fc15-eol/locker/deploy/trac/Makefile	(revision 2244)
@@ -0,0 +1,5 @@
+trac.tar.gz: trac
+	tar czf $@ trac
+
+install: trac.tar.gz
+	cp $^ ..
Index: tags/fc15-eol/locker/deploy/trac/trac.fcgi
===================================================================
--- tags/fc15-eol/locker/deploy/trac/trac.fcgi	(revision 2244)
+++ tags/fc15-eol/locker/deploy/trac/trac.fcgi	(revision 2244)
@@ -0,0 +1,70 @@
+#!/usr/bin/python
+
+import os, os.path, sys
+from trac.web.main import dispatch_request
+from trac.web._fcgi import WSGIServer
+import urlparse
+
+env_path = os.getcwd()+'/tracdata'
+os.environ['TRAC_ENV'] = env_path
+
+def send_upgrade_message(environ, start_response):
+    import pwd
+    start_response('500 Internal Server Error', [])
+    locker = pwd.getpwuid(os.getuid())[0]
+    return ['''This Trac instance needs to be upgraded.
+
+From an Athena machine, type
+  ssh %s@scripts trac-admin %s upgrade --no-backup
+  ssh %s@scripts trac-admin %s wiki upgrade
+to upgrade, and then
+  add scripts
+  for-each-server -l %s pkill -u %s trac.fcgi
+to get this message out of the way.
+
+Please ask the scripts.mit.edu maintainers for help
+if you have any trouble, at scripts@mit.edu.
+''' % (locker, env_path, locker, env_path, locker, locker)]
+
+def setup_env():
+    '''Obtain the environment, handling the needs-upgrade check, and cache it.
+
+    This mimics open_environment in trac/env.py.'''
+    import trac.env
+    env = trac.env.Environment(env_path)
+    needs_upgrade = False
+    try:
+        needs_upgrade = env.needs_upgrade()
+    except Exception, e: # e.g. no database connection
+        env.log.exception(e)
+    if env.needs_upgrade():
+        WSGIServer(send_upgrade_message).run()
+        sys.exit(0)
+    if hasattr(trac.env, 'env_cache'):
+        trac.env.env_cache[env_path] = env
+setup_env()
+
+def my_dispatch_request(environ, start_response):
+    if ('REDIRECT_URL' in environ and 'PATH_INFO' in environ
+        and environ['REDIRECT_URL'].endswith(environ['PATH_INFO'])):
+        environ['SCRIPT_NAME'] = environ['REDIRECT_URL'][:-len(environ['PATH_INFO'])]
+
+    # If the referrer has our hostname and path, rewrite it to have
+    # the right protocol and port, too.  This lets the login link go
+    # to the right page.
+    if 'HTTP_REFERER' in environ:
+        referrer = urlparse.urlsplit(environ['HTTP_REFERER'])
+        base = urlparse.urlsplit(
+            ('https://' if environ.get('HTTPS') == 'on' else 'http://') +
+            environ['HTTP_HOST'] +
+            environ['SCRIPT_NAME'])
+        if referrer.hostname == base.hostname and \
+           (referrer.path == base.path or
+            referrer.path.startswith(base.path + '/')):
+            environ['HTTP_REFERER'] = urlparse.urlunsplit(
+                (base.scheme, base.netloc,
+                 referrer.path, referrer.query, referrer.fragment))
+
+    return dispatch_request(environ, start_response)
+
+WSGIServer(my_dispatch_request).run()
Index: tags/fc15-eol/locker/deploy/trac/trac/.htaccess.in
===================================================================
--- tags/fc15-eol/locker/deploy/trac/trac/.htaccess.in	(revision 2244)
+++ tags/fc15-eol/locker/deploy/trac/trac/.htaccess.in	(revision 2244)
@@ -0,0 +1,19 @@
+AuthType SSLCert
+AuthSSLCertAuthoritative off
+AuthSSLCertVar SSL_CLIENT_S_DN_Email
+AuthSSLCertStripSuffix @MIT.EDU
+Require valid-user
+AuthOptional on
+
+RewriteEngine on
+
+RewriteCond %{HTTPS} =on
+RewriteRule ^logout http://%{SERVER_NAME}%{REQUEST_URI} [R,L]
+
+RewriteCond %{REQUEST_URI} !^/@ADDREND@/trac.fcgi
+RewriteRule ^(.*)$ /@ADDREND@/trac.fcgi/$1 [L]
+
+<Files login>
+AuthOptional off
+ErrorDocument 401 /__scripts/needcerts
+</Files>
Index: tags/fc15-eol/locker/deploy/trac/trac/trac.fcgi
===================================================================
--- tags/fc15-eol/locker/deploy/trac/trac/trac.fcgi	(revision 2244)
+++ tags/fc15-eol/locker/deploy/trac/trac/trac.fcgi	(revision 2244)
@@ -0,0 +1,2 @@
+#!/bin/sh
+exec /afs/athena.mit.edu/contrib/scripts/deploy/trac/trac.fcgi "$@"
Index: tags/fc15-eol/locker/doc/autoinstallers
===================================================================
--- tags/fc15-eol/locker/doc/autoinstallers	(revision 2244)
+++ tags/fc15-eol/locker/doc/autoinstallers	(revision 2244)
@@ -0,0 +1,63 @@
+-*- text -*-
+
+== How to update an autoinstaller to a new version of the upstream package ==
+
+Things to check beforehand:
+- Make sure /mit/scripts/deploydev is up to date from /mit/scripts/deploy (deploydev is not a svn checkout and is probably missing changes from deploy)
+
+Steps:
+# Example values
+PKG=wordpress
+NEWVERS=2.5.1
+OLDVERS=2.3.3
+URL=http://www.example.com/download/wordpress-2.5.1.tar.gz
+
+# Create a new directory in /mit/scripts/deploydev for the new version
+mkdir /mit/scripts/deploydev/$PKG-$NEWVERS
+
+# Copy any scripts patches to the new directory
+cp /mit/scripts/deploydev/$PKG-$OLDVERS/*.patch /mit/scripts/deploydev/$PKG-$NEWVERS/
+# Some scripts might have other files in here
+# Make sure the patch is still relevant for the current version of the package
+
+# Download the new package from the upstream site
+wget -O /mit/scripts/deploydev/$PKG-$NEWVERS/$PKG-$NEWVERS.tar.gz "$URL"
+
+# Update the symlink for the new package version
+cd /mit/scripts/deploydev && ln -nsf $PKG-$NEWVERS/$PKG-NEWVERS.tar.gz $PKG.tar.gz
+
+# Try an autoinstall
+ssh linerva -t env scriptsdev=dev athrun scripts
+
+# Fix any bugs that were introduced, probably in /mit/scripts/deploydev/bin/$PKG or /mit/scripts/bin/scripts-$PKG, or the patches
+
+# Commit your changes by moving them to /mit/scripts/deploy
+cp -a /mit/scripts/deploydev/$PKG-NEWVERS /mit/scripts/deploydev/$PKG.tar.gz /mit/scripts/deploy/
+
+# Test the new version from linerva and athena.dialup
+
+
+== How to generate an autoupdate ==
+
+cd /tmp
+# Use --dev if you haven't pushed to deploy yet
+/mit/scripts/sbin/propose-update --dev $PKG $OLDVERS $NEWVERS
+cd $PKG-$OLDVERS-to-$NEWVERS.proposal
+# If there is any custom setup that needs to be performed
+# (e.g. something in /mit/scripts/deploy/bin), do so to the
+# $PKG-$OLDVERS and $PKG-$NEWVERS directories, then do
+(cd .. && /mit/scripts/sbin/propose-update --redo-all --dev $PKG $OLDVERS $NEWVERS)
+# Look at the files that were generated to make sure they're sane
+# If necessary, add pre- and post- hooks, such as for a DB update script
+emacs extra/prepatch.sh
+emacs extra/postpatch.sh
+# Generate the patch
+cd ..
+# --dev here means to put the update in /mit/scripts/deploydev/updates
+/mit/scripts/sbin/build-update --dev $PKG $OLDVERS $NEWVERS
+# Test the update by running cd /mit/foo/web_scripts/bar && /mit/scripts/deploydev/updates/$PKG-#OLDVERS-to-$NEWVERS/update "foo"
+
+# If necessary, repeat this process. You can edit the files in the
+# $PKG-$OLDVERS and $PKG-$NEWVERS subdirectories of the proposal,
+# passing --redo-* options to propose-update as necessary to cause it
+# to regenerate the file lists from the subdirectories
Index: tags/fc15-eol/locker/doc/cluedump/AFS.tex
===================================================================
--- tags/fc15-eol/locker/doc/cluedump/AFS.tex	(revision 2244)
+++ tags/fc15-eol/locker/doc/cluedump/AFS.tex	(revision 2244)
@@ -0,0 +1,65 @@
+\subsection{AFS}
+
+\begin{frame}
+  \frametitle{AFS access controls}
+  \begin{itemize}
+  \item AFS enforces server side access controls.
+  \item On Athena systems: user's password $\to$ Kerberos tickets
+    $\to$ AFS tokens, which authenticate the client to the AFS server.
+  \item On scripts, we don't have the user's password or tickets.
+  \item User's scripts are not publicly readable.
+  \item Access is controlled through a single {\tt daemon.scripts} AFS
+    user.
+  \end{itemize}
+\end{frame}
+
+\begin{frame}
+  \frametitle{Isolating users on scripts}
+  \begin{itemize}
+  \item If all users share {\tt daemon.scripts} AFS tokens, how are
+    they prevented from accessing each other's {\tt web\_scripts}?
+  \item On scripts, we enforce additional restrictions in the AFS
+    kernel module.
+    \begin{itemize}
+    \item \texttt{afsAccessOK()} in
+      \texttt{openafs/src/afs/VNOPS/afs\_vnop\_access.c}
+      \end{itemize}
+  \end{itemize}
+\end{frame}
+
+\begin{frame}[fragile]
+  \only<1>{You can only use {\tt daemon.scripts} credentials to access
+    files in a volume with volume ID equal to your UID,}%
+  \only<2>{or the file is {\tt system:anyuser} readable
+    anyway,\vspace{\baselineskip}}%
+  \only<3>{or the {\tt apache} or {\tt postfix} users are doing a {\tt
+      stat()},\vspace{\baselineskip}}%
+  \only<4>{or the {\tt apache} user is trying to read a file with mode
+    {\tt 777},\vspace{\baselineskip}}%
+  \only<5>{or the {\tt root} or {\tt signup} users are accessing file
+    with the special {\tt D} or {\tt E} bits.}%
+
+\begin{footnotesize}
+\begin{semiverbatim}
+ int
+ afs_AccessOK(struct vcache *avc, afs_int32 arights,
+              struct vrequest *areq, afs_int32 check_mode_bits)
+ \{
+     \ldots
++    if (\alert<1>{!(areq->realuid == avc->fid.Fid.Volume)} &&
++        \alert<2>{!((avc->anyAccess | arights) == avc->anyAccess)} &&
++        \alert<3>{!(arights == PRSFS_LOOKUP && areq->realuid == HTTPD_UID) &&}
++        \alert<3>{!(arights == PRSFS_LOOKUP && areq->realuid == POSTFIX_UID)} &&
++        \alert<4>{!(arights == PRSFS_READ && areq->realuid == HTTPD_UID &&}
++        \alert<4>{  avc->m.Mode == 0100777)} &&
++        \alert<5>{!(PRSFS_USR3 == afs_GetAccessBits(avc, PRSFS_USR3, areq) &&}
++        \alert<5>{  areq->realuid == 0) &&}
++        \alert<5>{!(PRSFS_USR4 == afs_GetAccessBits(avc, PRSFS_USR4, areq) &&}
++        \alert<5>{  (areq->realuid == 0 || areq->realuid == SIGNUP_UID))}) \{
++       return 0;
++    \}
+     \ldots
+\end{semiverbatim}
+\end{footnotesize}
+\end{frame}
+
Index: tags/fc15-eol/locker/doc/cluedump/LDAP.tex
===================================================================
--- tags/fc15-eol/locker/doc/cluedump/LDAP.tex	(revision 2244)
+++ tags/fc15-eol/locker/doc/cluedump/LDAP.tex	(revision 2244)
@@ -0,0 +1,17 @@
+\subsection{LDAP}
+
+\begin{frame}
+  \frametitle{LDAP data}
+
+  \begin{itemize}
+  \item All user-specific information is stored in LDAP records
+  \item Each scripts server runs a local LDAP daemon with multi-master
+    replication
+  \item Each user has a \texttt{posixAccount} and at least one
+    \texttt{apacheConfig} and \texttt{scriptsVhost}
+  \item Users can request additional virtual hosts
+  \item We hope to create a web interface (phase 1 of
+    ``scripts-pony'') for users to create virtual hosts in the
+    \texttt{*.user.scripts.mit.edu} namespace
+  \end{itemize}
+\end{frame}
Index: tags/fc15-eol/locker/doc/cluedump/LVS.tex
===================================================================
--- tags/fc15-eol/locker/doc/cluedump/LVS.tex	(revision 2244)
+++ tags/fc15-eol/locker/doc/cluedump/LVS.tex	(revision 2244)
@@ -0,0 +1,22 @@
+\subsection{LVS}
+
+\begin{frame}
+  \frametitle{Linux Virtual Server}
+  \begin{itemize}
+    \item Provides high availability and load balancing
+    \item {\tt heartbeat} provides failover between LVS ``directors''
+    \item {\tt ldirectord} keeps track of online scripts servers and chooses destination server for each request
+  \end{itemize}
+\end{frame}
+
+\begin{frame}
+  \frametitle{Load Balancing}
+  \begin{itemize}
+    \item Users are assigned to scripts servers based on IP
+    \item Works around bugs in scripts that assume a single web server
+  \end{itemize}
+  \begin{center}
+    \only<1>{\includegraphics[width=3in] {Aggregated-cps_www-year.png}}
+    \only<2>{\includegraphics[width=3in] {Aggregated-cps_www-year-clip.png}}
+  \end{center}
+\end{frame}
Index: tags/fc15-eol/locker/doc/cluedump/backend.tex
===================================================================
--- tags/fc15-eol/locker/doc/cluedump/backend.tex	(revision 2244)
+++ tags/fc15-eol/locker/doc/cluedump/backend.tex	(revision 2244)
@@ -0,0 +1,1 @@
+\section{Backend}
Index: tags/fc15-eol/locker/doc/cluedump/closing.tex
===================================================================
--- tags/fc15-eol/locker/doc/cluedump/closing.tex	(revision 2244)
+++ tags/fc15-eol/locker/doc/cluedump/closing.tex	(revision 2244)
@@ -0,0 +1,7 @@
+\section{Further Info}
+\begin{frame}
+  \frametitle{Further Info}
+  Subversion: {\tt svn://scripts.mit.edu/}
+  \\
+  Scripts Hackathon \\ Saturday, 2 PM, W20-557
+\end{frame}
Index: tags/fc15-eol/locker/doc/cluedump/contents.tex
===================================================================
--- tags/fc15-eol/locker/doc/cluedump/contents.tex	(revision 2244)
+++ tags/fc15-eol/locker/doc/cluedump/contents.tex	(revision 2244)
@@ -0,0 +1,5 @@
+\begin{frame}
+  \frametitle{Outline}
+  \tableofcontents[pausesections]
+\end{frame}
+
Index: tags/fc15-eol/locker/doc/cluedump/httpdmods.tex
===================================================================
--- tags/fc15-eol/locker/doc/cluedump/httpdmods.tex	(revision 2244)
+++ tags/fc15-eol/locker/doc/cluedump/httpdmods.tex	(revision 2244)
@@ -0,0 +1,50 @@
+\subsection{Apache modules}
+
+\begin{frame}[fragile]
+  \frametitle{Apache modules}
+  \begin{itemize}
+  \item We make it easy to do authentication against MIT certificates.
+  \item Both \texttt{https://scripts-cert.mit.edu}, and port
+    \texttt{444} on any scripts hostname, are configured to request
+    client certificates.
+  \item \texttt{mod\_ssl} provides the
+    \texttt{SSL\_CLIENT\_S\_DN\_Email} environment variable, but does
+    not integrate with the Apache authentication and authorization
+    framework.
+  \item Wrote a collection of Apache modules to make this cleaner.
+  \end{itemize}
+\end{frame}
+
+\begin{frame}[fragile]
+  \frametitle{\texttt{mod\_auth\_sslcert}}
+  \begin{itemize}
+  \item \texttt{mod\_auth\_sslcert} passes the
+    \texttt{SSL\_CLIENT\_S\_DN\_Email} variable to the Apache
+    authorization handlers.
+  \end{itemize}
+\begin{semiverbatim}
+AuthType SSLCert
+AuthSSLCertVar SSL_CLIENT_S_DN_Email
+AuthSSLCertStripSuffix "@MIT.EDU"
+\end{semiverbatim}
+\end{frame}
+
+\begin{frame}[fragile]
+  \frametitle{\texttt{mod\_authz\_afsgroup}}
+  \begin{itemize}
+  \item \texttt{mod\_authz\_afsgroup} does Apache authorization based
+    on AFS groups.
+  \end{itemize}
+\begin{semiverbatim}
+Require afsgroup system:scripts-team
+\end{semiverbatim}
+\end{frame}
+
+\begin{frame}[fragile]
+  \frametitle{\texttt{mod\_auth\_optional}}
+  \begin{itemize}
+  \item \texttt{mod\_auth\_optional} subverts the authorization
+    process to allow you to serve different pages to users with
+    certificates and users without certificates.
+  \end{itemize}
+\end{frame}
Index: tags/fc15-eol/locker/doc/cluedump/kerberos.tex
===================================================================
--- tags/fc15-eol/locker/doc/cluedump/kerberos.tex	(revision 2244)
+++ tags/fc15-eol/locker/doc/cluedump/kerberos.tex	(revision 2244)
@@ -0,0 +1,47 @@
+\subsection{Kerberos}
+
+\begin{frame}
+  \frametitle{Group locker support}
+
+  \begin{itemize}
+  \item ``Users'' on scripts are actually lockers.
+  \item User IDs are actually locker volume IDs.
+    \pause
+  \item Kerberos is modified to let users SSH in as any locker they
+    administrate.
+    \begin{itemize}
+    \item Replaced the \texttt{.k5login} mechanism:
+      \texttt{krb5\_kuserok()} in
+      \texttt{krb5/src/lib/krb5/os/kuserok.c}
+    \item Calls a Perl script \texttt{/usr/local/sbin/admof} to do the
+      actual check.
+    \end{itemize}
+  \end{itemize}
+\end{frame}
+
+\begin{frame}[fragile]
+\begin{footnotesize}
+\begin{semiverbatim}
+ krb5_boolean KRB5_CALLCONV
+ krb5_kuserok(krb5_context context, krb5_principal principal,
+              const char *luser)
+ \{
+     \ldots
++    if ((pid = fork()) == -1) \{
++       free(princname);
++       return(FALSE);
++    \}
++    if (pid == 0) \{
++#define ADMOF_PATH "/usr/local/sbin/ssh-admof"
++        exec(ADMOF_PATH, ADMOF_PATH, (char *) luser, princname, NULL);
++        exit(1);
++    \}
++    if (waitpid(pid, &status, 0) > 0 && WIFEXITED(status) &&
++        WEXITSTATUS(status) == 33) \{
++        isok = TRUE;
++    \}
+     \ldots
+ \}
+\end{semiverbatim}
+\end{footnotesize}
+\end{frame}
Index: tags/fc15-eol/locker/doc/cluedump/services.tex
===================================================================
--- tags/fc15-eol/locker/doc/cluedump/services.tex	(revision 2244)
+++ tags/fc15-eol/locker/doc/cluedump/services.tex	(revision 2244)
@@ -0,0 +1,89 @@
+\section{Services}
+
+\subsection{Web}
+\begin{frame}
+  \frametitle{Apache}
+  \begin{itemize}
+      \item Everyone wants Apache
+      \item Apache's default configuration isn't safe for scripting
+      \item Scripting \emph{requires} code execution---mod\_php, mod\_perl, mod\_python
+      \item Apache normally runs everything as apache/nobody
+      \item How to secure?
+      \pause
+      \item suEXEC---allows Apache to spawn a process as the user\ldots
+      \item {\ldots}even for static content!
+  \end{itemize}
+\end{frame}
+
+\begin{frame}
+  \frametitle{suEXEC}
+  \begin{itemize}
+    \item setuid program
+    \item Passed the request by Apache
+    \item Verifies that the script is in the {\tt web\_scripts} directory
+    \item Switches to the uid of the file and executes
+    \item Even for static files!
+  \end{itemize}
+\end{frame}
+
+\subsection{Mail}
+
+\begin{frame}[fragile]
+  \frametitle{Postfix}
+  \begin{itemize}
+    \item Standard Postfix server
+    \item No local mailboxes
+    \item All mail is passed to procmail
+  \end{itemize}
+  \begin{verbatim}mailbox_command = /usr/bin/procmail -t \
+-a "${EXTENSION}" ~/mail_scripts/procmailrc\end{verbatim}
+\end{frame}
+
+\begin{frame}[fragile]
+  \frametitle{procmail}
+  \begin{itemize}
+    \item Reads \verb|~/mail_scripts/procmailrc| from user's home directory
+    \item Users can do whatever they want with messages
+    \item AFS causes problems---No way to know if failure is temporary (file server is down) or permanent (user isn't signed up for mail scripts)
+    \item All procmail failures are treated as temporary, so mail is queued
+  \end{itemize}
+\end{frame}
+
+\subsection{Cron (``Shortjobs'')}
+
+\begin{frame}[fragile]
+  \frametitle{Cron (cronie)}
+  \begin{itemize}
+    \item Crontabs are currently stored locally on scripts servers
+    \item {\tt cronload} command loads the crontabs from
+      \verb|~/cron_scripts/crontab| \pause
+    \item Needs improvement
+    \item Cron does not fail over with Web and Mail
+    \item Plan to move crontabs into AFS and do hot failover
+  \end{itemize}
+\end{frame}
+
+\subsection{SQL}
+
+\begin{frame}
+  \frametitle{sql.mit.edu}
+  Though scripts.mit.edu makes use of sql.mit.edu, it's a separate SIPB service with different maintainers.
+\begin{itemize}
+\item sql.mit.edu provides MySQL databases to scripts users and anyone else
+\item SQL data is stored locally, replicated across multiple servers
+\item Nightly backups go into AFS
+\end{itemize}
+\end{frame}
+
+\subsection{Version control}
+
+\begin{frame}
+  \frametitle{SVN and Git hosting}
+  \begin{itemize}
+    \item New service (September 2008), not well documented
+    \item svn://\textit{username}.scripts.mit.edu/ and git://\textit{username}.scripts.mit.edu/
+    \item Uses suEXEC to run a svnserve / git-daemon as the user
+    \item /mit/\textit{username}/Scripts/\{svn,git\}
+    \item git:// is read-only, so future plans for svn+ssh:// and git+ssh://
+  \end{itemize}
+\end{frame}
Index: tags/fc15-eol/locker/doc/cluedump/slides.tex
===================================================================
--- tags/fc15-eol/locker/doc/cluedump/slides.tex	(revision 2244)
+++ tags/fc15-eol/locker/doc/cluedump/slides.tex	(revision 2244)
@@ -0,0 +1,42 @@
+\documentclass{beamer}
+
+\mode<presentation>
+{ \usetheme{Copenhagen} }
+
+\AtBeginSection[]
+{
+   \begin{frame}
+       \frametitle{Outline}
+       \tableofcontents[currentsection]
+   \end{frame}
+}
+
+\usepackage{graphicx}
+
+\title{scripts.mit.edu}
+\author{Quentin Smith \and Geoffrey Thomas \\ \texttt{scripts@mit.edu}}
+\institute{Student Information Processing Board}
+\date{October 28, 2008}
+
+\begin{document}
+
+% Title slide - do not change
+\begin{frame}
+    \titlepage
+\end{frame}
+
+\include{contents}
+\include{services}
+
+\include{backend}
+
+\include{AFS}
+\include{suexec}
+\include{kerberos}
+\include{LDAP}
+\include{httpdmods}
+\include{LVS}
+
+\include{closing}
+
+\end{document}
Index: tags/fc15-eol/locker/doc/cluedump/standard-slide-include.sty
===================================================================
--- tags/fc15-eol/locker/doc/cluedump/standard-slide-include.sty	(revision 2244)
+++ tags/fc15-eol/locker/doc/cluedump/standard-slide-include.sty	(revision 2244)
@@ -0,0 +1,137 @@
+% \pagestyle{empty} % no page numbers
+
+\addtolength{\topmargin}{-1.25in}
+\addtolength{\textheight}{2in}
+\frenchspacing % uniform spacing
+\hyphenpenalty=10000 % no hyphenation
+\rightskip=0pt plus1.4in % add some stretchy glue to right side
+
+%%% Make LaTeX stuff easier to typeset
+
+\def\cmd#1{{\tt $\backslash$#1}}
+
+%\def\example#1{\begin{tabular}{p{0.5\textwidth}p{0.5\textwidth}} #1 &%
+%\begin{verbatim}
+%#1
+%\end{verbatim} \end{tabular}}
+
+%\def\example#1{\verb @#1@}
+
+%%% Set up handling of titles for slides
+
+\newlength{\titl@wd} %% Length of title
+\newlength{\titl@rulewidth} %% Thickness of underlining
+\setlength{\titl@rulewidth}{0.15ex}
+
+\def\titlesize{\large}
+\def\textsize{\normalsize}
+
+\def\mktitle{\slidetitle}
+
+\def\slidetitle{\@ifstar{\@nocontentstitle}{\@contentstitle}}
+
+\def\@contentstitle#1{%
+  \addcontentsline{toc}{slide}{#1}%
+  \@nocontentstitle{#1}}
+
+\def\@nocontentstitle#1{{%Makes the title of the slide
+ \def\th@title{{\titlesize \bf #1}}
+ \settowidth{\titl@wd}{\th@title}
+ \flushleft\th@title\hspace{-\titl@wd}%This comment necessary for spacing
+ \rule[-.3\baselineskip]{\textwidth}{\titl@rulewidth}\hfil\par
+}}
+
+%%% Set up figure and table environments
+
+%% Some required counters
+\newcounter{fig@re}
+\setcounter{fig@re}{0}
+
+\newcounter{t@ble}
+\setcounter{t@ble}{0}
+
+%% The environments themselves
+\newenvironment{figure}
+               {\@floatimitator{fig@re}}
+               {}
+
+\newenvironment{table}
+                {\@floatimitator{t@ble}}
+                {}
+
+%% A macro to detect [] stuff
+\def\@floatimitator#1{%
+  \@ifnextchar[%
+    {\@xfloatimitator{#1}}% [] stuff present
+    {\@regfloatimitator{#1}}} % call different things depending on whether location specifier is present
+
+\def\@regfloatimitator#1{%
+  \stepcounter{#1}%
+  \def\caption##1{%
+    {\def\@currentlabel{\csname the#1\endcsname}%
+    \m@kecaption{\csname #1num\endcsname}{##1}}}}
+
+\def\@xfloatimitator#1[#2]{\@regfloatimitator{#1}}  % just ignore the [] stuff
+
+%% Caption starter definitions
+\def\fig@renum{\fig@rename~\thefig@re}
+\def\t@blenum{\t@blename~\thet@ble}
+
+\def\fig@rename{Figure}
+\def\t@blename{Table}
+
+%% Macro to make caption itself
+\long\def\m@kecaption#1#2{%
+  \vskip\abovecaptionskip
+  \sbox\@tempboxa{#1: #2}%
+  \ifdim \wd\@tempboxa >\hsize
+    #1: #2\par
+  \else
+    \global \@minipagefalse
+    \hb@xt@\hsize{\hfil\box\@tempboxa\hfil}%
+  \fi
+  \vskip\belowcaptionskip}
+
+%% Some more lengths to control caption positioning
+\newlength{\abovecaptionskip}
+\setlength{\abovecaptionskip}{0pt}
+
+\newlength{\belowcaptionskip}
+\setlength{\belowcaptionskip}{0pt}
+
+
+%%% Label handling
+
+%% Fix the way labels are handled...
+\def\label#1{\@bsphack
+  \protected@write\@auxout{}%
+         {\string\newlabel{#1}{{\@currentlabel}{\theslide}}}%
+  \@esphack}
+
+%% define the standard label to just be slide
+\def\@currentlabel{\theslide}
+
+
+%% table of contents stuff
+\def\addcontentsline#1#2#3{%
+  \addtocontents{#1}{\protect\contentsline{#2}{#3}{\theslide}}}
+
+\newcommand\tableofcontents{%
+    \thispagestyle{empty}%
+    \addtocounter{slide}{-1}%
+    \slidetitle*{\contentsname
+        \@mkboth{%
+           \MakeUppercase\contentsname}{\MakeUppercase\contentsname}}%
+    \begingroup
+      \tiny
+        \@starttoc{toc}%
+    \endgroup
+    }
+
+\newcommand*\l@slide{\@dottedtocline{0}{1.5em}{2.3em}}
+
+\newcommand\contentsname{Contents}
+\newcommand\@pnumwidth{1.55em}
+\newcommand\@tocrmarg{2.55em}
+\newcommand\@dotsep{4.5}
+\setcounter{tocdepth}{0}
Index: tags/fc15-eol/locker/doc/cluedump/suexec.tex
===================================================================
--- tags/fc15-eol/locker/doc/cluedump/suexec.tex	(revision 2244)
+++ tags/fc15-eol/locker/doc/cluedump/suexec.tex	(revision 2244)
@@ -0,0 +1,96 @@
+\subsection{suEXEC}
+
+\begin{frame}
+  \frametitle{Serving static content}
+  \begin{itemize}
+  \item The \texttt{apache} user does not have permission to read the
+    user's files directly.
+  \item Both static and dynamic content is served through suEXEC.
+  \end{itemize}
+\end{frame}
+
+\begin{frame}[fragile,t]
+  \begin{enumerate}
+  \item \texttt{/etc/httpd/conf.d/execsys.conf} is configured to serve
+    static content with the \texttt{cgi-script} handler.
+  \end{enumerate}
+\begin{footnotesize}
+\begin{semiverbatim}
+<Files *.pl>
+        SetHandler cgi-script
+        Options +ExecCGI
+</Files>
+<Files *.php>
+        SetHandler cgi-script
+        Options +ExecCGI
+</Files>
+\ldots
+<Files *.html>
+        SetHandler cgi-script
+        Options +ExecCGI
+</Files>
+<Files *.css>
+        SetHandler cgi-script
+        Options +ExecCGI
+</Files>
+\ldots
+\end{semiverbatim}
+\end{footnotesize}
+\end{frame}
+
+\begin{frame}[fragile,t]
+  \begin{enumerate}
+    \addtocounter{enumi}{1}
+  \item \texttt{openafs/src/afs/VNOPS/afs\_vnop\_access.c} is modified
+    to mark \emph{all} files as executable (!).
+  \end{enumerate}
+\begin{footnotesize}
+\begin{semiverbatim}
+ int
+ afs_access(OSI_VC_DECL(avc), register afs_int32 amode,
+            struct AFS_UCRED *acred)
+ \{
+     register afs_int32 code;
+     struct vrequest treq;
+     struct afs_fakestat_state fakestate;
+     OSI_VC_CONVERT(avc);
+ 
+     AFS_STATCNT(afs_access);
++    amode = amode & ~VEXEC;
+     afs_Trace3(afs_iclSetp, CM_TRACE_ACCESS, ICL_TYPE_POINTER, avc,
+                ICL_TYPE_INT32, amode, ICL_TYPE_OFFSET,
+                ICL_HANDLE_OFFSET(avc->m.Length));
+     \ldots
+ \}
+\end{semiverbatim}
+\end{footnotesize}
+\end{frame}
+
+\begin{frame}[fragile,t]
+  \begin{enumerate}
+    \addtocounter{enumi}{2}
+  \item \texttt{httpd/support/suexec.c} is modified to dispatch static
+    content to \texttt{/usr/local/bin/static-cat}.
+  \end{enumerate}
+\begin{footnotesize}
+\begin{semiverbatim}
++#define STATIC_CAT_PATH "/usr/local/bin/static-cat"
++static const char *static_extensions[] = \{
++    "html",
++    "css",
++    \ldots
++\}
++
+ int main(int argc, char *argv[])
+ \{
+     \ldots
++    if (is_static_extension(cmd)) \{
++        argv[2] = STATIC_CAT_PATH;
++        execv(STATIC_CAT_PATH, &argv[2]);
++        log_err("(%d)%s: static_cat exec failed (%s)\\n", errno,
++                strerror(errno), argv[2]);
++        exit(255);
++    \}
+\end{semiverbatim}
+\end{footnotesize}
+\end{frame}
Index: tags/fc15-eol/locker/doc/object-identifiers
===================================================================
--- tags/fc15-eol/locker/doc/object-identifiers	(revision 2244)
+++ tags/fc15-eol/locker/doc/object-identifiers	(revision 2244)
@@ -0,0 +1,1 @@
+link /afs/sipb.mit.edu/admin/text/object-identifiers
Index: tags/fc15-eol/locker/doc/scripts-admin-use-policy
===================================================================
--- tags/fc15-eol/locker/doc/scripts-admin-use-policy	(revision 2244)
+++ tags/fc15-eol/locker/doc/scripts-admin-use-policy	(revision 2244)
@@ -0,0 +1,49 @@
+                                                                      2008-03-15
+                                                              amended 2008-08-05
+Policy on the Use of scripts.mit.edu Administrative Rights
+
+Users of scripts.mit.edu have a reasonable expectation that the data
+and code they store on our servers, and in sections of their locker
+accessible only by our servers, will not be improperly accessed or
+modified by anyone else, including by scripts.mit.edu maintainers.  To
+fulfill this expectation, we define a policy governing the
+maintainers’ use of special permissions and credentials held by our
+servers.  This includes any administrative access to the scripts
+servers, any use of private keys stored on the servers, and any use of
+scripts-specific permissions granted on locker directories.
+
+Such use of administrative rights shall only be permitted under any of
+the following circumstances.
+
+* Maintenance of the scripts.mit.edu service itself that is unrelated
+  to private user data.
+
+* Any access that is explicitly authorized by the owners of the data
+  in question.
+
+* Handling a user support request that cannot be satisfactorily answered
+  without resorting to using administrative rights. This access should
+  be restricted to only those files and resources that are strictly
+  necessary to fully answer the request.
+
+* Performing upgrades to autoinstalled software, using permissions
+  granted to the system:scripts-security-upd group.  This group is
+  normally empty, but the root instances of scripts maintainers will
+  be added when needed to perform upgrades, at the discretion of the
+  architect.
+
+* Modifications that are necessary for server security or reliability.
+  In this case, any modifications should be clearly marked and the
+  user should be contacted.
+
+* Ensuring that updates or planned updates to the scripts.mit.edu
+  service do not break existing user deployments.  In this case, any
+  modifications should be clearly marked and the user should be
+  contacted.
+
+[The third clause formerly read
+* Handling a user support request that can reasonably be considered an
+  implicit authorization for that use.  In this case, whenever
+  possible, any modifications should be reverted and the user should
+  be told how to make these modifications themselves.
+and was changed in August 2008.]
Index: tags/fc15-eol/locker/doc/scripts-decision-policy
===================================================================
--- tags/fc15-eol/locker/doc/scripts-decision-policy	(revision 2244)
+++ tags/fc15-eol/locker/doc/scripts-decision-policy	(revision 2244)
@@ -0,0 +1,131 @@
+                                                                      2007-07-07
+The Decision-Making Policy of the scripts.mit.edu Project:
+
+We, the creators of the scripts.mit.edu infrastructure, wish to define a
+policy for how decisions of the scripts.mit.edu project will be reached in
+order to avoid confusion on this subject among future contributors to the
+project.  We particularly want to avoid a situation in which the
+leadership of the project is unclear after we leave MIT.
+
+In general, we believe that all contributors to the project should have a
+say in how the service is run in approximate proportion to their
+contributions.  We furthermore believe that strong agreement among the
+project's principal contributors is highly important to the project's
+future, and so, whenever possible, the project's principal contributors
+should reach near-unanimous agreement about how the project should
+proceed.  Ultimately, the decisions of a project of this nature need to be
+made by the people who are making the project happen.
+
+Unfortunately, reaching unanimous agreement among all of the contributors
+to the project might not always be possible.  This document establishes
+two leadership positions for the scripts.mit.edu project in order to
+entrust decision-making authority to specific individuals.  These leaders
+are ultimately entrusted with the project, although they are expected to
+take significant pause before using their authority to end a disagreement
+before consensus of the principal contributors has been reached.  These
+leadership positions are based in part on the roles of "producer" and
+"director" described in Frederick P. Brooks' _The Mythical Man-Month_.
+
+The "scripts team leader" is an MIT student who:
+- "assembles the team, divides the work, and establishes the schedule"
+- "acquires and keeps on acquiring the necessary resources"
+- "establishes the pattern of communication and reporting within the team"
+- "ensures that the schedule is met, shifting resources and organization
+  in order to respond to changing circumstances"
+
+The team leader is responsible for ensuring that the project continues to
+make regular progress.  The team leader is entrusted with arbitrating
+decisions regarding the organization of the scripts team and the focus of
+its ongoing development efforts.  For example, the team leader may remove
+individuals from the project who are deemed to be having an overall
+negative influence on the project.
+
+The "scripts architect" is an MIT student who:
+- "provides unity and conceptual integrity to the whole design"
+- "serves as a limit to system complexity"
+- "invents solutions for [large-scale technical problems] or shifts the
+  system design as required"
+
+The architect is responsible for ensuring the technical quality of the
+scripts.mit.edu service.  The architect is entrusted with arbitrating
+decisions regarding the scope, design, and operation of the service.  As
+the guardian of the technical integrity of the service, the architect may
+arbitrate all decisions regarding the project's production hardware and
+software.
+
+Both positions may select their own replacement, and, in the case of a
+vacancy, either position may select a replacement for the other position.
+Before an individual assumes either position as a replacement, that
+individual should be confirmed for that position by the SIPB Executive
+Committee.  A single individual may hold both positions simultaneously if
+every individual who has significantly contributed to the project within
+the last one calendar year agrees.  Any objections must occur before the
+Executive Committee has confirmed the appointment.
+
+The creator of the scripts.mit.edu project, Jeff Arnold, will serve as the
+first team leader and architect.
+
+Any part of the scripts.mit.edu decision-making policy may be modified as
+necessary by agreement between the scripts team leader and the scripts
+architect.  When changing the scripts.mit.edu decision-making policy, as
+with any major decision, near-unanimous agreement among the project's
+principal contributors should ideally be reached.
+
+The scripts.mit.edu project is affiliated with SIPB, and while the project
+remains affiliated with SIPB, the project will follow appropriate SIPB
+procedures for projects.
+
+This policy should be distributed to contributors to the project so that
+they may decide not to contribute if they are dissatisfied with it.
+
+
+
+
+
+
+					    ____________________________________
+									jbarnold
+
+
+
+
+
+
+					    ____________________________________
+								        presbrey
+
+
+
+
+
+
+					    ____________________________________
+ 			     					        hartmans
+
+
+As contributors to the scripts.mit.edu project, we have contributed to
+the creation of this written decision-making policy and we fully support it.
+
+
+
+
+
+
+					    ____________________________________
+			     					         tabbott
+
+
+
+
+
+
+					    ____________________________________
+			     					         andersk
+
+
+
+
+
+
+					    ____________________________________
+			    					          geofft
Index: tags/fc15-eol/locker/doc/tickets/cnames.txt
===================================================================
--- tags/fc15-eol/locker/doc/tickets/cnames.txt	(revision 2244)
+++ tags/fc15-eol/locker/doc/tickets/cnames.txt	(revision 2244)
@@ -0,0 +1,87 @@
+HANDLING CNAME REQUESTS
+
+When someone e-mails scripts.mit.edu asking for a foo.mit.edu hostname:
+
+1. Check that the hostname is not currently in use. The commands
+     stella foo.mit.edu
+     athrun ops qy ghal foo.mit.edu \*
+   should both say the name is not in use. (The latter checks for aliases of
+   deleted or otherwise inactive hostnames that stella ignores.)
+
+   If the name is currently an alias of a name they own, make sure to forward
+   to jweiss the permission to move that name around.
+
+   If the name is the primary name of a machine they own, ask them what they
+   would like to rename the machine to, and make it clear that they'll need to
+   have another name associated with that IP address. Or (especially if the
+   machine doesn't ping) ask them to confirm they're no longer using that IP
+   address. If they're totally confused and keep insisting they want scripts
+   to serve that name, go ahead and tell them you'll rename the current foo to
+   foo-old.
+
+   If the name belongs to a deleted host on a dorm network, e-mail rccsuper to
+   reap it; they should do so quickly. If it belongs to an FSILG, e-mail
+   ht-$ILG-acl (ht-et-acl, ht-pika-acl, etc.) and ask nicely. If it belongs
+   to an academic network, they're not getting even deleted names back unless
+   they can negotiate with the current owner of the name.
+
+2. Check that they're requesting a scripts.mit.edu path that they control
+   (preferably, they'll give you a locker.scripts.mit.edu/something URL). If
+   they want a web.mit.edu path, you'll need to tell them to set up a redirect
+   according to http://scripts.mit.edu/faq/63/ in a directory in their
+   web_scripts, and ask them to tell us the directory. This doesn't block
+   requesting the hostname.
+
+   If they want something more outlandish, make sure they're not confused
+   before proceeding.
+
+   Confirm that they're signed up for scripts. http://locker.scripts.mit.edu/
+   should give something that isn't the "Account unknown" page.
+
+3. E-mail jweiss.
+   * Open the ticket in RT
+   * Click 'Comment' to the right of the body of the e-mail they sent
+   * CC: jweiss@mit.edu (Don't use "To:", there's a bug)
+   * Write something nice, preferably including the stella command line.
+   I typically use
+   Subject: scripts CNAME request: foo.mit.edu
+
+   At your convenience, please make foo.mit.edu an alias of scripts-vhosts.mit.edu.
+
+   stella scripts-vhosts -a foo
+       (or)
+   At your convenience, please move the alias foo.mit.edu from bar.mit.edu to
+     scripts-vhosts.mit.edu.
+
+   stella bar -d foo
+   stella scripts-vhosts -a foo
+       (or)
+   At your convenience, please rename the current host foo.mit.edu to
+   foo-old.mit.edu and mark it as deleted, and make foo.mit.edu an
+   alias of scripts-vhosts.mit.edu.
+
+   stella foo -S 3 -R foo-old
+   stella scripts-vhosts -a foo
+       (or)
+   If the request below is sufficient authorization, please remove....
+
+   * Set Status => Waiting and Blocking On => Moira
+
+   Occasionally jweiss is on vacation; generally he sets an auto-responder,
+   so you can just try emailing him and hoping, or ask him if he's around. If
+   not, see if zacheiss or cfox or computing-help will handle the requests.
+   (zacheiss has been willing to do them in the past.)
+
+4. Reply to the requestor (from either RT or your e-mail client), with
+   something like "We've forwarded the hostname request to IS&T; it should take
+   effect in 2-3 business days."
+
+5. After the name updates (jweiss replies, and DNS updates - which you can
+   check on -i dns), ask someone with root access to run
+
+   vhostadd foo.mit.edu
+
+6. Reply to the requestor again, and help them with stuff like MediaWiki URLs
+   or RewriteRules if they're having trouble.
+
+--geofft with minor edits by adehnert, last updated 2009-12-01
Index: tags/fc15-eol/locker/doc/tickets/rt.txt
===================================================================
--- tags/fc15-eol/locker/doc/tickets/rt.txt	(revision 2244)
+++ tags/fc15-eol/locker/doc/tickets/rt.txt	(revision 2244)
@@ -0,0 +1,49 @@
+RT TRICKS
+
+To edit stuff like ticket status, click "Basic" in the left.
+
+Note the multiple ways to search for tickets: you can click "All
+{new,open,waiting} Scripts Tickets" on the home page in the center, or
+"Scripts" on the right in the list of queues.
+
+You should take a look in "Preferences" at the left. Make sure "Notify
+yourself of own updates" is on. You can also set the "Default Working Queue"
+to Scripts, and give yourself a signature referring to scripts@mit.edu.
+
+Another useful option here is to set an RT passwordfor your account, so you
+don't need certs to log in (though it sometimes will keep asking you for
+your password on each page load if you don't have certs) and so you can use
+the zephyrbot).  The zephyrbot will take commands to
+-c scripts -i [ticket number] of the form /set status=resolved or
+/set owner=geofft.  You need to drop a file in
+/mit/geofft/web_scripts/rt/rt-passwords by your username with the format:
+
+"username" "yourawesomepassword"
+
+And then ask geofft (zwrite geofft) to restart the RT bot.
+
+Note that in the event that Geoff's account is compromised, it is possible
+for an attacker to use this password do manipulate tickets in *any*
+queue you have bits on, not just the Scripts one.
+
+The RT bot will post ticket notifications as -c scripts -i nnn.  If you are
+responding to a ticket, it is conventional to post "lock" to the appropriate
+instance, so others know not to pre-empt you.  You should post "unlock" once
+you are done handling the ticket.
+
+You can also place these commands on a line by themselves inside e-mail; they
+will be acted upon and removed before the e-mail gets sent back out.
+
+If you're adding a *comment* (such as when you're forwarding a cname request
+on to IS&T), don't use the 'To:' field, because it'll be clobbered by our
+RT scrips and the mail won't actually go to the destination you added.
+Instead, you should use the 'Cc:' field.  Similarly, if you're adding
+*correspondence*, the 'Cc:' field will be clobbered and you need to use
+the 'To:' field.
+
+Don't CC other RT queues, it doesn't work. If you really need to, use your
+e-mail client to forward it and remove the [help.mit.edu #nnn] tag.
+
+E-mail to scripts-comment that carries a [help.mit.edu #nnn] tag will be
+included in the ticket history for the scripts team to see, but will not be
+sent to the user. You can use this for asking "Help, what do I do here?"
Index: tags/fc15-eol/locker/etc/known_hosts
===================================================================
--- tags/fc15-eol/locker/etc/known_hosts	(revision 2244)
+++ tags/fc15-eol/locker/etc/known_hosts	(revision 2244)
@@ -0,0 +1,1 @@
+scripts,scripts.mit.edu,scripts-vhosts,scripts-vhosts.mit.edu,scripts-test,scripts-test.mit.edu,b-k,b-k.mit.edu,bees-knees,bees-knees.mit.edu,b-m,b-m.mit.edu,better-mousetrap,better-mousetrap.mit.edu,b-b,b-b.mit.edu,busy-beaver,busy-beaver.mit.edu,c-w,c-w.mit.edu,cats-whiskers,cats-whiskers.mit.edu,o-f,o-f.mit.edu,old-faithful,old-faithful.mit.edu,p-b,p-b.mit.edu,pancake-bunny,pancake-bunny.mit.edu,r-m,r-m.mit.edu,real-mccoy,real-mccoy.mit.edu,s-a,s-a.mit.edu,shining-armor,shining-armor.mit.edu,w-e,w-e.mit.edu,whole-enchilada,whole-enchilada.mit.edu,scripts1,scripts1.mit.edu,scripts2,scripts2.mit.edu,scripts3,scripts3.mit.edu,scripts4,scripts4.mit.edu,scripts5,scripts5.mit.edu,scripts6,scripts6.mit.edu,scripts7,scripts7.mit.edu,scripts8,scripts8.mit.edu,scripts9,scripts9.mit.edu,18.181.0.43,18.181.0.46,18.181.0.57,18.181.0.53,18.181.0.167,18.181.0.228,18.181.0.236,18.181.0.237,18.181.0.234,18.181.0.235,18.181.0.135,18.181.0.229 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAuEpkEgaIgjK7F1gV81lLSYTwSqIZX/9IJs37VaJCsJFv3D86uuJSdfI3Y94fPn2OH6AxfdaqGNksVdi27mKQfzvCB4ogjQgxmM391MIDLd+izZDY0YvCb4DqJLMJUpX49cNUMkj+/rJg1O0K2w/lb8DGr7wdoLSPKCUJNJv5WMMDxpFL253lPELsmnds4T+R6LpTt6W9+FalHl84me51sEjV9PbmhcTaNwuoJStAjhrKPfgHHDIKNyCUvaVkoHPXEsdzz00yY7i57djyZlzPV/jM7LKar+Xw2LB0Z3098IQcdbD8zmz2DdakPTlShxavNPC6kZDZ3WVqziC+bszaSQ==
Index: tags/fc15-eol/locker/sbin/build-update
===================================================================
--- tags/fc15-eol/locker/sbin/build-update	(revision 2244)
+++ tags/fc15-eol/locker/sbin/build-update	(revision 2244)
@@ -0,0 +1,155 @@
+#!/usr/bin/env perl
+
+use File::Spec::Functions qw(:ALL);
+use File::Copy;
+use File::Path;
+use Data::Dumper;
+use Getopt::Long;
+use Archive::Tar;
+use Cwd;
+use strict;
+use warnings;
+
+my $scriptsdev = "";
+
+GetOptions(
+#"redo-delete" => \$redodelete,
+#	   "redo-add" => \$redoadd,
+#	   "redo-replace" => \$redoreplace,
+#	   "redo-diff" => \$redodiff,
+#	   "redo-all" => sub {$redodelete = $redoadd = $redoreplace = $redodiff = 1;},
+	   "dev" => sub {$scriptsdev = "dev";},
+		  );
+
+if (@ARGV < 3) {
+  print STDERR "Usage: $0 package oldversion newversion\n";
+  exit(1);
+}
+
+my ($package, $oldversion, $newversion) = @ARGV;
+my ($old, $new, $updatename) = ($package.'-'.$oldversion, $package.'-'.$newversion, $package.'-'.$oldversion.'-to-'.$newversion);
+
+my $proposaldir = $updatename.".proposal";
+my $outdir = catdir("/mit/scripts/deploy$scriptsdev/updates/", $updatename);
+
+(-d $proposaldir) or die "Can't find $proposaldir, did you run propose-update?\n";
+((! -e $outdir) && mkdir($outdir)) or die "mkdir($outdir) failed: $!";
+
+my $olddir = catdir($proposaldir,$old);
+my $newdir = catdir($proposaldir,$new);
+(-d $olddir && -d $newdir) or die "Packages not unpacked?\n";
+
+sub readFileList($) {
+  my ($list) = @_;
+  open(LIST, $list) or die "Can't read $list: $!\n";
+  my @files = map { chomp; s|$newdir\/?||g; [split(' ', $_, 2)] } <LIST>;
+  close(LIST);
+  return @files;
+}
+
+my @todelete = readFileList(catfile($proposaldir, "files.delete"));
+my @toadd = readFileList(catfile($proposaldir, "files.add"));
+my @toreplace = readFileList(catfile($proposaldir, "files.replace"));
+
+open(CHECKMD5, ">", catfile($outdir, "check.md5")) or die "Can't open check.md5: $!";
+print CHECKMD5 map { join("  ", @{$_})."\n" } @todelete, @toreplace;
+close(CHECKMD5);
+
+open(ABSENT, ">", catfile($outdir, "oldfiles.absent")) or die "Can't open oldfiles.absent: $!";
+print ABSENT map { $_->[1]."\n" } @toadd;
+close(ABSENT);
+
+open(DELETE, ">", catfile($outdir, "files.delete")) or die "Can't open files.delete: $!";
+print DELETE map { $_->[1]."\n" } @todelete, @toreplace;
+close(DELETE);
+
+my $outfiletarball = catfile($outdir, "newfiles.tar.gz");
+my $cwd = getcwd();
+
+chdir($newdir);
+my $tar = Archive::Tar->new;
+$tar->add_files(map { $_->[1] } @toadd, @toreplace);
+$tar->write($outfiletarball, 1);
+chdir($cwd) or die "Couldn't chdir back to $cwd: $!\n";
+
+if (0) {
+    my $outfiledir = catdir($outdir, "newfiles");
+    (-d $outfiledir || mkdir($outfiledir)) or die "Can't mkdir($outfiledir)\n";
+    
+    foreach my $file (@toadd, @toreplace) {
+	my $filename = $file->[1];
+	my $src = catfile($newdir, $filename);
+	my $dest = catfile($outfiledir, $filename);
+	my (undef, $dir, undef) = splitpath($dest);
+	mkpath($dir);
+	copy($src, $dest) or die "Couldn't copy $filename from $src to $dest: $!";
+    }
+}
+
+copy(catfile($proposaldir, "update.diff"), catfile($outdir, "update.diff")) or die "Couldn't copy update.diff: $!";
+if (-d catdir($proposaldir, "extra")) {
+    system('cp', '-r', catdir($proposaldir, "extra"), $outdir) && die "Couldn't copy extra: $!";
+}
+
+open (SCRIPT, ">", catfile($outdir, "update")) or die "Couldn't write update: $!";
+printf SCRIPT <<'EOF', catfile("/afs/athena.mit.edu/contrib/scripts/deploy/", $old), catfile("/afs/athena.mit.edu/contrib/scripts/deploy/", $new);
+#!/bin/bash
+set -e -o noclobber
+
+die () { echo "[$PWD] die: $1" >&2; rm .scripts-security-upd-lock; exit 1; }
+aiee () { echo "[$PWD] AIEE: $1" >&2; exit 2; }
+
+patchdir=$(dirname "$0")
+lockername="${1:-$USER}"
+
+>.scripts-security-upd-lock || die "error: Unable to obtain update lock."
+
+packages=$(tail -1 .scripts-version)
+
+echo "[$PWD] begin dry run"
+
+found=""
+newpackages=""
+for package in $packages; do
+    if [ "$package" = "%s" ]; then
+    found="yes"
+    newpackages="$newpackages%s "
+    else
+    newpackages="$newpackages$package "
+    fi
+done
+
+[ "$found" = "yes" ] || die "error: Correct version not found."
+
+if [ -e "$patchdir/extra/prepatch.sh" ]; then
+  . "$patchdir/extra/prepatch.sh" || die "error: prepatch failed"
+fi
+
+[ -s "$patchdir/oldfiles.absent" ] && (xargs -n1 test ! -e <"$patchdir/oldfiles.absent" || die "error: Conflicting files exist." )
+[ -s "$patchdir/check.md5" ] && (md5sum -c "$patchdir/check.md5" || die "error: MD5 check failed.")
+patch -stN --dry-run --no-backup-if-mismatch -p2 <"$patchdir/update.diff" || die "error: Patch dry run failed."
+
+echo "[$PWD] dry run OK, applying update"
+
+mv .scripts-version .scripts-version.old || aiee "Failed to back up scripts-version"
+patch -stN --no-backup-if-mismatch -p2 <"$patchdir/update.diff" || aiee "patch did not apply"
+xargs rm -f <"$patchdir/files.delete" || aiee "Failed to remove files"
+/afs/athena.mit.edu/contrib/scripts/bin/gtar -xzf "$patchdir/newfiles.tar.gz" || aiee "Failed to extract new files"
+[ -e "$patchdir/extra/postpatch.sh" ] && . "$patchdir/extra/postpatch.sh"
+(
+    cat .scripts-version.old
+    echo
+    date "+%%F %%T %%z"
+    echo "$USER@$(hostname)"
+    echo "$patchdir"
+    echo "$newpackages"
+) >.scripts-version
+rm -f .scripts-version.old || aiee "Failed to remove .scripts-version.old"
+
+rm -f .scripts-security-upd-lock || aiee "Failed to remove .scripts-security-upd-lock"
+
+echo "[$PWD] done"
+
+exit 0
+EOF
+chmod 0755, catfile($outdir, "update");
Index: tags/fc15-eol/locker/sbin/check-ldap-cert.pl
===================================================================
--- tags/fc15-eol/locker/sbin/check-ldap-cert.pl	(revision 2244)
+++ tags/fc15-eol/locker/sbin/check-ldap-cert.pl	(revision 2244)
@@ -0,0 +1,32 @@
+#!/usr/bin/perl
+
+use strict;
+use File::Basename;
+use Date::Parse;
+use Sys::Hostname;
+
+my @servers = qw(localhost);
+
+my $hostname = hostname();
+
+my $now = time();
+
+my $dir = dirname($0);
+
+our $verbose = 0;
+$verbose = 1 if ($ARGV[0] eq "-v");
+
+use constant WARNING => 60*60*24*14; # Warn if a cert is expiring within 14 days
+
+foreach my $server (@servers) {
+  open(X509, "-|", "$dir/ssl-get-endtime", "$server:636") or die "Couldn't invoke ssl-get-endtime: $!";
+  chomp(my $exp = <X509>);
+  close(X509);
+  $exp =~ s/^notAfter=// or warn "Cert appears broken: $server";
+
+  my $time = str2time($exp);
+
+  if ($verbose || ($time - $now) <= WARNING) {
+    printf "$hostname: Certificate expiring in %.2f days: %s\n", (($time - $now) / (60.0*60*24)), $server;
+  }
+}
Index: tags/fc15-eol/locker/sbin/check-users
===================================================================
--- tags/fc15-eol/locker/sbin/check-users	(revision 2244)
+++ tags/fc15-eol/locker/sbin/check-users	(revision 2244)
@@ -0,0 +1,79 @@
+#!/bin/bash
+set -e
+
+err() {
+    echo "$@"
+}
+
+if [ -z "$1" ]; then
+    filter="objectClass=posixAccount"
+else
+    filter=
+    for user; do
+	filter="$filter(uid=$user)"
+    done
+    filter="(&(objectClass=posixAccount)(|$filter))"
+fi
+
+unset "${!l_@}"
+while read attr value; do
+    if [ -n "$attr" ]; then
+	declare "l_${attr%:}=$value"
+	continue
+    fi
+
+    read f_type f_data < <(hesinfo "$l_uid" filsys) || :
+    if [ -z "$f_type" ]; then
+	err "$l_uid" "no_hesiod"
+    elif [ "$f_type" = "ERR" ]; then
+	err "$l_uid" "hesiod_err ERR $f_data"
+    elif [ "$f_type" = "AFS" ]; then
+	read f_path f_perm f_link z \
+	    < <(echo "$f_data")
+	[ "$l_homeDirectory" = "$f_path" ] || \
+	    err "$l_uid" "hesiod_path $f_path"
+    else
+	err "$l_uid" "wrong_hesiod $f_type"
+    fi
+
+    IFS=/ read p_empty p_top p_cell p \
+	< <(echo "$l_homeDirectory")
+    [ -z "${p_empty}" ] || \
+	err "$l_uid" "relative_home $l_homeDirectory"
+    [ "${p_top}" = "afs" ] || \
+	err "$l_uid" "not_afs $l_homeDirectory"
+
+    read v_vname v_vol v \
+	< <(vos exa -noauth "$l_uidNumber" -cell "$p_cell" 2>/dev/null) || :
+    [ "$v_vol" = "$l_uidNumber" ] ||
+	err "$l_uid" "no_vol $l_uidNumber"
+
+    if ! [ -d "$l_homeDirectory" ]; then
+	if ! [ -e "$l_homeDirectory" ]; then
+	    err "$l_uid" "deleted $l_homeDirectory"
+	else
+	    err "$l_uid" "not_dir $l_homeDirectory"
+	fi
+    else
+	read c c_path c c c c_cell \
+	    < <(fs whichcell "$l_homeDirectory" 2>/dev/null) || :
+	[ "$c_path" = "$l_homeDirectory" ] || \
+	    err "$l_uid" "no_cell $l_homeDirectory"
+	[ "$c_cell" = "'$p_cell'" ] || \
+	    err "$l_uid" "wrong_cell $l_homeDirectory"
+
+	read m_path m m m m m m m_vname \
+	    < <(fs lsmount "$l_homeDirectory" 2>/dev/null) || :
+	[ "$m_path" = "'$l_homeDirectory'" ] || \
+	    err "$l_uid" "no_mount $l_homeDirectory"
+	[ "$m_vname" = "'#$v_vname'" ] || [ "$m_vname" = "'%$v_vname'" ] || \
+	    err "$l_uid" "wrong_mount $m_vname ($l_uidNumber = $v_vname)"
+    fi
+
+    unset "${!l_@}"
+done < <(
+    ldapsearch -LLL -x -D 'cn=Directory Manager' -y /etc/signup-ldap-pw \
+        -b ou=People,dc=scripts,dc=mit,dc=edu "$filter" \
+        uid uidNumber homeDirectory loginShell | \
+        perl -0pe 's/\n //g;'
+    )
Index: tags/fc15-eol/locker/sbin/commit-email.pl
===================================================================
--- tags/fc15-eol/locker/sbin/commit-email.pl	(revision 2244)
+++ tags/fc15-eol/locker/sbin/commit-email.pl	(revision 2244)
@@ -0,0 +1,840 @@
+#!/usr/bin/env perl
+
+# ====================================================================
+# This script is deprecated.  The Subversion developers recommend
+# using mailer.py for post-commit and post-revprop change
+# notifications.  If you wish to improve or add features to a
+# post-commit notification script, please do that work on mailer.py.
+# See http://svn.collab.net/repos/svn/trunk/tools/hook-scripts/mailer .
+# ====================================================================
+
+# ====================================================================
+# commit-email.pl: send a notification email describing either a
+# commit or a revprop-change action on a Subversion repository.
+#
+# For usage, see the usage subroutine or run the script with no
+# command line arguments.
+#
+# This script requires Subversion 1.2.0 or later.
+#
+# $HeadURL: http://svn.collab.net/repos/svn/trunk/contrib/hook-scripts/commit-email.pl.in $
+# $LastChangedDate: 2009-05-12 13:25:35 -0400 (Tue, 12 May 2009) $
+# $LastChangedBy: blair $
+# $LastChangedRevision: 37715 $
+#
+# ====================================================================
+# Copyright (c) 2000-2006 CollabNet.  All rights reserved.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution.  The terms
+# are also available at http://subversion.tigris.org/license-1.html.
+# If newer versions of this license are posted there, you may use a
+# newer version instead, at your option.
+#
+# This software consists of voluntary contributions made by many
+# individuals.  For exact contribution history, see the revision
+# history and logs, available at http://subversion.tigris.org/.
+# ====================================================================
+
+# Turn on warnings the best way depending on the Perl version.
+BEGIN {
+  if ( $] >= 5.006_000)
+    { require warnings; import warnings; }
+  else
+    { $^W = 1; }
+}
+
+use strict;
+use Carp;
+use POSIX qw(strftime);
+my ($sendmail, $smtp_server);
+
+######################################################################
+# Configuration section.
+
+$ENV{'LC_ALL'} = 'en_US.UTF-8';
+
+# Sendmail path, or SMTP server address.
+# You should define exactly one of these two configuration variables,
+# leaving the other commented out, to select which method of sending
+# email should be used.
+# Using --stdout on the command line overrides both.
+$sendmail = "/usr/sbin/sendmail";
+#$smtp_server = "127.0.0.1";
+
+# Svnlook path.
+my $svnlook = "/usr/bin/svnlook";
+
+# By default, when a file is deleted from the repository, svnlook diff
+# prints the entire contents of the file.  If you want to save space
+# in the log and email messages by not printing the file, then set
+# $no_diff_deleted to 1.
+my $no_diff_deleted = 0;
+# By default, when a file is added to the repository, svnlook diff
+# prints the entire contents of the file.  If you want to save space
+# in the log and email messages by not printing the file, then set
+# $no_diff_added to 1.
+my $no_diff_added = 0;
+
+# End of Configuration section.
+######################################################################
+
+# Check that the required programs exist, and the email sending method
+# configuration is sane, to ensure that the administrator has set up
+# the script properly.
+{
+  my $ok = 1;
+  foreach my $program ($sendmail, $svnlook)
+    {
+      next if not defined $program;
+      if (-e $program)
+        {
+          unless (-x $program)
+            {
+              warn "$0: required program `$program' is not executable, ",
+                   "edit $0.\n";
+              $ok = 0;
+            }
+        }
+      else
+        {
+          warn "$0: required program `$program' does not exist, edit $0.\n";
+          $ok = 0;
+        }
+    }
+  if (not (defined $sendmail xor defined $smtp_server))
+    {
+      warn "$0: exactly one of \$sendmail or \$smtp_server must be ",
+           "set, edit $0.\n";
+      $ok = 0;
+    }
+  exit 1 unless $ok;
+}
+
+require Net::SMTP if defined $smtp_server;
+
+######################################################################
+# Initial setup/command-line handling.
+
+# Each value in this array holds a hash reference which contains the
+# associated email information for one project.  Start with an
+# implicit rule that matches all paths.
+my @project_settings_list = (&new_project);
+
+# Process the command line arguments till there are none left.
+# In commit mode: The first two arguments that are not used by a command line
+# option are the repository path and the revision number.
+# In revprop-change mode: The first four arguments that are not used by a
+# command line option are the repository path, the revision number, the
+# author, and the property name. This script has no support for the fifth
+# argument (action) added to the post-revprop-change hook in Subversion
+# 1.2.0 yet - patches welcome!
+my $repos;
+my $rev;
+my $author;
+my $propname;
+
+my $mode = 'commit';
+my $date;
+my $diff_file;
+
+# Use the reference to the first project to populate.
+my $current_project = $project_settings_list[0];
+
+# This hash matches the command line option to the hash key in the
+# project.  If a key exists but has a false value (''), then the
+# command line option is allowed but requires special handling.
+my %opt_to_hash_key = ('--from' => 'from_address',
+                       '--revprop-change' => '',
+                       '-d'     => '',
+                       '-h'     => 'hostname',
+                       '-l'     => 'log_file',
+                       '-m'     => '',
+                       '-r'     => 'reply_to',
+                       '-s'     => 'subject_prefix',
+                       '--summary' => '',
+                       '--diff' => '',
+                       '--stdout' => '');
+
+while (@ARGV)
+  {
+    my $arg = shift @ARGV;
+    if ($arg =~ /^-/)
+      {
+        my $hash_key = $opt_to_hash_key{$arg};
+        unless (defined $hash_key)
+          {
+            die "$0: command line option `$arg' is not recognized.\n";
+          }
+
+        my $value;
+        if ($arg ne '--revprop-change' and $arg ne '--stdout' and $arg ne '--summary')
+          {
+            unless (@ARGV)
+              {
+                die "$0: command line option `$arg' is missing a value.\n";
+              }
+            $value = shift @ARGV;
+          }
+
+        if ($hash_key)
+          {
+            $current_project->{$hash_key} = $value;
+          }
+        else
+          {
+            if ($arg eq '-m')
+              {
+                $current_project                = &new_project;
+                $current_project->{match_regex} = $value;
+                push(@project_settings_list, $current_project);
+              }
+            elsif ($arg eq '-d')
+              {
+                if ($mode ne 'revprop-change')
+                  {
+                    die "$0: `-d' is valid only when used after"
+                      . " `--revprop-change'.\n";
+                  }
+                if ($diff_file)
+                  {
+                    die "$0: command line option `$arg'"
+                      . " can only be used once.\n";
+                  }
+                $diff_file = $value;
+              }
+            elsif ($arg eq '--revprop-change')
+              {
+                if (defined $repos)
+                  {
+                    die "$0: `--revprop-change' must be specified before"
+                      . " the first non-option argument.\n";
+                  }
+                $mode = 'revprop-change';
+              }
+            elsif ($arg eq '--diff')
+              {
+                $current_project->{show_diff} = parse_boolean($value);
+              }
+            elsif ($arg eq '--stdout')
+              {
+                $current_project->{stdout} = 1;
+              }
+            elsif ($arg eq '--summary')
+              {
+                $current_project->{summary} = 1;
+              }
+            else
+              {
+                die "$0: internal error:"
+                  . " should not be handling `$arg' here.\n";
+              }
+          }
+      }
+    else
+      {
+        if (! defined $repos)
+          {
+            $repos = $arg;
+          }
+        elsif (! defined $rev)
+          {
+            $rev = $arg;
+          }
+        elsif (! defined $author && $mode eq 'revprop-change')
+          {
+            $author = $arg;
+          }
+        elsif (! defined $propname && $mode eq 'revprop-change')
+          {
+            $propname = $arg;
+          }
+        else
+          {
+            push(@{$current_project->{email_addresses}}, $arg);
+          }
+      }
+  }
+
+if ($mode eq 'commit')
+  {
+    &usage("$0: too few arguments.") unless defined $rev;
+  }
+elsif ($mode eq 'revprop-change')
+  {
+    &usage("$0: too few arguments.") unless defined $propname;
+  }
+
+# Check the validity of the command line arguments.  Check that the
+# revision is an integer greater than 0 and that the repository
+# directory exists.
+unless ($rev =~ /^\d+/ and $rev > 0)
+  {
+    &usage("$0: revision number `$rev' must be an integer > 0.");
+  }
+unless (-e $repos)
+  {
+    &usage("$0: repos directory `$repos' does not exist.");
+  }
+unless (-d _)
+  {
+    &usage("$0: repos directory `$repos' is not a directory.");
+  }
+
+# Check that all of the regular expressions can be compiled and
+# compile them.
+{
+  my $ok = 1;
+  for (my $i=0; $i<@project_settings_list; ++$i)
+    {
+      my $match_regex = $project_settings_list[$i]->{match_regex};
+
+      # To help users that automatically write regular expressions
+      # that match the root directory using ^/, remove the / character
+      # because subversion paths, while they start at the root level,
+      # do not begin with a /.
+      $match_regex =~ s#^\^/#^#;
+
+      my $match_re;
+      eval { $match_re = qr/$match_regex/ };
+      if ($@)
+        {
+          warn "$0: -m regex #$i `$match_regex' does not compile:\n$@\n";
+          $ok = 0;
+          next;
+        }
+      $project_settings_list[$i]->{match_re} = $match_re;
+    }
+  exit 1 unless $ok;
+}
+
+# Harvest common data needed for both commit or revprop-change.
+
+# Figure out what directories have changed using svnlook.
+my @dirschanged = &read_from_process($svnlook, 'dirs-changed', $repos,
+                                     '-r', $rev);
+
+# Lose the trailing slash in the directory names if one exists, except
+# in the case of '/'.
+my $rootchanged = 0;
+for (my $i=0; $i<@dirschanged; ++$i)
+  {
+    if ($dirschanged[$i] eq '/')
+      {
+        $rootchanged = 1;
+      }
+    else
+      {
+        $dirschanged[$i] =~ s#^(.+)[/\\]$#$1#;
+      }
+  }
+
+# Figure out what files have changed using svnlook.
+my @svnlooklines = &read_from_process($svnlook, 'changed', $repos, '-r', $rev);
+
+# Parse the changed nodes.
+my @adds;
+my @dels;
+my @mods;
+foreach my $line (@svnlooklines)
+  {
+    my $path = '';
+    my $code = '';
+
+    # Split the line up into the modification code and path, ignoring
+    # property modifications.
+    if ($line =~ /^(.).  (.*)$/)
+      {
+        $code = $1;
+        $path = $2;
+      }
+
+    if ($code eq 'A')
+      {
+        push(@adds, $path);
+      }
+    elsif ($code eq 'D')
+      {
+        push(@dels, $path);
+      }
+    else
+      {
+        push(@mods, $path);
+      }
+  }
+
+# Declare variables which carry information out of the inner scope of
+# the conditional blocks below.
+my $subject_base;
+my $subject_logbase;
+my @body;
+# $author - declared above for use as a command line parameter in
+#   revprop-change mode.  In commit mode, gets filled in below.
+
+if ($mode eq 'commit')
+  {
+    ######################################################################
+    # Harvest data using svnlook.
+
+    # Get the author, date, and log from svnlook.
+    my @infolines = &read_from_process($svnlook, 'info', $repos, '-r', $rev);
+    $author = shift @infolines;
+    $date = shift @infolines;
+    shift @infolines;
+    my @log = map { "$_\n" } @infolines;
+
+    ######################################################################
+    # Modified directory name collapsing.
+
+    # Collapse the list of changed directories only if the root directory
+    # was not modified, because otherwise everything is under root and
+    # there's no point in collapsing the directories, and only if more
+    # than one directory was modified.
+    my $commondir = '';
+    my @edited_dirschanged = @dirschanged;
+    if (!$rootchanged and @edited_dirschanged > 1)
+      {
+        my $firstline    = shift @edited_dirschanged;
+        my @commonpieces = split('/', $firstline);
+        foreach my $line (@edited_dirschanged)
+          {
+            my @pieces = split('/', $line);
+            my $i = 0;
+            while ($i < @pieces and $i < @commonpieces)
+              {
+                if ($pieces[$i] ne $commonpieces[$i])
+                  {
+                    splice(@commonpieces, $i, @commonpieces - $i);
+                    last;
+                  }
+                $i++;
+              }
+          }
+        unshift(@edited_dirschanged, $firstline);
+
+        if (@commonpieces)
+          {
+            $commondir = join('/', @commonpieces);
+            my @new_dirschanged;
+            foreach my $dir (@edited_dirschanged)
+              {
+                if ($dir eq $commondir)
+                  {
+                    $dir = '.';
+                  }
+                else
+                  {
+                    $dir =~ s#^\Q$commondir/\E##;
+                  }
+                push(@new_dirschanged, $dir);
+              }
+            @edited_dirschanged = @new_dirschanged;
+          }
+      }
+    my $dirlist = join(' ', @edited_dirschanged);
+
+    ######################################################################
+    # Assembly of log message.
+
+    if ($commondir ne '')
+      {
+        $subject_base = "r$rev - in $commondir: $dirlist";
+      }
+    else
+      {
+        $subject_base = "r$rev - $dirlist";
+      }
+    my $summary = @log ? $log[0] : '';
+    chomp($summary);
+    $subject_logbase = "r$rev - $summary";
+
+    # Put together the body of the log message.
+    push(@body, "Author: $author\n");
+    push(@body, "Date: $date\n");
+    push(@body, "New Revision: $rev\n");
+    push(@body, "\n");
+    if (@adds)
+      {
+        @adds = sort @adds;
+        push(@body, "Added:\n");
+        push(@body, map { "   $_\n" } @adds);
+      }
+    if (@dels)
+      {
+        @dels = sort @dels;
+        push(@body, "Removed:\n");
+        push(@body, map { "   $_\n" } @dels);
+      }
+    if (@mods)
+      {
+        @mods = sort @mods;
+        push(@body, "Modified:\n");
+        push(@body, map { "   $_\n" } @mods);
+      }
+    push(@body, "Log:\n");
+    push(@body, @log);
+    push(@body, "\n");
+  }
+elsif ($mode eq 'revprop-change')
+  {
+    ######################################################################
+    # Harvest data.
+
+    my @svnlines;
+    # Get the diff file if it was provided, otherwise the property value.
+    if ($diff_file)
+      {
+        open(DIFF_FILE, $diff_file) or die "$0: cannot read `$diff_file': $!\n";
+        @svnlines = <DIFF_FILE>;
+        close DIFF_FILE;
+      }
+    else
+      {
+        @svnlines = &read_from_process($svnlook, 'propget', '--revprop', '-r',
+                                       $rev, $repos, $propname);
+      }
+
+    ######################################################################
+    # Assembly of log message.
+
+    $subject_base = "propchange - r$rev $propname";
+
+    # Put together the body of the log message.
+    push(@body, "Author: $author\n");
+    push(@body, "Revision: $rev\n");
+    push(@body, "Property Name: $propname\n");
+    push(@body, "\n");
+    unless ($diff_file)
+      {
+        push(@body, "New Property Value:\n");
+      }
+    push(@body, map { /[\r\n]+$/ ? $_ : "$_\n" } @svnlines);
+    push(@body, "\n");
+  }
+
+# Cached information - calculated when first needed.
+my @difflines;
+
+# Go through each project and see if there are any matches for this
+# project.  If so, send the log out.
+foreach my $project (@project_settings_list)
+  {
+    my $match_re = $project->{match_re};
+    my $match    = 0;
+    foreach my $path (@dirschanged, @adds, @dels, @mods)
+      {
+        if ($path =~ $match_re)
+          {
+            $match = 1;
+            last;
+          }
+      }
+
+    next unless $match;
+
+    my @email_addresses = @{$project->{email_addresses}};
+    my $userlist        = join(' ', @email_addresses);
+    my $to              = join(', ', @email_addresses);
+    my $from_address    = $project->{from_address};
+    my $hostname        = $project->{hostname};
+    my $log_file        = $project->{log_file};
+    my $reply_to        = $project->{reply_to};
+    my $subject_prefix  = $project->{subject_prefix};
+    my $summary         = $project->{summary};
+    my $diff_wanted     = ($project->{show_diff} and $mode eq 'commit');
+    my $stdout          = $project->{stdout};
+
+    my $subject         = $summary ? $subject_logbase : $subject_base;
+    if ($subject_prefix =~ /\w/)
+      {
+        $subject = "$subject_prefix $subject";
+      }
+    my $mail_from = $author;
+
+    if ($from_address =~ /\w/)
+      {
+        $mail_from = $from_address;
+      }
+    elsif ($hostname =~ /\w/)
+      {
+        $mail_from = "$mail_from\@$hostname";
+      }
+    elsif (defined $smtp_server and ! $stdout)
+      {
+        die "$0: use of either `-h' or `--from' is mandatory when ",
+            "sending email using direct SMTP.\n";
+      }
+
+    my @head;
+    my $formatted_date;
+    if ($stdout)
+      {
+        $formatted_date = strftime('%a %b %e %X %Y', localtime());
+        push(@head, "From $mail_from $formatted_date\n");
+      }
+    $formatted_date = strftime('%a, %e %b %Y %X %z', localtime());
+    push(@head, "Date: $formatted_date\n");
+    push(@head, "To: $to\n");
+    push(@head, "From: $mail_from\n");
+    push(@head, "Subject: $subject\n");
+    push(@head, "Reply-to: $reply_to\n") if $reply_to;
+
+    ### Below, we set the content-type etc, but see these comments
+    ### from Greg Stein on why this is not a full solution.
+    #
+    # From: Greg Stein <gstein@lyra.org>
+    # Subject: Re: svn commit: rev 2599 - trunk/tools/cgi
+    # To: dev@subversion.tigris.org
+    # Date: Fri, 19 Jul 2002 23:42:32 -0700
+    #
+    # Well... that isn't strictly true. The contents of the files
+    # might not be UTF-8, so the "diff" portion will be hosed.
+    #
+    # If you want a truly "proper" commit message, then you'd use
+    # multipart MIME messages, with each file going into its own part,
+    # and labeled with an appropriate MIME type and charset. Of
+    # course, we haven't defined a charset property yet, but no biggy.
+    #
+    # Going with multipart will surely throw out the notion of "cut
+    # out the patch from the email and apply." But then again: the
+    # commit emailer could see that all portions are in the same
+    # charset and skip the multipart thang.
+    #
+    # etc etc
+    #
+    # Basically: adding/tweaking the content-type is nice, but don't
+    # think that is the proper solution.
+    push(@head, "Content-Type: text/plain; charset=UTF-8\n");
+    push(@head, "Content-Transfer-Encoding: 8bit\n");
+
+    push(@head, "\n");
+
+    if ($diff_wanted and not @difflines)
+      {
+        # Get the diff from svnlook.
+        my @no_diff_deleted = $no_diff_deleted ? ('--no-diff-deleted') : ();
+        my @no_diff_added = $no_diff_added ? ('--no-diff-added') : ();
+        @difflines = &read_from_process($svnlook, 'diff', $repos,
+                                        '-r', $rev, @no_diff_deleted,
+                                        @no_diff_added);
+        @difflines = map { /[\r\n]+$/ ? $_ : "$_\n" } @difflines;
+      }
+
+    if ($stdout)
+      {
+        print @head, @body;
+        print @difflines if $diff_wanted;
+      }
+    elsif (defined $sendmail and @email_addresses)
+      {
+        # Open a pipe to sendmail.
+        my $command = "$sendmail -f'$mail_from' $userlist";
+        if (open(SENDMAIL, "| $command"))
+          {
+            print SENDMAIL @head, @body;
+            print SENDMAIL @difflines if $diff_wanted;
+            close SENDMAIL
+              or warn "$0: error in closing `$command' for writing: $!\n";
+          }
+        else
+          {
+            warn "$0: cannot open `| $command' for writing: $!\n";
+          }
+      }
+    elsif (defined $smtp_server and @email_addresses)
+      {
+        my $smtp = Net::SMTP->new($smtp_server)
+          or die "$0: error opening SMTP session to `$smtp_server': $!\n";
+        handle_smtp_error($smtp, $smtp->mail($mail_from));
+        handle_smtp_error($smtp, $smtp->recipient(@email_addresses));
+        handle_smtp_error($smtp, $smtp->data());
+        handle_smtp_error($smtp, $smtp->datasend(@head, @body));
+        if ($diff_wanted)
+          {
+            handle_smtp_error($smtp, $smtp->datasend(@difflines));
+          }
+        handle_smtp_error($smtp, $smtp->dataend());
+        handle_smtp_error($smtp, $smtp->quit());
+      }
+
+    # Dump the output to logfile (if its name is not empty).
+    if ($log_file =~ /\w/)
+      {
+        if (open(LOGFILE, ">> $log_file"))
+          {
+            print LOGFILE @head, @body;
+            print LOGFILE @difflines if $diff_wanted;
+            close LOGFILE
+              or warn "$0: error in closing `$log_file' for appending: $!\n";
+          }
+        else
+          {
+            warn "$0: cannot open `$log_file' for appending: $!\n";
+          }
+      }
+  }
+
+exit 0;
+
+sub handle_smtp_error
+{
+  my ($smtp, $retval) = @_;
+  if (not $retval)
+    {
+      die "$0: SMTP Error: " . $smtp->message() . "\n";
+    }
+}
+
+sub usage
+{
+  warn "@_\n" if @_;
+  die "usage (commit mode):\n",
+      "  $0 REPOS REVNUM [[-m regex] [options] [email_addr ...]] ...\n",
+      "usage: (revprop-change mode):\n",
+      "  $0 --revprop-change REPOS REVNUM USER PROPNAME [-d diff_file] \\\n",
+      "    [[-m regex] [options] [email_addr ...]] ...\n",
+      "options are:\n",
+      "  -m regex              Regular expression to match committed path\n",
+      "  --from email_address  Email address for 'From:' (overrides -h)\n",
+      "  -h hostname           Hostname to append to author for 'From:'\n",
+      "  -l logfile            Append mail contents to this log file\n",
+      "  -r email_address      Email address for 'Reply-To:'\n",
+      "  -s subject_prefix     Subject line prefix\n",
+      "  --summary             Use first line of commit log in subject\n",
+      "  --diff y|n            Include diff in message (default: y)\n",
+      "                        (applies to commit mode only)\n",
+      "  --stdout              Spit the message in mbox format to stdout.\n",
+      "\n",
+      "This script supports a single repository with multiple projects,\n",
+      "where each project receives email only for actions that affect that\n",
+      "project.  A project is identified by using the -m command line\n".
+      "option with a regular expression argument.  If the given revision\n",
+      "contains modifications to a path that matches the regular\n",
+      "expression, then the action applies to the project.\n",
+      "\n",
+      "Any of the following email addresses and command line options\n",
+      "(other than -d) are associated with this project, until the next -m,\n",
+      "which resets the options and the list of email addresses.\n",
+      "\n",
+      "To support a single project conveniently, the script initializes\n",
+      "itself with an implicit -m . rule that matches any modifications\n",
+      "to the repository.  Therefore, to use the script for a single-\n",
+      "project repository, just use the other command line options and\n",
+      "a list of email addresses on the command line.  If you do not want\n",
+      "a rule that matches the entire repository, then use -m with a\n",
+      "regular expression before any other command line options or email\n",
+      "addresses.\n",
+      "\n",
+      "'revprop-change' mode:\n",
+      "The message will contain a copy of the diff_file if it is provided,\n",
+      "otherwise a copy of the (assumed to be new) property value.\n",
+      "\n";
+}
+
+# Return a new hash data structure for a new empty project that
+# matches any modifications to the repository.
+sub new_project
+{
+  return {email_addresses => [],
+          from_address    => '',
+          hostname        => '',
+          log_file        => '',
+          match_regex     => '.',
+          reply_to        => '',
+          subject_prefix  => '',
+          show_diff       => 1,
+          stdout          => 0};
+}
+
+sub parse_boolean
+{
+  if ($_[0] eq 'y') { return 1; };
+  if ($_[0] eq 'n') { return 0; };
+
+  die "$0: valid boolean options are 'y' or 'n', not '$_[0]'\n";
+}
+
+# Start a child process safely without using /bin/sh.
+sub safe_read_from_pipe
+{
+  unless (@_)
+    {
+      croak "$0: safe_read_from_pipe passed no arguments.\n";
+    }
+
+  my $openfork_available = $^O ne "MSWin32";
+  if ($openfork_available) # We can fork on this system.
+    {
+      my $pid = open(SAFE_READ, '-|');
+      unless (defined $pid)
+        {
+          die "$0: cannot fork: $!\n";
+        }
+      unless ($pid)
+        {
+          open(STDERR, ">&STDOUT")
+            or die "$0: cannot dup STDOUT: $!\n";
+          exec(@_)
+            or die "$0: cannot exec `@_': $!\n";
+        }
+    }
+  else  # Running on Windows.  No fork.
+    {
+      my @commandline = ();
+      my $arg;
+
+      while ($arg = shift)
+        {
+          $arg =~ s/\"/\\\"/g;
+          if ($arg eq "" or $arg =~ /\s/) { $arg = "\"$arg\""; }
+          push(@commandline, $arg);
+        }
+
+      # Now do the pipe.
+      open(SAFE_READ, "@commandline |")
+        or die "$0: cannot pipe to command: $!\n";
+    }
+  my @output;
+  while (<SAFE_READ>)
+    {
+      s/[\r\n]+$//;
+      push(@output, $_);
+    }
+  close(SAFE_READ);
+  my $result = $?;
+  my $exit   = $result >> 8;
+  my $signal = $result & 127;
+  my $cd     = $result & 128 ? "with core dump" : "";
+  if ($signal or $cd)
+    {
+      warn "$0: pipe from `@_' failed $cd: exit=$exit signal=$signal\n";
+    }
+  if (wantarray)
+    {
+      return ($result, @output);
+    }
+  else
+    {
+      return $result;
+    }
+}
+
+# Use safe_read_from_pipe to start a child process safely and return
+# the output if it succeeded or an error message followed by the output
+# if it failed.
+sub read_from_process
+{
+  unless (@_)
+    {
+      croak "$0: read_from_process passed no arguments.\n";
+    }
+  my ($status, @output) = &safe_read_from_pipe(@_);
+  if ($status)
+    {
+      return ("$0: `@_' failed with this output:", @output);
+    }
+  else
+    {
+      return @output;
+    }
+}
Index: tags/fc15-eol/locker/sbin/commit-zephyr
===================================================================
--- tags/fc15-eol/locker/sbin/commit-zephyr	(revision 2244)
+++ tags/fc15-eol/locker/sbin/commit-zephyr	(revision 2244)
@@ -0,0 +1,52 @@
+#!/bin/bash
+#
+# This is a script that can be called from a Subversion post-commit hook
+# to zephyr a summary of the commit or the full commit.
+#
+# Use by putting something like the following in hooks/post-commit:
+# REPOS="$1"
+# REV="$2"
+# /mit/snippets/svn-hooks/commit-zephyr "$REPOS" "$REV" -c scripts
+# /mit/snippets/svn-hooks/commit-zephyr "$REPOS" "$REV" --full -c scripts-auto -i commits
+
+export LC_ALL=en_US.UTF-8
+
+CLASS=test
+INSTANCE=@
+FULL=0
+
+OPTS=$(getopt -o c:i:f -l class:,instance:,full -n "$0" -- "$@") || exit $?
+eval set -- "$OPTS"
+while :; do
+    case "$1" in
+	-c|--class) CLASS=$2; shift 2;;
+	-i|--instance) INSTANCE=$2; shift 2;;
+	-f|--full) FULL=1; shift;;
+	--) shift; break;;
+	*) exit 1;;
+    esac
+done
+[ $# -ge 2 ] || exit 1
+REPOS=$1
+REV=$2
+
+if [ "$INSTANCE" = "${INSTANCE%@}@" ]; then
+    INSTANCE=${INSTANCE%@}r$REV
+fi
+
+dirs=$(svnlook dirs-changed "$REPOS" -r "$REV")
+svnlook info "$REPOS" -r "$REV" | (
+    read -r author
+    read -r datestamp
+    read -r logsize
+    log=$(cat)
+    echo "r$REV by $author $datestamp"
+    echo "$log"
+    svnlook changed "$REPOS" -r "$REV"
+    if [ "$FULL" -eq 1 ]; then
+	echo
+	svnlook diff "$REPOS" -r "$REV"
+    else
+	echo svnlook diff "$REPOS" -r "$REV"
+    fi
+) | zwrite -d -c "$CLASS" -i "$INSTANCE" -O "auto" -s "SVN: r$REV"
Index: tags/fc15-eol/locker/sbin/delete-user
===================================================================
--- tags/fc15-eol/locker/sbin/delete-user	(revision 2244)
+++ tags/fc15-eol/locker/sbin/delete-user	(revision 2244)
@@ -0,0 +1,89 @@
+#!/usr/bin/python
+import ldap
+import ldap.filter
+import pwd
+import sys
+
+actuallyRun = False
+
+def delete_record(l, full_name):
+    if actuallyRun:
+        print "Deleting %s..." % (full_name,)
+        l.delete_s(full_name)
+    else:
+        print "Would have deleted %s" % (full_name,)
+
+def findUser(l, username):
+    # Try to delete the 
+    user_record, = ll.search_s(
+        "ou=People,dc=scripts,dc=mit,dc=edu",
+        ldap.SCOPE_SUBTREE,
+        ldap.filter.filter_format(
+            "(&(objectClass=posixAccount)" +
+            "(uid=%s))",
+            [username]))
+
+    return user_record
+
+def findGroup(l, username):
+    group_record, = ll.search_s(
+        "ou=Groups,dc=scripts,dc=mit,dc=edu",
+        ldap.SCOPE_SUBTREE,
+        ldap.filter.filter_format(
+            "(&(objectClass=posixGroup)" +
+            "(cn=%s))",
+            [username]))
+
+    return group_record
+
+def findApacheConfig(l, uid):
+    host_records = ll.search_s(
+        "ou=VirtualHosts,dc=scripts,dc=mit,dc=edu",
+        ldap.SCOPE_SUBTREE,
+        ldap.filter.filter_format(
+            "(&(objectClass=apacheConfig)" +
+            "(apacheSuexecUid=%s))",
+            [uid]))
+
+    return host_records
+
+def findVhost(l, full_name):
+    host_records = ll.search_s(
+        "ou=VirtualHosts,dc=scripts,dc=mit,dc=edu",
+        ldap.SCOPE_SUBTREE,
+        ldap.filter.filter_format(
+            "(&(objectClass=scriptsVhost)" +
+            "(scriptsVhostAccount=%s))",
+            [full_name]))
+
+    return host_records
+
+if __name__ == '__main__':
+    (self, user) = sys.argv
+
+    print "Binding to ldap..."
+
+    ll = ldap.initialize("ldapi://%2fvar%2frun%2fslapd-scripts.socket/")
+    ll.simple_bind_s("cn=Directory Manager", open('/etc/signup-ldap-pw').read())
+
+    print "Finding user '%s'..." % (user,)
+    user_record = findUser(ll, user)
+
+    print "Finding group '%s'..." % (user,)
+    group_record = findGroup(ll, user)
+
+    print "Searching for apache configurations..."
+    apache_configs = findApacheConfig(ll, user_record[1]['uidNumber'][0])
+
+    print "Searching for vhost configurations..."
+    vhost_configs = findVhost(ll, user_record[0])
+
+    print "Deleting..."
+    delete_record(ll, user_record[0])
+    delete_record(ll, group_record[0])
+
+    for config in apache_configs:
+        delete_record(ll, config[0])
+
+    for vhost in vhost_configs:
+        delete_record(ll, vhost[0])
Index: tags/fc15-eol/locker/sbin/get-homedirs.sh
===================================================================
--- tags/fc15-eol/locker/sbin/get-homedirs.sh	(revision 2244)
+++ tags/fc15-eol/locker/sbin/get-homedirs.sh	(revision 2244)
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+# Run this as root on scripts.
+
+/usr/bin/ldapsearch -LLL -z 0 -b ou=People,dc=scripts,dc=mit,dc=edu -s one -x -D 'cn=Directory Manager' -y /etc/signup-ldap-pw '' cn homeDirectory | \
+	perl -0pe 's/\n //g; s/^dn: .*\ncn: (.*)\nhomeDirectory: (.*)\n\n/$1 $2\n/gm'
Index: tags/fc15-eol/locker/sbin/get-ldap-admins
===================================================================
--- tags/fc15-eol/locker/sbin/get-ldap-admins	(revision 2244)
+++ tags/fc15-eol/locker/sbin/get-ldap-admins	(revision 2244)
@@ -0,0 +1,3 @@
+#!/bin/sh
+# This script can be run on or off of scripts
+ldapsearch -x -h scripts.mit.edu -b dc=scripts,dc=mit,dc=edu -LLL 'cn=Directory Administrators' uniqueMember
Index: tags/fc15-eol/locker/sbin/get-versions.pl
===================================================================
--- tags/fc15-eol/locker/sbin/get-versions.pl	(revision 2244)
+++ tags/fc15-eol/locker/sbin/get-versions.pl	(revision 2244)
@@ -0,0 +1,21 @@
+#!/usr/bin/perl
+
+system("/mit/scripts/sec-tools/get-passwd.sh");
+system("/mit/scripts/sec-tools/parallel-find.pl");
+sleep 5;
+
+while(1) {
+    my $count = `ps -ef | grep find | grep $ENV{USER} | grep -v ps | grep -v grep | wc -l | tr -d '\n'`;
+    if ($count eq '0') {
+	last;
+    }
+    else {
+	print "Current have $count find processes running.  Please wait.\n";
+	sleep 1;
+    }
+}
+
+print "Done finding files\n";
+system("cat /mit/scripts/sec-tools/store/versions/* >| /mit/scripts/sec-tools/store/scripts-versions");
+print "Done\n";
+#print `cat /mit/scripts/sec-tools/store/versions/`;
Index: tags/fc15-eol/locker/sbin/mail-owners.pl
===================================================================
--- tags/fc15-eol/locker/sbin/mail-owners.pl	(revision 2244)
+++ tags/fc15-eol/locker/sbin/mail-owners.pl	(revision 2244)
@@ -0,0 +1,53 @@
+#!/usr/athena/bin/perl
+
+use strict;
+
+use warnings;
+
+open LIST, "actual";
+
+open TEMPLATE, "wordpress-email";
+
+my $template = do {local $/; <TEMPLATE>};
+
+sub bits {
+    # Given the argument of a locker, return users with rlidwka rights
+    my $DIR = shift;
+    open PERM, "fs la $DIR | ";
+    my @list = (); #to be filled with users or moira lists
+    while (my $line = <PERM>){
+	if ($line =~ m{(\S+) \s rlidwka}x) {
+	    my $temp = $1;
+	    $temp =~ s/system://g;	    
+	    push @list, $temp;
+	}
+    }
+    return @list;
+}
+
+while (my $line = <LIST>) {
+    print $line;
+    if ($line =~ m{( (.*/ ([^/]+) ) /web_scripts/(\S+) )\s.*'([.0-9]+)'}x) {  
+	my $PATH = $1;
+	#print $PATH;
+	my $DIR = $2;
+	my $LOCKER = $3;
+	my $URI = "$3.scripts.mit.edu/$4";
+	my $VERSION = $5;
+	next if $VERSION ne '2.0.2';
+	my $lockeremail = $template;
+	$lockeremail =~ s/<LOCKER>/$LOCKER/g;
+	$lockeremail =~ s/<URI>/$URI/g;
+	$lockeremail =~ s/<DIRECTORY>/$PATH/g;
+	$lockeremail =~ s/<VERSION>/$VERSION/g;
+	$lockeremail = "To: ".join(',',&bits($DIR))."\n\n".$lockeremail; 
+	open OUTPUT, ">./email/$LOCKER";
+	print OUTPUT $lockeremail; 
+    }
+}
+
+
+
+
+
+
Index: tags/fc15-eol/locker/sbin/parallel-find.pl
===================================================================
--- tags/fc15-eol/locker/sbin/parallel-find.pl	(revision 2244)
+++ tags/fc15-eol/locker/sbin/parallel-find.pl	(revision 2244)
@@ -0,0 +1,112 @@
+#!/usr/bin/perl
+
+# Script to help generate find the .scripts-version files
+
+use LockFile::Simple qw(trylock unlock);
+use File::stat;
+
+use lib '/mit/scripts/sec-tools/perl';
+
+open(FILE, "</mit/scripts/sec-tools/store/scriptslist");
+my $dump = "/mit/scripts/sec-tools/store/versions";
+my $dumpbackup = "/mit/scripts/sec-tools/store/versions-backup";
+
+# try to grab a lock on the version directory
+trylock($dump) || die "Can't acquire lock; lockfile already exists at <$dump.lock>.  Another parallel-find may be running.  If you are SURE there is not, remove the lock file and retry.";
+
+sub unlock_and_die ($) {
+    my $msg = shift;
+    unlock($dump);
+    die $msg;
+}
+
+# if the versions directory exists, move it to versions-backup
+# (removing the backup directory if necessary).  Then make a new copy.
+if (-e $dump){
+    if (-e $dumpbackup){
+        system("rm -rf $dumpbackup") && unlock_and_die "Can't remove old backup directory $dumpbackup";
+    }
+    system("mv", $dump, $dumpbackup) && unlock_and_die "Unable to back up current directory $dump";
+}
+system("mkdir", $dump) && unlock_and_die "mkdir failed to create $dump";
+
+use Proc::Queue size => 40, debug => 0, trace => 0;
+use POSIX ":sys_wait_h"; # imports WNOHANG
+
+# this loop creates new childs, but Proc::Queue makes it wait every
+# time the limit (50) is reached until enough childs exit
+
+# Note that we miss things where one volume is inside another if we
+# use -xdev.  May miss libraries stuff.
+
+sub updatable ($) {
+    my $filename = shift;
+    for my $l (`fs la "$filename"`) {
+        return 1 if ($l =~ /^  system:scripts-security-upd rlidwk/);
+    }
+    return 0;
+}
+
+sub old_version ($) {
+    my $dirname = shift;
+    open my $h, "$dirname/.scripts-version";
+    chomp (my $v = (<$h>)[-1]);
+    return $v;
+}
+
+sub version ($) {
+    my $dirname = shift;
+    $uid = stat($dirname)->uid;
+    open my $h, "sudo -u#$uid git --git-dir=$dirname/.git describe --tags --always 2>/dev/null |";
+    chomp($val = <$h>);
+    if (! $val) {
+        print "Failed to read value for $dirname\n"
+    }
+    return $val;
+}
+
+sub find ($$) {
+    my $user = shift;
+    my $homedir = shift;
+
+    open my $files, "find $homedir/web_scripts -xdev -name .scripts-version -o -name .scripts 2>/dev/null |";
+    open my $out, ">$dump/$user";
+    while (my $f = <$files>) {
+        chomp $f;
+        my $new_style;
+        $new_style = ($f =~ s!/\.scripts$!!);
+        if (! $new_style) {
+            $f =~ s!/\.scripts-version$!!;
+            # Don't use .scripts-version of .scripts is around!
+            if (-d "$f/.scripts") {
+                next;
+            }
+        }
+        if (! updatable($f)) {
+            print STDERR "not updatable: $f";
+            next;
+        }
+        $v = $new_style ? version($f) : old_version($f);
+        print $out "$f:$v\n";
+    }
+    return 0;
+}
+
+while (<FILE>) {
+    my ($user, $homedir) = /^([^ ]*) (.*)$/;
+    my $f=fork;
+    if(defined ($f) and $f==0) {
+        if ($homedir !~ m|^/afs/athena| && $homedir !~ m|^/afs/sipb| && $homedir !~ m|^/afs/zone|) {
+            print "ignoring foreign-cell $user $homedir\n";
+            exit(0);
+        }
+        print "$user\n";
+        $ret = find($user, $homedir);
+        sleep rand 1;
+        exit($ret);
+    }
+    1 while waitpid(-1, WNOHANG)>0; # avoids memory leaks in Proc::Queue
+}
+
+unlock($dump);
+1;
Index: tags/fc15-eol/locker/sbin/propose-update
===================================================================
--- tags/fc15-eol/locker/sbin/propose-update	(revision 2244)
+++ tags/fc15-eol/locker/sbin/propose-update	(revision 2244)
@@ -0,0 +1,173 @@
+#!/usr/athena/bin/perl
+
+use File::Spec::Functions;
+use Data::Dumper;
+use Getopt::Long;
+use Cwd;
+
+my ($redodelete, $redoadd, $redoreplace, $redodiff) = (0,0,0,0);
+
+my $scriptsdev = "";
+
+GetOptions("redo-delete" => \$redodelete,
+	   "redo-add" => \$redoadd,
+	   "redo-replace" => \$redoreplace,
+	   "redo-diff" => \$redodiff,
+	   "redo-all" => sub {$redodelete = $redoadd = $redoreplace = $redodiff = 1;},
+	   "dev" => sub {$scriptsdev = "dev";},
+		  );
+
+if (@ARGV < 3) {
+  print STDERR "Usage: $0 [--redo-{delete|add|replace|diff|all}] [--dev] package oldversion newversion\n";
+  exit(1);
+}
+
+my ($package, $oldversion, $newversion) = @ARGV;
+my ($old, $new, $updatename) = ($package.'-'.$oldversion, $package.'-'.$newversion, $package.'-'.$oldversion.'-to-'.$newversion);
+
+my $outdir = $updatename.".proposal";
+
+(-d $outdir || mkdir($outdir)) or die "mkdir($outdir) failed: $!";
+
+my $olddir = catdir($outdir,$old);
+my $newdir = catdir($outdir,$new);
+
+unpackPackage($old, $olddir);
+unpackPackage($new, $newdir);
+
+sub unpackPackage($$) {
+  my ($package, $dir) = @_;
+  print STDERR "Extracting $package to $dir... ";
+  if (-d $dir) {
+    warn "$dir already exists; assuming unpacking was successful";
+    return;
+  }
+  mkdir($dir) or die "mkdir($dir) failed: $!";
+  my $cwd = cwd();
+  chdir($dir) or die $!;
+  `athrun scripts gtar zxf "/mit/scripts/deploy$scriptsdev/$package/$package.tar.gz"`;
+  if ($?) { chdir($cwd); system("rmdir", "$dir"); die "Failed to unpack $package.tar.gz: $?"; }
+  my @files=`athrun scripts gfind . -mindepth 1 -maxdepth 1 | grep -v .admin`;
+  if (@files <= 1) {
+    `athrun scripts gfind . -mindepth 2 -maxdepth 2 -exec mv {} . \\;`;
+    rmdir($files[0]);
+  }
+  chdir($cwd) or die "Couldn't return to $cwd";
+  print "done.\n";
+}
+
+my @oldfiles = sort { $a->[1] cmp $b->[1] } map { chomp; s|$olddir\/?||g; [split(' ', $_, 2)] } `athrun scripts gfind $olddir -type f -exec md5sum {} \\;`;
+#print Dumper(\@oldfiles);
+my @newfiles = sort { $a->[1] cmp $b->[1] } map { chomp; s|$newdir\/?||g; [split(' ', $_, 2)] } `athrun scripts gfind $newdir -type f -exec md5sum {} \\;`;
+#print Dumper(\@newfiles);
+
+sub compareDirectories($$) {
+  my ($alist, $blist) = @_;
+  my @a = @$alist;
+  my @b = @$blist;
+  my @aonly, @bonly, @both;
+  $a = $b = 0;
+  my $debug = 0;
+  local $Data::Dumper::Indent = 0;
+  while ($a <= $#a || $b <= $#a) {
+    my $fa = $a[$a];
+    my $fb = $b[$b];
+    print STDERR "Comparing ".Dumper($fa, $fb)."\n" if $debug;
+    if ($fa->[1] eq $fb->[1]) { # Same file exists on both
+      print STDERR "Same file\n" if $debug;
+      if ($fa->[0] ne $fb->[0]) { # File has changed in some way
+	print STDERR "Different md5, pushing on \@both\n" if $debug;
+	push(@both, [$fa->[1], $fa, $fb]);
+      }
+      $a++; $b++; # increment both counters
+    } else {
+      my $a2 = $a;
+      while ($a2 <= $#a && $a[$a2]->[1] lt $fb->[1]) {
+	$a2++;
+      }
+      if ($a2 <= $#a && $a[$a2]->[1] eq $fb->[1]) {
+	for my $i ($a..$a2-1) {
+	  push @aonly, $a[$i];
+	}
+	$a = $a2;
+      } else {
+	my $b2 = $b;
+	while ($b2 <= $#b && $b[$b2]->[1] lt $fa->[1]) {
+	  $b2++;
+	}
+	if ($b2 <= $#b && $b[$b2]->[1] eq $fa->[1]) {
+	  for my $i ($b..$b2-1) {
+	    push @bonly, $b[$i];
+	  }
+	  $b = $b2;
+	} else {
+	  push @aonly, $a[$a];
+	  push @bonly, $b[$b];
+	  $a++; $b++;
+	}
+      }
+    }
+  }
+  return (\@aonly, \@bonly, \@both);
+}
+
+my (@todelete, @toadd, @changed);
+my @comp = compareDirectories(\@oldfiles, \@newfiles);
+open(DIFF, ">", catfile($outdir, "diff.pl"));
+print DIFF Dumper(@comp);
+close(DIFF);
+@todelete = @{$comp[0]};
+@toadd = @{$comp[1]};
+@changed = @{$comp[2]};
+
+if ($redodelete or ! -e catfile($outdir, "files.delete")) {
+	open(TODELETE, ">", catfile($outdir, "files.delete")) or die "Can't open files.delete: $!";
+	foreach my $file (@todelete) {
+	  printf TODELETE "%s %s\n", $file->[0], $file->[1];
+	}
+	close(TODELETE);
+	printf "Wrote %d filenames to files.delete\n", scalar(@todelete);
+} else { printf "Not overwriting existing files.delete\n"; }
+
+if ($redoadd or ! -e catfile($outdir, "files.add")) {
+	open(TOADD, ">", catfile($outdir, "files.add")) or die "Can't open files.add: $!";
+	foreach my $file (@toadd) {
+	  printf TOADD "%s %s\n", $file->[0], $file->[1];
+	}
+	close(TOADD);
+	printf "Wrote %d filenames to files.add\n", scalar(@toadd);
+} else { printf "Not overwriting existing files.add\n"; }
+
+my @toreplace;
+my @topatch;
+
+foreach my $file (@changed) {
+	if (-B catdir($newdir, $file->[0])) {
+		push (@toreplace, $file);
+	} else {
+		push (@topatch, $file);
+	}
+}
+
+if ($redoreplace or ! -e catfile($outdir, "files.replace")) {
+	open(TOREPLACE, ">", catfile($outdir, "files.replace")) or die "Can't open files.replace: $!";
+	foreach my $file (@toreplace) {
+		printf TOREPLACE "%s %s\n", $file->[1][0], $file->[0];
+	}
+	close(TOREPLACE);
+	printf "Wrote %d filenames to files.replace\n", scalar(@toreplace);
+} else { printf "Not overwriting existing files.replace\n"; }
+
+if ($redodiff or ! -e catfile($outdir, "update.diff")) {
+    open(DIFF, ">", catfile($outdir, "update.diff")) or die "Can't open update.diff: $!";
+    foreach my $file (@topatch) {
+	my $filename = $file->[0];
+	my $oldfile = catfile($olddir, $file->[1][1]);
+	my $newfile = catfile($newdir, $file->[2][1]);
+	my $cmd = "diff -urN $oldfile $newfile";
+	print DIFF "$cmd\n";
+	print DIFF `$cmd`;
+    }
+    close(DIFF);
+    printf "Wrote %d diffs to update.diff\n", scalar(@topatch);
+} else { printf "Not overwriting existing update.patch\n"; }
Index: tags/fc15-eol/locker/sbin/rpm-master.sh
===================================================================
--- tags/fc15-eol/locker/sbin/rpm-master.sh	(revision 2244)
+++ tags/fc15-eol/locker/sbin/rpm-master.sh	(revision 2244)
@@ -0,0 +1,35 @@
+#!/bin/sh
+
+echo "Entering correct directory..."
+mkdir -p /mit/scripts/cron_scripts/rpm-sync/
+cd /mit/scripts/cron_scripts/rpm-sync/
+
+echo "Cleaning up environment..."
+rm -rf *.rpmlist *.diff rpmlist.master missing.rpms
+
+servers=`finger @scripts-director.mit.edu | grep "\->" | grep EDU | awk '{print $2}' | cut -d: -f1 | sort | uniq`
+
+for server in $servers; do
+    echo "Connecting to $server..."
+    { ssh $server /mit/scripts/sbin/rpmlist.sh 2>&1 >&3 | grep -Fxv 'If you have trouble logging in, see http://scripts.mit.edu/faq/41/.'; } 3>&1 >&2
+done
+
+echo "Creating master package list..."
+cat *.rpmlist | sort | uniq > rpmlist.master
+
+echo "Comparing scripts servers to overall rpm list..."
+touch missing.rpms
+for server in *.rpmlist; do
+    diff -U3 $server rpmlist.master > $server.diff
+    serverPretty=`basename $server .rpmlist`
+    echo "Server $serverPretty is missing:" >> missing.rpms
+    grep "^+[^+]" $server.diff | cut -b 1 --complement >> missing.rpms
+    echo >> missing.rpms
+done
+
+if [ `egrep -c -v '(missing)|(^$)' missing.rpms` -gt 0 ]; then
+    echo "Sending email..."
+    cat missing.rpms | mail -s "scripts.mit.edu servers are out of sync" root@scripts.mit.edu
+else
+    echo "No email needs to be sent! scripts.mit.edu is up to date."
+fi
Index: tags/fc15-eol/locker/sbin/rpmlist.sh
===================================================================
--- tags/fc15-eol/locker/sbin/rpmlist.sh	(revision 2244)
+++ tags/fc15-eol/locker/sbin/rpmlist.sh	(revision 2244)
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+copyTo='/mit/scripts/cron_scripts/rpm-sync/'
+packages=`mktemp --tmpdir rpmlist.XXXXXX`
+rpm -qa --queryformat '%{NAME}.%{ARCH}\n' | sort | uniq > $packages
+
+host=`hostname`
+extension='.rpmlist'
+file="$copyTo/$host$extension"
+mv $packages $file
Index: tags/fc15-eol/locker/sbin/scripts-createrepo
===================================================================
--- tags/fc15-eol/locker/sbin/scripts-createrepo	(revision 2244)
+++ tags/fc15-eol/locker/sbin/scripts-createrepo	(revision 2244)
@@ -0,0 +1,29 @@
+#!/bin/sh
+
+# Runs createrepo on the primary scripts server and copies the resulting
+# metadata to the live yum repository.
+
+set -eux
+
+ssh='ssh -o GSSAPIAuthentication=yes -o GSSAPIDelegateCredentials=no'
+
+yum=/afs/athena.mit.edu/contrib/scripts/yum-repos/rpm-fc$($ssh root@scripts.mit.edu 'lsb_release -rs')
+[ -d "$yum" ]
+
+tmp=$($ssh root@scripts.mit.edu "\
+set -eux
+tmp=\$(mktemp -dt createrepo.XXXXXX)
+createrepo -d -o \"\$tmp\" -- '$yum' >&2
+printf '%s' \"\$tmp\"
+")
+[ "$tmp" ]
+
+new=$(mktemp -d -- "$yum/repodata.XXXXXX")
+rsync -avz -e "$ssh" -- "root@scripts.mit.edu:$tmp/repodata/" "$new"
+mv -b -T -- "$new" "$yum/repodata"
+rm -rf -- "$yum/repodata~"
+
+$ssh root@scripts.mit.edu "\
+set -eux
+rm -rf -- '$tmp'
+"
Index: tags/fc15-eol/locker/sbin/ssl-get-endtime
===================================================================
--- tags/fc15-eol/locker/sbin/ssl-get-endtime	(revision 2244)
+++ tags/fc15-eol/locker/sbin/ssl-get-endtime	(revision 2244)
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+echo '' | openssl s_client -connect $1 2>/dev/null | openssl x509 -enddate -noout
Index: tags/fc15-eol/locker/sbin/vhostadd
===================================================================
--- tags/fc15-eol/locker/sbin/vhostadd	(revision 2244)
+++ tags/fc15-eol/locker/sbin/vhostadd	(revision 2244)
@@ -0,0 +1,74 @@
+#!/bin/bash
+set -e
+
+printf "Host name: " >&2
+if [ "$1" ]; then
+    host="$1"; shift
+    echo "$host"
+else
+    read host
+fi
+
+if ! grep -Fq "." <<< "$host"; then host=$host.mit.edu; fi
+
+printf "User: " >&2
+if [ "$1" ]; then
+    user="$1"; shift
+    echo "$user"
+else
+    read user
+fi
+
+while read attr value; do
+    echo "$attr" "$value"
+    case "$attr" in
+	dn:) user_dn=$value;;
+	uid:) user=$value;;
+	uidNumber:) uid=$value;;
+	gidNumber:) gid=$value;;
+	homeDirectory:) home=$value;;
+    esac
+done < <(ldapsearch -LLL -x -h scripts.mit.edu -b ou=People,dc=scripts,dc=mit,dc=edu "(uid=$user)" dn uid uidNumber gidNumber homeDirectory | perl -0pe 's/\n //g;')
+
+printf "Docroot: $home/web_scripts" >&2
+read subdir
+
+tmpfile=$(mktemp -t vhostadd.XXXXXX) || exit $?
+trap 'rm -f "$tmpfile"' EXIT
+
+cat <<EOF > "$tmpfile"
+dn: apacheServerName=$host,ou=VirtualHosts,dc=scripts,dc=mit,dc=edu
+objectClass: apacheConfig
+objectClass: top
+apacheServerName: $host
+EOF
+
+if [ "${host%mit.edu}" != "$host" ]; then
+    cat <<EOF >> "$tmpfile"
+apacheServerAlias: ${host%.mit.edu}
+EOF
+fi
+
+cat <<EOF >> "$tmpfile"
+apacheDocumentRoot: $home/web_scripts$subdir
+apacheSuexecUid: $uid
+apacheSuexecGid: $gid
+
+dn: scriptsVhostName=$host,ou=VirtualHosts,dc=scripts,dc=mit,dc=edu
+objectClass: scriptsVhost
+objectClass: top
+scriptsVhostName: $host
+EOF
+
+if [ "${host%mit.edu}" != "$host" ]; then
+    cat <<EOF >> "$tmpfile"
+scriptsVhostAlias: ${host%.mit.edu}
+EOF
+fi
+
+cat <<EOF >> "$tmpfile"
+scriptsVhostAccount: $user_dn
+scriptsVhostDirectory: ${subdir#/}
+EOF
+
+exec ldapvi --bind sasl -Y GSSAPI -h scripts5.mit.edu -b dc=scripts,dc=mit,dc=edu --add --in "$tmpfile"
Index: tags/fc15-eol/locker/sbin/vhostedit
===================================================================
--- tags/fc15-eol/locker/sbin/vhostedit	(revision 2244)
+++ tags/fc15-eol/locker/sbin/vhostedit	(revision 2244)
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+if [ ! "$1" ]; then
+    echo "Usage: $0 <vhost>"
+    exit 2
+fi
+
+exec ldapvi --bind sasl -Y GSSAPI -h scripts5.mit.edu -b dc=scripts,dc=mit,dc=edu \
+       "(|(&(objectClass=apacheConfig)(|(apacheServerName=$1)(apacheServerAlias=$1)))(&(objectClass=scriptsVhost)(|(scriptsVhostName=$1)(scriptsVhostAlias=$1))))"
Index: tags/fc15-eol/locker/sql/bin/create-database
===================================================================
--- tags/fc15-eol/locker/sql/bin/create-database	(revision 2244)
+++ tags/fc15-eol/locker/sql/bin/create-database	(revision 2244)
@@ -0,0 +1,11 @@
+#!/usr/bin/php
+<?php
+
+list($h,$u,$p) = explode("\t",`/mit/scripts/sql/bin/get-password`);
+$d = $argv[1];
+$create_r = explode(',',file_get_contents('https://sql.mit.edu/main/do/batch/create_db?d=' . urlencode($d) . '&u=' . urlencode($u) . '&p=' . urlencode($p)));
+$return_r = array_shift($create_r);
+$created = implode(',',$create_r);
+if ($return_r == '0') echo $created;
+
+?>
Index: tags/fc15-eol/locker/sql/bin/drop-database
===================================================================
--- tags/fc15-eol/locker/sql/bin/drop-database	(revision 2244)
+++ tags/fc15-eol/locker/sql/bin/drop-database	(revision 2244)
@@ -0,0 +1,11 @@
+#!/usr/bin/php
+<?php
+
+list($h,$u,$p) = explode("\t",`/mit/scripts/sql/bin/get-password`);
+$d = $argv[1];
+$drop_r = explode(',',file_get_contents('https://sql.mit.edu/main/do/batch/drop_db?d=' . urlencode($d) . '&u=' . urlencode($u) . '&p=' . urlencode($p)));
+$return_r = array_shift($drop_r);
+$dropped = implode(',',$drop_r);
+if ($return_r == '0') echo $dropped;
+
+?>
Index: tags/fc15-eol/locker/sql/bin/get-next-database
===================================================================
--- tags/fc15-eol/locker/sql/bin/get-next-database	(revision 2244)
+++ tags/fc15-eol/locker/sql/bin/get-next-database	(revision 2244)
@@ -0,0 +1,16 @@
+#!/usr/bin/php
+<?php
+
+list($h,$u,$p) = explode("\t",`/mit/scripts/sql/bin/get-password`);
+$newdb = str_replace($u.'+','',$argv[1]);
+$testdb = str_replace('.','',$u).'+'.$newdb;
+$dbs = explode("\n",file_get_contents('https://sql.mit.edu/tools/list_dbs?h=' . urlencode($h) . '&u=' . urlencode($u) . '&p=' . urlencode($p)));
+if (in_array($testdb,$dbs)) {
+	$i = 1;
+	while(in_array($testdb.$i,$dbs)) {
+		$i++;
+	}
+	echo $newdb.$i;
+} else echo $newdb;
+
+?>
Index: tags/fc15-eol/locker/sql/bin/get-password
===================================================================
--- tags/fc15-eol/locker/sql/bin/get-password	(revision 2244)
+++ tags/fc15-eol/locker/sql/bin/get-password	(revision 2244)
@@ -0,0 +1,58 @@
+#!/usr/bin/php
+<?php
+
+$host = 'sql.mit.edu';
+$env_user = getenv('USER');
+$home = '/mit/'.$env_user;
+
+$cnfPath = $home.'/.sql/my.cnf';
+
+function getMyCnfInfo($path) {
+if (file_exists($path)) {
+	global $env_user;
+	$cnfFile = file_get_contents($path);
+	if (preg_match('/\[mysql\][^\[]*host *= *([^\r\n]*)/',$cnfFile,$match)) {
+		$host = $match[1];
+	} elseif (preg_match('/\[client\][^\[]*host *= *([^\r\n]*)/',$cnfFile,$match)) {
+		$host = $match[1];
+	} else {
+		$host = 'sql.mit.edu';
+	}
+	if (preg_match('/\[mysql\][^\[]*user *= *([^\r\n]*)/',$cnfFile,$match)) {
+		$user = $match[1];
+	} elseif (preg_match('/\[client\][^\[]*user *= *([^\r\n]*)/',$cnfFile,$match)) {
+		$user = $match[1];
+	} else {
+		$user = $env_user;
+	}
+	if (preg_match('/\[mysql\][^\[]*password *= *([^\r\n]*)/',$cnfFile,$match)) {
+		$password = $match[1];
+	} elseif (preg_match('/\[client\][^\[]*password *= *([^\r\n]*)/',$cnfFile,$match)) {
+		$password = $match[1];
+	} else {
+		$password = 'password';
+	}
+	return array($host,$user,$password);
+}
+}
+
+$cnfinfo = getMyCnfInfo($cnfPath);
+if (is_array($cnfinfo)) {
+	list($h,$u,$p) = $cnfinfo;
+	echo "$h\t$u\t$p";
+	exit;
+}
+
+$sql_status = file_get_contents('https://sql.mit.edu/main/do/batch/status?u=' . urlencode($env_user));
+switch($sql_status) {
+	case 1:
+		$myPassword = `/usr/bin/sql-signup`;
+        file_put_contents($cnfPath, "[client]\nhost=$host\nuser=$env_user\npassword=$myPassword\n");
+        $cnfinfo = getMyCnfInfo($cnfPath);
+        if (is_array($cnfinfo)) {
+            list($h,$u,$p) = $cnfinfo;
+    	    echo "$h\t$u\t$p";
+        }
+		break;
+	case 0:
+}
Index: tags/fc15-eol/locker/sql/bin/get-status
===================================================================
--- tags/fc15-eol/locker/sql/bin/get-status	(revision 2244)
+++ tags/fc15-eol/locker/sql/bin/get-status	(revision 2244)
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+status=`wget --no-check-certificate https://sql.mit.edu/main/do/batch/status?u=$USER -q -O-`
+
+echo $status
+exit $status
Index: tags/fc15-eol/locker/sql/bin/save-password
===================================================================
--- tags/fc15-eol/locker/sql/bin/save-password	(revision 2244)
+++ tags/fc15-eol/locker/sql/bin/save-password	(revision 2244)
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+mkdir $lroot/.sql 2>/dev/null
+fs sa $lroot/.sql system:anyuser none
+fs sa $lroot/.sql system:authuser none
+fs sa $lroot/.sql daemon.scripts write
+fs sa $lroot/.sql daemon.sql write
+rm -f $lroot/.sql/my.cnf $lroot/.my.cnf
+
+echo "[client]
+host=sql.mit.edu
+user=$sqluser
+password=$sqlpass" > $lroot/.sql/my.cnf
+
+ln -nfs .sql/my.cnf $lroot/.my.cnf 2>/dev/null
Index: tags/fc15-eol/locker/sql/bin/test-password
===================================================================
--- tags/fc15-eol/locker/sql/bin/test-password	(revision 2244)
+++ tags/fc15-eol/locker/sql/bin/test-password	(revision 2244)
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+mysql -e "select 1" 2>&1 | grep -i error
Index: tags/fc15-eol/lvs/debian/config/etc/aliases
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/aliases	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/aliases	(revision 2244)
@@ -0,0 +1,14 @@
+# /etc/aliases
+mailer-daemon: postmaster
+postmaster: root
+nobody: root
+hostmaster: root
+usenet: root
+news: root
+webmaster: root
+www: root
+ftp: root
+abuse: root
+noc: root
+security: root
+root: andersk@mit.edu, quentin@mit.edu, geofft+root@mit.edu, mitchb@mit.edu, ezyang@mit.edu, xavid@mit.edu, adehnert-sipb@mit.edu, achernya@mit.edu
Index: tags/fc15-eol/lvs/debian/config/etc/cron.d/restart-inetd
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/cron.d/restart-inetd	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/cron.d/restart-inetd	(revision 2244)
@@ -0,0 +1,3 @@
+SHELL=/bin/sh
+PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
+*/5 * * * * root /etc/init.d/inetd restart >/dev/null 2>&1
Index: tags/fc15-eol/lvs/debian/config/etc/ha.d/cib.xml
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/ha.d/cib.xml	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/ha.d/cib.xml	(revision 2244)
@@ -0,0 +1,66 @@
+<?xml version="1.0" ?>
+<cib admin_epoch="0" epoch="0" num_updates="0">
+	<configuration>
+		<crm_config>
+			<cluster_property_set id="cib-bootstrap-options">
+				<attributes>
+					<nvpair id="cib-bootstrap-options-symmetric_cluster" name="symmetric_cluster" value="true"/>
+					<nvpair id="cib-bootstrap-options-no_quorum_policy" name="no_quorum_policy" value="stop"/>
+					<nvpair id="cib-bootstrap-options-default_resource_stickiness" name="default_resource_stickiness" value="0"/>
+					<nvpair id="cib-bootstrap-options-default_resource_failure_stickiness" name="default_resource_failure_stickiness" value="0"/>
+					<nvpair id="cib-bootstrap-options-stonith_enabled" name="stonith_enabled" value="false"/>
+					<nvpair id="cib-bootstrap-options-stonith_action" name="stonith_action" value="reboot"/>
+					<nvpair id="cib-bootstrap-options-stop_orphan_resources" name="stop_orphan_resources" value="true"/>
+					<nvpair id="cib-bootstrap-options-stop_orphan_actions" name="stop_orphan_actions" value="true"/>
+					<nvpair id="cib-bootstrap-options-remove_after_stop" name="remove_after_stop" value="false"/>
+					<nvpair id="cib-bootstrap-options-short_resource_names" name="short_resource_names" value="true"/>
+					<nvpair id="cib-bootstrap-options-transition_idle_timeout" name="transition_idle_timeout" value="5min"/>
+					<nvpair id="cib-bootstrap-options-default_action_timeout" name="default_action_timeout" value="5s"/>
+					<nvpair id="cib-bootstrap-options-is_managed_default" name="is_managed_default" value="true"/>
+				</attributes>
+			</cluster_property_set>
+		</crm_config>
+		<nodes/>
+		<resources>
+			<group id="scripts_LVS">
+				<primitive class="heartbeat" id="scripts_LVS_ldirectord" provider="heartbeat" type="ldirectord">
+				</primitive>
+				<primitive class="ocf" id="ip_scripts.mit.edu" provider="heartbeat" type="IPaddr2">
+					<operations>
+						<op id="ip_scripts.mit.edu_mon" interval="5s" name="monitor" timeout="5s"/>
+					</operations>
+					<instance_attributes id="ip_scripts.mit.edu_inst_attr">
+						<attributes>
+							<nvpair id="ip_scripts.mit.edu_attr_0" name="ip" value="18.181.0.46"/>
+							<nvpair id="ip_scripts.mit.edu_attr_1" name="netmask" value="16"/>
+							<nvpair id="ip_scripts.mit.edu_attr_2" name="nic" value="eth0"/>
+							<nvpair id="ip_scripts.mit.edu_attr_3" name="broadcast" value="18.181.255.255"/>
+						</attributes>
+					</instance_attributes>
+				</primitive>
+				<primitive class="ocf" id="ip_scripts-cert.mit.edu" provider="heartbeat" type="IPaddr2">
+					<operations>
+						<op id="ip_scripts-cert.mit.edu_mon" interval="5s" name="monitor" timeout="5s"/>
+					</operations>
+					<instance_attributes id="ip_scripts-cert.mit.edu_inst_attr">
+						<attributes>
+							<nvpair id="ip_scripts-cert.mit.edu_attr_0" name="ip" value="18.181.0.50"/>
+							<nvpair id="ip_scripts-cert.mit.edu_attr_1" name="netmask" value="16"/>
+							<nvpair id="ip_scripts-cert.mit.edu_attr_2" name="nic" value="eth0"/>
+							<nvpair id="ip_scripts-cert.mit.edu_attr_3" name="broadcast" value="18.181.255.255"/>
+						</attributes>
+					</instance_attributes>
+				</primitive>
+			</group>
+		</resources>
+		<constraints>
+			<rsc_location id="rsc_location_scripts_LVS" rsc="scripts_LVS">
+				<rule id="prefered_location_group_1" score="100">
+					<expression attribute="#uname" id="prefered_location_group_1_expr" operation="eq" value="rack-forward"/>
+				</rule>
+			</rsc_location>
+		</constraints>
+	</configuration>
+	<status/>
+</cib>
+
Index: tags/fc15-eol/lvs/debian/config/etc/ha.d/ha.cf
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/ha.d/ha.cf	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/ha.d/ha.cf	(revision 2244)
@@ -0,0 +1,12 @@
+logfacility        local0
+debug 0
+use_logd on
+mcast eth0 224.0.0.181 694 1 0
+deadtime 10
+initdead 60
+keepalive 1
+warntime 3
+
+node        rack-forward
+node        rack-backward
+crm respawn
Index: tags/fc15-eol/lvs/debian/config/etc/ha.d/haresources
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/ha.d/haresources	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/ha.d/haresources	(revision 2244)
@@ -0,0 +1,5 @@
+not-forward        \
+        ldirectord \
+        LVSSyncDaemonSwap::master \
+        IPaddr2::18.181.0.46/16/eth0/18.181.255.255 \
+        IPaddr2::18.181.0.50/16/eth0/18.181.255.255
Index: tags/fc15-eol/lvs/debian/config/etc/ha.d/ldirectord-finger.sh
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/ha.d/ldirectord-finger.sh	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/ha.d/ldirectord-finger.sh	(revision 2244)
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+ulimit -v 10240
+
+read line
+line=${line%[:blank:]}
+line=${line%
+}
+
+/sbin/ipvsadm | awk '! ($1 == "->" && $4 == 0 && $5 == 0 && $6 == 0) { print }'
Index: tags/fc15-eol/lvs/debian/config/etc/ha.d/ldirectord-http.sh
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/ha.d/ldirectord-http.sh	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/ha.d/ldirectord-http.sh	(revision 2244)
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+ulimit -v 10240
+
+# Read and ignore the request
+line=foo
+while [ -n "$line" ]; do
+    read line
+    line=${line%[:blank:]}
+    line=${line%
+}
+done
+
+# Generate an HTTP reply
+
+echo "HTTP/1.0 200 OK
+"
+echo "Content-type: text/html
+"
+echo "
+"
+echo "<html><head><title>scripts.mit.edu server status</title></head><body><h1>scripts.mit.edu server status</h1><p>The following table shows a list of the servers that are currently handling web requests for scripts.mit.edu:</p><table>"
+/sbin/ipvsadm | sed 's/:0//; s/:Port//' | awk 'BEGIN { OFS="</td><td>"; show=1 } /^FWM  2 / { show=1 } /^FWM  [^2] / { show=0 } /->/ { if (show==1) print "<tr><td>" $2, $4, $5, $6 "</td></tr>"}'
+echo "</table></body></html>"
Index: tags/fc15-eol/lvs/debian/config/etc/ha.d/ldirectord.cf
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/ha.d/ldirectord.cf	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/ha.d/ldirectord.cf	(revision 2244)
@@ -0,0 +1,65 @@
+checktimeout=5
+checkinterval=1
+autoreload=yes
+logfile="/var/log/ldirectord.log"
+quiescent=yes
+
+# iptables rules caused SMTP to use FWM 3
+virtual=3
+        #real=18.181.0.53:25  gate 4096 # old-faithful
+        real=18.181.0.57:25  gate 4096 # better-mousetrap
+        real=18.181.0.167:25 gate 4096 # bees-knees
+	real=18.181.0.228:25 gate 1024 # cats-whiskers
+	real=18.181.0.234:25 gate 4096 # busy-beaver
+	real=18.181.0.235:25 gate 4096 # real-mccoy
+	#real=18.181.0.237:25 gate 4096 # pancake-bunny
+	#real=18.181.0.236:25 gate 4096 # whole-enchilada
+	real=18.181.0.135:25 gate 4096 # shining-armor
+	real=18.181.0.141:25 gate 4096 # golden-egg
+        service=smtp
+        scheduler=wlc
+        persistent=600
+        protocol=fwm
+        checktype=negotiate
+	checkport=25
+
+# Apache (80, 443, and 444) uses FWM 2
+virtual=2
+	#real=18.181.0.53  gate 4096 # old-faithful
+	real=18.181.0.57  gate 4096 # better-mousetrap
+	real=18.181.0.167 gate 4096 # bees-knees
+	real=18.181.0.228 gate 1024 # cats-whiskers
+	real=18.181.0.234 gate 4096 # busy-beaver
+	real=18.181.0.235 gate 4096 # real-mccoy
+	#real=18.181.0.237 gate 4096 # pancake-bunny
+	#real=18.181.0.236 gate 4096 # whole-enchilada
+	real=18.181.0.135 gate 4096 # shining-armor
+	real=18.181.0.141 gate 4096 # golden-egg 
+	fallback=127.0.0.1 gate
+	service=http
+	request="heartbeat/http"
+	virtualhost="scripts.mit.edu"
+	receive="1"
+	checktype=negotiate
+	checkport=80
+	scheduler=wlc
+	persistent=600
+	protocol=fwm
+
+# Everything else uses FWM 1 and gets sent only to the primary
+virtual=1
+        #real=18.181.0.53  gate "heartbeat/services", "1"  # old-faithful
+        real=18.181.0.57  gate "heartbeat/services", "2"  # better-mousetrap
+        real=18.181.0.167 gate "heartbeat/services", "3"  # bees-knees
+	real=18.181.0.228 gate "heartbeat/services", "4"  # cats-whiskers
+	real=18.181.0.234 gate "heartbeat/services", "5"  # busy-beaver
+	real=18.181.0.235 gate "heartbeat/services", "6"  # real-mccoy
+	#real=18.181.0.237 gate "heartbeat/services", "7"  # pancake-bunny
+	#real=18.181.0.236 gate "heartbeat/services", "8"  # whole-enchilada
+	real=18.181.0.135 gate "heartbeat/services", "9"  # shining-armor
+	real=18.181.0.141 gate "heartbeat/services", "10" # golden-egg
+	service=http
+        scheduler=wrr
+        protocol=fwm
+        checktype=negotiate
+	checkport=80
Index: tags/fc15-eol/lvs/debian/config/etc/inetd.conf
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/inetd.conf	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/inetd.conf	(revision 2244)
@@ -0,0 +1,42 @@
+# /etc/inetd.conf:  see inetd(8) for further informations.
+#
+# Internet superserver configuration database
+#
+#
+# Lines starting with "#:LABEL:" or "#<off>#" should not
+# be changed unless you know what you are doing!
+#
+# If you want to disable an entry so it isn't touched during
+# package updates just comment it out with a single '#' character.
+#
+# Packages should modify this file by using update-inetd(8)
+#
+# <service_name> <sock_type> <proto> <flags> <user> <server_path> <args>
+#
+#:INTERNAL: Internal services
+#discard		stream	tcp	nowait	root	internal
+#discard		dgram	udp	wait	root	internal
+#daytime		stream	tcp	nowait	root	internal
+#time		stream	tcp	nowait	root	internal
+
+#:STANDARD: These are standard services.
+
+#:BSD: Shell, login, exec and talk are BSD protocols.
+
+#:MAIL: Mail, news and uucp services.
+
+#:INFO: Info services
+ident		stream	tcp	wait	identd	/usr/sbin/identd	identd
+
+#:BOOT: TFTP service is provided primarily for booting.  Most sites
+#       run this only on machines acting as "boot servers."
+
+#:RPC: RPC based services
+
+#:HAM-RADIO: amateur-radio services
+
+#:OTHER: Other services
+
+# Make it easy to remotely query these LVS servers
+79	stream	tcp	nowait	root	/etc/heartbeat/ldirectord-finger.sh
+78	stream	tcp	nowait	root	/etc/heartbeat/ldirectord-http.sh
Index: tags/fc15-eol/lvs/debian/config/etc/lighttpd/lighttpd.conf
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/lighttpd/lighttpd.conf	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/lighttpd/lighttpd.conf	(revision 2244)
@@ -0,0 +1,47 @@
+server.modules              = (
+	"mod_alias",
+	"mod_magnet",
+)
+
+server.max-connections=4096
+server.max-fds=9182
+server.max-read-idle=5
+
+## a static document-root, for virtual-hosting take look at the
+## server.virtual-* options
+server.document-root       = "/var/www/"
+
+## where to send error-messages to
+server.errorlog            = "/var/log/lighttpd/error.log"
+
+### files to check for if .../ is requested
+#index-file.names           = ( "index.php", "index.html",
+#                               "index.htm", "default.htm",
+#                               "index.lighttpd.html" )
+
+## bind to port (default: 80)
+server.port               = 80
+
+## bind to localhost only (default: all interfaces)
+## server.bind                = "localhost"
+
+## to help the rc.scripts
+server.pid-file            = "/var/run/lighttpd.pid"
+
+## change uid to <uid> (default: don't care)
+server.username            = "www-data"
+
+## change uid to <uid> (default: don't care)
+server.groupname           = "www-data"
+
+alias.url = (
+	"/__scripts/maint/" => "/etc/lighttpd/scripts-maint/"
+)
+
+$HTTP["url"] !~ "^/__scripts/maint" {
+	magnet.attract-physical-path-to = ( "/etc/lighttpd/scripts-maint.lua" )
+}
+
+#### external configuration files
+## mimetype mapping
+include_shell "/usr/share/lighttpd/create-mime.assign.pl"
Index: tags/fc15-eol/lvs/debian/config/etc/lighttpd/scripts-maint.lua
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/lighttpd/scripts-maint.lua	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/lighttpd/scripts-maint.lua	(revision 2244)
@@ -0,0 +1,6 @@
+-- lighty.header["X-Maintenance-Mode"] = "1" 
+-- uncomment the above if you want to add the header
+lighty.content = { { filename = "/etc/lighttpd/scripts-maint/index.html" } }
+lighty.header["Content-Type"] = "text/html"
+return 503
+-- or return 200 if you want
Index: tags/fc15-eol/lvs/debian/config/etc/lighttpd/scripts-maint/index.html
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/lighttpd/scripts-maint/index.html	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/lighttpd/scripts-maint/index.html	(revision 2244)
@@ -0,0 +1,97 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+        "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+<head>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<link rel="stylesheet" href="/__scripts/maint/style.css" type="text/css" />
+<title>scripts.mit.edu: Service unavailable</title>
+</head>
+<body>
+<div id="farouter">
+    <div id="outer">
+            <div id="masthead">
+
+                <h1 id="header"><a rel="home" href="http://scripts.mit.edu/">scripts.mit.edu</a></h1>
+                <h2 id="tagline">MIT SIPB Script Services for Athena</h2>
+            </div>
+            <div id="hmenu">
+                <div id="hnav">
+                    <ul id="navlist">
+                        <li><a href="http://scripts.mit.edu/">home</a></li>
+
+    <li><a href="http://scripts.mit.edu/start/">quick-start</a></li>
+                        <li><a href="http://scripts.mit.edu/web/">web scripts</a></li>
+                        <li><a href="http://scripts.mit.edu/mysql/">mysql databases</a></li>
+                        <li><a href="http://scripts.mit.edu/mail/">mail scripts</a></li>
+                        <li><a href="http://scripts.mit.edu/cron/">cron</a></li>
+                        <li><a href="http://scripts.mit.edu/news/">blog</a></li>
+    <li><a href="http://scripts.mit.edu/faq/">faq</a></li>
+
+                    </ul>
+                </div>
+            </div>
+        <div id="rap">
+            <div id="main">
+                <div id="content">
+
+<h3 class="storytitle"><a>Service unavailable</a></h3>
+    <p>The scripts.mit.edu service is currently unavailable. The service maintainers are working on the problem and expect to have it resolved soon.</p>
+    <p>If this message does not go away after an hour or more, contact <a href="mailto:scripts@mit.edu">scripts@mit.edu</a> for assistance.</p>
+<div class="feedback">
+</div>
+<div align="center"><img src="/__scripts/maint/1.gif" style="height:1px;width:400px" class="divider" alt="" /></div>
+
+
+
+<p>
+
+
+</p>
+
+
+
+                </div>
+                <div id="menu">
+
+                    <div id="nav">
+
+
+
+
+
+
+
+                        <h2>Contact</h2>
+                        <ul><li><a href="mailto:scripts@mit.edu">scripts@mit.edu</a></li>
+                        </ul>
+
+Feel free to contact us with any questions, comments, or suggestions.
+                        <h2>Search</h2>
+                        <ul>
+                            <li><form action="http://scripts.mit.edu/" method="get"><p>Search<br /><input type="text" name="q" value="" size="15" /></p></form></li>
+                        </ul>
+                        <h2>Feeds</h2>
+                        <ul>
+                            <li><a href="http://scripts.mit.edu/rss/?section=special" title="RSS Feed">RSS</a></li> <li><a href="http://scripts.mit.edu/atom/?section=special" title="Atom Feed">Atom</a></li>
+
+                        </ul>
+
+<a class="nobutt" href="http://scripts.mit.edu/faq/45/"><img src="/__scripts/maint/powered_by-trans.gif" alt="Powered by scripts" /></a>
+
+                    </div>
+                </div>
+		    <div id="clearer">&nbsp;</div>
+            </div>
+        </div>
+        <div id="foot">&nbsp;</div>
+
+<!--
+        <div id="footer">
+            <p class="credit">Originally "Blue Horizon" by <a href="http://kaushalsheth.com">Kaushal Sheth</a>. Mangled for scripts.mit.edu by <a href="/~presbrey/">Joe Presbrey</a><br />
+            </p>
+        </div>
+-->
+    </div>
+</div>
+</body>
+</html>
Index: tags/fc15-eol/lvs/debian/config/etc/lighttpd/scripts-maint/style.css
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/lighttpd/scripts-maint/style.css	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/lighttpd/scripts-maint/style.css	(revision 2244)
@@ -0,0 +1,325 @@
+/* -------  Layout CSS (Centered Fixed Width) ------ */
+
+body {
+  font-family: 'Lucida Grande', 'Lucida Sans Unicode', Verdana, sans-serif;
+  font-size: 80%;
+  margin: 0;
+  padding: 0;
+  text-align: center; /* IE 5.5 hack */
+}
+#farouter {
+	/*background: #ffffff;*/
+	width: 60em;
+	margin: 20px auto 20px auto;
+	text-align: left; /* IE 5.5 hack part II */
+}
+#outer {}
+#rap {
+	border: 1px solid #3A291F;
+}
+#masthead {
+            background: white;
+	border: 1px solid #3A291F;
+	letter-spacing: 0.2em;
+	padding: 0 10px 10px 60px;
+	font: normal 100% 'Lucida Grande', 'Lucida Sans Unicode', Verdana, sans-serif;
+	min-height: 100px;
+}
+#main { padding-left:3em; }
+#content { float: left; width: 40em; margin-top: 1em; }
+#content_wide { padding-right:35px; }
+#content_home { float: left; width: 490px; padding-top: 0px; }
+#menu { float: right; width: 14em; margin-right: 10px; border-left: 1px dashed #2050A0; }
+#nav { padding-left: 10px; }
+#logo { padding-top: 25px; padding-left: 12px; }
+#hmenu { margin: 0; padding: 0; }
+#hnav { margin: 0; padding: 0; }
+#clearer { clear: both; margin: 0; padding: 0; }
+#footer { margin: 8px 8px 8px 8px; }
+
+/* ----------------- Color CSS ------------------------ */
+
+body { background: #2050A0; color:#333; }
+#rap { background: #ffffff; }
+#masthead { background-image: url('/__scripts/maint/sb.gif'); background-repeat: no-repeat; }
+#footer { background: #2050A0; }
+#hnav { background: #2050A0; }
+a { color: #2050A0; text-decoration: none; }
+a:visited { color: #2050A0; text-decoration: none; }
+a:hover { color: #2050A0; text-decoration: underline; }
+acronym, abbr { border-bottom: #333; }
+h2 { color: #17397A; font-size: 24px; font-weight: normal; }
+h3 a { color: #17397A; }
+h3 a:hover { color: #17397A; }
+h3 a:visited { color: #17397A; }
+.meta { color: #1F6710 }
+.meta a { color: #001700; }
+.feedback a { color: #001700; }
+
+/* -------- Core CSS --------- */
+
+
+a { text-decoration: none; font-weight:bold; }
+a img { border: none; }
+acronym, abbr { border-bottom: 1px dashed; }
+acronym, abbr, span.caps { cursor: help; font-size: 90%; letter-spacing: .07em; }
+blockquote { margin-left: 1.5em; }
+cite { font-size: 90%; font-style: normal; }
+#header a:hover { text-decoration: underline; }
+h1 { margin: 0; padding: 20px; text-align: right; }
+#hidden {display:none;}
+
+h2 {
+	font: 100% 'Lucida Grande', 'Lucida Sans Unicode', Verdana, sans-serif;
+	letter-spacing: 0.2em;
+	margin: 0 20px 20px 0;
+	padding: 20px 0 0 0;
+}
+h2#tagline {
+	margin-right: 25px;
+	padding:0;
+	text-align: right;
+/*	color: #F2EEEC; */
+	border: 0px none;
+	margin-left:0;
+	margin-top:0;
+	margin-bottom:0
+}
+
+.post h2 {
+	font: 100% 'Lucida Grande', 'Lucida Sans Unicode', Verdana, sans-serif;
+	letter-spacing: 0.2em;
+	margin: 0 20px 0 30px;
+	padding: 20px 0 30px 0;
+}
+h3 {
+	font: 18px 'Lucida Grande', 'Lucida Sans Unicode', Verdana, sans-serif;
+	margin-left: 0;
+	margin-top: 20px;
+	color: #17397A;
+        border-bottom: solid thin #17397A;
+}
+h3#comments { margin-left: 20px; }
+h3#respond { margin-left: 20px; }
+h4 {
+	font-size: 16px;
+	font-weight: normal;
+}
+ol#comments li p { font-size: 100%; }
+img {
+	margin: 10px;
+	padding: 10px;
+	border: 0px solid #2F700F;
+}
+p, .feedback {
+	font: 100%/175% 'Lucida Grande', 'Lucida Sans Unicode', Verdana, sans-serif;
+}
+p {}
+.textarea { width:200px; margin:0; }
+#archvies {
+	font: 150% normal 'Lucida Grande', 'Lucida Sans Unicode', Verdana, sans-serif;
+}
+
+/* ------------------------- Classes used by the_meta() --------------------- */
+
+ul.post-meta {
+	list-style: none;
+}
+
+ul.post-meta span.post-meta-key {
+	font-weight: bold;
+}
+
+.credit {
+  color: #fff;
+  font-size: 90%;
+  margin: 10px 0 0 0;
+  padding: 3px;
+  text-align: center;
+}
+
+.credit a, .credit a:hover { color: #fff; text-decoration: none; }
+.feedback { text-align: right; clear: both; margin-right: 30px; font-size: 90% }
+.meta { font-size: .95em; }
+.meta li, ul.post-meta li { display: inline; }
+.meta ul { display: inline; list-style: none;margin: 0; padding: 0; }
+.meta, .meta a { font-weight: normal; letter-spacing: 0; }
+.post { margin: 35px 35px 20px 0; }
+.entrytext {margin-left: 30px; }
+.storytitle { margin-top: 10px; margin-bottom: 2px; }
+.storytitle a { text-decoration: none; }
+.storycontent { margin-bottom: 5px; border-bottom: 1px solid #2050A0; }
+#commentform { margin-left: 20px; }
+#commentform  #comment { width:450px; }
+#commentform #author, #commentform #email, #commentform #url, #commentform textarea {
+ 	background: #fff; padding: .2em;
+}
+#commentform textarea { width:100%; }
+#commentlist li { border: 2px solid #2050A0; margin-bottom: 20px; padding-left: 20px; }
+#commentlist li ul { border-left: 1px solid #ddd; font-size: 110%; list-style-type: none; }
+
+/* ----------  All menu styling except #menu itself (in layout above) ------- */
+
+#nav form {
+	margin: 0 0 0 13px;
+}
+
+#nav input#s {
+	width: 80%;
+	background: #eee;
+	border: 1px solid #999;
+	color: #000;
+}
+
+#nav ul li h2 {
+	font-family: 'Lucida Grande', 'Lucida Sans Unicode', Verdana, sans-serif;
+	font-weight: normal;
+	letter-spacing: 0.1em;
+	border: 0px none;
+	text-align: left;
+	padding-left:0;
+	margin-left: 0
+}
+
+#nav ul ul ul.children {
+	font-size: 100%;
+	padding-left: 4px;
+}
+
+/*#nav { width: 170px; }*/
+
+#nav ul {
+	margin-left: 0;
+	padding-left: 0;
+	padding-right: 4px;
+	list-style-type: none;
+	font-family: 'Lucida Grande', 'Lucida Sans Unicode', Verdana, sans-serif;
+	font-size: 95%;
+}
+
+#nav li {
+	display: block;
+	padding-left: 1.3em;
+	background-color: #FFF;
+	background-image: url('images/icon.gif');
+	background-repeat: no-repeat;
+	background-position: 0 55%;
+	border-bottom: 1px dotted #2050A0;
+	padding-right:3px; padding-top:3px; padding-bottom:3px;
+}
+
+#nav a.nobutt {
+	background-image: none;
+	border-bottom: none;
+}
+
+#nav a.nobutt:hover {
+	background-image: none;
+	border-bottom: none;
+}
+
+#nav a:link, #navlist a:visited {
+	text-decoration: none;
+}
+
+#nav li:hover {
+	background-image: url('images/icon2.gif'); 
+	/*color: #000*/
+}
+
+#themeswitcher {
+	font-size: 8px;
+}
+
+/*------------- hnav------------*/
+
+#hnav ul {
+	text-align: center;
+        margin: 0;
+        padding: 0;
+	background-color: #2050A0;
+	color: #F2EEEC;
+	width: 100%;
+	font-family: 'Lucida Grande', 'Lucida Sans Unicode', Verdana, sans-serif;
+	/* fixes Firefox 0.9.3 */
+}
+
+#hnav ul li {
+	display: inline;
+              margin: 0; padding: 0;
+              line-height: 2.5em;
+}
+
+#hnav ul li a {
+                padding: .5em .8em;
+	color: #F2EEEC;
+	text-decoration: none;
+	border-left: 1px solid #F2EEEC;
+}
+#hnav ul li:first-child a {
+                            border-left: none;
+                            }
+#hnav ul li a:hover {
+	background: #F2EEEC;
+	color: #3A291F;
+}
+
+#hnav #active { border-left: 1px solid #F2EEEC; }
+
+/*------------- added ------------*/
+
+.gravatar {
+	float:left;
+	padding: 3px;
+	margin-right: 5px;
+	margin-bottom: 5px;
+	border: 1px solid #2F700F;
+}	
+
+#commentbox {
+	background: #F2EEEC;
+	border: 1px solid #2F700F;
+	padding: 5px;
+	margin-bottom: 15px;
+}
+
+.commentby {
+	font-size: 14px;
+	text-transform: uppercase;
+}
+.commentinfo {
+	font-size: 10px;
+	margin-top: -10px;
+	border-bottom: 1px soild #1F6710;
+}
+
+.commentid {
+	float: right;
+	font-size: 24px;
+	font-style: italic;
+	padding-left: 10px;
+	padding-right: 5px;
+	padding-top: 5px;
+	padding-bottom: 5px;
+	color: #2050A0;
+}
+
+.commentid a {
+	color: #2050A0;
+	text-decoration: none;
+}
+
+.post ul li {
+	padding: 0px;
+	font-weight: normal;
+	list-style: url('images/icon.gif');
+	line-height: 1.5em;
+}
+
+.post ul li:hover {
+	padding: 0px;
+	font-weight: normal;
+	list-style: url('images/icon2.gif');
+	line-height: 1.5em;
+}
+
Index: tags/fc15-eol/lvs/debian/config/etc/logd.cf
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/logd.cf	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/logd.cf	(revision 2244)
@@ -0,0 +1,43 @@
+#	File to write debug messages to
+#	Default: /var/log/ha-debug
+debugfile /var/log/ha-debug
+
+#
+#
+# 	File to write other messages to
+#	Default: /var/log/ha-log
+logfile	/var/log/ha-log
+
+#
+#
+#	Facility to use for syslog()/logger 
+#	Default: local7
+logfacility	local7
+
+
+#	Entity to be shown at beginning of a message
+# 	for logging daemon
+# 	Default: "logd"
+entity logd
+
+
+#	Do we register to apphbd
+#	Default: no
+#useapphbd no
+
+#	There are two processes running for logging daemon
+#  		1. parent process which reads messages from all client channels 
+#  		and writes them to the child process 
+#  
+#  		2. the child process which reads messages from the parent process through IPC
+#  		and writes them to syslog/disk
+
+
+#	set the send queue length from the parent process to the child process
+#
+#sendqlen 256 
+
+#	set the recv queue length in child process
+#
+#recvqlen 256
+
Index: tags/fc15-eol/lvs/debian/config/etc/modules
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/modules	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/modules	(revision 2244)
@@ -0,0 +1,18 @@
+# /etc/modules: kernel modules to load at boot time.
+#
+# This file contains the names of kernel modules that should be loaded
+# at boot time, one per line. Lines beginning with "#" are ignored.
+
+loop
+ip_vs_dh
+ip_vs_ftp
+ip_vs
+ip_vs_lblc
+ip_vs_lblcr
+ip_vs_lc
+ip_vs_nq
+ip_vs_rr
+ip_vs_sed
+ip_vs_sh
+ip_vs_wlc
+ip_vs_wrr
Index: tags/fc15-eol/lvs/debian/config/etc/munin/munin-node.conf
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/munin/munin-node.conf	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/munin/munin-node.conf	(revision 2244)
@@ -0,0 +1,41 @@
+#
+# Example config-file for munin-node
+#
+
+log_level 4
+log_file /var/log/munin/munin-node.log
+port 4949
+pid_file /var/run/munin/munin-node.pid
+background 1
+setseid 1
+
+# Which port to bind to;
+host *
+user root
+group root
+setsid 1
+
+# Regexps for files to ignore
+
+#ignore_file [#~]$  # FIX doesn't work. '#' starts a comment
+ignore_file DEADJOE$
+ignore_file \.bak$
+ignore_file %$
+ignore_file \.dpkg-(tmp|new|old|dist)$
+ignore_file \.rpm(save|new)$
+ignore_file \.pod$
+
+# Set this if the client doesn't report the correct hostname when
+# telnetting to localhost, port 4949
+#
+#host_name localhost.localdomain
+
+# A list of addresses that are allowed to connect.  This must be a
+# regular expression, due to brain damage in Net::Server, which
+# doesn't understand CIDR-style network notation.  You may repeat
+# the allow line as many times as you'd like
+
+allow ^127\.0\.0\.1$
+allow ^18\.187\.1\.128$
+allow ^18\.181\.0\.65$
+allow ^18\.181\.0\.51$
Index: tags/fc15-eol/lvs/debian/config/etc/munin/plugin-conf.d/cps
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/munin/plugin-conf.d/cps	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/munin/plugin-conf.d/cps	(revision 2244)
@@ -0,0 +1,6 @@
+[cps_1_0]
+env.graph_title Load balanced miscellaneous connections
+[cps_2_0]
+env.graph_title Load balanced Apache connections
+[cps_3_0]
+env.graph_title Load balanced SMTP connections
Index: tags/fc15-eol/lvs/debian/config/etc/munin/plugin-conf.d/hddtemp_smartctl
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/munin/plugin-conf.d/hddtemp_smartctl	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/munin/plugin-conf.d/hddtemp_smartctl	(revision 2244)
@@ -0,0 +1,3 @@
+[hddtemp_smartctl]
+env.drives hda hdb
+
Index: tags/fc15-eol/lvs/debian/config/etc/munin/plugins/cps_1_0
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/munin/plugins/cps_1_0	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/munin/plugins/cps_1_0	(revision 2244)
@@ -0,0 +1,268 @@
+#!/usr/bin/perl
+#
+# Plugin to monitor connections per second, for LVS loadbalancers.
+#
+# Magic name:
+#
+# 	cps_<port>
+# 	cps_<vip>_<port>
+#
+# Examples:
+#
+# 	cps_smtp
+# 	cps_mail.foo.boo_smtp
+# 	cps_pop3
+# 	cps_www.foo.boo_www
+# 	cps_vvv.foo.boo_www
+#
+# Parameters understood:
+#
+# 	config   (required)
+# 	autoconf (optional - used by munin-config)
+# 	suggest  (optional - used by munin-config)
+#
+# $Log$
+# Revision 1.8  2004/12/10 18:55:14  jimmyo
+# Removed hardcoded host_name in linux/cps_.
+#
+# Revision 1.7  2004/12/10 18:51:44  jimmyo
+# linux/apt* has been forced to LANG=C, to get predictable output.
+#
+# Revision 1.6  2004/12/10 11:48:42  jimmyo
+# linux/cps_ plugin now groks high numbers.
+#
+# Revision 1.5  2004/12/10 10:47:49  jimmyo
+# Change name from ${scale} to ${graph_period}, to be more consistent.
+#
+# Revision 1.4  2004/12/09 22:12:56  jimmyo
+# Added "graph_period" option, to make "graph_sums" usable.
+#
+# Revision 1.3  2004/11/21 00:16:57  jimmyo
+# Changed a lot of plugins so they use DERIVE instead of COUNTER.
+#
+# Revision 1.2  2004/05/20 19:02:37  jimmyo
+# Set categories on a bunch of plugins
+#
+# Revision 1.1  2004/01/02 18:50:01  jimmyo
+# Renamed occurrances of lrrd -> munin
+#
+# Revision 1.1.1.1  2004/01/02 15:18:07  jimmyo
+# Import of LRRD CVS tree after renaming to Munin
+#
+# Revision 1.4  2003/11/07 17:43:16  jimmyo
+# Cleanups and log entries
+#
+#
+#
+# Magic markers - optional - used by installation scripts and munin-config:
+#
+#%# family=manual
+#%# capabilities=autoconf suggest
+#
+
+use strict;
+
+if ( defined $ARGV[0] and $ARGV[0] eq "autoconf" )
+{
+	&autoconf ();
+}
+if ( defined $ARGV[0] and $ARGV[0] eq "suggest" )
+{
+	my $sipvs;
+	$sipvs = &ipvs (".", ".", $sipvs);
+	exit 0 if $sipvs == undef;
+	&suggest ($sipvs);
+}
+
+unless ($0 =~ /cps(?:_([^_]+)|)_(.+)\s*$/)
+{
+	die "Could not parse name $0.\n";
+}
+my $vip  = $1;
+my $port = $2;
+my $ipvs;
+
+#print "Name: $0\nPort: $port\nVip : $vip\n";
+
+# Read ipvsadm-output
+
+$ipvs = &ipvs ($vip, $port, $ipvs);
+
+if ( defined $ARGV[0] and $ARGV[0] eq "dump" )
+{
+	use Data::Dumper;
+	print Dumper($ipvs);
+}
+
+if ( defined $ARGV[0] and $ARGV[0] eq "config" )
+{
+        &config ($vip, $port, $ipvs);
+}
+
+$vip = $vip || "";
+if (exists ($ipvs->{$vip}) and exists ($ipvs->{$vip}->{$port}))
+{
+	foreach my $host (sort keys %{$ipvs->{$vip}->{$port}})
+	{
+		(my $fname = $host) =~ s/[.-]/_/g;
+		print "$fname.value ", $ipvs->{$vip}->{$port}->{$host}, "\n";;
+	}
+}
+else
+{
+	foreach my $vip (sort keys %{$ipvs})
+	{
+		foreach my $host (sort keys %{$ipvs->{$vip}->{$port}})
+		{
+			(my $fname = ($vip . "-" . $host)) =~ s/[.-]/_/g;
+			print "$fname.value ", $ipvs->{$vip}->{$port}->{$host}, "\n";;
+		}
+	}
+}
+
+sub autoconf
+{
+	system ("/sbin/ipvsadm -L --stats >/dev/null 2>/dev/null");
+
+	if ($? == 0)
+	{
+		print "yes\n";
+		exit 0;
+	}
+	elsif (($?>>8) == 2)
+	{
+		print "no (permission denied)\n";
+		exit 1;
+	}
+	elsif ($? == 127)
+	{
+		print "no (ipvsadm not found)\n";
+		exit 1;
+	}
+	else
+	{
+		print "no\n";
+		exit 1;
+	}
+}
+sub suggest
+{
+	my $ipvs = shift;
+	exit 0 unless $ipvs;
+
+	foreach my $vip (sort keys %{$ipvs})
+	{
+		foreach my $port (sort keys %{$ipvs->{$vip}})
+		{
+			print "cps_${vip}_$port\n";
+		}
+	}
+	exit 0;
+}
+
+sub config
+{
+	my $vip  = shift;
+	my $port = shift;
+	my $ipvs = shift;
+
+	print "graph_title ", ($ENV{"graph_title"} || "Loadbalanced ".($vip?$vip:"*")."->".$port." connections"),"\n";
+	print "graph_args -l 0\n";
+	print "graph_total total\n";
+	print "graph_vlabel connections / \${graph_period}\n";
+	print "graph_category network\n";
+	my $first=1;
+	$vip = $vip || "";
+	if (exists ($ipvs->{$vip}) and exists ($ipvs->{$vip}->{$port}))
+	{
+		foreach my $host (sort keys %{$ipvs->{$vip}->{$port}})
+		{
+			(my $fname = $host) =~ s/[.-]/_/g;
+			if ( $first == 1 )
+			{
+				print "$fname.draw AREA\n";
+				$first=0
+			}
+			else
+			{
+				print "$fname.draw STACK\n";
+			}
+			print "$fname.type DERIVE\n";
+			$host =~ s/-bak//;
+			print "$fname.label $host\n";
+			print "$fname.max 1000\n";
+			print "$fname.min 0\n";
+		}
+	}
+	else
+	{
+		foreach my $vip (reverse sort keys %{$ipvs})
+		{
+			foreach my $host (sort keys %{$ipvs->{$vip}->{$port}})
+			{
+				(my $fname = ($vip . "-" . $host)) =~ s/[.-]/_/g;
+				if ( $first == 1 )
+				{
+					print "$fname.draw AREA\n";
+					$first=0
+				}
+				else
+				{
+					print "$fname.draw STACK\n";
+				}
+				print "$fname.type DERIVE\n";
+				$host =~ s/-bak//;
+				my $label = "$vip -> $host";
+				$label =~ s/\.MIT\.EDU//g;
+				print "$fname.label $label\n";
+				print "$fname.max 1000\n";
+				print "$fname.min 0\n";
+			}
+		}
+	}
+	exit 0;
+}
+
+sub ipvs
+{
+	my $vip  = shift;
+	my $port = shift;
+	my $ipvs = shift;
+	open (IPVS, "/sbin/ipvsadm -L --stats 2>/dev/null|") or return undef;
+	my $cvip  = "";
+	my $cport = "";
+	while (<IPVS>)
+	{
+		next if /^IP Virtual Server/;
+		next if /^Prot\s+LocalAddress/;
+		if (/^(\w+)\s+([\w\.-]+):([\w\d]+)\s+(\d+)[KMG]?\s+/)
+		{
+			$cvip  = $2;
+			$cport = $3;
+		}
+		elsif (/^FWM\s+([\d]+)\s/)
+		{
+		    $cvip = $1;
+		    $cport = 0;
+		}
+		elsif (/^\s+->\s+([^:]+):(\S+)\s+(\d+)G\s+/)
+		{
+			$ipvs->{$cvip}->{$cport}->{$1} += ($3*1000000000);
+		}
+		elsif (/^\s+->\s+([^:]+):(\S+)\s+(\d+)M\s+/)
+		{
+			$ipvs->{$cvip}->{$cport}->{$1} += ($3*1000000);
+		}
+		elsif (/^\s+->\s+([^:]+):(\S+)\s+(\d+)K\s+/)
+		{
+			$ipvs->{$cvip}->{$cport}->{$1} += ($3*1000);
+		}
+		elsif (/^\s+->\s+([^:]+):(\S+)\s+(\d+)\s+/)
+		{
+			$ipvs->{$cvip}->{$cport}->{$1} += $3;
+		}
+	}
+	close (IPVS) or return undef;
+	return $ipvs;
+}
+# vim:syntax=perl
Index: tags/fc15-eol/lvs/debian/config/etc/munin/plugins/cps_2_0
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/munin/plugins/cps_2_0	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/munin/plugins/cps_2_0	(revision 2244)
@@ -0,0 +1,1 @@
+link cps_1_0
Index: tags/fc15-eol/lvs/debian/config/etc/munin/plugins/cps_3_0
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/munin/plugins/cps_3_0	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/munin/plugins/cps_3_0	(revision 2244)
@@ -0,0 +1,1 @@
+link cps_1_0
Index: tags/fc15-eol/lvs/debian/config/etc/nagios/nrpe.cfg
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/nagios/nrpe.cfg	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/nagios/nrpe.cfg	(revision 2244)
@@ -0,0 +1,215 @@
+#############################################################################
+# Sample NRPE Config File 
+# Written by: Ethan Galstad (nagios@nagios.org)
+# 
+# Last Modified: 11-23-2007
+#
+# NOTES:
+# This is a sample configuration file for the NRPE daemon.  It needs to be
+# located on the remote host that is running the NRPE daemon, not the host
+# from which the check_nrpe client is being executed.
+#############################################################################
+
+
+# LOG FACILITY
+# The syslog facility that should be used for logging purposes.
+
+log_facility=daemon
+
+
+
+# PID FILE
+# The name of the file in which the NRPE daemon should write it's process ID
+# number.  The file is only written if the NRPE daemon is started by the root
+# user and is running in standalone mode.
+
+pid_file=/var/run/nagios/nrpe.pid
+
+
+
+# PORT NUMBER
+# Port number we should wait for connections on.
+# NOTE: This must be a non-priviledged port (i.e. > 1024).
+# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
+
+server_port=5666
+
+
+
+# SERVER ADDRESS
+# Address that nrpe should bind to in case there are more than one interface
+# and you do not want nrpe to bind on all interfaces.
+# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
+
+#server_address=192.168.1.1
+
+
+
+# ALLOWED HOST ADDRESSES
+# This is a comma-delimited list of IP address of hosts that are allowed
+# to talk to the NRPE daemon.
+#
+# NOTE: The daemon only does rudimentary checking of the client's IP
+#       address.  I would highly recommend adding entries in your
+#	/etc/hosts.allow file to allow only the specified host to connect
+#	to the port you are running this daemon on.
+#
+# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
+
+allowed_hosts=18.187.1.128,18.181.0.65
+
+
+
+# NRPE USER
+# This determines the effective user that the NRPE daemon should run as.  
+# You can either supply a username or a UID.
+# 
+# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
+
+nrpe_user=nagios
+
+
+
+# NRPE GROUP
+# This determines the effective group that the NRPE daemon should run as.  
+# You can either supply a group name or a GID.
+# 
+# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
+
+nrpe_group=nagios
+
+
+
+# COMMAND ARGUMENT PROCESSING
+# This option determines whether or not the NRPE daemon will allow clients
+# to specify arguments to commands that are executed.  This option only works
+# if the daemon was configured with the --enable-command-args configure script
+# option.  
+#
+# *** ENABLING THIS OPTION IS A SECURITY RISK! *** 
+# Read the SECURITY file for information on some of the security implications
+# of enabling this variable.
+#
+# Values: 0=do not allow arguments, 1=allow command arguments
+
+dont_blame_nrpe=0
+
+
+
+# DEBUGGING OPTION
+# This option determines whether or not debugging messages are logged to the
+# syslog facility.
+# Values: 0=debugging off, 1=debugging on
+
+debug=0
+
+
+
+# COMMAND TIMEOUT
+# This specifies the maximum number of seconds that the NRPE daemon will
+# allow plugins to finish executing before killing them off.
+
+command_timeout=60
+
+
+
+# CONNECTION TIMEOUT
+# This specifies the maximum number of seconds that the NRPE daemon will
+# wait for a connection to be established before exiting. This is sometimes
+# seen where a network problem stops the SSL being established even though
+# all network sessions are connected. This causes the nrpe daemons to
+# accumulate, eating system resources. Do not set this too low.
+
+connection_timeout=300
+
+
+
+# WEEK RANDOM SEED OPTION
+# This directive allows you to use SSL even if your system does not have
+# a /dev/random or /dev/urandom (on purpose or because the necessary patches
+# were not applied). The random number generator will be seeded from a file
+# which is either a file pointed to by the environment valiable $RANDFILE
+# or $HOME/.rnd. If neither exists, the pseudo random number generator will
+# be initialized and a warning will be issued.
+# Values: 0=only seed from /dev/[u]random, 1=also seed from weak randomness
+
+#allow_weak_random_seed=1
+
+
+
+# INCLUDE CONFIG FILE
+# This directive allows you to include definitions from an external config file.
+
+#include=<somefile.cfg>
+
+
+
+# INCLUDE CONFIG DIRECTORY
+# This directive allows you to include definitions from config files (with a
+# .cfg extension) in one or more directories (with recursion).
+
+#include_dir=<somedirectory>
+#include_dir=<someotherdirectory>
+
+
+
+# COMMAND DEFINITIONS
+# Command definitions that this daemon will run.  Definitions
+# are in the following format:
+#
+# command[<command_name>]=<command_line>
+#
+# When the daemon receives a request to return the results of <command_name>
+# it will execute the command specified by the <command_line> argument.
+#
+# Unlike Nagios, the command line cannot contain macros - it must be
+# typed exactly as it should be executed.
+#
+# Note: Any plugins that are used in the command lines must reside
+# on the machine that this daemon is running on!  The examples below
+# assume that you have plugins installed in a /usr/local/nagios/libexec
+# directory.  Also note that you will have to modify the definitions below
+# to match the argument format the plugins expect.  Remember, these are
+# examples only!
+
+# The following examples use hardcoded command arguments...
+
+#command[check_users]=/usr/lib/nagios/plugins/check_users -w 5 -c 10
+#command[check_load]=/usr/lib/nagios/plugins/check_load -w 15,10,5 -c 30,25,20
+command[check_disk1]=/usr/lib/nagios/plugins/check_disk -w 20 -c 10 -p /dev/hda1
+command[check_disk2]=/usr/lib/nagios/plugins/check_disk -w 20 -c 10 -p /dev/hdb1
+command[check_zombie_procs]=/usr/lib/nagios/plugins/check_procs -w 5 -c 10 -s Z
+command[check_total_procs]=/usr/lib/nagios/plugins/check_procs -w 150 -c 200 
+
+# The following examples allow user-supplied arguments and can
+# only be used if the NRPE daemon was compiled with support for 
+# command arguments *AND* the dont_blame_nrpe directive in this
+# config file is set to '1'...
+
+#command[check_users]=/usr/lib/nagios/plugins/check_users -w $ARG1$ -c $ARG2$
+#command[check_load]=/usr/lib/nagios/plugins/check_load -w $ARG1$ -c $ARG2$
+command[check_disk]=/usr/lib/nagios/plugins/check_disk -w 10% -c 5%
+#command[check_disk_p]=/usr/lib/nagios/plugins/check_disk -w $ARG1$ -c $ARG2$ -p $ARG3$
+#command[check_procs]=/usr/lib/nagios/plugins/check_procs -w $ARG1$ -c $ARG2$
+#command[check_procs_C]=/usr/lib/nagios/plugins/check_procs -w $ARG1$ -c $ARG2$ -C $ARG3$
+#command[check_procs_P]=/usr/lib/nagios/plugins/check_procs -w $ARG1$ -c $ARG2$ -P $ARG3$
+#command[check_procs_m]=/usr/lib/nagios/plugins/check_procs -w $ARG1$ -c $ARG2$ -m $ARG3$
+#command[check_procs_s]=/usr/lib/nagios/plugins/check_procs -w $ARG1$ -c $ARG2$ -s $ARG3$
+#command[check_procs_u]=/usr/lib/nagios/plugins/check_procs -w $ARG1$ -c $ARG2$ -u $ARG3$
+#command[check_procs_z]=/usr/lib/nagios/plugins/check_procs -w $ARG1$ -c $ARG2$ -z $ARG3$
+
+#command[check_users]=/usr/lib/nagios/plugins/check_users -w $ARG1$ -c $ARG2$
+#command[check_load]=/usr/lib/nagios/plugins/check_load -w $ARG1$ -c $ARG2$
+#command[check_disk]=/usr/lib/nagios/plugins/check_disk -w $ARG1$ -c $ARG2$ -p $ARG3$
+#command[check_procs]=/usr/lib/nagios/plugins/check_procs -w $ARG1$ -c $ARG2$ -s $ARG3$
+
+#
+# local configuration:
+#	if you'd prefer, you can instead place directives here
+include=/etc/nagios/nrpe_local.cfg
+
+# 
+# you can place your config snipplets into nrpe.d/
+include_dir=/etc/nagios/nrpe.d/
+
+
Index: tags/fc15-eol/lvs/debian/config/etc/network/if-up.d/iptables
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/network/if-up.d/iptables	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/network/if-up.d/iptables	(revision 2244)
@@ -0,0 +1,33 @@
+#!/bin/sh
+## Joe Presbrey <presbrey@mit.edu>
+## Quentin Smith <quentin@mit.edu>
+## Mitchell Berger <mitchb@mit.edu>
+## SIPB Scripts LVS Firewall marks
+
+iptables -F -t mangle
+
+# Create a table for regular scripts hosts
+iptables -t mangle -N scripts 2>/dev/null || :
+
+# scripts-vhosts.mit.edu
+iptables -A PREROUTING -t mangle -d 18.181.0.46 -j scripts
+# scripts.mit.edu
+iptables -A PREROUTING -t mangle -d 18.181.0.43 -j scripts
+# scripts-cert.mit.edu
+iptables -A PREROUTING -t mangle -d 18.181.0.50 -j scripts
+
+# Send Apache-bound traffic to FWM 2 (load-balanced)
+iptables -A scripts -t mangle -m tcp -m multiport -p tcp --dports 80,443,444 -j MARK --set-mark 2
+# Send SMTP-bound traffic to FWM 3 (load-balanced)
+iptables -A scripts -t mangle -m tcp -p tcp --dport 25 -j MARK --set-mark 3
+# Send finger-bound traffic to FWM 255 (the LVS director itself)
+iptables -A scripts -t mangle -m tcp -p tcp --dport 78:79 -j MARK --set-mark 255
+# Send everything else to FWM 1 (primary)
+iptables -A scripts -t mangle -m mark --mark 0 -j MARK --set-mark 1
+
+# webzephyr.mit.edu is special because its SMTP needs to always go to the primary (FWM 1)
+iptables -A PREROUTING -t mangle -m tcp -m multiport -p tcp -d 18.181.0.49 --dports 80,443,444 -j MARK --set-mark 2
+iptables -A PREROUTING -t mangle -m mark --mark 0 -d 18.181.0.49 -j MARK --set-mark 1
+
+# scripts-primary.mit.edu goes to the primary (FWM 1) on all ports
+iptables -A PREROUTING -t mangle -d 18.181.0.182 -j MARK --set-mark 1
Index: tags/fc15-eol/lvs/debian/config/etc/ntp.conf
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/ntp.conf	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/ntp.conf	(revision 2244)
@@ -0,0 +1,45 @@
+# /etc/ntp.conf, configuration for ntpd
+
+driftfile /var/lib/ntp/ntp.drift
+statsdir /var/log/ntpstats/
+
+statistics loopstats peerstats clockstats
+filegen loopstats file loopstats type day enable
+filegen peerstats file peerstats type day enable
+filegen clockstats file clockstats type day enable
+
+
+# You do need to talk to an NTP server or two (or three).
+server time.mit.edu
+
+# pool.ntp.org maps to more than 300 low-stratum NTP servers.
+# Your server will pick a different set every time it starts up.
+#  *** Please consider joining the pool! ***
+#  *** <http://www.pool.ntp.org/join.html> ***
+#server 0.debian.pool.ntp.org iburst
+#server 1.debian.pool.ntp.org iburst
+#server 2.debian.pool.ntp.org iburst
+#server 3.debian.pool.ntp.org iburst
+
+# By default, exchange time with everybody, but don't allow configuration.
+# See /usr/share/doc/ntp-doc/html/accopt.html for details.
+restrict -4 default kod notrap nomodify nopeer noquery
+restrict -6 default kod notrap nomodify nopeer noquery
+
+# Local users may interrogate the ntp server more closely.
+restrict 127.0.0.1
+restrict ::1
+
+# Clients from this (example!) subnet have unlimited access,
+# but only if cryptographically authenticated
+#restrict 192.168.123.0  mask  255.255.255.0 notrust
+
+# If you want to provide time to your local subnet, change the next line.
+# (Again, the address is an example only.)
+#broadcast 192.168.123.255
+
+# If you want to listen to time broadcasts on your local subnet,
+# de-comment the next lines. Please do this only if you trust everybody
+# on the network!
+#disable auth
+#broadcastclient
Index: tags/fc15-eol/lvs/debian/config/etc/sysctl.conf
===================================================================
--- tags/fc15-eol/lvs/debian/config/etc/sysctl.conf	(revision 2244)
+++ tags/fc15-eol/lvs/debian/config/etc/sysctl.conf	(revision 2244)
@@ -0,0 +1,69 @@
+#
+# /etc/sysctl.conf - Configuration file for setting system variables
+# See /etc/sysctl.d/ for additonal system variables
+# See sysctl.conf (5) for information.
+#
+
+#kernel.domainname = example.com
+
+# Uncomment the following to stop low-level messages on console
+#kernel.printk = 4 4 1 7
+
+##############################################################3
+# Functions previously found in netbase
+#
+
+# Uncomment the next two lines to enable Spoof protection (reverse-path filter)
+# Turn on Source Address Verification in all interfaces to
+# prevent some spoofing attacks
+#net.ipv4.conf.default.rp_filter=1
+#net.ipv4.conf.all.rp_filter=1
+
+# Uncomment the next line to enable TCP/IP SYN cookies
+# This disables TCP Window Scaling (http://lkml.org/lkml/2008/2/5/167),
+# and is not recommended.
+#net.ipv4.tcp_syncookies=1
+
+# Uncomment the next line to enable packet forwarding for IPv4
+net.ipv4.ip_forward=1
+
+# Uncomment the next line to enable packet forwarding for IPv6
+#net.ipv6.conf.all.forwarding=1
+
+
+###################################################################
+# Additional settings - these settings can improve the network
+# security of the host and prevent against some network attacks
+# including spoofing attacks and man in the middle attacks through
+# redirection. Some network environments, however, require that these
+# settings are disabled so review and enable them as needed.
+#
+# Ignore ICMP broadcasts
+#net.ipv4.icmp_echo_ignore_broadcasts = 1
+#
+# Ignore bogus ICMP errors
+#net.ipv4.icmp_ignore_bogus_error_responses = 1
+# 
+# Do not accept ICMP redirects (prevent MITM attacks)
+#net.ipv4.conf.all.accept_redirects = 0
+#net.ipv6.conf.all.accept_redirects = 0
+# _or_
+# Accept ICMP redirects only for gateways listed in our default
+# gateway list (enabled by default)
+# net.ipv4.conf.all.secure_redirects = 1
+#
+# Do not send ICMP redirects (we are not a router)
+#net.ipv4.conf.all.send_redirects = 0
+#
+# Do not accept IP source route packets (we are not a router)
+#net.ipv4.conf.all.accept_source_route = 0
+#net.ipv6.conf.all.accept_source_route = 0
+#
+# Log Martian Packets
+#net.ipv4.conf.all.log_martians = 1
+#
+# The contents of /proc/<pid>/maps and smaps files are only visible to 
+# readers that are allowed to ptrace() the process
+# kernel.maps_protect = 1
+
+net.ipv4.vs.expire_quiescent_template = 1
Index: tags/fc15-eol/lvs/doc/install-howto
===================================================================
--- tags/fc15-eol/lvs/doc/install-howto	(revision 2244)
+++ tags/fc15-eol/lvs/doc/install-howto	(revision 2244)
@@ -0,0 +1,31 @@
+- TO TEMPORARILY DISABLE HEARTBEAT: on an existing node, run
+  crm_attribute -n is_managed_default -v false
+- confirm that the change occurred with crm_attribute -n is_managed_default -G
+- Install Debian 4.0 from a minimal Debian install CD
+- aptitude install openssh-server krb5-user krb5-clients
+- dpkg-reconfigure krb5-config
+- Set GSSAPIAuthentication yes in /etc/ssh/sshd_config
+- Add keytab and .k5login
+- Edit lvs/debian/config/etc/ha.d/ha.cf in SVN to add "node foo", where foo is the new machine's hostname as reported by uname -n
+- Synchronize /etc out of SVN by running
+svn co https://scripts.mit.edu:1111/lvs/config/etc /etc
+and moving files/directories out of the way as it checks out.
+- aptitude update; aptitude install heartbeat ldirectord lighttpd-mod-magnet; # should install version >= 2.1.2
+- aptitude install munin-node
+- Copy /etc/ha.d/authkeys from an existing LVS node
+- svn up on each existing LVS node and then run /etc/init.d/heartbeat reload
+- If the node will run LVS, run "dpkg-reconfigure ipvsadm" and configure it to run "both" daemons on the correct network interface
+- Run /etc/init.d/heartbeat start on the new node
+- No services will be allocated to this node. To allocate scripts_LVS to it, run
+cibadmin -M -X '
+       <rsc_location id="rsc_location_scripts_LVS_all" rsc="scripts_LVS">
+         <rule id="prefered_rsc_location_scripts_LVS_all" score="-INFINITY" boolean_op="and">
+           <expression attribute="#uname" id="733286ca-cde9-4941-bab0-59af8bd6b55a" operation="ne" value="rack-forward"/>
+           <expression attribute="#uname" id="55373ba0-9e5e-43de-adf6-ac77bfe5bac6" operation="ne" value="not-backward"/>
+	   <expression attribute="#uname" id="UNIQUE_ID" operation="ne" value="new-node"/>
+         </rule>
+       </rsc_location>
+'
+- TO REENABLE HEARTBEAT, run crm_attribute -n is_managed_default -v true
+- Watch /var/log/messages and /var/log/syslog to make sure heartbeat is working
+- Add machine to noc/munin/munin.conf (syn:/etc/munin/munin.conf)
Index: tags/fc15-eol/server/README
===================================================================
--- tags/fc15-eol/server/README	(revision 2244)
+++ tags/fc15-eol/server/README	(revision 2244)
@@ -0,0 +1,11 @@
+common: 
+  distribution-independent code needed to run a scripts.mit.edu server
+
+fedora:
+  distribution-dependent code needed to run a fedora scripts.mit.edu server
+
+debian:
+  distribution-dependent code needed to run a debian scripts.mit.edu server
+
+doc:
+  documentation related to running a scripts.mit.edu server
Index: tags/fc15-eol/server/common/oursrc/accountadm/Makefile.in
===================================================================
--- tags/fc15-eol/server/common/oursrc/accountadm/Makefile.in	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/accountadm/Makefile.in	(revision 2244)
@@ -0,0 +1,32 @@
+CC = @CC@
+CPPFLAGS = @CPPFLAGS@
+CFLAGS = @CFLAGS@
+prefix = @prefix@
+exec_prefix = @exec_prefix@
+sbindir = @sbindir@
+bindir = @bindir@
+sysconfdir = @sysconfdir@
+
+all-local: admof
+
+admof: LDLIBS = -lafsauthent_pic -lafsrpc_pic -lresolv -lkrb5 -lpthread
+admof: admof.o
+
+install:
+	install -p -m644 -D mbashrc $(DESTDIR)$(sysconfdir)/mbashrc
+	install -p -m755 -D mbash $(DESTDIR)$(bindir)/mbash
+	install -p -m755 -D admof $(DESTDIR)$(bindir)/admof
+	install -p -m755 -D admof $(DESTDIR)$(sbindir)/ssh-admof
+	install -p -m755 -D signup-scripts-backend $(DESTDIR)$(sbindir)/signup-scripts-backend
+	install -p -m755 -D cronload $(DESTDIR)$(bindir)/cronload
+	install -p -m755 -D vhostadd $(DESTDIR)$(sbindir)/vhostadd
+	install -p -m755 -D vhostedit $(DESTDIR)$(sbindir)/vhostedit
+	install -p -m755 -D ldap-backup $(DESTDIR)$(sbindir)/ldap-backup
+
+clean:
+	rm -f admof admof.o
+
+distclean: clean
+	rm -f mbash signup-scripts-backend
+	rm -f configure config.* Makefile
+	rm -rf auto*.cache
Index: tags/fc15-eol/server/common/oursrc/accountadm/admof.c
===================================================================
--- tags/fc15-eol/server/common/oursrc/accountadm/admof.c	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/accountadm/admof.c	(revision 2244)
@@ -0,0 +1,291 @@
+/* admof
+ * Version 2.0, released 2007-12-30
+ * Anders Kaseorg <andersk@mit.edu>
+ * replacing Perl version by Jeff Arnold <jbarnold@mit.edu>
+ *
+ * Usage:
+ *   admof scripts andersk/root@ATHENA.MIT.EDU
+ * Outputs "yes" and exits with status 33 if the given principal is an
+ * administrator of the locker.
+ *
+ * Requires tokens (to authenticate/encrypt the connection to the
+ * ptserver) unless -noauth is given.
+ */
+
+#include <stdio.h>
+#include <limits.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <pwd.h>
+#include <unistd.h>
+#include <netinet/in.h>
+#include <afs/stds.h>
+#include <afs/vice.h>
+#include <afs/venus.h>
+#include <afs/ptclient.h>
+#include <afs/ptuser.h>
+#include <afs/prs_fs.h>
+#include <afs/ptint.h>
+#include <afs/cellconfig.h>
+#include <afs/afsutil.h>
+#include <krb5.h>
+#include <stdbool.h>
+#include <syslog.h>
+
+#define ANAME_SZ 40
+#define REALM_SZ 40
+#define INST_SZ 40
+#define MAX_K_NAME_SZ (ANAME_SZ + INST_SZ + REALM_SZ + 2)
+
+extern int pioctl(char *, afs_int32, struct ViceIoctl *, afs_int32);
+
+#define die(args...) do { fprintf(stderr, args); pr_End(); exit(1); } while(0)
+#define _STR(x) #x
+#define STR(x) _STR(x)
+
+#define SYSADMINS "system:scripts-root"
+#define SYSADMIN_CELL "athena.mit.edu"
+
+static bool
+ismember(char *user, char *group)
+{
+    int flag;
+    if (pr_IsAMemberOf(user, group, &flag) == 0)
+	return flag;
+    else
+	return 0;
+}
+
+/* Parse an ACL of n entries, returning the rights for user. */
+static int
+parse_rights(int n, const char **p, char *user)
+{
+    int rights = 0, *trights = malloc(n * sizeof(int)), i;
+    namelist tnames = {.namelist_len = n,
+		       .namelist_val = malloc(n * PR_MAXNAMELEN)};
+    idlist tids = {.idlist_len = 0,
+		   .idlist_val = NULL};
+
+    if (trights == NULL || tnames.namelist_val == NULL)
+	die("internal error: malloc failed: %m");
+
+    for (i = 0; i < n; ++i) {
+	int off;
+	if (sscanf(*p, "%" STR(PR_MAXNAMELEN) "s %d\n%n",
+		   tnames.namelist_val[i], &trights[i], &off) < 2)
+	    die("internal error: can't parse output from pioctl\n");
+	*p += off;
+    }
+
+    if (pr_NameToId(&tnames, &tids) != 0)
+	die("internal error: pr_NameToId failed");
+    if (tids.idlist_len < n)
+	die("internal error: pr_NameToId did not return enough ids");
+
+    for (i = 0; i < n; ++i) {
+	if (~rights & trights[i] &&
+	    (strcasecmp(tnames.namelist_val[i], user) == 0 ||
+	     (tids.idlist_val[i] < 0 && ismember(user, tnames.namelist_val[i]))))
+	    rights |= trights[i];
+    }
+
+    xdr_free((xdrproc_t) xdr_idlist, &tids);
+    tids.idlist_val = NULL;
+    free(tnames.namelist_val);
+    free(trights);
+
+    return rights;
+}
+
+/* Resolve a Kerberos principal to a name usable by the AFS PTS. */
+void
+resolve_principal(const char *name, const char *cell, char *user)
+{
+    /* Figure out the cell's realm. */
+    krb5_context context;
+    krb5_init_context(&context);
+
+    char **realm_list;
+    if (krb5_get_host_realm(context, cell, &realm_list) != 0 ||
+	realm_list[0] == NULL)
+	die("internal error: krb5_get_host_realm failed");
+
+    /* Convert the Kerberos 5 principal into a (Kerberos IV-style) AFS
+       name, omitting the realm if it equals the cell's realm. */
+    krb5_principal principal;
+    if (krb5_parse_name(context, name, &principal) != 0)
+	die("internal error: krb5_parse_name failed");
+    char pname[ANAME_SZ], pinst[INST_SZ], prealm[REALM_SZ];
+    if (krb5_524_conv_principal(context, principal, pname, pinst, prealm) != 0)
+	die("internal error: krb5_524_conv_principal failed\n");
+
+    krb5_data realm = *krb5_princ_realm(context, principal);
+    if (realm.length > REALM_SZ - 1)
+	realm.length = REALM_SZ - 1;
+    if (strlen(realm_list[0]) == realm.length &&
+	memcmp(realm.data, realm_list[0], realm.length) == 0)
+	snprintf(user, MAX_K_NAME_SZ, "%s%s%s",
+		 pname, pinst[0] ? "." : "", pinst);
+    else
+	snprintf(user, MAX_K_NAME_SZ, "%s%s%s@%.*s",
+		 pname, pinst[0] ? "." : "", pinst, realm.length, realm.data);
+
+    krb5_free_principal(context, principal);
+    krb5_free_host_realm(context, realm_list);
+    krb5_free_context(context);
+
+    /* Instead of canonicalizing the name as below, we just use
+       strcasecmp above. */
+#if 0
+    afs_int32 id;
+    if (pr_SNameToId((char *)user, &id) != 0)
+	die("bad principal\n");
+    if (id == ANONYMOUSID)
+	die("anonymous\n");
+    if (pr_SIdToName(id, user) != 0)
+	die("internal error: pr_SIdToName failed\n");
+#endif
+}
+
+int
+main(int argc, const char *argv[])
+{
+    /* Get arguments. */
+    const char *locker, *name;
+    afs_int32 secLevel;
+
+    if (argc == 3) {
+	locker = argv[1];
+	name = argv[2];
+	secLevel = 3;
+    } else if (argc == 4 && strcmp("-noauth", argv[1]) == 0) {
+	locker = argv[2];
+	name = argv[3];
+	secLevel = 0;
+    } else {
+	die("Usage: %s [-noauth] LOCKER PRINCIPAL\n", argv[0]);
+    }
+
+    /* Convert the locker into a directory. */
+    char dir[PATH_MAX];
+    int n;
+    struct passwd *pwd = getpwnam(locker);
+    if (pwd != NULL)
+	n = snprintf(dir, sizeof dir, "%s", pwd->pw_dir);
+    else
+	n = snprintf(dir, sizeof dir, "/mit/%s", locker);
+    if (n < 0 || n >= sizeof dir)
+	die("internal error\n");
+
+    /* For non-AFS homedirs, read the .k5login file. */
+    if (strncmp(dir, "/afs/", 5) != 0 && strncmp(dir, "/mit/", 5) != 0) {
+	if (chdir(dir) != 0)
+	    die("internal error: chdir: %m\n");
+	FILE *fp = fopen(".k5login", "r");
+	if (fp == NULL)
+	    die("internal error: .k5login: %m\n");
+	struct stat st;
+	if (fstat(fileno(fp), &st) != 0)
+	    die("internal error: fstat: %m\n");
+	if (st.st_uid != pwd->pw_uid && st.st_uid != 0) {
+	    fclose(fp);
+	    die("internal error: bad .k5login permissions\n");
+	}
+	bool found = false;
+	char *line = NULL;
+	size_t len = 0;
+	ssize_t read;
+	while ((read = getline(&line, &len, fp)) != -1) {
+	    if (read > 0 && line[read - 1] == '\n')
+		line[read - 1] = '\0';
+	    if (strcmp(name, line) == 0) {
+		found = true;
+		break;
+	    }
+	}
+	if (line)
+	    free(line);
+	fclose(fp);
+	if (found) {
+	    printf("yes\n");
+	    exit(33);
+	} else {
+	    printf("no\n");
+	    exit(1);
+	}
+    }
+
+    /* Get the locker's cell. */
+    char cell[MAXCELLCHARS];
+    struct ViceIoctl vi;
+    vi.in = NULL;
+    vi.in_size = 0;
+    vi.out = cell;
+    vi.out_size = sizeof cell;
+    if (pioctl(dir, VIOC_FILE_CELL_NAME, &vi, 1) != 0)
+	die("internal error: pioctl: %m\n");
+
+    if (pr_Initialize(secLevel, (char *)AFSDIR_CLIENT_ETC_DIRPATH, cell) != 0)
+	die("internal error: pr_Initialize failed\n");
+
+    /* Get the cell configuration. */
+    struct afsconf_dir *configdir = afsconf_Open(AFSDIR_CLIENT_ETC_DIRPATH);
+    if (configdir == NULL)
+	die("internal error: afsconf_Open failed\n");
+    struct afsconf_cell cellconfig;
+    if (afsconf_GetCellInfo(configdir, cell, NULL, &cellconfig) != 0)
+	die("internal error: afsconf_GetCellInfo failed\n");
+    afsconf_Close(configdir);
+
+    char user[MAX(PR_MAXNAMELEN, MAX_K_NAME_SZ)];
+    resolve_principal(name, cellconfig.hostName[0], user);
+
+    /* Read the locker ACL. */
+    char acl[2048];
+    vi.in = NULL;
+    vi.in_size = 0;
+    vi.out = acl;
+    vi.out_size = sizeof acl;
+    if (pioctl(dir, VIOCGETAL, &vi, 1) != 0)
+	die("internal error: pioctl: %m\n");
+
+    /* Parse the locker ACL to compute the user's rights. */
+    const char *p = acl;
+
+    int nplus, nminus;
+    int off;
+    if (sscanf(p, "%d\n%d\n%n", &nplus, &nminus, &off) < 2)
+	die("internal error: can't parse output from pioctl\n");
+    p += off;
+
+    int rights = parse_rights(nplus, &p, user);
+    rights &= ~parse_rights(nminus, &p, user);
+    pr_End();
+
+#ifdef SYSADMINS
+    if (~rights & PRSFS_ADMINISTER) {
+	char sysadmins[] = SYSADMINS, sysadmin_cell[] = SYSADMIN_CELL;
+	if (pr_Initialize(secLevel, (char *)AFSDIR_CLIENT_ETC_DIRPATH, sysadmin_cell) == 0) {
+	    resolve_principal(name, sysadmin_cell, user);
+	    if (ismember(user, sysadmins)) {
+		openlog("admof", 0, LOG_AUTHPRIV);
+		syslog(LOG_NOTICE, "giving %s admin rights on %s", user, locker);
+		closelog();
+		rights |= PRSFS_ADMINISTER;
+	    }
+	    pr_End();
+	}
+	/* If not, that's okay -- the normal codepath ran fine, so don't error */
+    }
+#endif
+
+    /* Output whether the user is an administrator. */
+    if (rights & PRSFS_ADMINISTER) {
+	printf("yes\n");
+	exit(33);
+    } else {
+	printf("no\n");
+	exit(1);
+    }
+}
Index: tags/fc15-eol/server/common/oursrc/accountadm/configure.in
===================================================================
--- tags/fc15-eol/server/common/oursrc/accountadm/configure.in	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/accountadm/configure.in	(revision 2244)
@@ -0,0 +1,29 @@
+AC_INIT(signup-scripts-backend.in)
+
+AC_PROG_CC
+
+AC_DEFUN(REQUIRE_PATH,[
+AC_SUBST($1_path)
+if test "[$]$1_path" = ""; then
+        AC_ERROR(Cannot find $1)
+fi
+])
+
+AC_DEFUN(LOCATE,[
+AC_PATH_PROG($1_path, $1)
+REQUIRE_PATH($1)
+])
+
+dnl Needed by signup-scripts-backend.in
+
+LOCATE(hesinfo)
+LOCATE(ldapadd)
+LOCATE(sudo)
+
+dnl Needed by mbash.in
+
+LOCATE(bash)
+
+AC_OUTPUT(Makefile)
+AC_OUTPUT(signup-scripts-backend)
+AC_OUTPUT(mbash)
Index: tags/fc15-eol/server/common/oursrc/accountadm/cronload
===================================================================
--- tags/fc15-eol/server/common/oursrc/accountadm/cronload	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/accountadm/cronload	(revision 2244)
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+if [ -n "$2" ]; then
+  cd "$2"
+fi
+
+/bin/cat "$1" | /usr/bin/crontab -
+
+echo "New crontab for $USER:"
+echo ""
+/usr/bin/crontab -l
Index: tags/fc15-eol/server/common/oursrc/accountadm/ldap-backup
===================================================================
--- tags/fc15-eol/server/common/oursrc/accountadm/ldap-backup	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/accountadm/ldap-backup	(revision 2244)
@@ -0,0 +1,172 @@
+#!/usr/bin/perl
+#
+# BEGIN COPYRIGHT BLOCK
+# This Program is free software; you can redistribute it and/or modify it under
+# the terms of the GNU General Public License as published by the Free Software
+# Foundation; version 2 of the License.
+# 
+# This Program is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License along with
+# this Program; if not, write to the Free Software Foundation, Inc., 59 Temple
+# Place, Suite 330, Boston, MA 02111-1307 USA.
+# 
+# Copyright (C) 2001 Sun Microsystems, Inc. Used by permission.
+# Copyright (C) 2005 Red Hat, Inc.
+# All rights reserved.
+# END COPYRIGHT BLOCK
+#
+
+@instances = qw(userRoot);
+@included = qw();
+@excluded = qw();
+
+our $nowrap = 1; # output LDIF is not folded
+our $nobase64 = 0; # avoid base64 encoding
+our $noversion = 0; # don't print version line
+our $nouniqueid = 0; # don't export unique id
+our $useid2entry = 0; # use main db file only
+our $onefile = 1; # one file (MUST BE 1)
+our $printkey = 1; # print key
+our $ldiffile; # override LDIF output file location
+
+$doreplica = 0;
+$ldifdir = "/var/lib/dirsrv/slapd-scripts/ldif";
+$servid = "scripts";
+$verbose = 0;
+$rootdn = "cn=Directory Manager";
+our $passwd;
+our $passwdfile = "/etc/signup-ldap-pw";
+$i = 0;
+$insti = 0;
+$incli = 0;
+$excli = 0;
+$decrypt_on_export = 0;
+
+foreach (@ARGV) {
+    $verbose++ if ($_ eq "-v");
+}
+
+if ((!@instances && !@included) || !$rootdn || !($passwd || $passwdfile)) { &usage; exit(1); }
+
+($s, $m, $h, $dy, $mn, $yr, $wdy, $ydy, $r) = localtime(time);
+$mn++; $yr += 1900;
+$taskname = "export_${yr}_${mn}_${dy}_${h}_${m}_${s}";
+$dn = "dn: cn=$taskname, cn=export, cn=tasks, cn=config\n";
+$misc = "changetype: add\nobjectclass: top\nobjectclass: extensibleObject\n";
+$cn =  "cn: $taskname\n";
+$i = 0;
+$be = "";
+$nsinstance = "";
+foreach my $instance (@instances) {
+	$nsinstance .= "nsInstance: $instance\n";
+	if ( !$be ) {
+		$be = "$instance";
+	} else {
+		$be = "${be}-$instance";
+	}
+	$i++;
+}
+$i = 0;
+$nsincluded = "";
+foreach my $include (@included) {
+	$nsincluded .= "nsIncludeSuffix: $include\n";
+	my ($rdn, $rest) = split(/,/, $include);
+	my ($rest, $tmpbe) = split(/=/, $rdn);
+	if ( !$be ) {
+		$be = "$tmpbe";
+	} else {
+		$be = "${be}-$tmpbe";
+	}
+	$i++;
+}
+$i = 0;
+$nsexcluded = "";
+foreach my $exclude (@excluded) {
+	$nsexcluded .= "nsExcludeSuffix: $exclude\n";
+	$i++;
+}
+if ($ldiffile eq "") {
+	if ($onefile == 0) {
+		$ldiffile = "${ldifdir}/${servid}-${yr}_${mn}_${dy}_${h}_${m}_${s}.ldif";
+	} else {
+		$ldiffile = "${ldifdir}/${servid}-${be}-${yr}_${mn}_${dy}_${h}_${m}_${s}.ldif";
+	}
+}
+
+$nsreplica = "";
+if ($doreplica != 0) { $nsreplica = "nsExportReplica: true\n"; }
+$nsnobase64 = "";
+if ($nobase64 != 0) { $nsnobase64 = "nsMinimalEncoding: true\n"; }
+$nsnowrap = "";
+if ($nowrap != 0) { $nsnowrap = "nsNoWrap: true\n"; }
+$nsnoversion = "";
+if ($noversion != 0) { $nsnoversion = "nsNoVersionLine: true\n"; }
+$nsnouniqueid = "";
+if ($nouniqueid != 0) { $nsnouniqueid = "nsDumpUniqId: false\n"; }
+$nsuseid2entry = "";
+if ($useid2entry != 0) { $nsuseid2entry = "nsUseId2Entry: true\n"; }
+$nsonefile = "";
+if ($onefile != 0) { $nsonefile = "nsUseOneFile: true\n"; }
+if ($onefile == 0) { $nsonefile = "nsUseOneFile: false\n"; }
+$nsexportdecrypt = "";
+if ($decrypt_on_export != 0) { $nsexportdecrypt = "nsExportDecrypt: true\n"; }
+$nsprintkey = "";
+if ($printkey == 0) { $nsprintkey = "nsPrintKey: false\n"; }
+$nsldiffile = "nsFilename: ${ldiffile}\n";
+$entry = "${dn}${misc}${cn}${nsinstance}${nsincluded}${nsexcluded}${nsreplica}${nsnobase64}${nsnowrap}${nsnoversion}${nsnouniqueid}${nsuseid2entry}${nsonefile}${nsexportdecrypt}${nsprintkey}${nsldiffile}";
+my @vstr = ();
+if ($verbose != 0) { @vstr = ("-v"); }
+my @qstr = ("-q");
+if ($verbose) { @qstr = (); }
+$ENV{'PATH'} = "/usr/lib64/mozldap:/usr/bin:";
+print STDERR ("Exporting to ldif file: ${ldiffile}\n") if ($verbose);
+
+my @pass;
+if ($passwdfile) {
+    @pass = ("-j", $passwdfile);
+} elsif ($passwd) {
+    @pass = ("-w", $passwd);
+}
+
+my @cmd = ("ldapmodify", @vstr, @qstr, qw(-h localhost -p 389), "-D", $rootdn, @pass, "-a");
+
+print STDERR "@cmd\n" if ($verbose);
+print STDERR "$entry\n" if ($verbose);
+
+open(FOO, "|-", @cmd) or die "Couldn't start ldapmodify: $!";
+print(FOO "$entry");
+close(FOO);
+
+die "Couldn't successfully execute ldapmodify: $!" if $?;
+
+my @statuscmd = ("ldapsearch", @vstr, qw(-h localhost -p 389), "-D", $rootdn, @pass, qw(-T -b cn=export,cn=tasks,cn=config), "cn=$taskname", qw(nstaskstatus nstaskexitcode));
+
+print STDERR "Status command: @statuscmd\n" if ($verbose);
+
+my $exitstatus=255;
+
+STATUS: while (1) {
+    sleep(1);
+    open(FOO, "-|", @statuscmd) or die "Couldn't start ldapsearch: $!";
+    while (<FOO>) {
+	chomp;
+	my ($key, $value) = split(": ", $_, 2);
+	if ($key eq "nstaskstatus" && $verbose) {
+	    print STDERR "Status: $value\n";
+	}
+	if ($key eq "nstaskexitcode") {
+	    $exitstatus = $value;
+	    last STATUS;
+	}
+    }
+    close(FOO);
+}
+
+open(OUTPUT, "<", $ldiffile) or die "Couldn't open output file: $!";
+print while (<OUTPUT>);
+close(OUTPUT);
+
+exit $exitstatus;
Index: tags/fc15-eol/server/common/oursrc/accountadm/mbash.in
===================================================================
--- tags/fc15-eol/server/common/oursrc/accountadm/mbash.in	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/accountadm/mbash.in	(revision 2244)
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+@bash_path@ --rcfile /usr/local/etc/mbashrc "$@"
Index: tags/fc15-eol/server/common/oursrc/accountadm/mbashrc
===================================================================
--- tags/fc15-eol/server/common/oursrc/accountadm/mbashrc	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/accountadm/mbashrc	(revision 2244)
@@ -0,0 +1,87 @@
+# System-wide .bashrc file for interactive bash(1) shells.
+
+. /etc/bashrc
+
+shopt -s checkwinsize
+
+# enable bash completion in interactive shells
+
+#if [ "$PS1" -a -f /etc/bash_completion ]; then
+#    . /etc/bash_completion
+#fi
+# ~/.bashrc: executed by bash(1) for non-login shells.
+
+export PS1='[\u@\h]:\w\$ '
+umask 022
+
+__scripts_print_root_message ()
+{
+    echo "ERROR: scripts.mit.edu is a shared server, and as such" >&2
+    echo "you do not have root access." >&2
+    echo " * If you want a package installed or a setting configured," >&2
+    echo "   contact us at scripts@mit.edu." >&2
+    echo " * If you're having trouble editing a file without 'sudo'," >&2
+    echo "   try logging out and making your change from Athena." >&2
+}
+
+__scripts_print_install_message ()
+{
+    echo "ERROR: scripts.mit.edu is a shared server, and as such" >&2
+    echo "you do not have root access. We are happy to install most" >&2
+    echo "packages upon request -- please contact us at scripts@mit.edu." >&2
+}
+
+__scripts_print_edit_message ()
+{
+    echo "ERROR: scripts.mit.edu is a shared server, and as such you" >&2
+    echo "do not have root access. You can make most changes to your" >&2
+    echo "account without root access; you may need to log out of scripts," >&2
+    echo "and use your Athena account to get full permissions in your locker." >&2
+    echo "If you're having trouble, contact us at scripts@mit.edu for help." >&2
+}
+
+
+su ()
+{
+    while [[ "$1" == -* ]]; do shift; done
+    if [ $# -eq 0 ] || [ "$1" = "root" ]; then
+        __scripts_print_root_message
+    else
+        echo "su is no longer supported on scripts.mit.edu. To access your" >&2
+        echo "group locker, run ssh $1@scripts.mit.edu from Athena." >&2
+    fi
+    return 1
+}
+
+sudo ()
+{
+    case "$1" in
+        apt-get|aptitude|yum|easy_install|gem|make|./setup.py)
+            __scripts_print_install_message ;;
+        emacs|vi|vim|nano|chown|rm|fs)
+            __scripts_print_edit_message ;;
+        *)
+            __scripts_print_root_message
+    esac
+    return 1
+}
+
+# You may uncomment the following lines if you want `ls' to be colorized:
+# export LS_OPTIONS='--color=auto'
+# eval `dircolors`
+# alias ls='ls $LS_OPTIONS'
+# alias ll='ls $LS_OPTIONS -l'
+# alias l='ls $LS_OPTIONS -lA'
+#
+# Some more alias to avoid making mistakes:
+# alias rm='rm -i'
+# alias cp='cp -i'
+# alias mv='mv -i'
+
+if [ -f ~/.bashrc.scripts ]; then
+	. ~/.bashrc.scripts
+fi
+
+if [ -d ~/web_scripts ]; then
+	cd ~/web_scripts
+fi
Index: tags/fc15-eol/server/common/oursrc/accountadm/mrproper
===================================================================
--- tags/fc15-eol/server/common/oursrc/accountadm/mrproper	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/accountadm/mrproper	(revision 2244)
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+rm -f admof signup-scripts-backend mbash
+rm -f configure config.* Makefile
+rm -rf auto*.cache
Index: tags/fc15-eol/server/common/oursrc/accountadm/signup-scripts-backend.in
===================================================================
--- tags/fc15-eol/server/common/oursrc/accountadm/signup-scripts-backend.in	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/accountadm/signup-scripts-backend.in	(revision 2244)
@@ -0,0 +1,158 @@
+#!/usr/bin/perl
+use strict;
+
+# signup-scripts-backend
+# Copyright (C) 2006  Jeff Arnold <jbarnold@mit.edu>
+# 
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+# 
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA
+# 
+# See /COPYRIGHT in this repository for more information.
+
+$ENV{PATH} = '';
+
+my $username = $ARGV[0];
+
+# Complain unless submitted username contains only valid characters
+complain("bad username") unless($username =~ /^[\w._-]+$/);
+
+open BANNEDUSERS, "</afs/athena.mit.edu/contrib/scripts/admin/users.banned" or
+    complain("internal error");
+while (<BANNEDUSERS>) {
+    chomp;
+    complain("banned username") if (lc eq lc $username);
+}
+close(BANNEDUSERS);
+
+my %filsys;
+open HESINFO, '-|', '@hesinfo_path@', '--', $username, 'filsys' or
+    complain("internal error");
+while (<HESINFO>) {
+	chomp;
+	my %f; @f{qw(type path rw mount order)} = split / /;
+	%filsys = %f if (($f{order} || 9999) <= ($filsys{order} || 9999));
+}
+close HESINFO;
+unless (%filsys &&
+	$filsys{type} eq 'AFS' &&
+	$filsys{path} =~ /^\/afs\/[\w\._\/-]+/ &&
+	$filsys{mount} eq "/mit/$username") {
+	complain("athena user not found");
+}
+my $homedir = $filsys{path};
+
+# Tell AFS that we don't want to trigger fakestat, and confirm user's homedir
+chdir $homedir or complain("athena homedir not found");
+opendir TEMP, '.';
+closedir TEMP;
+
+# Obtain user's homedir uid
+my (undef, undef, undef, undef, $uid1, $gid1, undef, undef, undef, undef, undef, undef, undef) = stat '.' or complain("athena homedir could not be examined");
+
+# Complain if user's uid is too low or too high
+complain("bad uid") unless($uid1 > 110 and $uid1 < (1 << 31));
+
+# Complain if user's .scripts-signup file does not exist
+#complain("scripts-signup file not found") unless(-e '.scripts-signup');
+
+# Complain if the user's username is already taken
+complain("username already taken") if(getpwnam $username);
+
+# Complain if user's uid is already taken
+complain("uid already taken") if(getpwuid $uid1);
+
+if($homedir !~ /\/afs\/athena\.mit\.edu\/user\//) {
+	$gid1 = $uid1;
+}
+
+# Complain if user's gid is already taken
+complain("gid already taken") if(getgrgid $gid1);
+
+my $disabledmsg = "scripts.mit.edu signups are currently disabled";
+if(-e "/afs/athena.mit.edu/contrib/scripts/admin/nosignup") {
+	open NOSIGNUP, "</afs/athena.mit.edu/contrib/scripts/admin/nosignup" or
+		complain("internal error");
+	while (<NOSIGNUP>) {
+		chomp;
+		$disabledmsg .= "\n$_";
+	}
+	close NOSIGNUP;
+	complain($disabledmsg);
+}
+elsif(-e "/etc/nosignup") {
+	$disabledmsg .= " on this server";
+	open NOSIGNUP, "</etc/nosignup" or complain("internal error");
+	while (<NOSIGNUP>) {
+		chomp;
+		$disabledmsg .= "\n$_";
+	}
+	close NOSIGNUP;
+	complain($disabledmsg);
+}
+
+my $pid;
+defined ($pid = open LDAP, '|-') or complain("internal error");
+if (!$pid) {
+	close STDOUT;
+	open STDOUT, '>/dev/null';
+	exec '@ldapadd_path@', '-c', '-x', '-D', 'cn=Directory Manager', '-y', '/etc/signup-ldap-pw';
+	exit 1;
+}
+print LDAP <<EOF;
+dn: uid=$username,ou=People,dc=scripts,dc=mit,dc=edu
+objectClass: posixAccount
+cn: $username
+uid: $username
+uidNumber: $uid1
+gidNumber: $gid1
+homeDirectory: $homedir
+loginShell: /usr/local/bin/mbash
+
+dn: cn=$username,ou=Groups,dc=scripts,dc=mit,dc=edu
+objectClass: posixGroup
+cn: $username
+gidNumber: $gid1
+
+dn: apacheServerName=$username.scripts.mit.edu,ou=VirtualHosts,dc=scripts,dc=mit,dc=edu
+objectClass: apacheConfig
+apacheServerName: $username.scripts.mit.edu
+apacheServerAlias: $username.scripts
+apacheDocumentRoot: $homedir/web_scripts
+apacheSuexecUid: $uid1
+apacheSuexecGid: $gid1
+
+dn: scriptsVhostName=$username.scripts.mit.edu,ou=VirtualHosts,dc=scripts,dc=mit,dc=edu
+objectClass: scriptsVhost
+scriptsVhostName: $username.scripts.mit.edu
+scriptsVhostAlias: $username.scripts
+scriptsVhostAccount: uid=$username,ou=People,dc=scripts,dc=mit,dc=edu
+scriptsVhostDirectory: 
+
+EOF
+close LDAP or complain("internal error");
+# Add disk quota for user
+#system('@sudo_path@', '-u', 'root', '/usr/sbin/setquota', $username, '0', '25000', '0', '10000', '-a');
+
+printexit("done", 0);
+
+sub complain {
+  my ($complaint) = @_;
+  printexit($complaint, 1);
+}
+
+sub printexit {
+  my ($msg, $status) = @_;
+  print $msg;
+  exit($status);
+}
Index: tags/fc15-eol/server/common/oursrc/accountadm/vhostadd
===================================================================
--- tags/fc15-eol/server/common/oursrc/accountadm/vhostadd	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/accountadm/vhostadd	(revision 2244)
@@ -0,0 +1,74 @@
+#!/bin/bash
+set -e
+
+printf "Host name: " >&2
+if [ "$1" ]; then
+    host="$1"; shift
+    echo "$host"
+else
+    read host
+fi
+
+if ! grep -Fq "." <<< "$host"; then host=$host.mit.edu; fi
+
+printf "User: " >&2
+if [ "$1" ]; then
+    user="$1"; shift
+    echo "$user"
+else
+    read user
+fi
+
+while read attr value; do
+    echo "$attr" "$value"
+    case "$attr" in
+	dn:) user_dn=$value;;
+	uid:) user=$value;;
+	uidNumber:) uid=$value;;
+	gidNumber:) gid=$value;;
+	homeDirectory:) home=$value;;
+    esac
+done < <(ldapsearch -LLL -x -b ou=People,dc=scripts,dc=mit,dc=edu "(uid=$user)" dn uid uidNumber gidNumber homeDirectory | perl -0pe 's/\n //g;')
+
+printf "Docroot: $home/web_scripts" >&2
+read subdir
+
+tmpfile=$(mktemp -t vhostadd.XXXXXX) || exit $?
+trap 'rm -f "$tmpfile"' EXIT
+
+cat <<EOF > "$tmpfile"
+dn: apacheServerName=$host,ou=VirtualHosts,dc=scripts,dc=mit,dc=edu
+objectClass: apacheConfig
+objectClass: top
+apacheServerName: $host
+EOF
+
+if [ "${host%mit.edu}" != "$host" ]; then
+    cat <<EOF >> "$tmpfile"
+apacheServerAlias: ${host%.mit.edu}
+EOF
+fi
+
+cat <<EOF >> "$tmpfile"
+apacheDocumentRoot: $home/web_scripts$subdir
+apacheSuexecUid: $uid
+apacheSuexecGid: $gid
+
+dn: scriptsVhostName=$host,ou=VirtualHosts,dc=scripts,dc=mit,dc=edu
+objectClass: scriptsVhost
+objectClass: top
+scriptsVhostName: $host
+EOF
+
+if [ "${host%mit.edu}" != "$host" ]; then
+    cat <<EOF >> "$tmpfile"
+scriptsVhostAlias: ${host%.mit.edu}
+EOF
+fi
+
+cat <<EOF >> "$tmpfile"
+scriptsVhostAccount: $user_dn
+scriptsVhostDirectory: ${subdir#/}
+EOF
+
+exec ldapvi --add --in "$tmpfile"
Index: tags/fc15-eol/server/common/oursrc/accountadm/vhostedit
===================================================================
--- tags/fc15-eol/server/common/oursrc/accountadm/vhostedit	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/accountadm/vhostedit	(revision 2244)
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+if [ ! "$1" ]; then
+    echo "Usage: $0 <vhost>"
+    exit 2
+fi
+
+exec ldapvi -b dc=scripts,dc=mit,dc=edu "(|(&(objectClass=apacheConfig)(|(apacheServerName=$1)(apacheServerAlias=$1)))(&(objectClass=scriptsVhost)(|(scriptsVhostName=$1)(scriptsVhostAlias=$1))))"
Index: tags/fc15-eol/server/common/oursrc/athrun/Makefile.in
===================================================================
--- tags/fc15-eol/server/common/oursrc/athrun/Makefile.in	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/athrun/Makefile.in	(revision 2244)
@@ -0,0 +1,14 @@
+prefix = @prefix@
+exec_prefix = @exec_prefix@
+bindir = @bindir@
+
+all-local:
+
+install:
+	install -p -m755 -D athrun.sh $(DESTDIR)$(bindir)/athrun
+
+clean:
+
+distclean: clean
+	rm -f configure config.* Makefile
+	rm -rf auto*.cache
Index: tags/fc15-eol/server/common/oursrc/athrun/athrun.sh
===================================================================
--- tags/fc15-eol/server/common/oursrc/athrun/athrun.sh	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/athrun/athrun.sh	(revision 2244)
@@ -0,0 +1,23 @@
+#!/bin/sh
+
+# An analog of the Athena athrun utility for scripts.mit.edu.
+# The Athena athrun was written by Greg Hudson.
+# This version was kludged by Mitchell Berger.
+# "athrun moira" runs moira from the moira locker.
+# "athrun gnu gls -l" runs gls -l from the gnu locker.
+
+case $# in
+0)
+  echo "Usage: athrun locker [program] [args ...]" >&2
+  exit 1
+  ;;
+1)
+  exec "/mit/$1/arch/@sys/bin/$1"
+  ;;
+*)
+  locker=$1
+  program=$2
+  shift 2;
+  exec "/mit/$locker/arch/@sys/bin/$program" "$@"
+  ;;
+esac
Index: tags/fc15-eol/server/common/oursrc/athrun/configure.in
===================================================================
--- tags/fc15-eol/server/common/oursrc/athrun/configure.in	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/athrun/configure.in	(revision 2244)
@@ -0,0 +1,5 @@
+AC_INIT()
+
+AC_PROG_CC
+
+AC_OUTPUT(Makefile)
Index: tags/fc15-eol/server/common/oursrc/athrun/mrproper
===================================================================
--- tags/fc15-eol/server/common/oursrc/athrun/mrproper	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/athrun/mrproper	(revision 2244)
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+rm -f configure config.* Makefile
+rm -rf auto*.cache
Index: tags/fc15-eol/server/common/oursrc/discuss/discuss.xinetd
===================================================================
--- tags/fc15-eol/server/common/oursrc/discuss/discuss.xinetd	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/discuss/discuss.xinetd	(revision 2244)
@@ -0,0 +1,11 @@
+service discuss
+{
+	disable			= yes
+	port			= 2199
+	socket_type		= stream
+	protocol		= tcp
+	wait			= no
+	user			= discuss
+	passenv			= PATH
+	server			= /usr/sbin/discussd
+}
Index: tags/fc15-eol/server/common/oursrc/execsys/Makefile.in
===================================================================
--- tags/fc15-eol/server/common/oursrc/execsys/Makefile.in	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/execsys/Makefile.in	(revision 2244)
@@ -0,0 +1,36 @@
+CC = @CC@
+CFLAGS = @CFLAGS@
+prefix = @prefix@
+exec_prefix = @exec_prefix@
+libexecdir = @libexecdir@
+sysconfdir = @sysconfdir@
+sbindir = @sbindir@
+APACHEDIR = /etc/httpd
+SYSCATPATH = /usr/local/bin
+trusteddir = /usr/libexec/scripts-trusted
+
+all-local: static-cat
+
+static-cat.c: static-cat.c.pre
+	syscat_path=$(SYSCATPATH)/static-cat perl upd-execsys
+
+install: all-local
+	install -D -p -m644 execsys.conf $(DESTDIR)$(APACHEDIR)/conf.d/execsys.conf
+	install -D -p -m755 execsys-binfmt $(DESTDIR)/etc/init.d/execsys-binfmt
+	install -D -p -m755 static-cat $(DESTDIR)$(SYSCATPATH)/static-cat
+	install -D -p -m755 ldapize.pl $(DESTDIR)$(sbindir)/ldapize.pl
+
+	install -D -p -m755 svnproxy.pl $(DESTDIR)$(sbindir)/svnproxy.pl
+	install -D -p -m755 svn $(DESTDIR)$(trusteddir)/svn
+	install -D -p -m644 scripts-svn.xinetd $(DESTDIR)/etc/xinetd.d/scripts-svn
+
+	install -D -p -m755 gitproxy.pl $(DESTDIR)$(sbindir)/gitproxy.pl
+	install -D -p -m755 git $(DESTDIR)$(trusteddir)/git
+	install -D -p -m644 scripts-git.xinetd $(DESTDIR)/etc/xinetd.d/scripts-git
+
+clean:
+	rm -f static-cat
+
+distclean: clean
+	rm -f configure config.* Makefile
+	rm -rf auto*.cache
Index: tags/fc15-eol/server/common/oursrc/execsys/configure.in
===================================================================
--- tags/fc15-eol/server/common/oursrc/execsys/configure.in	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/execsys/configure.in	(revision 2244)
@@ -0,0 +1,5 @@
+AC_INIT(static-cat.c.pre)
+
+AC_PROG_CC
+
+AC_OUTPUT(Makefile)
Index: tags/fc15-eol/server/common/oursrc/execsys/execsys-binfmt
===================================================================
--- tags/fc15-eol/server/common/oursrc/execsys/execsys-binfmt	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/execsys/execsys-binfmt	(revision 2244)
@@ -0,0 +1,54 @@
+#!/bin/sh
+#
+# execsys-binfmt: test1
+#
+# chkconfig: 2345 2 98
+# description: test2
+#
+### BEGIN INIT INFO
+# Provides:          execsys-binfmt
+# Required-Start:    $syslog
+# Required-Stop:     $syslog
+# Should-Start:      $local_fs
+# Should-Stop:       $local_fs
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Start scripts.mit.edu execsys system
+# Description:       Decides what interpreter to use to execute files
+### END INIT INFO
+
+stop ()
+{
+    echo "-1" > /proc/sys/fs/binfmt_misc/status
+    umount /proc/sys/fs/binfmt_misc
+}
+
+start ()
+{
+    mount -t binfmt_misc none /proc/sys/fs/binfmt_misc
+    echo ':CLR:M::MZ::/usr/bin/mono:' > /proc/sys/fs/binfmt_misc/register
+}
+
+case "$1" in
+start)
+    stop 2>/dev/null || :
+    start
+    ;;
+stop)
+    stop
+    ;;
+force-reload)
+    stop
+    start
+    ;;
+restart)
+    stop
+    start
+    ;;
+*)
+    echo "Usage: $0 [start|stop|restart|force-reload]" >&2
+    exit 2
+    ;;
+esac
+
+exit $?
Index: tags/fc15-eol/server/common/oursrc/execsys/git
===================================================================
--- tags/fc15-eol/server/common/oursrc/execsys/git	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/execsys/git	(revision 2244)
@@ -0,0 +1,13 @@
+#!/bin/sh
+
+case "$1" in
+*/.. | */../*)
+    exit 1
+    ;;
+${HOME%/Scripts}/Scripts/git/*)
+    exec /usr/bin/git daemon --inetd --base-path="$1"
+    ;;
+*)
+    exit 1
+    ;;
+esac
Index: tags/fc15-eol/server/common/oursrc/execsys/gitproxy.pl
===================================================================
--- tags/fc15-eol/server/common/oursrc/execsys/gitproxy.pl	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/execsys/gitproxy.pl	(revision 2244)
@@ -0,0 +1,106 @@
+#!/usr/bin/perl
+#
+# gitproxy: Wrapper around git daemon for Git virtual hosting.
+# version 1.1, released 2008-12-28
+# Copyright © 2008 Anders Kaseorg <andersk@mit.edu>
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+use strict;
+use warnings;
+use IPC::Open2;
+use Errno qw(EINTR);
+use IO::Poll qw(POLLIN POLLOUT POLLHUP);
+
+# Receive the first message from the client, and parse out the URL.
+my $host;
+my $msg = '';
+for (;;) {
+    my $n = sysread(STDIN, my $buf, 4096);
+    next if $n < 0 and $! == EINTR;
+    $n >= 0 or die "$0: read: $!";
+    $n > 0 or die "$0: unexpected message from client";
+    $msg .= $buf;
+    my $len;
+    if (($len) = $msg =~ m/^([[:xdigit:]]{4})/ and length($msg) >= hex($len)) {
+	foreach (split("\0", $')) {
+	    last if ($host) = m/^host=(.*)$/;
+	}
+	last if defined($host);
+	die "$0: no host found in client message";
+    } elsif ($msg !~ m/^[[:xdigit:]]{0,3}$/) {
+	die "$0: unexpected message from client";
+    }
+}
+
+# Now start the real git daemon based on the URL.
+my $pid = open2(\*IN, \*OUT, '/usr/local/sbin/ldapize.pl', "git://$host/") or die "$0: open: $!";
+
+# Finally, go into a poll loop to transfer the remaining data
+# (STDIN -> OUT, IN -> STDOUT), including the client's message to git daemon.
+my ($cbuf, $sbuf) = ($msg, '');
+my $poll = new IO::Poll;
+$poll->mask(\*STDOUT => POLLHUP);
+$poll->mask(\*OUT => POLLOUT);
+$poll->remove(\*STDIN);
+$poll->mask(\*IN => POLLIN);
+while ($poll->handles()) {
+    my $n = $poll->poll();
+    next if $n < 0 and $! == EINTR;
+    $n >= 0 or die "select: $!";
+    if ($poll->events(\*STDIN)) {
+	my $n = sysread(STDIN, $cbuf, 4096);
+	next if $n < 0 and $! == EINTR;
+	$n >= 0 or die "read: $!";
+	$poll->remove(\*STDIN);
+	$poll->mask(\*OUT => POLLOUT);
+    } elsif ($poll->events(\*IN)) {
+	my $n = sysread(IN, $sbuf, 4096);
+	next if $n < 0 and $! == EINTR;
+	$n >= 0 or die "read: $!";
+	$poll->remove(\*IN);
+	$poll->mask(\*STDOUT => POLLOUT);
+    } elsif ($poll->events(\*STDOUT) & POLLOUT && $sbuf ne '') {
+	my $n = syswrite(STDOUT, $sbuf);
+	next if $n < 0 and $! == EINTR;
+	$n >= 0 or die "write: $!";
+	$sbuf = substr($sbuf, $n);
+	if ($sbuf eq '') {
+	    $poll->mask(\*STDOUT => POLLHUP);
+	    $poll->mask(\*IN => POLLIN);
+	}
+    } elsif ($poll->events(\*STDOUT)) {
+	$poll->remove(\*STDOUT);
+	$poll->remove(\*IN);
+	close(STDOUT) or die "close: $!";
+	close(IN) or die "close: $!";
+    } elsif ($poll->events(\*OUT) & POLLOUT && $cbuf ne '') {
+	my $n = syswrite(OUT, $cbuf);
+	next if $n < 0 and $! == EINTR;
+	$n >= 0 or die "write: $!";
+	$cbuf = substr($cbuf, $n);
+	if ($cbuf eq '') {
+	    $poll->mask(\*OUT => POLLHUP);
+	    $poll->mask(\*STDIN => POLLIN);
+	}
+    } elsif ($poll->events(\*OUT)) {
+	$poll->remove(\*OUT);
+	$poll->remove(\*STDIN);
+	close(OUT) or die "close: $!";
+	close(STDIN) or die "close: $!";
+    }
+}
+
+while (waitpid($pid, 0) == -1 && $! == EINTR) { }
Index: tags/fc15-eol/server/common/oursrc/execsys/ldapize.pl
===================================================================
--- tags/fc15-eol/server/common/oursrc/execsys/ldapize.pl	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/execsys/ldapize.pl	(revision 2244)
@@ -0,0 +1,69 @@
+#!/usr/bin/perl
+
+use strict;
+use warnings;
+
+use Net::LDAP;
+use Net::LDAP::Filter;
+
+my $url = $ARGV[0];
+my ($proto, $hostname, $path) = $url =~ m|^(.*?)://([^/]*)(.*)| or die "Could not match URL";
+my $mesg;
+
+my $vhostName = $hostname;
+
+vhost:
+# oh my gosh Net::LDAP::Filter SUCKS
+my $filter = bless({and =>
+    [{equalityMatch => {attributeDesc  => 'objectClass',
+                        assertionValue => 'scriptsVhost'}},
+     {or =>
+         [{equalityMatch => {attributeDesc  => 'scriptsVhostName',
+                             assertionValue => $vhostName}},
+          {equalityMatch => {attributeDesc  => 'scriptsVhostAlias',
+                             assertionValue => $vhostName}}]}]},
+    'Net::LDAP::Filter');
+
+my $ldap = Net::LDAP->new("ldapi://%2fvar%2frun%2fslapd-scripts.socket/");
+$mesg = $ldap->bind();
+$mesg->code && die $mesg->error;
+
+$mesg = $ldap->search(base => "ou=VirtualHosts,dc=scripts,dc=mit,dc=edu",
+                      filter => $filter);
+$mesg->code && die $mesg->error;
+
+my $vhostEntry = $mesg->pop_entry;
+if (!defined $vhostEntry) {
+  $vhostName ne '*' or die 'No vhost for *';
+  $vhostName =~ s/^(?:\*\.)?[^.]*/*/;  # Try next wildcard
+  goto vhost;
+}
+
+my $vhostDirectory = $vhostEntry->get_value('scriptsVhostDirectory');
+
+$mesg = $ldap->search(base => $vhostEntry->get_value('scriptsVhostAccount'),
+                      scope => 'base', filter => 'objectClass=posixAccount');
+$mesg->code && die $mesg->error;
+
+my $userEntry = $mesg->pop_entry;
+my ($homeDirectory, $uidNumber, $gidNumber) =
+    map { $userEntry->get_value($_) } qw(homeDirectory uidNumber gidNumber);
+(my $scriptsdir = $homeDirectory) =~ s{(?:/Scripts)?$}{/Scripts};
+
+if ($proto eq 'svn') {
+  chdir '/usr/libexec/scripts-trusted';
+  exec('/usr/sbin/suexec', $uidNumber, $gidNumber, '/usr/libexec/scripts-trusted/svn', "$scriptsdir/svn/$vhostDirectory");
+} elsif ($proto eq 'git') {
+  if ($vhostEntry->get_value('scriptsVhostName') eq 'notfound.example.com') {
+    # git-daemon doesn’t report useful errors yet
+    my $msg = "ERR No such host $hostname\n";
+    printf '%04x%s', length($msg) + 4, $msg;
+    exit;
+  }
+  chdir '/usr/libexec/scripts-trusted';
+  exec('/usr/sbin/suexec', $uidNumber, $gidNumber, '/usr/libexec/scripts-trusted/git', "$scriptsdir/git/$vhostDirectory");
+} elsif ($proto eq 'http') {
+  print "suexec $uidNumber $gidNumber $scriptsdir/web/$vhostDirectory/$path\n";
+} else {
+  die "Unknown protocol\n";
+}
Index: tags/fc15-eol/server/common/oursrc/execsys/mime.types
===================================================================
--- tags/fc15-eol/server/common/oursrc/execsys/mime.types	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/execsys/mime.types	(revision 2244)
@@ -0,0 +1,538 @@
+# This is a comment. I love comments.
+
+# This file controls what Internet media types are sent to the client for
+# given file extension(s).  Sending the correct media type to the client
+# is important so they know how to handle the content of the file.
+# Extra types can either be added here or by using an AddType directive
+# in your config files. For more information about Internet media types,
+# please read RFC 2045, 2046, 2047, 2048, and 2077.  The Internet media type
+# registry is at <http://www.iana.org/assignments/media-types/>.
+
+# MIME type			Extension
+application/EDI-Consent
+application/EDI-X12
+application/EDIFACT
+application/activemessage
+application/andrew-inset	ez
+application/applefile
+application/atomicmail
+application/batch-SMTP
+application/beep+xml
+application/cals-1840
+application/commonground
+application/cybercash
+application/dca-rft
+application/dec-dx
+application/dvcs
+application/eshop
+application/http
+application/hyperstudio
+application/iges
+application/index
+application/index.cmd
+application/index.obj
+application/index.response
+application/index.vnd
+application/iotp
+application/ipp
+application/isup
+application/font-tdpfr
+application/java-archive	jar
+application/mac-binhex40	hqx
+application/mac-compactpro	cpt
+application/macwriteii
+application/marc
+application/mathematica
+application/mathematica-old
+application/msword		doc
+application/news-message-id
+application/news-transmission
+application/ocsp-request
+application/ocsp-response
+application/octet-stream	bin dms lha lzh exe class so dll img iso il ttf otf
+application/ogg			ogg
+application/parityfec
+application/pdf			pdf
+application/pgp-encrypted
+application/pgp-keys
+application/pgp-signature
+application/pkcs10
+application/pkcs7-mime
+application/pkcs7-signature
+application/pkix-cert
+application/pkix-crl
+application/pkixcmp
+application/postscript		ai eps ps
+application/prs.alvestrand.titrax-sheet
+application/prs.cww
+application/prs.nprend
+application/qsig
+application/remote-printing
+application/riscos
+application/rtf			rtf
+application/sdp
+application/set-payment
+application/set-payment-initiation
+application/set-registration
+application/set-registration-initiation
+application/sgml
+application/sgml-open-catalog
+application/sieve
+application/slate
+application/smil		smi smil
+application/timestamp-query
+application/timestamp-reply
+application/vemmi
+application/vnd.3M.Post-it-Notes
+application/vnd.FloGraphIt
+application/vnd.accpac.simply.aso
+application/vnd.accpac.simply.imp
+application/vnd.acucobol
+application/vnd.aether.imp
+application/vnd.anser-web-certificate-issue-initiation
+application/vnd.anser-web-funds-transfer-initiation
+application/vnd.audiograph
+application/vnd.businessobjects
+application/vnd.bmi
+application/vnd.canon-cpdl
+application/vnd.canon-lips
+application/vnd.claymore
+application/vnd.commerce-battelle
+application/vnd.commonspace
+application/vnd.comsocaller
+application/vnd.contact.cmsg
+application/vnd.cosmocaller
+application/vnd.cups-postscript
+application/vnd.cups-raster
+application/vnd.cups-raw
+application/vnd.ctc-posml
+application/vnd.cybank
+application/vnd.dna
+application/vnd.dpgraph
+application/vnd.dxr
+application/vnd.ecdis-update
+application/vnd.ecowin.chart
+application/vnd.ecowin.filerequest
+application/vnd.ecowin.fileupdate
+application/vnd.ecowin.series
+application/vnd.ecowin.seriesrequest
+application/vnd.ecowin.seriesupdate
+application/vnd.enliven
+application/vnd.epson.esf
+application/vnd.epson.msf
+application/vnd.epson.quickanime
+application/vnd.epson.salt
+application/vnd.epson.ssf
+application/vnd.ericsson.quickcall
+application/vnd.eudora.data
+application/vnd.fdf
+application/vnd.ffsns
+application/vnd.framemaker
+application/vnd.fsc.weblaunch
+application/vnd.fujitsu.oasys
+application/vnd.fujitsu.oasys2
+application/vnd.fujitsu.oasys3
+application/vnd.fujitsu.oasysgp
+application/vnd.fujitsu.oasysprs
+application/vnd.fujixerox.ddd
+application/vnd.fujixerox.docuworks
+application/vnd.fujixerox.docuworks.binder
+application/vnd.fut-misnet
+application/vnd.grafeq
+application/vnd.groove-account
+application/vnd.groove-identity-message
+application/vnd.groove-injector
+application/vnd.groove-tool-message
+application/vnd.groove-tool-template
+application/vnd.groove-vcard
+application/vnd.hhe.lesson-player
+application/vnd.hp-HPGL
+application/vnd.hp-PCL
+application/vnd.hp-PCLXL
+application/vnd.hp-hpid
+application/vnd.hp-hps
+application/vnd.httphone
+application/vnd.hzn-3d-crossword
+application/vnd.ibm.afplinedata
+application/vnd.ibm.MiniPay
+application/vnd.ibm.modcap
+application/vnd.informix-visionary
+application/vnd.intercon.formnet
+application/vnd.intertrust.digibox
+application/vnd.intertrust.nncp
+application/vnd.intu.qbo
+application/vnd.intu.qfx
+application/vnd.irepository.package+xml
+application/vnd.is-xpr
+application/vnd.japannet-directory-service
+application/vnd.japannet-jpnstore-wakeup
+application/vnd.japannet-payment-wakeup
+application/vnd.japannet-registration
+application/vnd.japannet-registration-wakeup
+application/vnd.japannet-setstore-wakeup
+application/vnd.japannet-verification
+application/vnd.japannet-verification-wakeup
+application/vnd.koan
+application/vnd.lotus-1-2-3
+application/vnd.lotus-approach
+application/vnd.lotus-freelance
+application/vnd.lotus-notes
+application/vnd.lotus-organizer
+application/vnd.lotus-screencam
+application/vnd.lotus-wordpro
+application/vnd.mcd
+application/vnd.mediastation.cdkey
+application/vnd.meridian-slingshot
+application/vnd.mif		mif
+application/vnd.minisoft-hp3000-save
+application/vnd.mitsubishi.misty-guard.trustweb
+application/vnd.mobius.daf
+application/vnd.mobius.dis
+application/vnd.mobius.msl
+application/vnd.mobius.plc
+application/vnd.mobius.txf
+application/vnd.motorola.flexsuite
+application/vnd.motorola.flexsuite.adsi
+application/vnd.motorola.flexsuite.fis
+application/vnd.motorola.flexsuite.gotap
+application/vnd.motorola.flexsuite.kmr
+application/vnd.motorola.flexsuite.ttc
+application/vnd.motorola.flexsuite.wem
+application/vnd.mozilla.xul+xml
+application/vnd.ms-artgalry
+application/vnd.ms-asf
+application/vnd.ms-excel	xls
+application/vnd.ms-lrm
+application/vnd.ms-powerpoint	ppt
+application/vnd.ms-project
+application/vnd.ms-tnef
+application/vnd.ms-works
+application/vnd.mseq
+application/vnd.msign
+application/vnd.music-niff
+application/vnd.musician
+application/vnd.netfpx
+application/vnd.noblenet-directory
+application/vnd.noblenet-sealer
+application/vnd.noblenet-web
+application/vnd.novadigm.EDM
+application/vnd.novadigm.EDX
+application/vnd.novadigm.EXT
+application/vnd.oasis.opendocument.chart	odc
+application/vnd.oasis.opendocument.database	odb
+application/vnd.oasis.opendocument.formula	odf
+application/vnd.oasis.opendocument.graphics	odg
+application/vnd.oasis.opendocument.graphics-template	otg
+application/vnd.oasis.opendocument.image	odi
+application/vnd.oasis.opendocument.presentation	odp
+application/vnd.oasis.opendocument.presentation-template	otp
+application/vnd.oasis.opendocument.spreadsheet	ods
+application/vnd.oasis.opendocument.spreadsheet-template	ots
+application/vnd.oasis.opendocument.text	odt
+application/vnd.oasis.opendocument.text-master	odm
+application/vnd.oasis.opendocument.text-template	ott
+application/vnd.oasis.opendocument.text-web	oth
+application/vnd.osa.netdeploy
+application/vnd.palm
+application/vnd.pg.format
+application/vnd.pg.osasli
+application/vnd.powerbuilder6
+application/vnd.powerbuilder6-s
+application/vnd.powerbuilder7
+application/vnd.powerbuilder7-s
+application/vnd.powerbuilder75
+application/vnd.powerbuilder75-s
+application/vnd.previewsystems.box
+application/vnd.publishare-delta-tree
+application/vnd.pvi.ptid1
+application/vnd.pwg-xhtml-print+xml
+application/vnd.rapid
+application/vnd.s3sms
+application/vnd.seemail
+application/vnd.shana.informed.formdata
+application/vnd.shana.informed.formtemplate
+application/vnd.shana.informed.interchange
+application/vnd.shana.informed.package
+application/vnd.sss-cod
+application/vnd.sss-dtf
+application/vnd.sss-ntf
+application/vnd.sun.xml.writer	sxw
+application/vnd.sun.xml.writer.template	stw
+application/vnd.sun.xml.calc	sxc
+application/vnd.sun.xml.calc.template	stc
+application/vnd.sun.xml.draw	sxd
+application/vnd.sun.xml.draw.template	std
+application/vnd.sun.xml.impress	sxi
+application/vnd.sun.xml.impress.template	sti
+application/vnd.sun.xml.writer.global	sxg
+application/vnd.sun.xml.math	sxm
+application/vnd.street-stream
+application/vnd.svd
+application/vnd.swiftview-ics
+application/vnd.triscape.mxs
+application/vnd.trueapp
+application/vnd.truedoc
+application/vnd.tve-trigger
+application/vnd.ufdl
+application/vnd.uplanet.alert
+application/vnd.uplanet.alert-wbxml
+application/vnd.uplanet.bearer-choice-wbxml
+application/vnd.uplanet.bearer-choice
+application/vnd.uplanet.cacheop
+application/vnd.uplanet.cacheop-wbxml
+application/vnd.uplanet.channel
+application/vnd.uplanet.channel-wbxml
+application/vnd.uplanet.list
+application/vnd.uplanet.list-wbxml
+application/vnd.uplanet.listcmd
+application/vnd.uplanet.listcmd-wbxml
+application/vnd.uplanet.signal
+application/vnd.vcx
+application/vnd.vectorworks
+application/vnd.vidsoft.vidconference
+application/vnd.visio
+application/vnd.vividence.scriptfile
+application/vnd.wap.sic
+application/vnd.wap.slc
+application/vnd.wap.wbxml	wbxml
+application/vnd.wap.wmlc	wmlc
+application/vnd.wap.wmlscriptc	wmlsc
+application/vnd.webturbo
+application/vnd.wrq-hp3000-labelled
+application/vnd.wt.stf
+application/vnd.xara
+application/vnd.xfdl
+application/vnd.yellowriver-custom-menu
+application/whoispp-query
+application/whoispp-response
+application/wita
+application/wordperfect5.1
+application/x-bcpio		bcpio
+application/x-bittorrent	torrent
+application/x-bzip2		bz2
+application/x-cdlink		vcd
+application/x-chess-pgn		pgn
+application/x-compress
+application/x-cpio		cpio
+application/x-csh		csh
+application/x-director		dcr dir dxr
+application/x-dvi		dvi
+application/x-futuresplash	spl
+application/x-gtar		gtar
+application/x-gzip		gz tgz
+application/x-hdf		hdf
+application/x-javascript	js
+application/x-kword		kwd kwt
+application/x-kspread		ksp
+application/x-kpresenter	kpr kpt
+application/x-kchart		chrt
+application/x-killustrator	kil
+application/x-koan		skp skd skt skm
+application/x-latex		latex
+application/x-netcdf		nc cdf
+# This conflicts with audio/x-pn-realaudio-plugin, which is commented out below.
+application/x-rpm		rpm
+application/x-sh		sh
+application/x-shar		shar
+application/x-shockwave-flash	swf
+application/x-stuffit		sit
+application/x-sv4cpio		sv4cpio
+application/x-sv4crc		sv4crc
+application/x-tar		tar
+application/x-tcl		tcl
+application/x-tex		tex
+application/x-texinfo		texinfo texi
+application/x-troff		t tr roff
+application/x-troff-man		man
+application/x-troff-me		me
+application/x-troff-ms		ms
+application/x-ustar		ustar
+application/x-wais-source	src
+application/x400-bp
+application/xhtml+xml		xhtml xht
+application/xml
+application/xml-dtd
+application/xml-external-parsed-entity
+application/zip			zip
+audio/32kadpcm
+audio/basic			au snd
+audio/g.722.1
+audio/l16
+audio/midi			mid midi kar
+audio/mp4a-latm
+audio/mpa-robust
+audio/mpeg			mpga mp2 mp3
+audio/parityfec
+audio/prs.sid
+audio/telephone-event
+audio/tone
+audio/vnd.cisco.nse
+audio/vnd.cns.anp1
+audio/vnd.cns.inf1
+audio/vnd.digital-winds
+audio/vnd.everad.plj
+audio/vnd.lucent.voice
+audio/vnd.nortel.vbk
+audio/vnd.nuera.ecelp4800
+audio/vnd.nuera.ecelp7470
+audio/vnd.nuera.ecelp9600
+audio/vnd.octel.sbc
+audio/vnd.qcelp
+audio/vnd.rhetorex.32kadpcm
+audio/vnd.vmx.cvsd
+audio/x-aiff			aif aiff aifc
+audio/x-mpegurl			m3u
+audio/x-pn-realaudio		ram rm
+#audio/x-pn-realaudio-plugin	rpm
+audio/x-realaudio		ra
+audio/x-wav			wav
+chemical/x-pdb			pdb
+chemical/x-xyz			xyz
+image/bmp			bmp
+image/cgm
+image/g3fax
+image/gif			gif
+image/ief			ief
+image/jpeg			jpeg jpg jpe
+image/naplps
+image/png			png
+image/prs.btif
+image/prs.pti
+image/svg+xml			svg
+image/tiff			tiff tif
+image/vnd.cns.inf2
+image/vnd.djvu			djvu djv
+image/vnd.dwg
+image/vnd.dxf
+image/vnd.fastbidsheet
+image/vnd.fpx
+image/vnd.fst
+image/vnd.fujixerox.edmics-mmr
+image/vnd.fujixerox.edmics-rlc
+image/vnd.microsoft.icon	ico
+image/vnd.mix
+image/vnd.net-fpx
+image/vnd.svf
+image/vnd.wap.wbmp		wbmp
+image/vnd.xiff
+image/x-cmu-raster		ras
+image/x-portable-anymap		pnm
+image/x-portable-bitmap		pbm
+image/x-portable-graymap	pgm
+image/x-portable-pixmap		ppm
+image/x-rgb			rgb
+image/x-xbitmap			xbm
+image/x-xpixmap			xpm
+image/x-xwindowdump		xwd
+message/delivery-status
+message/disposition-notification
+message/external-body
+message/http
+message/news
+message/partial
+message/rfc822
+message/s-http
+model/iges			igs iges
+model/mesh			msh mesh silo
+model/vnd.dwf
+model/vnd.flatland.3dml
+model/vnd.gdl
+model/vnd.gs-gdl
+model/vnd.gtw
+model/vnd.mts
+model/vnd.vtu
+model/vrml			wrl vrml
+multipart/alternative
+multipart/appledouble
+multipart/byteranges
+multipart/digest
+multipart/encrypted
+multipart/form-data
+multipart/header-set
+multipart/mixed
+multipart/parallel
+multipart/related
+multipart/report
+multipart/signed
+multipart/voice-message
+text/calendar
+text/css			css
+text/directory
+text/enriched
+text/html			html htm
+text/parityfec
+text/plain			asc txt
+text/prs.lines.tag
+text/rfc822-headers
+text/richtext			rtx
+text/rtf			rtf
+text/sgml			sgml sgm
+text/tab-separated-values	tsv
+text/t140
+text/uri-list
+text/vnd.DMClientScript
+text/vnd.IPTC.NITF
+text/vnd.IPTC.NewsML
+text/vnd.abc
+text/vnd.curl
+text/vnd.flatland.3dml
+text/vnd.fly
+text/vnd.fmi.flexstor
+text/vnd.in3d.3dml
+text/vnd.in3d.spot
+text/vnd.latex-z
+text/vnd.motorola.reflex
+text/vnd.ms-mediapackage
+text/vnd.wap.si
+text/vnd.wap.sl
+text/vnd.wap.wml		wml
+text/vnd.wap.wmlscript		wmls
+text/x-setext			etx
+text/xml			xml xsl
+text/xml-external-parsed-entity
+video/mp4v-es
+video/mpeg			mpeg mpg mpe
+video/parityfec
+video/pointer
+video/quicktime			qt mov
+video/vnd.fvt
+video/vnd.motorola.video
+video/vnd.motorola.videop
+video/vnd.mpegurl		mxu
+video/vnd.mts
+video/vnd.nokia.interleaved-multimedia
+video/vnd.vivo
+video/x-msvideo			avi
+video/x-sgi-movie		movie
+video/x-ms-wmv			wmv
+x-conference/x-cooltalk		ice
+application/xaml+xml		xaml
+application/x-silverlight-app	xap
+# The following MS Office MIME types are from this source:
+# http://blogs.msdn.com/b/vsofficedeveloper/archive/2008/05/08/office-2007-open-xml-mime-types.aspx
+# There's a typo in .potm that's corrected in this alternate source:
+# http://therightstuff.de/2006/12/16/Office+2007+File+Icons+For+Windows+SharePoint+Services+20+And+SharePoint+Portal+Server+2003.aspx
+application/msword	dot
+application/vnd.openxmlformats-officedocument.wordprocessingml.document	docx
+application/vnd.openxmlformats-officedocument.wordprocessingml.template	dotx
+application/vnd.ms-word.document.macroEnabled.12	docm
+application/vnd.ms-word.template.macroEnabled.12	dotm
+application/vnd.ms-excel	xlt
+application/vnd.ms-excel	xla
+application/vnd.openxmlformats-officedocument.spreadsheetml.sheet	xlsx
+application/vnd.openxmlformats-officedocument.spreadsheetml.template	xltx
+application/vnd.ms-excel.sheet.macroEnabled.12	xlsm
+application/vnd.ms-excel.template.macroEnabled.12	xltm
+application/vnd.ms-excel.addin.macroEnabled.12	xlam
+application/vnd.ms-excel.sheet.binary.macroEnabled.12	xlsb
+application/vnd.ms-powerpoint	pot
+application/vnd.ms-powerpoint	pps
+application/vnd.ms-powerpoint	ppa
+application/vnd.openxmlformats-officedocument.presentationml.presentation	pptx
+application/vnd.openxmlformats-officedocument.presentationml.template	potx
+application/vnd.openxmlformats-officedocument.presentationml.slideshow	ppsx
+application/vnd.ms-powerpoint.addin.macroEnabled.12	ppam
+application/vnd.ms-powerpoint.presentation.macroEnabled.12	pptm
+application/vnd.ms-powerpoint.template.macroEnabled.12	potm
+application/vnd.ms-powerpoint.slideshow.macroEnabled.12	ppsm
+# End MS Office MIME types.
Index: tags/fc15-eol/server/common/oursrc/execsys/mrproper
===================================================================
--- tags/fc15-eol/server/common/oursrc/execsys/mrproper	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/execsys/mrproper	(revision 2244)
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+rm -f static-cat
+rm -f configure config.* Makefile
+rm -f static-cat.c execsys.conf
+rm -rf auto*.cache
Index: tags/fc15-eol/server/common/oursrc/execsys/scripts-git.xinetd
===================================================================
--- tags/fc15-eol/server/common/oursrc/execsys/scripts-git.xinetd	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/execsys/scripts-git.xinetd	(revision 2244)
@@ -0,0 +1,11 @@
+service git
+{
+	disable			= no
+	port			= 9418
+	socket_type		= stream
+	protocol		= tcp
+	wait			= no
+	user			= apache
+	passenv			= PATH
+	server			= /usr/local/sbin/gitproxy.pl
+}
Index: tags/fc15-eol/server/common/oursrc/execsys/scripts-svn.xinetd
===================================================================
--- tags/fc15-eol/server/common/oursrc/execsys/scripts-svn.xinetd	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/execsys/scripts-svn.xinetd	(revision 2244)
@@ -0,0 +1,12 @@
+service svn
+{
+	disable			= no
+	port			= 3690
+	socket_type		= stream
+	protocol		= tcp
+	wait			= no
+	user			= apache
+	passenv			= PATH
+	server			= /usr/local/sbin/svnproxy.pl
+#	bind			= 127.0.0.1
+}
Index: tags/fc15-eol/server/common/oursrc/execsys/static-cat.c.pre
===================================================================
--- tags/fc15-eol/server/common/oursrc/execsys/static-cat.c.pre	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/execsys/static-cat.c.pre	(revision 2244)
@@ -0,0 +1,357 @@
+/*
+ * static-cat
+ * Copyright (C) 2006  Jeff Arnold <jbarnold@mit.edu>
+ * 
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ * 
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
+ * 
+ * See /COPYRIGHT in this repository for more information.
+ */
+
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <time.h>
+
+// Map from extensions to content-types
+
+// START-AUTOGENERATED: DO NOT EDIT THIS SECTION, INCLUDING THIS LINE!
+// This section is populated by the script upd-execsys
+// END-AUTOGENERATED: DO NOT EDIT THIS SECTION, INCLUDING THIS LINE!
+
+// Start code from w3c's libwww library
+// (as obtained from http://www.w3.org/Library/src/HTWWWStr.html)
+
+char *months[12] = {
+	"Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep",
+	"Oct", "Nov", "Dec"
+};
+
+char *wkdays[7] = {
+	"Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"
+};
+
+/*
+**	Returns a string pointer to a static area of the current calendar
+**	time in RFC 1123 format, for example
+**
+**		Sun, 06 Nov 1994 08:49:37 GMT
+**
+**	The result can be given in both local and GMT dependent on the flag
+*/
+const char *HTDateTimeStr(time_t * calendar, int local)
+{
+	static char buf[40];
+
+#ifdef HAVE_STRFTIME
+	if (local) {
+		/*
+		 ** Solaris 2.3 has a bug so we _must_ use reentrant version
+		 ** Thomas Maslen <tmaslen@verity.com>
+		 */
+#if defined(HT_REENTRANT) || defined(SOLARIS)
+		struct tm loctime;
+		localtime_r(calendar, &loctime);
+		strftime(buf, 40, "%a, %d %b %Y %H:%M:%S", &loctime);
+#else
+		struct tm *loctime = localtime(calendar);
+		strftime(buf, 40, "%a, %d %b %Y %H:%M:%S", loctime);
+#endif				/* SOLARIS || HT_REENTRANT */
+	} else {
+#if defined(HT_REENTRANT) || defined(SOLARIS)
+		struct tm gmt;
+		gmtime_r(calendar, &gmt);
+		strftime(buf, 40, "%a, %d %b %Y %H:%M:%S GMT", &gmt);
+#else
+		struct tm *gmt = gmtime(calendar);
+		strftime(buf, 40, "%a, %d %b %Y %H:%M:%S GMT", gmt);
+#endif				/* SOLARIS || HT_REENTRANT */
+	}
+#else
+	if (local) {
+#if defined(HT_REENTRANT)
+		struct tm loctime;
+		localtime_r(calendar, &loctime);
+#else
+		struct tm *loctime = localtime(calendar);
+#endif				/* HT_REENTRANT */
+		sprintf(buf, "%s, %02d %s %04d %02d:%02d:%02d",
+			wkdays[loctime->tm_wday],
+			loctime->tm_mday,
+			months[loctime->tm_mon],
+			loctime->tm_year + 1900,
+			loctime->tm_hour, loctime->tm_min,
+			loctime->tm_sec);
+	} else {
+#if defined(HT_REENTRANT) || defined(SOLARIS)
+		struct tm gmt;
+		gmtime_r(calendar, &gmt);
+#else
+		struct tm *gmt = gmtime(calendar);
+#endif
+		sprintf(buf, "%s, %02d %s %04d %02d:%02d:%02d GMT",
+			wkdays[gmt->tm_wday],
+			gmt->tm_mday,
+			months[gmt->tm_mon],
+			gmt->tm_year + 1900, gmt->tm_hour, gmt->tm_min,
+			gmt->tm_sec);
+	}
+#endif
+	return buf;
+}
+
+// End code from w3c's libwww library
+
+// Start code from gnu
+// (as obtained from "apt-get source coreutils" on debian sarge)
+
+// JBA: included by safe_read.h, safe_write.h, full_read.h, and full_write.h
+#include <stddef.h>
+
+// JBA: included by safe_read.c and full_write.c
+#if HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+// JBA: included by safe_read.c and full_write.c
+#include <errno.h>
+#ifndef errno
+extern int errno;
+#endif
+
+// Code from system.h:
+
+#ifndef STDOUT_FILENO
+# define STDOUT_FILENO 1
+#endif
+
+// Code from safe_read.h:
+
+#define SAFE_READ_ERROR ((size_t) -1)
+
+// Code from safe_write.h
+
+#define SAFE_WRITE_ERROR ((size_t) -1)
+
+// Code from safe_read.c
+
+/* Get ssize_t.  */
+#include <sys/types.h>
+#if HAVE_UNISTD_H
+# include <unistd.h>
+#endif
+
+#ifdef EINTR
+# define IS_EINTR(x) ((x) == EINTR)
+#else
+# define IS_EINTR(x) 0
+#endif
+
+#include <limits.h>
+
+/* Read(write) up to COUNT bytes at BUF from(to) descriptor FD, retrying if
+   interrupted.  Return the actual number of bytes read(written), zero for EOF,
+   or SAFE_READ_ERROR(SAFE_WRITE_ERROR) upon error.  */
+size_t safe_read(int fd, void *buf, size_t count)
+{
+	size_t result;
+
+	/* POSIX limits COUNT to SSIZE_MAX, but we limit it further, requiring
+	   that COUNT <= INT_MAX, to avoid triggering a bug in Tru64 5.1.
+	   When decreasing COUNT, keep the file pointer block-aligned.
+	   Note that in any case, read(write) may succeed, yet read(write)
+	   fewer than COUNT bytes, so the caller must be prepared to handle
+	   partial results.  */
+	if (count > INT_MAX)
+		count = INT_MAX & ~8191;
+
+	do {
+		result = read(fd, buf, count);
+	}
+	while (result < 0 && IS_EINTR(errno));
+
+	return (size_t) result;
+}
+
+/* Read(write) up to COUNT bytes at BUF from(to) descriptor FD, retrying if
+   interrupted.  Return the actual number of bytes read(written), zero for EOF,
+   or SAFE_READ_ERROR(SAFE_WRITE_ERROR) upon error.  */
+size_t safe_write(int fd, const void *buf, size_t count)
+{
+	size_t result;
+
+	/* POSIX limits COUNT to SSIZE_MAX, but we limit it further, requiring
+	   that COUNT <= INT_MAX, to avoid triggering a bug in Tru64 5.1.
+	   When decreasing COUNT, keep the file pointer block-aligned.
+	   Note that in any case, read(write) may succeed, yet read(write)
+	   fewer than COUNT bytes, so the caller must be prepared to handle
+	   partial results.  */
+	if (count > INT_MAX)
+		count = INT_MAX & ~8191;
+
+	do {
+		result = write(fd, buf, count);
+	}
+	while (result < 0 && IS_EINTR(errno));
+
+	return (size_t) result;
+}
+
+// Code from full_write.c
+
+/* Write(read) COUNT bytes at BUF to(from) descriptor FD, retrying if
+   interrupted or if a partial write(read) occurs.  Return the number
+   of bytes transferred.
+   When writing, set errno if fewer than COUNT bytes are written.
+   When reading, if fewer than COUNT bytes are read, you must examine
+   errno to distinguish failure from EOF (errno == 0).  */
+size_t full_read(int fd, void *buf, size_t count)
+{
+	size_t total = 0;
+	char *ptr = buf;
+
+	while (count > 0) {
+		size_t n_rw = safe_read(fd, ptr, count);
+		if (n_rw == (size_t) - 1)
+			break;
+		if (n_rw == 0) {
+			errno = 0;
+			break;
+		}
+		total += n_rw;
+		ptr += n_rw;
+		count -= n_rw;
+	}
+
+	return total;
+}
+
+/* Write(read) COUNT bytes at BUF to(from) descriptor FD, retrying if
+   interrupted or if a partial write(read) occurs.  Return the number
+   of bytes transferred.
+   When writing, set errno if fewer than COUNT bytes are written.
+   When reading, if fewer than COUNT bytes are read, you must examine
+   errno to distinguish failure from EOF (errno == 0).  */
+size_t full_write(int fd, const void *buf, size_t count)
+{
+	size_t total = 0;
+	const char *ptr = buf;
+
+	while (count > 0) {
+		size_t n_rw = safe_write(fd, ptr, count);
+		if (n_rw == (size_t) - 1)
+			break;
+		if (n_rw == 0) {
+			errno = ENOSPC;
+			break;
+		}
+		total += n_rw;
+		ptr += n_rw;
+		count -= n_rw;
+	}
+
+	return total;
+}
+
+// Code from cat.c
+
+/* Nonzero if a non-fatal error has occurred.  */
+static int exit_status = 0;
+
+static int input_desc;
+
+/* Plain cat.  Copies the file behind `input_desc' to STDOUT_FILENO.  */
+
+static void simple_cat(
+			      /* Pointer to the buffer, used by reads and writes.  */
+			      char *buf,
+			      /* Number of characters preferably read or written by each read and write
+			         call.  */
+			      int bufsize)
+{
+	/* Actual number of characters read, and therefore written.  */
+	size_t n_read;
+
+	/* Loop until the end of the file.  */
+
+	for (;;) {
+		/* Read a block of input.  */
+
+		n_read = safe_read(input_desc, buf, bufsize);
+		if (n_read == SAFE_READ_ERROR) {
+			// JBA: simplified to "exit_status=1; return;"
+			exit_status = 1;
+			return;
+		}
+
+		/* End of this file?  */
+
+		if (n_read == 0)
+			break;
+
+		/* Write this block out.  */
+
+		{
+			/* The following is ok, since we know that 0 < n_read.  */
+			size_t n = n_read;
+			if (full_write(STDOUT_FILENO, buf, n) != n)
+				exit(1);	// JBA: simplified to "exit(1);"
+		}
+	}
+}
+
+// End code from gnu
+
+int main(int argc, char **argv)
+{
+	input_desc = open(argv[1], O_RDONLY);
+	if (input_desc == -1) {
+		input_desc =
+		    open("/mit/scripts/www/403-404.html", O_RDONLY);
+		if (input_desc == -1)
+			exit(0);
+		printf("Status: 404 Not Found\n");
+		printf("Content-type: text/html;\n\n");
+	} else {
+		int i, j;
+		const char *content_type = "application/octet-stream";
+		for (i = strlen(argv[1]) - 1; i > 0; i--) {
+			if (argv[1][i - 1] == '.')
+				break;
+		}
+		if (i == 0)
+			exit(0);
+		for (j = 0; j < 2 * NEXTS; j += 2) {
+			if (strcasecmp(map[j], &argv[1][i]) == 0) {
+				content_type = map[j + 1];
+			}
+		}
+
+		struct stat statbuf;
+		if (fstat(input_desc, &statbuf) == 0) {
+			const char *dtstr =
+			    HTDateTimeStr(&statbuf.st_mtime, 0);
+			printf("Last-Modified: %s\n", dtstr);
+		}
+		printf("Content-type: %s\n\n", content_type);
+	}
+	fflush(stdout);
+	char *buf = malloc(4096);
+	simple_cat(buf, 4096);
+	free(buf);
+	close(input_desc);
+	return exit_status;
+}
Index: tags/fc15-eol/server/common/oursrc/execsys/svn
===================================================================
--- tags/fc15-eol/server/common/oursrc/execsys/svn	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/execsys/svn	(revision 2244)
@@ -0,0 +1,13 @@
+#!/bin/sh
+
+case "$1" in
+*/.. | */../*)
+    exit 1
+    ;;
+${HOME%/Scripts}/Scripts/svn/*)
+    exec /usr/bin/svnserve -i -r "$1"
+    ;;
+*)
+    exit 1
+    ;;
+esac
Index: tags/fc15-eol/server/common/oursrc/execsys/svnproxy.pl
===================================================================
--- tags/fc15-eol/server/common/oursrc/execsys/svnproxy.pl	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/execsys/svnproxy.pl	(revision 2244)
@@ -0,0 +1,140 @@
+#!/usr/bin/perl
+#
+# svnproxy: Wrapper around svnserve for Subversion virtual hosting.
+# version 1.1, released 2008-12-28
+# Copyright © 2008 Anders Kaseorg <andersk@mit.edu>
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+
+use strict;
+use warnings;
+use IPC::Open2;
+use Errno qw(EINTR);
+use IO::Poll qw(POLLIN POLLOUT POLLHUP);
+
+# Read the initial greeting from a dummy svnserve process.
+my $pid = open(IN, '-|');
+defined $pid or die "$0: open: $!";
+if ($pid == 0) {
+    close(STDIN) or die "$0: close: $!";
+    exec('svnserve', '-i') or die "$0: exec svnproxy: $!";
+}
+my $greeting = '';
+for (;;) {
+    my $n = sysread(IN, my $buf, 4096);
+    next if $n < 0 and $! == EINTR;
+    $n >= 0 or die "$0: read: $!";
+    last if $n == 0;
+    $greeting .= $buf;
+}
+
+# Send the greeting to the client.
+my $buf = $greeting;
+while ($buf ne '') {
+    my $n = syswrite(STDOUT, $buf);
+    next if $n < 0 and $! == EINTR;
+    $n >= 0 or die "$0: write: $!";
+    $buf = substr($buf, $n);
+}
+close(IN) or die "$0: close: $!";
+waitpid(-1, 0) or die "$0: waitpid: $!";
+
+# Receive the response from the client, and parse out the URL.
+my $url;
+my $response = '';
+for (;;) {
+    my $n = sysread(STDIN, my $buf, 4096);
+    next if $n < 0 and $! == EINTR;
+    $n >= 0 or die "$0: read: $!";
+    $n > 0 or die "$0: unexpected response from client";
+    $response .= $buf;
+    my $url_len;
+    if (($url_len) = $response =~ m/^\(\s\S+\s\(\s[^)]*\)\s(\d+):/ and
+	length($') >= $url_len) {
+	$url = substr($', 0, $url_len);
+	last;
+    } elsif ($response !~ m/^(?:\((?:\s(?:\S+(?:\s(?:\((?:\s(?:[^)]*(?:\)(?:\s(?:\d+:?)?)?)?)?)?)?)?)?)?)?$/) {
+	die "$0: unexpected response from client";
+    }
+}
+
+# Now start the real svnserve based on the URL.
+$pid = open2(\*IN, \*OUT, '/usr/local/sbin/ldapize.pl', $url) or die "$0: open: $!";
+
+# Read the greeting, expecting it to be identical to the dummy greeting.
+while ($greeting ne '') {
+    my $n = sysread(IN, my $buf, length($greeting));
+    next if $n < 0 and $! == EINTR;
+    $n >= 0 or die "$0: read: $!";
+    $n > 0 or die "$0: svnserve unexpectedly closed connection";
+    $greeting =~ s/^\Q$buf\E// or die "$0: unexpected greeting from svnserve";
+}
+
+# Finally, go into a select loop to transfer the remaining data
+# (STDIN -> OUT, IN -> STDOUT), including the client's response to svnserve.
+my ($cbuf, $sbuf) = ($response, '');
+my $poll = new IO::Poll;
+$poll->mask(\*STDOUT => POLLHUP);
+$poll->mask(\*OUT => POLLOUT);
+$poll->remove(\*STDIN);
+$poll->mask(\*IN => POLLIN);
+while ($poll->handles()) {
+    my $n = $poll->poll();
+    next if $n < 0 and $! == EINTR;
+    $n >= 0 or die "select: $!";
+    if ($poll->events(\*STDIN)) {
+	my $n = sysread(STDIN, $cbuf, 4096);
+	next if $n < 0 and $! == EINTR;
+	$n >= 0 or die "read: $!";
+	$poll->remove(\*STDIN);
+	$poll->mask(\*OUT => POLLOUT);
+    } elsif ($poll->events(\*IN)) {
+	my $n = sysread(IN, $sbuf, 4096);
+	next if $n < 0 and $! == EINTR;
+	$n >= 0 or die "read: $!";
+	$poll->remove(\*IN);
+	$poll->mask(\*STDOUT => POLLOUT);
+    } elsif ($poll->events(\*STDOUT) & POLLOUT && $sbuf ne '') {
+	my $n = syswrite(STDOUT, $sbuf);
+	next if $n < 0 and $! == EINTR;
+	$n >= 0 or die "write: $!";
+	$sbuf = substr($sbuf, $n);
+	if ($sbuf eq '') {
+	    $poll->mask(\*STDOUT => POLLHUP);
+	    $poll->mask(\*IN => POLLIN);
+	}
+    } elsif ($poll->events(\*STDOUT)) {
+	$poll->remove(\*STDOUT);
+	$poll->remove(\*IN);
+	close(STDOUT) or die "close: $!";
+	close(IN) or die "close: $!";
+    } elsif ($poll->events(\*OUT) & POLLOUT && $cbuf ne '') {
+	my $n = syswrite(OUT, $cbuf);
+	next if $n < 0 and $! == EINTR;
+	$n >= 0 or die "write: $!";
+	$cbuf = substr($cbuf, $n);
+	if ($cbuf eq '') {
+	    $poll->mask(\*OUT => POLLHUP);
+	    $poll->mask(\*STDIN => POLLIN);
+	}
+    } elsif ($poll->events(\*OUT)) {
+	$poll->remove(\*OUT);
+	$poll->remove(\*STDIN);
+	close(OUT) or die "close: $!";
+	close(STDIN) or die "close: $!";
+    }
+}
+
+while (waitpid($pid, 0) == -1 && $! == EINTR) { }
Index: tags/fc15-eol/server/common/oursrc/execsys/upd-execsys
===================================================================
--- tags/fc15-eol/server/common/oursrc/execsys/upd-execsys	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/execsys/upd-execsys	(revision 2244)
@@ -0,0 +1,155 @@
+#!/usr/bin/perl -w
+use strict;
+
+# upd-execsys
+# Copyright (C) 2006  Jeff Arnold <jbarnold@mit.edu>
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA
+#
+# See /COPYRIGHT in this repository for more information.
+
+my @dynamic = qw(
+ pl
+ php
+ py
+ cgi
+ scm
+ exe
+);
+
+my @static = qw(
+ html
+ css
+ gif
+ jpg
+ png
+ htm
+ jpeg
+ js
+ ico
+ xml
+ xsl
+ tiff
+ tif
+ tgz
+ tar
+ jar
+ zip
+ pdf
+ ps
+ doc
+ xls
+ ppt
+ dot
+ docx
+ dotx
+ docm
+ dotm
+ xlt
+ xla
+ xlsx
+ xltx
+ xlsm
+ xltm
+ xlam
+ xlsb
+ pot
+ pps
+ ppa
+ pptx
+ potx
+ ppsx
+ ppam
+ pptm
+ potm
+ ppsm
+ swf
+ mp3
+ mov
+ wmv
+ mpg
+ mpeg
+ avi
+ il
+ xhtml
+ svg
+ xaml
+ xap
+ wav
+ mid
+ midi
+ ttf
+ otf
+ odc
+ odb
+ odf
+ odg
+ otg
+ odi
+ odp
+ otp
+ ods
+ ots
+ odt
+ odm
+ ott
+ oth
+);
+
+my %map;
+open(TYPES, "./mime.types");
+while(my $line = <TYPES>) {
+	next if($line =~ /^\#/ or $line =~ /^\s*$/);
+	my ($type, $exts) = ($line =~ /^(\S*)\s+(.*)$/);
+	next if($exts =~ /^\s*$/);
+	
+	foreach my $ext (split " ", $exts) {
+		$map{$ext} = $type;
+	}
+}
+close(TYPES);
+
+undef $/;
+my $regexp = '(.*[\/\#]+\sSTART-AUTOGENERATED:[^!]*!).*\s([\/\#]+\sEND-AUTOGENERATED.*)';
+
+open(CONF, ">./execsys.conf");
+
+foreach my $ext (@dynamic, @static) {
+	print CONF <<END
+<FilesMatch "(?i)\\.$ext\$">
+	SetHandler cgi-script
+	Options +ExecCGI
+</FilesMatch>
+
+END
+}
+close(CONF);
+
+open(CAT, "./static-cat.c.pre");
+my $file = <CAT>;
+my ($fstart, $fend) = ($file =~ /$regexp/s);
+close(CAT);
+
+open(CAT, ">./static-cat.c");
+print CAT $fstart, "\n";
+print CAT '#define NEXTS ', scalar(@static), "\n";
+print CAT "const char *map[2 * NEXTS] = {\n";
+for(my $i = 0; $i < scalar(@static); $i++) {
+	my $comma = ( $i < scalar(@static)-1 ? "," : "" );
+	print CAT "\t\"$static[$i]\", \"$map{$static[$i]}\"$comma\n";
+}
+print CAT "};\n";
+print CAT $fend;
+close(CAT);
Index: tags/fc15-eol/server/common/oursrc/fuse-better-mousetrapfs/better-mousetrapfs
===================================================================
--- tags/fc15-eol/server/common/oursrc/fuse-better-mousetrapfs/better-mousetrapfs	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/fuse-better-mousetrapfs/better-mousetrapfs	(revision 2244)
@@ -0,0 +1,90 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# better-mousetrapfs: Filesystem that logs and kills any accessors
+# version 1.0, released 2010-03-31
+# Copyright © 2010 Anders Kaseorg <andersk@mit.edu>
+#
+# Permission is hereby granted, free of charge, to any person
+# obtaining a copy of this software and associated documentation files
+# (the “Software”), to deal in the Software without restriction,
+# including without limitation the rights to use, copy, modify, merge,
+# publish, distribute, sublicense, and/or sell copies of the Software,
+# and to permit persons to whom the Software is furnished to do so,
+# subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be
+# included in all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND,
+# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+# NONINFRINGEMENT.  IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+# ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+import errno
+import fuse
+import grp
+import os
+import pwd
+import signal
+import stat
+import syslog
+
+fuse.fuse_python_api = (0, 2)
+
+class BetterMousetrapFS(fuse.Fuse):
+    def __init__(self, *args, **kwargs):
+        syslog.openlog('better-mousetrapfs')
+        fuse.Fuse.__init__(self, *args, **kwargs)
+
+    def getattr(self, path):
+        if path == '/':
+            return fuse.Stat(st_mode = stat.S_IFDIR | 0755, st_nlink = 2)
+        else:
+            return -errno.EACCES
+
+    def opendir(self, path):
+        self.spring(fuse.FuseGetContext())
+        return -errno.EACCES
+
+    def spring(self, context):
+        pid = context['pid']
+        uid = context['uid']
+        gid = context['gid']
+        try:
+            user = '%d %r' % (uid, pwd.getpwuid(uid).pw_name)
+        except KeyError:
+            user = '%d' % uid
+        try:
+            group = '%d %r' % (gid, grp.getgrgid(gid).gr_name)
+        except KeyError:
+            group = '%d' % gid
+        cmdline = open('/proc/%d/cmdline' % pid).read().split('\0')[:-1]
+        exe = os.readlink('/proc/%d/exe' % pid)
+        status = dict(tuple(v.strip() for v in l.split(':', 1))
+                      for l in open('/proc/%d/status' % pid).readlines())
+        cwd = os.readlink('/proc/%d/cwd' % pid)
+
+        syslog.syslog(
+            syslog.LOG_WARNING | 80, # 80 = LOG_AUTHPRIV
+            'mousetrap caught process %d, uid=%s, gid=%s, exe=%r, cmdline=%r, cwd=%r' %
+            (pid, user, group, exe, cmdline, cwd))
+
+        try:
+            nonlocal_gid = grp.getgrnam('nss-nonlocal-users').gr_gid
+        except KeyError:
+            nonlocal_gid = None
+        if str(nonlocal_gid) in status['Groups'].split():
+            os.kill(pid, signal.SIGKILL)
+            pass
+
+if __name__ == '__main__':
+    fs = BetterMousetrapFS()
+    fs.parse(errex=1)
+    fs.fuse_args.add('allow_other')
+    fs.fuse_args.add('ro')
+    fs.main()
Index: tags/fc15-eol/server/common/oursrc/hacron/hacron
===================================================================
--- tags/fc15-eol/server/common/oursrc/hacron/hacron	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/hacron/hacron	(revision 2244)
@@ -0,0 +1,360 @@
+#!/usr/bin/env python
+from __future__ import with_statement
+import glob
+import logging.handlers
+import fcntl
+import optparse
+import os
+import socket
+import shutil
+import subprocess
+import sys
+import time
+from os import path
+
+OCF_SUCCESS=0
+OCF_ERR_GENERIC=1
+OCF_ERR_ARGS=2
+OCF_ERR_UNIMPLEMENTED=3
+OCF_ERR_PERM=4
+OCF_ERR_INSTALLED=5
+OCF_ERR_CONFIGURED=6
+OCF_NOT_RUNNING=7
+
+logger = logging.getLogger('cron')
+
+HA_LOGD = os.environ.get('HA_LOGD') == 'yes'
+
+class HacronError(Exception):
+    def __init__(self, ocf_errno, msg='Something went wrong'):
+        self.ocf_errno = ocf_errno
+        self.msg = msg
+        logger.error(msg)
+    
+class HaLogHandler(logging.Handler):
+    """
+    A handler class which writes to ha_logger.
+    """
+    def __init__(self, ha_tag):
+        """
+        Initialize the handler.  ha_tag is the name of this resource.
+        """
+        logging.Handler.__init__(self)
+        self.ha_tag = ha_tag
+
+    def emit(self, record):
+        """
+        Emit a record.
+        """
+        print 'Passed', record
+        try:
+            levelname = record.levelname
+            msg = self.format(record)
+            subprocess.call(['/usr/sbin/ha_logger', '-t', self.ha_tag, msg])
+        except (KeyboardInterrupt, SystemExit):
+            raise
+        except:
+            self.handleError(record)
+
+class lock(object):
+    def __init__(self, filename):
+        self.filename = filename
+        if not _touch(filename):
+            raise
+
+    def __enter__(self):
+        f = open(self.filename)
+        fcntl.flock(f, fcntl.LOCK_EX)
+            
+    def __exit__(self, type, value, traceback):
+        f = open(self.filename)
+        fcntl.flock(f, fcntl.LOCK_UN)
+        
+def _touch(path):
+    """Effectively touches a file.  Returns true if successful, false
+    otherwise"""
+    try:
+        open(path, 'a').close()
+    except IOError:
+        return False
+    else:
+        return True
+
+def _remove(dest):
+    if not path.exists(dest) and not path.islink(dest):
+        logger.error('Tried to remove nonexistant path %s' % dest)
+        return True
+
+    try:
+        if path.isdir(dest):
+            os.rmdir(dest)
+        else:
+            os.remove(dest)
+    except OSError, e:
+        logging.error('Could not remove %s: %s' % (dest, e))
+        return False
+    else:
+        return True
+
+def _mkdir(dir):
+    try:
+        os.mkdir(dir)
+    except OSError, e:
+        logging.error('Could not mkdir %s: %s' % (dir, e))
+        return False
+    else:
+        return True
+    
+def _strip(name):
+    """Strip off the file extension, and leading /'s, if they exist"""
+    return path.splitext(path.basename(name))[0]
+
+def _suffix(name, suffix):
+    return '%s.%s' % (name, suffix)
+
+def _crondir(server):
+    return path.join(CRONSPOOL_DIR, _suffix(server, 'cronspool'))
+
+def _serverfile(server):
+    return path.join(SERVER_DIR, server)
+
+def _servers():
+    """Get a list of the servers."""
+    return [_strip(f) for f in glob.glob(path.join(SERVER_DIR, '*'))]
+
+def _is_master(server):
+    crondir = path.join(CRONSPOOL_DIR, _suffix(server, 'cronspool'))
+    return path.islink(crondir)
+
+def _restart_crond(args, options):
+    # TODO: insert correct cmd here.  Also, should we capture and log
+    # stdout?
+    if options.development:
+        cmd = ['echo', 'called crond reset']
+    else:
+        cmd = ['service', 'crond', 'reload']
+    try:
+        subprocess.check_call(cmd)
+    except OSError, e:
+        raise HacronError(OCF_ERR_GENERIC, 'Cron restart exited with return code %d' % e.errno)
+    else:
+        logger.info('Restarted crond')
+
+def start_cron(args, options):
+    serverfile = _serverfile(HOSTNAME)
+    if not _touch(serverfile):
+        logger.error('Could not touch %s' % serverfile)
+        return OCF_ERR_CONFIGURED
+    elif _is_master(HOSTNAME):
+        logger.error('%s is already the master!' % HOSTNAME)
+        return OCF_SUCCESS
+
+    logger.info('Starting %s' % HOSTNAME)
+    for server in _servers():
+        crondir = _crondir(server)
+        if server == HOSTNAME:
+            # Get rid of current crondir, and leave if that fails.
+            if not _remove(crondir):
+                logger.error("Could not remove dummy cronspool dir %s" % crondir)
+                return OCF_ERR_GENERIC
+            os.symlink('../cronspool', crondir)
+            logger.info('Created master symlink %s' % crondir)
+        else:
+            if path.islink(crondir):
+                _remove(crondir)
+                logger.info('Removed old master symlink: %s' % crondir)
+            if not path.exists(crondir):
+                _mkdir(crondir)
+                logger.info('Created slave dummy directory %s' % crondir)
+    try:
+        _restart_crond(args, options)
+    except HacronException, e:
+        return e.ocf_errno
+    return OCF_SUCCESS
+
+def stop_cron(args, options):
+    """Stop cron."""
+    if not _is_master(HOSTNAME):
+        logger.error('I am not the master!')
+        return OCF_NOT_RUNNING
+    else:
+        crondir = _crondir(HOSTNAME)
+        logger.info('Removing symlink %s' % crondir)
+        _remove(crondir)
+        _mkdir(crondir)
+        # TODO: should we do something else here?
+        try:
+            _restart_crond(args, options)
+        except HacronException, e:
+            return e.ocf_errno
+        return OCF_SUCCESS
+
+def monitor_cron(args, options):
+    """Check whether cron is running.  For now just makes sure that the
+    current machine is the master, although this should likely be fixed."""
+    if _is_master(HOSTNAME):
+        return OCF_SUCCESS
+    else:
+        return OCF_NOT_RUNNING
+
+def validate_all_cron(args, options):
+    if not _touch(_serverfile(HOSTNAME)):
+        logger.error('Could not touch %s' % _serverfile(HOSTNAME))
+        return OCF_ERR_GENERIC
+    elif not path.exists(CRONSPOOL_DIR):
+        return OCF_ERR_GENERIC
+    else:
+        return OCF_SUCCESS
+
+def setup(args, options):
+    for d in [CRONSPOOL_DIR, SERVER_DIR]:
+        if not path.exists(d):
+            os.makedirs(d)
+            logger.info('Created %s' % d)
+        else:
+            logger.info('Already exists: %s' % d)
+
+def remove_servers(servers, options):
+    """Remove servers from the list of available ones."""
+    for server in servers:
+        _remove(_serverfile(server))
+        _remove(_crondir(server))
+        logger.info('Removed %s from list of available ones' % server)
+
+
+def meta_data_cron(args, options):
+    print """<?xml version="1.0"?>
+<!DOCTYPE resource-agent SYSTEM "ra-api-1.dtd">
+<resource-agent name="hacron" version="0.1">
+<version>1.0</version>
+
+<longdesc lang="en">
+This is the high-availability cron manager.  It uses an extremely overpowered
+clustering solution to make it so that people can have their crontabs.  Yay.
+</longdesc>
+<shortdesc lang="en">HA Cron</shortdesc>
+
+<parameters>
+<parameter name="cron_root" required="1">
+<longdesc lang="en">
+Base directory for storage of crontabs and server information.
+</longdesc>
+<shortdesc lang="en">Cron base directory</shortdesc>
+<content type="string" />
+</parameter>
+</parameters>
+
+<actions>
+<action name="start"        timeout="90" />
+<action name="stop"         timeout="100" />
+<action name="monitor"      timeout="20" interval="10" depth="0" start-delay="0" />
+<action name="reload"       timeout="90" />
+<action name="meta-data"    timeout="5" />
+<action name="validate-all"   timeout="30" />
+</actions>
+</resource-agent>
+"""
+    return OCF_SUCCESS
+
+def usage(parser):
+    parser.print_help()
+    return 1
+
+def _set_globals(args, options):
+    global HOSTNAME, CRONROOT, CRONSPOOL_DIR, SERVER_DIR, \
+        HA_RSCTMP, OCF_RESOURCE_INSTANCE
+    if options.development:
+        logging.basicConfig(level=logging.DEBUG)
+    else:
+        if HA_LOGD:
+            handler = HaLogHandler('hacron')
+        else:
+            handler = logging.handlers.SysLogHandler('/dev/log')
+        formatter = logging.Formatter("%(module)s: %(levelname)s %(message)s")
+        handler.setLevel(logging.INFO)
+        handler.setFormatter(formatter)
+        logger.addHandler(handler)
+    HOSTNAME = options.server or os.environ.get('HA_CURHOST') or socket.gethostname()
+    CRONROOT = options.cronroot or os.environ.get('OCF_RESKEY_cron_root')
+    if not CRONROOT:
+        raise HacronError(OCF_ERR_CONFIGURED, 'No cron_root specified.')
+    CRONSPOOL_DIR = path.join(CRONROOT, 'server-cronspools')
+    SERVER_DIR = path.join(CRONROOT, 'servers')
+    HA_RSCTMP = os.environ.get('HA_RSCTMP', '/tmp')
+    OCF_RESOURCE_INSTANCE = os.environ.get('OCF_RESOURCE_INSTANCE', 'default')
+    return OCF_SUCCESS
+
+def main():
+    usage_str = """usage: %prog [-s server] [-c cronroot] [-d] cmd
+
+Script for starting and stopping cron in a multiserver environment.
+One server is designated the master.
+
+== HA available commands: ==
+start: Make this server into the master and reload crond.
+reload: Same as start.
+stop: Demote this server to a spare and reload crond.
+monitor: Indicate whether this server is successfully the master.
+validate-all: Make sure that things look right and this server is
+  ready to be promoted to master.
+meta-data: Print out the XML meta data for this service
+
+== User-only commands: ==
+setup: Create the folders, etc. necessary for running hacron.
+remove-servers server1 server2 ...: Take a list of servers out of the
+  list of available ones.
+    """
+    parser = optparse.OptionParser(usage=usage_str)
+    parser.add_option("-s", "--server",
+                      action="store", dest="server",
+                      default=None,
+                      help="choose which server to run script as")
+    parser.add_option("-c", "--cronroot",
+                      action="store", dest="cronroot",
+                      default=None,
+                      help="pick root of cron dir")
+    parser.add_option("-d", "--development",
+                      action="store_true", dest="development",
+                      default=False,
+                      help="run in development mode")
+    (options, args) = parser.parse_args()
+    if len(args) < 1:
+        return usage(parser)
+    command = args[0]
+    args = args[1:]
+
+    if command == 'meta-data':
+        return meta_data_cron(args, options)
+
+    try:
+        _set_globals(args, options)
+    except HacronError, e:
+        return e.ocf_errno
+
+    with lock('%s/hacron-%s.lock' % (HA_RSCTMP, OCF_RESOURCE_INSTANCE)):
+        if command == 'start':
+            return start_cron(args, options)
+        elif command == 'reload':
+            return start_cron(args, options)
+        elif command == 'stop':
+            return stop_cron(args, options)
+        elif command == 'monitor':
+            return monitor_cron(args, options)
+        elif command == 'validate-all':
+            return validate_all_cron(args, options)
+        elif command == 'setup':
+            return setup(args, options)
+        elif command == 'remove-servers':
+            return remove_servers(args, options)
+        else:
+            usage(parser)
+            return OCF_ERR_UNIMPLEMENTED
+
+if __name__ == '__main__':
+    try:
+        ret = main()
+    except Exception, e:
+        logger.error('exception from main: %s' % e)
+        ret = OCF_ERR_GENERIC
+        raise
+    sys.exit(ret)
Index: tags/fc15-eol/server/common/oursrc/httpdmods/Makefile.in
===================================================================
--- tags/fc15-eol/server/common/oursrc/httpdmods/Makefile.in	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/httpdmods/Makefile.in	(revision 2244)
@@ -0,0 +1,17 @@
+APXS = apxs
+
+MODS = mod_auth_sslcert mod_authz_afsgroup mod_auth_optional mod_vhost_ldap mod_original_dst
+
+all-local: $(patsubst %,.libs/%.so,$(MODS))
+
+APXSFLAGS_mod_vhost_ldap = -Wc,-DMOD_VHOST_LDAP_VERSION=\\\"mod_vhost_ldap/1.2.0scripts\\\" -lldap_r
+
+.libs/%.so: %.c
+	$(APXS) $(APXSFLAGS_$*) -c $<
+
+clean:
+	rm -f $(MODS:=.o) $(MODS:=.la) $(MODS:=.lo) $(MODS:=.slo)
+	rm -rf .libs
+
+distclean: clean
+	rm -f config.log config.cache config.status Makefile
Index: tags/fc15-eol/server/common/oursrc/httpdmods/configure.in
===================================================================
--- tags/fc15-eol/server/common/oursrc/httpdmods/configure.in	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/httpdmods/configure.in	(revision 2244)
@@ -0,0 +1,5 @@
+AC_INIT()
+
+AC_PROG_CC
+
+AC_OUTPUT(Makefile)
Index: tags/fc15-eol/server/common/oursrc/httpdmods/mod_auth_optional.c
===================================================================
--- tags/fc15-eol/server/common/oursrc/httpdmods/mod_auth_optional.c	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/httpdmods/mod_auth_optional.c	(revision 2244)
@@ -0,0 +1,80 @@
+/* mod_auth_optional
+ * version 1.0, released 2007-09-01
+ * Anders Kaseorg <andersk@mit.edu>
+ *
+ * This module can pretend that authentication succeeded even if no
+ * authorization module is authoritative, instead of returning a
+ * Forbidden error.
+ */
+
+#include "ap_config.h"
+#include "httpd.h"
+#include "http_config.h"
+#include "http_request.h"
+
+typedef struct {
+    int optional;
+    char *default_user;
+} auth_optional_config_rec;
+
+static void *create_auth_optional_dir_config(apr_pool_t *p, char *d)
+{
+    auth_optional_config_rec *conf = apr_pcalloc(p, sizeof(*conf));
+    conf->optional = 0;
+    conf->default_user = NULL;
+    return conf;
+}
+
+static const command_rec auth_optional_cmds[] =
+{
+    AP_INIT_FLAG("AuthOptional", ap_set_flag_slot,
+                 (void *)APR_OFFSETOF(auth_optional_config_rec, optional),
+                 OR_AUTHCFG,
+                 "Make authentication succeed if no authorization module is authoritative"),
+    AP_INIT_TAKE1("AuthOptionalDefaultUser", ap_set_string_slot,
+                   (void*)APR_OFFSETOF(auth_optional_config_rec, default_user),
+                  OR_AUTHCFG,
+                  "Default username to use if no authorization module is authoritative"),
+    {NULL}
+};
+
+module AP_MODULE_DECLARE_DATA auth_optional_module;
+
+static int auth_optional_check_user_id(request_rec *r)
+{
+    auth_optional_config_rec *conf = ap_get_module_config(r->per_dir_config,
+							  &auth_optional_module);
+    if (!conf->optional)
+	return DECLINED;
+
+    r->user = conf->default_user;
+    return OK;
+}
+
+static int auth_optional_auth_checker(request_rec *r)
+{
+    auth_optional_config_rec *conf = ap_get_module_config(r->per_dir_config,
+							  &auth_optional_module);
+    if (!conf->optional || conf->default_user != NULL)
+	return DECLINED;
+
+    return OK;
+}
+
+static void register_hooks(apr_pool_t *p)
+{
+    /* Right before mod_authz_default. */
+    ap_hook_check_user_id(auth_optional_check_user_id, NULL, NULL, APR_HOOK_LAST - 1);
+    ap_hook_auth_checker(auth_optional_auth_checker, NULL, NULL, APR_HOOK_REALLY_FIRST);
+}
+
+module AP_MODULE_DECLARE_DATA auth_optional_module =
+{
+    STANDARD20_MODULE_STUFF,
+    create_auth_optional_dir_config, /* dir config creater */
+    NULL,                            /* dir merger --- default is to override */
+    NULL,                            /* server config */
+    NULL,                            /* merge server config */
+    auth_optional_cmds,              /* command apr_table_t */
+    register_hooks                   /* register hooks */
+};
Index: tags/fc15-eol/server/common/oursrc/httpdmods/mod_auth_sslcert.c
===================================================================
--- tags/fc15-eol/server/common/oursrc/httpdmods/mod_auth_sslcert.c	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/httpdmods/mod_auth_sslcert.c	(revision 2244)
@@ -0,0 +1,170 @@
+/* mod_auth_sslcert
+ * version 1.1.1, released 2007-10-01
+ * Anders Kaseorg <andersk@mit.edu>
+ *
+ * This module does authentication based on SSL client certificates:
+ *   AuthType SSLCert
+ *   AuthSSLCertVar SSL_CLIENT_S_DN_Email
+ *   AuthSSLCertStripSuffix "@MIT.EDU"
+ */
+
+#include "apr_strings.h"
+#define APR_WANT_STRFUNC        /* for strcasecmp */
+#include "apr_want.h"
+
+#include "ap_config.h"
+#include "httpd.h"
+#include "http_config.h"
+#include "http_core.h"
+#include "http_log.h"
+#include "http_request.h"
+
+#include "mod_auth.h"
+#include "mod_ssl.h"
+
+static APR_OPTIONAL_FN_TYPE(ssl_var_lookup) *ssl_var_lookup;
+
+typedef struct {
+    int authoritative;
+    char *var;
+    char *strip_suffix;
+    int strip_suffix_required;
+} auth_sslcert_config_rec;
+
+static void *create_auth_sslcert_dir_config(apr_pool_t *p, char *dirspec)
+{
+    auth_sslcert_config_rec *conf = apr_pcalloc(p, sizeof(*conf));
+
+    conf->authoritative = -1;
+    conf->var = NULL;
+    conf->strip_suffix = NULL;
+    conf->strip_suffix_required = -1;
+
+    return conf;
+}
+
+static void *merge_auth_sslcert_dir_config(apr_pool_t *p, void *parent_conf, void *newloc_conf)
+{
+    auth_sslcert_config_rec *pconf = parent_conf, *nconf = newloc_conf,
+	*conf = apr_pcalloc(p, sizeof(*conf));
+
+    conf->authoritative = (nconf->authoritative != -1) ?
+	nconf->authoritative : pconf->authoritative;
+    conf->var = (nconf->var != NULL) ?
+	nconf->var : pconf->var;
+    conf->strip_suffix = (nconf->var != NULL || nconf->strip_suffix != NULL) ?
+	nconf->strip_suffix : pconf->strip_suffix;
+    conf->strip_suffix_required = (nconf->var != NULL || nconf->strip_suffix_required != -1) ?
+	nconf->authoritative : pconf->authoritative;
+
+    return conf;
+}
+
+static const command_rec auth_sslcert_cmds[] =
+{
+    AP_INIT_FLAG("AuthSSLCertAuthoritative", ap_set_flag_slot,
+                 (void *)APR_OFFSETOF(auth_sslcert_config_rec, authoritative),
+                 OR_AUTHCFG,
+                 "Set to 'Off' to allow access control to be passed along to "
+                 "lower modules if the UserID is not known to this module"),
+    AP_INIT_TAKE1("AuthSSLCertVar", ap_set_string_slot,
+		  (void*)APR_OFFSETOF(auth_sslcert_config_rec, var),
+		  OR_AUTHCFG,
+		  "SSL variable to use as the username"),
+    AP_INIT_TAKE1("AuthSSLCertStripSuffix", ap_set_string_slot,
+		  (void*)APR_OFFSETOF(auth_sslcert_config_rec, strip_suffix),
+		  OR_AUTHCFG,
+		  "An optional suffix to strip from the username"),
+    AP_INIT_FLAG("AuthSSLCertStripSuffixRequired", ap_set_flag_slot,
+		 (void *)APR_OFFSETOF(auth_sslcert_config_rec, strip_suffix_required),
+		 OR_AUTHCFG,
+		 "Set to 'Off' to allow certs that don't end with a recognized "
+		 "suffix to still authenticate"),
+    {NULL}
+};
+
+module AP_MODULE_DECLARE_DATA auth_sslcert_module;
+
+static int authenticate_sslcert_user(request_rec *r)
+{
+    auth_sslcert_config_rec *conf = ap_get_module_config(r->per_dir_config,
+							 &auth_sslcert_module);
+    const char *current_auth;
+
+    /* Are we configured to be SSLCert auth? */
+    current_auth = ap_auth_type(r);
+    if (!current_auth || strcasecmp(current_auth, "SSLCert") != 0) {
+        return DECLINED;
+    }
+
+    r->ap_auth_type = "SSLCert";
+
+    if (strcasecmp((char *)ssl_var_lookup(r->pool, r->server, r->connection, r,
+					  "SSL_CLIENT_VERIFY"),
+		   "SUCCESS") == 0) {
+	if (conf->var == NULL) {
+	    ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+			  "AuthSSLCertVar is not set: \"%s\"", r->uri);
+	    return HTTP_INTERNAL_SERVER_ERROR;
+	}
+	char *user = (char *)ssl_var_lookup(r->pool, r->server, r->connection, r,
+					    conf->var);
+	if (user != NULL && user[0] != '\0') {
+	    if (conf->strip_suffix != NULL) {
+		int i = strlen(user) - strlen(conf->strip_suffix);
+		if (i >= 0 && strcasecmp(user + i, conf->strip_suffix) == 0) {
+		    r->user = apr_pstrmemdup(r->pool, user, i);
+		    return OK;
+		} else if (!conf->strip_suffix_required) {
+		    r->user = user;
+		    return OK;
+		} else {
+		    ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+				  "SSL username for \"%s\" has wrong suffix: \"%s\"",
+				  r->uri, user);
+		}
+	    } else {
+		r->user = user;
+		return OK;
+	    }
+	} else {
+	    ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+			  "no SSL username for \"%s\"", r->uri);
+	}
+    } else if (conf->authoritative) {
+	ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+		      "SSL client not verified for \"%s\"", r->uri);
+    }
+
+    /* If we're not authoritative, then any error is ignored. */
+    if (!conf->authoritative) {
+	return DECLINED;
+    }
+
+    ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+		  "SSLCert authentication failure for \"%s\"",
+		  r->uri);
+    return HTTP_UNAUTHORIZED;
+}
+
+static void import_ssl_var_lookup()
+{
+    ssl_var_lookup = APR_RETRIEVE_OPTIONAL_FN(ssl_var_lookup);
+}
+
+static void register_hooks(apr_pool_t *p)
+{
+    ap_hook_check_user_id(authenticate_sslcert_user, NULL, NULL, APR_HOOK_MIDDLE);
+    ap_hook_optional_fn_retrieve(import_ssl_var_lookup, NULL, NULL, APR_HOOK_MIDDLE);
+}
+
+module AP_MODULE_DECLARE_DATA auth_sslcert_module =
+{
+    STANDARD20_MODULE_STUFF,
+    create_auth_sslcert_dir_config,  /* dir config creater */
+    merge_auth_sslcert_dir_config,   /* dir merger */
+    NULL,                            /* server config */
+    NULL,                            /* merge server config */
+    auth_sslcert_cmds,               /* command apr_table_t */
+    register_hooks                   /* register hooks */
+};
Index: tags/fc15-eol/server/common/oursrc/httpdmods/mod_authz_afsgroup.c
===================================================================
--- tags/fc15-eol/server/common/oursrc/httpdmods/mod_authz_afsgroup.c	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/httpdmods/mod_authz_afsgroup.c	(revision 2244)
@@ -0,0 +1,182 @@
+/* mod_authz_afsgroup
+ * version 1.1, released 2007-03-13
+ * Anders Kaseorg <anders@kaseorg.com>
+ *
+ * This module does authorization based on AFS groups:
+ *   Require afsgroup system:administrators
+ *
+ * It currently works by parsing the output of `pts membership
+ * <group>`.
+ */
+
+#include "apr_strings.h"
+
+#include "ap_config.h"
+#include "httpd.h"
+#include "http_config.h"
+#include "http_core.h"
+#include "http_log.h"
+#include "http_protocol.h"
+#include "http_request.h"
+
+#include <unistd.h>
+#include <stdio.h>
+
+typedef struct {
+    int authoritative;
+} authz_afsgroup_config_rec;
+
+static void *create_authz_afsgroup_dir_config(apr_pool_t *p, char *d)
+{
+    authz_afsgroup_config_rec *conf = apr_palloc(p, sizeof(*conf));
+
+    conf->authoritative = 1;
+    return conf;
+}
+
+static const command_rec authz_afsgroup_cmds[] =
+{
+    AP_INIT_FLAG("AuthzAFSGroupAuthoritative", ap_set_flag_slot,
+                 (void *)APR_OFFSETOF(authz_afsgroup_config_rec, authoritative),
+                 OR_AUTHCFG,
+                 "Set to 'Off' to allow access control to be passed along to "
+                 "lower modules if the 'require afsgroup' statement is not "
+                 "met. (default: On)."),
+    {NULL}
+};
+
+module AP_MODULE_DECLARE_DATA authz_afsgroup_module;
+
+static int check_afsgroup_access(request_rec *r)
+{
+    authz_afsgroup_config_rec *conf = ap_get_module_config(r->per_dir_config,
+							   &authz_afsgroup_module);
+    char *user = r->user;
+    int m = r->method_number;
+    int required_afsgroup = 0;
+    register int x;
+    const char *t;
+    char *w;
+    const apr_array_header_t *reqs_arr = ap_requires(r);
+    require_line *reqs;
+
+    if (!reqs_arr) {
+        return DECLINED;
+    }
+    reqs = (require_line *)reqs_arr->elts;
+
+    for (x = 0; x < reqs_arr->nelts; x++) {
+
+        if (!(reqs[x].method_mask & (AP_METHOD_BIT << m))) {
+            continue;
+        }
+
+        t = reqs[x].requirement;
+        w = ap_getword_white(r->pool, &t);
+        if (!strcasecmp(w, "afsgroup")) {
+            required_afsgroup = 1;
+            while (t[0]) {
+		int pfd[2];
+		pid_t cpid;
+		int status;
+		FILE *fp;
+		char *line = NULL;
+		char buf[256];
+		size_t len = 0;
+		ssize_t read;
+		int found = 0;
+                w = ap_getword_conf(r->pool, &t);
+		if (pipe(pfd) == -1) {
+		    ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+				  "pipe() failed!");
+		    return HTTP_INTERNAL_SERVER_ERROR;
+		}
+		cpid = fork();
+		if (cpid == -1) {
+		    close(pfd[0]);
+		    close(pfd[1]);
+		    ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+				  "fork() failed!");
+		    return HTTP_INTERNAL_SERVER_ERROR;
+		}
+		if (cpid == 0) {
+		    close(pfd[0]);
+		    dup2(pfd[1], STDOUT_FILENO);
+		    execve("/usr/bin/pts",
+			   (char *const[]) {
+			       "pts", "membership", "-nameorid", w, NULL
+			   },
+			   NULL);
+		    _exit(1);
+		}
+		close(pfd[1]);
+		fp = fdopen(pfd[0], "r");
+		if (fp == NULL) {
+		    close(pfd[0]);
+		    ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+				  "fdopen() failed!");
+		    return HTTP_INTERNAL_SERVER_ERROR;
+		}
+		if (snprintf(buf, sizeof(buf), "  %s\n", user) >= sizeof(buf)) {
+		    ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+				  "access to %s failed, reason: username '%s' "
+				  "is too long!",
+				  r->uri, user);
+		    continue;
+		}
+		while ((read = getline(&line, &len, fp)) != -1) {
+		    if (strcmp(line, buf) == 0)
+			found = 1;
+		}
+		if (line)
+		    free(line);
+		fclose(fp);
+		if (waitpid(cpid, &status, 0) == -1) {
+		    ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+				  "waitpid() failed!");
+		    return HTTP_INTERNAL_SERVER_ERROR;
+		}
+		if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) {
+		    ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+				  "`pts membership -nameorid %s` failed!",
+				  w);
+		    return HTTP_INTERNAL_SERVER_ERROR;
+		}
+		if (found)
+		    return OK;
+            }
+        }
+    }
+
+    if (!required_afsgroup) {
+        return DECLINED;
+    }
+
+    if (!conf->authoritative) {
+        return DECLINED;
+    }
+
+    ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
+                  "access to %s failed, reason: user '%s' does not meet "
+                  "'require'ments for afsgroup to be allowed access",
+                  r->uri, user);
+
+    ap_note_auth_failure(r);
+    return HTTP_FORBIDDEN;
+}
+
+static void register_hooks(apr_pool_t *p)
+{
+    ap_hook_auth_checker(check_afsgroup_access, NULL, NULL, APR_HOOK_MIDDLE);
+}
+
+module AP_MODULE_DECLARE_DATA authz_afsgroup_module =
+{
+    STANDARD20_MODULE_STUFF,
+    create_authz_afsgroup_dir_config, /* dir config creater */
+    NULL,                             /* dir merger --- default is to override */
+    NULL,                             /* server config */
+    NULL,                             /* merge server config */
+    authz_afsgroup_cmds,              /* command apr_table_t */
+    register_hooks                    /* register hooks */
+};
Index: tags/fc15-eol/server/common/oursrc/httpdmods/mod_original_dst.c
===================================================================
--- tags/fc15-eol/server/common/oursrc/httpdmods/mod_original_dst.c	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/httpdmods/mod_original_dst.c	(revision 2244)
@@ -0,0 +1,90 @@
+/* mod_original_dst
+ * version 1.0, released 2011-03-25
+ * Anders Kaseorg <andersk@mit.edu>
+ *
+ * This replaces the address of incoming connections with the original
+ * destination, before any local masquerading (as given by
+ * SO_ORIGINAL_DST).
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <limits.h>
+#include <netdb.h>
+#include <linux/netfilter_ipv4.h>
+
+#include "ap_config.h"
+#include "ap_listen.h"
+#include "http_config.h"
+#include "http_log.h"
+#include "httpd.h"
+#include "mpm.h"
+
+extern void apr_sockaddr_vars_set(apr_sockaddr_t *, int, apr_port_t);
+
+static apr_status_t original_dst_accept_func(void **accepted, ap_listen_rec *lr, apr_pool_t *ptrans)
+{
+    apr_status_t status = MPM_ACCEPT_FUNC(accepted, lr, ptrans);
+    if (status != APR_SUCCESS)
+	return status;
+
+    apr_socket_t *csd = *accepted;
+
+    apr_sockaddr_t *local_addr;
+    status = apr_socket_addr_get(&local_addr, APR_LOCAL, csd);
+    if (status != APR_SUCCESS) {
+	ap_log_perror(APLOG_MARK, APLOG_EMERG, status, ptrans,
+		      "original_dst_accept_func: apr_socket_addr_get failed");
+	apr_socket_close(csd);
+	return APR_EGENERAL;
+    }
+
+    int sockdes;
+    status = apr_os_sock_get(&sockdes, csd);
+    if (status != APR_SUCCESS) {
+	ap_log_perror(APLOG_MARK, APLOG_EMERG, status, ptrans,
+		      "original_dst_accept_func: apr_os_sock_get failed");
+	apr_socket_close(csd);
+	return APR_EGENERAL;
+    }
+
+    socklen_t salen = sizeof(local_addr->sa);
+    status = getsockopt(sockdes, SOL_IP, SO_ORIGINAL_DST, &local_addr->sa, &salen);
+    if (status == 0) {
+	local_addr->salen = salen;
+	apr_sockaddr_vars_set(local_addr, local_addr->sa.sin.sin_family, htons(local_addr->sa.sin.sin_port));
+	return APR_SUCCESS;
+    } else if (errno == ENOENT) {
+	return APR_SUCCESS;
+    } else {
+	ap_log_perror(APLOG_MARK, APLOG_EMERG, errno, ptrans,
+		      "original_dst_accept_func: getsockopt failed");
+	apr_socket_close(csd);
+	return APR_EGENERAL;
+    }
+}
+
+static int original_dst_post_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *s)
+{
+    ap_listen_rec *lr;
+    for (lr = ap_listeners; lr; lr = lr->next)
+	if (lr->accept_func == MPM_ACCEPT_FUNC)
+	    lr->accept_func = original_dst_accept_func;
+    return OK;
+}
+
+static void original_dst_register_hooks(apr_pool_t *p)
+{
+    ap_hook_post_config(original_dst_post_config, NULL, NULL, APR_HOOK_MIDDLE);
+}
+
+module AP_MODULE_DECLARE_DATA original_dst_module =
+{
+    STANDARD20_MODULE_STUFF,
+    NULL,                           /* per-directory config creator */
+    NULL,                           /* dir config merger */
+    NULL,                           /* server config creator */
+    NULL,                           /* server config merger */
+    NULL,                           /* command table */
+    original_dst_register_hooks,    /* set up other request processing hooks */
+};
Index: tags/fc15-eol/server/common/oursrc/httpdmods/mod_vhost_ldap.c
===================================================================
--- tags/fc15-eol/server/common/oursrc/httpdmods/mod_vhost_ldap.c	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/httpdmods/mod_vhost_ldap.c	(revision 2244)
@@ -0,0 +1,754 @@
+/* ============================================================
+ * Copyright (c) 2003-2004, Ondrej Sury
+ * All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * 
+ */
+
+/*
+ * mod_vhost_ldap.c --- read virtual host config from LDAP directory
+ */
+
+#define CORE_PRIVATE
+
+#include <unistd.h>
+
+#include "httpd.h"
+#include "http_config.h"
+#include "http_core.h"
+#include "http_log.h"
+#include "http_request.h"
+#include "apr_version.h"
+#include "apr_ldap.h"
+#include "apr_reslist.h"
+#include "apr_strings.h"
+#include "apr_tables.h"
+#include "util_ldap.h"
+#include "util_script.h"
+
+#if !defined(APU_HAS_LDAP) && !defined(APR_HAS_LDAP)
+#error mod_vhost_ldap requires APR-util to have LDAP support built in
+#endif
+
+#if !defined(WIN32) && !defined(OS2) && !defined(BEOS) && !defined(NETWARE)
+#define HAVE_UNIX_SUEXEC
+#endif
+
+#ifdef HAVE_UNIX_SUEXEC
+#include "unixd.h"              /* Contains the suexec_identity hook used on Unix */
+#endif
+
+#define MIN_UID 100
+#define MIN_GID 100
+const char USERDIR[] = "web_scripts";
+
+#define MAX_FAILURES 5
+
+module AP_MODULE_DECLARE_DATA vhost_ldap_module;
+
+typedef enum {
+    MVL_UNSET, MVL_DISABLED, MVL_ENABLED
+} mod_vhost_ldap_status_e;
+
+typedef struct mod_vhost_ldap_config_t {
+    mod_vhost_ldap_status_e enabled;			/* Is vhost_ldap enabled? */
+
+    /* These parameters are all derived from the VhostLDAPURL directive */
+    char *url;				/* String representation of LDAP URL */
+
+    char *host;				/* Name of the LDAP server (or space separated list) */
+    int port;				/* Port of the LDAP server */
+    char *basedn;			/* Base DN to do all searches from */
+    int scope;				/* Scope of the search */
+    char *filter;			/* Filter to further limit the search  */
+    deref_options deref;		/* how to handle alias dereferening */
+
+    char *binddn;			/* DN to bind to server (can be NULL) */
+    char *bindpw;			/* Password to bind to server (can be NULL) */
+
+    int have_deref;                     /* Set if we have found an Deref option */
+    int have_ldap_url;			/* Set if we have found an LDAP url */
+
+    int secure;				/* True if SSL connections are requested */
+
+    char *fallback;                     /* Fallback virtual host */
+
+} mod_vhost_ldap_config_t;
+
+typedef struct mod_vhost_ldap_request_t {
+    char *dn;				/* The saved dn from a successful search */
+    char *name;				/* ServerName */
+    char *admin;			/* ServerAdmin */
+    char *docroot;			/* DocumentRoot */
+    char *cgiroot;			/* ScriptAlias */
+    char *uid;				/* Suexec Uid */
+    char *gid;				/* Suexec Gid */
+} mod_vhost_ldap_request_t;
+
+char *attributes[] =
+  { "apacheServerName", "apacheDocumentRoot", "apacheScriptAlias", "apacheSuexecUid", "apacheSuexecGid", "apacheServerAdmin", 0 };
+
+static int total_modules;
+
+#if (APR_MAJOR_VERSION >= 1)
+static APR_OPTIONAL_FN_TYPE(uldap_connection_close) *util_ldap_connection_close;
+static APR_OPTIONAL_FN_TYPE(uldap_connection_find) *util_ldap_connection_find;
+static APR_OPTIONAL_FN_TYPE(uldap_cache_comparedn) *util_ldap_cache_comparedn;
+static APR_OPTIONAL_FN_TYPE(uldap_cache_compare) *util_ldap_cache_compare;
+static APR_OPTIONAL_FN_TYPE(uldap_cache_checkuserid) *util_ldap_cache_checkuserid;
+static APR_OPTIONAL_FN_TYPE(uldap_cache_getuserdn) *util_ldap_cache_getuserdn;
+static APR_OPTIONAL_FN_TYPE(uldap_ssl_supported) *util_ldap_ssl_supported;
+
+static void ImportULDAPOptFn(void)
+{
+    util_ldap_connection_close  = APR_RETRIEVE_OPTIONAL_FN(uldap_connection_close);
+    util_ldap_connection_find   = APR_RETRIEVE_OPTIONAL_FN(uldap_connection_find);
+    util_ldap_cache_comparedn   = APR_RETRIEVE_OPTIONAL_FN(uldap_cache_comparedn);
+    util_ldap_cache_compare     = APR_RETRIEVE_OPTIONAL_FN(uldap_cache_compare);
+    util_ldap_cache_checkuserid = APR_RETRIEVE_OPTIONAL_FN(uldap_cache_checkuserid);
+    util_ldap_cache_getuserdn   = APR_RETRIEVE_OPTIONAL_FN(uldap_cache_getuserdn);
+    util_ldap_ssl_supported     = APR_RETRIEVE_OPTIONAL_FN(uldap_ssl_supported);
+}
+#endif 
+
+static int mod_vhost_ldap_post_config(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *s)
+{
+    module **m;
+    
+    /* Stolen from modules/generators/mod_cgid.c */
+    total_modules = 0;
+    for (m = ap_preloaded_modules; *m != NULL; m++)
+      total_modules++;
+
+    /* make sure that mod_ldap (util_ldap) is loaded */
+    if (ap_find_linked_module("util_ldap.c") == NULL) {
+        ap_log_error(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, s,
+                     "Module mod_ldap missing. Mod_ldap (aka. util_ldap) "
+                     "must be loaded in order for mod_vhost_ldap to function properly");
+        return HTTP_INTERNAL_SERVER_ERROR;
+
+    }
+
+    ap_add_version_component(p, MOD_VHOST_LDAP_VERSION);
+
+    return OK;
+}
+
+static void *
+mod_vhost_ldap_create_server_config (apr_pool_t *p, server_rec *s)
+{
+    mod_vhost_ldap_config_t *conf =
+	(mod_vhost_ldap_config_t *)apr_pcalloc(p, sizeof (mod_vhost_ldap_config_t));
+
+    conf->enabled = MVL_UNSET;
+    conf->have_ldap_url = 0;
+    conf->have_deref = 0;
+    conf->binddn = NULL;
+    conf->bindpw = NULL;
+    conf->deref = always;
+    conf->fallback = NULL;
+
+    return conf;
+}
+
+static void *
+mod_vhost_ldap_merge_server_config(apr_pool_t *p, void *parentv, void *childv)
+{
+    mod_vhost_ldap_config_t *parent = (mod_vhost_ldap_config_t *) parentv;
+    mod_vhost_ldap_config_t *child  = (mod_vhost_ldap_config_t *) childv;
+    mod_vhost_ldap_config_t *conf =
+	(mod_vhost_ldap_config_t *)apr_pcalloc(p, sizeof(mod_vhost_ldap_config_t));
+
+    if (child->enabled == MVL_UNSET) {
+	conf->enabled = parent->enabled;
+    } else {
+	conf->enabled = child->enabled;
+    }
+
+    if (child->have_ldap_url) {
+	conf->have_ldap_url = child->have_ldap_url;
+	conf->url = child->url;
+	conf->host = child->host;
+	conf->port = child->port;
+	conf->basedn = child->basedn;
+	conf->scope = child->scope;
+	conf->filter = child->filter;
+	conf->secure = child->secure;
+    } else {
+	conf->have_ldap_url = parent->have_ldap_url;
+	conf->url = parent->url;
+	conf->host = parent->host;
+	conf->port = parent->port;
+	conf->basedn = parent->basedn;
+	conf->scope = parent->scope;
+	conf->filter = parent->filter;
+	conf->secure = parent->secure;
+    }
+    if (child->have_deref) {
+	conf->have_deref = child->have_deref;
+	conf->deref = child->deref;
+    } else {
+	conf->have_deref = parent->have_deref;
+	conf->deref = parent->deref;
+    }
+
+    conf->binddn = (child->binddn ? child->binddn : parent->binddn);
+    conf->bindpw = (child->bindpw ? child->bindpw : parent->bindpw);
+
+    conf->fallback = (child->fallback ? child->fallback : parent->fallback);
+
+    return conf;
+}
+
+/* 
+ * Use the ldap url parsing routines to break up the ldap url into
+ * host and port.
+ */
+static const char *mod_vhost_ldap_parse_url(cmd_parms *cmd, 
+					    void *dummy,
+					    const char *url)
+{
+    int result;
+    apr_ldap_url_desc_t *urld;
+#if (APR_MAJOR_VERSION >= 1)
+    apr_ldap_err_t *result_err;
+#endif
+
+    mod_vhost_ldap_config_t *conf =
+	(mod_vhost_ldap_config_t *)ap_get_module_config(cmd->server->module_config,
+							&vhost_ldap_module);
+
+    ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0,
+	         cmd->server, "[mod_vhost_ldap.c] url parse: `%s'", 
+	         url);
+    
+#if (APR_MAJOR_VERSION >= 1)    /* for apache >= 2.2 */
+    result = apr_ldap_url_parse(cmd->pool, url, &(urld), &(result_err));
+    if (result != LDAP_SUCCESS) {
+        return result_err->reason;
+    }
+#else
+    result = apr_ldap_url_parse(url, &(urld));
+    if (result != LDAP_SUCCESS) {
+        switch (result) {
+            case LDAP_URL_ERR_NOTLDAP:
+                return "LDAP URL does not begin with ldap://";
+            case LDAP_URL_ERR_NODN:
+                return "LDAP URL does not have a DN";
+            case LDAP_URL_ERR_BADSCOPE:
+                return "LDAP URL has an invalid scope";
+            case LDAP_URL_ERR_MEM:
+                return "Out of memory parsing LDAP URL";
+            default:
+                return "Could not parse LDAP URL";
+        }
+    }
+#endif
+    conf->url = apr_pstrdup(cmd->pool, url);
+
+    ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0,
+	         cmd->server, "[mod_vhost_ldap.c] url parse: Host: %s", urld->lud_host);
+    ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0,
+	         cmd->server, "[mod_vhost_ldap.c] url parse: Port: %d", urld->lud_port);
+    ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0,
+	         cmd->server, "[mod_vhost_ldap.c] url parse: DN: %s", urld->lud_dn);
+    ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0,
+	         cmd->server, "[mod_vhost_ldap.c] url parse: attrib: %s", urld->lud_attrs? urld->lud_attrs[0] : "(null)");
+    ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0,
+	         cmd->server, "[mod_vhost_ldap.c] url parse: scope: %s", 
+	         (urld->lud_scope == LDAP_SCOPE_SUBTREE? "subtree" : 
+		 urld->lud_scope == LDAP_SCOPE_BASE? "base" : 
+		 urld->lud_scope == LDAP_SCOPE_ONELEVEL? "onelevel" : "unknown"));
+    ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0,
+	         cmd->server, "[mod_vhost_ldap.c] url parse: filter: %s", urld->lud_filter);
+
+    /* Set all the values, or at least some sane defaults */
+    if (conf->host) {
+        char *p = apr_palloc(cmd->pool, strlen(conf->host) + strlen(urld->lud_host) + 2);
+        strcpy(p, urld->lud_host);
+        strcat(p, " ");
+        strcat(p, conf->host);
+        conf->host = p;
+    }
+    else {
+        conf->host = urld->lud_host? apr_pstrdup(cmd->pool, urld->lud_host) : "localhost";
+    }
+    conf->basedn = urld->lud_dn? apr_pstrdup(cmd->pool, urld->lud_dn) : "";
+
+    conf->scope = urld->lud_scope == LDAP_SCOPE_ONELEVEL ?
+        LDAP_SCOPE_ONELEVEL : LDAP_SCOPE_SUBTREE;
+
+    if (urld->lud_filter) {
+        if (urld->lud_filter[0] == '(') {
+            /* 
+	     * Get rid of the surrounding parens; later on when generating the
+	     * filter, they'll be put back.
+             */
+            conf->filter = apr_pstrdup(cmd->pool, urld->lud_filter+1);
+            conf->filter[strlen(conf->filter)-1] = '\0';
+        }
+        else {
+            conf->filter = apr_pstrdup(cmd->pool, urld->lud_filter);
+        }
+    }
+    else {
+        conf->filter = "objectClass=apacheConfig";
+    }
+
+      /* "ldaps" indicates secure ldap connections desired
+      */
+    if (strncasecmp(url, "ldaps", 5) == 0)
+    {
+        conf->secure = 1;
+        conf->port = urld->lud_port? urld->lud_port : LDAPS_PORT;
+        ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, cmd->server,
+                     "LDAP: vhost_ldap using SSL connections");
+    }
+    else
+    {
+        conf->secure = 0;
+        conf->port = urld->lud_port? urld->lud_port : LDAP_PORT;
+        ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, cmd->server, 
+                     "LDAP: vhost_ldap not using SSL connections");
+    }
+
+    conf->have_ldap_url = 1;
+#if (APR_MAJOR_VERSION < 1) /* free only required for older apr */
+    apr_ldap_free_urldesc(urld);
+#endif
+    return NULL;
+}
+
+static const char *mod_vhost_ldap_set_enabled(cmd_parms *cmd, void *dummy, int enabled)
+{
+    mod_vhost_ldap_config_t *conf =
+	(mod_vhost_ldap_config_t *)ap_get_module_config(cmd->server->module_config,
+							&vhost_ldap_module);
+
+    conf->enabled = (enabled) ? MVL_ENABLED : MVL_DISABLED;
+
+    return NULL;
+}
+
+static const char *mod_vhost_ldap_set_binddn(cmd_parms *cmd, void *dummy, const char *binddn)
+{
+    mod_vhost_ldap_config_t *conf =
+	(mod_vhost_ldap_config_t *)ap_get_module_config(cmd->server->module_config,
+							&vhost_ldap_module);
+
+    conf->binddn = apr_pstrdup(cmd->pool, binddn);
+    return NULL;
+}
+
+static const char *mod_vhost_ldap_set_bindpw(cmd_parms *cmd, void *dummy, const char *bindpw)
+{
+    mod_vhost_ldap_config_t *conf =
+	(mod_vhost_ldap_config_t *)ap_get_module_config(cmd->server->module_config,
+							&vhost_ldap_module);
+
+    conf->bindpw = apr_pstrdup(cmd->pool, bindpw);
+    return NULL;
+}
+
+static const char *mod_vhost_ldap_set_deref(cmd_parms *cmd, void *dummy, const char *deref)
+{
+    mod_vhost_ldap_config_t *conf = 
+	(mod_vhost_ldap_config_t *)ap_get_module_config (cmd->server->module_config,
+							 &vhost_ldap_module);
+
+    if (strcmp(deref, "never") == 0 || strcasecmp(deref, "off") == 0) {
+        conf->deref = never;
+	conf->have_deref = 1;
+    }
+    else if (strcmp(deref, "searching") == 0) {
+        conf->deref = searching;
+	conf->have_deref = 1;
+    }
+    else if (strcmp(deref, "finding") == 0) {
+        conf->deref = finding;
+	conf->have_deref = 1;
+    }
+    else if (strcmp(deref, "always") == 0 || strcasecmp(deref, "on") == 0) {
+        conf->deref = always;
+	conf->have_deref = 1;
+    }
+    else {
+        return "Unrecognized value for VhostLDAPAliasDereference directive";
+    }
+    return NULL;
+}
+
+static const char *mod_vhost_ldap_set_fallback(cmd_parms *cmd, void *dummy, const char *fallback)
+{
+    mod_vhost_ldap_config_t *conf =
+	(mod_vhost_ldap_config_t *)ap_get_module_config(cmd->server->module_config,
+							&vhost_ldap_module);
+
+    conf->fallback = apr_pstrdup(cmd->pool, fallback);
+    return NULL;
+}
+
+static int reconfigure_directive(apr_pool_t *p,
+				 server_rec *s,
+				 const char *dir,
+				 const char *args)
+{
+    ap_directive_t dir_s = { .directive = dir, .args = args, .next = NULL,
+                             .line_num = 0, .filename = "VhostLDAPConf" };
+    return ap_process_config_tree(s, &dir_s, p, p);
+}
+
+command_rec mod_vhost_ldap_cmds[] = {
+    AP_INIT_TAKE1("VhostLDAPURL", mod_vhost_ldap_parse_url, NULL, RSRC_CONF,
+                  "URL to define LDAP connection. This should be an RFC 2255 compliant\n"
+                  "URL of the form ldap://host[:port]/basedn[?attrib[?scope[?filter]]].\n"
+                  "<ul>\n"
+                  "<li>Host is the name of the LDAP server. Use a space separated list of hosts \n"
+                  "to specify redundant servers.\n"
+                  "<li>Port is optional, and specifies the port to connect to.\n"
+                  "<li>basedn specifies the base DN to start searches from\n"
+                  "</ul>\n"),
+
+    AP_INIT_TAKE1 ("VhostLDAPBindDN", mod_vhost_ldap_set_binddn, NULL, RSRC_CONF,
+		   "DN to use to bind to LDAP server. If not provided, will do an anonymous bind."),
+    
+    AP_INIT_TAKE1("VhostLDAPBindPassword", mod_vhost_ldap_set_bindpw, NULL, RSRC_CONF,
+                  "Password to use to bind to LDAP server. If not provided, will do an anonymous bind."),
+
+    AP_INIT_FLAG("VhostLDAPEnabled", mod_vhost_ldap_set_enabled, NULL, RSRC_CONF,
+                 "Set to off to disable vhost_ldap, even if it's been enabled in a higher tree"),
+
+    AP_INIT_TAKE1("VhostLDAPDereferenceAliases", mod_vhost_ldap_set_deref, NULL, RSRC_CONF,
+                  "Determines how aliases are handled during a search. Can be one of the"
+                  "values \"never\", \"searching\", \"finding\", or \"always\". "
+                  "Defaults to always."),
+
+    AP_INIT_TAKE1("VhostLDAPFallback", mod_vhost_ldap_set_fallback, NULL, RSRC_CONF,
+		  "Set default virtual host which will be used when requested hostname"
+		  "is not found in LDAP database. This option can be used to display"
+		  "\"virtual host not found\" type of page."),
+
+    {NULL}
+};
+
+#define FILTER_LENGTH MAX_STRING_LEN
+static int mod_vhost_ldap_translate_name(request_rec *r)
+{
+    server_rec *server;
+    const char *error;
+    int code;
+    mod_vhost_ldap_request_t *reqc;
+    int failures = 0;
+    const char **vals = NULL;
+    char filtbuf[FILTER_LENGTH];
+    mod_vhost_ldap_config_t *conf =
+	(mod_vhost_ldap_config_t *)ap_get_module_config(r->server->module_config, &vhost_ldap_module);
+    util_ldap_connection_t *ldc = NULL;
+    int result = 0;
+    const char *dn = NULL;
+    const char *hostname = NULL;
+    int is_fallback = 0;
+    int sleep0 = 0;
+    int sleep1 = 1;
+    int sleep;
+    struct berval hostnamebv, shostnamebv;
+
+    if ((error = ap_init_virtual_host(r->pool, "", r->server, &server)) != NULL) {
+        ap_log_rerror(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, r,
+		      "[mod_vhost_ldap.c]: Could not initialize a new VirtualHost: %s",
+		      error);
+	return HTTP_INTERNAL_SERVER_ERROR;
+    }
+
+    reqc =
+	(mod_vhost_ldap_request_t *)apr_pcalloc(r->pool, sizeof(mod_vhost_ldap_request_t));
+    memset(reqc, 0, sizeof(mod_vhost_ldap_request_t)); 
+
+    ap_set_module_config(r->request_config, &vhost_ldap_module, reqc);
+
+    // mod_vhost_ldap is disabled or we don't have LDAP Url
+    if ((conf->enabled != MVL_ENABLED)||(!conf->have_ldap_url)) {
+	return DECLINED;
+    }
+
+start_over:
+
+    if (conf->host) {
+        ldc = util_ldap_connection_find(r, conf->host, conf->port,
+					conf->binddn, conf->bindpw, conf->deref,
+					conf->secure);
+    }
+    else {
+        ap_log_rerror(APLOG_MARK, APLOG_WARNING|APLOG_NOERRNO, 0, r, 
+                      "[mod_vhost_ldap.c] translate: no conf->host - weird...?");
+        return HTTP_INTERNAL_SERVER_ERROR;
+    }
+
+    hostname = r->hostname;
+    if (hostname == NULL || hostname[0] == '\0')
+        goto null;
+
+fallback:
+
+    ap_log_rerror(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, r,
+		  "[mod_vhost_ldap.c]: translating hostname [%s], uri [%s]",
+		  hostname, r->uri);
+
+    ber_str2bv(hostname, 0, 0, &hostnamebv);
+    if (ldap_bv2escaped_filter_value(&hostnamebv, &shostnamebv) != 0)
+	goto null;
+    apr_snprintf(filtbuf, FILTER_LENGTH, "(&(%s)(|(apacheServerName=%s)(apacheServerAlias=%s)))", conf->filter, shostnamebv.bv_val, shostnamebv.bv_val);
+    ber_memfree(shostnamebv.bv_val);
+
+    result = util_ldap_cache_getuserdn(r, ldc, conf->url, conf->basedn, conf->scope,
+				       attributes, filtbuf, &dn, &vals);
+
+    util_ldap_connection_close(ldc);
+
+    /* sanity check - if server is down, retry it up to 5 times */
+    if (AP_LDAP_IS_SERVER_DOWN(result) ||
+	(result == LDAP_TIMEOUT) ||
+	(result == LDAP_CONNECT_ERROR)) {
+        sleep = sleep0 + sleep1;
+        ap_log_rerror(APLOG_MARK, APLOG_WARNING|APLOG_NOERRNO, 0, r,
+		      "[mod_vhost_ldap.c]: lookup failure, retry number #[%d], sleeping for [%d] seconds",
+		      failures, sleep);
+        if (failures++ < MAX_FAILURES) {
+	    /* Back-off exponentially */
+	    apr_sleep(apr_time_from_sec(sleep));
+	    sleep0 = sleep1;
+	    sleep1 = sleep;
+            goto start_over;
+        } else {
+	    return HTTP_GATEWAY_TIME_OUT;
+	}
+    }
+
+    if (result == LDAP_NO_SUCH_OBJECT) {
+	if (strcmp(hostname, "*") != 0) {
+	    if (strncmp(hostname, "*.", 2) == 0)
+		hostname += 2;
+	    hostname += strcspn(hostname, ".");
+	    hostname = apr_pstrcat(r->pool, "*", hostname, (const char *)NULL);
+	    ap_log_rerror(APLOG_MARK, APLOG_NOTICE|APLOG_NOERRNO, 0, r,
+		          "[mod_vhost_ldap.c] translate: "
+			  "virtual host not found, trying wildcard %s",
+			  hostname);
+	    goto fallback;
+	}
+
+null:
+	if (conf->fallback && (is_fallback++ <= 0)) {
+	    ap_log_rerror(APLOG_MARK, APLOG_NOTICE|APLOG_NOERRNO, 0, r,
+			  "[mod_vhost_ldap.c] translate: "
+			  "virtual host %s not found, trying fallback %s",
+			  hostname, conf->fallback);
+	    hostname = conf->fallback;
+	    goto fallback;
+	}
+
+	ap_log_rerror(APLOG_MARK, APLOG_WARNING|APLOG_NOERRNO, 0, r,
+		      "[mod_vhost_ldap.c] translate: "
+		      "virtual host %s not found",
+		      hostname);
+
+	return HTTP_BAD_REQUEST;
+    }
+
+    /* handle bind failure */
+    if (result != LDAP_SUCCESS) {
+        ap_log_rerror(APLOG_MARK, APLOG_WARNING|APLOG_NOERRNO, 0, r, 
+                      "[mod_vhost_ldap.c] translate: "
+                      "translate failed; virtual host %s; URI %s [%s]",
+		      hostname, r->uri, ldap_err2string(result));
+	return HTTP_INTERNAL_SERVER_ERROR;
+    }
+
+    /* mark the user and DN */
+    reqc->dn = apr_pstrdup(r->pool, dn);
+
+    /* Optimize */
+    if (vals) {
+	int i;
+	for (i = 0; attributes[i]; i++) {
+
+	    const char *directive;
+	    char *val = apr_pstrdup (r->pool, vals[i]);
+	    /* These do not correspond to any real directives */
+	    if (strcasecmp (attributes[i], "apacheSuexecUid") == 0) {
+		reqc->uid = val;
+		continue;
+	    }
+	    else if (strcasecmp (attributes[i], "apacheSuexecGid") == 0) {
+		reqc->gid = val;
+		continue;
+	    }
+
+	    if (strcasecmp (attributes[i], "apacheServerName") == 0) {
+		reqc->name = val;
+		directive = "ServerName";
+	    }
+	    else if (strcasecmp (attributes[i], "apacheServerAdmin") == 0) {
+		reqc->admin = val;
+		directive = "ServerAdmin";
+	    }
+	    else if (strcasecmp (attributes[i], "apacheDocumentRoot") == 0) {
+		reqc->docroot = val;
+		directive = "DocumentRoot";
+	    }
+	    else if (strcasecmp (attributes[i], "apacheScriptAlias") == 0) {
+		if (val != NULL) {
+		    /* Hack to deal with current apacheScriptAlias lagout */
+		    if (strlen(val) > 0 && val[strlen(val) - 1] == '/')
+			val = apr_pstrcat(r->pool, "/cgi-bin/ ", val, (const char *)NULL);
+		    else
+			val = apr_pstrcat(r->pool, "/cgi-bin/ ", val, "/", (const char *)NULL);
+		    directive = "ScriptAlias";
+		}
+		reqc->cgiroot = val;
+	    }
+	    else {
+		/* This should not actually be reachable, but it's
+		   good to cover all all possible cases */
+                ap_log_rerror(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, r,
+                              "Unexpected attribute %s encountered", attributes[i]);
+                continue;
+            }
+
+	    if (val == NULL)
+                continue;
+
+	    if ((code = reconfigure_directive(r->pool, server, directive, val)) != 0)
+		return code;
+	}
+    }
+
+    ap_log_rerror(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, r,
+		  "[mod_vhost_ldap.c]: loaded from ldap: "
+		  "apacheServerName: %s, "
+		  "apacheServerAdmin: %s, "
+		  "apacheDocumentRoot: %s, "
+		  "apacheScriptAlias: %s, "
+		  "apacheSuexecUid: %s, "
+		  "apacheSuexecGid: %s",
+		  reqc->name, reqc->admin, reqc->docroot, reqc->cgiroot, reqc->uid, reqc->gid);
+
+    if ((reqc->name == NULL)||(reqc->docroot == NULL)) {
+        ap_log_rerror(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, r, 
+                      "[mod_vhost_ldap.c] translate: "
+                      "translate failed; ServerName or DocumentRoot not defined");
+	return HTTP_INTERNAL_SERVER_ERROR;
+    }
+
+    if (reqc->uid != NULL) {
+	char *username;
+	char *userdir_val;
+	uid_t uid = (uid_t) atoll(reqc->uid);
+
+	if ((code = reconfigure_directive(r->pool, server, "UserDir", USERDIR)) != 0)
+	    return code;
+
+        /* Deal with ~ expansion */
+        if ((code = reconfigure_directive(r->pool, server, "UserDir", "disabled")) != 0)
+            return code;
+
+	if (apr_uid_name_get(&username, uid, r->pool) != APR_SUCCESS) {
+	    ap_log_rerror(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, r, 
+		          "could not get username for uid %d", uid);
+	    return HTTP_INTERNAL_SERVER_ERROR;
+	}
+
+        userdir_val = apr_pstrcat(r->pool, "enabled ", username, (const char *)NULL);
+
+	if ((code = reconfigure_directive(r->pool, server, "UserDir", userdir_val)) != 0)
+	    return code;
+    }
+
+    ap_fixup_virtual_host(r->pool, r->server, server);
+    r->server = server;
+
+    /* Hack to allow post-processing by other modules (mod_rewrite, mod_alias) */
+    return DECLINED;
+}
+
+#ifdef HAVE_UNIX_SUEXEC
+static ap_unix_identity_t *mod_vhost_ldap_get_suexec_id_doer(const request_rec * r)
+{
+  ap_unix_identity_t *ugid = NULL;
+  mod_vhost_ldap_config_t *conf = 
+      (mod_vhost_ldap_config_t *)ap_get_module_config(r->server->module_config,
+						      &vhost_ldap_module);
+  mod_vhost_ldap_request_t *req =
+      (mod_vhost_ldap_request_t *)ap_get_module_config(r->request_config,
+						       &vhost_ldap_module);
+
+  uid_t uid = -1;
+  gid_t gid = -1;
+
+  // mod_vhost_ldap is disabled or we don't have LDAP Url
+  if ((conf->enabled != MVL_ENABLED)||(!conf->have_ldap_url)) {
+      return NULL;
+  }
+
+  if ((req == NULL)||(req->uid == NULL)||(req->gid == NULL)) {
+      return NULL;
+  }
+
+  if ((ugid = apr_palloc(r->pool, sizeof(ap_unix_identity_t))) == NULL) {
+      return NULL;
+  }
+
+  uid = (uid_t)atoll(req->uid);
+  gid = (gid_t)atoll(req->gid);
+
+  if ((uid < MIN_UID)||(gid < MIN_GID)) {
+      return NULL;
+  }
+
+  ugid->uid = uid;
+  ugid->gid = gid;
+  ugid->userdir = 0;
+  
+  return ugid;
+}
+#endif
+
+static void
+mod_vhost_ldap_register_hooks (apr_pool_t * p)
+{
+
+    /*
+     * Run before mod_rewrite
+     */
+    static const char * const aszRewrite[]={ "mod_rewrite.c", NULL };
+
+    ap_hook_post_config(mod_vhost_ldap_post_config, NULL, NULL, APR_HOOK_MIDDLE);
+    ap_hook_translate_name(mod_vhost_ldap_translate_name, NULL, aszRewrite, APR_HOOK_FIRST);
+#ifdef HAVE_UNIX_SUEXEC
+    ap_hook_get_suexec_identity(mod_vhost_ldap_get_suexec_id_doer, NULL, NULL, APR_HOOK_MIDDLE);
+#endif
+#if (APR_MAJOR_VERSION >= 1)
+    ap_hook_optional_fn_retrieve(ImportULDAPOptFn,NULL,NULL,APR_HOOK_MIDDLE);
+#endif
+}
+
+module AP_MODULE_DECLARE_DATA vhost_ldap_module = {
+  STANDARD20_MODULE_STUFF,
+  NULL,
+  NULL,
+  mod_vhost_ldap_create_server_config,
+  mod_vhost_ldap_merge_server_config,
+  mod_vhost_ldap_cmds,
+  mod_vhost_ldap_register_hooks,
+};
Index: tags/fc15-eol/server/common/oursrc/httpdmods/mrproper
===================================================================
--- tags/fc15-eol/server/common/oursrc/httpdmods/mrproper	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/httpdmods/mrproper	(revision 2244)
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+rm -f configure config.* Makefile
+rm -rf auto*.cache
Index: tags/fc15-eol/server/common/oursrc/logview/Makefile.in
===================================================================
--- tags/fc15-eol/server/common/oursrc/logview/Makefile.in	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/logview/Makefile.in	(revision 2244)
@@ -0,0 +1,18 @@
+CC = @CC@
+CFLAGS = @CFLAGS@
+prefix = @prefix@
+exec_prefix = @exec_prefix@
+bindir = @bindir@
+
+all-local: logview
+
+install:
+	install -p -m755 -D logview $(DESTDIR)$(bindir)/logview
+	install -p -m755 -D logview.pl $(DESTDIR)$(bindir)/logview.pl
+
+clean:
+	rm -f logview
+
+distclean: clean
+	rm -f configure config.* Makefile
+	rm -rf auto*.cache
Index: tags/fc15-eol/server/common/oursrc/logview/configure.in
===================================================================
--- tags/fc15-eol/server/common/oursrc/logview/configure.in	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/logview/configure.in	(revision 2244)
@@ -0,0 +1,5 @@
+AC_INIT()
+
+AC_PROG_CC
+
+AC_OUTPUT(Makefile)
Index: tags/fc15-eol/server/common/oursrc/logview/logview.c
===================================================================
--- tags/fc15-eol/server/common/oursrc/logview/logview.c	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/logview/logview.c	(revision 2244)
@@ -0,0 +1,8 @@
+#include <unistd.h>
+
+#define REALPATH "/usr/local/bin/logview.pl"
+
+int main (int argc, char** argv)
+{
+  execv(REALPATH, argv);
+}
Index: tags/fc15-eol/server/common/oursrc/logview/logview.pl
===================================================================
--- tags/fc15-eol/server/common/oursrc/logview/logview.pl	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/logview/logview.pl	(revision 2244)
@@ -0,0 +1,12 @@
+#!/usr/bin/perl -T -w
+
+my $elogsrc = '/home/logview/error_log';
+# get by uid the caller's name to find the corresponding locker name
+my ($caller, $home) = (getpwuid($<))[0, 7];
+my $search = "$home/";
+
+print "--- Error logs for $caller ---\n";
+open FOO, '<', $elogsrc or die $!;
+while (<FOO>) {
+    print if index($_, $search) != -1;
+}
Index: tags/fc15-eol/server/common/oursrc/logview/mrproper
===================================================================
--- tags/fc15-eol/server/common/oursrc/logview/mrproper	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/logview/mrproper	(revision 2244)
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+rm -f logview
+rm -f configure config.* Makefile
+rm -rf auto*.cache
Index: tags/fc15-eol/server/common/oursrc/nss_nonlocal/COPYING.LESSER
===================================================================
--- tags/fc15-eol/server/common/oursrc/nss_nonlocal/COPYING.LESSER	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/nss_nonlocal/COPYING.LESSER	(revision 2244)
@@ -0,0 +1,511 @@
+                  GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 2.1, February 1999
+
+ Copyright (C) 1991, 1999 Free Software Foundation, Inc.
+ 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+[This is the first released version of the Lesser GPL.  It also counts
+ as the successor of the GNU Library Public License, version 2, hence
+ the version number 2.1.]
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+Licenses are intended to guarantee your freedom to share and change
+free software--to make sure the software is free for all its users.
+
+  This license, the Lesser General Public License, applies to some
+specially designated software packages--typically libraries--of the
+Free Software Foundation and other authors who decide to use it.  You
+can use it too, but we suggest you first think carefully about whether
+this license or the ordinary General Public License is the better
+strategy to use in any particular case, based on the explanations below.
+
+  When we speak of free software, we are referring to freedom of use,
+not price.  Our General Public Licenses are designed to make sure that
+you have the freedom to distribute copies of free software (and charge
+for this service if you wish); that you receive source code or can get
+it if you want it; that you can change the software and use pieces of
+it in new free programs; and that you are informed that you can do
+these things.
+
+  To protect your rights, we need to make restrictions that forbid
+distributors to deny you these rights or to ask you to surrender these
+rights.  These restrictions translate to certain responsibilities for
+you if you distribute copies of the library or if you modify it.
+
+  For example, if you distribute copies of the library, whether gratis
+or for a fee, you must give the recipients all the rights that we gave
+you.  You must make sure that they, too, receive or can get the source
+code.  If you link other code with the library, you must provide
+complete object files to the recipients, so that they can relink them
+with the library after making changes to the library and recompiling
+it.  And you must show them these terms so they know their rights.
+
+  We protect your rights with a two-step method: (1) we copyright the
+library, and (2) we offer you this license, which gives you legal
+permission to copy, distribute and/or modify the library.
+
+  To protect each distributor, we want to make it very clear that
+there is no warranty for the free library.  Also, if the library is
+modified by someone else and passed on, the recipients should know
+that what they have is not the original version, so that the original
+author's reputation will not be affected by problems that might be
+introduced by others.
+
+
+  Finally, software patents pose a constant threat to the existence of
+any free program.  We wish to make sure that a company cannot
+effectively restrict the users of a free program by obtaining a
+restrictive license from a patent holder.  Therefore, we insist that
+any patent license obtained for a version of the library must be
+consistent with the full freedom of use specified in this license.
+
+  Most GNU software, including some libraries, is covered by the
+ordinary GNU General Public License.  This license, the GNU Lesser
+General Public License, applies to certain designated libraries, and
+is quite different from the ordinary General Public License.  We use
+this license for certain libraries in order to permit linking those
+libraries into non-free programs.
+
+  When a program is linked with a library, whether statically or using
+a shared library, the combination of the two is legally speaking a
+combined work, a derivative of the original library.  The ordinary
+General Public License therefore permits such linking only if the
+entire combination fits its criteria of freedom.  The Lesser General
+Public License permits more lax criteria for linking other code with
+the library.
+
+  We call this license the "Lesser" General Public License because it
+does Less to protect the user's freedom than the ordinary General
+Public License.  It also provides other free software developers Less
+of an advantage over competing non-free programs.  These disadvantages
+are the reason we use the ordinary General Public License for many
+libraries.  However, the Lesser license provides advantages in certain
+special circumstances.
+
+  For example, on rare occasions, there may be a special need to
+encourage the widest possible use of a certain library, so that it becomes
+a de-facto standard.  To achieve this, non-free programs must be
+allowed to use the library.  A more frequent case is that a free
+library does the same job as widely used non-free libraries.  In this
+case, there is little to gain by limiting the free library to free
+software only, so we use the Lesser General Public License.
+
+  In other cases, permission to use a particular library in non-free
+programs enables a greater number of people to use a large body of
+free software.  For example, permission to use the GNU C Library in
+non-free programs enables many more people to use the whole GNU
+operating system, as well as its variant, the GNU/Linux operating
+system.
+
+  Although the Lesser General Public License is Less protective of the
+users' freedom, it does ensure that the user of a program that is
+linked with the Library has the freedom and the wherewithal to run
+that program using a modified version of the Library.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.  Pay close attention to the difference between a
+"work based on the library" and a "work that uses the library".  The
+former contains code derived from the library, whereas the latter must
+be combined with the library in order to run.
+
+
+                  GNU LESSER GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License Agreement applies to any software library or other
+program which contains a notice placed by the copyright holder or
+other authorized party saying it may be distributed under the terms of
+this Lesser General Public License (also called "this License").
+Each licensee is addressed as "you".
+
+  A "library" means a collection of software functions and/or data
+prepared so as to be conveniently linked with application programs
+(which use some of those functions and data) to form executables.
+
+  The "Library", below, refers to any such software library or work
+which has been distributed under these terms.  A "work based on the
+Library" means either the Library or any derivative work under
+copyright law: that is to say, a work containing the Library or a
+portion of it, either verbatim or with modifications and/or translated
+straightforwardly into another language.  (Hereinafter, translation is
+included without limitation in the term "modification".)
+
+  "Source code" for a work means the preferred form of the work for
+making modifications to it.  For a library, complete source code means
+all the source code for all modules it contains, plus any associated
+interface definition files, plus the scripts used to control compilation
+and installation of the library.
+
+  Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running a program using the Library is not restricted, and output from
+such a program is covered only if its contents constitute a work based
+on the Library (independent of the use of the Library in a tool for
+writing it).  Whether that is true depends on what the Library does
+and what the program that uses the Library does.
+
+  1. You may copy and distribute verbatim copies of the Library's
+complete source code as you receive it, in any medium, provided that
+you conspicuously and appropriately publish on each copy an
+appropriate copyright notice and disclaimer of warranty; keep intact
+all the notices that refer to this License and to the absence of any
+warranty; and distribute a copy of this License along with the
+Library.
+
+  You may charge a fee for the physical act of transferring a copy,
+and you may at your option offer warranty protection in exchange for a
+fee.
+
+
+  2. You may modify your copy or copies of the Library or any portion
+of it, thus forming a work based on the Library, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) The modified work must itself be a software library.
+
+    b) You must cause the files modified to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    c) You must cause the whole of the work to be licensed at no
+    charge to all third parties under the terms of this License.
+
+    d) If a facility in the modified Library refers to a function or a
+    table of data to be supplied by an application program that uses
+    the facility, other than as an argument passed when the facility
+    is invoked, then you must make a good faith effort to ensure that,
+    in the event an application does not supply such function or
+    table, the facility still operates, and performs whatever part of
+    its purpose remains meaningful.
+
+    (For example, a function in a library to compute square roots has
+    a purpose that is entirely well-defined independent of the
+    application.  Therefore, Subsection 2d requires that any
+    application-supplied function or table used by this function must
+    be optional: if the application does not supply it, the square
+    root function must still compute square roots.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Library,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Library, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote
+it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Library.
+
+In addition, mere aggregation of another work not based on the Library
+with the Library (or with a work based on the Library) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may opt to apply the terms of the ordinary GNU General Public
+License instead of this License to a given copy of the Library.  To do
+this, you must alter all the notices that refer to this License, so
+that they refer to the ordinary GNU General Public License, version 2,
+instead of to this License.  (If a newer version than version 2 of the
+ordinary GNU General Public License has appeared, then you can specify
+that version instead if you wish.)  Do not make any other change in
+these notices.
+
+
+  Once this change is made in a given copy, it is irreversible for
+that copy, so the ordinary GNU General Public License applies to all
+subsequent copies and derivative works made from that copy.
+
+  This option is useful when you wish to copy part of the code of
+the Library into a program that is not a library.
+
+  4. You may copy and distribute the Library (or a portion or
+derivative of it, under Section 2) in object code or executable form
+under the terms of Sections 1 and 2 above provided that you accompany
+it with the complete corresponding machine-readable source code, which
+must be distributed under the terms of Sections 1 and 2 above on a
+medium customarily used for software interchange.
+
+  If distribution of object code is made by offering access to copy
+from a designated place, then offering equivalent access to copy the
+source code from the same place satisfies the requirement to
+distribute the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  5. A program that contains no derivative of any portion of the
+Library, but is designed to work with the Library by being compiled or
+linked with it, is called a "work that uses the Library".  Such a
+work, in isolation, is not a derivative work of the Library, and
+therefore falls outside the scope of this License.
+
+  However, linking a "work that uses the Library" with the Library
+creates an executable that is a derivative of the Library (because it
+contains portions of the Library), rather than a "work that uses the
+library".  The executable is therefore covered by this License.
+Section 6 states terms for distribution of such executables.
+
+  When a "work that uses the Library" uses material from a header file
+that is part of the Library, the object code for the work may be a
+derivative work of the Library even though the source code is not.
+Whether this is true is especially significant if the work can be
+linked without the Library, or if the work is itself a library.  The
+threshold for this to be true is not precisely defined by law.
+
+  If such an object file uses only numerical parameters, data
+structure layouts and accessors, and small macros and small inline
+functions (ten lines or less in length), then the use of the object
+file is unrestricted, regardless of whether it is legally a derivative
+work.  (Executables containing this object code plus portions of the
+Library will still fall under Section 6.)
+
+  Otherwise, if the work is a derivative of the Library, you may
+distribute the object code for the work under the terms of Section 6.
+Any executables containing that work also fall under Section 6,
+whether or not they are linked directly with the Library itself.
+
+
+  6. As an exception to the Sections above, you may also combine or
+link a "work that uses the Library" with the Library to produce a
+work containing portions of the Library, and distribute that work
+under terms of your choice, provided that the terms permit
+modification of the work for the customer's own use and reverse
+engineering for debugging such modifications.
+
+  You must give prominent notice with each copy of the work that the
+Library is used in it and that the Library and its use are covered by
+this License.  You must supply a copy of this License.  If the work
+during execution displays copyright notices, you must include the
+copyright notice for the Library among them, as well as a reference
+directing the user to the copy of this License.  Also, you must do one
+of these things:
+
+    a) Accompany the work with the complete corresponding
+    machine-readable source code for the Library including whatever
+    changes were used in the work (which must be distributed under
+    Sections 1 and 2 above); and, if the work is an executable linked
+    with the Library, with the complete machine-readable "work that
+    uses the Library", as object code and/or source code, so that the
+    user can modify the Library and then relink to produce a modified
+    executable containing the modified Library.  (It is understood
+    that the user who changes the contents of definitions files in the
+    Library will not necessarily be able to recompile the application
+    to use the modified definitions.)
+
+    b) Use a suitable shared library mechanism for linking with the
+    Library.  A suitable mechanism is one that (1) uses at run time a
+    copy of the library already present on the user's computer system,
+    rather than copying library functions into the executable, and (2)
+    will operate properly with a modified version of the library, if
+    the user installs one, as long as the modified version is
+    interface-compatible with the version that the work was made with.
+
+    c) Accompany the work with a written offer, valid for at
+    least three years, to give the same user the materials
+    specified in Subsection 6a, above, for a charge no more
+    than the cost of performing this distribution.
+
+    d) If distribution of the work is made by offering access to copy
+    from a designated place, offer equivalent access to copy the above
+    specified materials from the same place.
+
+    e) Verify that the user has already received a copy of these
+    materials or that you have already sent this user a copy.
+
+  For an executable, the required form of the "work that uses the
+Library" must include any data and utility programs needed for
+reproducing the executable from it.  However, as a special exception,
+the materials to be distributed need not include anything that is
+normally distributed (in either source or binary form) with the major
+components (compiler, kernel, and so on) of the operating system on
+which the executable runs, unless that component itself accompanies
+the executable.
+
+  It may happen that this requirement contradicts the license
+restrictions of other proprietary libraries that do not normally
+accompany the operating system.  Such a contradiction means you cannot
+use both them and the Library together in an executable that you
+distribute.
+
+
+  7. You may place library facilities that are a work based on the
+Library side-by-side in a single library together with other library
+facilities not covered by this License, and distribute such a combined
+library, provided that the separate distribution of the work based on
+the Library and of the other library facilities is otherwise
+permitted, and provided that you do these two things:
+
+    a) Accompany the combined library with a copy of the same work
+    based on the Library, uncombined with any other library
+    facilities.  This must be distributed under the terms of the
+    Sections above.
+
+    b) Give prominent notice with the combined library of the fact
+    that part of it is a work based on the Library, and explaining
+    where to find the accompanying uncombined form of the same work.
+
+  8. You may not copy, modify, sublicense, link with, or distribute
+the Library except as expressly provided under this License.  Any
+attempt otherwise to copy, modify, sublicense, link with, or
+distribute the Library is void, and will automatically terminate your
+rights under this License.  However, parties who have received copies,
+or rights, from you under this License will not have their licenses
+terminated so long as such parties remain in full compliance.
+
+  9. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Library or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Library (or any work based on the
+Library), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Library or works based on it.
+
+  10. Each time you redistribute the Library (or any work based on the
+Library), the recipient automatically receives a license from the
+original licensor to copy, distribute, link with or modify the Library
+subject to these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties with
+this License.
+
+
+  11. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Library at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Library by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Library.
+
+If any portion of this section is held invalid or unenforceable under any
+particular circumstance, the balance of the section is intended to apply,
+and the section as a whole is intended to apply in other circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  12. If the distribution and/or use of the Library is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Library under this License may add
+an explicit geographical distribution limitation excluding those countries,
+so that distribution is permitted only in or among countries not thus
+excluded.  In such case, this License incorporates the limitation as if
+written in the body of this License.
+
+  13. The Free Software Foundation may publish revised and/or new
+versions of the Lesser General Public License from time to time.
+Such new versions will be similar in spirit to the present version,
+but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Library
+specifies a version number of this License which applies to it and
+"any later version", you have the option of following the terms and
+conditions either of that version or of any later version published by
+the Free Software Foundation.  If the Library does not specify a
+license version number, you may choose any version ever published by
+the Free Software Foundation.
+
+
+  14. If you wish to incorporate parts of the Library into other free
+programs whose distribution conditions are incompatible with these,
+write to the author to ask for permission.  For software which is
+copyrighted by the Free Software Foundation, write to the Free
+Software Foundation; we sometimes make exceptions for this.  Our
+decision will be guided by the two goals of preserving the free status
+of all derivatives of our free software and of promoting the sharing
+and reuse of software generally.
+
+                            NO WARRANTY
+
+  15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
+WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
+OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
+KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
+LIBRARY IS WITH YOU.  SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
+THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
+WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
+AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
+FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
+CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
+LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
+RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
+FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
+SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
+
+
+           How to Apply These Terms to Your New Libraries
+
+  If you develop a new library, and you want it to be of the greatest
+possible use to the public, we recommend making it free software that
+everyone can redistribute and change.  You can do so by permitting
+redistribution under these terms (or, alternatively, under the terms of the
+ordinary General Public License).
+
+  To apply these terms, attach the following notices to the library.  It is
+safest to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least the
+"copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the library's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Lesser General Public License for more details.
+
+    You should have received a copy of the GNU Lesser General Public
+    License along with this library; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+Also add information on how to contact you by electronic and paper mail.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the library, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the
+  library `Frob' (a library for tweaking knobs) written by James Random Hacker.
+
+  <signature of Ty Coon>, 1 April 1990
+  Ty Coon, President of Vice
+
+That's all there is to it!
Index: tags/fc15-eol/server/common/oursrc/nss_nonlocal/Makefile.am
===================================================================
--- tags/fc15-eol/server/common/oursrc/nss_nonlocal/Makefile.am	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/nss_nonlocal/Makefile.am	(revision 2244)
@@ -0,0 +1,12 @@
+lib_LTLIBRARIES = libnss_nonlocal.la
+libnss_nonlocal_la_SOURCES = \
+    nonlocal-passwd.c nonlocal-group.c nonlocal-shadow.c \
+    nonlocal.h nsswitch-internal.h
+libnss_nonlocal_la_LDFLAGS = \
+    -version-info 2:0:0 \
+    -export-symbols-regex '^_nss_nonlocal_' \
+    -no-undefined -Wl,-z,defs
+
+install-exec-hook:
+	rm -f $(DESTDIR)$(libdir)/libnss_nonlocal.so
+	rm -f $(DESTDIR)$(libdir)/libnss_nonlocal.la
Index: tags/fc15-eol/server/common/oursrc/nss_nonlocal/README
===================================================================
--- tags/fc15-eol/server/common/oursrc/nss_nonlocal/README	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/nss_nonlocal/README	(revision 2244)
@@ -0,0 +1,43 @@
+This is nss_nonlocal, an nsswitch module that acts as a proxy for other 
+nsswitch modules like hesiod, but prevents non-local users from 
+potentially gaining local privileges by spoofing local UIDs and GIDs.
+
+To use it, configure /etc/nsswitch.conf as follows:
+
+passwd:         compat nonlocal
+passwd_nonlocal: hesiod
+group:          compat nonlocal
+group_nonlocal: hesiod
+
+The module also assigns special properties to two local groups and one
+local user, if they exist:
+
+• If the local group ‘nss-nonlocal-users’ exists, then nonlocal users
+  will be automatically added to it.  Furthermore, if a local user is
+  added to this group, then that user will inherit any nonlocal gids
+  from a nonlocal user of the same name, as supplementary gids.
+
+• If the local group ‘nss-local-users’ exists, then local users will
+  be automatically added to it.
+
+• If the local user ‘nss-nonlocal-users’ is added to a local group,
+  then the local group will inherit the nonlocal membership of a group
+  of the same gid.
+
+Copyright © 2007–2010 Anders Kaseorg <andersk@mit.edu> and Tim Abbott
+<tabbott@mit.edu>
+
+nss_nonlocal is free software; you can redistribute it and/or modify
+it under the terms of the GNU Lesser General Public License as
+published by the Free Software Foundation; either version 2.1 of the
+License, or (at your option) any later version.
+
+nss_nonlocal is distributed in the hope that it will be useful, but
+WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+Lesser General Public License for more details.
+
+You should have received a copy of the GNU Lesser General Public
+License along with nss_nonlocal; if not, write to the Free Software
+Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+02110-1301  USA
Index: tags/fc15-eol/server/common/oursrc/nss_nonlocal/configure.ac
===================================================================
--- tags/fc15-eol/server/common/oursrc/nss_nonlocal/configure.ac	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/nss_nonlocal/configure.ac	(revision 2244)
@@ -0,0 +1,23 @@
+AC_INIT([nss_nonlocal], [2.0], [andersk@mit.edu])
+AC_CANONICAL_TARGET
+AM_INIT_AUTOMAKE([-Wall -Werror foreign])
+m4_ifdef([AM_SILENT_RULES],[AM_SILENT_RULES([yes])])
+
+AC_PREFIX_DEFAULT([/])
+AC_DISABLE_STATIC
+AC_PROG_CC
+AC_PROG_INSTALL
+AC_PROG_LIBTOOL
+
+AC_HEADER_STDBOOL
+
+case "$target_cpu" in
+    i386 | i486 | i586 | i686 | i786)
+	AC_DEFINE([USE_REGPARMS], [],
+	          [Define if the regparm attribute shall be used for local functions (gcc on ix86 only).])
+ 	;;
+esac
+
+AC_CONFIG_HEADERS([config.h])
+AC_CONFIG_FILES([Makefile])
+AC_OUTPUT
Index: tags/fc15-eol/server/common/oursrc/nss_nonlocal/nonlocal-group.c
===================================================================
--- tags/fc15-eol/server/common/oursrc/nss_nonlocal/nonlocal-group.c	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/nss_nonlocal/nonlocal-group.c	(revision 2244)
@@ -0,0 +1,472 @@
+/*
+ * nonlocal-group.c
+ * group database for nss_nonlocal proxy
+ *
+ * Copyright © 2007–2010 Anders Kaseorg <andersk@mit.edu> and Tim
+ * Abbott <tabbott@mit.edu>
+ *
+ * This file is part of nss_nonlocal.
+ *
+ * nss_nonlocal is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * nss_nonlocal is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with nss_nonlocal; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301  USA
+ */
+
+#define _GNU_SOURCE
+#include <sys/types.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <dlfcn.h>
+#include <stdio.h>
+#include <syslog.h>
+#include <errno.h>
+#include <pwd.h>
+#include <grp.h>
+#include <nss.h>
+#include "nsswitch-internal.h"
+#include "nonlocal.h"
+
+/*
+ * If the MAGIC_NONLOCAL_GROUPNAME local group exists, then nonlocal
+ * users will be automatically added to it.  Furthermore, if a local
+ * user is added to this group, then that user will inherit any
+ * nonlocal gids from a nonlocal user of the same name, as
+ * supplementary gids.
+ */
+#define MAGIC_NONLOCAL_GROUPNAME "nss-nonlocal-users"
+
+/*
+ * If the MAGIC_LOCAL_GROUPNAME local group exists, then local users
+ * will be automatically added to it.
+ */
+#define MAGIC_LOCAL_GROUPNAME "nss-local-users"
+
+/*
+ * If the MAGIC_NONLOCAL_USERNAME local user is added to a local
+ * group, then the local group will inherit the nonlocal membership of
+ * a group of the same gid.
+ */
+#define MAGIC_NONLOCAL_USERNAME "nss-nonlocal-users"
+
+
+enum nss_status
+_nss_nonlocal_getgrnam_r(const char *name, struct group *grp,
+			 char *buffer, size_t buflen, int *errnop);
+
+enum nss_status
+_nss_nonlocal_getgrgid_r(gid_t gid, struct group *grp,
+			 char *buffer, size_t buflen, int *errnop);
+
+
+static service_user *__nss_group_nonlocal_database;
+
+static int
+internal_function
+__nss_group_nonlocal_lookup(service_user **ni, const char *fct_name,
+			    void **fctp)
+{
+    if (__nss_group_nonlocal_database == NULL
+	&& __nss_database_lookup("group_nonlocal", NULL, NULL,
+				 &__nss_group_nonlocal_database) < 0)
+	return -1;
+
+    *ni = __nss_group_nonlocal_database;
+
+    *fctp = __nss_lookup_function(*ni, fct_name);
+    return 0;
+}
+
+
+enum nss_status
+check_nonlocal_gid(const char *user, const char *group, gid_t gid, int *errnop)
+{
+    enum nss_status status;
+    struct group gbuf;
+    char *buf;
+    size_t buflen = sysconf(_SC_GETGR_R_SIZE_MAX);
+    const struct walk_nss w = {
+	.lookup = &__nss_group_lookup, .fct_name = "getgrgid_r",
+	.status = &status, .errnop = errnop, .buf = &buf, .buflen = &buflen
+    };
+    const __typeof__(&_nss_nonlocal_getgrgid_r) self = &_nss_nonlocal_getgrgid_r;
+#define args (gid, &gbuf, buf, buflen, errnop)
+#include "walk_nss.h"
+#undef args
+
+    if (status == NSS_STATUS_TRYAGAIN)
+	return status;
+    else if (status != NSS_STATUS_SUCCESS)
+	return NSS_STATUS_SUCCESS;
+
+    if (group == NULL || strcmp(gbuf.gr_name, group) == 0) {
+	char *const *mem;
+	for (mem = gbuf.gr_mem; *mem != NULL; mem++)
+	    if (strcmp(*mem, MAGIC_NONLOCAL_USERNAME) == 0) {
+		status = check_nonlocal_user(*mem, errnop);
+		if (status == NSS_STATUS_TRYAGAIN) {
+		    free(buf);
+		    return status;
+		} else if (status == NSS_STATUS_NOTFOUND) {
+		    free(buf);
+		    return NSS_STATUS_SUCCESS;
+		}
+		break;
+	    }
+    }
+
+    syslog(LOG_DEBUG, "nss_nonlocal: removing local group %u (%s) from non-local user %s\n", gbuf.gr_gid, gbuf.gr_name, user);
+    free(buf);
+    return NSS_STATUS_NOTFOUND;
+}
+
+enum nss_status
+check_nonlocal_group(const char *user, struct group *grp, int *errnop)
+{
+    enum nss_status status = NSS_STATUS_SUCCESS;
+    int old_errno = errno;
+    char *end;
+    unsigned long gid;
+
+    errno = 0;
+    gid = strtoul(grp->gr_name, &end, 10);
+    if (errno == 0 && *end == '\0' && (gid_t)gid == gid) {
+	errno = old_errno;
+	status = check_nonlocal_gid(user, grp->gr_name, gid, errnop);
+    } else
+	errno = old_errno;
+    if (status != NSS_STATUS_SUCCESS)
+	return status;
+
+    return check_nonlocal_gid(user, grp->gr_name, grp->gr_gid, errnop);
+}
+
+enum nss_status
+get_local_group(const char *name, struct group *grp, char **buffer, int *errnop)
+{
+    enum nss_status status;
+    size_t buflen = sysconf(_SC_GETGR_R_SIZE_MAX);
+    const struct walk_nss w = {
+	.lookup = &__nss_group_lookup, .fct_name = "getgrnam_r",
+	.status = &status, .errnop = errnop, .buf = buffer, .buflen = &buflen
+    };
+    const __typeof__(&_nss_nonlocal_getgrnam_r) self = &_nss_nonlocal_getgrnam_r;
+#define args (name, grp, *buffer, buflen, errnop)
+#include "walk_nss.h"
+#undef args
+    return status;
+}
+
+static service_user *grent_startp, *grent_nip;
+static void *grent_fct_start;
+static union {
+    enum nss_status (*l)(struct group *grp, char *buffer, size_t buflen,
+			 int *errnop);
+    void *ptr;
+} grent_fct;
+static const char *grent_fct_name = "getgrent_r";
+
+enum nss_status
+_nss_nonlocal_setgrent(int stayopen)
+{
+    enum nss_status status;
+    const struct walk_nss w = {
+	.lookup = &__nss_group_nonlocal_lookup, .fct_name = "setgrent",
+	.status = &status
+    };
+    const __typeof__(&_nss_nonlocal_setgrent) self = NULL;
+#define args (stayopen)
+#include "walk_nss.h"
+#undef args
+    if (status != NSS_STATUS_SUCCESS)
+	return status;
+
+    if (grent_fct_start == NULL)
+	__nss_group_nonlocal_lookup(&grent_startp, grent_fct_name,
+				    &grent_fct_start);
+    grent_nip = grent_startp;
+    grent_fct.ptr = grent_fct_start;
+    return NSS_STATUS_SUCCESS;
+}
+
+enum nss_status
+_nss_nonlocal_endgrent(void)
+{
+    enum nss_status status;
+    const struct walk_nss w = {
+	.lookup = &__nss_group_nonlocal_lookup, .fct_name = "endgrent",
+	.status = &status
+    };
+    const __typeof__(&_nss_nonlocal_endgrent) self = NULL;
+
+    grent_nip = NULL;
+
+#define args ()
+#include "walk_nss.h"
+#undef args
+    return status;
+}
+
+enum nss_status
+_nss_nonlocal_getgrent_r(struct group *grp, char *buffer, size_t buflen,
+			 int *errnop)
+{
+    enum nss_status status;
+
+    char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
+    if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
+	return NSS_STATUS_UNAVAIL;
+
+    if (grent_nip == NULL) {
+	status = _nss_nonlocal_setgrent(0);
+	if (status != NSS_STATUS_SUCCESS)
+	    return status;
+    }
+    do {
+	if (grent_fct.ptr == NULL)
+	    status = NSS_STATUS_UNAVAIL;
+	else {
+	    int nonlocal_errno;
+	    do
+		status = DL_CALL_FCT(grent_fct.l, (grp, buffer, buflen, errnop));
+	    while (status == NSS_STATUS_SUCCESS &&
+		   check_nonlocal_group("(unknown)", grp, &nonlocal_errno) != NSS_STATUS_SUCCESS);
+	}
+	if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE)
+	    return status;
+
+	if (status == NSS_STATUS_SUCCESS)
+	    return NSS_STATUS_SUCCESS;
+    } while (__nss_next(&grent_nip, grent_fct_name, &grent_fct.ptr, status, 0) == 0);
+
+    grent_nip = NULL;
+    return NSS_STATUS_NOTFOUND;
+}
+
+
+enum nss_status
+_nss_nonlocal_getgrnam_r(const char *name, struct group *grp,
+			 char *buffer, size_t buflen, int *errnop)
+{
+    enum nss_status status;
+    const struct walk_nss w = {
+	.lookup = &__nss_group_nonlocal_lookup, .fct_name = "getgrnam_r",
+	.status = &status, .errnop = errnop
+    };
+    const __typeof__(&_nss_nonlocal_getgrnam_r) self = NULL;
+
+    char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
+    if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
+	return NSS_STATUS_UNAVAIL;
+
+#define args (name, grp, buffer, buflen, errnop)
+#include "walk_nss.h"
+#undef args
+    if (status != NSS_STATUS_SUCCESS)
+	return status;
+
+    if (strcmp(name, grp->gr_name) != 0) {
+	syslog(LOG_ERR, "nss_nonlocal: discarding group %s from lookup for group %s\n", grp->gr_name, name);
+	return NSS_STATUS_NOTFOUND;
+    }
+
+    return check_nonlocal_group(name, grp, errnop);
+}
+
+enum nss_status
+_nss_nonlocal_getgrgid_r(gid_t gid, struct group *grp,
+			 char *buffer, size_t buflen, int *errnop)
+{
+    enum nss_status status;
+    const struct walk_nss w = {
+	.lookup = &__nss_group_nonlocal_lookup, .fct_name = "getgrgid_r",
+	.status = &status, .errnop = errnop
+    };
+    const __typeof__(&_nss_nonlocal_getgrgid_r) self = NULL;
+
+    char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
+    if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
+	return NSS_STATUS_UNAVAIL;
+
+#define args (gid, grp, buffer, buflen, errnop)
+#include "walk_nss.h"
+#undef args
+    if (status != NSS_STATUS_SUCCESS)
+	return status;
+
+    if (gid != grp->gr_gid) {
+	syslog(LOG_ERR, "nss_nonlocal: discarding gid %d from lookup for gid %d\n", grp->gr_gid, gid);
+	return NSS_STATUS_NOTFOUND;
+    }
+
+    return check_nonlocal_group(grp->gr_name, grp, errnop);
+}
+
+static bool
+add_group(gid_t group, long int *start, long int *size, gid_t **groupsp,
+	  long int limit, int *errnop, enum nss_status *status)
+{
+    int i, old_errno = errno;
+    for (i = 0; i < *start; ++i)
+	if ((*groupsp)[i] == group)
+	    return true;
+    if (*start + 1 > *size) {
+	gid_t *newgroups;
+	long int newsize = 2 * *size;
+	if (limit > 0) {
+	    if (*size >= limit) {
+		*status = NSS_STATUS_SUCCESS;
+		return false;
+	    }
+	    if (newsize > limit)
+		newsize = limit;
+	}
+	newgroups = realloc(*groupsp, newsize * sizeof((*groupsp)[0]));
+	errno = old_errno;
+	if (newgroups == NULL) {
+	    *errnop = ENOMEM;
+	    *status = NSS_STATUS_TRYAGAIN;
+	    return false;
+	}
+	*groupsp = newgroups;
+	*size = newsize;
+    }
+    (*groupsp)[(*start)++] = group;
+    return true;
+}
+
+enum nss_status
+_nss_nonlocal_initgroups_dyn(const char *user, gid_t group, long int *start,
+			     long int *size, gid_t **groupsp, long int limit,
+			     int *errnop)
+{
+    enum nss_status status;
+    const struct walk_nss w = {
+	.lookup = &__nss_group_nonlocal_lookup, .fct_name = "initgroups_dyn",
+	.status = &status, .errnop = errnop
+    };
+    const __typeof__(&_nss_nonlocal_initgroups_dyn) self = NULL;
+
+    struct group local_users_group, nonlocal_users_group;
+    bool is_nonlocal = true;
+    char *buffer;
+    int in, out, i;
+
+    /* Check that the user is a nonlocal user, or a member of the
+     * MAGIC_NONLOCAL_GROUPNAME group, before adding any groups. */
+    status = check_nonlocal_user(user, errnop);
+    if (status == NSS_STATUS_TRYAGAIN) {
+	return status;
+    } else if (status != NSS_STATUS_SUCCESS) {
+	is_nonlocal = false;
+
+	status = get_local_group(MAGIC_LOCAL_GROUPNAME,
+				 &local_users_group, &buffer, errnop);
+	if (status == NSS_STATUS_SUCCESS) {
+	    free(buffer);
+	    if (!add_group(local_users_group.gr_gid, start, size, groupsp,
+			   limit, errnop, &status))
+		return status;
+	} else if (status == NSS_STATUS_TRYAGAIN) {
+	    return status;
+	} else {
+	    syslog(LOG_WARNING,
+		   "nss_nonlocal: Group %s does not exist locally!",
+		   MAGIC_LOCAL_GROUPNAME);
+	}
+    }
+
+    status = get_local_group(MAGIC_NONLOCAL_GROUPNAME,
+			     &nonlocal_users_group, &buffer, errnop);
+    if (status == NSS_STATUS_SUCCESS) {
+	free(buffer);
+	if (is_nonlocal) {
+	    if (!add_group(nonlocal_users_group.gr_gid, start, size, groupsp,
+			   limit, errnop, &status))
+		return status;
+	} else {
+	    int i;
+	    for (i = 0; i < *start; ++i) {
+		if ((*groupsp)[i] == nonlocal_users_group.gr_gid) {
+		    is_nonlocal = true;
+		    break;
+		}
+	    }
+
+	    if (is_nonlocal) {
+		struct passwd pwbuf;
+		char *buf;
+		int nonlocal_errno = *errnop;
+		status = get_nonlocal_passwd(user, &pwbuf, &buf, errnop);
+
+		if (status == NSS_STATUS_SUCCESS) {
+		    nonlocal_errno = *errnop;
+		    status = check_nonlocal_gid(user, NULL, pwbuf.pw_gid,
+						&nonlocal_errno);
+		    free(buf);
+		}
+
+		if (status == NSS_STATUS_SUCCESS) {
+		    if (!add_group(pwbuf.pw_gid, start, size, groupsp, limit,
+				   errnop, &status))
+			return status;
+		} else if (status == NSS_STATUS_TRYAGAIN) {
+		    *errnop = nonlocal_errno;
+		    return status;
+		}
+	    }
+	}
+    } else if (status == NSS_STATUS_TRYAGAIN) {
+	if (is_nonlocal)
+	    return status;
+    } else {
+	syslog(LOG_WARNING, "nss_nonlocal: Group %s does not exist locally!",
+	       MAGIC_NONLOCAL_GROUPNAME);
+    }
+
+    if (!is_nonlocal)
+	return NSS_STATUS_SUCCESS;
+
+    in = out = *start;
+
+#define args (user, group, start, size, groupsp, limit, errnop)
+#include "walk_nss.h"
+#undef args
+    if (status != NSS_STATUS_SUCCESS)
+        return status;
+
+    for (; in < *start; ++in) {
+	int nonlocal_errno = *errnop;
+
+	for (i = 0; i < out; ++i)
+	    if ((*groupsp)[i] == (*groupsp)[in])
+		break;
+	if (i < out)
+	    continue;
+
+	status = check_nonlocal_gid(user, NULL, (*groupsp)[in],
+				    &nonlocal_errno);
+	if (status == NSS_STATUS_SUCCESS) {
+	    (*groupsp)[out++] = (*groupsp)[in];
+	} else if (status == NSS_STATUS_TRYAGAIN) {
+	    *start = out;
+	    *errnop = nonlocal_errno;
+	    return status;
+	}
+    }
+
+    *start = out;
+    return NSS_STATUS_SUCCESS;
+}
Index: tags/fc15-eol/server/common/oursrc/nss_nonlocal/nonlocal-passwd.c
===================================================================
--- tags/fc15-eol/server/common/oursrc/nss_nonlocal/nonlocal-passwd.c	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/nss_nonlocal/nonlocal-passwd.c	(revision 2244)
@@ -0,0 +1,323 @@
+/*
+ * nonlocal-passwd.c
+ * passwd database for nss_nonlocal proxy.
+ *
+ * Copyright © 2007–2010 Anders Kaseorg <andersk@mit.edu> and Tim
+ * Abbott <tabbott@mit.edu>
+ *
+ * This file is part of nss_nonlocal.
+ *
+ * nss_nonlocal is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * nss_nonlocal is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with nss_nonlocal; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301  USA
+ */
+
+
+#define _GNU_SOURCE
+#include <sys/types.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <dlfcn.h>
+#include <stdio.h>
+#include <syslog.h>
+#include <errno.h>
+#include <pwd.h>
+#include <grp.h>
+#include <nss.h>
+#include "nsswitch-internal.h"
+#include "nonlocal.h"
+
+
+enum nss_status
+_nss_nonlocal_getpwuid_r(uid_t uid, struct passwd *pwd,
+			 char *buffer, size_t buflen, int *errnop);
+enum nss_status
+_nss_nonlocal_getpwnam_r(const char *name, struct passwd *pwd,
+			 char *buffer, size_t buflen, int *errnop);
+
+
+static service_user *__nss_passwd_nonlocal_database;
+
+static int
+internal_function
+__nss_passwd_nonlocal_lookup(service_user **ni, const char *fct_name,
+			     void **fctp)
+{
+    if (__nss_passwd_nonlocal_database == NULL
+	&& __nss_database_lookup("passwd_nonlocal", NULL, NULL,
+				 &__nss_passwd_nonlocal_database) < 0)
+	return -1;
+
+    *ni = __nss_passwd_nonlocal_database;
+
+    *fctp = __nss_lookup_function(*ni, fct_name);
+    return 0;
+}
+
+
+enum nss_status
+check_nonlocal_uid(const char *user, uid_t uid, int *errnop)
+{
+    enum nss_status status;
+    struct passwd pwbuf;
+    char *buf;
+    size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX);
+    const struct walk_nss w = {
+	.lookup = &__nss_passwd_lookup, .fct_name = "getpwuid_r",
+	.status = &status, .errnop = errnop, .buf = &buf, .buflen = &buflen
+    };
+    const __typeof__(&_nss_nonlocal_getpwuid_r) self = &_nss_nonlocal_getpwuid_r;
+#define args (uid, &pwbuf, buf, buflen, errnop)
+#include "walk_nss.h"
+#undef args
+
+    if (status == NSS_STATUS_SUCCESS) {
+	syslog(LOG_ERR, "nss_nonlocal: possible spoofing attack: non-local user %s has same UID as local user %s!\n", user, pwbuf.pw_name);
+	free(buf);
+	status = NSS_STATUS_NOTFOUND;
+    } else if (status != NSS_STATUS_TRYAGAIN) {
+	status = NSS_STATUS_SUCCESS;
+    }
+
+    return status;
+}
+
+enum nss_status
+check_nonlocal_passwd(const char *user, struct passwd *pwd, int *errnop)
+{
+    enum nss_status status = NSS_STATUS_SUCCESS;
+    int old_errno = errno;
+    char *end;
+    unsigned long uid;
+
+    errno = 0;
+    uid = strtoul(pwd->pw_name, &end, 10);
+    if (errno == 0 && *end == '\0' && (uid_t)uid == uid) {
+	errno = old_errno;
+	status = check_nonlocal_uid(user, uid, errnop);
+    } else {
+	errno = old_errno;
+    }
+    if (status != NSS_STATUS_SUCCESS)
+	return status;
+
+    return check_nonlocal_uid(user, pwd->pw_uid, errnop);
+}
+
+enum nss_status
+check_nonlocal_user(const char *user, int *errnop)
+{
+    enum nss_status status;
+    struct passwd pwbuf;
+    char *buf;
+    size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX);
+    const struct walk_nss w = {
+	.lookup = __nss_passwd_lookup, .fct_name = "getpwnam_r",
+	.status = &status, .errnop = errnop, .buf = &buf, .buflen = &buflen
+    };
+    const __typeof__(&_nss_nonlocal_getpwnam_r) self = &_nss_nonlocal_getpwnam_r;
+#define args (user, &pwbuf, buf, buflen, errnop)
+#include "walk_nss.h"
+#undef args
+
+    if (status == NSS_STATUS_SUCCESS) {
+	free(buf);
+	status = NSS_STATUS_NOTFOUND;
+    } else if (status != NSS_STATUS_TRYAGAIN) {
+	status = NSS_STATUS_SUCCESS;
+    }
+
+    return status;
+}
+
+enum nss_status
+get_nonlocal_passwd(const char *name, struct passwd *pwd, char **buffer,
+		    int *errnop)
+{
+    enum nss_status status;
+    size_t buflen = sysconf(_SC_GETPW_R_SIZE_MAX);
+    const struct walk_nss w = {
+	.lookup = __nss_passwd_nonlocal_lookup, .fct_name = "getpwnam_r",
+	.status = &status, .errnop = errnop, .buf = buffer, .buflen = &buflen
+    };
+    const __typeof__(&_nss_nonlocal_getpwnam_r) self = NULL;
+#define args (name, pwd, *buffer, buflen, errnop)
+#include "walk_nss.h"
+#undef args
+    return status;
+}
+
+
+static service_user *pwent_startp, *pwent_nip;
+static void *pwent_fct_start;
+static union {
+    enum nss_status (*l)(struct passwd *pwd, char *buffer, size_t buflen,
+			 int *errnop);
+    void *ptr;
+} pwent_fct;
+static const char *pwent_fct_name = "getpwent_r";
+
+enum nss_status
+_nss_nonlocal_setpwent(int stayopen)
+{
+    enum nss_status status;
+    const struct walk_nss w = {
+	.lookup = &__nss_passwd_nonlocal_lookup, .fct_name = "setpwent",
+	.status = &status
+    };
+    const __typeof__(&_nss_nonlocal_setpwent) self = NULL;
+#define args (stayopen)
+#include "walk_nss.h"
+#undef args
+    if (status != NSS_STATUS_SUCCESS)
+	return status;
+
+    if (pwent_fct_start == NULL)
+	__nss_passwd_nonlocal_lookup(&pwent_startp, pwent_fct_name,
+				     &pwent_fct_start);
+    pwent_nip = pwent_startp;
+    pwent_fct.ptr = pwent_fct_start;
+    return NSS_STATUS_SUCCESS;
+}
+
+enum nss_status
+_nss_nonlocal_endpwent(void)
+{
+    enum nss_status status;
+    const struct walk_nss w = {
+	.lookup = &__nss_passwd_nonlocal_lookup, .fct_name = "endpwent",
+	.status = &status
+    };
+    const __typeof__(&_nss_nonlocal_endpwent) self = NULL;
+
+    pwent_nip = NULL;
+
+#define args ()
+#include "walk_nss.h"
+#undef args
+    return status;
+}
+
+enum nss_status
+_nss_nonlocal_getpwent_r(struct passwd *pwd, char *buffer, size_t buflen,
+			 int *errnop)
+{
+    enum nss_status status;
+
+    char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
+    if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
+	return NSS_STATUS_UNAVAIL;
+
+    if (pwent_nip == NULL) {
+	status = _nss_nonlocal_setpwent(0);
+	if (status != NSS_STATUS_SUCCESS)
+	    return status;
+    }
+    do {
+	if (pwent_fct.ptr == NULL)
+	    status = NSS_STATUS_UNAVAIL;
+	else {
+	    int nonlocal_errno;
+	    do
+		status = DL_CALL_FCT(pwent_fct.l, (pwd, buffer, buflen, errnop));
+	    while (status == NSS_STATUS_SUCCESS &&
+		   check_nonlocal_passwd(pwd->pw_name, pwd, &nonlocal_errno) != NSS_STATUS_SUCCESS);
+	}
+	if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE)
+	    return status;
+
+	if (status == NSS_STATUS_SUCCESS)
+	    return NSS_STATUS_SUCCESS;
+    } while (__nss_next(&pwent_nip, pwent_fct_name, &pwent_fct.ptr, status, 0) == 0);
+
+    pwent_nip = NULL;
+    return NSS_STATUS_NOTFOUND;
+}
+
+
+enum nss_status
+_nss_nonlocal_getpwnam_r(const char *name, struct passwd *pwd,
+			 char *buffer, size_t buflen, int *errnop)
+{
+    enum nss_status status;
+    int group_errno;
+    const struct walk_nss w = {
+	.lookup = __nss_passwd_nonlocal_lookup, .fct_name = "getpwnam_r",
+	.status = &status, .errnop = errnop
+    };
+    const __typeof__(&_nss_nonlocal_getpwnam_r) self = NULL;
+
+    char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
+    if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
+	return NSS_STATUS_UNAVAIL;
+
+#define args (name, pwd, buffer, buflen, errnop)
+#include "walk_nss.h"
+#undef args
+    if (status != NSS_STATUS_SUCCESS)
+	return status;
+
+    if (strcmp(name, pwd->pw_name) != 0) {
+	syslog(LOG_ERR, "nss_nonlocal: discarding user %s from lookup for user %s\n", pwd->pw_name, name);
+	return NSS_STATUS_NOTFOUND;
+    }
+
+    status = check_nonlocal_passwd(name, pwd, errnop);
+    if (status != NSS_STATUS_SUCCESS)
+	return status;
+
+    if (check_nonlocal_gid(name, NULL, pwd->pw_gid, &group_errno) !=
+	NSS_STATUS_SUCCESS)
+	pwd->pw_gid = 65534 /* nogroup */;
+    return NSS_STATUS_SUCCESS;
+}
+
+enum nss_status
+_nss_nonlocal_getpwuid_r(uid_t uid, struct passwd *pwd,
+			 char *buffer, size_t buflen, int *errnop)
+{
+    enum nss_status status;
+    int group_errno;
+    const struct walk_nss w = {
+	.lookup = &__nss_passwd_nonlocal_lookup, .fct_name = "getpwuid_r",
+	.status = &status, .errnop = errnop
+    };
+    const __typeof__(&_nss_nonlocal_getpwuid_r) self = NULL;
+
+    char *nonlocal_ignore = getenv(NONLOCAL_IGNORE_ENV);
+    if (nonlocal_ignore != NULL && nonlocal_ignore[0] != '\0')
+	return NSS_STATUS_UNAVAIL;
+
+#define args (uid, pwd, buffer, buflen, errnop)
+#include "walk_nss.h"
+#undef args
+    if (status != NSS_STATUS_SUCCESS)
+	return status;
+
+    if (uid != pwd->pw_uid) {
+	syslog(LOG_ERR, "nss_nonlocal: discarding uid %d from lookup for uid %d\n", pwd->pw_uid, uid);
+	return NSS_STATUS_NOTFOUND;
+    }
+
+    status = check_nonlocal_passwd(pwd->pw_name, pwd, errnop);
+    if (status != NSS_STATUS_SUCCESS)
+	return status;
+
+    if (check_nonlocal_gid(pwd->pw_name, NULL, pwd->pw_gid, &group_errno) !=
+	NSS_STATUS_SUCCESS)
+	pwd->pw_gid = 65534 /* nogroup */;
+    return NSS_STATUS_SUCCESS;
+}
Index: tags/fc15-eol/server/common/oursrc/nss_nonlocal/nonlocal-shadow.c
===================================================================
--- tags/fc15-eol/server/common/oursrc/nss_nonlocal/nonlocal-shadow.c	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/nss_nonlocal/nonlocal-shadow.c	(revision 2244)
@@ -0,0 +1,160 @@
+/*
+ * nonlocal-shadow.c
+ * shadow database for nss_nonlocal proxy.
+ *
+ * Copyright © 2007–2010 Anders Kaseorg <andersk@mit.edu>
+ *
+ * This file is part of nss_nonlocal.
+ *
+ * nss_nonlocal is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * nss_nonlocal is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with nss_nonlocal; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301  USA
+ */
+
+#define _GNU_SOURCE
+#include <sys/types.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <dlfcn.h>
+#include <stdio.h>
+#include <syslog.h>
+#include <errno.h>
+#include <shadow.h>
+#include <nss.h>
+
+#include "nsswitch-internal.h"
+#include "nonlocal.h"
+
+
+static service_user *__nss_shadow_nonlocal_database;
+
+static int
+internal_function
+__nss_shadow_nonlocal_lookup(service_user **ni, const char *fct_name,
+			    void **fctp)
+{
+    if (__nss_shadow_nonlocal_database == NULL
+	&& __nss_database_lookup("shadow_nonlocal", NULL, NULL,
+				 &__nss_shadow_nonlocal_database) < 0)
+	return -1;
+
+    *ni = __nss_shadow_nonlocal_database;
+
+    *fctp = __nss_lookup_function(*ni, fct_name);
+    return 0;
+}
+
+
+static service_user *spent_startp, *spent_nip;
+static void *spent_fct_start;
+static union {
+    enum nss_status (*l)(struct spwd *pwd, char *buffer, size_t buflen,
+			 int *errnop);
+    void *ptr;
+} spent_fct;
+static const char *spent_fct_name = "getspent_r";
+
+enum nss_status
+_nss_nonlocal_setspent(int stayopen)
+{
+    enum nss_status status;
+    const struct walk_nss w = {
+	.lookup = &__nss_shadow_nonlocal_lookup, .fct_name = "setspent",
+	.status = &status
+    };
+    const __typeof__(&_nss_nonlocal_setspent) self = NULL;
+#define args (stayopen)
+#include "walk_nss.h"
+#undef args
+    if (status != NSS_STATUS_SUCCESS)
+	return status;
+
+    if (spent_fct_start == NULL)
+	__nss_shadow_nonlocal_lookup(&spent_startp, spent_fct_name,
+				     &spent_fct_start);
+    spent_nip = spent_startp;
+    spent_fct.ptr = spent_fct_start;
+    return NSS_STATUS_SUCCESS;
+}
+
+enum nss_status
+_nss_nonlocal_endspent(void)
+{
+    enum nss_status status;
+    const struct walk_nss w = {
+	.lookup = &__nss_shadow_nonlocal_lookup, .fct_name = "endspent",
+	.status = &status
+    };
+    const __typeof__(&_nss_nonlocal_endspent) self = NULL;
+
+    spent_nip = NULL;
+
+#define args ()
+#include "walk_nss.h"
+#undef args
+    return status;
+}
+
+enum nss_status
+_nss_nonlocal_getspent_r(struct spwd *pwd, char *buffer, size_t buflen,
+			 int *errnop)
+{
+    enum nss_status status;
+    if (spent_nip == NULL) {
+	status = _nss_nonlocal_setspent(0);
+	if (status != NSS_STATUS_SUCCESS)
+	    return status;
+    }
+    do {
+	if (spent_fct.ptr == NULL)
+	    status = NSS_STATUS_UNAVAIL;
+	else
+	    status = DL_CALL_FCT(spent_fct.l, (pwd, buffer, buflen, errnop));	
+	if (status == NSS_STATUS_TRYAGAIN && *errnop == ERANGE)
+	    return status;
+
+	if (status == NSS_STATUS_SUCCESS)
+	    return NSS_STATUS_SUCCESS;
+    } while (__nss_next(&spent_nip, spent_fct_name, &spent_fct.ptr, status, 0) == 0);
+
+    spent_nip = NULL;
+    return NSS_STATUS_NOTFOUND;
+}
+
+
+enum nss_status
+_nss_nonlocal_getspnam_r(const char *name, struct spwd *pwd,
+			 char *buffer, size_t buflen, int *errnop)
+{
+    enum nss_status status;
+    const struct walk_nss w = {
+	.lookup = __nss_shadow_nonlocal_lookup, .fct_name = "getspnam_r",
+	.status = &status, .errnop = errnop
+    };
+    const __typeof__(&_nss_nonlocal_getspnam_r) self = NULL;
+#define args (name, pwd, buffer, buflen, errnop)
+#include "walk_nss.h"
+#undef args
+    if (status != NSS_STATUS_SUCCESS)
+	return status;
+
+    if (strcmp(name, pwd->sp_namp) != 0) {
+	syslog(LOG_ERR, "nss_nonlocal: discarding shadow %s from lookup for shadow %s\n", pwd->sp_namp, name);
+	return NSS_STATUS_NOTFOUND;
+    }
+
+    return NSS_STATUS_SUCCESS;
+}
Index: tags/fc15-eol/server/common/oursrc/nss_nonlocal/nonlocal.h
===================================================================
--- tags/fc15-eol/server/common/oursrc/nss_nonlocal/nonlocal.h	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/nss_nonlocal/nonlocal.h	(revision 2244)
@@ -0,0 +1,69 @@
+/*
+ * nonlocal.h
+ * common definitions for nss_nonlocal proxy
+ *
+ * Copyright © 2007–2010 Anders Kaseorg <andersk@mit.edu> and Tim
+ * Abbott <tabbott@mit.edu>
+ *
+ * This file is part of nss_nonlocal.
+ *
+ * nss_nonlocal is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * nss_nonlocal is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with nss_nonlocal; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301  USA
+ */
+
+#ifndef NONLOCAL_H
+#define NONLOCAL_H
+
+#include "config.h"
+
+#ifdef HAVE_STDBOOL_H
+# include <stdbool.h>
+#else
+# ifndef HAVE__BOOL
+#  ifdef __cplusplus
+typedef bool _Bool;
+#  else
+#   define _Bool signed char
+#  endif
+# endif
+# define bool _Bool
+# define false 0
+# define true 1
+# define __bool_true_false_are_defined 1
+#endif
+
+#include "nsswitch-internal.h"
+#include <pwd.h>
+
+struct walk_nss {
+    enum nss_status *status;
+    int (*lookup)(service_user **ni, const char *fct_name,
+		  void **fctp) internal_function;
+    const char *fct_name;
+    int *errnop;
+    char **buf;
+    size_t *buflen;
+};
+
+enum nss_status check_nonlocal_uid(const char *user, uid_t uid, int *errnop);
+enum nss_status check_nonlocal_gid(const char *user, const char *group,
+				   gid_t gid, int *errnop);
+enum nss_status check_nonlocal_user(const char *user, int *errnop);
+enum nss_status get_nonlocal_passwd(const char *name, struct passwd *pwd,
+				    char **buffer, int *errnop);
+
+#define NONLOCAL_IGNORE_ENV "NSS_NONLOCAL_IGNORE"
+
+#endif /* NON_LOCAL_H */
Index: tags/fc15-eol/server/common/oursrc/nss_nonlocal/nsswitch-internal.h
===================================================================
--- tags/fc15-eol/server/common/oursrc/nss_nonlocal/nsswitch-internal.h	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/nss_nonlocal/nsswitch-internal.h	(revision 2244)
@@ -0,0 +1,34 @@
+/*
+ * nsswitch_internal.h
+ * Prototypes for some internal glibc functions that we use.  Shhh.
+ */
+
+#ifndef NSSWITCH_INTERNAL_H
+#define NSSWITCH_INTERNAL_H
+
+#include "config.h"
+
+/* glibc/config.h.in */
+#if defined USE_REGPARMS && !defined PROF && !defined __BOUNDED_POINTERS__
+# define internal_function __attribute__ ((regparm (3), stdcall))
+#else
+# define internal_function
+#endif
+
+/* glibc/nss/nsswitch.h */
+typedef struct service_user service_user;
+
+extern int __nss_next (service_user **ni, const char *fct_name, void **fctp,
+		       int status, int all_values);
+extern int __nss_database_lookup (const char *database,
+				  const char *alternative_name,
+				  const char *defconfig, service_user **ni);
+extern void *__nss_lookup_function (service_user *ni, const char *fct_name);
+
+/* glibc/nss/XXX-lookup.c */
+extern int __nss_passwd_lookup (service_user **ni, const char *fct_name,
+				void **fctp) internal_function;
+extern int __nss_group_lookup (service_user **ni, const char *fct_name,
+			        void **fctp) internal_function;
+
+#endif /* NSSWITCH_INTERNAL_H */
Index: tags/fc15-eol/server/common/oursrc/nss_nonlocal/walk_nss.h
===================================================================
--- tags/fc15-eol/server/common/oursrc/nss_nonlocal/walk_nss.h	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/nss_nonlocal/walk_nss.h	(revision 2244)
@@ -0,0 +1,62 @@
+{
+    static service_user *startp = NULL;
+    static void *fct_start = NULL;
+
+    service_user *nip;
+    union {
+	__typeof__(self) l;
+	void *ptr;
+    } fct;
+    int old_errno = errno;
+
+    if (fct_start == NULL &&
+	w.lookup(&startp, w.fct_name, &fct_start) != 0) {
+	*w.status = NSS_STATUS_UNAVAIL;
+	goto walk_nss_out;
+    }
+
+    nip = startp;
+    fct.ptr = fct_start;
+
+    if (w.buf != NULL) {
+	*w.buf = malloc(*w.buflen);
+	errno = old_errno;
+	if (*w.buf == NULL) {
+	    *w.status = NSS_STATUS_TRYAGAIN;
+	    *w.errnop = ENOMEM;
+	    goto walk_nss_out;
+	}
+    }
+
+    do {
+    walk_nss_morebuf:
+	if (fct.ptr == NULL)
+	    *w.status = NSS_STATUS_UNAVAIL;
+	else if (self != NULL && fct.l == self)
+	    *w.status = NSS_STATUS_NOTFOUND;
+	else
+	    *w.status = DL_CALL_FCT(fct.l, args);
+	if (*w.status == NSS_STATUS_TRYAGAIN &&
+	    w.errnop != NULL && *w.errnop == ERANGE) {
+	    if (w.buf == NULL)
+		break;
+	    free(*w.buf);
+	    *w.buflen *= 2;
+	    *w.buf = malloc(*w.buflen);
+	    errno = old_errno;
+	    if (*w.buf == NULL) {
+		*w.errnop = ENOMEM;
+		goto walk_nss_out;
+	    }
+	    goto walk_nss_morebuf;
+	}
+    } while (__nss_next(&nip, w.fct_name, &fct.ptr, *w.status, 0) == 0);
+
+    if (w.buf != NULL && *w.status != NSS_STATUS_SUCCESS) {
+	free(*w.buf);
+	*w.buf = NULL;
+    }
+
+ walk_nss_out:
+    ;
+}
Index: tags/fc15-eol/server/common/oursrc/php_scripts/Makefile.in
===================================================================
--- tags/fc15-eol/server/common/oursrc/php_scripts/Makefile.in	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/php_scripts/Makefile.in	(revision 2244)
@@ -0,0 +1,22 @@
+CC = @CC@
+CFLAGS = @CFLAGS@
+prefix = @prefix@
+exec_prefix = @exec_prefix@
+bindir = @bindir@
+MODS = scripts
+
+all-local: $(patsubst %,.libs/%.so,$(MODS))
+
+.libs/%.so: %.c
+	$(CC) $(CFLAGS) -c $<
+
+install:
+	install -p -m755 -D .libs/scripts.so $(DESTDIR)/usr/lib64/php/modules/scripts.so
+
+clean:
+	rm -f $(MODS:=.so) $(MODS:=.o) $(MODS:=.la) $(MODS:=.lo) $(MODS:=.slo) $(MODS:=.lai)
+	rm -rf .libs modules
+
+distclean: clean
+	rm -f configure config.* Makefile
+	rm -rf auto*.cache
Index: tags/fc15-eol/server/common/oursrc/php_scripts/mrproper
===================================================================
--- tags/fc15-eol/server/common/oursrc/php_scripts/mrproper	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/php_scripts/mrproper	(revision 2244)
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+rm -f scripts.so
+rm -f configure config.* Makefile
+rm -rf auto*.cache
+rm -rf .libs
Index: tags/fc15-eol/server/common/oursrc/php_scripts/php_scripts-config.m4
===================================================================
--- tags/fc15-eol/server/common/oursrc/php_scripts/php_scripts-config.m4	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/php_scripts/php_scripts-config.m4	(revision 2244)
@@ -0,0 +1,7 @@
+PHP_ARG_ENABLE(scripts, whether to enable scripts.mit.edu support,
+[ --enable-scripts   Enable scripts.mit.edu support])
+
+if test "$PHP_SCRIPTS" != "no"; then
+  AC_DEFINE(HAVE_SCRIPTS, 1, [Whether you have scripts.mit.edu support])
+  PHP_NEW_EXTENSION(scripts, php_scripts.c, $ext_shared)
+fi
Index: tags/fc15-eol/server/common/oursrc/php_scripts/php_scripts.c
===================================================================
--- tags/fc15-eol/server/common/oursrc/php_scripts/php_scripts.c	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/php_scripts/php_scripts.c	(revision 2244)
@@ -0,0 +1,85 @@
+/***
+ * scripts.mit.edu PHP enhancement extension
+ *
+ * Joe Presbrey <presbrey@mit.edu>
+ * 2008-06-19
+ *
+ ***/
+
+#include "php.h"
+#include "zend_extensions.h"
+
+#include "php_scripts.h"
+
+#ifndef ZEND_EXT_API
+#define ZEND_EXT_API    ZEND_DLEXPORT
+#endif
+ZEND_EXTENSION();
+
+ZEND_MODULE_STARTUP_D(scripts)
+{
+	return SUCCESS;
+}
+
+ZEND_MODULE_SHUTDOWN_D(scripts)
+{
+}
+
+ZEND_MODULE_ACTIVATE_D(scripts)
+{
+    // replace error handler callback with our own
+    old_error_cb = zend_error_cb;
+    new_error_cb = scripts_error_cb;
+    zend_error_cb = new_error_cb;
+
+	return SUCCESS;
+}
+
+ZEND_MODULE_DEACTIVATE_D(scripts)
+{
+    // restore original error handler callback
+    zend_error_cb = old_error_cb;
+}
+
+void scripts_error_cb(int type, const char *error_filename, const uint error_lineno, const char *format, va_list args)
+{
+    char *buffer;
+    const char *user = php_get_current_user();
+
+    // enhance the log message
+    spprintf(&buffer, 0, "(%s) %s", user, format);
+
+    // pass through to builtin error callback
+    if (strncmp(format, "Module '%s' already loaded", 26)==0) {
+        // demote from E_CORE_WARNING
+        old_error_cb(E_NOTICE, error_filename, error_lineno, buffer, args);
+    } else {
+        old_error_cb(type, error_filename, error_lineno, buffer, args);
+    }
+
+    efree(buffer);
+}
+
+ZEND_DLEXPORT zend_extension zend_extension_entry = {
+    PHP_SCRIPTS_EXTNAME,
+    PHP_SCRIPTS_VERSION,
+    PHP_SCRIPTS_AUTHOR,
+    PHP_SCRIPTS_URL,
+    PHP_SCRIPTS_YEAR,
+    ZEND_MODULE_STARTUP_N(scripts),		/* startup_func_t */
+    ZEND_MODULE_SHUTDOWN_N(scripts),	/* shutdown_func_t */
+    ZEND_MODULE_ACTIVATE_N(scripts),	/* activate_func_t */
+    ZEND_MODULE_DEACTIVATE_N(scripts),	/* deactivate_func_t */
+    NULL,           					/* message_handler_func_t */
+    NULL,           					/* op_array_handler_func_t */
+    NULL,           					/* statement_handler_func_t */
+    NULL,           					/* fcall_begin_handler_func_t */
+    NULL,           					/* fcall_end_handler_func_t */
+    NULL,           					/* op_array_ctor_func_t */
+    NULL,           					/* op_array_dtor_func_t */
+    STANDARD_ZEND_EXTENSION_PROPERTIES
+};
+
+#ifdef COMPILE_DL_SCRIPTS
+ZEND_GET_MODULE(scripts)
+#endif
Index: tags/fc15-eol/server/common/oursrc/php_scripts/php_scripts.h
===================================================================
--- tags/fc15-eol/server/common/oursrc/php_scripts/php_scripts.h	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/php_scripts/php_scripts.h	(revision 2244)
@@ -0,0 +1,51 @@
+/***
+ * scripts.mit.edu PHP extension
+ *
+ * Joe Presbrey <presbrey@mit.edu>
+ * 2008-06-19
+ *
+ ***/
+
+#ifndef PHP_SCRIPTS_H
+#define PHP_SCRIPTS_H 1
+
+#define PHP_SCRIPTS_VERSION "1.0"
+#define PHP_SCRIPTS_EXTNAME "scripts"
+#define PHP_SCRIPTS_AUTHOR "presbrey@mit.edu"
+#define PHP_SCRIPTS_URL "http://scripts.mit.edu/"
+#define PHP_SCRIPTS_YEAR "2008"
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+extern zend_module_entry scripts_module_entry;
+#define phpext_scripts_ptr &scripts_module_entry
+
+/* error callback repalcement functions */
+void (*old_error_cb)(int type, const char *error_filename, const uint error_lineno, const char *format, va_list args);
+void (*new_error_cb)(int type, const char *error_filename, const uint error_lineno, const char *format, va_list args);
+void scripts_error_cb(int type, const char *error_filename, const uint error_lineno, const char *format, va_list args);
+
+static function_entry scripts_functions[] = {
+    {NULL, NULL, NULL}
+};
+
+zend_module_entry scripts_module_entry = {
+#if ZEND_MODULE_API_NO >= 20010901
+    STANDARD_MODULE_HEADER,
+#endif
+    PHP_SCRIPTS_EXTNAME,
+    scripts_functions,
+    NULL, //PHP_MINIT(scripts),
+    NULL, //PHP_MSHUTDOWN(scripts),
+    NULL,
+    NULL,
+    NULL,
+#if ZEND_MODULE_API_NO >= 20010901
+    PHP_SCRIPTS_VERSION,
+#endif
+    STANDARD_MODULE_PROPERTIES
+};
+
+#endif
Index: tags/fc15-eol/server/common/oursrc/python-routefs/routefs/__init__.py
===================================================================
--- tags/fc15-eol/server/common/oursrc/python-routefs/routefs/__init__.py	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/python-routefs/routefs/__init__.py	(revision 2244)
@@ -0,0 +1,219 @@
+"""
+RouteFS is a base class for developing read-only FUSE filesystems that
+lets you focus on the directory tree instead of the system calls.
+
+RouteFS uses the Routes library developed for Pylons. URLs were
+inspired by filesystems, and now you can have filesystems inspired by
+URLs.
+
+When developing a descendent of RouteFS, any methods defined in that
+class are considered "controllers", and receive any other parameters
+specified by the URL as keyword arguments.
+"""
+
+import fuse
+import routes
+import errno
+import stat
+
+fuse.fuse_python_api = (0, 2)
+
+class RouteStat(fuse.Stat):
+    """
+    RouteStat is a descendent of fuse.Stat, defined to make sure that
+    all of the necessary attributes are always defined
+    """
+    def __init__(self):
+        self.st_mode = 0
+        self.st_ino = 0
+        self.st_dev = 0
+        self.st_nlink = 0
+        self.st_uid = 0
+        self.st_gid = 0
+        self.st_size = 0
+        self.st_atime = 0
+        self.st_mtime = 0
+        self.st_ctime = 0
+
+class RouteMeta(type):
+    """
+    Metaclass to calculate controller methods
+    
+    Routes needs to be pre-seeded with a list of "controllers". For
+    all descendents of RouteFS, the list of controllers is defined to
+    be any non-private methods of the class that were not in the
+    RouteFS class.
+    """
+    def __init__(cls, classname, bases, dict_):
+        super(RouteMeta, cls).__init__(classname, bases, dict_)
+        if bases != (fuse.Fuse,):
+            new_funcs = set(dict_.keys()).difference(dir(RouteFS))
+            cls.controllers([func for func in new_funcs \
+                                 if not func.startswith('_')])
+
+class RouteFS(fuse.Fuse):
+    """
+    RouteFS: Web 2.0 for filesystems
+    """
+    __metaclass__ = RouteMeta
+    def __init__(self, *args, **kwargs):
+        super(RouteFS, self).__init__(*args, **kwargs)
+        
+        self.map = self.make_map()
+        self.map.create_regs(self.controller_list)
+        
+    def make_map(self):
+        """
+        This method should be overridden by descendents of RouteFS to
+        define the routing for the filesystem
+        """
+        m = routes.Mapper()
+        
+        m.connect(':controller')
+        
+        return m
+    
+    @classmethod
+    def controllers(cls, lst):
+        cls.controller_list = lst
+    
+    def _get_file(self, path):
+        """
+        Find the filesystem entry object for a given path
+        """
+        match = self.map.match(path)
+        if match is None:
+            return NoEntry()
+        controller = match.pop('controller')
+        result = getattr(self, controller)(**match)
+        if type(result) is str:
+            result = File(result)
+        if type(result) is list:
+            result = Directory(result)
+        return result
+    
+    def readdir(self, path, offset):
+        """
+        If the path referred to is a directory, return the elements of
+        that diectory
+        """
+        return self._get_file(path).readdir(offset)
+    
+    def getattr(self, path):
+        """
+        Return the stat information for a path
+        
+        The stat information for a directory, symlink, or file is
+        predetermined based on which it is.
+        """
+        return self._get_file(path).getattr()
+    
+    def read(self, path, length, offset):
+        """
+        If the path specified is a file, return the requested portion
+        of the file
+        """
+        return self._get_file(path).read(length, offset)
+    
+    def readlink(self, path):
+        """
+        If the path specified is a symlink, return the target
+        """
+        return self._get_file(path).readlink()
+
+class TreeKey(object):
+    def getattr(self):
+        return -errno.EINVAL
+    def readdir(self, offset):
+        return -errno.EINVAL
+    def read(self, length, offset):
+        return -errno.EINVAL
+    def readlink(self):
+        return -errno.EINVAL
+
+class NoEntry(TreeKey):
+    def getattr(self):
+        return -errno.ENOENT
+    def readdir(self, offset):
+        return -errno.ENOENT
+    def read(self, length, offset):
+        return -errno.ENOENT
+    def readlink(self):
+        return -errno.ENOENT
+
+class TreeEntry(TreeKey):
+    default_mode = 0444
+    
+    def __new__(cls, contents, mode=None):
+        return super(TreeEntry, cls).__new__(cls, contents)
+    
+    def __init__(self, contents, mode=None):
+        if mode is None:
+            self.mode = self.default_mode
+        else:
+            self.mode = mode
+        
+        super(TreeEntry, self).__init__(contents)
+
+class Directory(TreeEntry, list):
+    """
+    A dummy class representing a filesystem entry that should be a
+    directory
+    """
+    default_mode = 0555
+
+    def getattr(self):
+        st = RouteStat()
+        st.st_mode = stat.S_IFDIR | self.mode
+        st.st_nlink = 2
+        return st
+
+    def readdir(self, offset):
+        for member in ['.', '..'] + self:
+            yield fuse.Direntry(str(member))
+
+class Symlink(TreeEntry, str):
+    """
+    A dummy class representing something that should be a symlink
+    """
+    default_mode = 0777
+
+    def getattr(self):
+        st = RouteStat()
+        st.st_mode = stat.S_IFLNK | self.mode
+        st.st_nlink = 1
+        st.st_size = len(self)
+        return st
+
+    def readlink(self):
+        return self
+
+class File(TreeEntry, str):
+    """
+    A dummy class representing something that should be a file
+    """
+    default_mode = 0444
+
+    def getattr(self):
+        st = RouteStat()
+        st.st_mode = stat.S_IFREG | self.mode
+        st.st_nlink = 1
+        st.st_size = len(self)
+        return st
+
+    def read(self, length, offset):
+        return self[offset:offset + length]
+
+def main(cls):
+    """
+    A convenience function for initializing a RouteFS filesystem
+    """
+    server = cls(version="%prog " + fuse.__version__,
+                 usage=fuse.Fuse.fusage,
+                 dash_s_do='setsingle')
+    server.parse(values=server, errex=1)
+    server.main()
+
+from dictfs import DictFS
+
+__all__ = ['RouteFS', 'DictFS', 'Symlink', 'Directory', 'File', 'main']
Index: tags/fc15-eol/server/common/oursrc/python-routefs/routefs/dictfs.py
===================================================================
--- tags/fc15-eol/server/common/oursrc/python-routefs/routefs/dictfs.py	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/python-routefs/routefs/dictfs.py	(revision 2244)
@@ -0,0 +1,48 @@
+"""
+DictFS allows you to easily create read-only filesystems when the
+file tree is known in advance.
+
+To create your own DictFS descendent, simply override the files
+property, which can be created either using the property
+decorator, or just a simple assignment.
+
+A dictionary represents a directory, with keys corresponding to
+file names and the values corresponding to the file contents.
+"""
+
+import routefs
+from routes import Mapper
+import os
+
+class DictFS(routefs.RouteFS):
+    @property
+    def files(self):
+        """
+        This property should be overridden in your DictFS descendant
+        """
+        return dict()
+    
+    def make_map(self):
+        m = Mapper()
+        
+        m.connect('*path', controller='handler')
+        
+        return m
+    
+    def handler(self, path, **kwargs):
+        if path != '':
+            elements = path.split(os.path.sep)
+        else:
+            elements = []
+        
+        try:
+            tree = self.files
+            for elt in elements:
+                tree = tree[elt]
+        except KeyError:
+            return
+        
+        if type(tree) is dict:
+            return tree.keys()
+        else:
+            return tree
Index: tags/fc15-eol/server/common/oursrc/python-routefs/routefs/examples/dictexfs.py
===================================================================
--- tags/fc15-eol/server/common/oursrc/python-routefs/routefs/examples/dictexfs.py	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/python-routefs/routefs/examples/dictexfs.py	(revision 2244)
@@ -0,0 +1,10 @@
+#!/usr/bin/python
+
+import routefs
+
+class DictExFS(routefs.DictFS):
+    files = dict(Hello='World',
+                 Directory=dict(a='a', b='b', c=routefs.Symlink('a')))
+
+if __name__ == '__main__':
+    routefs.main(DictExFS)
Index: tags/fc15-eol/server/common/oursrc/python-routefs/routefs/examples/pyhesiodfs.py
===================================================================
--- tags/fc15-eol/server/common/oursrc/python-routefs/routefs/examples/pyhesiodfs.py	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/python-routefs/routefs/examples/pyhesiodfs.py	(revision 2244)
@@ -0,0 +1,46 @@
+#!/usr/bin/python
+
+import hesiod
+import routefs
+from routes import Mapper
+
+class PyHesiodFS(routefs.RouteFS):
+    def __init__(self, *args, **kwargs):
+        super(PyHesiodFS, self).__init__(*args, **kwargs)
+        self.fuse_args.add("allow_other", True)
+        
+        self.cache = {}
+    
+    def make_map(self):
+        m = Mapper()
+        m.connect('', controller='getList')
+        m.connect('README.txt', controller='getReadme')
+        m.connect(':action', controller='getLocker')
+        return m
+    
+    def getLocker(self, action, **kwargs):
+        if action in self.cache:
+            return routefs.Symlink(self.cache[action])
+        
+        try:
+            filsys = hesiod.FilsysLookup(action).filsys[0]
+            if filsys['type'] == 'AFS':
+                self.cache[action] = filsys['location']
+                return routefs.Symlink(self.cache[action])
+        except (TypeError, KeyError, IndexError):
+            return
+    
+    def getList(self, **kwargs):
+        return self.cache.keys() + ['README.txt']
+    
+    def getReadme(self, **kwargs):
+        return """
+This is the pyHesiodFS FUSE automounter. To access a Hesiod filsys,
+just access /mit/name.
+
+If you're using the Finder, try pressing Cmd+Shift+G and then entering
+/mit/name
+"""
+
+if __name__ == '__main__':
+    routefs.main(PyHesiodFS)
Index: tags/fc15-eol/server/common/oursrc/python-routefs/setup.py
===================================================================
--- tags/fc15-eol/server/common/oursrc/python-routefs/setup.py	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/python-routefs/setup.py	(revision 2244)
@@ -0,0 +1,15 @@
+#!/usr/bin/python
+
+from setuptools import setup, find_packages
+
+setup(
+    name="RouteFS",
+    version="0.0.1",
+    description="RouteFS: A FUSE API wrapper based on URL routing",
+    author="Evan Broder",
+    author_email="broder@mit.edu",
+    #url="http://ebroder.net/code/RouteFS",
+    license="MIT",
+    packages=find_packages(),
+    install_requires=['fuse_python>=0.2a', 'Routes>=1.7']
+)
Index: tags/fc15-eol/server/common/oursrc/scripts-static-cat/Setup.hs
===================================================================
--- tags/fc15-eol/server/common/oursrc/scripts-static-cat/Setup.hs	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/scripts-static-cat/Setup.hs	(revision 2244)
@@ -0,0 +1,2 @@
+import Distribution.Simple
+main = defaultMain
Index: tags/fc15-eol/server/common/oursrc/scripts-static-cat/StaticCat.hs
===================================================================
--- tags/fc15-eol/server/common/oursrc/scripts-static-cat/StaticCat.hs	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/scripts-static-cat/StaticCat.hs	(revision 2244)
@@ -0,0 +1,232 @@
+{-# LANGUAGE DeriveDataTypeable, ViewPatterns #-}
+{-# OPTIONS_GHC -O2 -Wall #-}
+
+import Prelude hiding (catch)
+import Control.Applicative
+import Control.Monad
+import Control.Monad.CatchIO
+import qualified Data.ByteString.Lazy as B
+import Data.Char
+import Data.Dynamic
+import Data.Int
+import qualified Data.Map as M
+import Data.Time.Clock.POSIX
+import Data.Time.Format
+import Network.CGI
+import Numeric
+import System.FilePath
+import System.IO
+import System.IO.Error (isDoesNotExistError, isPermissionError)
+import System.IO.Unsafe
+import System.Locale
+import System.Posix
+import System.Posix.Handle
+
+encodings :: M.Map String String
+encodings = M.fromList [
+             (".bz2", "bzip2"),
+             (".gz", "gzip"),
+             (".z", "compress")
+            ]
+
+types :: M.Map String String
+types = M.fromList [
+         (".avi", "video/x-msvideo"),
+         (".css", "text/css"),
+         (".doc", "application/msword"),
+         (".docm", "application/vnd.ms-word.document.macroEnabled.12"),
+         (".docx", "application/vnd.openxmlformats-officedocument.wordprocessingml.document"),
+         (".dot", "application/msword"),
+         (".dotm", "application/vnd.ms-word.template.macroEnabled.12"),
+         (".dotx", "application/vnd.openxmlformats-officedocument.wordprocessingml.template"),
+         (".gif", "image/gif"),
+         (".htm", "text/html"),
+         (".html", "text/html"),
+         (".ico", "image/vnd.microsoft.icon"),
+         (".il", "application/octet-stream"),
+         (".jar", "application/java-archive"),
+         (".jpeg", "image/jpeg"),
+         (".jpg", "image/jpeg"),
+         (".js", "application/x-javascript"),
+         (".mid", "audio/midi"),
+         (".midi", "audio/midi"),
+         (".mov", "video/quicktime"),
+         (".mp3", "audio/mpeg"),
+         (".mpeg", "video/mpeg"),
+         (".mpg", "video/mpeg"),
+         (".odb", "application/vnd.oasis.opendocument.database"),
+         (".odc", "application/vnd.oasis.opendocument.chart"),
+         (".odf", "application/vnd.oasis.opendocument.formula"),
+         (".odg", "application/vnd.oasis.opendocument.graphics"),
+         (".odi", "application/vnd.oasis.opendocument.image"),
+         (".odm", "application/vnd.oasis.opendocument.text-master"),
+         (".odp", "application/vnd.oasis.opendocument.presentation"),
+         (".ods", "application/vnd.oasis.opendocument.spreadsheet"),
+         (".odt", "application/vnd.oasis.opendocument.text"),
+         (".otf", "application/octet-stream"),
+         (".otg", "application/vnd.oasis.opendocument.graphics-template"),
+         (".oth", "application/vnd.oasis.opendocument.text-web"),
+         (".otp", "application/vnd.oasis.opendocument.presentation-template"),
+         (".ots", "application/vnd.oasis.opendocument.spreadsheet-template"),
+         (".ott", "application/vnd.oasis.opendocument.text-template"),
+         (".pdf", "application/pdf"),
+         (".png", "image/png"),
+         (".pot", "application/vnd.ms-powerpoint"),
+         (".potm", "application/vnd.ms-powerpoint.template.macroEnabled.12"),
+         (".potx", "application/vnd.openxmlformats-officedocument.presentationml.template"),
+         (".ppa", "application/vnd.ms-powerpoint"),
+         (".ppam", "application/vnd.ms-powerpoint.addin.macroEnabled.12"),
+         (".pps", "application/vnd.ms-powerpoint"),
+         (".ppsm", "application/vnd.ms-powerpoint.slideshow.macroEnabled.12"),
+         (".ppsx", "application/vnd.openxmlformats-officedocument.presentationml.slideshow"),
+         (".ppt", "application/vnd.ms-powerpoint"),
+         (".pptm", "application/vnd.ms-powerpoint.presentation.macroEnabled.12"),
+         (".pptx", "application/vnd.openxmlformats-officedocument.presentationml.presentation"),
+         (".ps", "application/postscript"),
+         (".svg", "image/svg+xml"),
+         (".swf", "application/x-shockwave-flash"),
+         (".tar", "application/x-tar"),
+         (".tgz", "application/x-gzip"),
+         (".tif", "image/tiff"),
+         (".tiff", "image/tiff"),
+         (".ttf", "application/octet-stream"),
+         (".wav", "audio/x-wav"),
+         (".wmv", "video/x-ms-wmv"),
+         (".xaml", "application/xaml+xml"),
+         (".xap", "application/x-silverlight-app"),
+         (".xhtml", "application/xhtml+xml"),
+         (".xla", "application/vnd.ms-excel"),
+         (".xlam", "application/vnd.ms-excel.addin.macroEnabled.12"),
+         (".xls", "application/vnd.ms-excel"),
+         (".xlsb", "application/vnd.ms-excel.sheet.binary.macroEnabled.12"),
+         (".xlsm", "application/vnd.ms-excel.sheet.macroEnabled.12"),
+         (".xlsx", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"),
+         (".xlt", "application/vnd.ms-excel"),
+         (".xltm", "application/vnd.ms-excel.template.macroEnabled.12"),
+         (".xltx", "application/vnd.openxmlformats-officedocument.spreadsheetml.template"),
+         (".xml", "text/xml"),
+         (".xsl", "text/xml"),
+         (".zip", "application/zip")
+        ]
+
+data MyError = NotModified | Forbidden | NotFound | BadMethod | BadRange
+    deriving (Show, Typeable)
+
+instance Exception MyError
+
+outputMyError :: MyError -> CGI CGIResult
+outputMyError NotModified = setStatus 304 "Not Modified" >> outputNothing
+outputMyError Forbidden = outputError 403 "Forbidden" []
+outputMyError NotFound = outputError 404 "Not Found" []
+outputMyError BadMethod = outputError 405 "Method Not Allowed" []
+outputMyError BadRange = outputError 416 "Requested Range Not Satisfiable" []
+
+checkExtension :: FilePath -> CGI ()
+checkExtension file = do
+  let (base, ext) = splitExtension file
+  ext' <- case M.lookup (map toLower ext) encodings of
+            Nothing -> return ext
+            Just e -> do
+              setHeader "Content-Encoding" e
+              return $ takeExtension base
+
+  case M.lookup (map toLower ext') types of
+    Nothing -> throw Forbidden
+    Just t -> setHeader "Content-Type" t
+
+checkMethod :: CGI CGIResult -> CGI CGIResult
+checkMethod rOutput = do
+  m <- requestMethod
+  case m of
+    "HEAD" -> rOutput >> outputNothing
+    "GET" -> rOutput
+    "POST" -> rOutput
+    _ -> throw BadMethod
+
+httpDate :: String
+httpDate = "%a, %d %b %Y %H:%M:%S %Z"
+formatHTTPDate :: EpochTime -> String
+formatHTTPDate = formatTime defaultTimeLocale httpDate .
+                 posixSecondsToUTCTime . realToFrac
+parseHTTPDate :: String -> Maybe EpochTime
+parseHTTPDate = (fromInteger . floor . utcTimeToPOSIXSeconds <$>) .
+                parseTime defaultTimeLocale httpDate
+
+checkModified :: EpochTime -> CGI ()
+checkModified mTime = do
+  setHeader "Last-Modified" $ formatHTTPDate mTime
+  (requestHeader "If-Modified-Since" >>=) $ maybe (return ()) $ \ims ->
+      when (parseHTTPDate ims >= Just mTime) $ throw NotModified
+
+checkIfRange :: EpochTime -> CGI (Maybe ())
+checkIfRange mTime = do
+  (requestHeader "If-Range" >>=) $ maybe (return $ Just ()) $ \ir ->
+      return $ if parseHTTPDate ir == Just mTime then Just () else Nothing
+
+parseRange :: String -> FileOffset -> Maybe (FileOffset, FileOffset)
+parseRange (splitAt 6 -> ("bytes=", '-':(readDec -> [(len, "")]))) size =
+    Just (max 0 (size - len), size - 1)
+parseRange (splitAt 6 -> ("bytes=", readDec -> [(a, "-")])) size =
+    Just (a, size - 1)
+parseRange (splitAt 6 -> ("bytes=", readDec -> [(a, '-':(readDec -> [(b, "")]))])) size =
+    Just (a, min (size - 1) b)
+parseRange _ _ = Nothing
+
+checkRange :: EpochTime -> FileOffset -> CGI (Maybe (FileOffset, FileOffset))
+checkRange mTime size = do
+  setHeader "Accept-Ranges" "bytes"
+  (requestHeader "Range" >>=) $ maybe (return Nothing) $ \range -> do
+  (checkIfRange mTime >>=) $ maybe (return Nothing) $ \() -> do
+    case parseRange range size of
+      Just (a, b) | a <= b -> return $ Just (a, b)
+      Just _ -> throw BadRange
+      Nothing -> return Nothing
+
+outputAll :: Handle -> FileOffset -> CGI CGIResult
+outputAll h size = do
+  setHeader "Content-Length" $ show size
+  outputFPS =<< liftIO (B.hGetContents h)
+
+-- | Lazily read a given number of bytes from the handle into a
+-- 'ByteString', then close the handle.
+hGetClose :: Handle -> Int64 -> IO B.ByteString
+hGetClose h len = do
+  contents <- B.hGetContents h
+  end <- unsafeInterleaveIO (hClose h >> return B.empty)
+  return (B.append (B.take len contents) end)
+
+outputRange :: Handle -> FileOffset -> Maybe (FileOffset, FileOffset) -> CGI CGIResult
+outputRange h size Nothing = outputAll h size
+outputRange h size (Just (a, b)) = do
+  let len = b - a + 1
+
+  setStatus 206 "Partial Content"
+  setHeader "Content-Range" $
+   "bytes " ++ show a ++ "-" ++ show b ++ "/" ++ show size
+  setHeader "Content-Length" $ show len
+  liftIO $ hSeek h AbsoluteSeek (fromIntegral a)
+  outputFPS =<< liftIO (hGetClose h (fromIntegral len))
+
+serveFile :: FilePath -> CGI CGIResult
+serveFile file = (`catch` outputMyError) $ do
+  checkExtension file
+
+  checkMethod $ do
+
+  let handleOpenError e =
+          if isDoesNotExistError e then throw NotFound
+          else if isPermissionError e then throw Forbidden
+          else throw e
+  h <- liftIO (openBinaryFile file ReadMode) `catch` handleOpenError
+  (`onException` liftIO (hClose h)) $ do
+
+  status <- liftIO $ hGetStatus h
+  let mTime = modificationTime status
+      size = fileSize status
+  checkModified mTime
+
+  range <- checkRange mTime size
+  outputRange h size range
+
+main :: IO ()
+main = runCGI $ handleErrors $ serveFile =<< pathTranslated
Index: tags/fc15-eol/server/common/oursrc/scripts-static-cat/scripts-static-cat.cabal
===================================================================
--- tags/fc15-eol/server/common/oursrc/scripts-static-cat/scripts-static-cat.cabal	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/scripts-static-cat/scripts-static-cat.cabal	(revision 2244)
@@ -0,0 +1,23 @@
+Name:		scripts-static-cat
+Version:	0.0
+Cabal-Version:	>= 1.2
+Build-Type:	Simple
+License:	GPL
+Copyright:	© 2010, Anders Kaseorg
+Author:		Anders Kaseorg <andersk@mit.edu>
+Maintainer:	scripts@mit.edu
+
+Executable		static-cat
+  Main-Is:		StaticCat.hs
+  GHC-Options:		-Wall -O2
+  Build-Depends:
+    base >= 4,
+    bytestring,
+    cgi >= 3001.1.8,
+    containers,
+    filepath,
+    MonadCatchIO-mtl,
+    old-locale,
+    time,
+    unix,
+    unix-handle
Index: tags/fc15-eol/server/common/oursrc/sql-signup/Makefile
===================================================================
--- tags/fc15-eol/server/common/oursrc/sql-signup/Makefile	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/sql-signup/Makefile	(revision 2244)
@@ -0,0 +1,12 @@
+install:
+	install -Dpm 644 sql-signup-capps ${DESTDIR}/etc/security/console.apps/sql-signup
+	install -Dpm 644 sql-signup-pam ${DESTDIR}/etc/pam.d/sql-signup
+	install -DpT sql-signup-sbin ${DESTDIR}/usr/sbin/sql-signup
+	mkdir -p ${DESTDIR}/usr/bin
+	ln -nfs /usr/bin/consolehelper ${DESTDIR}/usr/bin/sql-signup
+
+clean:
+	rm -f ${DESTDIR}/usr/bin/sql-signup
+	rm -f ${DESTDIR}/usr/sbin/sql-signup
+	rm -f ${DESTDIR}/etc/pam.d/sql-signup
+	rm -f ${DESTDIR}/etc/security/console.apps/sql-signup
Index: tags/fc15-eol/server/common/oursrc/sql-signup/sql-signup-capps
===================================================================
--- tags/fc15-eol/server/common/oursrc/sql-signup/sql-signup-capps	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/sql-signup/sql-signup-capps	(revision 2244)
@@ -0,0 +1,1 @@
+PROGRAM=/usr/sbin/sql-signup
Index: tags/fc15-eol/server/common/oursrc/sql-signup/sql-signup-pam
===================================================================
--- tags/fc15-eol/server/common/oursrc/sql-signup/sql-signup-pam	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/sql-signup/sql-signup-pam	(revision 2244)
@@ -0,0 +1,5 @@
+#%PAM-1.0
+auth		sufficient	pam_succeed_if.so uid >= 500 quiet
+auth		include		config-util
+account		include		config-util
+session		include		config-util
Index: tags/fc15-eol/server/common/oursrc/sql-signup/sql-signup-sbin
===================================================================
--- tags/fc15-eol/server/common/oursrc/sql-signup/sql-signup-sbin	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/sql-signup/sql-signup-sbin	(revision 2244)
@@ -0,0 +1,23 @@
+#!/usr/bin/python
+
+from pwd import getpwuid
+from os import getenv, setuid, setgid, execv
+from sys import exit
+
+SQLUID = 537704221
+SQLGID = 537704221
+SQLBIN = '/afs/athena.mit.edu/contrib/sql/web_scripts/main/batch/signup.php'
+
+caller = int(getenv('USERHELPER_UID'))
+if caller is None or caller == 0:
+	exit('No user specified.')
+else:
+	pw = getpwuid(caller)
+	(user_name, user_uid, user_gid) = (pw[0], pw[2], pw[3])
+
+	if len(user_name) and user_uid > 1000:
+		setgid(SQLGID)
+		setuid(SQLUID)
+		execv(SQLBIN, [SQLBIN, str(user_name), str(user_uid), str(user_gid)])
+	else:
+		print 'Invalid UID:', user_uid
Index: tags/fc15-eol/server/common/oursrc/tokensys/Makefile.in
===================================================================
--- tags/fc15-eol/server/common/oursrc/tokensys/Makefile.in	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/tokensys/Makefile.in	(revision 2244)
@@ -0,0 +1,16 @@
+prefix = @prefix@
+exec_prefix = @exec_prefix@
+libdir = @libdir@
+
+all:
+
+install:
+	mkdir -p $(DESTDIR)$(libdir)
+	install -m a=rx,u+w -p renew $(DESTDIR)$(libdir)/
+
+clean:
+	rm -f renew
+
+distclean: clean
+	rm -f configure config.* Makefile
+	rm -rf auto*.cache
Index: tags/fc15-eol/server/common/oursrc/tokensys/configure.in
===================================================================
--- tags/fc15-eol/server/common/oursrc/tokensys/configure.in	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/tokensys/configure.in	(revision 2244)
@@ -0,0 +1,36 @@
+AC_INIT()
+
+AC_DEFUN(REQUIRE_PATH,[
+AC_SUBST($1_path)
+if test "[$]$1_path" = ""; then
+        AC_ERROR(Cannot find $1)
+fi
+])
+
+AC_ARG_WITH(kinit,
+[  --with-kinit[=PATH]       kinit is located at PATH],[
+  if test "$withval" != "no" -a "$withval" != "yes"; then
+    kinit_path="$withval"
+  fi
+])
+REQUIRE_PATH(kinit)
+
+AC_ARG_WITH(aklog,
+[  --with-aklog[=PATH]       aklog is located at PATH],[
+  if test "$withval" != "no" -a "$withval" != "yes"; then
+    aklog_path="$withval"
+  fi
+])
+REQUIRE_PATH(aklog)
+
+AC_ARG_WITH(fs,
+[  --with-fs[=PATH]          fs is located at PATH],[
+  if test "$withval" != "no" -a "$withval" != "yes"; then
+    fs_path="$withval"
+  fi
+])
+REQUIRE_PATH(fs)
+
+AC_OUTPUT(Makefile)
+AC_OUTPUT(renew)
+AC_OUTPUT(scripts-afsagent-startup)
Index: tags/fc15-eol/server/common/oursrc/tokensys/mrproper
===================================================================
--- tags/fc15-eol/server/common/oursrc/tokensys/mrproper	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/tokensys/mrproper	(revision 2244)
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+rm -f renew
+rm -f configure config.* Makefile
+rm -rf auto*.cache
Index: tags/fc15-eol/server/common/oursrc/tokensys/renew.in
===================================================================
--- tags/fc15-eol/server/common/oursrc/tokensys/renew.in	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/tokensys/renew.in	(revision 2244)
@@ -0,0 +1,18 @@
+#!/bin/sh
+
+# This script renews afsagent's tickets and tokens.
+# It is called by systemd on a regular schedule.
+
+export KRB5CCNAME=/home/afsagent/krb5cc
+export KRBTKFILE=/home/afsagent/tkt
+
+# Option #1: invoke kinit with a password
+#echo "password" | @kinit_path@ >/dev/null daemon/scripts.mit.edu
+
+# Option #2: invoke kinit with a keytab
+@kinit_path@ -k -t /etc/daemon.keytab daemon/scripts.mit.edu
+
+# Obtain AFS tokens
+@aklog_path@
+@aklog_path@ -c sipb
+@aklog_path@ -c csail
Index: tags/fc15-eol/server/common/oursrc/tokensys/scripts-afsagent-startup.in
===================================================================
--- tags/fc15-eol/server/common/oursrc/tokensys/scripts-afsagent-startup.in	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/tokensys/scripts-afsagent-startup.in	(revision 2244)
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+/sbin/sysctl -q afs.GCPAGs=0
+@fs_path@ setcrypt on
+@fs_path@ sysname 'amd64_fedora15_scripts' 'amd64_fedora13_scripts' 'amd64_fedora11_scripts' 'amd64_fedora9_scripts' 'amd64_fedora7_scripts' 'scripts' 'amd64_fedora15' 'amd64_fedora13' 'amd64_fedora11' 'amd64_fedora9' 'amd64_fedora7' 'amd64_linux26' 'i386_deb60' 'i386_deb50' 'i386_deb40' 'i386_rhel4' 'i386_rhel3' 'i386_rh9' 'i386_linux26' 'i386_linux24' 'i386_linux22' 'i386_linux3' 'i386_linux2'
+
+@fs_path@ setcell -nosuid -c athena
Index: tags/fc15-eol/server/common/oursrc/tokensys/scripts-afsagent-startup.service
===================================================================
--- tags/fc15-eol/server/common/oursrc/tokensys/scripts-afsagent-startup.service	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/tokensys/scripts-afsagent-startup.service	(revision 2244)
@@ -0,0 +1,12 @@
+[Unit]
+Description=Scripts AFS Configuration Service
+After=syslog.target openafs-client.service
+Before=crond.service
+Requires=openafs-client.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/libexec/scripts-afsagent-startup
+
+[Install]
+WantedBy=multi-user.target remote-fs.target crond.service
Index: tags/fc15-eol/server/common/oursrc/tokensys/scripts-afsagent.service
===================================================================
--- tags/fc15-eol/server/common/oursrc/tokensys/scripts-afsagent.service	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/tokensys/scripts-afsagent.service	(revision 2244)
@@ -0,0 +1,13 @@
+[Unit]
+Description=Scripts afsagent Service
+After=syslog.target openafs-client.service
+Before=crond.service
+Requires=openafs-client.service
+
+[Service]
+Type=oneshot
+ExecStart=/home/afsagent/renew
+User=afsagent
+
+[Install]
+WantedBy=multi-user.target remote-fs.target crond.service
Index: tags/fc15-eol/server/common/oursrc/tokensys/scripts-afsagent.timer
===================================================================
--- tags/fc15-eol/server/common/oursrc/tokensys/scripts-afsagent.timer	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/tokensys/scripts-afsagent.timer	(revision 2244)
@@ -0,0 +1,9 @@
+[Unit]
+Description=Scripts afsagent periodic renew
+
+[Timer]
+Unit=scripts-afsagent.service
+OnUnitActiveSec=3h
+
+[Install]
+WantedBy=multi-user.target remote-fs.target
Index: tags/fc15-eol/server/common/oursrc/whoisd/Makefile.in
===================================================================
--- tags/fc15-eol/server/common/oursrc/whoisd/Makefile.in	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/whoisd/Makefile.in	(revision 2244)
@@ -0,0 +1,7 @@
+install:
+	install -Dpm 644 whoisd.tac ${DESTDIR}@libexecdir@/whoisd.tac
+	install -Dpm 644 scripts-whoisd.service ${DESTDIR}/lib/systemd/system/scripts-whoisd.service
+
+clean:
+	rm -f ${DESTDIR}@libexecdir@/whoisd.tac
+	rm -f ${DESTDIR}/lib/systemd/system/scripts-whoisd.service
Index: tags/fc15-eol/server/common/oursrc/whoisd/configure.in
===================================================================
--- tags/fc15-eol/server/common/oursrc/whoisd/configure.in	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/whoisd/configure.in	(revision 2244)
@@ -0,0 +1,2 @@
+AC_INIT()
+AC_OUTPUT(Makefile)
Index: tags/fc15-eol/server/common/oursrc/whoisd/crontab
===================================================================
--- tags/fc15-eol/server/common/oursrc/whoisd/crontab	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/whoisd/crontab	(revision 2244)
@@ -0,0 +1,1 @@
+@reboot root /usr/bin/twistd -l /var/log/scripts-whoisd.log --pidfile /var/run/whoisd.pid -y /usr/local/libexec/whoisd.tac
Index: tags/fc15-eol/server/common/oursrc/whoisd/mrproper
===================================================================
--- tags/fc15-eol/server/common/oursrc/whoisd/mrproper	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/whoisd/mrproper	(revision 2244)
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+rm -f configure config.* Makefile
+rm -rf auto*.cache
Index: tags/fc15-eol/server/common/oursrc/whoisd/scripts-whoisd.service
===================================================================
--- tags/fc15-eol/server/common/oursrc/whoisd/scripts-whoisd.service	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/whoisd/scripts-whoisd.service	(revision 2244)
@@ -0,0 +1,10 @@
+[Unit]
+Description=Scripts whois Service
+After=syslog.target dirsrv.service
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/twistd --nodaemon -l /var/log/scripts-whoisd.log --pidfile /var/run/whoisd.pid -y /usr/local/libexec/whoisd.tac
+
+[Install]
+WantedBy=multi-user.target
Index: tags/fc15-eol/server/common/oursrc/whoisd/whoisd.tac
===================================================================
--- tags/fc15-eol/server/common/oursrc/whoisd/whoisd.tac	(revision 2244)
+++ tags/fc15-eol/server/common/oursrc/whoisd/whoisd.tac	(revision 2244)
@@ -0,0 +1,109 @@
+from twisted.application import internet, service
+from twisted.internet import protocol, reactor, defer
+from twisted.protocols import basic
+import ldap, ldap.filter
+import os, sys, pwd, glob
+
+class WhoisProtocol(basic.LineReceiver):
+    def lineReceived(self, hostname):
+    	(key, hostname) = hostname.split('=',2)
+	if key != self.factory.key:
+            self.transport.write("Unauthorized to use whois"+"\r\n")
+	    self.transport.loseConnection()
+	else:
+            self.factory.getWhois(hostname
+            ).addErrback(lambda _: "Internal error in server"
+            ).addCallback(lambda m:
+                          (self.transport.write(m+"\r\n"),
+                           self.transport.loseConnection()))
+class WhoisFactory(protocol.ServerFactory):
+    protocol = WhoisProtocol
+    def __init__(self, vhostDir, ldap_URL, ldap_base, keyFile):
+        self.vhostDir = vhostDir
+        self.ldap_URL = ldap_URL
+        self.ldap = ldap.initialize(self.ldap_URL)
+        self.ldap_base = ldap_base
+        self.vhosts = {}
+        if vhostDir:
+            self.rescanVhosts()
+        self.key = file(keyFile).read()
+    def rescanVhosts(self):
+        newVhosts = {}
+        for f in glob.iglob(os.path.join(self.vhostDir, "*.conf")):
+            locker = os.path.splitext(os.path.basename(f))[0]
+            newVhosts.update(self.parseApacheConf(file(f)))
+        self.vhosts = newVhosts
+        self.vhostTime = os.stat(self.vhostDir).st_mtime
+    def parseApacheConf(self, f):
+        vhosts = {}
+        hostnames = []
+        locker = None
+        docroot = None
+        for l in f:
+            parts = l.split()
+            if not parts: continue
+            command = parts.pop(0)
+            if command in ("ServerName", "ServerAlias"):
+                hostnames.extend(parts)
+            elif command in ("SuExecUserGroup",):
+                locker = parts[0]
+            elif command in ("DocumentRoot",):
+                docroot = parts[0]
+            elif command == "</VirtualHost>":
+                d = {'locker': locker, 'apacheDocumentRoot': docroot, 'apacheServerName': hostnames[0]}
+                for h in hostnames: vhosts[h] = d
+                hostnames = []
+                locker = None
+                docroot = None
+        return vhosts
+    def canonicalize(self, vhost):
+        vhost = vhost.lower().rstrip(".")
+        return vhost
+#        if vhost.endswith(".mit.edu"):
+#            return vhost
+#        else:
+#            return vhost + ".mit.edu"
+    def searchLDAP(self, vhost):
+        results = self.ldap.search_st(self.ldap_base, ldap.SCOPE_SUBTREE,
+            ldap.filter.filter_format(
+                '(|(apacheServername=%s)(apacheServerAlias=%s))', (vhost,)*2),
+                timeout=5)
+        if len(results) >= 1:
+            result = results[0]
+            attrs = result[1]
+            for attr in ('apacheServerName','apacheDocumentRoot', 'apacheSuexecUid', 'apacheSuexecGid'):
+                attrs[attr] = attrs[attr][0]
+            user = pwd.getpwuid(int(attrs['apacheSuexecUid']))
+            if user:
+                attrs['locker'] = user.pw_name
+            else:
+                attrs['locker'] = None
+            return attrs
+        else:
+            return None
+    def getWhois(self, vhost):
+        vhost = self.canonicalize(vhost)
+        info = self.vhosts.get(vhost)
+        tries = 0
+        while (tries < 3) and not info:
+            tries += 1
+            try:
+                info = self.searchLDAP(vhost)
+                break
+            except (ldap.TIMEOUT, ldap.SERVER_DOWN):
+                self.ldap.unbind()
+                self.ldap = ldap.initialize(self.ldap_URL)
+        if info:
+            ret = "Hostname: %s\nAlias: %s\nLocker: %s\nDocument Root: %s" % \
+                (info['apacheServerName'], vhost, info['locker'], info['apacheDocumentRoot'])
+        elif tries == 3:
+            ret = "The whois server is experiencing problems looking up LDAP records.\nPlease contact scripts@mit.edu for help if this problem persists."
+        else:
+            ret = "No such hostname"
+        return defer.succeed(ret)
+
+application = service.Application('whois', uid=99, gid=99)
+factory = WhoisFactory(None,
+    "ldap://localhost", "ou=VirtualHosts,dc=scripts,dc=mit,dc=edu", "/etc/whoisd-password")
+internet.TCPServer(43, factory).setServiceParent(
+    service.IServiceCollection(application))
Index: tags/fc15-eol/server/common/patches/httpd-2.2.x-304.patch
===================================================================
--- tags/fc15-eol/server/common/patches/httpd-2.2.x-304.patch	(revision 2244)
+++ tags/fc15-eol/server/common/patches/httpd-2.2.x-304.patch	(revision 2244)
@@ -0,0 +1,14 @@
+--- httpd-2.2.10/server/util_script.c.orig	2006-09-15 09:19:25.000000000 -0400
++++ httpd-2.2.10/server/util_script.c	2009-03-28 14:33:17.000000000 -0400
+@@ -482,6 +482,11 @@
+             if ((cgi_status == HTTP_UNSET) && (r->method_number == M_GET)) {
+                 cond_status = ap_meets_conditions(r);
+             }
++            else if ((cgi_status == HTTP_NO_CONTENT) ||
++                     (cgi_status == HTTP_NOT_MODIFIED) ||
++                     ap_is_HTTP_INFO(cgi_status)) {
++                r->header_only = 1; /* discard any body */
++            }
+             apr_table_overlap(r->err_headers_out, merge,
+                 APR_OVERLAP_TABLES_MERGE);
+             if (!apr_is_empty_table(cookie_table)) {
Index: tags/fc15-eol/server/common/patches/httpd-2.2.x-log-docroot.patch
===================================================================
--- tags/fc15-eol/server/common/patches/httpd-2.2.x-log-docroot.patch	(revision 2244)
+++ tags/fc15-eol/server/common/patches/httpd-2.2.x-log-docroot.patch	(revision 2244)
@@ -0,0 +1,13 @@
+--- httpd-2.2.8/server/log.c.orig	2009-02-20 01:48:06.000000000 -0500
++++ httpd-2.2.8/server/log.c	2009-02-20 01:55:40.000000000 -0500
+@@ -621,6 +621,10 @@
+         len += apr_snprintf(errstr + len, MAX_STRING_LEN - len,
+                             "[client %s] ", c->remote_ip);
+     }
++    if (r) { // Extract the document root and print it
++      len += apr_sprintf(errstr + len, MAX_STRING_LEN - len,
++			 "[docroot %s] ", ap_document_root(r));
++    }
+     if (status != 0) {
+         if (status < APR_OS_START_EAIERR) {
+             len += apr_snprintf(errstr + len, MAX_STRING_LEN - len,
Index: tags/fc15-eol/server/common/patches/httpd-2.2.x-mod_ssl-sessioncaching.patch
===================================================================
--- tags/fc15-eol/server/common/patches/httpd-2.2.x-mod_ssl-sessioncaching.patch	(revision 2244)
+++ tags/fc15-eol/server/common/patches/httpd-2.2.x-mod_ssl-sessioncaching.patch	(revision 2244)
@@ -0,0 +1,176 @@
+Index: httpd-2.2.x/modules/ssl/ssl_private.h
+===================================================================
+--- httpd-2.2.x/modules/ssl/ssl_private.h	(revision 833672)
++++ httpd-2.2.x/modules/ssl/ssl_private.h	(working copy)
+@@ -395,6 +395,9 @@ typedef struct {
+ #if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
+     const char     *szCryptoDevice;
+ #endif
++#ifndef OPENSSL_NO_TLSEXT
++    ssl_enabled_t  session_tickets_enabled;
++#endif
+     struct {
+         void *pV1, *pV2, *pV3, *pV4, *pV5, *pV6, *pV7, *pV8, *pV9, *pV10;
+     } rCtx;
+@@ -547,6 +550,7 @@ const char  *ssl_cmd_SSLRequire(cmd_parm
+ const char  *ssl_cmd_SSLRenegBufferSize(cmd_parms *cmd, void *dcfg, const char *arg);
+ const char  *ssl_cmd_SSLStrictSNIVHostCheck(cmd_parms *cmd, void *dcfg, int flag);
+ const char *ssl_cmd_SSLInsecureRenegotiation(cmd_parms *cmd, void *dcfg, int flag);
++const char  *ssl_cmd_SSLSessionTicketExtension(cmd_parms *cmd, void *cdfg, int flag);
+ 
+ const char  *ssl_cmd_SSLProxyEngine(cmd_parms *cmd, void *dcfg, int flag);
+ const char  *ssl_cmd_SSLProxyProtocol(cmd_parms *, void *, const char *);
+Index: httpd-2.2.x/modules/ssl/ssl_engine_init.c
+===================================================================
+--- httpd-2.2.x/modules/ssl/ssl_engine_init.c	(revision 833672)
++++ httpd-2.2.x/modules/ssl/ssl_engine_init.c	(working copy)
+@@ -382,6 +382,15 @@ static void ssl_init_ctx_tls_extensions(
+         ssl_log_ssl_error(APLOG_MARK, APLOG_ERR, s);
+         ssl_die();
+     }
++
++    /*
++     * Session tickets (stateless resumption)
++     */
++    if ((myModConfig(s))->session_tickets_enabled == SSL_ENABLED_FALSE) {
++        ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
++                     "Disabling TLS session ticket support");
++        SSL_CTX_set_options(mctx->ssl_ctx, SSL_OP_NO_TICKET);
++    }
+ }
+ #endif
+ 
+@@ -1018,6 +1027,11 @@ void ssl_init_CheckServers(server_rec *b
+ 
+     BOOL conflict = FALSE;
+ 
++#if !defined(OPENSSL_NO_TLSEXT) && OPENSSL_VERSION_NUMBER < 0x009080d0
++    unsigned char *tlsext_tick_keys = NULL;
++    long tick_keys_len;
++#endif
++
+     /*
+      * Give out warnings when a server has HTTPS configured
+      * for the HTTP port or vice versa
+@@ -1042,6 +1056,25 @@ void ssl_init_CheckServers(server_rec *b
+                          ssl_util_vhostid(p, s),
+                          DEFAULT_HTTP_PORT, DEFAULT_HTTPS_PORT);
+         }
++
++#if !defined(OPENSSL_NO_TLSEXT) && OPENSSL_VERSION_NUMBER < 0x009080d0
++        /*
++         * When using OpenSSL versions 0.9.8f through 0.9.8l, configure
++         * the same ticket encryption parameters for every SSL_CTX (workaround
++         * for SNI+SessionTicket extension interoperability issue in these versions)
++         */
++        if ((sc->enabled == SSL_ENABLED_TRUE) ||
++            (sc->enabled == SSL_ENABLED_OPTIONAL)) {
++            if (!tlsext_tick_keys) {
++                tick_keys_len = SSL_CTX_ctrl((sc->server->ssl_ctx),SSL_CTRL_SET_TLSEXT_TICKET_KEYS,
++                                                               (-1),(NULL));
++                tlsext_tick_keys = (unsigned char *)apr_palloc(p, tick_keys_len);
++                RAND_bytes(tlsext_tick_keys, tick_keys_len);
++            }
++            SSL_CTX_ctrl((sc->server->ssl_ctx),SSL_CTRL_SET_TLSEXT_TICKET_KEYS,
++                                           (tick_keys_len),(tlsext_tick_keys));
++        }
++#endif
+     }
+ 
+     /*
+Index: httpd-2.2.x/modules/ssl/ssl_engine_config.c
+===================================================================
+--- httpd-2.2.x/modules/ssl/ssl_engine_config.c	(revision 833672)
++++ httpd-2.2.x/modules/ssl/ssl_engine_config.c	(working copy)
+@@ -75,6 +75,9 @@ SSLModConfigRec *ssl_config_global_creat
+ #if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
+     mc->szCryptoDevice         = NULL;
+ #endif
++#ifndef OPENSSL_NO_TLSEXT
++    mc->session_tickets_enabled = SSL_ENABLED_UNSET;
++#endif
+ 
+     memset(mc->pTmpKeys, 0, sizeof(mc->pTmpKeys));
+ 
+@@ -1471,6 +1474,26 @@ const char  *ssl_cmd_SSLStrictSNIVHostCh
+ #endif
+ }
+ 
++const char *ssl_cmd_SSLSessionTicketExtension(cmd_parms *cmd, void *dcfg, int flag)
++{
++#ifndef OPENSSL_NO_TLSEXT
++    const char *err;
++    SSLModConfigRec *mc = myModConfig(cmd->server);
++
++    if ((err = ap_check_cmd_context(cmd, GLOBAL_ONLY))) {
++        return err;
++    }
++
++    mc->session_tickets_enabled = flag ? SSL_ENABLED_TRUE : SSL_ENABLED_FALSE;
++
++    return NULL;
++#else
++    return "SSLSessionTicketExtension failed; OpenSSL is not built with support "
++           "for TLS extensions. Refer to the documentation, and build "
++           "a compatible version of OpenSSL.";
++#endif
++}
++
+ void ssl_hook_ConfigTest(apr_pool_t *pconf, server_rec *s)
+ {
+     if (!ap_exists_config_define("DUMP_CERTS")) {
+Index: httpd-2.2.x/modules/ssl/ssl_engine_kernel.c
+===================================================================
+--- httpd-2.2.x/modules/ssl/ssl_engine_kernel.c	(revision 833672)
++++ httpd-2.2.x/modules/ssl/ssl_engine_kernel.c	(working copy)
+@@ -29,6 +29,7 @@
+                                   time I was too famous.''
+                                             -- Unknown                */
+ #include "ssl_private.h"
++#include "util_md5.h"
+ 
+ static void ssl_configure_env(request_rec *r, SSLConnRec *sslconn);
+ #ifndef OPENSSL_NO_TLSEXT
+@@ -2010,6 +2011,7 @@ static int ssl_find_vhost(void *serverna
+     apr_array_header_t *names;
+     int i;
+     SSLConnRec *sslcon;
++    char *sid_ctx;
+ 
+     /* check ServerName */
+     if (!strcasecmp(servername, s->server_hostname)) {
+@@ -2074,6 +2076,21 @@ static int ssl_find_vhost(void *serverna
+             SSL_set_verify(ssl, SSL_CTX_get_verify_mode(ssl->ctx),
+                            SSL_CTX_get_verify_callback(ssl->ctx));
+         }
++        /*
++         * Adjust the session id context. ssl_init_ssl_connection()
++         * always picks the configuration of the first vhost when
++         * calling SSL_new(), but we want to tie the session to the
++         * vhost we have just switched to. Again, we have to make sure
++         * that we're not overwriting a session id context which was
++         * possibly set in ssl_hook_Access(), before triggering
++         * a renegotation.
++         */
++        if (!SSL_num_renegotiations(ssl)) {
++            sid_ctx = ap_md5_binary(c->pool, (unsigned char*)sc->vhost_id,
++                                    sc->vhost_id_len);
++            SSL_set_session_id_context(ssl, (unsigned char *)sid_ctx,
++                                       APR_MD5_DIGESTSIZE*2);
++        }
+ 
+         /*
+          * Save the found server into our SSLConnRec for later
+Index: httpd-2.2.x/modules/ssl/mod_ssl.c
+===================================================================
+--- httpd-2.2.x/modules/ssl/mod_ssl.c	(revision 833672)
++++ httpd-2.2.x/modules/ssl/mod_ssl.c	(working copy)
+@@ -92,6 +92,8 @@ static const command_rec ssl_config_cmds
+     SSL_CMD_SRV(RandomSeed, TAKE23,
+                 "SSL Pseudo Random Number Generator (PRNG) seeding source "
+                 "(`startup|connect builtin|file:/path|exec:/path [bytes]')")
++    SSL_CMD_SRV(SessionTicketExtension, FLAG,
++                "TLS Session Ticket extension support")
+ 
+     /*
+      * Per-server context configuration directives
Index: tags/fc15-eol/server/common/patches/httpd-2.2.x-mod_status-security.patch
===================================================================
--- tags/fc15-eol/server/common/patches/httpd-2.2.x-mod_status-security.patch	(revision 2244)
+++ tags/fc15-eol/server/common/patches/httpd-2.2.x-mod_status-security.patch	(revision 2244)
@@ -0,0 +1,70 @@
+Prevents mod_status from taking effect in .htaccess files, by requiring
+a directive that's only permitted in directory context.
+
+Signed-off-by: Quentin Smith <quentin@mit.edu>
+Signed-off-by: Geoffrey Thomas <geofft@mit.edu>
+--- a/modules/generators/mod_status.c	2008-01-02 04:43:52.000000000 -0500
++++ b/modules/generators/mod_status.c	2008-08-06 01:31:26.000000000 -0400
+@@ -115,6 +115,10 @@
+ static pid_t child_pid;
+ #endif
+ 
++typedef struct {
++  int permit_status_handler;
++} status_config_rec;
++
+ /*
+  * command-related code. This is here to prevent use of ExtendedStatus
+  * without status_module included.
+@@ -139,6 +143,13 @@
+     return NULL;
+ }
+ 
++static void *create_status_dir_config(apr_pool_t *p, char *d)
++{
++  status_config_rec *conf = apr_pcalloc(p, sizeof(*conf));
++  conf->permit_status_handler = 0;
++  return conf;
++}
++
+ 
+ static const command_rec status_module_cmds[] =
+ {
+@@ -147,6 +158,11 @@
+     AP_INIT_FLAG("SeeRequestTail", set_reqtail, NULL, RSRC_CONF,
+       "For verbose requests, \"On\" to see the last 63 chars of the request, "
+       "\"Off\" (default) to see the first 63 in extended status display"),
++    AP_INIT_FLAG("PermitStatusHandler", ap_set_flag_slot,
++		 (void *)APR_OFFSETOF(status_config_rec, permit_status_handler),
++		 ACCESS_CONF,
++      "As a security measure, only permit status handlers where this flag "
++      "is set. Only legal in directory context, not .htaccess."),
+     {NULL}
+ };
+ 
+@@ -247,9 +263,13 @@
+     pid_t *pid_buffer, worker_pid;
+     clock_t tu, ts, tcu, tcs;
+     ap_generation_t worker_generation;
+-
+-    if (strcmp(r->handler, STATUS_MAGIC_TYPE) &&
+-        strcmp(r->handler, "server-status")) {
++    
++    status_config_rec *conf = ap_get_module_config(r->per_dir_config,
++                                                      &status_module);
++
++    if ((strcmp(r->handler, STATUS_MAGIC_TYPE) &&
++         strcmp(r->handler, "server-status")) ||
++	!conf->permit_status_handler) {
+         return DECLINED;
+     }
+ 
+@@ -871,7 +891,7 @@
+ module AP_MODULE_DECLARE_DATA status_module =
+ {
+     STANDARD20_MODULE_STUFF,
+-    NULL,                       /* dir config creater */
++    create_status_dir_config,   /* dir config creater */
+     NULL,                       /* dir merger --- default is to override */
+     NULL,                       /* server config */
+     NULL,                       /* merge server config */
Index: tags/fc15-eol/server/common/patches/httpd-fixup-vhost.patch
===================================================================
--- tags/fc15-eol/server/common/patches/httpd-fixup-vhost.patch	(revision 2244)
+++ tags/fc15-eol/server/common/patches/httpd-fixup-vhost.patch	(revision 2244)
@@ -0,0 +1,98 @@
+commit 3b081163d6250d893838d69d9a83f217c341d657
+Author: Greg Brockman <gdb@mit.edu>
+Date:   Fri Aug 6 23:19:15 2010 -0400
+
+    Add method to merge virtual host with a main server_rec
+
+diff --git a/include/http_config.h b/include/http_config.h
+index 5e9fd51..8e6f247 100644
+--- a/include/http_config.h
++++ b/include/http_config.h
+@@ -827,6 +827,16 @@ AP_DECLARE(void) ap_register_hooks(module *m, apr_pool_t *p);
+ AP_DECLARE(void) ap_fixup_virtual_hosts(apr_pool_t *p, 
+                                         server_rec *main_server);
+ 
++/**
++ * Setup a single virtual host by merging the main server_rec into it.
++ * @param p The pool to allocate from
++ * @param main_server The server_rec with which to merge
++ * @param virt The virtual host server_rec with some set of directives to override already set
++ */
++AP_DECLARE(void) ap_fixup_virtual_host(apr_pool_t *p,
++				       server_rec *main_server,
++				       server_rec *virt);
++
+ /* For http_request.c... */
+ 
+ /**
+diff --git a/server/config.c b/server/config.c
+index 101d0e4..ef0f2ba 100644
+--- a/server/config.c
++++ b/server/config.c
+@@ -1902,38 +1902,43 @@ AP_CORE_DECLARE(const char *) ap_init_virtual_host(apr_pool_t *p,
+ }
+ 
+ 
+-AP_DECLARE(void) ap_fixup_virtual_hosts(apr_pool_t *p, server_rec *main_server)
++AP_DECLARE(void) ap_fixup_virtual_host(apr_pool_t *p, server_rec *main_server,
++                                       server_rec *virt)
+ {
+-    server_rec *virt;
++    merge_server_configs(p, main_server->module_config,
++                         virt->module_config);
+ 
+-    for (virt = main_server->next; virt; virt = virt->next) {
+-        merge_server_configs(p, main_server->module_config,
+-                             virt->module_config);
++    virt->lookup_defaults =
++        ap_merge_per_dir_configs(p, main_server->lookup_defaults,
++                                 virt->lookup_defaults);
+ 
+-        virt->lookup_defaults =
+-            ap_merge_per_dir_configs(p, main_server->lookup_defaults,
+-                                     virt->lookup_defaults);
++    if (virt->server_admin == NULL)
++        virt->server_admin = main_server->server_admin;
+ 
+-        if (virt->server_admin == NULL)
+-            virt->server_admin = main_server->server_admin;
++    if (virt->timeout == 0)
++        virt->timeout = main_server->timeout;
+ 
+-        if (virt->timeout == 0)
+-            virt->timeout = main_server->timeout;
++    if (virt->keep_alive_timeout == 0)
++        virt->keep_alive_timeout = main_server->keep_alive_timeout;
+ 
+-        if (virt->keep_alive_timeout == 0)
+-            virt->keep_alive_timeout = main_server->keep_alive_timeout;
++    if (virt->keep_alive == -1)
++        virt->keep_alive = main_server->keep_alive;
+ 
+-        if (virt->keep_alive == -1)
+-            virt->keep_alive = main_server->keep_alive;
++    if (virt->keep_alive_max == -1)
++        virt->keep_alive_max = main_server->keep_alive_max;
+ 
+-        if (virt->keep_alive_max == -1)
+-            virt->keep_alive_max = main_server->keep_alive_max;
++    /* XXX: this is really something that should be dealt with by a
++     * post-config api phase
++     */
++    ap_core_reorder_directories(p, virt);
++}
+ 
+-        /* XXX: this is really something that should be dealt with by a
+-         * post-config api phase
+-         */
+-        ap_core_reorder_directories(p, virt);
+-    }
++AP_DECLARE(void) ap_fixup_virtual_hosts(apr_pool_t *p, server_rec *main_server)
++{
++    server_rec *virt;
++
++    for (virt = main_server->next; virt; virt = virt->next)
++        ap_fixup_virtual_host(p, main_server, virt);
+ 
+     ap_core_reorder_directories(p, main_server);
+ }
Index: tags/fc15-eol/server/common/patches/httpd-suexec-cloexec.patch
===================================================================
--- tags/fc15-eol/server/common/patches/httpd-suexec-cloexec.patch	(revision 2244)
+++ tags/fc15-eol/server/common/patches/httpd-suexec-cloexec.patch	(revision 2244)
@@ -0,0 +1,52 @@
+From: Stefan Fritsch <sf@apache.org>
+Date: Sat, 3 Oct 2009 13:46:48 +0000
+Subject: suexec: Allow to log an error if exec fails by setting FD_CLOEXEC on the log file instead of closing it.
+
+PR: 10744
+Submitted by: Nicolas Rachinsky
+Reviewed by: Stefan Fritsch
+
+Origin: upstream, http://svn.apache.org/viewvc?rev=821321&view=rev
+Bug: https://issues.apache.org/bugzilla/show_bug.cgi?id=10744
+---
+ support/suexec.c |   18 +++++++++---------
+ 1 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/support/suexec.c b/support/suexec.c
+index cb4e85f..85e1318 100644
+--- a/support/suexec.c
++++ b/support/suexec.c
+@@ -49,6 +49,7 @@
+ #include <stdio.h>
+ #include <stdarg.h>
+ #include <stdlib.h>
++#include <fcntl.h>
+ #include <selinux/selinux.h>
+ 
+ #ifdef HAVE_PWD_H
+@@ -714,17 +715,16 @@ TRUSTED_DIRECTORY:
+ #endif /* AP_SUEXEC_UMASK */
+ 
+     /*
+-     * Be sure to close the log file so the CGI can't
+-     * mess with it.  If the exec fails, it will be reopened
+-     * automatically when log_err is called.  Note that the log
+-     * might not actually be open if AP_LOG_EXEC isn't defined.
+-     * However, the "log" cell isn't ifdef'd so let's be defensive
+-     * and assume someone might have done something with it
+-     * outside an ifdef'd AP_LOG_EXEC block.
++     * ask fcntl(2) to set the FD_CLOEXEC flag on the log file,
++     * so it'll be automagically closed if the exec() call succeeds.
+      */
+     if (log != NULL) {
+-        fclose(log);
+-        log = NULL;
++        fflush(log);
++        setbuf(log,NULL);
++        if ((fcntl(fileno(log), F_SETFD, FD_CLOEXEC) == -1)) {
++            log_err("error: can't set close-on-exec flag");
++            exit(122);
++        }
+     }
+ 
+     /*
Index: tags/fc15-eol/server/common/patches/httpd-suexec-scripts.patch
===================================================================
--- tags/fc15-eol/server/common/patches/httpd-suexec-scripts.patch	(revision 2244)
+++ tags/fc15-eol/server/common/patches/httpd-suexec-scripts.patch	(revision 2244)
@@ -0,0 +1,346 @@
+# scripts.mit.edu httpd suexec patch
+# Copyright (C) 2006, 2007, 2008  Jeff Arnold <jbarnold@mit.edu>,
+#                                 Joe Presbrey <presbrey@mit.edu>,
+#                                 Anders Kaseorg <andersk@mit.edu>,
+#                                 Geoffrey Thomas <geofft@mit.edu>
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA
+#
+# See /COPYRIGHT in this repository for more information.
+#
+--- httpd-2.2.2/support/Makefile.in.old	2005-07-06 19:15:34.000000000 -0400
++++ httpd-2.2.2/support/Makefile.in	2007-01-20 17:12:51.000000000 -0500
+@@ -60,7 +60,7 @@
+
+ suexec_OBJECTS = suexec.lo
+ suexec: $(suexec_OBJECTS)
+-	$(LINK) $(suexec_OBJECTS)
++	$(LINK) -lselinux $(suexec_OBJECTS)
+
+ htcacheclean_OBJECTS = htcacheclean.lo
+ htcacheclean: $(htcacheclean_OBJECTS)
+--- httpd-2.2.2/configure.in.old	2007-07-17 10:48:25.000000000 -0400
++++ httpd-2.2.2/configure.in	2008-08-29 08:15:41.000000000 -0400
+@@ -559,6 +559,10 @@
+ APACHE_HELP_STRING(--with-suexec-userdir,User subdirectory),[
+   AC_DEFINE_UNQUOTED(AP_USERDIR_SUFFIX, "$withval", [User subdirectory] ) ] )
+ 
++AC_ARG_WITH(suexec-trusteddir,
++APACHE_HELP_STRING(--with-suexec-trusteddir,Trusted SuExec directory),[
++  AC_DEFINE_UNQUOTED(AP_TRUSTED_DIRECTORY, "$withval", [Trusted SuExec directory] ) ] )
++
+ AC_ARG_WITH(suexec-docroot,
+ APACHE_HELP_STRING(--with-suexec-docroot,SuExec root directory),[
+   AC_DEFINE_UNQUOTED(AP_DOC_ROOT, "$withval", [SuExec root directory] ) ] )
+--- httpd-2.2.11/support/suexec.c.old	2008-11-30 10:47:31.000000000 -0500
++++ httpd-2.2.11/support/suexec.c	2009-06-08 09:02:17.000000000 -0400
+@@ -30,6 +30,9 @@
+  *
+  */
+ 
++#define STATIC_CAT_PATH "/usr/bin/static-cat"
++#define PHP_PATH "/usr/bin/php-cgi"
++
+ #include "apr.h"
+ #include "ap_config.h"
+ #include "suexec.h"
+@@ -46,6 +49,7 @@
+ #include <stdio.h>
+ #include <stdarg.h>
+ #include <stdlib.h>
++#include <selinux/selinux.h>
+ 
+ #ifdef HAVE_PWD_H
+ #include <pwd.h>
+@@ -95,6 +99,7 @@
+ {
+     /* variable name starts with */
+     "HTTP_",
++    "HTTPS_",
+     "SSL_",
+ 
+     /* variable name is */
+@@ -245,9 +250,108 @@
+     environ = cleanenv;
+ }
+ 
++static const char *static_extensions[] = {
++    "html",
++    "css",
++    "gif",
++    "jpg",
++    "png",
++    "htm",
++    "jpeg",
++    "js",
++    "ico",
++    "xml",
++    "xsl",
++    "tiff",
++    "tif",
++    "tgz",
++    "tar",
++    "jar",
++    "zip",
++    "pdf",
++    "ps",
++    "doc",
++    "xls",
++    "ppt",
++    "dot",
++    "docx",
++    "dotx",
++    "docm",
++    "dotm",
++    "xlt",
++    "xla",
++    "xlsx",
++    "xltx",
++    "xlsm",
++    "xltm",
++    "xlam",
++    "xlsb",
++    "pot",
++    "pps",
++    "ppa",
++    "pptx",
++    "potx",
++    "ppsx",
++    "ppam",
++    "pptm",
++    "potm",
++    "ppsm",
++    "swf",
++    "mp3",
++    "mov",
++    "wmv",
++    "mpg",
++    "mpeg",
++    "avi",
++    "il",
++    "xhtml",
++    "svg",
++    "xaml",
++    "xap",
++    "wav",
++    "mid",
++    "midi",
++    "ttf",
++    "otf",
++    "odc",
++    "odb",
++    "odf",
++    "odg",
++    "otg",
++    "odi",
++    "odp",
++    "otp",
++    "ods",
++    "ots",
++    "odt",
++    "odm",
++    "ott",
++    "oth",
++    NULL
++};
++
++static int is_static_extension(const char *file)
++{
++    const char *extension = strrchr(file, '.');
++    const char **p;
++    if (extension == NULL) return 0;
++    for (p = static_extensions; *p; ++p) {
++        if (strcasecmp(extension + 1, *p) == 0) return 1;
++    }
++    return 0;
++}
++
++static int is_php_extension(const char *file)
++{
++    const char *extension = strrchr(file, '.');
++    if (extension == NULL) return 0;
++    return strcmp(extension + 1, "php") == 0;
++}
++
+ int main(int argc, char *argv[])
+ {
+     int userdir = 0;        /* ~userdir flag             */
++    int trusteddir = 0;     /* TRUSTED_DIRECTORY flag    */
+     uid_t uid;              /* user information          */
+     gid_t gid;              /* target group placeholder  */
+     char *target_uname;     /* target user name          */
+@@ -268,6 +368,7 @@
+      * Start with a "clean" environment
+      */
+     clean_env();
++    setenv("JAVA_TOOL_OPTIONS", "-Xmx128M", 1); /* scripts.mit.edu local hack */
+ 
+     prog = argv[0];
+     /*
+@@ -350,6 +451,20 @@
+ #endif /*_OSD_POSIX*/
+ 
+     /*
++     * First check if this is an absolute path to the directory
++     * of trusted executables. These are supposed to be security
++     * audited to check parameters and validity on their own...
++     */
++    if (strstr(cmd, AP_TRUSTED_DIRECTORY) == cmd) {
++        if (strstr(cmd, "/../") != NULL) {
++            log_err("invalid command (%s)\n", cmd);
++            exit(104);
++        }
++        trusteddir = 1;
++        goto TRUSTED_DIRECTORY;
++    }
++
++    /*
+      * Check for a leading '/' (absolute path) in the command to be executed,
+      * or attempts to back up out of the current directory,
+      * to protect against attacks.  If any are
+@@ -371,6 +486,7 @@
+         userdir = 1;
+     }
+ 
++TRUSTED_DIRECTORY:
+     /*
+      * Error out if the target username is invalid.
+      */
+@@ -452,7 +568,7 @@
+      * Error out if attempt is made to execute as root or as
+      * a UID less than AP_UID_MIN.  Tsk tsk.
+      */
+-    if ((uid == 0) || (uid < AP_UID_MIN)) {
++    if ((uid == 0) || (uid < AP_UID_MIN && uid != 102)) { /* uid 102 = signup  */
+         log_err("cannot run as forbidden uid (%d/%s)\n", uid, cmd);
+         exit(107);
+     }
+@@ -484,6 +599,7 @@
+         log_err("failed to setuid (%ld: %s)\n", uid, cmd);
+         exit(110);
+     }
++    setenv("HOME", target_homedir, 1);
+ 
+     /*
+      * Get the current working directory, as well as the proper
+@@ -506,6 +637,21 @@
+             log_err("cannot get docroot information (%s)\n", target_homedir);
+             exit(112);
+         }
++        size_t expected_len = strlen(target_homedir)+1+strlen(AP_USERDIR_SUFFIX)+1;
++        char *expected = malloc(expected_len);
++        snprintf(expected, expected_len, "%s/%s", target_homedir, AP_USERDIR_SUFFIX);
++        if (strncmp(cwd, expected, expected_len-1) != 0) {
++            log_err("error: file's directory not a subdirectory of user's home directory (%s, %s)\n", cwd, expected);
++            exit(114);
++        }
++    }
++    else if (trusteddir) {
++        if (((chdir(AP_TRUSTED_DIRECTORY)) != 0) ||
++            ((getcwd(dwd, AP_MAXPATH)) == NULL) |
++            ((chdir(cwd)) != 0)) {
++            log_err("cannot get docroot information (%s)\n", AP_TRUSTED_DIRECTORY);
++            exit(112);
++        }
+     }
+     else {
+         if (((chdir(AP_DOC_ROOT)) != 0) ||
+@@ -532,15 +678,17 @@
+     /*
+      * Error out if cwd is writable by others.
+      */
++#if 0
+     if ((dir_info.st_mode & S_IWOTH) || (dir_info.st_mode & S_IWGRP)) {
+         log_err("directory is writable by others: (%s)\n", cwd);
+         exit(116);
+     }
++#endif
+ 
+     /*
+      * Error out if we cannot stat the program.
+      */
+-    if (((lstat(cmd, &prg_info)) != 0) || (S_ISLNK(prg_info.st_mode))) {
++    if (((lstat(cmd, &prg_info)) != 0) /*|| (S_ISLNK(prg_info.st_mode))*/) {
+         log_err("cannot stat program: (%s)\n", cmd);
+         exit(117);
+     }
+@@ -548,10 +696,12 @@
+     /*
+      * Error out if the program is writable by others.
+      */
++#if 0
+     if ((prg_info.st_mode & S_IWOTH) || (prg_info.st_mode & S_IWGRP)) {
+         log_err("file is writable by others: (%s/%s)\n", cwd, cmd);
+         exit(118);
+     }
++#endif
+ 
+     /*
+      * Error out if the file is setuid or setgid.
+@@ -565,6 +715,7 @@
+      * Error out if the target name/group is different from
+      * the name/group of the cwd or the program.
+      */
++#if 0
+     if ((uid != dir_info.st_uid) ||
+         (gid != dir_info.st_gid) ||
+         (uid != prg_info.st_uid) ||
+@@ -576,12 +727,14 @@
+                 prg_info.st_uid, prg_info.st_gid);
+         exit(120);
+     }
++#endif
+     /*
+      * Error out if the program is not executable for the user.
+      * Otherwise, she won't find any error in the logs except for
+      * "[error] Premature end of script headers: ..."
+      */
+-    if (!(prg_info.st_mode & S_IXUSR)) {
++    if (!is_static_extension(cmd) && !is_php_extension(cmd) &&
++        !(prg_info.st_mode & S_IXUSR)) {
+         log_err("file has no execute permission: (%s/%s)\n", cwd, cmd);
+         exit(121);
+     }
+@@ -614,6 +767,30 @@
+     /*
+      * Execute the command, replacing our image with its own.
+      */
++    if (is_static_extension(cmd)) {
++        if (setenv("PATH_TRANSLATED", cmd, 1) != 0) {
++            log_err("setenv failed\n");
++            exit(255);
++        }
++        execl(STATIC_CAT_PATH, STATIC_CAT_PATH, (const char *)NULL);
++        log_err("(%d)%s: static-cat exec failed (%s)\n", errno, strerror(errno), STATIC_CAT_PATH);
++        exit(255);
++    }
++    if (is_php_extension(cmd)) {
++        setenv("PHPRC", ".", 1);
++        argv[1] = PHP_PATH;
++        argv[2] = "-f";
++        /*
++         * argv[3] is the command to run. argv[4] is either an argument or
++         * already null. We don't want to pass any arguments through from
++         * Apache (since they're untrusted), so we chop off the remainder
++         * of argv here.
++         */
++        argv[4] = 0;
++        execv(PHP_PATH, &argv[1]);
++        log_err("(%d)%s: php exec failed (%s)\n", errno, strerror(errno), argv[1]);
++        exit(255);
++    }
+ #ifdef NEED_HASHBANG_EMUL
+     /* We need the #! emulation when we want to execute scripts */
+     {
Index: tags/fc15-eol/server/common/patches/httpd-sysv-deps.patch
===================================================================
--- tags/fc15-eol/server/common/patches/httpd-sysv-deps.patch	(revision 2244)
+++ tags/fc15-eol/server/common/patches/httpd-sysv-deps.patch	(revision 2244)
@@ -0,0 +1,11 @@
+--- a/httpd.init.orig	2011-11-05 19:10:18.897425517 -0400
++++ b/httpd.init	2011-11-05 19:11:22.523201035 -0400
+@@ -12,7 +12,7 @@
+ #
+ ### BEGIN INIT INFO
+ # Provides: httpd
+-# Required-Start: $local_fs $remote_fs $network $named
++# Required-Start: $local_fs $remote_fs $network $named openafs-client crond
+ # Required-Stop: $local_fs $remote_fs $network
+ # Should-Start: distcache
+ # Short-Description: start and stop Apache HTTP Server
Index: tags/fc15-eol/server/common/patches/krb5-kuserok-scripts.patch
===================================================================
--- tags/fc15-eol/server/common/patches/krb5-kuserok-scripts.patch	(revision 2244)
+++ tags/fc15-eol/server/common/patches/krb5-kuserok-scripts.patch	(revision 2244)
@@ -0,0 +1,150 @@
+# scripts.mit.edu krb5 kuserok patch
+# Copyright (C) 2006  Tim Abbott <tabbott@mit.edu>
+#               2011  Alexander Chernyakhovsky <achernya@mit.edu>
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA
+#
+# See /COPYRIGHT in this repository for more information.
+#
+--- krb5-1.9/src/lib/krb5/os/kuserok.c.old	2011-04-16 19:09:58.000000000 -0400
++++ krb5-1.9/src/lib/krb5/os/kuserok.c	2011-04-16 19:34:23.000000000 -0400
+@@ -32,6 +32,7 @@
+ #if !defined(_WIN32)            /* Not yet for Windows */
+ #include <stdio.h>
+ #include <pwd.h>
++#include <sys/wait.h>
+ 
+ #if defined(_AIX) && defined(_IBMR2)
+ #include <sys/access.h>
+@@ -51,39 +52,6 @@
+ enum result { ACCEPT, REJECT, PASS };
+ 
+ /*
+- * Find the k5login filename for luser, either in the user's homedir or in a
+- * configured directory under the username.
+- */
+-static krb5_error_code
+-get_k5login_filename(krb5_context context, const char *luser,
+-                     const char *homedir, char **filename_out)
+-{
+-    krb5_error_code ret;
+-    char *dir, *filename;
+-
+-    *filename_out = NULL;
+-    ret = profile_get_string(context->profile, KRB5_CONF_LIBDEFAULTS,
+-                             KRB5_CONF_K5LOGIN_DIRECTORY, NULL, NULL, &dir);
+-    if (ret != 0)
+-        return ret;
+-
+-    if (dir == NULL) {
+-        /* Look in the user's homedir. */
+-        if (asprintf(&filename, "%s/.k5login", homedir) < 0)
+-            return ENOMEM;
+-    } else {
+-        /* Look in the configured directory. */
+-        if (asprintf(&filename, "%s/%s", dir, luser) < 0)
+-            ret = ENOMEM;
+-        profile_release_string(dir);
+-        if (ret)
+-            return ret;
+-    }
+-    *filename_out = filename;
+-    return 0;
+-}
+-
+-/*
+  * Determine whether principal is authorized to log in as luser according to
+  * the user's k5login file.  Return ACCEPT if the k5login file authorizes the
+  * principal, PASS if the k5login file does not exist, or REJECT if the k5login
+@@ -93,13 +61,12 @@
+ static enum result
+ k5login_ok(krb5_context context, krb5_principal principal, const char *luser)
+ {
+-    int authoritative = TRUE, gobble;
++    int authoritative = TRUE;
+     enum result result = REJECT;
+-    char *filename = NULL, *princname = NULL;
+-    char *newline, linebuf[BUFSIZ], pwbuf[BUFSIZ];
+-    struct stat sbuf;
++    char *princname = NULL;
++    char pwbuf[BUFSIZ];
+     struct passwd pwx, *pwd;
+-    FILE *fp = NULL;
++    int pid, status;
+ 
+     if (profile_get_boolean(context->profile, KRB5_CONF_LIBDEFAULTS,
+                             KRB5_CONF_K5LOGIN_AUTHORITATIVE, NULL, TRUE,
+@@ -110,46 +77,29 @@
+     if (k5_getpwnam_r(luser, &pwx, pwbuf, sizeof(pwbuf), &pwd) != 0)
+         goto cleanup;
+ 
+-    if (get_k5login_filename(context, luser, pwd->pw_dir, &filename) != 0)
+-        goto cleanup;
+-
+-    if (access(filename, F_OK) != 0) {
+-        result = PASS;
+-        goto cleanup;
+-    }
+-
+     if (krb5_unparse_name(context, principal, &princname) != 0)
+         goto cleanup;
+ 
+-    fp = fopen(filename, "r");
+-    if (fp == NULL)
++    if ((pid = fork()) == -1)
+         goto cleanup;
+-    set_cloexec_file(fp);
+-
+-    /* For security reasons, the .k5login file must be owned either by
+-     * the user or by root. */
+-    if (fstat(fileno(fp), &sbuf))
+-        goto cleanup;
+-    if (sbuf.st_uid != pwd->pw_uid && !FILE_OWNER_OK(sbuf.st_uid))
+-        goto cleanup;
+-
+-    /* Check each line. */
+-    while (result != ACCEPT && (fgets(linebuf, sizeof(linebuf), fp) != NULL)) {
+-        newline = strrchr(linebuf, '\n');
+-        if (newline != NULL)
+-            *newline = '\0';
+-        if (strcmp(linebuf, princname) == 0)
+-            result = ACCEPT;
+-        /* Clean up the rest of the line if necessary. */
+-        if (newline == NULL)
+-            while (((gobble = getc(fp)) != EOF) && gobble != '\n');
++    
++    if (pid == 0) {
++        char *args[4];
++#define ADMOF_PATH "/usr/local/sbin/ssh-admof"
++        args[0] = ADMOF_PATH;
++        args[1] = (char *) luser;
++        args[2] = princname;
++        args[3] = NULL;
++        execv(ADMOF_PATH, args);
++        exit(1);
+     }
+ 
++    if (waitpid(pid, &status, 0) > 0 && WIFEXITED(status) && WEXITSTATUS(status) == 33) {
++        result = ACCEPT;
++    }
++    
+ cleanup:
+     free(princname);
+-    free(filename);
+-    if (fp != NULL)
+-        fclose(fp);
+     /* If k5login files are non-authoritative, never reject. */
+     return (!authoritative && result == REJECT) ? PASS : result;
+ }
Index: tags/fc15-eol/server/common/patches/moira-fix-manpage-paths.patch
===================================================================
--- tags/fc15-eol/server/common/patches/moira-fix-manpage-paths.patch	(revision 2244)
+++ tags/fc15-eol/server/common/patches/moira-fix-manpage-paths.patch	(revision 2244)
@@ -0,0 +1,40 @@
+Index: moira/man/update_server.8
+===================================================================
+--- moira.orig/man/update_server.8     2010-01-04 21:12:54.000000000 -0500
++++ moira/man/update_server.8  2010-01-04 22:03:58.000000000 -0500
+@@ -14,7 +14,7 @@
+ it is needed.
+ .SH OPTIONS
+ While there are no command line options, a configuration file
+-.I /etc/athena/moira.conf
++.I /etc/moira.conf
+ may specify a number of options.  This file may contain blank lines,
+ comments preceeded by hash marks, boolean options, or string options.
+ A boolean option is set by just putting the name of the option on a
+@@ -48,7 +48,7 @@
+ .B sms
+ in the local realm is assumed.
+ .SH FILES
+-/etc/athena/moira.conf \- For configuration variables.
+-/etc/athena/srvtab \- It must be able to get rcmd Kerberos tickets.
++/etc/moira.conf \- For configuration variables.
++/etc/srvtab \- It must be able to get rcmd Kerberos tickets.
+ .SH "SEE ALSO"
+ The Project Athena Technical Plan section on Moira.
+Index: moira/man/moira.3
+===================================================================
+--- moira.orig/man/moira.3     2010-01-04 22:04:05.000000000 -0500
++++ moira/man/moira.3  2010-01-04 22:04:20.000000000 -0500
+@@ -239,9 +239,9 @@
+ except that it uses strcmp on the elements rather than comparing the
+ addresses directly.
+ .SH FILES
+-/usr/athena/include/moira.h
++/usr/include/moira/moira.h
+ .br
+-/usr/athena/include/mr_et.h
++/usr/include/moira/mr_et.h
+ .br
+ /tmp/tkt###
+ .SH "SEE ALSO"
+
Index: tags/fc15-eol/server/common/patches/moira-update-server.rc.patch
===================================================================
--- tags/fc15-eol/server/common/patches/moira-update-server.rc.patch	(revision 2244)
+++ tags/fc15-eol/server/common/patches/moira-update-server.rc.patch	(revision 2244)
@@ -0,0 +1,131 @@
+--- /dev/null	2009-12-25 01:17:35.868011025 -0500
++++ moira-update-server.init	2009-12-26 22:31:51.000000000 -0500
+@@ -0,0 +1,128 @@
++#! /bin/sh
++# Stolen from Debathena
++
++### BEGIN INIT INFO
++# Provides:          moira-update-server
++# Required-Start:    $local_fs $remote_fs
++# Required-Stop:     $local_fs $remote_fs
++# Default-Start:     2 3 4 5
++# Default-Stop:      0 1 6
++# Short-Description: Moira update_server
++# Description:       The moira update_server program for taking updates from
++#                    moira
++### END INIT INFO
++
++# Original Author: Evan Broder <broder@mit.edu>
++# Modified for Fedora by Greg Brockman <gdb@mit.edu>
++
++# Do NOT "set -e"
++
++# PATH should only include /usr/* if it runs after the mountnfs.sh script
++
++prog=update_server
++exec=/usr/sbin/update_server
++config=/etc/athena/moira.conf
++
++# From Debathena
++PATH=/usr/sbin:/usr/bin:/sbin:/bin
++DESC="Moira update_server"
++DAEMON_ARGS=""
++SCRIPTNAME=/etc/rc.d/init.d/$NAME
++
++# Exit if the package is not installed
++[ -x "$exec" ] || exit 0
++
++# Read configuration variable file if it is present
++[ -r /etc/default/$prog ] && . /etc/default/$prog
++
++# Load the VERBOSE setting and other rcS variables
++[ -f /etc/default/rcS ] && . /etc/default/rcS
++
++# Define LSB log_* functions.
++# Depend on lsb-base (>= 3.0-6) to ensure that this file is present.
++. /lib/lsb/init-functions
++# End from Debathena
++
++# Source function library.
++. /etc/rc.d/init.d/functions
++
++[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog
++
++lockfile=/var/lock/subsys/$prog
++
++start() {
++    [ -x $exec ] || exit 5
++    [ -f $config ] || exit 6
++    echo -n $"Starting $prog: "
++    # if not running, start it up here, usually something like "daemon $exec"
++    daemon $exec
++    retval=$?
++    echo
++    [ $retval -eq 0 ] && touch $lockfile
++    return $retval
++}
++
++stop() {
++    echo -n $"Stopping $prog: "
++    # stop it here, often "killproc $prog"
++    killproc $prog
++    retval=$?
++    echo
++    [ $retval -eq 0 ] && rm -f $lockfile
++    return $retval
++}
++
++restart() {
++    stop
++    start
++}
++
++reload() {
++    restart
++}
++
++force_reload() {
++    restart
++}
++
++rh_status() {
++    # run checks to determine if the service is running or use generic status
++    status $prog
++}
++
++rh_status_q() {
++    rh_status >/dev/null 2>&1
++}
++
++
++case "$1" in
++    start)
++        rh_status_q && exit 0
++        $1
++        ;;
++    stop)
++        rh_status_q || exit 0
++        $1
++        ;;
++    restart)
++        $1
++        ;;
++    reload)
++        rh_status_q || exit 7
++        $1
++        ;;
++    force-reload)
++        force_reload
++        ;;
++    status)
++        rh_status
++        ;;
++    condrestart|try-restart)
++        rh_status_q || exit 0
++        restart
++        ;;
++    *)
++        echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}"
++        exit 2
++esac
++exit $?
Index: tags/fc15-eol/server/common/patches/openafs-scripts.patch
===================================================================
--- tags/fc15-eol/server/common/patches/openafs-scripts.patch	(revision 2244)
+++ tags/fc15-eol/server/common/patches/openafs-scripts.patch	(revision 2244)
@@ -0,0 +1,271 @@
+# scripts.mit.edu openafs patch
+# Copyright (C) 2006  Jeff Arnold <jbarnold@mit.edu>
+# with modifications by Joe Presbrey <presbrey@mit.edu>
+# and Anders Kaseorg <andersk@mit.edu>
+# and Edward Z. Yang <ezyang@mit.edu>
+# and Benjamin Kaduk <kaduk@mit.edu>
+# and Alexander Chernyakhovsky <achernya@mit.edu>
+#
+# This file is available under both the MIT license and the GPL.
+#
+
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+# 
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+# 
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+# THE SOFTWARE.
+#
+
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA
+#
+# See /COPYRIGHT in this repository for more information.
+#
+diff --git a/src/afs/LINUX/osi_vnodeops.c b/src/afs/LINUX/osi_vnodeops.c
+index 7c7705e..0d0e94f 100644
+--- a/src/afs/LINUX/osi_vnodeops.c
++++ b/src/afs/LINUX/osi_vnodeops.c
+@@ -904,6 +904,28 @@ afs_linux_dentry_revalidate(struct dentry *dp, int flags)
+ 	/* should we always update the attributes at this point? */
+ 	/* unlikely--the vcache entry hasn't changed */
+ 
++	/* [scripts] This code makes hardlinks work correctly.
++	*
++	* We want Apache to be able to read a file with hardlinks
++	* named .htaccess and foo to be able to read it via .htaccess
++	* and not via foo, regardless of which name was looked up
++	* (remember, inodes do not have filenames associated with them.)
++	*
++	* It is important that we modify the existing cache entry even
++	* if it is otherwise totally valid and would not be reloaded.
++	* Otherwise, it won't recover from repeatedly reading the same
++	* inode via multiple hardlinks or different names.  Specifically,
++	* Apache will be able to read both names if it was first looked
++	* up (by anyone!) via .htaccess, and neither if it was first
++	* looked up via foo.
++	*
++	* With regards to performance, the strncmp() is bounded by
++	* three characters, so it takes O(3) operations.  If this code
++	* is extended to all static-cat extensions, we'll want to do
++	* some clever hashing using gperf here.
++	*/
++	vcp->apache_access = strncmp(dp->d_name.name, ".ht", 3) == 0;
++
+ 	dput(parent);
+     } else {
+ #ifdef notyet
+diff --git a/src/afs/VNOPS/afs_vnop_access.c b/src/afs/VNOPS/afs_vnop_access.c
+index eabcfeb..6390850 100644
+--- a/src/afs/VNOPS/afs_vnop_access.c
++++ b/src/afs/VNOPS/afs_vnop_access.c
+@@ -130,6 +130,15 @@ afs_AccessOK(struct vcache *avc, afs_int32 arights, struct vrequest *areq,
+ 	    dirBits = PRSFS_LOOKUP | PRSFS_READ;
+ 	    return (arights == (dirBits & arights));
+ 	}
++	if ( areq->uid == globalpag &&
++	    !(areq->realuid == avc->f.fid.Fid.Volume) &&
++	    !((avc->f.anyAccess | arights) == avc->f.anyAccess) &&
++	    !(((arights & ~(PRSFS_LOOKUP|PRSFS_READ)) == 0) && areq->realuid == HTTPD_UID) &&
++	    !(((arights & ~(PRSFS_LOOKUP|PRSFS_READ)) == 0) && areq->realuid == POSTFIX_UID) &&
++	    !(areq->realuid == 0 && PRSFS_USR3 == afs_GetAccessBits(avc, PRSFS_USR3, areq)) &&
++	    !((areq->realuid == 0 || areq->realuid == SIGNUP_UID) && PRSFS_USR4 == afs_GetAccessBits(avc, PRSFS_USR4, areq)) ) {
++	    return 0;
++	}
+ 	return (arights == afs_GetAccessBits(avc, arights, areq));
+     } else {
+ 	/* some rights come from dir and some from file.  Specifically, you 
+@@ -183,6 +192,19 @@ afs_AccessOK(struct vcache *avc, afs_int32 arights, struct vrequest *areq,
+ 		    fileBits |= PRSFS_READ;
+ 	    }
+ 	}
++
++	if ( areq->uid == globalpag &&
++	    !(areq->realuid == avc->f.fid.Fid.Volume) &&
++	    !((avc->f.anyAccess | arights) == avc->f.anyAccess) &&
++	    !(arights == PRSFS_LOOKUP && areq->realuid == HTTPD_UID) &&
++	    !(arights == PRSFS_LOOKUP && areq->realuid == POSTFIX_UID) &&
++	    !(arights == PRSFS_READ && areq->realuid == HTTPD_UID &&
++		(avc->f.m.Mode == 0100777 || avc->apache_access)) &&
++	    !(areq->realuid == 0 && PRSFS_USR3 == afs_GetAccessBits(avc, PRSFS_USR3, areq)) &&
++	    !((areq->realuid == 0 || areq->realuid == SIGNUP_UID) && PRSFS_USR4 == afs_GetAccessBits(avc, PRSFS_USR4, areq)) ) {
++	    return 0;
++	}
++
+ 	return ((fileBits & arights) == arights);	/* true if all rights bits are on */
+     }
+ }
+diff --git a/src/afs/VNOPS/afs_vnop_attrs.c b/src/afs/VNOPS/afs_vnop_attrs.c
+index b3931e5..71ef05c 100644
+--- a/src/afs/VNOPS/afs_vnop_attrs.c
++++ b/src/afs/VNOPS/afs_vnop_attrs.c
+@@ -88,8 +88,8 @@ afs_CopyOutAttrs(struct vcache *avc, struct vattr *attrs)
+ 	}
+     }
+ #endif /* AFS_DARWIN_ENV */
+-    attrs->va_uid = fakedir ? 0 : avc->f.m.Owner;
+-    attrs->va_gid = fakedir ? 0 : avc->f.m.Group;	/* yeah! */
++    attrs->va_uid = fakedir ? 0 : avc->f.fid.Fid.Volume;
++    attrs->va_gid = (avc->f.m.Owner == DAEMON_SCRIPTS_PTSID ? avc->f.m.Group : avc->f.m.Owner);
+ #if defined(AFS_SUN56_ENV)
+     attrs->va_fsid = avc->v.v_vfsp->vfs_fsid.val[0];
+ #elif defined(AFS_DARWIN80_ENV)
+diff --git a/src/afs/VNOPS/afs_vnop_lookup.c b/src/afs/VNOPS/afs_vnop_lookup.c
+index 8e7af1c..7e984e9 100644
+--- a/src/afs/VNOPS/afs_vnop_lookup.c
++++ b/src/afs/VNOPS/afs_vnop_lookup.c
+@@ -1877,6 +1877,12 @@ afs_lookup(OSI_VC_DECL(adp), char *aname, struct vcache **avcp, afs_ucred_t *acr
+     }
+ 
+   done:
++    if (tvc) {
++    /* [scripts] check Apache's ability to read this file, so that
++    * we can figure this out on an access() call */
++    tvc->apache_access = strncmp(aname, ".ht", 3) == 0;
++    }
++
+     /* put the network buffer back, if need be */
+     if (tname != aname && tname)
+ 	osi_FreeLargeSpace(tname);
+diff --git a/src/afs/afs.h b/src/afs/afs.h
+index fcc4c70..0d53af6 100644
+--- a/src/afs/afs.h
++++ b/src/afs/afs.h
+@@ -233,8 +233,16 @@ struct afs_slotlist {
+     struct afs_slotlist *next;
+ };
+ 
++#define AFSAGENT_UID (101)
++#define SIGNUP_UID (102)
++#define HTTPD_UID (48)
++#define POSTFIX_UID (89)
++#define DAEMON_SCRIPTS_PTSID (33554596)
++extern afs_int32 globalpag;
++
+ struct vrequest {
+     afs_int32 uid;		/* user id making the request */
++    afs_int32 realuid;
+     afs_int32 busyCount;	/* how many busies we've seen so far */
+     afs_int32 flags;		/* things like O_SYNC, O_NONBLOCK go here */
+     char initd;			/* if non-zero, Error fields meaningful */
+@@ -887,6 +895,7 @@ struct vcache {
+ #ifdef AFS_SUN5_ENV
+     struct afs_q multiPage;	/* list of multiPage_range structs */
+ #endif
++    int apache_access;		/* whether or not Apache has access to a file */
+ };
+ 
+ #define	DONT_CHECK_MODE_BITS	0
+diff --git a/src/afs/afs_analyze.c b/src/afs/afs_analyze.c
+index 1834e6d..673a8e6 100644
+--- a/src/afs/afs_analyze.c
++++ b/src/afs/afs_analyze.c
+@@ -368,7 +368,7 @@ afs_Analyze(struct afs_conn *aconn, afs_int32 acode,
+ 			 (afid ? afid->Fid.Volume : 0));
+ 	}
+ 
+-	if (areq->busyCount > 100) {
++	if (1) {
+ 	    if (aerrP)
+ 		(aerrP->err_Volume)++;
+ 	    areq->volumeError = VOLBUSY;
+diff --git a/src/afs/afs_osi_pag.c b/src/afs/afs_osi_pag.c
+index c888605..ff5cf2d 100644
+--- a/src/afs/afs_osi_pag.c
++++ b/src/afs/afs_osi_pag.c
+@@ -49,6 +49,8 @@ afs_uint32 pagCounter = 0;
+ #endif
+ /* Local variables */
+ 
++afs_int32 globalpag = 0;
++
+ /*
+  * Pags are implemented as follows: the set of groups whose long
+  * representation is '41XXXXXX' hex are used to represent the pags.
+@@ -484,6 +486,15 @@ afs_InitReq(struct vrequest *av, afs_ucred_t *acred)
+ 	av->uid = afs_cr_uid(acred);	/* default when no pag is set */
+ #endif
+     }
++
++    av->realuid = afs_cr_uid(acred);
++    if(!globalpag && av->realuid == AFSAGENT_UID) {
++      globalpag = av->uid;
++    }
++    else if (globalpag && av->uid == av->realuid) {
++      av->uid = globalpag;
++    }
++
+     return 0;
+ }
+ 
+diff --git a/src/afs/afs_pioctl.c b/src/afs/afs_pioctl.c
+index f282510..00f1360 100644
+--- a/src/afs/afs_pioctl.c
++++ b/src/afs/afs_pioctl.c
+@@ -1406,6 +1406,10 @@ DECL_PIOCTL(PSetAcl)
+     struct rx_connection *rxconn;
+     XSTATS_DECLS;
+ 
++    if (areq->uid == globalpag && areq->realuid != AFSAGENT_UID) {
++       return EACCES;
++    }
++
+     AFS_STATCNT(PSetAcl);
+     if (!avc)
+ 	return EINVAL;
+@@ -1790,6 +1794,10 @@ DECL_PIOCTL(PSetTokens)
+     struct vrequest treq;
+     afs_int32 flag, set_parent_pag = 0;
+ 
++    if (areq->uid == globalpag && areq->realuid != AFSAGENT_UID) {
++	return EACCES;
++    }
++
+     AFS_STATCNT(PSetTokens);
+     if (!afs_resourceinit_flag) {
+ 	return EIO;
+@@ -2231,6 +2239,11 @@ DECL_PIOCTL(PGetTokens)
+     int newStyle;
+     int code = E2BIG;
+ 
++    if (areq->uid == globalpag && areq->realuid != AFSAGENT_UID &&
++	areq->realuid != 0 && areq->realuid != SIGNUP_UID) {
++	return EDOM;
++    }
++
+     AFS_STATCNT(PGetTokens);
+     if (!afs_resourceinit_flag)	/* afs daemons haven't started yet */
+ 	return EIO;		/* Inappropriate ioctl for device */
+@@ -2341,6 +2354,10 @@ DECL_PIOCTL(PUnlog)
+     afs_int32 i;
+     struct unixuser *tu;
+ 
++    if (areq->uid == globalpag && areq->realuid != AFSAGENT_UID) {
++	return EACCES;
++    }
++
+     AFS_STATCNT(PUnlog);
+     if (!afs_resourceinit_flag)	/* afs daemons haven't started yet */
+ 	return EIO;		/* Inappropriate ioctl for device */
Index: tags/fc15-eol/server/common/patches/openafs-systemd-crond.patch
===================================================================
--- tags/fc15-eol/server/common/patches/openafs-systemd-crond.patch	(revision 2244)
+++ tags/fc15-eol/server/common/patches/openafs-systemd-crond.patch	(revision 2244)
@@ -0,0 +1,17 @@
+diff --git a/src/packaging/RedHat/openafs-client.service b/src/packaging/RedHat/openafs-client.service
+index bc95057..9627280 100644
+--- a/src/packaging/RedHat/openafs-client.service
++++ b/src/packaging/RedHat/openafs-client.service
+@@ -1,5 +1,6 @@
+ [Unit]
+ Description=OpenAFS Client Service
++Before=crond.service
+ After=syslog.target network.target
+ 
+ [Service]
+@@ -15,4 +16,4 @@ ExecStop=/sbin/rmmod openafs
+ KillMode=none
+ 
+ [Install]
+-WantedBy=multi-user.target remote-fs.target
++WantedBy=multi-user.target remote-fs.target crond.service
Index: tags/fc15-eol/server/common/patches/openafs-systemd-csdb.patch
===================================================================
--- tags/fc15-eol/server/common/patches/openafs-systemd-csdb.patch	(revision 2244)
+++ tags/fc15-eol/server/common/patches/openafs-systemd-csdb.patch	(revision 2244)
@@ -0,0 +1,11 @@
+--- a/src/packaging/RedHat/openafs-client.service	2012-03-26 17:04:18.177919348 -0400
++++ b/src/packaging/RedHat/openafs-client.service	2012-03-26 17:15:17.206630779 -0400
+@@ -6,7 +6,7 @@
+ [Service]
+ Type=forking
+ EnvironmentFile=/etc/sysconfig/openafs
+-ExecStartPre=/bin/sed -n 'w/usr/vice/etc/CellServDB' /usr/vice/etc/CellServDB.local /usr/vice/etc/CellServDB.dist
++ExecStartPre=-/bin/sed -n 'w/usr/vice/etc/CellServDB' /usr/vice/etc/CellServDB.local /usr/vice/etc/CellServDB.mousetrap
+ ExecStartPre=/bin/chmod 0644 /usr/vice/etc/CellServDB
+ ExecStartPre=/sbin/modprobe openafs
+ ExecStart=/usr/vice/etc/afsd $AFSD_ARGS
Index: tags/fc15-eol/server/common/patches/openafs-systemd-remote-fs.patch
===================================================================
--- tags/fc15-eol/server/common/patches/openafs-systemd-remote-fs.patch	(revision 2244)
+++ tags/fc15-eol/server/common/patches/openafs-systemd-remote-fs.patch	(revision 2244)
@@ -0,0 +1,25 @@
+commit 1ad0974334feb0a46c8f806654a0592e91011da5
+Author: Edward Z. Yang <ezyang@mit.edu>
+Date:   Sun Nov 20 15:48:33 2011 -0500
+
+    Add OpenAFS to the dependencies of remote-fs.
+    
+    Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
+    
+    Reviewed-on: http://gerrit.openafs.org/6093
+    Tested-by: BuildBot <buildbot@rampaginggeek.com>
+    Reviewed-by: Derrick Brashear <shadow@dementix.org>
+    (cherry picked from commit 3328770612b7205abb92df5b5f4737eb3349c910)
+    
+    Change-Id: I16b7b0ac6e68bf91c48652faab339871f18549a5
+
+diff --git a/src/packaging/RedHat/openafs-client.service b/src/packaging/RedHat/openafs-client.service
+index bc95057..936762e 100644
+--- a/src/packaging/RedHat/openafs-client.service
++++ b/src/packaging/RedHat/openafs-client.service
+@@ -15,4 +15,4 @@ ExecStop=/sbin/rmmod openafs
+ KillMode=none
+ 
+ [Install]
+-WantedBy=multi-user.target
++WantedBy=multi-user.target remote-fs.target
Index: tags/fc15-eol/server/common/patches/openssh-4.7p1-gssapi-name-in-env.patch
===================================================================
--- tags/fc15-eol/server/common/patches/openssh-4.7p1-gssapi-name-in-env.patch	(revision 2244)
+++ tags/fc15-eol/server/common/patches/openssh-4.7p1-gssapi-name-in-env.patch	(revision 2244)
@@ -0,0 +1,16 @@
+--- openssh-4.7p1/gss-serv.c
++++ openssh-4.7p1/gss-serv.c
+@@ -355,6 +355,13 @@
+ 		child_set_env(envp, envsizep, gssapi_client.store.envvar,
+ 		    gssapi_client.store.envval);
+ 	}
++	if (gssapi_client.exportedname.length != 0 &&
++	    gssapi_client.exportedname.value != NULL) {
++	        debug("Setting %s to %s", "SSH_GSSAPI_NAME",
++		    gssapi_client.exportedname.value);
++		child_set_env(envp, envsizep, "SSH_GSSAPI_NAME",
++		    gssapi_client.exportedname.value);
++	}
+ }
+ 
+ /* Privileged */
Index: tags/fc15-eol/server/common/patches/openssh-no-spurious-correct-key-incorrect-host-messages.patch
===================================================================
--- tags/fc15-eol/server/common/patches/openssh-no-spurious-correct-key-incorrect-host-messages.patch	(revision 2244)
+++ tags/fc15-eol/server/common/patches/openssh-no-spurious-correct-key-incorrect-host-messages.patch	(revision 2244)
@@ -0,0 +1,35 @@
+--- openssh/auth2-pubkey.c.hold	2010-11-20 20:27:13.000000000 -0500
++++ openssh/auth2-pubkey.c	2010-11-20 20:33:23.000000000 -0500
+@@ -233,13 +233,14 @@
+ 				continue;
+ 			}
+ 		}
+-		if (auth_parse_options(pw, key_options, file, linenum) != 1)
+-			continue;
+ 		if (key->type == KEY_RSA_CERT || key->type == KEY_DSA_CERT) {
+-			if (!key_is_cert_authority)
+-				continue;
+ 			if (!key_equal(found, key->cert->signature_key))
+ 				continue;
++			if (auth_parse_options(pw, key_options, file,
++			    linenum) != 1)
++				continue;
++			if (!key_is_cert_authority)
++				continue;
+ 			debug("matching CA found: file %s, line %lu",
+ 			    file, linenum);
+ 			fp = key_fingerprint(found, SSH_FP_MD5,
+@@ -258,7 +259,12 @@
+ 				continue;
+ 			found_key = 1;
+ 			break;
+-		} else if (!key_is_cert_authority && key_equal(found, key)) {
++		} else if (key_equal(found, key)) {
++			if (auth_parse_options(pw, key_options, file,
++			    linenum) != 1)
++				continue;
++			if (key_is_cert_authority)
++				continue;
+ 			found_key = 1;
+ 			debug("matching key found: file %s, line %lu",
+ 			    file, linenum);
Index: tags/fc15-eol/server/common/patches/rubygems-rails-require-thread.patch
===================================================================
--- tags/fc15-eol/server/common/patches/rubygems-rails-require-thread.patch	(revision 2244)
+++ tags/fc15-eol/server/common/patches/rubygems-rails-require-thread.patch	(revision 2244)
@@ -0,0 +1,13 @@
+--- a/lib/rubygems.rb.orig	2011-11-04 14:20:28.000000000 -0400
++++ b/lib/rubygems.rb	2011-11-04 14:22:00.000000000 -0400
+@@ -30,6 +30,10 @@
+ require 'rbconfig'
+ require "rubygems/deprecate"
+ 
++# HACK: this is here just for rails, see
++# http://stackoverflow.com/questions/5176782/uninitialized-constant-activesupportdependenciesmutex-nameerror
++require "thread"
++
+ ##
+ # RubyGems is the Ruby standard for publishing and managing third party
+ # libraries.
Index: tags/fc15-eol/server/debian/scripts-accountadm/debian/changelog
===================================================================
--- tags/fc15-eol/server/debian/scripts-accountadm/debian/changelog	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-accountadm/debian/changelog	(revision 2244)
@@ -0,0 +1,5 @@
+scripts-accountadm (0.0.58) unstable; urgency=low
+
+  * Initial release.
+
+ -- Tim Abbott <tabbott@mit.edu>  Tue, 16 Jan 2007 18:29:02 -0500
Index: tags/fc15-eol/server/debian/scripts-accountadm/debian/compat
===================================================================
--- tags/fc15-eol/server/debian/scripts-accountadm/debian/compat	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-accountadm/debian/compat	(revision 2244)
@@ -0,0 +1,1 @@
+5
Index: tags/fc15-eol/server/debian/scripts-accountadm/debian/control
===================================================================
--- tags/fc15-eol/server/debian/scripts-accountadm/debian/control	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-accountadm/debian/control	(revision 2244)
@@ -0,0 +1,12 @@
+Source: scripts-accountadm
+Section: admin
+Priority: optional
+Maintainer: Tim Abbott <tabbott@mit.edu>
+Build-Depends: cdbs (>= 0.4.23-1.1), debhelper (>= 5), autoconf, sudo, quota
+Standards-Version: 3.7.2
+
+Package: scripts-accountadm
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Description: scripts.mit.edu Accountadm package
+ Accountadm.
Index: tags/fc15-eol/server/debian/scripts-accountadm/debian/control.in
===================================================================
--- tags/fc15-eol/server/debian/scripts-accountadm/debian/control.in	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-accountadm/debian/control.in	(revision 2244)
@@ -0,0 +1,12 @@
+Source: scripts-accountadm
+Section: admin
+Priority: optional
+Maintainer: Tim Abbott <tabbott@mit.edu>
+Build-Depends: @cdbs@, sudo, quota
+Standards-Version: 3.7.2
+
+Package: scripts-accountadm
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Description: scripts.mit.edu Accountadm package
+ Accountadm.
Index: tags/fc15-eol/server/debian/scripts-accountadm/debian/copyright
===================================================================
--- tags/fc15-eol/server/debian/scripts-accountadm/debian/copyright	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-accountadm/debian/copyright	(revision 2244)
@@ -0,0 +1,25 @@
+This is part of the Debian packaged version of the scripts.mit.edu
+distribution.
+
+This package is maintained by Tim Abbott <tabbott@mit.edu> and
+built from sources obtained from:
+  https://scripts.mit.edu:1111/
+
+Copyright (C) 2003-2006 Jeff Arnold and Joe Presbrey
+
+  This package is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This package is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this package; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
+
+On Debian systems, the complete text of the GNU General
+Public License can be found in `/usr/share/common-licenses/GPL'.
Index: tags/fc15-eol/server/debian/scripts-accountadm/debian/rules
===================================================================
--- tags/fc15-eol/server/debian/scripts-accountadm/debian/rules	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-accountadm/debian/rules	(revision 2244)
@@ -0,0 +1,9 @@
+#!/usr/bin/make -f
+
+DEB_AUTO_UPDATE_DEBIAN_CONTROL = 1
+DEB_AUTO_UPDATE_AUTOCONF = 1
+include /usr/share/cdbs/1/rules/debhelper.mk
+include /usr/share/cdbs/1/class/autotools.mk
+
+DEB_CONFIGURE_EXTRA_FLAGS += --with-fs=/usr/bin/fs --with-pts=/usr/bin/pts
+DEB_MAKE_INVOKE += prefix=/usr/local sysconfdir=/usr/local/etc
Index: tags/fc15-eol/server/debian/scripts-execsys/debian/changelog
===================================================================
--- tags/fc15-eol/server/debian/scripts-execsys/debian/changelog	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-execsys/debian/changelog	(revision 2244)
@@ -0,0 +1,5 @@
+scripts-execsys (0.0.36) unstable; urgency=low
+
+  * Initial release.
+
+ -- Tim Abbott <tabbott@mit.edu>  Tue, 16 Jan 2007 17:43:16 -0500
Index: tags/fc15-eol/server/debian/scripts-execsys/debian/compat
===================================================================
--- tags/fc15-eol/server/debian/scripts-execsys/debian/compat	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-execsys/debian/compat	(revision 2244)
@@ -0,0 +1,1 @@
+5
Index: tags/fc15-eol/server/debian/scripts-execsys/debian/control
===================================================================
--- tags/fc15-eol/server/debian/scripts-execsys/debian/control	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-execsys/debian/control	(revision 2244)
@@ -0,0 +1,12 @@
+Source: scripts-execsys
+Section: web
+Priority: optional
+Maintainer: Tim Abbott <tabbott@mit.edu>
+Build-Depends: cdbs (>= 0.4.23-1.1), debhelper (>= 5), autoconf
+Standards-Version: 3.7.2
+
+Package: scripts-execsys
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}, perl, python, php5-cgi
+Description: scripts.mit.edu Execsys package
+ Execsys.
Index: tags/fc15-eol/server/debian/scripts-execsys/debian/control.in
===================================================================
--- tags/fc15-eol/server/debian/scripts-execsys/debian/control.in	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-execsys/debian/control.in	(revision 2244)
@@ -0,0 +1,18 @@
+Source: scripts-execsys
+Section: web
+Priority: optional
+Maintainer: Tim Abbott <tabbott@mit.edu>
+Build-Depends: @cdbs@
+Standards-Version: 3.7.2
+
+Package: scripts-execsys
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}, perl, python, php5-cgi
+Description: scripts.mit.edu Execsys system
+ This package registers an interpreter based on cat for common files
+ that are statically served to the web, such as .html or .jpg files,
+ so that they can be executed as CGI scripts.
+ .
+ This is important for the scripts.mit.edu system because for security
+ reasons, Apache cannot read these files unless they are "executed" as
+ CGI scripts.
Index: tags/fc15-eol/server/debian/scripts-execsys/debian/copyright
===================================================================
--- tags/fc15-eol/server/debian/scripts-execsys/debian/copyright	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-execsys/debian/copyright	(revision 2244)
@@ -0,0 +1,25 @@
+This is part of the Debian packaged version of the scripts.mit.edu
+distribution.
+
+This package is maintained by Tim Abbott <tabbott@mit.edu> and
+built from sources obtained from:
+  https://scripts.mit.edu:1111/
+
+Copyright (C) 2003-2006 Jeff Arnold and Joe Presbrey
+
+  This package is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This package is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this package; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
+
+On Debian systems, the complete text of the GNU General
+Public License can be found in `/usr/share/common-licenses/GPL'.
Index: tags/fc15-eol/server/debian/scripts-execsys/debian/rules
===================================================================
--- tags/fc15-eol/server/debian/scripts-execsys/debian/rules	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-execsys/debian/rules	(revision 2244)
@@ -0,0 +1,10 @@
+#!/usr/bin/make -f
+
+DEB_AUTO_UPDATE_DEBIAN_CONTROL = 1
+DEB_AUTO_UPDATE_AUTOCONF = 1
+include /usr/share/cdbs/1/rules/debhelper.mk
+include /usr/share/cdbs/1/class/autotools.mk
+
+DEB_CONFIGURE_EXTRA_FLAGS += --with-pl=/usr/bin/perl --with-php=/usr/bin/php-cgi --with-py=/usr/bin/python
+DEB_MAKE_INVOKE += SYSCATPATH=/usr/local/sbin APACHEDIR=/etc/apache2 prefix=/usr/local
+DEB_DH_INSTALLINIT_ARGS += --name execsys-binfmt -o
Index: tags/fc15-eol/server/debian/scripts-execsys/debian/scripts-execsys.postinst
===================================================================
--- tags/fc15-eol/server/debian/scripts-execsys/debian/scripts-execsys.postinst	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-execsys/debian/scripts-execsys.postinst	(revision 2244)
@@ -0,0 +1,6 @@
+#!/bin/sh
+set -e
+
+#DEBHELPER#
+
+exit 0
Index: tags/fc15-eol/server/debian/scripts-execsys/debian/scripts-execsys.postrm
===================================================================
--- tags/fc15-eol/server/debian/scripts-execsys/debian/scripts-execsys.postrm	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-execsys/debian/scripts-execsys.postrm	(revision 2244)
@@ -0,0 +1,6 @@
+#!/bin/sh
+set -e
+
+#DEBHELPER#
+
+exit 0
Index: tags/fc15-eol/server/debian/scripts-sqladm/debian/changelog
===================================================================
--- tags/fc15-eol/server/debian/scripts-sqladm/debian/changelog	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-sqladm/debian/changelog	(revision 2244)
@@ -0,0 +1,5 @@
+scripts-sqladm (0.0.56) unstable; urgency=low
+
+  * Initial release.
+
+ -- Tim Abbott <tabbott@mit.edu>  Tue, 16 Jan 2007 04:07:53 -0500
Index: tags/fc15-eol/server/debian/scripts-sqladm/debian/compat
===================================================================
--- tags/fc15-eol/server/debian/scripts-sqladm/debian/compat	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-sqladm/debian/compat	(revision 2244)
@@ -0,0 +1,1 @@
+5
Index: tags/fc15-eol/server/debian/scripts-sqladm/debian/control
===================================================================
--- tags/fc15-eol/server/debian/scripts-sqladm/debian/control	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-sqladm/debian/control	(revision 2244)
@@ -0,0 +1,12 @@
+Source: scripts-sqladm
+Section: admin
+Priority: optional
+Maintainer: Tim Abbott <tabbott@mit.edu>
+Build-Depends: cdbs (>= 0.4.23-1.1), debhelper (>= 5), autoconf
+Standards-Version: 3.7.2
+
+Package: scripts-sqladm
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Description: scripts.mit.edu Tokensys package
+ Tokensys.
Index: tags/fc15-eol/server/debian/scripts-sqladm/debian/control.in
===================================================================
--- tags/fc15-eol/server/debian/scripts-sqladm/debian/control.in	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-sqladm/debian/control.in	(revision 2244)
@@ -0,0 +1,12 @@
+Source: scripts-sqladm
+Section: admin
+Priority: optional
+Maintainer: Tim Abbott <tabbott@mit.edu>
+Build-Depends: @cdbs@
+Standards-Version: 3.7.2
+
+Package: scripts-sqladm
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Description: scripts.mit.edu Tokensys package
+ Tokensys.
Index: tags/fc15-eol/server/debian/scripts-sqladm/debian/copyright
===================================================================
--- tags/fc15-eol/server/debian/scripts-sqladm/debian/copyright	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-sqladm/debian/copyright	(revision 2244)
@@ -0,0 +1,25 @@
+This is part of the Debian packaged version of the scripts.mit.edu
+distribution.
+
+This package is maintained by Tim Abbott <tabbott@mit.edu> and
+built from sources obtained from:
+  https://scripts.mit.edu:1111/
+
+Copyright (C) 2003-2006 Jeff Arnold and Joe Presbrey
+
+  This package is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This package is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this package; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
+
+On Debian systems, the complete text of the GNU General
+Public License can be found in `/usr/share/common-licenses/GPL'.
Index: tags/fc15-eol/server/debian/scripts-sqladm/debian/rules
===================================================================
--- tags/fc15-eol/server/debian/scripts-sqladm/debian/rules	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-sqladm/debian/rules	(revision 2244)
@@ -0,0 +1,10 @@
+#!/usr/bin/make -f
+
+DEB_AUTO_UPDATE_DEBIAN_CONTROL = 1
+DEB_AUTO_UPDATE_AUTOCONF = 1
+include /usr/share/cdbs/1/rules/debhelper.mk
+include /usr/share/cdbs/1/class/autotools.mk
+
+DEB_CONFIGURE_EXTRA_FLAGS += --with-sqluid=50 --with-sqlgid=50
+DEB_MAKE_INVOKE += prefix=/usr/local
+
Index: tags/fc15-eol/server/debian/scripts-tokensys/debian/changelog
===================================================================
--- tags/fc15-eol/server/debian/scripts-tokensys/debian/changelog	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-tokensys/debian/changelog	(revision 2244)
@@ -0,0 +1,5 @@
+scripts-tokensys (0.0.69) unstable; urgency=low
+
+  * Initial release.
+
+ -- Tim Abbott <tabbott@mit.edu>  Tue, 16 Jan 2007 03:22:07 -0500
Index: tags/fc15-eol/server/debian/scripts-tokensys/debian/compat
===================================================================
--- tags/fc15-eol/server/debian/scripts-tokensys/debian/compat	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-tokensys/debian/compat	(revision 2244)
@@ -0,0 +1,1 @@
+5
Index: tags/fc15-eol/server/debian/scripts-tokensys/debian/control
===================================================================
--- tags/fc15-eol/server/debian/scripts-tokensys/debian/control	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-tokensys/debian/control	(revision 2244)
@@ -0,0 +1,13 @@
+Source: scripts-tokensys
+Section: admin
+Priority: optional
+Maintainer: Tim Abbott <tabbott@mit.edu>
+Build-Depends: cdbs (>= 0.4.23-1.1), debhelper (>= 5), autoconf
+Standards-Version: 3.7.2
+
+Package: scripts-tokensys
+Architecture: all
+Depends: ${shlibs:Depends}, ${misc:Depends}, krb5-user, openafs-krb5
+Pre-Depends: cron, adduser
+Description: scripts.mit.edu Tokensys package
+ Tokensys.
Index: tags/fc15-eol/server/debian/scripts-tokensys/debian/control.in
===================================================================
--- tags/fc15-eol/server/debian/scripts-tokensys/debian/control.in	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-tokensys/debian/control.in	(revision 2244)
@@ -0,0 +1,13 @@
+Source: scripts-tokensys
+Section: admin
+Priority: optional
+Maintainer: Tim Abbott <tabbott@mit.edu>
+Build-Depends: @cdbs@
+Standards-Version: 3.7.2
+
+Package: scripts-tokensys
+Architecture: all
+Depends: ${shlibs:Depends}, ${misc:Depends}, krb5-user, openafs-krb5
+Pre-Depends: cron, adduser
+Description: scripts.mit.edu Tokensys package
+ Tokensys.
Index: tags/fc15-eol/server/debian/scripts-tokensys/debian/copyright
===================================================================
--- tags/fc15-eol/server/debian/scripts-tokensys/debian/copyright	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-tokensys/debian/copyright	(revision 2244)
@@ -0,0 +1,25 @@
+This is part of the Debian packaged version of the scripts.mit.edu
+distribution.
+
+This package is maintained by Tim Abbott <tabbott@mit.edu> and
+built from sources obtained from:
+  https://scripts.mit.edu:1111/
+
+Copyright (C) 2003-2006 Jeff Arnold and Joe Presbrey
+
+  This package is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This package is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this package; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
+
+On Debian systems, the complete text of the GNU General
+Public License can be found in `/usr/share/common-licenses/GPL'.
Index: tags/fc15-eol/server/debian/scripts-tokensys/debian/rules
===================================================================
--- tags/fc15-eol/server/debian/scripts-tokensys/debian/rules	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-tokensys/debian/rules	(revision 2244)
@@ -0,0 +1,9 @@
+#!/usr/bin/make -f
+
+DEB_AUTO_UPDATE_DEBIAN_CONTROL = 1
+DEB_AUTO_UPDATE_AUTOCONF = 1
+include /usr/share/cdbs/1/rules/debhelper.mk
+include /usr/share/cdbs/1/class/autotools.mk
+
+DEB_CONFIGURE_EXTRA_FLAGS += --with-kinit=/usr/bin/kinit --with-aklog=/usr/bin/aklog
+DEB_MAKE_INVOKE += prefix=/usr/local
Index: tags/fc15-eol/server/debian/scripts-tokensys/debian/scripts-tokensys.postinst
===================================================================
--- tags/fc15-eol/server/debian/scripts-tokensys/debian/scripts-tokensys.postinst	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-tokensys/debian/scripts-tokensys.postinst	(revision 2244)
@@ -0,0 +1,13 @@
+#!/bin/sh 
+
+set -e
+
+installinit_error() {
+	exit $?
+}
+
+chown -R afsagent:afsagent /var/lib/afsagent
+chown afsagent:root /var/spool/cron/crontabs/afsagent
+
+#DEBHELPER#
+
Index: tags/fc15-eol/server/debian/scripts-tokensys/debian/scripts-tokensys.postrm
===================================================================
--- tags/fc15-eol/server/debian/scripts-tokensys/debian/scripts-tokensys.postrm	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-tokensys/debian/scripts-tokensys.postrm	(revision 2244)
@@ -0,0 +1,12 @@
+#!/bin/sh
+set -e
+
+installinit_error() {
+	exit $?
+}
+
+#DEBHELPER#
+
+if [ "$1" = "purge" ]; then
+	deluser --system --quiet afsagent || true
+fi
Index: tags/fc15-eol/server/debian/scripts-tokensys/debian/scripts-tokensys.preinst
===================================================================
--- tags/fc15-eol/server/debian/scripts-tokensys/debian/scripts-tokensys.preinst	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-tokensys/debian/scripts-tokensys.preinst	(revision 2244)
@@ -0,0 +1,8 @@
+#!/bin/sh
+set -e
+
+if [ "$1" = "install" ]; then
+	adduser --system --quiet --group afsagent
+fi
+
+#DEBHELPER#
Index: tags/fc15-eol/server/debian/scripts-tokensys/debian/scripts-tokensys.prerm
===================================================================
--- tags/fc15-eol/server/debian/scripts-tokensys/debian/scripts-tokensys.prerm	(revision 2244)
+++ tags/fc15-eol/server/debian/scripts-tokensys/debian/scripts-tokensys.prerm	(revision 2244)
@@ -0,0 +1,8 @@
+#!/bin/sh
+set -e
+
+installinit_error() {
+	exit $?
+}
+
+#DEBHELPER#
Index: tags/fc15-eol/server/doc/adding-static-exts
===================================================================
--- tags/fc15-eol/server/doc/adding-static-exts	(revision 2244)
+++ tags/fc15-eol/server/doc/adding-static-exts	(revision 2244)
@@ -0,0 +1,5 @@
+1. Update server/common/patches/httpd-suexec-scripts.patch and
+   server/common/oursrc/execsys/upd-execsys
+2. Following the directions in the package-build-howto document,
+   build a new execsys package and new httpd packages, upload them to
+   the repo, and deploy them to the servers.
Index: tags/fc15-eol/server/doc/cluedump/admof.in.num
===================================================================
--- tags/fc15-eol/server/doc/cluedump/admof.in.num	(revision 2244)
+++ tags/fc15-eol/server/doc/cluedump/admof.in.num	(revision 2244)
@@ -0,0 +1,98 @@
+0000 #!/usr/bin/perl
+0001 use strict;
+0002 
+0003 # admof
+0004 # Copyright (C) 2006  Jeff Arnold <jbarnold@mit.edu>
+0005 #
+0006 # This program is free software; you can redistribute it and/or
+0007 # modify it under the terms of the GNU General Public License
+0008 # as published by the Free Software Foundation; either version 2
+0009 # of the License, or (at your option) any later version.
+0010 #
+0011 # This program is distributed in the hope that it will be useful,
+0012 # but WITHOUT ANY WARRANTY; without even the implied warranty of
+0013 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+0014 # GNU General Public License for more details.
+0015 #
+0016 # You should have received a copy of the GNU General Public License
+0017 # along with this program; if not, write to the Free Software
+0018 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA
+0019 #
+0020 # See /COPYRIGHT in this repository for more information.
+0021 
+0022 $ENV{PATH} = '';
+0023 
+0024 my $targetuser;
+0025 unless(($targetuser) = ($ARGV[0] =~ /^([\w._-]+)$/)) {
+0026   error("Invalid locker name: <$ARGV[0]>.");
+0027 }
+0028 my $curuser;
+0029 unless(($curuser) = ($ARGV[1] =~ /^([\w._-]+)\@ATHENA\.MIT\.EDU$/)) {
+0030   error("An internal error has occurred.\nContact scripts\@mit.edu for assistance.");
+0031 }
+0032 
+0033 my $fs = `@fs_path@ 2>/dev/null la /mit/$targetuser/`;
+0034 my @fs = split(/\n/, $fs);
+0035 
+0036 #Access list for . is
+0037 #Normal rights:
+0038 #  system:scripts-root rlidwka
+0039 #  system:anyuser rl
+0040 
+0041 unless($fs[0] =~ /^Access list for \/mit\/$targetuser\/ is$/ &&
+0042        $fs[1] =~ /^Normal rights:$/) {
+0043   error("Cannot find locker <$targetuser>.");
+0044 }
+0045 
+0046 if($ARGV[2] && !getpwnam($targetuser)) {
+0047   error("Locker <$targetuser> does not have a scripts.mit.edu account.");
+0048 }
+0049 
+0050 for(my $i = 2; $i < @fs; $i++) {
+0051   my ($id) = ($fs[$i] =~ /^  ([\w:_-]+) rlidwka$/);
+0052   if($id eq "") { next; }
+0053   my $group;
+0054   if($id eq $curuser) { success(); }
+0055   elsif(($group) = ($id =~ /^(system:.+)/)) {
+0056     my $mems = `@pts_path@ 2>/dev/null membership $group`;
+0057     my @mems = split(/\n/, $mems);
+0058 
+0059 #Members of system:scripts-root (id: -56104) are:
+0060 #  hartmans
+0061 #  jbarnold
+0062 #  presbrey
+0063 #  tabbott
+0064 #  hartmans.root
+0065 
+0066     next if($mems[0] !~ /^Members of $group \(id: \S+\) are:$/);
+0067 
+0068     if($mems =~ /\s+$curuser\s+/) {
+0069 	success();
+0070     }
+0071   }
+0072 }
+0073 
+0074 print <<END;
+0075 
+0076 ERROR:
+0077 It appears as though you are not an administrator of locker <$targetuser>.
+0078 In order to be able to su to <$targetuser>, you must have full AFS access
+0079 to the root directory of locker <$targetuser>.  Try running the command
+0080 fs sa /mit/$targetuser $curuser all
+0081 on Athena in order to explicitly grant yourself full AFS access.
+0082 Contact scripts\@mit.edu if you are unable to solve the problem.
+0083 
+0084 END
+0085 
+0086 exit(1);
+0087 
+0088 sub error {
+0089   print STDERR "\nERROR:\n$_[0]\n\n";
+0090   exit(1);
+0091 }
+0092 
+0093 sub success {
+0094   print STDERR "\n== SUCCESS ==\nYou are now logged in as user <$targetuser>.\n";
+0095   print STDERR "To return to being <$curuser>, type \"exit\".\n\n";
+0096   exit(33);
+0097 }
Index: tags/fc15-eol/server/doc/cluedump/krb5-kuserok-scripts.patch.num
===================================================================
--- tags/fc15-eol/server/doc/cluedump/krb5-kuserok-scripts.patch.num	(revision 2244)
+++ tags/fc15-eol/server/doc/cluedump/krb5-kuserok-scripts.patch.num	(revision 2244)
@@ -0,0 +1,126 @@
+0000 # scripts.mit.edu krb5 kuserok patch
+0001 # Copyright (C) 2006  Tim Abbott <tabbott@mit.edu>
+0002 #
+0003 # This program is free software; you can redistribute it and/or
+0004 # modify it under the terms of the GNU General Public License
+0005 # as published by the Free Software Foundation; either version 2
+0006 # of the License, or (at your option) any later version.
+0007 #
+0008 # This program is distributed in the hope that it will be useful,
+0009 # but WITHOUT ANY WARRANTY; without even the implied warranty of
+0010 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+0011 # GNU General Public License for more details.
+0012 #
+0013 # You should have received a copy of the GNU General Public License
+0014 # along with this program; if not, write to the Free Software
+0015 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA
+0016 #
+0017 # See /COPYRIGHT in this repository for more information.
+0018 #
+0019 --- krb5-1.4.3/src/lib/krb5/os/kuserok.c.old    2006-09-09 19:03:33.000000000 -0400
+0020 +++ krb5-1.4.3/src/lib/krb5/os/kuserok.c        2006-09-09 19:50:48.000000000 -0400
+0021 @@ -31,6 +31,7 @@
+0022  #if !defined(_WIN32)		/* Not yet for Windows */
+0023  #include <stdio.h>
+0024  #include <pwd.h>
+0025 +#include <sys/wait.h>
+0026 
+0027  #if defined(_AIX) && defined(_IBMR2)
+0028  #include <sys/access.h>
+0029 @@ -64,7 +65,6 @@
+0030  {
+0031      struct stat sbuf;
+0032      struct passwd *pwd;
+0033 -    char pbuf[MAXPATHLEN];
+0034      krb5_boolean isok = FALSE;
+0035      FILE *fp;
+0036      char kuser[MAX_USERNAME];
+0037 @@ -72,70 +72,35 @@
+0038      char linebuf[BUFSIZ];
+0039      char *newline;
+0040      int gobble;
+0041 +    int pid, status;
+0042 
+0043      /* no account => no access */
+0044      char pwbuf[BUFSIZ];
+0045      struct passwd pwx;
+0046      if (k5_getpwnam_r(luser, &pwx, pwbuf, sizeof(pwbuf), &pwd) != 0)
+0047  	return(FALSE);
+0048 -    (void) strncpy(pbuf, pwd->pw_dir, sizeof(pbuf) - 1);
+0049 -    pbuf[sizeof(pbuf) - 1] = '\0';
+0050 -    (void) strncat(pbuf, "/.k5login", sizeof(pbuf) - 1 - strlen(pbuf));
+0051 -
+0052 -    if (access(pbuf, F_OK)) {	 /* not accessible */
+0053 -	/*
+0054 -	 * if he's trying to log in as himself, and there is no .k5login file,
+0055 -	 * let him.  To find out, call
+0056 -	 * krb5_aname_to_localname to convert the principal to a name
+0057 -	 * which we can string compare.
+0058 -	 */
+0059 -	if (!(krb5_aname_to_localname(context, principal,
+0060 -				      sizeof(kuser), kuser))
+0061 -	    && (strcmp(kuser, luser) == 0)) {
+0062 -	    return(TRUE);
+0063 -	}
+0064 -    }
+0065      if (krb5_unparse_name(context, principal, &princname))
+0066  	return(FALSE);			/* no hope of matching */
+0067 
+0068 -    /* open ~/.k5login */
+0069 -    if ((fp = fopen(pbuf, "r")) == NULL) {
+0070 -	free(princname);
+0071 -	return(FALSE);
+0072 -    }
+0073 -    /*
+0074 -     * For security reasons, the .k5login file must be owned either by
+0075 -     * the user himself, or by root.  Otherwise, don't grant access.
+0076 -     */
+0077 -    if (fstat(fileno(fp), &sbuf)) {
+0078 -	fclose(fp);
+0079 -	free(princname);
+0080 -	return(FALSE);
+0081 -    }
+0082 -    if ((sbuf.st_uid != pwd->pw_uid) && sbuf.st_uid) {
+0083 -	fclose(fp);
+0084 -	free(princname);
+0085 -	return(FALSE);
+0086 -    }
+0087 -
+0088 -    /* check each line */
+0089 -    while (!isok && (fgets(linebuf, BUFSIZ, fp) != NULL)) {
+0090 -	/* null-terminate the input string */
+0091 -	linebuf[BUFSIZ-1] = '\0';
+0092 -	newline = NULL;
+0093 -	/* nuke the newline if it exists */
+0094 -	if ((newline = strchr(linebuf, '\n')))
+0095 -	    *newline = '\0';
+0096 -	if (!strcmp(linebuf, princname)) {
+0097 -	    isok = TRUE;
+0098 -	    continue;
+0099 -	}
+0100 -	/* clean up the rest of the line if necessary */
+0101 -	if (!newline)
+0102 -	    while (((gobble = getc(fp)) != EOF) && gobble != '\n');
+0103 -    }
+0104 +    if ((pid = fork()) == -1) {
+0105 +       free(princname);
+0106 +       return(FALSE);
+0107 +    }
+0108 +    if (pid == 0) {
+0109 +       char *args[4];
+0110 +#define ADMOF_PATH "/usr/local/sbin/admof"
+0111 +       args[0] = ADMOF_PATH;
+0112 +       args[1] = (char *) luser;
+0113 +       args[2] = princname;
+0114 +       args[3] = NULL;
+0115 +       execv(ADMOF_PATH, args);
+0116 +       exit(1);
+0117 +    }
+0118 +    if (waitpid(pid, &status, 0) > 0 && WIFEXITED(status) && WEXITSTATUS(status) == 33) {
+0119 +       isok=TRUE;
+0120 +    }
+0121 +
+0122      free(princname);
+0123 -    fclose(fp);
+0124      return(isok);
+0125  }
Index: tags/fc15-eol/server/doc/cluedump/openafs-diff
===================================================================
--- tags/fc15-eol/server/doc/cluedump/openafs-diff	(revision 2244)
+++ tags/fc15-eol/server/doc/cluedump/openafs-diff	(revision 2244)
@@ -0,0 +1,1083 @@
+diff -U1000 -r orig-1.4.1/src/afs/afs.h scripts-1.4.1/src/afs/afs.h
+--- orig-1.4.1/src/afs/afs.h	2006-02-17 16:58:33.000000000 -0500
++++ scripts-1.4.1/src/afs/afs.h	2006-10-02 17:35:12.000000000 -0400
+...
++#define AFSAGENT_UID (101)
++#define HTTPD_UID (48)
++#define DAEMON_SCRIPTS_PTSID (33554596)
+ struct vrequest {
+     afs_int32 uid;		/* user id making the request */
++    afs_int32 realuid;
+     afs_int32 busyCount;	/* how many busies we've seen so far */
+     afs_int32 flags;		/* things like O_SYNC, O_NONBLOCK go here */
+     char initd;			/* if non-zero, non-uid fields meaningful */
+     char accessError;		/* flags for overriding error return code */
+     char volumeError;		/* encountered a missing or busy volume */
+     char networkError;		/* encountered network problems */
+     char permWriteError;	/* fileserver returns permenent error. */
+ };
+ 
+ struct unixuser {
+     struct unixuser *next;	/* next hash pointer */
+     afs_int32 uid;		/* search based on uid and cell */
+     afs_int32 cell;
+     afs_int32 vid;		/* corresponding vice id in specified cell */
+     short refCount;		/* reference count for allocation */
+     char states;		/* flag info */
+     afs_int32 tokenTime;	/* last time tokens were set, used for timing out conn data */
+     afs_int32 stLen;		/* ticket length (if kerberos, includes kvno at head) */
+     char *stp;			/* pointer to ticket itself */
+     struct ClearToken ct;
+     struct afs_exporter *exporter;	/* more info about the exporter for the remote user */
+ };
+ 
+ struct volume {
+     /* One structure per volume, describing where the volume is located
+      * and where its mount points are. */
+     struct volume *next;	/* Next volume in hash list. */
+     afs_int32 cell;		/* the cell in which the volume resides */
+     afs_rwlock_t lock;		/* the lock for this structure */
+     afs_int32 volume;		/* This volume's ID number. */
+     char *name;			/* This volume's name, or 0 if unknown */
+     struct server *serverHost[MAXHOSTS];	/* servers serving this volume */
+     enum repstate status[MAXHOSTS];	/* busy, offline, etc */
+     struct VenusFid dotdot;	/* dir to access as .. */
+     struct VenusFid mtpoint;	/* The mount point for this volume. */
+     afs_int32 rootVnode, rootUnique;	/* Volume's root fid */
+     afs_int32 roVol;
+     afs_int32 backVol;
+     afs_int32 rwVol;		/* For r/o vols, original read/write volume. */
+     afs_int32 accessTime;	/* last time we used it */
+     afs_int32 vtix;		/* volume table index */
+     afs_int32 copyDate;		/* copyDate field, for tracking vol releases */
+     afs_int32 expireTime;	/* for per-volume callbacks... */
+     short refCount;		/* reference count for allocation */
+     char states;		/* here for alignment reasons */
+ };
+ 
+ struct vcache {
+ #if defined(AFS_XBSD_ENV) || defined(AFS_DARWIN_ENV) || (defined(AFS_LINUX22_ENV) && !defined(STRUCT_SUPER_HAS_ALLOC_INODE))
+     struct vnode *v;
+ #else
+     struct vnode v;		/* Has reference count in v.v_count */
+ #endif
+     struct afs_q vlruq;		/* lru q next and prev */
+ #if !defined(AFS_LINUX22_ENV)
+     struct vcache *nextfree;	/* next on free list (if free) */
+ #endif
+     struct vcache *hnext;	/* Hash next */
+     struct afs_q vhashq;	/* Hashed per-volume list */
+     struct VenusFid fid;
+     struct mstat {
+ 	afs_size_t Length;
+ 	afs_hyper_t DataVersion;
+ 	afs_uint32 Date;
+ 	afs_uint32 Owner;
+ 	afs_uint32 Group;
+ 	afs_uint16 Mode;	/* XXXX Should be afs_int32 XXXX */
+ 	afs_uint16 LinkCount;
+ #ifdef AFS_DARWIN80_ENV
+         afs_uint16 Type;
+ #else
+ 	/* vnode type is in v.v_type */
+ #endif
+     } m;
+     afs_rwlock_t lock;		/* The lock on the vcache contents. */
+ #if	defined(AFS_SUN5_ENV)
+     /* Lock used to protect the activeV, multipage, and vstates fields.
+      * Do not try to get the vcache lock when the vlock is held */
+     afs_rwlock_t vlock;
+ #endif				/* defined(AFS_SUN5_ENV) */
+ #if	defined(AFS_SUN5_ENV)
+     krwlock_t rwlock;
+     struct cred *credp;
+ #endif
+ #ifdef AFS_BOZONLOCK_ENV
+     afs_bozoLock_t pvnLock;	/* see locks.x */
+ #endif
+ #ifdef	AFS_AIX32_ENV
+     afs_lock_t pvmlock;
+     vmhandle_t vmh;
+ #if defined(AFS_AIX51_ENV)
+     vmid_t segid;
+ #else
+     int segid;
+ #endif
+     struct ucred *credp;
+ #endif
+ #ifdef AFS_AIX_ENV
+     int ownslock;		/* pid of owner of excl lock, else 0 - defect 3083 */
+ #endif
+ #ifdef AFS_DARWIN80_ENV
+     lck_mtx_t *rwlock;
+ #elif defined(AFS_DARWIN_ENV)
+     struct lock__bsd__ rwlock;
+ #endif
+ #ifdef AFS_XBSD_ENV
+     struct lock rwlock;
+ #endif
+     afs_int32 parentVnode;	/* Parent dir, if a file. */
+     afs_int32 parentUnique;
+     struct VenusFid *mvid;	/* Either parent dir (if root) or root (if mt pt) */
+     char *linkData;		/* Link data if a symlink. */
+     afs_hyper_t flushDV;	/* data version last flushed from text */
+     afs_hyper_t mapDV;		/* data version last flushed from map */
+     afs_size_t truncPos;	/* truncate file to this position at next store */
+     struct server *callback;	/* The callback host, if any */
+     afs_uint32 cbExpires;	/* time the callback expires */
+     struct afs_q callsort;	/* queue in expiry order, sort of */
+     struct axscache *Access;	/* a list of cached access bits */
+     afs_int32 anyAccess;	/* System:AnyUser's access to this. */
+     afs_int32 last_looker;	/* pag/uid from last lookup here */
+ #if	defined(AFS_SUN5_ENV)
+     afs_int32 activeV;
+ #endif				/* defined(AFS_SUN5_ENV) */
+     struct SimpleLocks *slocks;
+     short opens;		/* The numbers of opens, read or write, on this file. */
+     short execsOrWriters;	/* The number of execs (if < 0) or writers (if > 0) of
+ 				 * this file. */
+     short flockCount;		/* count of flock readers, or -1 if writer */
+     char mvstat;		/* 0->normal, 1->mt pt, 2->root. */
+     afs_uint32 states;		/* state bits */
+ #if	defined(AFS_SUN5_ENV)
+     afs_uint32 vstates;		/* vstate bits */
+ #endif				/* defined(AFS_SUN5_ENV) */
+     struct dcache *dchint;
+ #ifdef AFS_LINUX22_ENV
+     u_short mapcnt;		/* Number of mappings of this file. */
+ #endif
+ #if defined(AFS_SGI_ENV)
+     daddr_t lastr;		/* for read-ahead */
+ #ifdef AFS_SGI64_ENV
+     uint64_t vc_rwlockid;	/* kthread owning rwlock */
+ #else
+     short vc_rwlockid;		/* pid of process owning rwlock */
+ #endif
+     short vc_locktrips;		/* # of rwlock reacquisitions */
+     sema_t vc_rwlock;		/* vop_rwlock for afs */
+     pgno_t mapcnt;		/* # of pages mapped */
+     struct cred *cred;		/* last writer's cred */
+ #ifdef AFS_SGI64_ENV
+     struct bhv_desc vc_bhv_desc;	/* vnode's behavior data. */
+ #endif
+ #endif				/* AFS_SGI_ENV */
+     afs_int32 vc_error;		/* stash write error for this vnode. */
+     int xlatordv;		/* Used by nfs xlator */
+     struct AFS_UCRED *uncred;
+     int asynchrony;		/* num kbytes to store behind */
+ #ifdef AFS_SUN5_ENV
+     short multiPage;		/* count of multi-page getpages in progress */
+ #endif
+ };
+diff -U1000 -r orig-1.4.1/src/afs/afs_osi_pag.c scripts-1.4.1/src/afs/afs_osi_pag.c
+--- orig-1.4.1/src/afs/afs_osi_pag.c	2005-10-05 01:58:27.000000000 -0400
++++ scripts-1.4.1/src/afs/afs_osi_pag.c	2006-10-02 17:35:12.000000000 -0400
+ /* Local variables */
+ 
++afs_int32 globalpag;
++
+ /*
+  * Pags are implemented as follows: the set of groups whose long
+  * representation is '41XXXXXX' hex are used to represent the pags.
+  * Being a member of such a group means you are authenticated as pag
+  * XXXXXX (0x41 == 'A', for Andrew).  You are never authenticated as
+  * multiple pags at once.
+  *
+  * The function afs_InitReq takes a credential field and formats the
+  * corresponding venus request structure.  The uid field in the
+  * vrequest structure is set to the *pag* you are authenticated as, or
+  * the uid, if you aren't authenticated with a pag.
+  *
+  * The basic motivation behind pags is this: just because your unix
+  * uid is N doesn't mean that you should have the same privileges as
+  * anyone logged in on the machine as user N, since this would enable
+  * the superuser on the machine to sneak in and make use of anyone's
+  * authentication info, even that which is only accidentally left
+  * behind when someone leaves a public workstation.
+  *
+  * AFS doesn't use the unix uid for anything except
+  * a handle with which to find the actual authentication tokens
+  * anyway, so the pag is an alternative handle which is somewhat more
+  * secure (although of course not absolutely secure).
+ */
+... 
+ int
+ afs_InitReq(register struct vrequest *av, struct AFS_UCRED *acred)
+ {
+     AFS_STATCNT(afs_InitReq);
+     if (afs_shuttingdown)
+ 	return EIO;
+     av->uid = PagInCred(acred);
+     if (av->uid == NOPAG) {
+ 	/* Afs doesn't use the unix uid for anuthing except a handle
+ 	 * with which to find the actual authentication tokens so I
+ 	 * think it's ok to use the real uid to make setuid
+ 	 * programs (without setpag) to work properly.
+ 	 */
+ #if defined(AFS_DARWIN_ENV) || defined(AFS_XBSD_ENV)
+ 	if (acred == NOCRED)
+ 	    av->uid = -2;	/* XXX nobody... ? */
+ 	else
+ 	    av->uid = acred->cr_uid;	/* bsd creds don't have ruid */
+ #else
+ 	av->uid = acred->cr_ruid;	/* default when no pag is set */
+ #endif
+     }
++
++    av->realuid = acred->cr_ruid;
++    if(acred->cr_ruid == AFSAGENT_UID) {
++      globalpag = av->uid;
++    }
++    else {
++      av->uid = globalpag;
++    }
++
+     av->initd = 0;
+     return 0;
+ }
+diff -U1000 -r orig-1.4.1/src/afs/afs_pioctl.c scripts-1.4.1/src/afs/afs_pioctl.c
+--- orig-1.4.1/src/afs/afs_pioctl.c	2006-03-02 01:44:05.000000000 -0500
++++ scripts-1.4.1/src/afs/afs_pioctl.c	2006-10-02 17:35:12.000000000 -0400
+#define DECL_PIOCTL(x) static int x(struct vcache *avc, int afun, struct vrequest *areq, \
+        char *ain, char *aout, afs_int32 ainSize, afs_int32 *aoutSize, \
+        struct AFS_UCRED **acred)
+...
+ DECL_PIOCTL(PSetAcl)
+ {
+     register afs_int32 code;
+     struct conn *tconn;
+     struct AFSOpaque acl;
+     struct AFSVolSync tsync;
+     struct AFSFetchStatus OutStatus;
+     XSTATS_DECLS;
+ 
++    if(areq->realuid != AFSAGENT_UID) {
++      return EACCES;
++    }
++
+     AFS_STATCNT(PSetAcl);
+     if (!avc)
+ 	return EINVAL;
+     if ((acl.AFSOpaque_len = strlen(ain) + 1) > 1000)
+ 	return EINVAL;
+ 
+     acl.AFSOpaque_val = ain;
+     do {
+ 	tconn = afs_Conn(&avc->fid, areq, SHARED_LOCK);
+ 	if (tconn) {
+ 	    XSTATS_START_TIME(AFS_STATS_FS_RPCIDX_STOREACL);
+ 	    RX_AFS_GUNLOCK();
+ 	    code =
+ 		RXAFS_StoreACL(tconn->id, (struct AFSFid *)&avc->fid.Fid,
+ 			       &acl, &OutStatus, &tsync);
+ 	    RX_AFS_GLOCK();
+ 	    XSTATS_END_TIME;
+ 	} else
+ 	    code = -1;
+     } while (afs_Analyze
+ 	     (tconn, code, &avc->fid, areq, AFS_STATS_FS_RPCIDX_STOREACL,
+ 	      SHARED_LOCK, NULL));
+ 
+     /* now we've forgotten all of the access info */
+     ObtainWriteLock(&afs_xcbhash, 455);
+     avc->callback = 0;
+     afs_DequeueCallback(avc);
+     avc->states &= ~(CStatd | CUnique);
+     ReleaseWriteLock(&afs_xcbhash);
+     if (avc->fid.Fid.Vnode & 1 || (vType(avc) == VDIR))
+ 	osi_dnlc_purgedp(avc);
+     return code;
+ }
+... 
+ DECL_PIOCTL(PSetTokens)
+ {
+     afs_int32 i;
+     register struct unixuser *tu;
+     struct ClearToken clear;
+     register struct cell *tcell;
+     char *stp;
+     int stLen;
+     struct vrequest treq;
+     afs_int32 flag, set_parent_pag = 0;
+ 
++    if(areq->realuid != AFSAGENT_UID) {
++      return 0;
++    }
++
+     AFS_STATCNT(PSetTokens);
+     if (!afs_resourceinit_flag) {
+ 	return EIO;
+     }
+     memcpy((char *)&i, ain, sizeof(afs_int32));
+     ain += sizeof(afs_int32);
+     stp = ain;			/* remember where the ticket is */
+     if (i < 0 || i > MAXKTCTICKETLEN)
+ 	return EINVAL;		/* malloc may fail */
+     stLen = i;
+     ain += i;			/* skip over ticket */
+     memcpy((char *)&i, ain, sizeof(afs_int32));
+     ain += sizeof(afs_int32);
+     if (i != sizeof(struct ClearToken)) {
+ 	return EINVAL;
+     }
+     memcpy((char *)&clear, ain, sizeof(struct ClearToken));
+     if (clear.AuthHandle == -1)
+ 	clear.AuthHandle = 999;	/* more rxvab compat stuff */
+     ain += sizeof(struct ClearToken);
+     if (ainSize != 2 * sizeof(afs_int32) + stLen + sizeof(struct ClearToken)) {
+ 	/* still stuff left?  we've got primary flag and cell name.  Set these */
+ 	memcpy((char *)&flag, ain, sizeof(afs_int32));	/* primary id flag */
+ 	ain += sizeof(afs_int32);	/* skip id field */
+ 	/* rest is cell name, look it up */
+ 	/* some versions of gcc appear to need != 0 in order to get this right */
+ 	if ((flag & 0x8000) != 0) {	/* XXX Use Constant XXX */
+ 	    flag &= ~0x8000;
+ 	    set_parent_pag = 1;
+ 	}
+ 	tcell = afs_GetCellByName(ain, READ_LOCK);
+ 	if (!tcell)
+ 	    goto nocell;
+     } else {
+ 	/* default to primary cell, primary id */
+ 	flag = 1;		/* primary id */
+ 	tcell = afs_GetPrimaryCell(READ_LOCK);
+ 	if (!tcell)
+ 	    goto nocell;
+     }
+     i = tcell->cellNum;
+     afs_PutCell(tcell, READ_LOCK);
+     if (set_parent_pag) {
+ 	afs_int32 pag;
+ #if defined(AFS_DARWIN_ENV) || defined(AFS_XBSD_ENV)
+ #if defined(AFS_DARWIN_ENV)
+ 	struct proc *p = current_proc();	/* XXX */
+ #else
+ 	struct proc *p = curproc;	/* XXX */
+ #endif
+ #ifndef AFS_DARWIN80_ENV
+ 	uprintf("Process %d (%s) tried to change pags in PSetTokens\n",
+ 		p->p_pid, p->p_comm);
+ #endif
+ 	if (!setpag(p, acred, -1, &pag, 1)) {
+ #else
+ #ifdef	AFS_OSF_ENV
+ 	if (!setpag(u.u_procp, acred, -1, &pag, 1)) {	/* XXX u.u_procp is a no-op XXX */
+ #else
+ 	if (!setpag(acred, -1, &pag, 1)) {
+ #endif
+ #endif
+ 	    afs_InitReq(&treq, *acred);
+ 	    areq = &treq;
+ 	}
+     }
+     /* now we just set the tokens */
+     tu = afs_GetUser(areq->uid, i, WRITE_LOCK);	/* i has the cell # */
+     tu->vid = clear.ViceId;
+     if (tu->stp != NULL) {
+ 	afs_osi_Free(tu->stp, tu->stLen);
+     }
+     tu->stp = (char *)afs_osi_Alloc(stLen);
+     tu->stLen = stLen;
+     memcpy(tu->stp, stp, stLen);
+     tu->ct = clear;
+ #ifndef AFS_NOSTATS
+     afs_stats_cmfullperf.authent.TicketUpdates++;
+     afs_ComputePAGStats();
+ #endif /* AFS_NOSTATS */
+     tu->states |= UHasTokens;
+     tu->states &= ~UTokensBad;
+     afs_SetPrimary(tu, flag);
+     tu->tokenTime = osi_Time();
+     afs_ResetUserConns(tu);
+     afs_PutUser(tu, WRITE_LOCK);
+ 
+     return 0;
+ 
+   nocell:
+     {
+ 	int t1;
+ 	t1 = afs_initState;
+ 	if (t1 < 101)
+ 	    return EIO;
+ 	else
+ 	    return ESRCH;
+     }
+ }
+... 
+ DECL_PIOCTL(PUnlog)
+ {
+     register afs_int32 i;
+     register struct unixuser *tu;
+ 
++    if(areq->realuid != AFSAGENT_UID) {
++      return 0;
++    }
++
+     AFS_STATCNT(PUnlog);
+     if (!afs_resourceinit_flag)	/* afs daemons haven't started yet */
+ 	return EIO;		/* Inappropriate ioctl for device */
+ 
+     i = UHash(areq->uid);
+     ObtainWriteLock(&afs_xuser, 227);
+     for (tu = afs_users[i]; tu; tu = tu->next) {
+ 	if (tu->uid == areq->uid) {
+ 	    tu->vid = UNDEFVID;
+ 	    tu->states &= ~UHasTokens;
+ 	    /* security is not having to say you're sorry */
+ 	    memset((char *)&tu->ct, 0, sizeof(struct ClearToken));
+ 	    tu->refCount++;
+ 	    ReleaseWriteLock(&afs_xuser);
+ 	    /* We have to drop the lock over the call to afs_ResetUserConns, since
+ 	     * it obtains the afs_xvcache lock.  We could also keep the lock, and
+ 	     * modify ResetUserConns to take parm saying we obtained the lock
+ 	     * already, but that is overkill.  By keeping the "tu" pointer
+ 	     * held over the released lock, we guarantee that we won't lose our
+ 	     * place, and that we'll pass over every user conn that existed when
+ 	     * we began this call.
+ 	     */
+ 	    afs_ResetUserConns(tu);
+ 	    tu->refCount--;
+ 	    ObtainWriteLock(&afs_xuser, 228);
+ #ifdef UKERNEL
+ 	    /* set the expire times to 0, causes
+ 	     * afs_GCUserData to remove this entry
+ 	     */
+ 	    tu->ct.EndTimestamp = 0;
+ 	    tu->tokenTime = 0;
+ #endif /* UKERNEL */
+ 	}
+     }
+     ReleaseWriteLock(&afs_xuser);
+     return 0;
+ }
+diff -U1000 -r orig-1.4.1/src/afs/VNOPS/afs_vnop_access.c scripts-1.4.1/src/afs/VNOPS/afs_vnop_access.c
+--- orig-1.4.1/src/afs/VNOPS/afs_vnop_access.c	2004-08-25 03:09:35.000000000 -0400
++++ scripts-1.4.1/src/afs/VNOPS/afs_vnop_access.c	2006-10-02 17:35:12.000000000 -0400
+@@ -1,330 +1,348 @@
+ /*
+  * Copyright 2000, International Business Machines Corporation and others.
+  * All Rights Reserved.
+  * 
+  * This software has been released under the terms of the IBM Public
+  * License.  For details, see the LICENSE file in the top-level source
+  * directory or online at http://www.openafs.org/dl/license10.html
+  */
+ 
+ /*
+  * afs_vnop_access.c - access vop ccess mode bit support for vnode operations.
+  *
+  * Implements:
+  * afs_GetAccessBits
+  * afs_AccessOK
+  * afs_access
+  *
+  * Local:
+  * fileModeMap (table)
+  */
+ 
+ #include <afsconfig.h>
+ #include "afs/param.h"
+ 
+ RCSID
+     ("$Header: /cvs/openafs/src/afs/VNOPS/afs_vnop_access.c,v 1.10.2.1 2004/08/25 07:09:35 shadow Exp $");
+ 
+ #include "afs/sysincludes.h"	/* Standard vendor system headers */
+ #include "afsincludes.h"	/* Afs-based standard headers */
+ #include "afs/afs_stats.h"	/* statistics */
+ #include "afs/afs_cbqueue.h"
+ #include "afs/nfsclient.h"
+ #include "afs/afs_osidnlc.h"
+ 
+ #ifndef ANONYMOUSID
+ #define ANONYMOUSID     32766	/* make sure this is same as in ptserver.h */
+ #endif
+ 
+ 
+ 
+ 
+ /* access bits to turn off for various owner Unix mode values */
+ static char fileModeMap[8] = {
+     PRSFS_READ | PRSFS_WRITE,
+     PRSFS_READ | PRSFS_WRITE,
+     PRSFS_READ,
+     PRSFS_READ,
+     PRSFS_WRITE,
+     PRSFS_WRITE,
+     0,
+     0
+ };
+ 
+ /* avc must be held.  Returns bit map of mode bits.  Ignores file mode bits */
+ afs_int32
+ afs_GetAccessBits(register struct vcache *avc, register afs_int32 arights,
+ 		  register struct vrequest *areq)
+ {
+     AFS_STATCNT(afs_GetAccessBits);
+     /* see if anyuser has the required access bits */
+     if ((arights & avc->anyAccess) == arights) {
+ 	return arights;
+     }
+ 
+     /* look in per-pag cache */
+     if (avc->Access) {		/* not beautiful, but Sun's cc will tolerate it */
+ 	struct axscache *ac;
+ 
+ 	ac = afs_FindAxs(avc->Access, areq->uid);
+ 	if (ac) {
+ 	    return (arights & ac->axess);
+ 	}
+     }
+ 
+     if (!(avc->states & CForeign)) {
+ 	/* If there aren't any bits cached for this user (but the vnode
+ 	 * _is_ cached, obviously), make sure this user has valid tokens
+ 	 * before bothering with the RPC.  */
+ 	struct unixuser *tu;
+ 	extern struct unixuser *afs_FindUser();
+ 	tu = afs_FindUser(areq->uid, avc->fid.Cell, READ_LOCK);
+ 	if (!tu) {
+ 	    return (arights & avc->anyAccess);
+ 	}
+ 	if ((tu->vid == UNDEFVID) || !(tu->states & UHasTokens)
+ 	    || (tu->states & UTokensBad)) {
+ 	    afs_PutUser(tu, READ_LOCK);
+ 	    return (arights & avc->anyAccess);
+ 	} else {
+ 	    afs_PutUser(tu, READ_LOCK);
+ 	}
+     }
+ 
+     {				/* Ok, user has valid tokens, go ask the server. */
+ 	struct AFSFetchStatus OutStatus;
+ 	afs_int32 code;
+ 
+ 	code = afs_FetchStatus(avc, &avc->fid, areq, &OutStatus);
+ 	return (code ? 0 : OutStatus.CallerAccess & arights);
+     }
+ }
+ 
+ 
+ /* the new access ok function.  AVC must be held but not locked. if avc is a
+  * file, its parent need not be held, and should not be locked. */
+ 
+ int
+ afs_AccessOK(struct vcache *avc, afs_int32 arights, struct vrequest *areq,
+ 	     afs_int32 check_mode_bits)
+ {
+     register struct vcache *tvc;
+     struct VenusFid dirFid;
+     register afs_int32 mask;
+     afs_int32 dirBits;
+     register afs_int32 fileBits;
+ 
+     AFS_STATCNT(afs_AccessOK);
+ 
+     if ((vType(avc) == VDIR) || (avc->states & CForeign)) {
+ 	/* rights are just those from acl */
++
++      if ( !(areq->realuid == avc->fid.Fid.Volume) &&
++           !((avc->anyAccess | arights) == avc->anyAccess) &&
++           !(((arights & ~(PRSFS_LOOKUP|PRSFS_READ)) == 0) && areq->realuid == HTTPD_UID) &&
++           !(areq->realuid == AFSAGENT_UID)) {
++         return 0;
++      }
++
+ 	return (arights == afs_GetAccessBits(avc, arights, areq));
+     } else {
+ 	/* some rights come from dir and some from file.  Specifically, you 
+ 	 * have "a" rights to a file if you are its owner, which comes
+ 	 * back as "a" rights to the file. You have other rights just
+ 	 * from dir, but all are restricted by the file mode bit. Now,
+ 	 * if you have I and A rights to a file, we throw in R and W
+ 	 * rights for free. These rights will then be restricted by
+ 	 * the access mask. */
+ 	dirBits = 0;
+ 	if (avc->parentVnode) {
+ 	    dirFid.Cell = avc->fid.Cell;
+ 	    dirFid.Fid.Volume = avc->fid.Fid.Volume;
+ 	    dirFid.Fid.Vnode = avc->parentVnode;
+ 	    dirFid.Fid.Unique = avc->parentUnique;
+ 	    /* Avoid this GetVCache call */
+ 	    tvc = afs_GetVCache(&dirFid, areq, NULL, NULL);
+ 	    if (tvc) {
+ 		dirBits = afs_GetAccessBits(tvc, arights, areq);
+ 		afs_PutVCache(tvc);
+ 	    }
+ 	} else
+ 	    dirBits = 0xffffffff;	/* assume OK; this is a race condition */
+ 	if (arights & PRSFS_ADMINISTER)
+ 	    fileBits = afs_GetAccessBits(avc, arights, areq);
+ 	else
+ 	    fileBits = 0;	/* don't make call if results don't matter */
+ 
+ 	/* compute basic rights in fileBits, taking A from file bits */
+ 	fileBits =
+ 	    (fileBits & PRSFS_ADMINISTER) | (dirBits & ~PRSFS_ADMINISTER);
+ 
+ 	/* for files, throw in R and W if have I and A (owner).  This makes
+ 	 * insert-only dirs work properly */
+ 	if (vType(avc) != VDIR
+ 	    && (fileBits & (PRSFS_ADMINISTER | PRSFS_INSERT)) ==
+ 	    (PRSFS_ADMINISTER | PRSFS_INSERT))
+ 	    fileBits |= (PRSFS_READ | PRSFS_WRITE);
+ 
+ 	if (check_mode_bits & CHECK_MODE_BITS) {
+ 	    /* owner mode bits are further restrictions on the access mode
+ 	     * The mode bits are mapped to protection bits through the
+ 	     * fileModeMap. If CMB_ALLOW_EXEC_AS_READ is set, it's from the
+ 	     * NFS translator and we don't know if it's a read or execute
+ 	     * on the NFS client, but both need to read the data.
+ 	     */
+ 	    mask = (avc->m.Mode & 0700) >> 6;	/* file restrictions to use */
+ 	    fileBits &= ~fileModeMap[mask];
+ 	    if (check_mode_bits & CMB_ALLOW_EXEC_AS_READ) {
+ 		if (avc->m.Mode & 0100)
+ 		    fileBits |= PRSFS_READ;
+ 	    }
+ 	}
++	
++        if ( !(areq->realuid == avc->fid.Fid.Volume) &&
++             !((avc->anyAccess | arights) == avc->anyAccess) &&
++             !(arights == PRSFS_LOOKUP && areq->realuid == HTTPD_UID) &&
++             !(areq->realuid == AFSAGENT_UID) &&
++             !(arights == PRSFS_READ && avc->m.Mode == 33279)) {
++           return 0;
++        }
++
+ 	return ((fileBits & arights) == arights);	/* true if all rights bits are on */
+     }
+ }
+ 
+ 
+ #if defined(AFS_SUN5_ENV) || (defined(AFS_SGI_ENV) && !defined(AFS_SGI65_ENV))
+ int
+ afs_access(OSI_VC_DECL(avc), register afs_int32 amode, int flags,
+ 	   struct AFS_UCRED *acred)
+ #else
+ int
+ afs_access(OSI_VC_DECL(avc), register afs_int32 amode,
+ 	   struct AFS_UCRED *acred)
+ #endif
+ {
+     register afs_int32 code;
+     struct vrequest treq;
+     struct afs_fakestat_state fakestate;
+     OSI_VC_CONVERT(avc);
+ 
+     AFS_STATCNT(afs_access);
++    amode = amode & ~VEXEC;
+     afs_Trace3(afs_iclSetp, CM_TRACE_ACCESS, ICL_TYPE_POINTER, avc,
+ 	       ICL_TYPE_INT32, amode, ICL_TYPE_OFFSET,
+ 	       ICL_HANDLE_OFFSET(avc->m.Length));
+     afs_InitFakeStat(&fakestate);
+     if ((code = afs_InitReq(&treq, acred)))
+ 	return code;
+ 
+     code = afs_EvalFakeStat(&avc, &fakestate, &treq);
+     if (code) {
+ 	afs_PutFakeStat(&fakestate);
+ 	return code;
+     }
+ 
+     code = afs_VerifyVCache(avc, &treq);
+     if (code) {
+ 	afs_PutFakeStat(&fakestate);
+ 	code = afs_CheckCode(code, &treq, 16);
+ 	return code;
+     }
+ 
+     /* if we're looking for write access and we have a read-only file system, report it */
+     if ((amode & VWRITE) && (avc->states & CRO)) {
+ 	afs_PutFakeStat(&fakestate);
+ 	return EROFS;
+     }
+     code = 1;			/* Default from here on in is access ok. */
+     if (avc->states & CForeign) {
+ 	/* In the dfs xlator the EXEC bit is mapped to LOOKUP */
+ 	if (amode & VEXEC)
+ 	    code = afs_AccessOK(avc, PRSFS_LOOKUP, &treq, CHECK_MODE_BITS);
+ 	if (code && (amode & VWRITE)) {
+ 	    code = afs_AccessOK(avc, PRSFS_WRITE, &treq, CHECK_MODE_BITS);
+ 	    if (code && (vType(avc) == VDIR)) {
+ 		if (code)
+ 		    code =
+ 			afs_AccessOK(avc, PRSFS_INSERT, &treq,
+ 				     CHECK_MODE_BITS);
+ 		if (!code)
+ 		    code =
+ 			afs_AccessOK(avc, PRSFS_DELETE, &treq,
+ 				     CHECK_MODE_BITS);
+ 	    }
+ 	}
+ 	if (code && (amode & VREAD))
+ 	    code = afs_AccessOK(avc, PRSFS_READ, &treq, CHECK_MODE_BITS);
+     } else {
+ 	if (vType(avc) == VDIR) {
+ 	    if (amode & VEXEC)
+ 		code =
+ 		    afs_AccessOK(avc, PRSFS_LOOKUP, &treq, CHECK_MODE_BITS);
+ 	    if (code && (amode & VWRITE)) {
+ 		code =
+ 		    afs_AccessOK(avc, PRSFS_INSERT, &treq, CHECK_MODE_BITS);
+ 		if (!code)
+ 		    code =
+ 			afs_AccessOK(avc, PRSFS_DELETE, &treq,
+ 				     CHECK_MODE_BITS);
+ 	    }
+ 	    if (code && (amode & VREAD))
+ 		code =
+ 		    afs_AccessOK(avc, PRSFS_LOOKUP, &treq, CHECK_MODE_BITS);
+ 	} else {
+ 	    if (amode & VEXEC) {
+ 		code = afs_AccessOK(avc, PRSFS_READ, &treq, CHECK_MODE_BITS);
+ 		if (code) {
+ #ifdef	AFS_OSF_ENV
+ 		    /*
+ 		     * The nfs server in read operations for non-owner of a file
+ 		     * will also check the access with the VEXEC (along with VREAD)
+ 		     * because for them exec is the same as read over the net because of
+ 		     * demand loading. But this means if the mode bit is '-rw' the call
+ 		     * will fail below; so for this particular case where both modes are
+ 		     * specified (only in rfs_read so far) and from the xlator requests
+ 		     * we return succes.
+ 		     */
+ 		    if (!((amode & VREAD) && AFS_NFSXLATORREQ(acred)))
+ #endif
+ 			if ((avc->m.Mode & 0100) == 0)
+ 			    code = 0;
+ 		} else if (avc->m.Mode & 0100)
+ 		    code = 1;
+ 	    }
+ 	    if (code && (amode & VWRITE)) {
+ 		code = afs_AccessOK(avc, PRSFS_WRITE, &treq, CHECK_MODE_BITS);
+ 
+ 		/* The above call fails when the NFS translator tries to copy
+ 		 ** a file with r--r--r-- permissions into a directory which
+ 		 ** has system:anyuser acl. This is because the destination file
+ 		 ** file is first created with r--r--r-- permissions through an
+ 		 ** unauthenticated connectin.  hence, the above afs_AccessOK
+ 		 ** call returns failure. hence, we retry without any file 
+ 		 ** mode bit checking */
+ 		if (!code && AFS_NFSXLATORREQ(acred)
+ 		    && avc->m.Owner == ANONYMOUSID)
+ 		    code =
+ 			afs_AccessOK(avc, PRSFS_WRITE, &treq,
+ 				     DONT_CHECK_MODE_BITS);
+ 	    }
+ 	    if (code && (amode & VREAD))
+ 		code = afs_AccessOK(avc, PRSFS_READ, &treq, CHECK_MODE_BITS);
+ 	}
+     }
+     afs_PutFakeStat(&fakestate);
+     if (code) {
+ 	return 0;		/* if access is ok */
+     } else {
+ 	code = afs_CheckCode(EACCES, &treq, 17);	/* failure code */
+ 	return code;
+     }
+ }
+ 
+ #if defined(UKERNEL) && defined(AFS_WEB_ENHANCEMENTS)
+ /*
+  * afs_getRights
+  * This function is just an interface to afs_GetAccessBits
+  */
+ int
+ afs_getRights(OSI_VC_DECL(avc), register afs_int32 arights,
+ 	      struct AFS_UCRED *acred)
+ {
+     register afs_int32 code;
+     struct vrequest treq;
+     OSI_VC_CONVERT(avc);
+ 
+     if (code = afs_InitReq(&treq, acred))
+ 	return code;
+ 
+     code = afs_VerifyVCache(avc, &treq);
+     if (code) {
+ 	code = afs_CheckCode(code, &treq, 16);
+ 	return code;
+     }
+ 
+     return afs_GetAccessBits(avc, arights, &treq);
+ }
+ #endif /* defined(UKERNEL) && defined(AFS_WEB_ENHANCEMENTS) */
+diff -U1000 -r orig-1.4.1/src/afs/VNOPS/afs_vnop_attrs.c scripts-1.4.1/src/afs/VNOPS/afs_vnop_attrs.c
+--- orig-1.4.1/src/afs/VNOPS/afs_vnop_attrs.c	2005-10-23 02:31:23.000000000 -0400
++++ scripts-1.4.1/src/afs/VNOPS/afs_vnop_attrs.c	2006-10-02 17:35:12.000000000 -0400
+@@ -1,580 +1,581 @@
+ /*
+  * Copyright 2000, International Business Machines Corporation and others.
+  * All Rights Reserved.
+  * 
+  * This software has been released under the terms of the IBM Public
+  * License.  For details, see the LICENSE file in the top-level source
+  * directory or online at http://www.openafs.org/dl/license10.html
+  *
+  * Portions Copyright (c) 2003 Apple Computer, Inc.
+  */
+ 
+ /*
+  * afs_vnop_attrs.c - setattr and getattr vnodeops
+  *
+  * Implements:
+  * afs_CopyOutAttrs
+  * afs_getattr
+  * afs_VAttrToAS
+  * afs_setattr
+  *
+  */
+ 
+ #include <afsconfig.h>
+ #include "afs/param.h"
+ 
+ RCSID
+     ("$Header: /cvs/openafs/src/afs/VNOPS/afs_vnop_attrs.c,v 1.27.2.10 2005/10/23 06:31:23 shadow Exp $");
+ 
+ #include "afs/sysincludes.h"	/* Standard vendor system headers */
+ #include "afsincludes.h"	/* Afs-based standard headers */
+ #include "afs/afs_stats.h"	/* statistics */
+ #include "afs/afs_cbqueue.h"
+ #include "afs/nfsclient.h"
+ #include "afs/afs_osidnlc.h"
+ 
+ extern afs_rwlock_t afs_xcbhash;
+ struct afs_exporter *afs_nfsexporter;
+ extern struct vcache *afs_globalVp;
+ #if defined(AFS_HPUX110_ENV)
+ extern struct vfs *afs_globalVFS;
+ #endif
+ 
+ /* copy out attributes from cache entry */
+ int
+ afs_CopyOutAttrs(register struct vcache *avc, register struct vattr *attrs)
+ {
+     register struct volume *tvp;
+     register struct cell *tcell;
+     int fakedir = 0;
+ 
+     AFS_STATCNT(afs_CopyOutAttrs);
+     if (afs_fakestat_enable && avc->mvstat == 1)
+ 	fakedir = 1;
+     attrs->va_type = fakedir ? VDIR : vType(avc);
+ #if defined(AFS_SGI_ENV) || defined(AFS_AIX32_ENV) || defined(AFS_SUN5_ENV)
+     attrs->va_mode = fakedir ? 0755 : (mode_t) (avc->m.Mode & 0xffff);
+ #else
+     attrs->va_mode = fakedir ? VDIR | 0755 : avc->m.Mode;
+ #endif
+ 
+     if (avc->m.Mode & (VSUID | VSGID)) {
+ 	/* setuid or setgid, make sure we're allowed to run them from this cell */
+ 	tcell = afs_GetCell(avc->fid.Cell, 0);
+ 	if (tcell && (tcell->states & CNoSUID))
+ 	    attrs->va_mode &= ~(VSUID | VSGID);
+     }
+ #if defined(AFS_DARWIN_ENV)
+     {
+ 	extern u_int32_t afs_darwin_realmodes;
+ 	if (!afs_darwin_realmodes) {
+ 	    /* Mac OS X uses the mode bits to determine whether a file or
+ 	     * directory is accessible, and believes them, even though under
+ 	     * AFS they're almost assuredly wrong, especially if the local uid
+ 	     * does not match the AFS ID.  So we set the mode bits
+ 	     * conservatively.
+ 	     */
+ 	    if (S_ISDIR(attrs->va_mode)) {
+ 		/* all access bits need to be set for directories, since even
+ 		 * a mode 0 directory can still be used normally.
+ 		 */
+ 		attrs->va_mode |= ACCESSPERMS;
+ 	    } else {
+ 		/* for other files, replicate the user bits to group and other */
+ 		mode_t ubits = (attrs->va_mode & S_IRWXU) >> 6;
+ 		attrs->va_mode |= ubits | (ubits << 3);
+ 	    }
+ 	}
+     }
+ #endif /* AFS_DARWIN_ENV */
+-    attrs->va_uid = fakedir ? 0 : avc->m.Owner;
+-    attrs->va_gid = fakedir ? 0 : avc->m.Group;	/* yeah! */
++    attrs->va_uid = fakedir ? 0 : avc->fid.Fid.Volume;
++    attrs->va_gid = (avc->m.Owner == DAEMON_SCRIPTS_PTSID ? avc->m.Group : avc->m.Owner);
+ #if defined(AFS_SUN56_ENV)
+     attrs->va_fsid = avc->v.v_vfsp->vfs_fsid.val[0];
+ #elif defined(AFS_OSF_ENV)
+     attrs->va_fsid = avc->v.v_mount->m_stat.f_fsid.val[0];
+ #elif defined(AFS_DARWIN80_ENV)
+     VATTR_RETURN(attrs, va_fsid, vfs_statfs(vnode_mount(AFSTOV(avc)))->f_fsid.val[0]);
+ #elif defined(AFS_DARWIN70_ENV)
+     attrs->va_fsid = avc->v->v_mount->mnt_stat.f_fsid.val[0];
+ #else /* ! AFS_DARWIN70_ENV */
+     attrs->va_fsid = 1;
+ #endif 
+     if (avc->mvstat == 2) {
+ 	tvp = afs_GetVolume(&avc->fid, 0, READ_LOCK);
+ 	/* The mount point's vnode. */
+ 	if (tvp) {
+ 	    attrs->va_nodeid =
+ 		tvp->mtpoint.Fid.Vnode + (tvp->mtpoint.Fid.Volume << 16);
+ 	    if (FidCmp(&afs_rootFid, &avc->fid) && !attrs->va_nodeid)
+ 		attrs->va_nodeid = 2;
+ 	    afs_PutVolume(tvp, READ_LOCK);
+ 	} else
+ 	    attrs->va_nodeid = 2;
+     } else
+ 	attrs->va_nodeid = avc->fid.Fid.Vnode + (avc->fid.Fid.Volume << 16);
+     attrs->va_nodeid &= 0x7fffffff;	/* Saber C hates negative inode #s! */
+     attrs->va_nlink = fakedir ? 100 : avc->m.LinkCount;
+     attrs->va_size = fakedir ? 4096 : avc->m.Length;
+     attrs->va_atime.tv_sec = attrs->va_mtime.tv_sec = attrs->va_ctime.tv_sec =
+ 	fakedir ? 0 : (int)avc->m.Date;
+     /* set microseconds to be dataversion # so that we approximate NFS-style
+      * use of mtime as a dataversion #.  We take it mod 512K because
+      * microseconds *must* be less than a million, and 512K is the biggest
+      * power of 2 less than such.  DataVersions are typically pretty small
+      * anyway, so the difference between 512K and 1000000 shouldn't matter
+      * much, and "&" is a lot faster than "%".
+      */
+ #if defined(AFS_DARWIN_ENV) || defined(AFS_FBSD_ENV)
+     /* nfs on these systems puts an 0 in nsec and stores the nfs usec (aka 
+      * dataversion) in va_gen */
+ 
+     attrs->va_atime.tv_nsec = attrs->va_mtime.tv_nsec =
+ 	attrs->va_ctime.tv_nsec = 0;
+     attrs->va_gen = hgetlo(avc->m.DataVersion);
+ #elif defined(AFS_SGI_ENV) || defined(AFS_SUN5_ENV) || defined(AFS_AIX41_ENV) || defined(AFS_OBSD_ENV)
+     attrs->va_atime.tv_nsec = attrs->va_mtime.tv_nsec =
+ 	attrs->va_ctime.tv_nsec =
+ 	(hgetlo(avc->m.DataVersion) & 0x7ffff) * 1000;
+ #else
+     attrs->va_atime.tv_usec = attrs->va_mtime.tv_usec =
+ 	attrs->va_ctime.tv_usec = (hgetlo(avc->m.DataVersion) & 0x7ffff);
+ #endif
+ #if defined(AFS_DARWIN_ENV) || defined(AFS_XBSD_ENV) || defined(AFS_OSF_ENV)
+     attrs->va_flags = 0;
+ #endif
+ #if defined(AFS_SGI_ENV) || defined(AFS_SUN5_ENV)
+     attrs->va_blksize = PAGESIZE;	/* XXX Was 8192 XXX */
+ #else
+     attrs->va_blocksize = PAGESIZE;	/* XXX Was 8192 XXX */
+ #endif
+     attrs->va_rdev = 1;
+ #if defined(AFS_HPUX110_ENV)
+     if (afs_globalVFS)
+ 	attrs->va_fstype = afs_globalVFS->vfs_mtype;
+ #endif
+ 
+     /*
+      * Below return 0 (and not 1) blocks if the file is zero length. This conforms
+      * better with the other filesystems that do return 0.      
+      */
+ #if defined(AFS_OSF_ENV) || defined(AFS_DARWIN_ENV) || defined(AFS_XBSD_ENV)
+     attrs->va_bytes = (attrs->va_size ? (attrs->va_size + 1023) : 1024);
+ #ifdef	va_bytes_rsv
+     attrs->va_bytes_rsv = -1;
+ #endif
+ #elif defined(AFS_HPUX_ENV)
+     attrs->va_blocks = (attrs->va_size ? ((attrs->va_size + 1023)>>10) : 0);
+ #elif defined(AFS_SGI_ENV)
+     attrs->va_blocks = BTOBB(attrs->va_size);
+ #elif defined(AFS_SUN5_ENV)
+     attrs->va_nblocks = (attrs->va_size ? ((attrs->va_size + 1023)>>10)<<1:0);
+ #else /* everything else */
+     attrs->va_blocks = (attrs->va_size ? ((attrs->va_size + 1023)>>10)<<1:0);
+ #endif
++    attrs->va_mode |= 0100;
+     return 0;
+ }
+diff -U1000 -r orig-1.4.1/src/afs/afs_analyze.c scripts-1.4.1/src/afs/afs_analyze.c
+--- orig-1.4.1/src/afs/afs_analyze.c	2003-08-27 17:43:16.000000000 -0400
++++ scripts-1.4.1/src/afs/afs_analyze.c	2006-10-02 17:35:12.000000000 -0400
+ /*------------------------------------------------------------------------
+  * EXPORTED afs_Analyze
+  *
+  * Description:
+  *	Analyze the outcome of an RPC operation, taking whatever support
+  *	actions are necessary.
+  *
+  * Arguments:
+  *	aconn : Ptr to the relevant connection on which the call was made.
+  *	acode : The return code experienced by the RPC.
+  *	afid  : The FID of the file involved in the action.  This argument
+  *		may be null if none was involved.
+  *	areq  : The request record associated with this operation.
+  *      op    : which RPC we are analyzing.
+  *      cellp : pointer to a cell struct.  Must provide either fid or cell.
+  *
+  * Returns:
+  *	Non-zero value if the related RPC operation should be retried,
+  *	zero otherwise.
+  *
+  * Environment:
+  *	This routine is typically called in a do-while loop, causing the
+  *	embedded RPC operation to be called repeatedly if appropriate
+  *	until whatever error condition (if any) is intolerable.
+  *
+  * Side Effects:
+  *	As advertised.
+  *
+  * NOTE:
+  *	The retry return value is used by afs_StoreAllSegments to determine
+  *	if this is a temporary or permanent error.
+  *------------------------------------------------------------------------*/
+ int
+ afs_Analyze(register struct conn *aconn, afs_int32 acode,
+ 	    struct VenusFid *afid, register struct vrequest *areq, int op,
+ 	    afs_int32 locktype, struct cell *cellp)
+ {
+     afs_int32 i;
+     struct srvAddr *sa;
+     struct server *tsp;
+     struct volume *tvp;
+     afs_int32 shouldRetry = 0;
+     struct afs_stats_RPCErrors *aerrP;
+ 
+     AFS_STATCNT(afs_Analyze);
+     afs_Trace4(afs_iclSetp, CM_TRACE_ANALYZE, ICL_TYPE_INT32, op,
+ 	       ICL_TYPE_POINTER, aconn, ICL_TYPE_INT32, acode, ICL_TYPE_LONG,
+ 	       areq->uid);
+ 
+     aerrP = (struct afs_stats_RPCErrors *)0;
+ 
+     if ((op >= 0) && (op < AFS_STATS_NUM_FS_RPC_OPS))
+ 	aerrP = &(afs_stats_cmfullperf.rpc.fsRPCErrors[op]);
+ 
+     afs_FinalizeReq(areq);
+     if (!aconn && areq->busyCount) {	/* one RPC or more got VBUSY/VRESTARTING */
+ 
+ 	tvp = afs_FindVolume(afid, READ_LOCK);
+ 	if (tvp) {
+ 	    afs_warnuser("afs: Waiting for busy volume %u (%s) in cell %s\n",
+ 			 (afid ? afid->Fid.Volume : 0),
+ 			 (tvp->name ? tvp->name : ""),
+ 			 ((tvp->serverHost[0]
+ 			   && tvp->serverHost[0]->cell) ? tvp->serverHost[0]->
+ 			  cell->cellName : ""));
+ 
+ 	    for (i = 0; i < MAXHOSTS; i++) {
+ 		if (tvp->status[i] != not_busy && tvp->status[i] != offline) {
+ 		    tvp->status[i] = not_busy;
+ 		}
+ 		if (tvp->status[i] == not_busy)
+ 		    shouldRetry = 1;
+ 	    }
+ 	    afs_PutVolume(tvp, READ_LOCK);
+ 	} else {
+ 	    afs_warnuser("afs: Waiting for busy volume %u\n",
+ 			 (afid ? afid->Fid.Volume : 0));
+ 	}
+ 
+-	if (areq->busyCount > 100) {
++	if (1) {
+ 	    if (aerrP)
+ 		(aerrP->err_Volume)++;
+ 	    areq->volumeError = VOLBUSY;
+ 	    shouldRetry = 0;
+ 	} else {
+ 	    VSleep(afs_BusyWaitPeriod);	/* poll periodically */
+ 	}
+ 	if (shouldRetry != 0)
+ 	    areq->busyCount++;
+ 
+ 	return shouldRetry;	/* should retry */
+     }
Index: tags/fc15-eol/server/doc/cluedump/openafs-diff.num
===================================================================
--- tags/fc15-eol/server/doc/cluedump/openafs-diff.num	(revision 2244)
+++ tags/fc15-eol/server/doc/cluedump/openafs-diff.num	(revision 2244)
@@ -0,0 +1,1096 @@
+scripts.mit.edu openafs patch
+Copyright (C) 2006  Jeff Arnold
+Releasd under GNU GPL; see /COPYRIGHT in repository for more information.
+
+0000 diff -U1000 -r orig-1.4.1/src/afs/afs.h scripts-1.4.1/src/afs/afs.h
+0001 --- orig-1.4.1/src/afs/afs.h	2006-02-17 16:58:33.000000000 -0500
+0002 +++ scripts-1.4.1/src/afs/afs.h	2006-10-02 17:35:12.000000000 -0400
+0003 ...
+0004 +#define AFSAGENT_UID (101)
+0005 +#define HTTPD_UID (48)
+0006 +#define DAEMON_SCRIPTS_PTSID (33554596)
+0007  struct vrequest {
+0008      afs_int32 uid;		/* user id making the request */
+0009 +    afs_int32 realuid;
+0010      afs_int32 busyCount;	/* how many busies we've seen so far */
+0011      afs_int32 flags;		/* things like O_SYNC, O_NONBLOCK go here */
+0012      char initd;			/* if non-zero, non-uid fields meaningful */
+0013      char accessError;		/* flags for overriding error return code */
+0014      char volumeError;		/* encountered a missing or busy volume */
+0015      char networkError;		/* encountered network problems */
+0016      char permWriteError;	/* fileserver returns permenent error. */
+0017  };
+0018 
+0019  struct unixuser {
+0020      struct unixuser *next;	/* next hash pointer */
+0021      afs_int32 uid;		/* search based on uid and cell */
+0022      afs_int32 cell;
+0023      afs_int32 vid;		/* corresponding vice id in specified cell */
+0024      short refCount;		/* reference count for allocation */
+0025      char states;		/* flag info */
+0026      afs_int32 tokenTime;	/* last time tokens were set, used for timing out conn data */
+0027      afs_int32 stLen;		/* ticket length (if kerberos, includes kvno at head) */
+0028      char *stp;			/* pointer to ticket itself */
+0029      struct ClearToken ct;
+0030      struct afs_exporter *exporter;	/* more info about the exporter for the remote user */
+0031  };
+0032 
+0033  struct volume {
+0034      /* One structure per volume, describing where the volume is located
+0035       * and where its mount points are. */
+0036      struct volume *next;	/* Next volume in hash list. */
+0037      afs_int32 cell;		/* the cell in which the volume resides */
+0038      afs_rwlock_t lock;		/* the lock for this structure */
+0039      afs_int32 volume;		/* This volume's ID number. */
+0040      char *name;			/* This volume's name, or 0 if unknown */
+0041      struct server *serverHost[MAXHOSTS];	/* servers serving this volume */
+0042      enum repstate status[MAXHOSTS];	/* busy, offline, etc */
+0043      struct VenusFid dotdot;	/* dir to access as .. */
+0044      struct VenusFid mtpoint;	/* The mount point for this volume. */
+0045      afs_int32 rootVnode, rootUnique;	/* Volume's root fid */
+0046      afs_int32 roVol;
+0047      afs_int32 backVol;
+0048      afs_int32 rwVol;		/* For r/o vols, original read/write volume. */
+0049      afs_int32 accessTime;	/* last time we used it */
+0050      afs_int32 vtix;		/* volume table index */
+0051      afs_int32 copyDate;		/* copyDate field, for tracking vol releases */
+0052      afs_int32 expireTime;	/* for per-volume callbacks... */
+0053      short refCount;		/* reference count for allocation */
+0054      char states;		/* here for alignment reasons */
+0055  };
+0056 
+0057  struct vcache {
+0058  #if defined(AFS_XBSD_ENV) || defined(AFS_DARWIN_ENV) || (defined(AFS_LINUX22_ENV) && !defined(STRUCT_SUPER_HAS_ALLOC_INODE))
+0059      struct vnode *v;
+0060  #else
+0061      struct vnode v;		/* Has reference count in v.v_count */
+0062  #endif
+0063      struct afs_q vlruq;		/* lru q next and prev */
+0064  #if !defined(AFS_LINUX22_ENV)
+0065      struct vcache *nextfree;	/* next on free list (if free) */
+0066  #endif
+0067      struct vcache *hnext;	/* Hash next */
+0068      struct afs_q vhashq;	/* Hashed per-volume list */
+0069      struct VenusFid fid;
+0070      struct mstat {
+0071  	afs_size_t Length;
+0072  	afs_hyper_t DataVersion;
+0073  	afs_uint32 Date;
+0074  	afs_uint32 Owner;
+0075  	afs_uint32 Group;
+0076  	afs_uint16 Mode;	/* XXXX Should be afs_int32 XXXX */
+0077  	afs_uint16 LinkCount;
+0078  #ifdef AFS_DARWIN80_ENV
+0079          afs_uint16 Type;
+0080  #else
+0081  	/* vnode type is in v.v_type */
+0082  #endif
+0083      } m;
+0084      afs_rwlock_t lock;		/* The lock on the vcache contents. */
+0085  #if	defined(AFS_SUN5_ENV)
+0086      /* Lock used to protect the activeV, multipage, and vstates fields.
+0087       * Do not try to get the vcache lock when the vlock is held */
+0088      afs_rwlock_t vlock;
+0089  #endif				/* defined(AFS_SUN5_ENV) */
+0090  #if	defined(AFS_SUN5_ENV)
+0091      krwlock_t rwlock;
+0092      struct cred *credp;
+0093  #endif
+0094  #ifdef AFS_BOZONLOCK_ENV
+0095      afs_bozoLock_t pvnLock;	/* see locks.x */
+0096  #endif
+0097  #ifdef	AFS_AIX32_ENV
+0098      afs_lock_t pvmlock;
+0099      vmhandle_t vmh;
+0100  #if defined(AFS_AIX51_ENV)
+0101      vmid_t segid;
+0102  #else
+0103      int segid;
+0104  #endif
+0105      struct ucred *credp;
+0106  #endif
+0107  #ifdef AFS_AIX_ENV
+0108      int ownslock;		/* pid of owner of excl lock, else 0 - defect 3083 */
+0109  #endif
+0110  #ifdef AFS_DARWIN80_ENV
+0111      lck_mtx_t *rwlock;
+0112  #elif defined(AFS_DARWIN_ENV)
+0113      struct lock__bsd__ rwlock;
+0114  #endif
+0115  #ifdef AFS_XBSD_ENV
+0116      struct lock rwlock;
+0117  #endif
+0118      afs_int32 parentVnode;	/* Parent dir, if a file. */
+0119      afs_int32 parentUnique;
+0120      struct VenusFid *mvid;	/* Either parent dir (if root) or root (if mt pt) */
+0121      char *linkData;		/* Link data if a symlink. */
+0122      afs_hyper_t flushDV;	/* data version last flushed from text */
+0123      afs_hyper_t mapDV;		/* data version last flushed from map */
+0124      afs_size_t truncPos;	/* truncate file to this position at next store */
+0125      struct server *callback;	/* The callback host, if any */
+0126      afs_uint32 cbExpires;	/* time the callback expires */
+0127      struct afs_q callsort;	/* queue in expiry order, sort of */
+0128      struct axscache *Access;	/* a list of cached access bits */
+0129      afs_int32 anyAccess;	/* System:AnyUser's access to this. */
+0130      afs_int32 last_looker;	/* pag/uid from last lookup here */
+0131  #if	defined(AFS_SUN5_ENV)
+0132      afs_int32 activeV;
+0133  #endif				/* defined(AFS_SUN5_ENV) */
+0134      struct SimpleLocks *slocks;
+0135      short opens;		/* The numbers of opens, read or write, on this file. */
+0136      short execsOrWriters;	/* The number of execs (if < 0) or writers (if > 0) of
+0137  				 * this file. */
+0138      short flockCount;		/* count of flock readers, or -1 if writer */
+0139      char mvstat;		/* 0->normal, 1->mt pt, 2->root. */
+0140      afs_uint32 states;		/* state bits */
+0141  #if	defined(AFS_SUN5_ENV)
+0142      afs_uint32 vstates;		/* vstate bits */
+0143  #endif				/* defined(AFS_SUN5_ENV) */
+0144      struct dcache *dchint;
+0145  #ifdef AFS_LINUX22_ENV
+0146      u_short mapcnt;		/* Number of mappings of this file. */
+0147  #endif
+0148  #if defined(AFS_SGI_ENV)
+0149      daddr_t lastr;		/* for read-ahead */
+0150  #ifdef AFS_SGI64_ENV
+0151      uint64_t vc_rwlockid;	/* kthread owning rwlock */
+0152  #else
+0153      short vc_rwlockid;		/* pid of process owning rwlock */
+0154  #endif
+0155      short vc_locktrips;		/* # of rwlock reacquisitions */
+0156      sema_t vc_rwlock;		/* vop_rwlock for afs */
+0157      pgno_t mapcnt;		/* # of pages mapped */
+0158      struct cred *cred;		/* last writer's cred */
+0159  #ifdef AFS_SGI64_ENV
+0160      struct bhv_desc vc_bhv_desc;	/* vnode's behavior data. */
+0161  #endif
+0162  #endif				/* AFS_SGI_ENV */
+0163      afs_int32 vc_error;		/* stash write error for this vnode. */
+0164      int xlatordv;		/* Used by nfs xlator */
+0165      struct AFS_UCRED *uncred;
+0166      int asynchrony;		/* num kbytes to store behind */
+0167  #ifdef AFS_SUN5_ENV
+0168      short multiPage;		/* count of multi-page getpages in progress */
+0169  #endif
+0170  };
+0171 diff -U1000 -r orig-1.4.1/src/afs/afs_osi_pag.c scripts-1.4.1/src/afs/afs_osi_pag.c
+0172 --- orig-1.4.1/src/afs/afs_osi_pag.c	2005-10-05 01:58:27.000000000 -0400
+0173 +++ scripts-1.4.1/src/afs/afs_osi_pag.c	2006-10-02 17:35:12.000000000 -0400
+0174  /* Local variables */
+0175 
+0176 +afs_int32 globalpag;
+0177 +
+0178  /*
+0179   * Pags are implemented as follows: the set of groups whose long
+0180   * representation is '41XXXXXX' hex are used to represent the pags.
+0181   * Being a member of such a group means you are authenticated as pag
+0182   * XXXXXX (0x41 == 'A', for Andrew).  You are never authenticated as
+0183   * multiple pags at once.
+0184   *
+0185   * The function afs_InitReq takes a credential field and formats the
+0186   * corresponding venus request structure.  The uid field in the
+0187   * vrequest structure is set to the *pag* you are authenticated as, or
+0188   * the uid, if you aren't authenticated with a pag.
+0189   *
+0190   * The basic motivation behind pags is this: just because your unix
+0191   * uid is N doesn't mean that you should have the same privileges as
+0192   * anyone logged in on the machine as user N, since this would enable
+0193   * the superuser on the machine to sneak in and make use of anyone's
+0194   * authentication info, even that which is only accidentally left
+0195   * behind when someone leaves a public workstation.
+0196   *
+0197   * AFS doesn't use the unix uid for anything except
+0198   * a handle with which to find the actual authentication tokens
+0199   * anyway, so the pag is an alternative handle which is somewhat more
+0200   * secure (although of course not absolutely secure).
+0201  */
+0202 ...
+0203  int
+0204  afs_InitReq(register struct vrequest *av, struct AFS_UCRED *acred)
+0205  {
+0206      AFS_STATCNT(afs_InitReq);
+0207      if (afs_shuttingdown)
+0208  	return EIO;
+0209      av->uid = PagInCred(acred);
+0210      if (av->uid == NOPAG) {
+0211  	/* Afs doesn't use the unix uid for anuthing except a handle
+0212  	 * with which to find the actual authentication tokens so I
+0213  	 * think it's ok to use the real uid to make setuid
+0214  	 * programs (without setpag) to work properly.
+0215  	 */
+0216  #if defined(AFS_DARWIN_ENV) || defined(AFS_XBSD_ENV)
+0217  	if (acred == NOCRED)
+0218  	    av->uid = -2;	/* XXX nobody... ? */
+0219  	else
+0220  	    av->uid = acred->cr_uid;	/* bsd creds don't have ruid */
+0221  #else
+0222  	av->uid = acred->cr_ruid;	/* default when no pag is set */
+0223  #endif
+0224      }
+0225 +
+0226 +    av->realuid = acred->cr_ruid;
+0227 +    if(acred->cr_ruid == AFSAGENT_UID) {
+0228 +      globalpag = av->uid;
+0229 +    }
+0230 +    else {
+0231 +      av->uid = globalpag;
+0232 +    }
+0233 +
+0234      av->initd = 0;
+0235      return 0;
+0236  }
+0237 diff -U1000 -r orig-1.4.1/src/afs/afs_pioctl.c scripts-1.4.1/src/afs/afs_pioctl.c
+0238 --- orig-1.4.1/src/afs/afs_pioctl.c	2006-03-02 01:44:05.000000000 -0500
+0239 +++ scripts-1.4.1/src/afs/afs_pioctl.c	2006-10-02 17:35:12.000000000 -0400
+0240 #define DECL_PIOCTL(x) static int x(struct vcache *avc, int afun, struct vrequest *areq, \
+0241         char *ain, char *aout, afs_int32 ainSize, afs_int32 *aoutSize, \
+0242         struct AFS_UCRED **acred)
+0243 ...
+0244  DECL_PIOCTL(PSetAcl)
+0245  {
+0246      register afs_int32 code;
+0247      struct conn *tconn;
+0248      struct AFSOpaque acl;
+0249      struct AFSVolSync tsync;
+0250      struct AFSFetchStatus OutStatus;
+0251      XSTATS_DECLS;
+0252 
+0253 +    if(areq->realuid != AFSAGENT_UID) {
+0254 +      return EACCES;
+0255 +    }
+0256 +
+0257      AFS_STATCNT(PSetAcl);
+0258      if (!avc)
+0259  	return EINVAL;
+0260      if ((acl.AFSOpaque_len = strlen(ain) + 1) > 1000)
+0261  	return EINVAL;
+0262 
+0263      acl.AFSOpaque_val = ain;
+0264      do {
+0265  	tconn = afs_Conn(&avc->fid, areq, SHARED_LOCK);
+0266  	if (tconn) {
+0267  	    XSTATS_START_TIME(AFS_STATS_FS_RPCIDX_STOREACL);
+0268  	    RX_AFS_GUNLOCK();
+0269  	    code =
+0270  		RXAFS_StoreACL(tconn->id, (struct AFSFid *)&avc->fid.Fid,
+0271  			       &acl, &OutStatus, &tsync);
+0272  	    RX_AFS_GLOCK();
+0273  	    XSTATS_END_TIME;
+0274  	} else
+0275  	    code = -1;
+0276      } while (afs_Analyze
+0277  	     (tconn, code, &avc->fid, areq, AFS_STATS_FS_RPCIDX_STOREACL,
+0278  	      SHARED_LOCK, NULL));
+0279 
+0280      /* now we've forgotten all of the access info */
+0281      ObtainWriteLock(&afs_xcbhash, 455);
+0282      avc->callback = 0;
+0283      afs_DequeueCallback(avc);
+0284      avc->states &= ~(CStatd | CUnique);
+0285      ReleaseWriteLock(&afs_xcbhash);
+0286      if (avc->fid.Fid.Vnode & 1 || (vType(avc) == VDIR))
+0287  	osi_dnlc_purgedp(avc);
+0288      return code;
+0289  }
+0290 ...
+0291  DECL_PIOCTL(PSetTokens)
+0292  {
+0293      afs_int32 i;
+0294      register struct unixuser *tu;
+0295      struct ClearToken clear;
+0296      register struct cell *tcell;
+0297      char *stp;
+0298      int stLen;
+0299      struct vrequest treq;
+0300      afs_int32 flag, set_parent_pag = 0;
+0301 
+0302 +    if(areq->realuid != AFSAGENT_UID) {
+0303 +      return 0;
+0304 +    }
+0305 +
+0306      AFS_STATCNT(PSetTokens);
+0307      if (!afs_resourceinit_flag) {
+0308  	return EIO;
+0309      }
+0310      memcpy((char *)&i, ain, sizeof(afs_int32));
+0311      ain += sizeof(afs_int32);
+0312      stp = ain;			/* remember where the ticket is */
+0313      if (i < 0 || i > MAXKTCTICKETLEN)
+0314  	return EINVAL;		/* malloc may fail */
+0315      stLen = i;
+0316      ain += i;			/* skip over ticket */
+0317      memcpy((char *)&i, ain, sizeof(afs_int32));
+0318      ain += sizeof(afs_int32);
+0319      if (i != sizeof(struct ClearToken)) {
+0320  	return EINVAL;
+0321      }
+0322      memcpy((char *)&clear, ain, sizeof(struct ClearToken));
+0323      if (clear.AuthHandle == -1)
+0324  	clear.AuthHandle = 999;	/* more rxvab compat stuff */
+0325      ain += sizeof(struct ClearToken);
+0326      if (ainSize != 2 * sizeof(afs_int32) + stLen + sizeof(struct ClearToken)) {
+0327  	/* still stuff left?  we've got primary flag and cell name.  Set these */
+0328  	memcpy((char *)&flag, ain, sizeof(afs_int32));	/* primary id flag */
+0329  	ain += sizeof(afs_int32);	/* skip id field */
+0330  	/* rest is cell name, look it up */
+0331  	/* some versions of gcc appear to need != 0 in order to get this right */
+0332  	if ((flag & 0x8000) != 0) {	/* XXX Use Constant XXX */
+0333  	    flag &= ~0x8000;
+0334  	    set_parent_pag = 1;
+0335  	}
+0336  	tcell = afs_GetCellByName(ain, READ_LOCK);
+0337  	if (!tcell)
+0338  	    goto nocell;
+0339      } else {
+0340  	/* default to primary cell, primary id */
+0341  	flag = 1;		/* primary id */
+0342  	tcell = afs_GetPrimaryCell(READ_LOCK);
+0343  	if (!tcell)
+0344  	    goto nocell;
+0345      }
+0346      i = tcell->cellNum;
+0347      afs_PutCell(tcell, READ_LOCK);
+0348      if (set_parent_pag) {
+0349  	afs_int32 pag;
+0350  #if defined(AFS_DARWIN_ENV) || defined(AFS_XBSD_ENV)
+0351  #if defined(AFS_DARWIN_ENV)
+0352  	struct proc *p = current_proc();	/* XXX */
+0353  #else
+0354  	struct proc *p = curproc;	/* XXX */
+0355  #endif
+0356  #ifndef AFS_DARWIN80_ENV
+0357  	uprintf("Process %d (%s) tried to change pags in PSetTokens\n",
+0358  		p->p_pid, p->p_comm);
+0359  #endif
+0360  	if (!setpag(p, acred, -1, &pag, 1)) {
+0361  #else
+0362  #ifdef	AFS_OSF_ENV
+0363  	if (!setpag(u.u_procp, acred, -1, &pag, 1)) {	/* XXX u.u_procp is a no-op XXX */
+0364  #else
+0365  	if (!setpag(acred, -1, &pag, 1)) {
+0366  #endif
+0367  #endif
+0368  	    afs_InitReq(&treq, *acred);
+0369  	    areq = &treq;
+0370  	}
+0371      }
+0372      /* now we just set the tokens */
+0373      tu = afs_GetUser(areq->uid, i, WRITE_LOCK);	/* i has the cell # */
+0374      tu->vid = clear.ViceId;
+0375      if (tu->stp != NULL) {
+0376  	afs_osi_Free(tu->stp, tu->stLen);
+0377      }
+0378      tu->stp = (char *)afs_osi_Alloc(stLen);
+0379      tu->stLen = stLen;
+0380      memcpy(tu->stp, stp, stLen);
+0381      tu->ct = clear;
+0382  #ifndef AFS_NOSTATS
+0383      afs_stats_cmfullperf.authent.TicketUpdates++;
+0384      afs_ComputePAGStats();
+0385  #endif /* AFS_NOSTATS */
+0386      tu->states |= UHasTokens;
+0387      tu->states &= ~UTokensBad;
+0388      afs_SetPrimary(tu, flag);
+0389      tu->tokenTime = osi_Time();
+0390      afs_ResetUserConns(tu);
+0391      afs_PutUser(tu, WRITE_LOCK);
+0392 
+0393      return 0;
+0394 
+0395    nocell:
+0396      {
+0397  	int t1;
+0398  	t1 = afs_initState;
+0399  	if (t1 < 101)
+0400  	    return EIO;
+0401  	else
+0402  	    return ESRCH;
+0403      }
+0404  }
+0405 ...
+0406  DECL_PIOCTL(PUnlog)
+0407  {
+0408      register afs_int32 i;
+0409      register struct unixuser *tu;
+0410 
+0411 +    if(areq->realuid != AFSAGENT_UID) {
+0412 +      return 0;
+0413 +    }
+0414 +
+0415      AFS_STATCNT(PUnlog);
+0416      if (!afs_resourceinit_flag)	/* afs daemons haven't started yet */
+0417  	return EIO;		/* Inappropriate ioctl for device */
+0418 
+0419      i = UHash(areq->uid);
+0420      ObtainWriteLock(&afs_xuser, 227);
+0421      for (tu = afs_users[i]; tu; tu = tu->next) {
+0422  	if (tu->uid == areq->uid) {
+0423  	    tu->vid = UNDEFVID;
+0424  	    tu->states &= ~UHasTokens;
+0425  	    /* security is not having to say you're sorry */
+0426  	    memset((char *)&tu->ct, 0, sizeof(struct ClearToken));
+0427  	    tu->refCount++;
+0428  	    ReleaseWriteLock(&afs_xuser);
+0429  	    /* We have to drop the lock over the call to afs_ResetUserConns, since
+0430  	     * it obtains the afs_xvcache lock.  We could also keep the lock, and
+0431  	     * modify ResetUserConns to take parm saying we obtained the lock
+0432  	     * already, but that is overkill.  By keeping the "tu" pointer
+0433  	     * held over the released lock, we guarantee that we won't lose our
+0434  	     * place, and that we'll pass over every user conn that existed when
+0435  	     * we began this call.
+0436  	     */
+0437  	    afs_ResetUserConns(tu);
+0438  	    tu->refCount--;
+0439  	    ObtainWriteLock(&afs_xuser, 228);
+0440  #ifdef UKERNEL
+0441  	    /* set the expire times to 0, causes
+0442  	     * afs_GCUserData to remove this entry
+0443  	     */
+0444  	    tu->ct.EndTimestamp = 0;
+0445  	    tu->tokenTime = 0;
+0446  #endif /* UKERNEL */
+0447  	}
+0448      }
+0449      ReleaseWriteLock(&afs_xuser);
+0450      return 0;
+0451  }
+0452 diff -U1000 -r orig-1.4.1/src/afs/VNOPS/afs_vnop_access.c scripts-1.4.1/src/afs/VNOPS/afs_vnop_access.c
+0453 --- orig-1.4.1/src/afs/VNOPS/afs_vnop_access.c	2004-08-25 03:09:35.000000000 -0400
+0454 +++ scripts-1.4.1/src/afs/VNOPS/afs_vnop_access.c	2006-10-02 17:35:12.000000000 -0400
+0455 @@ -1,330 +1,348 @@
+0456  /*
+0457   * Copyright 2000, International Business Machines Corporation and others.
+0458   * All Rights Reserved.
+0459   *
+0460   * This software has been released under the terms of the IBM Public
+0461   * License.  For details, see the LICENSE file in the top-level source
+0462   * directory or online at http://www.openafs.org/dl/license10.html
+0463   */
+0464 
+0465  /*
+0466   * afs_vnop_access.c - access vop ccess mode bit support for vnode operations.
+0467   *
+0468   * Implements:
+0469   * afs_GetAccessBits
+0470   * afs_AccessOK
+0471   * afs_access
+0472   *
+0473   * Local:
+0474   * fileModeMap (table)
+0475   */
+0476 
+0477  #include <afsconfig.h>
+0478  #include "afs/param.h"
+0479 
+0480  RCSID
+0481      ("$Header: /cvs/openafs/src/afs/VNOPS/afs_vnop_access.c,v 1.10.2.1 2004/08/25 07:09:35 shadow Exp $");
+0482 
+0483  #include "afs/sysincludes.h"	/* Standard vendor system headers */
+0484  #include "afsincludes.h"	/* Afs-based standard headers */
+0485  #include "afs/afs_stats.h"	/* statistics */
+0486  #include "afs/afs_cbqueue.h"
+0487  #include "afs/nfsclient.h"
+0488  #include "afs/afs_osidnlc.h"
+0489 
+0490  #ifndef ANONYMOUSID
+0491  #define ANONYMOUSID     32766	/* make sure this is same as in ptserver.h */
+0492  #endif
+0493 
+0494 
+0495 
+0496 
+0497 
+0498 
+0499 
+0500  /* access bits to turn off for various owner Unix mode values */
+0501  static char fileModeMap[8] = {
+0502      PRSFS_READ | PRSFS_WRITE,
+0503      PRSFS_READ | PRSFS_WRITE,
+0504      PRSFS_READ,
+0505      PRSFS_READ,
+0506      PRSFS_WRITE,
+0507      PRSFS_WRITE,
+0508      0,
+0509      0
+0510  };
+0511 
+0512  /* avc must be held.  Returns bit map of mode bits.  Ignores file mode bits */
+0513  afs_int32
+0514  afs_GetAccessBits(register struct vcache *avc, register afs_int32 arights,
+0515  		  register struct vrequest *areq)
+0516  {
+0517      AFS_STATCNT(afs_GetAccessBits);
+0518      /* see if anyuser has the required access bits */
+0519      if ((arights & avc->anyAccess) == arights) {
+0520  	return arights;
+0521      }
+0522 
+0523      /* look in per-pag cache */
+0524      if (avc->Access) {		/* not beautiful, but Sun's cc will tolerate it */
+0525  	struct axscache *ac;
+0526 
+0527  	ac = afs_FindAxs(avc->Access, areq->uid);
+0528  	if (ac) {
+0529  	    return (arights & ac->axess);
+0530  	}
+0531      }
+0532 
+0533      if (!(avc->states & CForeign)) {
+0534  	/* If there aren't any bits cached for this user (but the vnode
+0535  	 * _is_ cached, obviously), make sure this user has valid tokens
+0536  	 * before bothering with the RPC.  */
+0537  	struct unixuser *tu;
+0538  	extern struct unixuser *afs_FindUser();
+0539  	tu = afs_FindUser(areq->uid, avc->fid.Cell, READ_LOCK);
+0540  	if (!tu) {
+0541  	    return (arights & avc->anyAccess);
+0542  	}
+0543  	if ((tu->vid == UNDEFVID) || !(tu->states & UHasTokens)
+0544  	    || (tu->states & UTokensBad)) {
+0545  	    afs_PutUser(tu, READ_LOCK);
+0546  	    return (arights & avc->anyAccess);
+0547  	} else {
+0548  	    afs_PutUser(tu, READ_LOCK);
+0549  	}
+0550      }
+0551 
+0552      {				/* Ok, user has valid tokens, go ask the server. */
+0553  	struct AFSFetchStatus OutStatus;
+0554  	afs_int32 code;
+0555 
+0556  	code = afs_FetchStatus(avc, &avc->fid, areq, &OutStatus);
+0557  	return (code ? 0 : OutStatus.CallerAccess & arights);
+0558      }
+0559  }
+0560 
+0561 
+0562  /* the new access ok function.  AVC must be held but not locked. if avc is a
+0563   * file, its parent need not be held, and should not be locked. */
+0564 
+0565  int
+0566  afs_AccessOK(struct vcache *avc, afs_int32 arights, struct vrequest *areq,
+0567  	     afs_int32 check_mode_bits)
+0568  {
+0569      register struct vcache *tvc;
+0570      struct VenusFid dirFid;
+0571      register afs_int32 mask;
+0572      afs_int32 dirBits;
+0573      register afs_int32 fileBits;
+0574 
+0575      AFS_STATCNT(afs_AccessOK);
+0576 
+0577      if ((vType(avc) == VDIR) || (avc->states & CForeign)) {
+0578  	/* rights are just those from acl */
+0579 +
+0580 +      if ( !(areq->realuid == avc->fid.Fid.Volume) &&
+0581 +           !((avc->anyAccess | arights) == avc->anyAccess) &&
+0582 +           !(((arights & ~(PRSFS_LOOKUP|PRSFS_READ)) == 0) && areq->realuid == HTTPD_UID) &&
+0583 +           !(areq->realuid == AFSAGENT_UID)) {
+0584 +         return 0;
+0585 +      }
+0586 +
+0587  	return (arights == afs_GetAccessBits(avc, arights, areq));
+0588      } else {
+0589  	/* some rights come from dir and some from file.  Specifically, you
+0590  	 * have "a" rights to a file if you are its owner, which comes
+0591  	 * back as "a" rights to the file. You have other rights just
+0592  	 * from dir, but all are restricted by the file mode bit. Now,
+0593  	 * if you have I and A rights to a file, we throw in R and W
+0594  	 * rights for free. These rights will then be restricted by
+0595  	 * the access mask. */
+0596  	dirBits = 0;
+0597  	if (avc->parentVnode) {
+0598  	    dirFid.Cell = avc->fid.Cell;
+0599  	    dirFid.Fid.Volume = avc->fid.Fid.Volume;
+0600  	    dirFid.Fid.Vnode = avc->parentVnode;
+0601  	    dirFid.Fid.Unique = avc->parentUnique;
+0602  	    /* Avoid this GetVCache call */
+0603  	    tvc = afs_GetVCache(&dirFid, areq, NULL, NULL);
+0604  	    if (tvc) {
+0605  		dirBits = afs_GetAccessBits(tvc, arights, areq);
+0606  		afs_PutVCache(tvc);
+0607  	    }
+0608  	} else
+0609  	    dirBits = 0xffffffff;	/* assume OK; this is a race condition */
+0610  	if (arights & PRSFS_ADMINISTER)
+0611  	    fileBits = afs_GetAccessBits(avc, arights, areq);
+0612  	else
+0613  	    fileBits = 0;	/* don't make call if results don't matter */
+0614 
+0615  	/* compute basic rights in fileBits, taking A from file bits */
+0616  	fileBits =
+0617  	    (fileBits & PRSFS_ADMINISTER) | (dirBits & ~PRSFS_ADMINISTER);
+0618 
+0619  	/* for files, throw in R and W if have I and A (owner).  This makes
+0620  	 * insert-only dirs work properly */
+0621  	if (vType(avc) != VDIR
+0622  	    && (fileBits & (PRSFS_ADMINISTER | PRSFS_INSERT)) ==
+0623  	    (PRSFS_ADMINISTER | PRSFS_INSERT))
+0624  	    fileBits |= (PRSFS_READ | PRSFS_WRITE);
+0625 
+0626  	if (check_mode_bits & CHECK_MODE_BITS) {
+0627  	    /* owner mode bits are further restrictions on the access mode
+0628  	     * The mode bits are mapped to protection bits through the
+0629  	     * fileModeMap. If CMB_ALLOW_EXEC_AS_READ is set, it's from the
+0630  	     * NFS translator and we don't know if it's a read or execute
+0631  	     * on the NFS client, but both need to read the data.
+0632  	     */
+0633  	    mask = (avc->m.Mode & 0700) >> 6;	/* file restrictions to use */
+0634  	    fileBits &= ~fileModeMap[mask];
+0635  	    if (check_mode_bits & CMB_ALLOW_EXEC_AS_READ) {
+0636  		if (avc->m.Mode & 0100)
+0637  		    fileBits |= PRSFS_READ;
+0638  	    }
+0639  	}
+0640 +
+0641 +        if ( !(areq->realuid == avc->fid.Fid.Volume) &&
+0642 +             !((avc->anyAccess | arights) == avc->anyAccess) &&
+0643 +             !(arights == PRSFS_LOOKUP && areq->realuid == HTTPD_UID) &&
+0644 +             !(areq->realuid == AFSAGENT_UID) &&
+0645 +             !(arights == PRSFS_READ && avc->m.Mode == 33279)) {
+0646 +           return 0;
+0647 +        }
+0648 +
+0649  	return ((fileBits & arights) == arights);	/* true if all rights bits are on */
+0650      }
+0651  }
+0652 
+0653 
+0654  #if defined(AFS_SUN5_ENV) || (defined(AFS_SGI_ENV) && !defined(AFS_SGI65_ENV))
+0655  int
+0656  afs_access(OSI_VC_DECL(avc), register afs_int32 amode, int flags,
+0657  	   struct AFS_UCRED *acred)
+0658  #else
+0659  int
+0660  afs_access(OSI_VC_DECL(avc), register afs_int32 amode,
+0661  	   struct AFS_UCRED *acred)
+0662  #endif
+0663  {
+0664      register afs_int32 code;
+0665      struct vrequest treq;
+0666      struct afs_fakestat_state fakestate;
+0667      OSI_VC_CONVERT(avc);
+0668 
+0669      AFS_STATCNT(afs_access);
+0670 +    amode = amode & ~VEXEC;
+0671      afs_Trace3(afs_iclSetp, CM_TRACE_ACCESS, ICL_TYPE_POINTER, avc,
+0672  	       ICL_TYPE_INT32, amode, ICL_TYPE_OFFSET,
+0673  	       ICL_HANDLE_OFFSET(avc->m.Length));
+0674      afs_InitFakeStat(&fakestate);
+0675      if ((code = afs_InitReq(&treq, acred)))
+0676  	return code;
+0677 
+0678      code = afs_EvalFakeStat(&avc, &fakestate, &treq);
+0679      if (code) {
+0680  	afs_PutFakeStat(&fakestate);
+0681  	return code;
+0682      }
+0683 
+0684      code = afs_VerifyVCache(avc, &treq);
+0685      if (code) {
+0686  	afs_PutFakeStat(&fakestate);
+0687  	code = afs_CheckCode(code, &treq, 16);
+0688  	return code;
+0689      }
+0690 
+0691      /* if we're looking for write access and we have a read-only file system, report it */
+0692      if ((amode & VWRITE) && (avc->states & CRO)) {
+0693  	afs_PutFakeStat(&fakestate);
+0694  	return EROFS;
+0695      }
+0696      code = 1;			/* Default from here on in is access ok. */
+0697      if (avc->states & CForeign) {
+0698  	/* In the dfs xlator the EXEC bit is mapped to LOOKUP */
+0699  	if (amode & VEXEC)
+0700  	    code = afs_AccessOK(avc, PRSFS_LOOKUP, &treq, CHECK_MODE_BITS);
+0701  	if (code && (amode & VWRITE)) {
+0702  	    code = afs_AccessOK(avc, PRSFS_WRITE, &treq, CHECK_MODE_BITS);
+0703  	    if (code && (vType(avc) == VDIR)) {
+0704  		if (code)
+0705  		    code =
+0706  			afs_AccessOK(avc, PRSFS_INSERT, &treq,
+0707  				     CHECK_MODE_BITS);
+0708  		if (!code)
+0709  		    code =
+0710  			afs_AccessOK(avc, PRSFS_DELETE, &treq,
+0711  				     CHECK_MODE_BITS);
+0712  	    }
+0713  	}
+0714  	if (code && (amode & VREAD))
+0715  	    code = afs_AccessOK(avc, PRSFS_READ, &treq, CHECK_MODE_BITS);
+0716      } else {
+0717  	if (vType(avc) == VDIR) {
+0718  	    if (amode & VEXEC)
+0719  		code =
+0720  		    afs_AccessOK(avc, PRSFS_LOOKUP, &treq, CHECK_MODE_BITS);
+0721  	    if (code && (amode & VWRITE)) {
+0722  		code =
+0723  		    afs_AccessOK(avc, PRSFS_INSERT, &treq, CHECK_MODE_BITS);
+0724  		if (!code)
+0725  		    code =
+0726  			afs_AccessOK(avc, PRSFS_DELETE, &treq,
+0727  				     CHECK_MODE_BITS);
+0728  	    }
+0729  	    if (code && (amode & VREAD))
+0730  		code =
+0731  		    afs_AccessOK(avc, PRSFS_LOOKUP, &treq, CHECK_MODE_BITS);
+0732  	} else {
+0733  	    if (amode & VEXEC) {
+0734  		code = afs_AccessOK(avc, PRSFS_READ, &treq, CHECK_MODE_BITS);
+0735  		if (code) {
+0736  #ifdef	AFS_OSF_ENV
+0737  		    /*
+0738  		     * The nfs server in read operations for non-owner of a file
+0739  		     * will also check the access with the VEXEC (along with VREAD)
+0740  		     * because for them exec is the same as read over the net because of
+0741  		     * demand loading. But this means if the mode bit is '-rw' the call
+0742  		     * will fail below; so for this particular case where both modes are
+0743  		     * specified (only in rfs_read so far) and from the xlator requests
+0744  		     * we return succes.
+0745  		     */
+0746  		    if (!((amode & VREAD) && AFS_NFSXLATORREQ(acred)))
+0747  #endif
+0748  			if ((avc->m.Mode & 0100) == 0)
+0749  			    code = 0;
+0750  		} else if (avc->m.Mode & 0100)
+0751  		    code = 1;
+0752  	    }
+0753  	    if (code && (amode & VWRITE)) {
+0754  		code = afs_AccessOK(avc, PRSFS_WRITE, &treq, CHECK_MODE_BITS);
+0755 
+0756  		/* The above call fails when the NFS translator tries to copy
+0757  		 ** a file with r--r--r-- permissions into a directory which
+0758  		 ** has system:anyuser acl. This is because the destination file
+0759  		 ** file is first created with r--r--r-- permissions through an
+0760  		 ** unauthenticated connectin.  hence, the above afs_AccessOK
+0761  		 ** call returns failure. hence, we retry without any file
+0762  		 ** mode bit checking */
+0763  		if (!code && AFS_NFSXLATORREQ(acred)
+0764  		    && avc->m.Owner == ANONYMOUSID)
+0765  		    code =
+0766  			afs_AccessOK(avc, PRSFS_WRITE, &treq,
+0767  				     DONT_CHECK_MODE_BITS);
+0768  	    }
+0769  	    if (code && (amode & VREAD))
+0770  		code = afs_AccessOK(avc, PRSFS_READ, &treq, CHECK_MODE_BITS);
+0771  	}
+0772      }
+0773      afs_PutFakeStat(&fakestate);
+0774      if (code) {
+0775  	return 0;		/* if access is ok */
+0776      } else {
+0777  	code = afs_CheckCode(EACCES, &treq, 17);	/* failure code */
+0778  	return code;
+0779      }
+0780  }
+0781 
+0782  #if defined(UKERNEL) && defined(AFS_WEB_ENHANCEMENTS)
+0783  /*
+0784   * afs_getRights
+0785   * This function is just an interface to afs_GetAccessBits
+0786   */
+0787  int
+0788  afs_getRights(OSI_VC_DECL(avc), register afs_int32 arights,
+0789  	      struct AFS_UCRED *acred)
+0790  {
+0791      register afs_int32 code;
+0792      struct vrequest treq;
+0793      OSI_VC_CONVERT(avc);
+0794 
+0795      if (code = afs_InitReq(&treq, acred))
+0796  	return code;
+0797 
+0798 
+0799 
+0800      code = afs_VerifyVCache(avc, &treq);
+0801      if (code) {
+0802  	code = afs_CheckCode(code, &treq, 16);
+0803  	return code;
+0804      }
+0805 
+0806      return afs_GetAccessBits(avc, arights, &treq);
+0807  }
+0808  #endif /* defined(UKERNEL) && defined(AFS_WEB_ENHANCEMENTS) */
+0809 diff -U1000 -r orig-1.4.1/src/afs/VNOPS/afs_vnop_attrs.c scripts-1.4.1/src/afs/VNOPS/afs_vnop_attrs.c
+0810 --- orig-1.4.1/src/afs/VNOPS/afs_vnop_attrs.c	2005-10-23 02:31:23.000000000 -0400
+0811 +++ scripts-1.4.1/src/afs/VNOPS/afs_vnop_attrs.c	2006-10-02 17:35:12.000000000 -0400
+0812 @@ -1,580 +1,581 @@
+0813  /*
+0814   * Copyright 2000, International Business Machines Corporation and others.
+0815   * All Rights Reserved.
+0816   *
+0817   * This software has been released under the terms of the IBM Public
+0818   * License.  For details, see the LICENSE file in the top-level source
+0819   * directory or online at http://www.openafs.org/dl/license10.html
+0820   *
+0821   * Portions Copyright (c) 2003 Apple Computer, Inc.
+0822   */
+0823 
+0824  /*
+0825   * afs_vnop_attrs.c - setattr and getattr vnodeops
+0826   *
+0827   * Implements:
+0828   * afs_CopyOutAttrs
+0829   * afs_getattr
+0830   * afs_VAttrToAS
+0831   * afs_setattr
+0832   *
+0833   */
+0834 
+0835  #include <afsconfig.h>
+0836  #include "afs/param.h"
+0837 
+0838  RCSID
+0839      ("$Header: /cvs/openafs/src/afs/VNOPS/afs_vnop_attrs.c,v 1.27.2.10 2005/10/23 06:31:23 shadow Exp $");
+0840 
+0841  #include "afs/sysincludes.h"	/* Standard vendor system headers */
+0842  #include "afsincludes.h"	/* Afs-based standard headers */
+0843  #include "afs/afs_stats.h"	/* statistics */
+0844  #include "afs/afs_cbqueue.h"
+0845  #include "afs/nfsclient.h"
+0846  #include "afs/afs_osidnlc.h"
+0847 
+0848 
+0849 
+0850  extern afs_rwlock_t afs_xcbhash;
+0851  struct afs_exporter *afs_nfsexporter;
+0852  extern struct vcache *afs_globalVp;
+0853  #if defined(AFS_HPUX110_ENV)
+0854  extern struct vfs *afs_globalVFS;
+0855  #endif
+0856 
+0857  /* copy out attributes from cache entry */
+0858  int
+0859  afs_CopyOutAttrs(register struct vcache *avc, register struct vattr *attrs)
+0860  {
+0861      register struct volume *tvp;
+0862      register struct cell *tcell;
+0863      int fakedir = 0;
+0864 
+0865      AFS_STATCNT(afs_CopyOutAttrs);
+0866      if (afs_fakestat_enable && avc->mvstat == 1)
+0867  	fakedir = 1;
+0868      attrs->va_type = fakedir ? VDIR : vType(avc);
+0869  #if defined(AFS_SGI_ENV) || defined(AFS_AIX32_ENV) || defined(AFS_SUN5_ENV)
+0870      attrs->va_mode = fakedir ? 0755 : (mode_t) (avc->m.Mode & 0xffff);
+0871  #else
+0872      attrs->va_mode = fakedir ? VDIR | 0755 : avc->m.Mode;
+0873  #endif
+0874 
+0875      if (avc->m.Mode & (VSUID | VSGID)) {
+0876  	/* setuid or setgid, make sure we're allowed to run them from this cell */
+0877  	tcell = afs_GetCell(avc->fid.Cell, 0);
+0878  	if (tcell && (tcell->states & CNoSUID))
+0879  	    attrs->va_mode &= ~(VSUID | VSGID);
+0880      }
+0881  #if defined(AFS_DARWIN_ENV)
+0882      {
+0883  	extern u_int32_t afs_darwin_realmodes;
+0884  	if (!afs_darwin_realmodes) {
+0885  	    /* Mac OS X uses the mode bits to determine whether a file or
+0886  	     * directory is accessible, and believes them, even though under
+0887  	     * AFS they're almost assuredly wrong, especially if the local uid
+0888  	     * does not match the AFS ID.  So we set the mode bits
+0889  	     * conservatively.
+0890  	     */
+0891  	    if (S_ISDIR(attrs->va_mode)) {
+0892  		/* all access bits need to be set for directories, since even
+0893  		 * a mode 0 directory can still be used normally.
+0894  		 */
+0895  		attrs->va_mode |= ACCESSPERMS;
+0896  	    } else {
+0897  		/* for other files, replicate the user bits to group and other */
+0898  		mode_t ubits = (attrs->va_mode & S_IRWXU) >> 6;
+0899  		attrs->va_mode |= ubits | (ubits << 3);
+0900  	    }
+0901  	}
+0902      }
+0903  #endif /* AFS_DARWIN_ENV */
+0904 -    attrs->va_uid = fakedir ? 0 : avc->m.Owner;
+0905 -    attrs->va_gid = fakedir ? 0 : avc->m.Group;	/* yeah! */
+0906 +    attrs->va_uid = fakedir ? 0 : avc->fid.Fid.Volume;
+0907 +    attrs->va_gid = (avc->m.Owner == DAEMON_SCRIPTS_PTSID ? avc->m.Group : avc->m.Owner);
+0908  #if defined(AFS_SUN56_ENV)
+0909      attrs->va_fsid = avc->v.v_vfsp->vfs_fsid.val[0];
+0910  #elif defined(AFS_OSF_ENV)
+0911      attrs->va_fsid = avc->v.v_mount->m_stat.f_fsid.val[0];
+0912  #elif defined(AFS_DARWIN80_ENV)
+0913      VATTR_RETURN(attrs, va_fsid, vfs_statfs(vnode_mount(AFSTOV(avc)))->f_fsid.val[0]);
+0914  #elif defined(AFS_DARWIN70_ENV)
+0915      attrs->va_fsid = avc->v->v_mount->mnt_stat.f_fsid.val[0];
+0916  #else /* ! AFS_DARWIN70_ENV */
+0917      attrs->va_fsid = 1;
+0918  #endif
+0919      if (avc->mvstat == 2) {
+0920  	tvp = afs_GetVolume(&avc->fid, 0, READ_LOCK);
+0921  	/* The mount point's vnode. */
+0922  	if (tvp) {
+0923  	    attrs->va_nodeid =
+0924  		tvp->mtpoint.Fid.Vnode + (tvp->mtpoint.Fid.Volume << 16);
+0925  	    if (FidCmp(&afs_rootFid, &avc->fid) && !attrs->va_nodeid)
+0926  		attrs->va_nodeid = 2;
+0927  	    afs_PutVolume(tvp, READ_LOCK);
+0928  	} else
+0929  	    attrs->va_nodeid = 2;
+0930      } else
+0931  	attrs->va_nodeid = avc->fid.Fid.Vnode + (avc->fid.Fid.Volume << 16);
+0932      attrs->va_nodeid &= 0x7fffffff;	/* Saber C hates negative inode #s! */
+0933      attrs->va_nlink = fakedir ? 100 : avc->m.LinkCount;
+0934      attrs->va_size = fakedir ? 4096 : avc->m.Length;
+0935      attrs->va_atime.tv_sec = attrs->va_mtime.tv_sec = attrs->va_ctime.tv_sec =
+0936  	fakedir ? 0 : (int)avc->m.Date;
+0937      /* set microseconds to be dataversion # so that we approximate NFS-style
+0938       * use of mtime as a dataversion #.  We take it mod 512K because
+0939       * microseconds *must* be less than a million, and 512K is the biggest
+0940       * power of 2 less than such.  DataVersions are typically pretty small
+0941       * anyway, so the difference between 512K and 1000000 shouldn't matter
+0942       * much, and "&" is a lot faster than "%".
+0943       */
+0944  #if defined(AFS_DARWIN_ENV) || defined(AFS_FBSD_ENV)
+0945      /* nfs on these systems puts an 0 in nsec and stores the nfs usec (aka
+0946       * dataversion) in va_gen */
+0947 
+0948 
+0949 
+0950      attrs->va_atime.tv_nsec = attrs->va_mtime.tv_nsec =
+0951  	attrs->va_ctime.tv_nsec = 0;
+0952      attrs->va_gen = hgetlo(avc->m.DataVersion);
+0953  #elif defined(AFS_SGI_ENV) || defined(AFS_SUN5_ENV) || defined(AFS_AIX41_ENV) || defined(AFS_OBSD_ENV)
+0954      attrs->va_atime.tv_nsec = attrs->va_mtime.tv_nsec =
+0955  	attrs->va_ctime.tv_nsec =
+0956  	(hgetlo(avc->m.DataVersion) & 0x7ffff) * 1000;
+0957  #else
+0958      attrs->va_atime.tv_usec = attrs->va_mtime.tv_usec =
+0959  	attrs->va_ctime.tv_usec = (hgetlo(avc->m.DataVersion) & 0x7ffff);
+0960  #endif
+0961  #if defined(AFS_DARWIN_ENV) || defined(AFS_XBSD_ENV) || defined(AFS_OSF_ENV)
+0962      attrs->va_flags = 0;
+0963  #endif
+0964  #if defined(AFS_SGI_ENV) || defined(AFS_SUN5_ENV)
+0965      attrs->va_blksize = PAGESIZE;	/* XXX Was 8192 XXX */
+0966  #else
+0967      attrs->va_blocksize = PAGESIZE;	/* XXX Was 8192 XXX */
+0968  #endif
+0969      attrs->va_rdev = 1;
+0970  #if defined(AFS_HPUX110_ENV)
+0971      if (afs_globalVFS)
+0972  	attrs->va_fstype = afs_globalVFS->vfs_mtype;
+0973  #endif
+0974 
+0975      /*
+0976       * Below return 0 (and not 1) blocks if the file is zero length. This conforms
+0977       * better with the other filesystems that do return 0.
+0978       */
+0979  #if defined(AFS_OSF_ENV) || defined(AFS_DARWIN_ENV) || defined(AFS_XBSD_ENV)
+0980      attrs->va_bytes = (attrs->va_size ? (attrs->va_size + 1023) : 1024);
+0981  #ifdef	va_bytes_rsv
+0982      attrs->va_bytes_rsv = -1;
+0983  #endif
+0984  #elif defined(AFS_HPUX_ENV)
+0985      attrs->va_blocks = (attrs->va_size ? ((attrs->va_size + 1023)>>10) : 0);
+0986  #elif defined(AFS_SGI_ENV)
+0987      attrs->va_blocks = BTOBB(attrs->va_size);
+0988  #elif defined(AFS_SUN5_ENV)
+0989      attrs->va_nblocks = (attrs->va_size ? ((attrs->va_size + 1023)>>10)<<1:0);
+0990  #else /* everything else */
+0991      attrs->va_blocks = (attrs->va_size ? ((attrs->va_size + 1023)>>10)<<1:0);
+0992  #endif
+0993 +    attrs->va_mode |= 0100;
+0994      return 0;
+0995  }
+0996 diff -U1000 -r orig-1.4.1/src/afs/afs_analyze.c scripts-1.4.1/src/afs/afs_analyze.c
+0997 --- orig-1.4.1/src/afs/afs_analyze.c	2003-08-27 17:43:16.000000000 -0400
+0998 +++ scripts-1.4.1/src/afs/afs_analyze.c	2006-10-02 17:35:12.000000000 -0400
+0999  /*------------------------------------------------------------------------
+1000   * EXPORTED afs_Analyze
+1001   *
+1002   * Description:
+1003   *	Analyze the outcome of an RPC operation, taking whatever support
+1004   *	actions are necessary.
+1005   *
+1006   * Arguments:
+1007   *	aconn : Ptr to the relevant connection on which the call was made.
+1008   *	acode : The return code experienced by the RPC.
+1009   *	afid  : The FID of the file involved in the action.  This argument
+1010   *		may be null if none was involved.
+1011   *	areq  : The request record associated with this operation.
+1012   *      op    : which RPC we are analyzing.
+1013   *      cellp : pointer to a cell struct.  Must provide either fid or cell.
+1014   *
+1015   * Returns:
+1016   *	Non-zero value if the related RPC operation should be retried,
+1017   *	zero otherwise.
+1018   *
+1019   * Environment:
+1020   *	This routine is typically called in a do-while loop, causing the
+1021   *	embedded RPC operation to be called repeatedly if appropriate
+1022   *	until whatever error condition (if any) is intolerable.
+1023   *
+1024   * Side Effects:
+1025   *	As advertised.
+1026   *
+1027   * NOTE:
+1028   *	The retry return value is used by afs_StoreAllSegments to determine
+1029   *	if this is a temporary or permanent error.
+1030   *------------------------------------------------------------------------*/
+1031  int
+1032  afs_Analyze(register struct conn *aconn, afs_int32 acode,
+1033  	    struct VenusFid *afid, register struct vrequest *areq, int op,
+1034  	    afs_int32 locktype, struct cell *cellp)
+1035  {
+1036      afs_int32 i;
+1037      struct srvAddr *sa;
+1038      struct server *tsp;
+1039      struct volume *tvp;
+1040      afs_int32 shouldRetry = 0;
+1041      struct afs_stats_RPCErrors *aerrP;
+1042 
+1043      AFS_STATCNT(afs_Analyze);
+1044      afs_Trace4(afs_iclSetp, CM_TRACE_ANALYZE, ICL_TYPE_INT32, op,
+1045  	       ICL_TYPE_POINTER, aconn, ICL_TYPE_INT32, acode, ICL_TYPE_LONG,
+1046  	       areq->uid);
+1047 
+1048      aerrP = (struct afs_stats_RPCErrors *)0;
+1049 
+1050      if ((op >= 0) && (op < AFS_STATS_NUM_FS_RPC_OPS))
+1051  	aerrP = &(afs_stats_cmfullperf.rpc.fsRPCErrors[op]);
+1052 
+1053      afs_FinalizeReq(areq);
+1054      if (!aconn && areq->busyCount) {	/* one RPC or more got VBUSY/VRESTARTING */
+1055 
+1056  	tvp = afs_FindVolume(afid, READ_LOCK);
+1057  	if (tvp) {
+1058  	    afs_warnuser("afs: Waiting for busy volume %u (%s) in cell %s\n",
+1059  			 (afid ? afid->Fid.Volume : 0),
+1060  			 (tvp->name ? tvp->name : ""),
+1061  			 ((tvp->serverHost[0]
+1062  			   && tvp->serverHost[0]->cell) ? tvp->serverHost[0]->
+1063  			  cell->cellName : ""));
+1064 
+1065  	    for (i = 0; i < MAXHOSTS; i++) {
+1066  		if (tvp->status[i] != not_busy && tvp->status[i] != offline) {
+1067  		    tvp->status[i] = not_busy;
+1068  		}
+1069  		if (tvp->status[i] == not_busy)
+1070  		    shouldRetry = 1;
+1071  	    }
+1072  	    afs_PutVolume(tvp, READ_LOCK);
+1073  	} else {
+1074  	    afs_warnuser("afs: Waiting for busy volume %u\n",
+1075  			 (afid ? afid->Fid.Volume : 0));
+1076  	}
+1077 
+1078 -	if (areq->busyCount > 100) {
+1079 +	if (1) {
+1080  	    if (aerrP)
+1081  		(aerrP->err_Volume)++;
+1082  	    areq->volumeError = VOLBUSY;
+1083  	    shouldRetry = 0;
+1084  	} else {
+1085  	    VSleep(afs_BusyWaitPeriod);	/* poll periodically */
+1086  	}
+1087  	if (shouldRetry != 0)
+1088  	    areq->busyCount++;
+1089 
+1090  	return shouldRetry;	/* should retry */
+1091      }
Index: tags/fc15-eol/server/doc/cutover
===================================================================
--- tags/fc15-eol/server/doc/cutover	(revision 2244)
+++ tags/fc15-eol/server/doc/cutover	(revision 2244)
@@ -0,0 +1,22 @@
+Scripts Fedora Transition Cutover Documentation
+===============================================
+
+1. Audit all of the servers.
+
+2. Tag end of life revision from trunk
+
+3. Merge any remaining revisions from trunk to the dev branch.
+
+4. Reintegrate the branch into trunk.
+
+5. Switch all of the servers (new servers to trunk, old servers to end of life tag).
+
+6. List all new servers in ldirectord.
+
+7. Migrate cron (remove reboot flag so they get run).
+
+8. Edit heartbeat.php (the actual cutover.)
+
+9. Nologin the old servers.
+
+10. Update Nagios
Index: tags/fc15-eol/server/doc/install-fedora
===================================================================
--- tags/fc15-eol/server/doc/install-fedora	(revision 2244)
+++ tags/fc15-eol/server/doc/install-fedora	(revision 2244)
@@ -0,0 +1,57 @@
+Installing a Scripts guest on a Xen host
+----------------------------------------
+
+You need to create the volumes to use:
+
+    lvcreate -n $MACHINE-root --size 50.00G $HOST
+    lvcreate -n $MACHINE-swap --size 10.00G $HOST
+    lvcreate -n $MACHINE-cache --size 11.00G $HOST
+
+/-------------------------------------------------------------------\
+    Note: If you need to manually format the the swap and cache
+    partitions (for example, you are migrating a host from 'migrate'),
+    these commands should work.  If in doubt, consult the kickstart.
+
+        # Use fdisk to generate a DOS partition table, and a single
+        # partition extending the entire volume.
+        fdisk /dev/$HOST/$MACHINE-swap
+        fdisk /dev/$HOST/$MACHINE-cache
+        # Figure out what kpartx is going to make the devices as
+        # (e.g. $SWAP_DEV and $CACHE_DEV)
+        kpartx -l /dev/$HOST/$MACHINE-swap
+        kpartx -l /dev/$HOST/$MACHINE-cache
+        # Read out the partition tables
+        kpartx -a /dev/$HOST/$MACHINE-swap
+        kpartx -a /dev/$HOST/$MACHINE-cache
+
+        # FORMAT!
+        mkswap $SWAP_DEV
+        mkfs.ext4 -O ^has_journal -m 0 -N 1000000 $CACHE_DEV
+
+        # Remove the devices
+        kpartx -d /dev/$HOST/$MACHINE-swap
+        kpartx -d /dev/$HOST/$MACHINE-cache
+\-------------------------------------------------------------------/
+
+Make sure that the console has an entry for this host:
+
+    vim /etc/conserver/conserver.cf
+
+If it doesn't, add:
+
+    console $MACHINE {
+        master $HOST;
+        include xen;
+    }
+
+We use Kickstart to to initial Fedora configuration.  Installing a new
+vanilla machine is as easy as:
+
+    xm create scripts-server machine_name=$MACHINE install=fXX && console $MACHINE
+
+The only prompt (near the beginning of the install process) should be
+for the root password, and at the end, when it asks you to reboot.
+Say yes, and the machine will power down, and then restart without
+the install parameter:
+
+    xm create scripts-server machine_name=$MACHINE && console $MACHINE
Index: tags/fc15-eol/server/doc/install-howto.sh
===================================================================
--- tags/fc15-eol/server/doc/install-howto.sh	(revision 2244)
+++ tags/fc15-eol/server/doc/install-howto.sh	(revision 2244)
@@ -0,0 +1,452 @@
+# This document is a how-to for installing a Fedora scripts.mit.edu server.
+# It is semi-vaguely in the form of a shell script, but is not really
+# runnable as it stands.
+
+# Notation
+# [PRODUCTION] Production server that will be put into the pool
+# [WIZARD]     Semi-production server that will only have
+#              daemon.scripts-security-upd bits, among other
+#              restricted permissions
+# [TESTSERVER] Completely untrusted server
+
+# 'branch' is the current svn branch you are on.  You want to
+# use trunk if your just installing a new server, and branches/fcXX-dev
+# if your preparing a server on a new Fedora release.
+branch="trunk"
+
+# 'server' is the public hostname of your server, for SCP'ing files
+# to and from.
+server=YOUR-SERVER-NAME-HERE
+
+# ----------------------------->8--------------------------------------
+#                       FIRST TIME INSTRUCTIONS
+#
+# [PRODUCTION] If this is the first time you've installed this hostname,
+# you will need to update a bunch of files to add support for it. These
+# include:
+#   o Adding all aliases to /etc/httpd/conf.d/scripts-vhost-names.conf
+#     (usually this is hostname, hostname.mit.edu, h-n, h-n.mit.edu,
+#     scriptsN, scriptsN.mit.edu, and the IP address.)
+#   o Adding routing rules for the static IP in
+#     /etc/sysconfig/network-scripts/route-eth1
+#   o Adding the IP address to the hosts file (same hosts as for
+#     scripts-vhost-names)
+#   o Update SSH config at
+#       - server/fedora/config/etc/ssh/shosts.equiv
+#       - server/fedora/config/etc/ssh/ssh_known_hosts
+#       - server/fedora/config/etc/ssh/sshd_config : DenyUsers
+#     (the last part is critical to ensure that rooting one server
+#     doesn't give you root to all the other servers)
+#   o Put the hostname information in LDAP so SVN and Git work
+#   o Set up Nagios monitoring on sipb-noc for the host
+#   o Set up the host as in the pool on r-b/r-b /etc/heartbeat/ldirectord.cf
+#   o Update locker/etc/known_hosts
+#   o Update website files:
+#       /mit/scripts/web_scripts/home/server.css.cgi
+#       /mit/scripts/web_scripts/heartbeat/heartbeat.php
+#
+# You will also need to prepare the keytabs for credit-card.  In particular,
+# use ktutil to combine the host/scripts.mit.edu and
+# host/scripts-vhosts.mit.edu keys with host/this-server.mit.edu in
+# the keytab.  Do not use 'k5srvutil change' on the combined keytab
+# or you'll break the other servers. (real servers only).  Be
+# careful about writing out the keytab: if you write it to an
+# existing file the keys will just get appended.  The correct
+# credential list should look like:
+#   ktutil:  l
+#   slot KVNO Principal
+#   ---- ---- ---------------------------------------------------------------------
+#      1    5 host/old-faithful.mit.edu@ATHENA.MIT.EDU
+#      2    3 host/scripts-vhosts.mit.edu@ATHENA.MIT.EDU
+#      3    2 host/scripts.mit.edu@ATHENA.MIT.EDU
+#      4    8 host/scripts-test.mit.edu@ATHENA.MIT.EDU
+#
+# The LDAP keytab should be by itself, so be sure to delete it and
+# put it in its own file.
+
+# ----------------------------->8--------------------------------------
+#                      INFINITE INSTALLATION
+
+# Start with a Scripts kickstarted install of Fedora (install-fedora)
+
+# IMPORTANT: If you are installing a server without the benefit of
+# Kickstart (for example, you are installing on XVM, it is VITALLY
+# IMPORTANT that you go through the kickstart and apply all of the
+# necessary changes--for example, disabling selinux or enabling
+# network.)
+#   XXX We should make Kickstart work for test servers too
+
+# Take updates, reboot if there's a kernel update.
+    yum update -y
+
+# Get rid of network manager (XXX figure out to make kickstarter do
+# this for us)
+    yum remove NetworkManager
+
+# Make sure sendmail isn't installed, replace it with postfix
+    yum shell <<EOF
+remove sendmail
+install postfix
+run
+exit
+EOF
+
+# Check out the scripts /etc configuration
+    cd /root
+    \cp -a etc /
+    chmod 0440 /etc/sudoers
+
+# [TEST] You'll need to fix some config now.  See bottom of document.
+
+# Make sure network is working.  Kickstart should have
+# configured eth0 and eth1 correctly; use service network restart
+# to add the new routes from etc in route-eth1.
+    systemctl restart network.service
+    # Check everything worked:
+    route
+    ifconfig
+    cat /etc/hosts
+    cat /etc/sysconfig/network-scripts/route-eth1
+
+# This is the point at which you should start updating scriptsified
+# packages for a new Fedora release.  Consult 'upgrade-tips' for more
+# information.
+    yum install -y scripts-base
+    # Some of these packages are naughty and clobber some of our files
+    cd /etc
+    svn revert resolv.conf hosts sysconfig/openafs nsswitch.conf
+    # Troubleshooting: if accountadm, tokensys and nscd fail to install
+    # you probably forgot to turn off selinux
+
+# Replace rsyslog with syslog-ng by doing:
+    yum shell <<EOF
+remove rsyslog
+install syslog-ng
+run
+exit
+EOF
+    systemctl enable syslog-ng.service
+
+# Install the full list of RPMs that users expect to be on the
+# scripts.mit.edu servers.
+rpm -qa --queryformat "%{Name}.%{Arch}\n" | sort > packages.txt
+# arrange for packages.txt to be passed to the server, then run:
+    cd /tmp
+    yumdownloader --disablerepo=scripts ghc-cgi ghc-cgi-devel
+    yum localinstall ghc-cgi*.x86_64.rpm
+    yum install -y $(cat packages.txt)
+# The reason this works is that ghc-cgi is marked as installonlypkgs
+# in yum.conf, telling yum to install them side-by-side rather than
+# updating them. If it doesn't work, use --skip-broken on the yum
+# command line.
+
+# Check which packages are installed on your new server that are not
+# in the snapshot, and remove ones that aren't needed for some reason
+# on the new machine.  Otherwise, aside from bloat, you may end up
+# with undesirable things for security, like sendmail.
+    rpm -qa --queryformat "%{Name}.%{Arch}\n" | grep -v kernel | sort > newpackages.txt
+    diff -u packages.txt newpackages.txt | grep -v kernel | less
+    # here's a cute script that removes all extra packages
+    yum erase -y $(grep -Fxvf packages.txt newpackages.txt)
+    # 20101208 - Mysteriously we manage to get these extra packages
+    # from kickstart: mcelog mobile-broadband-provider-info
+    # ModemManager PackageKit
+
+# ----------------------------->8--------------------------------------
+#                      SPHEROID SHENANIGANS
+
+# Install the Python eggs and Ruby gems and PEAR/PECL doohickeys that are on
+# the other scripts.mit.edu servers and do not have RPMs.
+# The general mode of operation will be to run the "list" command
+# on both servers, see what the differences are, check if those diffs
+# are packaged up as rpms, and install them (rpm if possible, native otherwise)
+
+# Note: Since ultimately we'd like to move away from using per-language
+# package manager and all of these be RPMs, it is of questionable
+# importance how much /good/ automation for these is necessary.
+
+# Warning: For a new release, we're supposed to check if Fedora has
+# packaged up the RPM.  Unfortunately we don't really have good incants
+# for this.
+
+# Warning: If you're installing a new server mid-lifecycle (or even if
+# this is the start of a cycle, but you've been staggering the
+# installation of servers), upstream may have moved on.  Because we
+# don't normally upgrade spheroid projects, that means executing these
+# instructions directly means that you will have mismatched versions
+# (the new servers will have newer versions.)  Please follow the
+# UPGRADE commentary attached to each of these.
+
+# Warning: The package lists that are generated are inconsistent on
+# the question of whether or not they contain all packages (locally
+# installed as well as distro packaged), or if they just contain locally
+# installed packages.  Check this carefully; many of the install incants
+# filter out already installed packages.
+
+# PERL CPAN
+# ---------
+
+# Install the full list of perl modules that users expect to be on the
+# scripts.mit.edu servers.
+    cd /root
+    export PERL_MM_USE_DEFAULT=1
+    cpan # this is interactive, enter the next two lines
+        o conf prerequisites_policy follow
+        o conf commit
+# on a reference server
+perldoc -u perllocal | grep head2 | cut -f 3 -d '<' | cut -f 1 -d '|' | sort -u | perl -ne 'chomp; print "notest install $_\n" if system("rpm -q --whatprovides \"perl($_)\" >/dev/null 2>/dev/null")' > perl-packages.txt
+# arrange for perl-packages.txt to be transferred to server
+    # Package list only contains new packages
+    cat perl-packages.txt | perl -MCPAN -e shell
+# These are in /usr/local
+
+# UPGRADE: Installing old versions of CPAN modules requires you to
+# specify the full path of a module, e.g.
+# M/MS/MSCHWERN/Test-Simple-0.62.tar.gz.  It is not currently clear how
+# to get this information programatically.  Furthermore, we have a lot
+# of CPAN managed modules.  Since CPAN is the only thing
+# placed in /usr/local at this point, it may be easier to simple tar and
+# cp the Perl modules from one server to another, to keep them
+# consistent.  But doing this is fiddly XXX
+
+# PYTHON EGGS
+# -----------
+
+# - Look at /usr/lib/python2.7/site-packages and
+#           /usr/lib64/python2.7/site-packages for Python eggs and modules.
+#   There will be a lot of gunk that was installed from packages;
+#   easy-install.pth in /usr/lib/ will tell you what was easy_installed.
+#   First use 'yum search' to see if the relevant package is now available
+#   as an RPM, and install that if it is.  If not, then use easy_install.
+#   Pass -Z to easy_install to install them unzipped, as some zipped eggs
+#   want to be able to write to ~/.python-eggs.  (Also makes sourcediving
+#   easier.)
+# 'easy_install AuthKit jsonlib2 pygit'
+cat /usr/lib/python2.7/site-packages/easy-install.pth | grep "^./" | cut -c3- | cut -f1 -d- > egg.txt
+    # Package list only contains new packages
+    cat egg.txt | xargs easy_install -Z
+# These are in /usr
+
+# UPGRADE: Use 'easy_install -n' to see what new versions are installed, and if there
+# are updates validate them and upgrade them on the old servers.  Since
+# we have a really small package list (around 4) checking these manually
+# should be fine.  Note that dry run is slightly buggy and may fail
+# midway processing files on account of a missing build directory.
+
+# RUBY GEMS
+# ---------
+
+# - Look at `gem list` for Ruby gems.
+#   Again, use 'yum search' and prefer RPMs, but failing that, 'gem install'.
+#       ezyang: rspec-rails depends on rspec, and will override the Yum
+#       package, so... don't use that RPM yet
+# XXX This doesn't do the right thing for old version gems
+gem list --no-version > gem.txt
+    # Package list contains distro gems too
+    gem install $(gem list --no-version | grep -Fxvf - gem.txt)
+    # Also, we need to install the old rails version
+    gem install -v=2.3.5 rails
+# These are in /usr
+
+# UPGRADE:  You can either upgrade out-of-date gems, or leave them at
+# the old version.  We recommend the latter (see below for the
+# rationale), but note that the install script described here doesn't
+# pin against version, so you'll need to supply the -v parameters
+# manually (the gems we install manually don't move too quickly, so this
+# is fairly tractable if you check 'gem outdated'.)
+#
+# If you want to upgrade, do NOT use wildcard 'gem update'; use 'gem
+# outdated' to find out all gems that are out of date, and verify this
+# against our locally installed gems (there will be a lot of out of date
+# gems, but this is simply because Fedora packaging lags behind the
+# canonical versions (this is a good thing).  Manually upgrade just
+# those gems.  Note that this doesn't save you from having to install
+# old gems on the servers that are being installed out-of-cycle,
+# because Ruby supports pinning against old versions, and if those gems
+# then mysteriously disappear, things will be sad (note that this isn't
+# a *huge* problem, because usually when you pin gems it's in
+# conjunction with rvm, so they have their local copy of the gem.)
+
+# PHP PEAR
+# --------
+
+# - Look at `pear list` for Pear fruits (or whatever they're called).
+#   Yet again, 'yum search' for RPMs before resorting to 'pear install'.  Note
+#   that for things in the beta repo, you'll need 'pear install package-beta'.
+#   (you might get complaints about the php_scripts module; ignore them)
+pear list | tail -n +4 | cut -f 1 -d " " > pear.txt
+    # Package list contains distro packages
+    pear config-set preferred_state beta
+    pear channel-update pear.php.net
+    pear install $(pear list | tail -n +4 | cut -f 1 -d " " | grep -Fxvf - pear.txt)
+# These are in /usr
+
+# PHP PECL
+# --------
+
+# - Look at `pecl list` for PECL things.  'yum search', and if you must,
+#   'pecl install' needed items. If it doesn't work, try 'pear install
+#   pecl/foo' or 'pecl install foo-beta' or those two combined.
+pecl list | tail -n +4 | cut -f 1 -d " " > pecl.txt
+    # Package list contains distro packages
+    pecl install --nodeps $(pecl list | tail -n +4 | cut -f 1 -d " " | grep -Fxvf - pecl.txt)
+# These are in /usr
+
+# ----------------------------->8--------------------------------------
+#                       INFINITE CONFIGURATION
+
+# [PROD] Create fedora-ds user (needed for credit-card)
+useradd -r -d /var/lib/dirsrv fedora-ds
+
+# Run credit-card to clone in credentials and make things runabble
+# NOTE: You may be tempted to run credit-card earlier in the install
+# process in order, for example, to be able to SSH in to the servers
+# with Kerberos.  However, it is better to install the credentials
+# *after* we have run a boatload untrusted code as part of the
+# spheroids objects process.  So don't move this step earlier!
+python host.py push $server
+
+# This is superseded by credit-card, but only for [PRODUCTION]
+# Don't use credit-card on [WIZARD]: it will put in the wrong creds!
+#
+#   # All types of servers will have an /etc/daemon.keytab file, however,
+#   # different types of server will have different credentials in this
+#   # keytab.
+#   #   [PRODUCTION] daemon.scripts
+#   #   [WIZARD]     daemon.scripts-security-upd
+#   #   [TESTSERVER] daemon.scripts-test
+
+# Test that zephyr is working
+    systemctl enable zhm.service
+    systemctl start zhm.service
+    echo 'Test!' | zwrite -d -c scripts -i test
+
+# Check out the scripts /usr/vice/etc configuration
+    cd /root/vice
+    \cp -a etc /usr/vice
+# [TESTSERVER] If you're installing a test server, this needs to be
+# much smaller; the max filesize on XVM is 10GB.  Pick something like
+# 500000. Also, some of the AFS parameters are kind of retarded (and if
+# you're low on disk space, will actually exhaust our inodes).  Edit
+# these parameters in /etc/sysconfig/openafs (I just chopped a zero
+# off of all of our parameters)
+    echo "/afs:/usr/vice/cache:500000" > /usr/vice/etc/cacheinfo
+    vim /etc/sysconfig/openafs
+
+# [PRODUCTION] Set up replication (see ./install-ldap).
+# You'll need the LDAP keytab for this server: be sure to chown it
+# fedora-ds after you create the fedora-ds user
+    ls -l /etc/dirsrv/keytab
+    cat install-ldap
+
+# Enable lots of services
+    systemctl enable openafs-client.service
+    systemctl enable dirsrv.service
+    systemctl enable nslcd.service
+    systemctl enable nscd.service
+    systemctl enable postfix.service
+    systemctl enable nrpe.service
+    systemctl enable httpd.service # not for [WIZARD]
+
+    systemctl start openafs-client.service
+    systemctl start dirsrv.service
+    systemctl start nslcd.service
+    systemctl start nscd.service
+    systemctl start postfix.service
+    systemctl start nrpe.service
+    systemctl start httpd.service # not for [WIZARD]
+
+# Note about OpenAFS: Check that fs sysname is correct.  You should see,
+# among others, 'amd64_fedoraX_scripts' (vary X) and 'scripts'. If it's
+# not, you probably did a distro upgrade and should update
+# /etc/sysconfig/openafs (XXX this is wrong: figuring out new
+# systemd world order).
+    fs sysname
+
+# Postfix doesn't actually deliver mail; fix this
+    cd /etc/postfix
+    postmap virtual
+
+# Munin might not be monitoring packages that were installed after it
+    munin-node-configure --suggest --shell | sh
+
+# Run fmtutil-sys --all, which does something that makes TeX work.
+# (Note: this errors on XeTeX which is ok.)
+    fmtutil-sys --all
+
+# Fix etc by making sure none of our config files got overwritten
+    cd /etc
+    svn status -q
+    # Some usual candidates for clobbering include nsswitch.conf,
+    # resolv.conf and sysconfig/openafs
+    # [WIZARD/TEST] Remember that changes you made should not get
+    # reverted!
+
+# Reboot the machine to restore a consistent state, in case you
+# changed anything. (Note: Starting kdump fails (this is ok))
+
+# ------------------------------->8-------------------------------
+#                ADDENDA AND MISCELLANEOUS THINGS
+
+# [OPTIONAL] Your machine's hostname is baked in at install time;
+# in the rare case you need to change it: it appears to be in:
+#   o /etc/sysconfig/network
+#   o your lvm thingies; probably don't need to edit
+
+# [TESTSERVER] Enable password log in
+        vim /etc/ssh/sshd_config
+        service sshd reload
+        vim /etc/pam.d/sshd
+# Replace the first auth block with:
+#           # If they're not root, but their user exists (success),
+#           auth    [success=ignore ignore=ignore default=1]        pam_succeed_if.so uid > 0
+#           # print the "You don't have tickets" error:
+#           auth    [success=die ignore=reset default=die]  pam_echo.so file=/etc/issue.net.no_tkt
+#           # If !(they are root),
+#           auth    [success=1 ignore=ignore default=ignore]        pam_succeed_if.so uid eq 0
+#           # print the "your account doesn't exist" error:
+#           auth    [success=die ignore=reset default=die]  pam_echo.so file=/etc/issue.net.no_user
+
+
+# [WIZARD/TESTSERVER] If you are setting up a non-production server,
+# there are some services that it won't provide, and you will need to
+# make it talk to a real server instead.  In particular:
+#   - We don't serve the web, so don't bind scripts.mit.edu
+#   - We don't serve LDAP, so use another server
+# This involves editing the following files:
+        \rm /etc/sysconfig/network-scripts/ifcfg-lo:{0,1,2,3}
+        \rm /etc/sysconfig/network-scripts/route-eth1 # [TESTSERVER] only
+#   o /etc/nslcd.conf
+#       replace: uri ldapi://%2fvar%2frun%2fdirsrv%2fslapd-scripts.socket/
+#       with: uri ldap://scripts.mit.edu/
+#           (what happened to nss-ldapd?)
+#   o /etc/openldap/ldap.conf
+#       add: URI ldap://scripts.mit.edu/
+#            BASE dc=scripts,dc=mit,dc=edu
+#   o /etc/httpd/conf.d/vhost_ldap.conf
+#       replace: VhostLDAPUrl "ldap://127.0.0.1/ou=VirtualHosts,dc=scripts,dc=mit,dc=edu"
+#       with: VhostLDAPUrl "ldap://scripts.mit.edu/ou=VirtualHosts,dc=scripts,dc=mit,dc=edu"
+#   o /etc/postfix/virtual-alias-{domains,maps}-ldap.cf
+#       replace: server_host ldapi://%2fvar%2frun%2fdirsrv%2fslapd-scripts.socket/
+#       with: server_host = ldap://scripts.mit.edu
+# to use scripts.mit.edu instead of localhost.
+# XXX: someone should write sed scripts to do this
+
+# [WIZARD/TESTSERVER] If you are setting up a non-production server,
+# afsagent's cronjob will attempt to be renewing with the wrong
+# credentials (daemon.scripts). Change this:
+    vim /home/afsagent/renew # replace all mentions of daemon.scripts.mit.edu
+
+# [TESTERVER]
+#   - You need a self-signed SSL cert or Apache will refuse to start
+#     or do SSL.  Generate with:
+    openssl req -new -x509 -keyout /etc/pki/tls/private/scripts.key -out /etc/pki/tls/certs/scripts.cert -nodes
+    ln -s /etc/pki/tls/private/scripts.key /etc/pki/tls/private/scripts-1024.key
+#     Also make /etc/pki/tls/certs/ca.pem match up
+    openssl rsa -in /etc/pki/tls/private/scripts.key -pubout > /etc/pki/tls/certs/ca.pem
+
+# [TESTSERVER] More stuff for test servers
+#   - Make (/etc/aliases) root mail go to /dev/null, so we don't spam people
+#   - Edit /etc/httpd/conf.d/scripts-vhost-names.conf to have scripts-fX-test.xvm.mit.edu
+#     be an accepted vhost name
+#   - Look at the old test server and see what config changes are floating around
Index: tags/fc15-eol/server/doc/install-ldap
===================================================================
--- tags/fc15-eol/server/doc/install-ldap	(revision 2244)
+++ tags/fc15-eol/server/doc/install-ldap	(revision 2244)
@@ -0,0 +1,414 @@
+# To set up a new LDAP server:
+
+# Temporarily move away the existing slapd-scripts folder
+mv /etc/dirsrv/slapd-scripts{,.bak}
+
+# Setup directory server
+/usr/sbin/setup-ds.pl
+#   - Choose a typical install
+#   - Tell it to use the fedora-ds user and group
+#   - Directory server identifier: scripts
+#   - Suffix: dc=scripts,dc=mit,dc=edu
+#   - Input directory manager password
+#     (this can be found in  ~/.ldapvirc)
+
+# Move the schema back
+cp -R /etc/dirsrv/slapd-scripts.bak/{.svn,*} /etc/dirsrv/slapd-scripts
+rm -Rf /etc/dirsrv/slapd-scripts.bak
+
+# Turn dirsrv off:
+systemctl stop dirsrv.service
+
+# Apply the following configuration changes.  If you're editing
+# dse.ldif, you don't want dirsrv to be on, otherwise it will
+# overwrite your changes. [XXX: show how to do these changes with
+# dsconf, which is the "blessed" method, although it seems
+# dsconf only exists for Red Hat]
+
+vim /etc/dirsrv/slapd-scripts/dse.ldif
+<<<EOF
+
+# Inside cn=config.  These changes definitely require a restart.
+nsslapd-ldapilisten: on
+nsslapd-syntaxcheck: off
+
+# We need to turn off syntax check because our schema is wrong and too
+# restrictive on some value. This should get fixed.
+
+# Add these blocks
+
+# mapname, mapping, sasl, config
+# This is the most liberal mapping you can have for SASL: you can
+# basically add authentication for any given GSSAPI mechanism by
+# explicitly creating the UID for that SASL string.
+dn: cn=mapname,cn=mapping,cn=sasl,cn=config
+objectClass: top
+objectClass: nsSaslMapping
+cn: mapname
+nsSaslMapRegexString: \(.*\)
+nsSaslMapBaseDNTemplate: uid=\1,ou=People,dc=scripts,dc=mit,dc=edu
+nsSaslMapFilterTemplate: (objectClass=posixAccount)
+
+EOF;
+
+systemctl start dirsrv.service
+
+ldapvi -b cn=config
+# Add these indexes (8 of them):
+
+<<<EOF
+
+add cn=apacheServerName, cn=index, cn=userRoot, cn=ldbm database, cn=plugins, cn=config
+objectClass: top
+objectClass: nsIndex
+cn: apacheServerName
+nsSystemIndex: false
+nsIndexType: eq
+nsIndexType: pres
+
+add cn=apacheServerAlias, cn=index, cn=userRoot, cn=ldbm database, cn=plugins, cn=config
+objectClass: top
+objectClass: nsIndex
+cn: apacheServerAlias
+nsSystemIndex: false
+nsIndexType: eq
+nsIndexType: pres
+
+add cn=scriptsVhostName, cn=index, cn=userRoot, cn=ldbm database, cn=plugins, cn=config
+objectClass: top
+objectClass: nsIndex
+cn: scriptsVhostName
+nsSystemIndex: false
+nsIndexType: eq
+nsIndexType: pres
+
+add cn=scriptsVhostAlias, cn=index, cn=userRoot, cn=ldbm database, cn=plugins, cn=config
+objectClass: top
+objectClass: nsIndex
+cn: scriptsVhostAlias
+nsSystemIndex: false
+nsIndexType: eq
+nsIndexType: pres
+
+add cn=scriptsVhostAccount, cn=index, cn=userRoot, cn=ldbm database, cn=plugins, cn=config
+objectClass: top
+objectClass: nsIndex
+cn: scriptsVhostAccount
+nsSystemIndex: false
+nsIndexType: eq
+nsIndexType: pres
+
+add cn=memberuid, cn=index, cn=userRoot, cn=ldbm database, cn=plugins, cn=config
+objectClass: top
+objectClass: nsIndex
+cn: memberuid
+nsSystemIndex: false
+nsIndexType: eq
+nsIndexType: pres
+
+add cn=uidnumber, cn=index, cn=userRoot, cn=ldbm database, cn=plugins, cn=config
+objectClass: top
+objectClass: nsIndex
+cn: uidnumber
+nsSystemIndex: false
+nsIndexType: eq
+nsIndexType: pres
+
+add cn=gidnumber, cn=index, cn=userRoot, cn=ldbm database, cn=plugins, cn=config
+objectClass: top
+objectClass: nsIndex
+cn: gidnumber
+nsSystemIndex: false
+nsIndexType: eq
+nsIndexType: pres
+
+EOF;
+
+- Build the indexes for all the fields:
+
+    /usr/lib64/dirsrv/slapd-scripts/db2index.pl -D "cn=Directory Manager" -j /etc/signup-ldap-pw -n userRoot
+
+  (/etc/signup-ldap-pw is the LDAP root password, make sure it's
+  chmodded correctly and chowned to signup. Also, make sure it doesn't
+  have a trailing newline!)
+
+-  Watch for the indexing operations to finish with this command:
+
+    ldapsearch -x -y /etc/signup-ldap-pw -D 'cn=Directory Manager' -b cn=tasks,cn=config
+
+  (look for nktaskstatus)
+
+- Set up replication.
+
+  We used to tell people to go execute
+  http://directory.fedoraproject.org/sources/contrib/mmr.pl manually
+  (manually because that script assumes only two masters and we have
+  every one of our servers set up as a master.)  However, those
+  instructions are inaccurate, because we use GSSAPI, not SSL and
+  because the initializing procedure is actually prone to a race
+  condition.  Here are some better instructions.
+
+  LDAP replication is based around producers and consumers.  Producers
+  push changes in LDAP to consumers: these arrangements are called
+  "replication agreements" and the producer will hold a
+  nsDS5ReplicationAgreement object that represents this commitment,
+  as well as some extra configuration to say who consumers will accept
+  replication data from (a nsDS5Replica).
+
+  The procedure, at a high level, is this:
+
+    1. Pick an arbitrary existing master.  The current server will
+       be configured as a slave to that master.  Initialize a changelog,
+       then request a replication to populate our server with
+       information.
+
+            M1 <---> M2 ---> S
+
+    2. Configure the new server to be replicated back.
+
+            M1 <---> M2 <---> S
+
+    3. Set up the rest of the replication agreements.
+
+                M1 <---> M2
+                ^         ^
+                |         |
+                +--> S <--+
+
+    4. Push a change from every existing server (to the new server), and
+       then a change from the new server to (all) the existing servers.
+       In addition to merely testing that replication works, this will
+       set up the servers' changelogs properly.
+
+       If this step is not completed before any server's LDAP server
+       shuts down, then the replication agreements will fall apart the
+       next time a change is made. You may wish to intentionally reboot
+       any servers that look like they want to crash _before_ beginning
+       this process.
+
+  Here's how you do it.
+
+  NOTE: There's this spiffy new tool MMR hammer which automates some of
+  this process.  Check the "MMR Hammer" sections to see how.  Install it
+  here:  https://github.com/ezyang/mmr-hammer
+
+    0. Tell -c scripts not to go off and reboot servers until you're
+       done (or to get any rebooting done with first).
+
+    1. Pull open the replication part of the database. It's fairly empty
+       right now.
+
+        ldapvi -b cn=\"dc=scripts,dc=mit,dc=edu\",cn=mapping\ tree,cn=config
+
+    2. Configure the server $SLAVE (this server) to accept $MASTER
+       replications by adding the following LDAP entries:
+
+add cn=replica, cn="dc=scripts,dc=mit,dc=edu", cn=mapping tree, cn=config
+objectClass: top
+objectClass: nsDS5Replica
+cn: replica
+nsDS5ReplicaId: $REPLICA_ID
+nsDS5ReplicaRoot: dc=scripts,dc=mit,dc=edu
+nsDS5Flags: 1
+nsDS5ReplicaBindDN: uid=ldap/bees-knees.mit.edu,ou=People,dc=scripts,dc=mit,dc=edu
+nsDS5ReplicaBindDN: uid=ldap/busy-beaver.mit.edu,ou=People,dc=scripts,dc=mit,dc=edu
+nsDS5ReplicaBindDN: uid=ldap/cats-whiskers.mit.edu,ou=People,dc=scripts,dc=mit,dc=edu
+nsDS5ReplicaBindDN: uid=ldap/pancake-bunny.mit.edu,ou=People,dc=scripts,dc=mit,dc=edu
+nsDS5ReplicaBindDN: uid=ldap/whole-enchilada.mit.edu,ou=People,dc=scripts,dc=mit,dc=edu
+nsDS5ReplicaBindDN: uid=ldap/real-mccoy.mit.edu,ou=People,dc=scripts,dc=mit,dc=edu
+nsDS5ReplicaBindDN: uid=ldap/better-mousetrap.mit.edu,ou=People,dc=scripts,dc=mit,dc=edu
+nsDS5ReplicaBindDN: uid=ldap/old-faithful.mit.edu,ou=People,dc=scripts,dc=mit,dc=edu
+nsDS5ReplicaBindDN: uid=ldap/shining-armor.mit.edu,ou=People,dc=scripts,dc=mit,dc=edu
+nsDS5ReplicaBindDN: uid=ldap/golden-egg.mit.edu,ou=People,dc=scripts,dc=mit,dc=edu
+nsds5ReplicaPurgeDelay: 604800
+nsds5ReplicaLegacyConsumer: off
+nsDS5ReplicaType: 3
+
+        $REPLICA_ID is the scripts$N number (stella $HOSTNAME to find
+        out.)  You might wonder why we are binding to all servers;
+        weren't we going to replicate from only one server?  That is
+        correct, however, simply binding won't mean we will receive
+        updates; we have to setup the $MASTER to send data $SLAVE.
+
+    3. Although we allowed those uids to bind, that user information
+       doesn't exist on $SLAVE yet.  So you'll need to create the entry
+       for just $MASTER.
+
+       REMEMBER: You need to use FOO.mit.edu for the names!  Otherwise you will get
+       unauthorized errors.
+
+add uid=ldap/$MASTER,ou=People,dc=scripts,dc=mit,dc=edu
+uid: ldap/$MASTER
+objectClass: account
+objectClass: top
+
+    4. Though our $SLAVE will not be making changes to LDAP, we need to
+       initialize the changelog because we intend to be able to do this
+       later.
+
+add cn=changelog5,cn=config
+objectclass: top
+objectclass: extensibleObject
+cn: changelog5
+nsslapd-changelogdir: /etc/dirsrv/slapd-scripts/changelogdb
+
+    5. Ok, now go to your $MASTER server that you picked (it should have
+       been one of the hosts mentioned in nsDS5ReplicaBindDN) and tell
+       it to replicate to $SLAVE.
+
+       The last line runs the replication.  This is perhaps the most
+       risky step of the process; see below for help debugging problems.
+
+       MMR Hammer:
+        mmr-hammer -h $MASTER init agreements $SLAVE
+        mmr-hammer -h $MASTER update $SLAVE # XXX pick a better name
+
+        ldapvi -b cn=\"dc=scripts,dc=mit,dc=edu\",cn=mapping\ tree,cn=config
+
+add cn="GSSAPI Replication to $SLAVE", cn=replica, cn="dc=scripts,dc=mit,dc=edu", cn=mapping tree, cn=config
+objectClass: top
+objectClass: nsDS5ReplicationAgreement
+cn: "GSSAPI Replication to $SLAVE"
+cn: GSSAPI Replication to $SLAVE
+nsDS5ReplicaHost: $SLAVE
+nsDS5ReplicaRoot: dc=scripts,dc=mit,dc=edu
+nsDS5ReplicaPort: 389
+nsDS5ReplicaTransportInfo: LDAP
+nsDS5ReplicaBindDN: uid=ldap/$MASTER,ou=People,dc=scripts,dc=mit,dc=edu
+nsDS5ReplicaBindMethod: SASL/GSSAPI
+nsDS5ReplicaUpdateSchedule: "0000-2359 0123456"
+nsDS5ReplicaTimeout: 120
+nsDS5BeginReplicaRefresh: start
+
+    5. Check that the replication is running; the status will be stored
+    in the object we've been mucking around with.
+
+    If it fails with LDAP Error 49, check /var/log/dirsrv on $MASTER
+    for more information.  It might be because fedora-ds can't read
+    /etc/dirsrv/keytab or because you setup the account on the SLAVE
+    incorrectly.
+
+    6. Replicate in the other direction.  On $MASTER, add $SLAVE
+    as a nsDS5ReplicaBindDN in cn=replica,cn="dc=scripts,dc=mit,dc=edu",cn=mapping tree,cn=config
+    Also, add an account for $SLAVE if it doesn't exist already.
+
+add uid=ldap/$SLAVE,ou=People,dc=scripts,dc=mit,dc=edu
+uid: ldap/$SLAVE
+objectClass: account
+objectClass: top
+
+    On $SLAVE,
+
+       MMR Hammer: mmr-hammer -h $SLAVE init agreements $MASTER
+
+add cn="GSSAPI Replication to $MASTER", cn=replica, cn="dc=scripts,dc=mit,dc=edu", cn=mapping tree, cn=config
+objectClass: top
+objectClass: nsDS5ReplicationAgreement
+cn: "GSSAPI Replication to $MASTER"
+cn: GSSAPI Replication to $MASTER
+nsDS5ReplicaHost: $MASTER
+nsDS5ReplicaRoot: dc=scripts,dc=mit,dc=edu
+nsDS5ReplicaPort: 389
+nsDS5ReplicaTransportInfo: LDAP
+nsDS5ReplicaBindDN: uid=ldap/$SLAVE,ou=People,dc=scripts,dc=mit,dc=edu
+nsDS5ReplicaBindMethod: SASL/GSSAPI
+nsDS5ReplicaUpdateSchedule: "0000-2359 0123456"
+nsDS5ReplicaTimeout: 120
+
+    If you get a really scary internal server error, that might mean you
+    forgot to initialize the changelog.  Remove the replication
+    agreement (you'll need to turn off dirsrv), add the changelog, and
+    then try again.
+
+    7. Repeat step 6 to complete the graph of replications (i.e., from
+    every other server to the new server, and from the new server to
+    every other server).
+
+    Note the only difference between steps 5 and 6 is the lack of
+    nsDS5ReplicaRefresh: start. That only needs to be done once, to the
+    new server.
+
+    With MMR hammer, that's something like:
+
+        for i in $SERVER_NAMES; do mmr-hammer -h $i init agreements $SERVER_NAMES; done
+
+    8. If at this point you look at the new server's changelog with
+    cl-dump (preferably /mit/scripts/admin/cl-dump.pl, to not prompt you
+    for a password), you won't see the servers you added in step 7. So,
+    from each of those servers, make a change to some record so it gets
+    propagated to the new server, and then one from the new server so it
+    gets propagated to all the existing servers' changelogs. This is
+    also good for making sure the replication agreements actually work.
+
+    With MMR hammer, that's something like:
+
+        for i in $SERVER_NAMES; do mmr-hammer -h $i test; sleep 20; done
+
+Troubleshooting
+===============
+
+LDAP multimaster replication can fail in a number of colorful ways;
+combine that with GSSAPI authentication and it goes exponential.
+
+If authentication is failing with LDAP error 49, check if:
+
+    * /etc/dirsrv/keytab
+    * fedora-ds is able to read /etc/dirsrv/keytab
+    * /etc/hosts has not been modified by Network Manager (you
+      /did/ uninstall it, right? Right?)
+
+If the failure is local to a single master, usually you can recover
+by asking another master to refresh that master with:
+
+nsDS5BeginReplicaRefresh: start
+
+In practice, we've also had problems with this technique.  Some of them
+include:
+
+* Something like https://bugzilla.redhat.com/show_bug.cgi?id=547503
+  on Fedora 11 ns-slapd, where replication is turned off to do the
+  replication, but then it wedges and you need to forcibly kill the
+  process.
+
+* Failed LDAP authentication because another master attempted to do
+  an incremental update.
+
+* Repropagation of the error because the corrupt master thinks it still
+  should push updates.
+
+So the extremely safe method to bring up a crashed master is as follows:
+
+1. Disable all incoming and outgoing replication agreements by editing
+   /etc/dirsrv/slapd-scripts/dse.ldif. You'll need to munge:
+
+   nsDS5ReplicaBindDN in cn=replica,cn=dc\3Dscripts\2Cdc\3Dmit\2Cdc\3Dedu,cn=mapping tree,cn=config
+
+   and all of the push agreements.  Deleting them outright works, but
+   means you'll have to reconstruct all of the agreements from scratch.
+
+2. Bring up the server.
+
+3. Accept incoming replication data from a single server.
+
+4. Initiate a full update from that server.
+
+5. Finish setting up replication as described above.
+
+If your database gets extremely fucked, other servers may not be able
+to authenticate because your authentication information has gone missing.
+In that case, the minimal set of entries you need is:
+
+add dc=scripts,dc=mit,dc=edu
+objectClass: top
+objectClass: domain
+dc: scripts
+
+add ou=People,dc=scripts,dc=mit,dc=edu
+objectClass: top
+objectClass: organizationalunit
+ou: People
+
+add uid=ldap/whole-enchilada.mit.edu,ou=People,dc=scripts,dc=mit,dc=edu
+objectClass: account
+objectClass: top
+uid: ldap/whole-enchilada.mit.edu
Index: tags/fc15-eol/server/doc/install-xvm
===================================================================
--- tags/fc15-eol/server/doc/install-xvm	(revision 2244)
+++ tags/fc15-eol/server/doc/install-xvm	(revision 2244)
@@ -0,0 +1,48 @@
+Installing a test scripts server on XVM
+=======================================
+
+It's useful to have a less secure scripts server for testing
+purposes.  Here's what you have to do:
+
+1. Creating the VM
+------------------
+
+To authenticate to xvm.mit.edu with root tickets, you need
+a browser that suppors SPNEGO;  Firefox is one such browser and
+the following instructions will assume it.  Browse to about:config
+and modify the key 'network.negotiate-auth.trusted-uris' to be
+
+    https://xvm.mit.edu:442/*
+
+Then, with active root tickets on your system, navigate to
+
+    https://xvm.mit.edu:442/
+
+You should be logged in as root, and if you are on scripts-root
+you should be able to assign ownership to scripts.
+
+[XXX: there should be a way to do this with remctl too]
+
+2. Spin up
+----------
+
+These instructions are mostly the same as the latter part of
+install-fedora, with the following changes:
+
+VNC
+---
+
+You will not need to sketchily forward VNC, because XVM has a built
+in VNC console.
+
+Password
+--------
+
+Do NOT use the scripts-root password.  Pick something else.
+
+Disks
+-----
+
+The standard Scripts setup has separate LVM partitions for root and
+swap, as well as a non-LVM partition for boot.  You will not have this
+for XVM, so the Fedora defaults mostly work.  Don't use ext4 though.
Index: tags/fc15-eol/server/doc/kernel-build-howto
===================================================================
--- tags/fc15-eol/server/doc/kernel-build-howto	(revision 2244)
+++ tags/fc15-eol/server/doc/kernel-build-howto	(revision 2244)
@@ -0,0 +1,34 @@
+<Build kernel>
+
+[root@old-faithful ~]# su - scripts-build
+[scripts-build@old-faithful ~]$ wget -N http://download.fedora.redhat.com/pub/fedora/linux/updates/testing/7/SRPMS/kernel-2.6.23.1-28.fc7.src.rpm
+[scripts-build@old-faithful ~]$ rpm -i kernel-2.6.23.1-28.fc7.src.rpm
+[scripts-build@old-faithful ~]$ cd rpmbuild/SOURCES
+[scripts-build@old-faithful SOURCES]$ wget -N http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.23.tar.bz2
+[scripts-build@old-faithful SOURCES]$ wget -N http://kernel.org/pub/linux/kernel/v2.6/patch-2.6.23.8.bz2
+[scripts-build@old-faithful SOURCES]$ rename 2.6.23.1 2.6.23.8 kernel-2.6.23.1-*.config
+[scripts-build@old-faithful SOURCES]$ cd ../SPECS
+[scripts-build@old-faithful SPECS]$ emacs kernel-2.6.spec
+ change:
+ %define build_id .scripts1
+ %define base_sublevel 23
+ %define stable_update 8
+[scripts-build@old-faithful SPECS]$ rpmbuild --with baseonly --with vanilla -bb kernel-2.6.spec
+[scripts-build@old-faithful ~]$ logout
+[root@old-faithful ~]# cp -a /home/scripts-build/rpmbuild/RPMS/x86_64/kernel-vanilla*-2.6.23.8-28.scripts1.fc7.x86_64.rpm .
+[root@old-faithful ~]# rpm -ivh kernel-vanilla{,-devel}-2.6.23.8-28.scripts1.fc7.x86_64.rpm
+
+You can build kernel-firmware, which is a bunch of binary blobs for
+hardware, by running the mock build with --arch=noarch.
+
+<Build kmod-openafs>
+
+[root@old-faithful ~]# su scripts-build -
+[scripts-build@old-faithful ~]$ cd repository
+[scripts-build@old-faithful repository]$ svn up
+[scripts-build@old-faithful repository]$ cd server/fedora
+[scripts-build@old-faithful fedora]$ make openafs-kernel kernvers=2.6.23.8-28.scripts1.fc7
+[scripts-build@old-faithful fedora]$ logout
+[root@old-faithful ~]# cp -a /home/scripts-build/rpmbuild/RPMS/x86_64/kmod-openafs-1.4.5-1.2.6.23.8_28.scripts1.fc7.x86_64.rpm .
+[root@old-faithful ~]# rpm -ivh kmod-openafs-1.4.5-1.2.6.23.8_28.scripts1.fc7.x86_64.rpm
+
Index: tags/fc15-eol/server/doc/ldap-kerberos-replication.txt
===================================================================
--- tags/fc15-eol/server/doc/ldap-kerberos-replication.txt	(revision 2244)
+++ tags/fc15-eol/server/doc/ldap-kerberos-replication.txt	(revision 2244)
@@ -0,0 +1,93 @@
+How to migrate from SSL authentication to GSSAPI authentication
+===============================================================
+
+    :author: Edward Z. Yang <ezyang>
+    :author: Geoffrey Thomas <geofft>
+
+NOTE: This document is strictly for HISTORICAL purposes.  It may
+come in handy if you ever need to migrate from SSL to GSSAPI on
+another LDAP setup, though!  This assumes that ldap service keytabs
+are setup properly on all hosts involved.
+
+----
+
+On $CONSUMER (e.g. real-mccoy.mit.edu)
+
+To cn=replica,cn="dc=scripts,dc=mit,dc=edu",cn=mapping tree,cn=config:
+Add nsDS5ReplicaBindDN: uid=ldap/$PRODUCER,ou=People,dc=scripts,dc=mit,dc=edu
+    This tells the CONSUMER to accept replication pushes from PRODUCER.
+    However, PRODUCER is not configured yet, so you should keep
+    the cn=repman,cn=config entry which is old style.
+
+Create uid=ldap/$PRODUCER,ou=People,dc=scripts,dc=mit,dc=edu
+uid: ldap/$PRODUCER
+objectClass: account
+objectClass: top
+    This creates the LDAP user entry for GSSAPI authentication via the
+    service keytab of LDAP replication.  This information /is/
+    replicated, so if you felt like it you could create entries for all
+    PRODUCERS (which, in full multimaster replication, is all servers.)
+
+----
+
+On $PRODUCER (e.g. cats-whiskers.mit.edu)
+    You will destroy and recreate a replication agreement (well,
+    actually, ldapvi will attempt to create and then destroy the old
+    agreement).
+
+To cn="SSL Replication to $CONSUMER",cn=replica,cn="dc=scripts,dc=mit,dc=edu",cn=mapping tree,cn=config
+Replace all instances of "SSL Replication" to "GSSAPI Replication"
+Replace the number on the entry with 'add'; to indicate destroy/recreate
+Replace nsDS5ReplicaBindDN: uid=ldap/cats-whiskers.mit.edu,ou=People,dc=scripts,dc=mit,dc=edu
+    (instead of cn=repman,cn=config)
+Replace nsDS5ReplicaTransportInfo: LDAP
+    (instead of SSL)
+Replace nsDS5ReplicaPort: 389
+    (instead of 636)
+Replace nsDS5ReplicaBindMethod: SASL/GSSAPI
+    (instead of simple)
+Remove nsDS5ReplicaCredentials
+
+Here are some search-replace lines that will probably do what you want,
+but be sure to double check how many substitutions were made. '<,'> lines
+should exclude the cn=replica section.
+
+    # n = NUMBER OF SERVERS - 1 = 4
+    # n*3 substitutions
+    :%s/SSL Replication/GSSAPI Replication/g
+    # n substitutions
+    :'<,'>s/cn=repman,cn=config/uid=ldap\/$HOST,ou=People,dc=scripts,dc=mit,dc=edu/g
+    :%s/simple/SASL\/GSSAPI/
+    :%s/nsDS5ReplicaPort: 636/nsDS5ReplicaPort: 389/
+    :%s/SSL/LDAP/g
+    :%s/^nsDS5ReplicaCredentials.\+\n//g
+    :'<,'>s/^nsds5replicareapactive: 0\n//g
+    :%s/^[1-9] /add /g   # fix if more than 9 servers
+
+There is some cleanup that needs to happen after these values change;
+I had luck forcibly rebooting the servers and making LDAP cleanup
+after an unclean shutdown.  You can tell if this cleanup is necessary
+if LDAP refuses to start replication sessions.  This issue is known to
+clear up after several reboots or by destroying and recreating all
+replicas.
+
+----
+
+Once everything is on the new replication and you verify it's working
+correctly, you should then clean out the SSL configuration (most
+notably, turn nsslapd-security off. Despite its ominous name, it only
+controls SSL authentication, not GSSAPI authentication.)  You will need
+to take the server offline to do that; edit
+/etc/dirsrv/slapd-scripts/dse.ldif
+
+When that's gone, there may be some vestigial SSL configuration left.
+Scripts specifically had the following sections that needed to be
+cleaned up:
+
+    cn=RSA,cn=encryption,cn=config
+        (whole thing)
+    cn=encryption,cn=config
+        nsSSL3: on [change to off]
+        nsSSL3Ciphers: +rsa_rc4_128_md5 [delete]
+    cn=config
+        nsslapd-sslclientauth: on [change to off]
Index: tags/fc15-eol/server/doc/migrate
===================================================================
--- tags/fc15-eol/server/doc/migrate	(revision 2244)
+++ tags/fc15-eol/server/doc/migrate	(revision 2244)
@@ -0,0 +1,37 @@
+Migrating a Scripts guest between Xen hosts
+-------------------------------------------
+
+Two main components:
+
+    1. Copying the disk image (we do this with dd/netcat/backend network)
+    2. Modifying Xen configuration
+
+First, get a copy of /etc/fstab; in particular, you care about the UUIDs
+of the swap and cache partitions.
+
+Next, shut off the relevant VM.  Make sure that you have space on the
+destination host, and that you have a volume ready to receive the data
+(check with 'lvs').  From now, we'll assume $MACHINE is the name of the
+VM you're migrating, $SRC is the source host, and $DST is the destination host.
+
+Setup dd listening on a port on the destination host.  Pick a random,
+hard to guess port number.
+
+    root@$DST:~# nc -l -p $RANDOMPORT | dd of=/dev/$DST/$MACHINE-root bs=16M
+
+Next, send the data over the *backend network*.  We have 172.21.*.* setup
+to be routed on our backend network, do NOT use the public IPs on 18.*.*.*.
+
+    root@$SRC:~# dd if=/dev/$SRC/$MACHINE-root bs=16M | nc 172.21.X.Y $RANDOMPORT
+
+where X and Y are the last two digits of the normal 18.181.X.Y IP address of $DST.
+
+Once you're done, ensure that the swap and cache partitions are ready on the
+destination (you don't, mercifully, have to dd those over)--make sure they're
+properly configured; especially make sure that they the right UUIDs (from
+the fstab you saved!)  Check 'install-fedora' if you need to be reminded
+what the incants are.
+
+Finally, edit /etc/xen/scripts and modify the host that is hosting the server.
+Spin it up on the host and make sure everything is in order, then nuke the
+old disk image (multiple copies of a Scripts server is a bad idea!)
Index: tags/fc15-eol/server/doc/package-build-howto
===================================================================
--- tags/fc15-eol/server/doc/package-build-howto	(revision 2244)
+++ tags/fc15-eol/server/doc/package-build-howto	(revision 2244)
@@ -0,0 +1,161 @@
+This document is a how-to for building new packaages for scripts.mit.edu.
+
+Prerequisites
+=============
+
+  * A trusted scripts.mit.edu server
+  * A scripts-build account on that server (but that was created when it
+    was installed, or something's wrong)
+  * A set of personal credentials for the scripts svn repo
+
+Directions
+==========
+
+  * Log into the server as root
+
+  * /bin/su scripts-build # It's a bad idea to build as root.  This is
+                          # less urgent than it used to be, because you'll
+			  # be building using mock in a chroot, but it's
+			  # still good habit.  Also, if you work in
+			  # /srv/repository as root, scripts-build won't
+			  # be able to change some of the resulting files
+
+  * cd /srv/repository
+
+  * svn up  # Important both to build with current code, and because the
+            # svn revision becomes part of the package release number,
+	    # and you can infer whether changes in the code were made
+	    # before or after a particular build by looking at the package
+	    # and svn release/revision.
+
+  * cd server/fedora
+
+  * # Look in the .dload directory.  If you want to build with a newer
+    # version of any upstream packages that are there, then
+    * rm .dload/[OLD-PACKAGES].src.rpm # It's fine to delete all SRPMs here
+    * rm download_stamp
+
+  * make [PACKAGE-YOU-WANT] # e.g. 'make httpd' builds Apache with our patches
+    # Note that openafs-devel is a build-dependency of accountadm, so if
+    # this is a new Fedora release being bootstrapped, you'll have to
+    # build openafs and install its -devel package before building accountadm
+
+  * # If the build succeeds, the mock logs, build log, binary and SRPMs
+    # will be in /var/lib/mock/fedora-[RELEASE]-{x86_64|i386}/result (note that
+    # this will be cleared out each time you start a new build, so if
+    # you're building several packages in succession, copy the results
+    # somewhere safe after each build to preserve them)
+    # Add the packages to the repository by using a trusted machine and
+    krootscp root@[BUILD-SERVER]:/var/lib/mock/fedora-[RELEASE]-{x86_64|i386}/result /mit/scripts/rpm-fc[RELEASE]
+
+  * # Rebuild the repo metadata to include the new packages.
+    cd /mit/scripts/yum-repos/rpm-fc[RELEASE]
+    # If you have a trusted machine:
+    createrepo -d .
+    # Otherwise, on a scripts server, as root:
+    mkdir /root/repodata-YYYYMMDD # Or any suitable temp directory
+    createrepo -d -o /root/repodata-YYYYMMDD .
+    # Then from your trusted machine
+    krootscp -r root@[BUILD-SERVER]:/root/repodata-YYYYMMDD /mit/scripts/rpm-fc[RELEASE]
+    # Sanity check the files, and then replace the current repodata directory
+    # with the one in repodata-YYYYMMDD.
+
+Patching packages
+=================
+
+  * To make changes to the packages that we are the upstream maintainers
+    of (that is, the packages that the Scripts Team wrote):
+    * The authoritative source lives in server/common/oursrc/[PACKAGE]
+    * The RPM spec file is server/fedora/specs/[PACAKGE].spec
+    * You directly make the relevant changes to those files, commit to
+      svn, and then rebuild the package as above to include the new changes.
+
+  * To make changes to the upstream packages that we "scriptsify":
+
+    * If we haven't previously scriptsified this package, you'll need
+      to add it to the upstream_yum line in SVN/server/fedora/Makefile,
+      and remove the download_stamp file so that it gets fetched next
+      time you run 'make [PACKAGE]'.
+
+    * The authoritative upstream source comes from the SRPM in the upstream
+      yum repo, or in odd cases like openafs, from some other URL.  When
+      you 'make [PACKAGE]' in SVN/server/fedora, if download_stamp has
+      been removed, the SRPMs are all refetched into
+      SVN/server/fedora/.dload, and then installed with 'rpm -i'.  This
+      results in the source patches, and tarballs landing in ~/rpmbuild/SOURCES
+      and the spec files landing in ~/rpmbuild/SPECS.  You can also
+      manually get individual SRPMs for a package by doing this (these
+      steps work fine as a mortal user, including the 'rpm -i'):
+      * yumdownloader --source [PACKAGE]
+        # That deposits [PACKAGE]-[VER]-[RELEASE].src.rpm in the current dir
+      * rpm -i [PACAKGE]-[VER]-[RELEASE].src.rpm
+        # That unpacks the SRPM, placing the source tarball and patches in
+	# ~/rpmbuild/SOURCES and the spec file in ~/rpmbuild/SPECS; it
+	# does *not* globally install anything, and doesn't require root
+      If you prefer to not install the file, you can simply extract it
+      into a directory by running:
+      * /mit/ghudson/scripts/rpmx [PACKAGE]-[VER]-[RELEASE].src.rpm
+
+    * If you develop a patch to the upstream source, you should save a
+      diff with your changes and add it to the repo as
+      SVN/server/common/patches/[PACKAGE]-[SHORT_DESCRIPTIVE_STRING].patch
+
+    * To cause your patch to be applied when the package is built, you
+      will need to save a copy of the original spec file for the upstream
+      package, then modify it to add a line like:
+        Patch[NUM]: [PACKAGE]-[SHORT_DESCRIPTOVE_STRING].patch
+	# This should generally go after the last existing Patch line
+	# in the file, and [NUM] should be significantly larger than
+	# the upstream Fedora patches, to avoid conflicts later.  This
+	# line tells rpmbuild where the contents of the patch live.
+      You also add a line like:
+        %patch[NUM] -p1 -b .[SHORT_DESCRIPTIVE_STRING]
+	# This should generally go after the last existing %patch line
+	# in the file, [NUM] should be the same as in the Patch line, and
+	# tells rpmbuild that this is the point at which to actually apply
+	# the patch
+
+    * The Release tag in the spec file should have ".scripts.%{scriptsversion}
+      inserted into it just before %{?dist}, or at the end of the release
+      if %{?dist} is unused.
+      # e.g.          Release: 1%{?dist}
+      # changes to    Release: 1.scripts.%{scriptsversion}%{?dist}
+      This causes the package version to include the string "scripts"
+      and our SVN revision number (which is set by the Makefile) for
+      easy identification (this version will also be greater than the
+      upstream version, so the system will prefer to update to it).
+
+    * If the scriptsified version of the package needs to be installed
+      on the servers, and a new upstream version would break scripts
+      without our changes, add a line like this:
+        Provides: scripts-[PACKAGE]
+      and correspondingly, add "scripts-[PACKAGE]" to the Requires line
+      in SVN/server/fedora/specs/scripts-base.spec (and remember to
+      build, upload, and deploy a new scripts-base package)
+
+    * Though we're not always good about it, do feel encouraged to add
+      an entry at the top of the %changelog section near the bottom of
+      the spec file explaining your modifications
+
+    * When you're finished with the updates to the upstream spec file,
+      create a diff from the upstream spec file to your new version,
+      and add it to the SVN repo as
+        SVN/server/fedora/specs/[PACKAGE].spec.patch
+      Make sure to copy it there before you try to build the package,
+      since if you don't mock will use the original specfile (and
+      overwrite any changes you made in place).
+
+Replacing the source of packages
+===============================
+
+    * Patch the specfile to have an alternate Source0 (or SourceX) URL
+      pointing to the updated source of the package.  You will then
+      need to add a spectool line to the Makefile to ensure this new
+      source gets downloaded on build:
+        spectool -g -R $(specs)/PACKAGE-NAME.spec
+
+Tips
+====
+
+    * Don't try to build a 32-bit package without building the 64-bit
+      package as well.
Index: tags/fc15-eol/server/doc/rpm
===================================================================
--- tags/fc15-eol/server/doc/rpm	(revision 2244)
+++ tags/fc15-eol/server/doc/rpm	(revision 2244)
@@ -0,0 +1,3 @@
+In order to transfer rpms from one machine to another:
+
+rpm -qa --queryformat "%{Name}.%{Arch}\n" | sort
Index: tags/fc15-eol/server/doc/rpm_snapshot
===================================================================
--- tags/fc15-eol/server/doc/rpm_snapshot	(revision 2244)
+++ tags/fc15-eol/server/doc/rpm_snapshot	(revision 2244)
@@ -0,0 +1,1353 @@
+a2ps.x86_64
+a52dec.x86_64
+accountadm.x86_64
+acl.x86_64
+acpid.x86_64
+adns.x86_64
+alsa-lib.i386
+alsa-lib.x86_64
+anacron.x86_64
+antlr.x86_64
+apr-devel.i386
+apr-devel.x86_64
+apr.i386
+apr-util-devel.i386
+apr-util-devel.x86_64
+apr-util.i386
+apr-util.x86_64
+apr.x86_64
+aspell-devel.x86_64
+aspell-en.x86_64
+aspell.i386
+aspell.x86_64
+athena-lprng.i386
+atk-devel.x86_64
+atk.i386
+atk.x86_64
+atlas.x86_64
+attr.x86_64
+at.x86_64
+audiofile.x86_64
+audit-libs-devel.i386
+audit-libs-devel.x86_64
+audit-libs.i386
+audit-libs-python.x86_64
+audit-libs.x86_64
+audit.x86_64
+authconfig.x86_64
+autoconf.noarch
+autofs.x86_64
+automake.noarch
+avahi-glib.x86_64
+avahi.x86_64
+basesystem.noarch
+bash-completion.noarch
+bash.x86_64
+bc.x86_64
+beecrypt-devel.x86_64
+beecrypt.x86_64
+bind-libs.x86_64
+bind-utils.x86_64
+bind.x86_64
+binutils.x86_64
+bison.x86_64
+bitstream-vera-fonts.noarch
+blas.x86_64
+bluez-gnome.x86_64
+bluez-hcidump.x86_64
+bluez-libs.x86_64
+boost.x86_64
+busybox.x86_64
+bwidget.noarch
+byacc.x86_64
+bzip2-devel.x86_64
+bzip2-libs.x86_64
+bzip2.x86_64
+caching-nameserver.x86_64
+cadaver.x86_64
+cairo-devel.x86_64
+cairo.i386
+cairo.x86_64
+ccid.x86_64
+checkpolicy.x86_64
+chkconfig.x86_64
+chkfontpath.x86_64
+chkrootkit.x86_64
+clearsilver.x86_64
+compat-db.x86_64
+compat-readline43.i386
+compat-readline43.x86_64
+ConsoleKit-libs.x86_64
+ConsoleKit.x86_64
+coolkey.i386
+coolkey.x86_64
+coreutils.x86_64
+cpan2rpm.noarch
+cpio.x86_64
+cpp.x86_64
+cpuspeed.x86_64
+cracklib-dicts.x86_64
+cracklib.i386
+cracklib.x86_64
+crash.x86_64
+crontabs.noarch
+cryptsetup-luks.i386
+cryptsetup-luks.x86_64
+cups-libs.i386
+cups-libs.x86_64
+cups.x86_64
+curl-devel.x86_64
+curl.i386
+curl.x86_64
+cvs.x86_64
+cyrus-sasl-devel.x86_64
+cyrus-sasl-gssapi.x86_64
+cyrus-sasl-lib.i386
+cyrus-sasl-lib.x86_64
+cyrus-sasl-md5.x86_64
+cyrus-sasl-plain.x86_64
+cyrus-sasl.x86_64
+db4-devel.x86_64
+db4.i386
+db4-java.x86_64
+db4.x86_64
+dbus-glib.x86_64
+dbus.i386
+dbus-python.x86_64
+dbus.x86_64
+desktop-file-utils.x86_64
+device-mapper-libs.i386
+device-mapper-libs.x86_64
+device-mapper-multipath.x86_64
+device-mapper.x86_64
+dhcdbd.x86_64
+dhclient.x86_64
+dhcpv6_client.x86_64
+dialog.x86_64
+diffstat.x86_64
+diffutils.x86_64
+distcache-devel.i386
+distcache-devel.x86_64
+distcache.i386
+distcache.x86_64
+Django.noarch
+dmidecode.x86_64
+dmraid.x86_64
+docbook-dtds.noarch
+docbook-style-dsssl.noarch
+docbook-style-xsl.noarch
+docbook-utils.noarch
+dos2unix.x86_64
+dosfstools.x86_64
+dump.x86_64
+e2fsprogs-devel.x86_64
+e2fsprogs-libs.i386
+e2fsprogs-libs.x86_64
+e2fsprogs.x86_64
+eclipse-ecj.x86_64
+ed.x86_64
+eject.x86_64
+elfutils-devel-static.x86_64
+elfutils-devel.x86_64
+elfutils-libelf-devel-static.x86_64
+elfutils-libelf-devel.x86_64
+elfutils-libelf.i386
+elfutils-libelf.x86_64
+elfutils-libs.x86_64
+elfutils.x86_64
+elinks.x86_64
+emacs-common.x86_64
+emacs.x86_64
+enscript.x86_64
+esound-libs.x86_64
+esound.x86_64
+ethtool.x86_64
+execsys.x86_64
+exiv2.x86_64
+exo.x86_64
+expat-devel.i386
+expat-devel.x86_64
+expat.i386
+expat.x86_64
+expect-devel.x86_64
+expect.x86_64
+faac.x86_64
+faad2.x86_64
+fakeroot.x86_64
+fbida.x86_64
+fbset.x86_64
+fedora-ds-base.x86_64
+fedora-logos.noarch
+fedora-release.noarch
+fedora-release-notes.noarch
+fedora-usermgmt-core.noarch
+fedora-usermgmt-default-fedora-setup.noarch
+fedora-usermgmt.noarch
+fedora-usermgmt-shadow-utils.noarch
+fetchmail.x86_64
+ffmpeg.x86_64
+file-libs.x86_64
+filesystem.x86_64
+file.x86_64
+findutils.x86_64
+finger.x86_64
+firstboot-tui.noarch
+flex.x86_64
+fontconfig-devel.x86_64
+fontconfig.i386
+fontconfig.x86_64
+foomatic.x86_64
+freeglut.x86_64
+freetype-devel.x86_64
+freetype.i386
+freetype.x86_64
+freshrpms-release.noarch
+ftp.x86_64
+gamin.x86_64
+gawk.x86_64
+gcc-c++.x86_64
+gcc-java.x86_64
+gcc.x86_64
+GConf2.x86_64
+gc.x86_64
+gdbm-devel.i386
+gdbm-devel.x86_64
+gdbm.i386
+gdbm.x86_64
+gdb.x86_64
+gd-devel.x86_64
+gd.i386
+gd.x86_64
+genisoimage.x86_64
+gettext-devel.x86_64
+gettext.x86_64
+ghostscript-fonts.noarch
+ghostscript.x86_64
+giflib.x86_64
+glib2-devel.x86_64
+glib2.i386
+glib2.x86_64
+glibc-common.x86_64
+glibc-devel.x86_64
+glibc-headers.x86_64
+glibc.i686
+glibc.x86_64
+glib.x86_64
+gmp-devel.x86_64
+gmp.i386
+gmp.x86_64
+gnome-keyring.x86_64
+gnome-mime-data.noarch
+gnome-mount.x86_64
+gnome-themes.noarch
+gnome-vfs2.x86_64
+gnupg.x86_64
+gnuplot.x86_64
+gnutls.i386
+gnutls.x86_64
+gpg-pubkey.(none)
+gpg-pubkey.(none)
+gpg-pubkey.(none)
+gpm.i386
+gpm.x86_64
+graphviz-devel.x86_64
+graphviz-graphs.x86_64
+graphviz-guile.x86_64
+graphviz-java.x86_64
+graphviz-ocaml.x86_64
+graphviz-perl.x86_64
+graphviz-python.x86_64
+graphviz-ruby.x86_64
+graphviz-sharp.x86_64
+graphviz-tcl.x86_64
+graphviz.x86_64
+grep.x86_64
+groff-perl.x86_64
+groff.x86_64
+grub.x86_64
+gsl.x86_64
+gsm.x86_64
+gtk2-devel.i386
+gtk2-devel.x86_64
+gtk2-engines.x86_64
+gtk2.i386
+gtk2.x86_64
+guile.x86_64
+gzip.x86_64
+hal-info.noarch
+hal-libs.i386
+hal-libs.x86_64
+hal.x86_64
+hardlink.x86_64
+hdparm.x86_64
+heartbeat.x86_64
+hesinfo.x86_64
+hesiod-devel.i386
+hesiod-devel.x86_64
+hesiod.i386
+hesiod.x86_64
+hicolor-icon-theme.noarch
+highlight.x86_64
+htmlview.noarch
+httpd-devel.i386
+httpd-devel.x86_64
+httpd-manual.x86_64
+httpdmods.x86_64
+httpd.x86_64
+hwdata.noarch
+ifd-egate.x86_64
+iftop.x86_64
+ImageMagick.x86_64
+imake.x86_64
+imlib2.x86_64
+info.x86_64
+initscripts.x86_64
+iproute.x86_64
+ipsec-tools.x86_64
+iptables-ipv6.x86_64
+iptables.x86_64
+iptraf.x86_64
+iptstate.x86_64
+iputils.x86_64
+ipvsadm.x86_64
+ipython.noarch
+irda-utils.x86_64
+irqbalance.x86_64
+isdn4k-utils.x86_64
+java-1.5.0-gcj-devel.x86_64
+java-1.5.0-gcj.x86_64
+java-1.6.0-sun-devel.x86_64
+java-1.6.0-sun-src.x86_64
+java-1.6.0-sun.x86_64
+java_cup.x86_64
+jhead.x86_64
+jpackage-utils.noarch
+jwhois.x86_64
+kakasi.x86_64
+kbd.x86_64
+kernel-devel.x86_64
+kernel-devel.x86_64
+kernel-headers.x86_64
+kernel-vanilla-devel.x86_64
+kernel-vanilla.x86_64
+kernel.x86_64
+kexec-tools.x86_64
+keyutils-libs-devel.i386
+keyutils-libs-devel.x86_64
+keyutils-libs.i386
+keyutils-libs.x86_64
+kmod-openafs.x86_64
+kmod-openafs.x86_64
+kpartx.x86_64
+krb5-devel.x86_64
+krb5-libs.i386
+krb5-libs.x86_64
+krb5-workstation.x86_64
+ksh.x86_64
+kudzu.x86_64
+lame.x86_64
+lcms.x86_64
+ldirectord.x86_64
+less.x86_64
+lftp.x86_64
+libacl.x86_64
+libaio.x86_64
+libart_lgpl.x86_64
+libattr.x86_64
+libavc1394.x86_64
+libbonoboui.x86_64
+libbonobo.x86_64
+libcap.i386
+libcap.x86_64
+libc-client2006.i386
+libc-client2006.x86_64
+libcdio.x86_64
+libcroco.x86_64
+libdaemon.x86_64
+libdhcp4client.x86_64
+libdhcp6client.x86_64
+libdhcp.x86_64
+libdrm.x86_64
+libdv.x86_64
+libevent.x86_64
+libexif.x86_64
+libfontenc.x86_64
+libFS.x86_64
+libgcc.i386
+libgcc.x86_64
+libgcj-devel.x86_64
+libgcj.i386
+libgcj-src.x86_64
+libgcj.x86_64
+libgcrypt-devel.x86_64
+libgcrypt.i386
+libgcrypt.x86_64
+libgdiplus.x86_64
+libgfortran.x86_64
+libglade2.x86_64
+libgnomecanvas.x86_64
+libgnomeui.x86_64
+libgnome.x86_64
+libgomp.x86_64
+libgpg-error-devel.x86_64
+libgpg-error.i386
+libgpg-error.x86_64
+libgsf.x86_64
+libgssapi.x86_64
+libICE.i386
+libICE.x86_64
+libicu.x86_64
+libid3tag.x86_64
+libIDL.x86_64
+libidn-devel.x86_64
+libidn.i386
+libidn.x86_64
+libjpeg-devel.i386
+libjpeg-devel.x86_64
+libjpeg.i386
+libjpeg.x86_64
+libmng.x86_64
+libmp4v2.x86_64
+libnetfilter_conntrack.x86_64
+libnfnetlink.x86_64
+libnl.x86_64
+libnotify.x86_64
+libogg-devel.x86_64
+libogg.i386
+libogg.x86_64
+libpcap.x86_64
+libpng-devel.x86_64
+libpng.i386
+libpng.x86_64
+libraw1394.x86_64
+librsvg2.x86_64
+libselinux-devel.i386
+libselinux-devel.x86_64
+libselinux.i386
+libselinux-python.x86_64
+libselinux.x86_64
+libsemanage.x86_64
+libsepol-devel.x86_64
+libsepol.i386
+libsepol.x86_64
+libsigsegv.x86_64
+libsmbios-libs.x86_64
+libSM.i386
+libSM.x86_64
+libstatgrab.x86_64
+libstdc++-devel.x86_64
+libstdc++.i386
+libstdc++.x86_64
+libsysfs.x86_64
+libtermcap-devel.x86_64
+libtermcap.i386
+libtermcap.x86_64
+libthai.i386
+libthai.x86_64
+libtheora-devel.i386
+libtheora-devel.x86_64
+libtheora.i386
+libtheora.x86_64
+libtiff.i386
+libtiff.x86_64
+libtirpc.x86_64
+libtool-ltdl.x86_64
+libtool.x86_64
+libusb.x86_64
+libuser.i386
+libuser.x86_64
+libutempter.i386
+libutempter.x86_64
+libvolume_id.x86_64
+libvorbis-devel.i386
+libvorbis-devel.x86_64
+libvorbis.i386
+libvorbis.x86_64
+libwmf.x86_64
+libwnck.x86_64
+libwvstreams.x86_64
+libX11-devel.x86_64
+libX11.i386
+libX11.x86_64
+libXau-devel.x86_64
+libXau.i386
+libXau.x86_64
+libXaw.x86_64
+libXcursor-devel.x86_64
+libXcursor.i386
+libXcursor.x86_64
+libXdmcp-devel.x86_64
+libXdmcp.i386
+libXdmcp.x86_64
+libXext-devel.x86_64
+libXext.i386
+libXext.x86_64
+libxfce4mcs.x86_64
+libxfce4util.x86_64
+libxfcegui4.x86_64
+libXfixes-devel.x86_64
+libXfixes.i386
+libXfixes.x86_64
+libXfontcache.x86_64
+libXfont.x86_64
+libXft-devel.x86_64
+libXft.i386
+libXft.x86_64
+libXi-devel.x86_64
+libXi.i386
+libXinerama-devel.x86_64
+libXinerama.i386
+libXinerama.x86_64
+libXi.x86_64
+libxkbfile.x86_64
+libxml2-devel.x86_64
+libxml2.i386
+libxml2-python.x86_64
+libxml2.x86_64
+libXmu.x86_64
+libXp.i386
+libXpm-devel.x86_64
+libXpm.i386
+libXpm.x86_64
+libXp.x86_64
+libXrandr-devel.x86_64
+libXrandr.i386
+libXrandr.x86_64
+libXrender-devel.x86_64
+libXrender.i386
+libXrender.x86_64
+libXres.x86_64
+libxslt-devel.x86_64
+libxslt.i386
+libxslt.x86_64
+libXt.i386
+libXTrap.x86_64
+libXtst.i386
+libXtst.x86_64
+libXt.x86_64
+libXxf86misc.x86_64
+libXxf86vm.x86_64
+lm_sensors-devel.x86_64
+lm_sensors.x86_64
+lockdev.x86_64
+logrotate.x86_64
+logview.x86_64
+logwatch.noarch
+lrzsz.x86_64
+lsof.x86_64
+ltrace.x86_64
+lvm2.x86_64
+lynx.x86_64
+lzo.x86_64
+m4.x86_64
+mailcap.noarch
+mailx.x86_64
+MAKEDEV.x86_64
+make.x86_64
+man-pages.noarch
+man.x86_64
+mcelog.x86_64
+mcstrans.x86_64
+mdadm.x86_64
+mesa-libGL-devel.x86_64
+mesa-libGLU.x86_64
+mesa-libGL.x86_64
+mgetty.x86_64
+microcode_ctl.x86_64
+mikmod.x86_64
+mingetty.x86_64
+minicom.x86_64
+mit-lprng.x86_64
+mit-zephyr.i386
+mkbootdisk.x86_64
+mkinitrd.x86_64
+mktemp.x86_64
+mlocate.x86_64
+mod_auth_kerb.x86_64
+mod_dav_svn.x86_64
+mod_fcgid.x86_64
+mod_perl.x86_64
+mod_python.x86_64
+mod_ssl.x86_64
+module-init-tools.x86_64
+mono-core.x86_64
+mono-data.x86_64
+mono-web.x86_64
+mono-winforms.x86_64
+mozldap-tools.x86_64
+mozldap.x86_64
+mtools.x86_64
+mtr.x86_64
+munin-node.noarch
+mutt.x86_64
+mx.x86_64
+mysqlclient10-devel.x86_64
+mysqlclient10.x86_64
+mysqlclient14-devel.x86_64
+mysqlclient14.x86_64
+mysql-devel.x86_64
+mysql-libs.i386
+mysql-libs.x86_64
+MySQL-python.x86_64
+mysql.x86_64
+nagios-plugins-disk.x86_64
+nagios-plugins-load.x86_64
+nagios-plugins-procs.x86_64
+nagios-plugins-users.x86_64
+nagios-plugins.x86_64
+nail.x86_64
+nano.x86_64
+nash.x86_64
+ncurses-devel.i386
+ncurses-devel.x86_64
+ncurses.i386
+ncurses.x86_64
+nc.x86_64
+neon-devel.x86_64
+neon.i386
+neon.x86_64
+netpbm-progs.x86_64
+netpbm.x86_64
+net-snmp-devel.x86_64
+net-snmp-libs.x86_64
+net-snmp-utils.x86_64
+net-snmp.x86_64
+net-tools.x86_64
+NetworkManager.x86_64
+newt.x86_64
+nfs-utils-lib.x86_64
+nfs-utils.x86_64
+nmap.x86_64
+notification-daemon.x86_64
+nrpe.x86_64
+nscd.x86_64
+nspr.i386
+nspr.x86_64
+nss_db.x86_64
+nss.i386
+nss_ldap.i386
+nss_ldap.x86_64
+nss-tools.x86_64
+nss.x86_64
+ntp.x86_64
+ntsysv.x86_64
+numactl.x86_64
+numpy.x86_64
+ocaml.x86_64
+openafs-client.x86_64
+openafs-devel.x86_64
+openafs-krb5.x86_64
+openafs.x86_64
+openjade.x86_64
+openldap-clients.x86_64
+openldap-devel.x86_64
+openldap.i386
+openldap.x86_64
+opensp.x86_64
+openssh-clients.x86_64
+openssh-server.x86_64
+openssh.x86_64
+openssl097a.x86_64
+openssl-devel.i386
+openssl-devel.x86_64
+openssl.i686
+openssl.x86_64
+ORBit2.x86_64
+pam_ccreds.i386
+pam_ccreds.x86_64
+pam-devel.i386
+pam-devel.x86_64
+pam.i386
+pam_krb5.i386
+pam_krb5.x86_64
+pam_passwdqc.i386
+pam_passwdqc.x86_64
+pam_pkcs11.i386
+pam_pkcs11.x86_64
+pam_smb.i386
+pam_smb.x86_64
+pam.x86_64
+pango-devel.x86_64
+pango.i386
+pango.x86_64
+paps-libs.x86_64
+paps.x86_64
+parted.i386
+parted.x86_64
+passivetex.noarch
+passwd.i386
+passwd.x86_64
+patch.i386
+patchutils.x86_64
+patch.x86_64
+pax.i386
+pax.x86_64
+pciutils.x86_64
+pcmciautils.x86_64
+pcre-devel.i386
+pcre-devel.x86_64
+pcre.i386
+pcre.x86_64
+pcsc-lite-libs.x86_64
+pcsc-lite.x86_64
+pdfjam.noarch
+perl-Algorithm-Dependency.noarch
+perl-Algorithm-Diff.noarch
+perl-Apache-LogRegex.noarch
+perl-Apache-Session.noarch
+perl-Apache-Session-Wrapper.noarch
+perl-AppConfig.noarch
+perl-Archive-Tar.noarch
+perl-Archive-Zip.noarch
+perl-Array-Compare.noarch
+perl-Authen-SASL.noarch
+perl-BerkeleyDB.x86_64
+perl-Bit-Vector.x86_64
+perl-BSD-Resource.x86_64
+perl-Business-Hours.noarch
+perl-Cache-Cache.noarch
+perl-Cache-Simple-TimedExpiry.noarch
+perl-capitalization.noarch
+perl-Carp-Assert-More.noarch
+perl-Carp-Assert.noarch
+perl-Carp-Clan.noarch
+perl-CGI-FastTemplate.noarch
+perl-CGI-FormBuilder.noarch
+perl-CGI-Simple.noarch
+perl-CGI-Untaint-date.noarch
+perl-CGI-Untaint.noarch
+perl-Class-Accessor-Chained.noarch
+perl-Class-Accessor.noarch
+perl-Class-Autouse.noarch
+perl-Class-Container.noarch
+perl-Class-Data-Inheritable.noarch
+perl-Class-DBI-AbstractSearch.noarch
+perl-Class-DBI-AsForm.noarch
+perl-Class-DBI-FromCGI.noarch
+perl-Class-DBI-Loader.noarch
+perl-Class-DBI-Loader-Relationship.noarch
+perl-Class-DBI-mysql.noarch
+perl-Class-DBI.noarch
+perl-Class-DBI-Pager.noarch
+perl-Class-DBI-Pg.noarch
+perl-Class-DBI-Plugin.noarch
+perl-Class-DBI-Plugin-RetrieveAll.noarch
+perl-Class-DBI-Plugin-Type.noarch
+perl-Class-DBI-SQLite.noarch
+perl-Class-ErrorHandler.noarch
+perl-Class-Inspector.noarch
+perl-Class-MethodMaker.x86_64
+perl-Class-ReturnValue.noarch
+perl-Class-Singleton.noarch
+perl-Class-Trigger.noarch
+perl-Class-Whitehole.noarch
+perl-clearsilver.x86_64
+perl-Clone.x86_64
+perl-Compress-Bzip2.x86_64
+perl-Compress-Zlib.x86_64
+perl-Config-General.noarch
+perl-Config-IniFiles.noarch
+perl-Config-Record.noarch
+perl-Config-Tiny.noarch
+perl-Convert-ASN1.noarch
+perl-Convert-BinHex.noarch
+perl-Convert-TNEF.noarch
+perl-Convert-UUlib.x86_64
+perl-CPAN.x86_64
+perl-Crypt-Blowfish.x86_64
+perl-Crypt-CBC.noarch
+perl-Crypt-DES.x86_64
+perl-Crypt-DH.noarch
+perl-Crypt-SSLeay.x86_64
+perl-Data-Buffer.noarch
+perl-Data-Page.noarch
+perl-Date-Calc.x86_64
+perl-DateManip.noarch
+perl-Date-Simple.x86_64
+perl-DateTime-Format-Mail.noarch
+perl-DateTime-Format-W3CDTF.noarch
+perl-DateTime.x86_64
+perl-DBD-MySQL.x86_64
+perl-DBD-Pg.x86_64
+perl-DBD-SQLite2.x86_64
+perl-DBD-SQLite.x86_64
+perl-DBI.x86_64
+perl-DBIx-ContextualFetch.noarch
+perl-DBIx-DBSchema.noarch
+perl-DBIx-SearchBuilder.noarch
+perl-Devel-Cycle.noarch
+perl-Devel-StackTrace.noarch
+perl-Devel-Symdump.noarch
+perl-devel.x86_64
+perl-Digest-BubbleBabble.noarch
+perl-Digest-HMAC.noarch
+perl-Digest-MD2.x86_64
+perl-Digest-MD4.x86_64
+perl-Digest-Nilsimsa.x86_64
+perl-Digest-SHA1.x86_64
+perl-Error.noarch
+perl-Exception-Class.noarch
+perl-Exporter-Lite.noarch
+perl-ExtUtils-AutoInstall.noarch
+perl-ExtUtils-CBuilder.noarch
+perl-ExtUtils-Depends.noarch
+perl-ExtUtils-Embed.x86_64
+perl-ExtUtils-MakeMaker.x86_64
+perl-ExtUtils-ParseXS.noarch
+perl-ExtUtils-PkgConfig.noarch
+perl-ExtUtils-XSBuilder.noarch
+perl-File-BOM.noarch
+perl-File-chmod.noarch
+perl-File-Find-Rule.noarch
+perl-File-Flat.noarch
+perl-FileHandle-Unget.noarch
+perl-File-HomeDir.noarch
+perl-File-MMagic.noarch
+perl-File-NCopy.noarch
+perl-File-Remove.noarch
+perl-File-Slurp.noarch
+perl-File-Tail.noarch
+perl-Font-AFM.noarch
+perl-FreezeThaw.noarch
+perl-Frontier-RPC.noarch
+perl-gettext.x86_64
+perl-Glib.x86_64
+perl-GnuPG-Interface.noarch
+perl-GSSAPI.x86_64
+perl-Hook-LexWrap.noarch
+perl-HTML-Format.noarch
+perl-HTML-Mason.noarch
+perl-HTML-Parser.x86_64
+perl-HTML-Scrubber.noarch
+perl-HTML-Tagset.noarch
+perl-HTML-Template-Expr.noarch
+perl-HTML-Template.noarch
+perl-HTML-Tree.noarch
+perl-HTTP-Server-Simple-Mason.noarch
+perl-HTTP-Server-Simple.noarch
+perl-Ima-DBI.noarch
+perl-Image-Base.noarch
+perl-Image-Xbm.noarch
+perl-Image-Xpm.noarch
+perl-Inline.noarch
+perl-IO-CaptureOutput.noarch
+perl-IO-Multiplex.noarch
+perl-IO-Socket-INET6.noarch
+perl-IO-Socket-SSL.noarch
+perl-IO-String.noarch
+perl-IO-stringy.noarch
+perl-IO-Tty.x86_64
+perl-IO-Zlib.noarch
+perl-IPC-Run.noarch
+perl-IPC-Shareable.noarch
+perl-IPC-SharedCache.noarch
+perl-IPC-ShareLite.x86_64
+perl-Jcode.noarch
+perl-LDAP.noarch
+perl-libintl.x86_64
+perl-libs.i386
+perl-libs.x86_64
+perl-libwww-perl.noarch
+perl-libxml-perl.noarch
+perl-Lingua-EN-Inflect.noarch
+perl-Lingua-EN-Inflect-Number.noarch
+perl-Locale-Maketext-Fuzzy.noarch
+perl-Locale-Maketext-Lexicon.noarch
+perl-Log-Dispatch.noarch
+perl-Mail-Alias.noarch
+perl-Mail-GnuPG.noarch
+perl-Mail-Mbox-MessageParser.noarch
+perl-Mail-Sender.noarch
+perl-Mail-Sendmail.noarch
+perl-Mail-SPF-Query.noarch
+perl-MailTools.noarch
+perl-MIME-Lite.noarch
+perl-MIME-tools.noarch
+perl-MIME-Types.noarch
+perl-MLDBM.noarch
+perl-Module-Build.noarch
+perl-Module-CoreList.noarch
+perl-Module-Install.noarch
+perl-Module-Refresh.noarch
+perl-Module-ScanDeps.noarch
+perl-Module-Signature.noarch
+perl-Module-Versions-Report.noarch
+perl-Mozilla-LDAP.x86_64
+perl-Net-CIDR-Lite.noarch
+perl-Net-DNS.x86_64
+perl-Net-IP-CMatch.x86_64
+perl-Net-IP.noarch
+perl-Net-Netmask.noarch
+perl-Net-Patricia.x86_64
+perl-Net-SCP.noarch
+perl-Net-Server.noarch
+perl-Net-SNMP.noarch
+perl-Net-SSH.noarch
+perl-Net-SSLeay.x86_64
+perl-Net-Telnet.noarch
+perl-NKF.x86_64
+perl-Number-Compare.noarch
+perl-OLE-Storage_Lite.noarch
+perl-PadWalker.x86_64
+perl-Params-Util.noarch
+perl-Params-Validate.x86_64
+perl-PAR-Dist.noarch
+perl-Parse-RecDescent.noarch
+perl-Parse-Yapp.noarch
+perl-PatchReader.noarch
+perl-PDL.x86_64
+perl-pmtools.noarch
+perl-Pod-Coverage.noarch
+perl-Pod-Escapes.noarch
+perl-Pod-POM.noarch
+perl-Pod-Readme.noarch
+perl-Pod-Simple.noarch
+perl-Pod-Tests.noarch
+perl-prefork.noarch
+perl-Razor-Agent.x86_64
+perl-Readonly.noarch
+perl-Readonly-XS.x86_64
+perl-Regexp-Common.noarch
+perl-RPM-Specfile.noarch
+perl-Set-IntSpan.noarch
+perl-SGMLSpm.noarch
+perl-SNMP_Session.noarch
+perl-SOAP-Lite.noarch
+perl-Socket6.x86_64
+perl-Sort-Versions.noarch
+perl-Spiffy.noarch
+perl-Spreadsheet-WriteExcel.noarch
+perl-SQL-Abstract-Limit.noarch
+perl-SQL-Abstract.noarch
+perl-SQL-Statement.noarch
+perl-String-CRC32.x86_64
+perl-String-Ediff.x86_64
+perl-String-ShellQuote.noarch
+perl-Sub-Uplevel.noarch
+perl-suidperl.x86_64
+perl-Template-Toolkit.x86_64
+perl-TermReadKey.x86_64
+perl-Test-Base.noarch
+perl-Test-ClassAPI.noarch
+perl-Test-Exception.noarch
+perl-Test-Harness.x86_64
+perl-Test-Inline.noarch
+perl-Test-LongString.noarch
+perl-Test-Manifest.noarch
+perl-Test-Memory-Cycle.noarch
+perl-Test-MockModule.noarch
+perl-Test-MockObject.noarch
+perl-Test-Pod-Coverage.noarch
+perl-Test-Pod.noarch
+perl-Test-Portability-Files.noarch
+perl-Test-Simple.x86_64
+perl-Test-Taint.x86_64
+perl-Test-Warn.noarch
+perl-Test-WWW-Mechanize.noarch
+perl-TeX-Hyphen.noarch
+perl-Text-Autoformat.noarch
+perl-Text-CSV_XS.x86_64
+perl-Text-Diff.noarch
+perl-Text-Glob.noarch
+perl-Text-Iconv.x86_64
+perl-Text-Kakasi.x86_64
+perl-Text-Quoted.noarch
+perl-Text-Reform.noarch
+perl-Text-Template.noarch
+perl-Text-WikiFormat.noarch
+perl-Text-Wrapper.noarch
+perl-Tie-DBI.noarch
+perl-Tie-IxHash.noarch
+perl-TimeDate.noarch
+perl-Time-modules.noarch
+perl-Time-Piece-MySQL.noarch
+perl-Time-Piece.x86_64
+perl-Tree-DAG_Node.noarch
+perl-Tree-Simple.noarch
+perl-udunits.x86_64
+perl-Unicode-Map8.x86_64
+perl-Unicode-MapUTF8.noarch
+perl-Unicode-Map.x86_64
+perl-Unicode-String.x86_64
+perl-UNIVERSAL-can.noarch
+perl-UNIVERSAL-exports.noarch
+perl-UNIVERSAL-isa.noarch
+perl-UNIVERSAL-moniker.noarch
+perl-UNIVERSAL-require.noarch
+perl-Unix-Statgrab.x86_64
+perl-Unix-Syslog.x86_64
+perl-URI.noarch
+perl-version.x86_64
+perl-Want.x86_64
+perl-WWW-Mechanize.noarch
+perl-X11-Protocol.noarch
+perl.x86_64
+perl-XML-DOM.noarch
+perl-XML-Dumper.noarch
+perl-XML-Grove.noarch
+perl-XML-LibXML-Common.x86_64
+perl-XML-LibXML.x86_64
+perl-XML-LibXSLT.x86_64
+perl-XML-NamespaceSupport.noarch
+perl-XML-Parser.x86_64
+perl-XML-RegExp.noarch
+perl-XML-RSS.noarch
+perl-XML-SAX.noarch
+perl-XML-SAX.noarch
+perl-XML-Simple.noarch
+perl-XML-Twig.noarch
+perl-XML-XPath.noarch
+perl-YAML.noarch
+php-adodb.noarch
+php-bcmath.x86_64
+php-cli.x86_64
+php-common.x86_64
+php-dba.x86_64
+php-devel.x86_64
+php-gd.x86_64
+php-imap.x86_64
+php-ldap.x86_64
+php-mbstring.x86_64
+php-mysql.x86_64
+php-ncurses.x86_64
+php-odbc.x86_64
+php-pdo.x86_64
+php-pear-Auth-SASL.noarch
+php-pear-Image-GraphViz.noarch
+php-pear-Net-SMTP.noarch
+php-pear-Net-Socket.noarch
+php-pear.noarch
+php-pecl-Fileinfo.x86_64
+php-pecl-mailparse.x86_64
+php-pgsql.x86_64
+php-Smarty.noarch
+php-snmp.x86_64
+php-soap.x86_64
+php.x86_64
+php-xmlrpc.x86_64
+php-xml.x86_64
+pils.x86_64
+pinfo.x86_64
+pkgconfig.x86_64
+plt-scheme.x86_64
+pm-utils.x86_64
+pnm2ppa.x86_64
+policycoreutils-newrole.x86_64
+policycoreutils.x86_64
+poppler-utils.x86_64
+poppler.x86_64
+popt.i386
+popt.x86_64
+postfix.x86_64
+postgresql-devel.x86_64
+postgresql-libs.i386
+postgresql-libs.x86_64
+postgresql-python.x86_64
+postgresql.x86_64
+ppp.x86_64
+prelink.x86_64
+procmail.x86_64
+procps.x86_64
+proj.x86_64
+psacct.x86_64
+psmisc.x86_64
+psutils.x86_64
+pycairo.x86_64
+pygobject2.x86_64
+pygtk2.x86_64
+pyOpenSSL.x86_64
+python-4Suite-XML.x86_64
+python-adns.x86_64
+python-amara.noarch
+python-basemap-data.noarch
+python-basemap.x86_64
+python-bibtex.x86_64
+python-cheetah.x86_64
+python-cherrypy.noarch
+python-cherrytemplate.noarch
+python-clearsilver.x86_64
+python-clientform.noarch
+python-configobj.noarch
+python-crypto.x86_64
+python-dateutil.noarch
+python-decoratortools.noarch
+python-devel.i386
+python-devel.x86_64
+python-dialog.noarch
+python-dns.noarch
+python-docs.noarch
+python-durus.x86_64
+python-exo.x86_64
+python-feedparser.noarch
+python-formencode.noarch
+python-fpconst.noarch
+python-goopy.noarch
+python-HTMLgen.noarch
+python-imaging.x86_64
+python-inotify.x86_64
+python-irclib.noarch
+python-json.noarch
+python-kid.noarch
+python-krbV.x86_64
+python-lcms.x86_64
+python-ldap.x86_64
+python-libs.i386
+python-libs.x86_64
+python-logilab-astng.noarch
+python-logilab-common.noarch
+python-lxml.x86_64
+python-matplotlib.x86_64
+python-mechanize.noarch
+python-myghty.noarch
+python-nose.noarch
+python-numarray.x86_64
+python-numeric.x86_64
+python-paste-deploy.noarch
+python-paste.noarch
+python-paste-script.noarch
+python-pgsql.x86_64
+python-protocols.x86_64
+python-psycopg2.x86_64
+python-psycopg.x86_64
+python-pycurl.x86_64
+python-pydns.noarch
+python-pyspf.noarch
+python-quixote.x86_64
+python-ruledispatch.x86_64
+python-setuptools.noarch
+python-simplejson.x86_64
+python-simpy-doc.noarch
+python-sqlalchemy.noarch
+python-sqlite2.x86_64
+python-sqlobject.noarch
+python-tag.x86_64
+python-TestGears.noarch
+python-tgfastdata.noarch
+python-turbocheetah.noarch
+python-turbojson.noarch
+python-turbokid.noarch
+python-twisted-conch.x86_64
+python-twisted-core-doc.x86_64
+python-twisted-core.x86_64
+python-twisted-lore.x86_64
+python-twisted-mail.x86_64
+python-twisted-names.x86_64
+python-twisted-news.x86_64
+python-twisted.noarch
+python-twisted-runner.x86_64
+python-twisted-web.x86_64
+python-twisted-words.x86_64
+python-urlgrabber.noarch
+python-urljr.noarch
+python.x86_64
+python-xmpp.noarch
+python-yadis.noarch
+python-zope-interface.x86_64
+pytz.noarch
+pyxf86config.x86_64
+PyXML.x86_64
+quota.x86_64
+radeontool.x86_64
+raptor-devel.i386
+raptor-devel.x86_64
+raptor.i386
+raptor.x86_64
+rasqal-devel.x86_64
+rasqal.i386
+rasqal.x86_64
+rcs.x86_64
+rdate.x86_64
+rdist.x86_64
+readahead.x86_64
+readline-devel.i386
+readline-devel.x86_64
+readline.i386
+readline.x86_64
+recode.x86_64
+redhat-artwork.x86_64
+redhat-lsb.x86_64
+redhat-menus.noarch
+redhat-rpm-config.noarch
+redland-devel.i386
+redland-devel.x86_64
+redland.i386
+redland.x86_64
+rhpl.x86_64
+rmt.x86_64
+rng-utils.x86_64
+rootfiles.noarch
+rpcbind.x86_64
+rpm-build.x86_64
+rpm-devel.x86_64
+rpmdevtools.noarch
+rpm-libs.x86_64
+rpm-python.x86_64
+rpm.x86_64
+rp-pppoe.x86_64
+rrdtool-php.x86_64
+rrdtool-python.x86_64
+rrdtool.x86_64
+rsh.x86_64
+rsync.x86_64
+ruby-devel.x86_64
+ruby-docs.x86_64
+rubygems.noarch
+ruby-irb.x86_64
+ruby-libs.x86_64
+ruby-mode.x86_64
+ruby-mysql.x86_64
+ruby-rdoc.x86_64
+ruby-sqlite3.x86_64
+ruby.x86_64
+samba-common.x86_64
+samba.x86_64
+screen.x86_64
+SDL.x86_64
+sed.x86_64
+selinux-doc.noarch
+selinux-policy-devel.noarch
+selinux-policy.noarch
+selinux-policy-strict.noarch
+selinux-policy-targeted.noarch
+setarch.x86_64
+setools-console.x86_64
+setools-gui.x86_64
+setools-libs.x86_64
+setools.x86_64
+setserial.x86_64
+setup.noarch
+setuptool.x86_64
+sgml-common.noarch
+shadow-utils.x86_64
+shapelib.x86_64
+shared-mime-info.x86_64
+sinjdoc.x86_64
+slang.x86_64
+slrn.x86_64
+smartmontools.x86_64
+SOAPpy.noarch
+socat.x86_64
+spamassassin.x86_64
+specspo.noarch
+sqlite2-devel.x86_64
+sqlite2.x86_64
+sqlite-devel.x86_64
+sqlite.i386
+sqlite.x86_64
+sql-signup.x86_64
+startup-notification.x86_64
+statserial.x86_64
+stonith.x86_64
+strace.x86_64
+stunnel.x86_64
+subversion.i386
+subversion.x86_64
+sudo.x86_64
+svrcore.x86_64
+swig.x86_64
+symlinks.x86_64
+sysklogd.x86_64
+syslinux.x86_64
+sysreport.noarch
+sysstat.x86_64
+system-config-network-tui.noarch
+system-config-securitylevel-tui.x86_64
+sysvinit.x86_64
+taglib.x86_64
+talk.x86_64
+tar.x86_64
+tcl-devel.i386
+tcl-devel.x86_64
+tcl.i386
+tcl.x86_64
+tcpdump.x86_64
+tcp_wrappers-devel.i386
+tcp_wrappers-devel.x86_64
+tcp_wrappers-libs.i386
+tcp_wrappers-libs.x86_64
+tcp_wrappers.x86_64
+tcsh.x86_64
+telnet.x86_64
+termcap.noarch
+tetex-dvips.x86_64
+tetex-fonts.x86_64
+tetex-latex.x86_64
+tetex-unicode.noarch
+tetex.x86_64
+texinfo-tex.x86_64
+texinfo.x86_64
+time.x86_64
+tix-devel.i386
+tix-devel.x86_64
+tix.i386
+tix.x86_64
+tk-devel.i386
+tk-devel.x86_64
+tk.i386
+tk.x86_64
+tmpwatch.x86_64
+tokensys.x86_64
+traceroute.x86_64
+trac.noarch
+tree.x86_64
+ttmkfdir.x86_64
+TurboGears.noarch
+tzdata.noarch
+udev.x86_64
+udunits.x86_64
+units.x86_64
+unix2dos.x86_64
+unixODBC-devel.x86_64
+unixODBC.x86_64
+unzip.x86_64
+urlview.x86_64
+urw-fonts.noarch
+usbutils.x86_64
+usermode.x86_64
+util-linux.x86_64
+uw-imap-devel.i386
+uw-imap-devel.x86_64
+vbetool.x86_64
+vconfig.x86_64
+vim-common.x86_64
+vim-enhanced.x86_64
+vim-minimal.x86_64
+vixie-cron.x86_64
+w3m.x86_64
+wget.x86_64
+which.x86_64
+wireless-tools.i386
+wireless-tools.x86_64
+words.noarch
+wpa_supplicant.x86_64
+wvdial.x86_64
+x264.x86_64
+Xaw3d.x86_64
+xinetd.x86_64
+xml-common.noarch
+xmltex.noarch
+xmlto.x86_64
+xorg-x11-apps.x86_64
+xorg-x11-filesystem.noarch
+xorg-x11-fonts-ISO8859-1-100dpi.noarch
+xorg-x11-fonts-ISO8859-1-75dpi.noarch
+xorg-x11-font-utils.x86_64
+xorg-x11-proto-devel.x86_64
+xorg-x11-server-utils.x86_64
+xorg-x11-xauth.x86_64
+xorg-x11-xfs.x86_64
+xvidcore.x86_64
+ypbind.x86_64
+yp-tools.x86_64
+yum-fastestmirror.noarch
+yum-fedorakmod.noarch
+yum-metadata-parser.x86_64
+yum.noarch
+yum-updatesd.noarch
+yum-utils.noarch
+zip.x86_64
+zlib-devel.i386
+zlib-devel.x86_64
+zlib.i386
+zlib.x86_64
+zziplib.x86_64
Index: tags/fc15-eol/server/doc/upgrade-tips
===================================================================
--- tags/fc15-eol/server/doc/upgrade-tips	(revision 2244)
+++ tags/fc15-eol/server/doc/upgrade-tips	(revision 2244)
@@ -0,0 +1,214 @@
+Upgrading Scripts for a new Fedora distribution
+===============================================
+
+1. Gather knowledge
+-------------------
+
+You should read the Release Notes for all of the intervening
+releases.  For example, here are the Fedora 13 release notes:
+
+    http://docs.fedoraproject.org/en-US/Fedora/13/html/Release_Notes/
+
+Because we sometimes skip releases, you should read any skipped
+release's report notes.
+
+Example:
+
+    In Fedora 12, i586 was deprecated in favor of i686; this meant
+    that any parts of Scripts that referenced i586 explicitly had to
+    changed to i686.
+
+2. Update the Scripts build environment
+---------------------------------------
+
+A large amount of the Scripts source repository is Fedora Release
+specific, so when you are ramping up the new release, you will want
+a new branch to do development on, before merging back upon the
+official release.  You can do this with:
+
+    svn cp svn://scripts.mit.edu/trunk \
+           svn://scripts.mit.edu/branches/fcXX-dev
+
+On the new branch, there are a number of files you will have to
+update:
+
+2.1 Mock
+
+Mock needs to be setup for the new environment.  The first thing to do
+is to update the Makefile by substituting
+s/scripts-fcOLD/scripts-fcNEW/g on the /usr/bin/mock invocations.
+After that, you need to go to /etc/mock and create the new cfg file
+for the new scripts-fcXX-ARCH configurations (where ARCH is x86_64 and
+i386).  You can base the new cfg off of the older version's, however
+you will want to make the following changes:
+
+    * Update all references to the old Fedora release to the new
+      Fedora release.  This includes root, dist, mirrorlist, baseurl
+
+    * Temporarily disabling the web.mit.edu Scripts RPM repository
+      and the local RPM repository by setting enabled=0 (it's there for
+      a reason!)  However, the local RPM repository is fairly painless
+      to create and will come in handy when you start attempting to
+      build packages that have dependencies on other scriptsified
+      packages: you can set one up as scripts-build with:
+
+        mkdir ~/mock-local
+        createrepo ~/mock-local
+
+3. Rebuild Scripts packages
+---------------------------
+
+In order to support specific extra functionality, we have scriptsified
+a variety of Fedora packages.  When the base packages get upgrades,
+we need to upgrade the scriptsification.  Some of the following topics
+are covered in 'package-build-howto', but a new Fedora release tends
+to also result in somewhat rarer situations.
+
+As you finish building packages, you'll want to place them somewhere
+so they don't get blown away on a successive mock build.  ~/mock-local
+is a good choice.  The Mock RPMs will be created in:
+
+    /var/lib/mock/$MOCK_ENV/result/
+
+Here are some of the common troubles you'll have to deal with:
+
+3.1 Spec patches are no longer necessary
+
+When a Fedora release gets EOL'ed, we may continue to backport
+patches for CVE's manually.  When we upgrade to a non-EOL'd release,
+those patches will generally become unnecessary and can be dropped.
+
+You can drop a modified specfile from the repository simply by
+`svn rm`ing:
+
+    * The spec patch in server/fedora/specs,
+    * The source code patch in server/common/patches, and
+    * The upstream_yum entry in server/fedora/Makefile
+
+If a specfile merely bumps the version field, there may be no extra
+patch (this indicates that the maintainer rebuilt the package simply
+by manually dropping the new source tarball in rpmbuild/SOURCES,
+which is kind of sketchy but works.  See -c 1586 for an example.)
+
+3.2 Spec patches no longer apply
+
+Symptom:
+
+    $ make patch-specs
+    patching file openssh.spec
+    Hunk #1 succeeded at 74 with fuzz 2 (offset 11 lines).
+    Hunk #2 failed at 88.
+    Hunk #3 succeeded at 177 (offset 14 lines).
+    Hunk #4 succeeded at 270 with fuzz 2 (offset 36 lines).
+    1 out of 4 hunks failed--saving rejects to openssh.spec.rej
+
+Fix:
+
+    The main thing to remember is where the generated files live
+    they are placed in rpmbuild/SPECS/openssh.spec{.rej,.orig}.
+    A workflow for fixing them might look like:
+
+        1. Inspect the rejects file.
+        2. As much as possible, manually fix the original diff
+           file in /srv/repository/server/fedora/specs
+        3. If absolutely necessary, edit the rpmbuild/SPECS/openssh.spec
+           file with any final changes (this is dangerous because
+           this file is blown away on a successive make)
+        4. Generate a new unified diff:
+             diff -u openssh.spec.orig openssh.spec > \
+                 /srv/repository/server/fedora/specs\openssh.spec.patch
+
+3.3 Mock fails with no error message
+
+Fix: You forgot to add scripts-build to the mock group.  See
+     https://bugzilla.redhat.com/show_bug.cgi?id=630791
+     [XXX: remove this entry when this bug is fixed]
+
+3.4 Source patches no longer apply
+
+Symptoms:
+
+    Generally, you will see these error messages after Mock starts
+    building (if they occur before Mock, that means it's a bug in the
+    spec patch, not a source patch that the spec patch references.)
+
+Fix:
+
+    The error message will be from within a schroot that Mock is using.
+    As a result, it's not immediately obvious where the files live.
+
+    The easiest approach is to use rpmbuild to manually reapply the
+    patches.
+
+        rpmbuild -bp path/to/foo.spec
+
+    If this fails complaining about a dependency, you should install
+    the dependency and add it to the Makefile.
+
+    Once you've fixed the patch, you can rerun rpmbuild after running
+
+        make setup
+
+    (This is useful if you can't do a full make due to another mock
+    process running.)
+
+4. "Officializing" everything
+-----------------------------
+
+web.mit.edu scripts repository (/mit/scripts/rpm-fcXX and
+/mit/scripts/rpm-fcXX-testing) needs to be made.  It's quite simple;
+all you need to do is copy the RPMs from the build server to there
+(probably going through a trusted machine, since you don't want to put
+your root tickets on a server.)  When you're done, run `createrepo -d`
+on the directory.
+
+Note that if you do a successive rebuild without bumping the Subversion
+revision (via a `svn up`), the new package will have the *same* version
+and yum will probably insist on using the old cached version.  You can
+use `yum clean all` to reset your cache and force yum to get the latest
+version.
+
+5. Update fs sysname
+--------------------
+
+Update /etc/sysconfig/openafs with an extra amd64_fedoraX_scripts and
+amd64_fedoraX sysname.  The format should be evident from the existing
+entries.  [XXX There might be other things you want]
+
+6. Testing critical infrastructure
+----------------------------------
+
+There are some important Scripts maintained applications you should test
+and ensure run on the new platform.  They include:
+
+    - http://scripts.mit.edu
+    - http://scripts.mit.edu/wiki
+    - http://scripts.mit.edu/trac
+    - http://scripts.mit.edu/whois/
+    - http://pony.scripts.mit.edu
+
+7. Extra stuff
+--------------
+
+Fedora occasionally updates the architecture name for 32-bit; the last
+such update was in Fedora 12, when i586 became i686.  Fixing this
+usually just involves replacing i586 with i686 in the appropriate places
+(Makefile, specfiles, /etc/mock configuration).  Note that for
+hysterical raisins we still refer to our 32-bit builds as i386.
+[XXX: Maybe this should change]
+
+Until we decide that the performance impact is negligible, any new PHP
+extensions other than the few we’ve whitelisted should be disabled by
+emptying their .ini files in /etc/php.d.
+
+8. Sending announcements
+------------------------
+
+Once development work has finished, we need to allow users to test
+their websites on the new servers.
+
+    SIPB Internal Testing: Send an email to scripts-team@mit.edu
+    and -c sipb notifying them of testing procedure and known
+    issues.
+
+    General Testing:
Index: tags/fc15-eol/server/fedora/Makefile
===================================================================
--- tags/fc15-eol/server/fedora/Makefile	(revision 2244)
+++ tags/fc15-eol/server/fedora/Makefile	(revision 2244)
@@ -0,0 +1,199 @@
+# Makefile for building scripts.mit.edu Fedora packages
+# Copyright (C) 2006  Jeff Arnold <jbarnold@mit.edu>
+#                and  Joe Presbrey <presbrey@mit.edu>
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA
+#
+# See /COPYRIGHT in this repository for more information.
+
+upstream_yum	= krb5 krb5.i686 httpd openssh redland-bindings rubygems
+hackage		= MonadCatchIO-mtl-0.3.0.2 cgi-3001.1.8.2 unix-handle-0.0.0
+upstream_hackage = ghc-MonadCatchIO-mtl ghc-cgi ghc-unix-handle
+upstream	= openafs $(upstream_yum) $(upstream_hackage) moira zephyr zephyr.i686 python-zephyr python-afs athena-aclocal discuss
+oursrc		= execsys tokensys accountadm httpdmods logview sql-signup nss_nonlocal nss_nonlocal.i686 whoisd athrun php_scripts scripts-wizard scripts-base scripts-static-cat fuse-better-mousetrapfs
+allsrc		= $(upstream) $(oursrc)
+oursrcdir	= ${PWD}/../common/oursrc
+patches		= ${PWD}/../common/patches
+specs		= ${PWD}/specs
+
+topdir		= ${HOME}/rpmbuild
+tmp_build	= $(topdir)/BUILD
+tmp_specs	= $(topdir)/SPECS
+tmp_src		= $(topdir)/SOURCES
+out_rpms	= $(topdir)/RPMS
+out_srpms	= $(topdir)/SRPMS
+out_sbin	= $(topdir)/sbin
+
+dload		= ${PWD}/.dload
+server_url	= "http://web.mit.edu/scripts/src"
+server_arch	= "fedora.stable"
+openafs_url	= "http://dl.openafs.org/dl/openafs/1.6.1/openafs-1.6.1-1.src.rpm"
+zephyr_url	= "http://zephyr.1ts.org/files/zephyr-3.0.2.tar.gz"
+
+PKG		= $(patsubst %.i686,%,$@)
+
+.PHONY: minimal-clean
+
+info:
+	@echo "The following packages are available:"
+	@echo "$(allsrc)"
+	@echo "Run 'make all' to build all packages."
+
+minimal-clean:
+	rm -rf $(topdir) $(dload)
+
+clean: minimal-clean
+	rm -rf $(out_rpms) $(out_srpms) $(out_sbin)
+	rm -f download_stamp
+
+mkdir-tree:
+	rpmdev-setuptree
+	mkdir -p $(out_sbin)
+	ln -sTf $(topdir) rpmbuild
+
+download: download_stamp
+download_stamp:
+	mkdir -p $(dload)
+	#wget -qO- -nv $(server_url)/$(server_arch) | xargs make
+	cd $(dload) && yumdownloader --disablerepo=scripts --source $(upstream_yum)
+	wget -P $(dload) $(openafs_url)
+	wget -P $(dload) $(zephyr_url)
+	cd $(tmp_src) && wget -nd -r -l1 -np -A.orig.tar.gz http://debathena.mit.edu/apt/pool/debathena/d/debathena-moira/
+	cabal update
+	cabal fetch --no-dependencies $(hackage)
+	cp -a $(hackage:%=~/.cabal/packages/*/*/*/%.tar.gz) $(tmp_src)
+	spectool -g -R $(specs)/python-zephyr.spec
+	spectool -g -R $(specs)/python-afs.spec
+	touch download_stamp
+
+	cd $(tmp_src) && wget -nd -r -l1 -np -A.tar.gz http://debathena.mit.edu/apt/pool/debathena/d/debathena-aclocal/
+	cd $(tmp_src) && wget -nd -r -l1 -np -A.orig.tar.gz http://debathena.mit.edu/apt/pool/debathena/d/debathena-discuss/
+	cp $(oursrcdir)/discuss/* $(tmp_src)
+%.src.rpm:
+	wget -q -nv -N -B $(server_url) -nd -nH -P $(dload) $(server_url)/$*.src.rpm
+
+copy-patches: mkdir-tree
+	cp $(patches)/*.patch $(tmp_src)
+
+install-srpms: mkdir-tree download
+	rpm $(rpm_args) -i $(dload)/*.src.rpm 2>/dev/null
+
+copy-specs: mkdir-tree
+	cp ${specs}/*.spec $(tmp_specs)
+
+# Remove old .orig files so we're not mislead
+patch-specs: install-srpms
+	@set -ex; \
+	cd ${tmp_specs}; \
+	list=`ls ${specs}/*.spec.patch`; \
+	rm -f *.orig; \
+	rm -f *.spec.~*~; \
+	for i in $$list; do \
+		patch -bV numbered < $$i; \
+	done; \
+	list2=`svn ls ${oursrcdir}`; \
+	for i in $$list2; do \
+		base=`basename $$i`; \
+		[ -e ${tmp_specs}/$$base.spec ] || continue; \
+		version=`svnversion ${oursrcdir}/$$i`; \
+		version=$${version//:/_}; \
+		echo "$$i version $$version"; \
+		sed --in-place \
+			-e "s/SVNVERSION_TO_UPDATE/$${version}/" \
+		${tmp_specs}/$$base.spec; \
+	done
+
+# 1. use the package's Makefile to delete leftover files and run autoconf
+# 2. create a tarball (we want it to contain the autoconf output)
+tarballs: mkdir-tree
+	@set -ex; \
+	cd ${oursrcdir}; \
+	list=`find -mindepth 1 -maxdepth 1 -type d | grep -v ".svn"`; \
+	for i in $$list; do \
+		pushd $$i; \
+		if [ -x ./mrproper ]; then \
+			./mrproper; \
+			if [ -e configure.in ] || [ -e configure.ac ]; then \
+				autoconf; \
+			fi; \
+		fi; \
+		popd; \
+		tar -czf $(tmp_src)/$$i.tar.gz $$i; \
+	done
+
+#setup: install-srpms copy-patches copy-specs patch-specs tarballs
+setup: copy-patches copy-specs patch-specs tarballs
+
+oursrc:
+	make $(oursrc)
+
+upstream: mkdir-tree download
+	make $(upstream)
+
+all:
+	make $(allsrc)
+
+$(oursrc): rpmbuild_args += --define 'scriptsversion $(shell svnversion ${oursrcdir}/$** | tr ':' '_' | sed -e 's/-.*/0.uncommitted/')'
+
+$(filter %.i686,$(oursrc)): %.i686: setup
+	PATH="/usr/kerberos/sbin:/usr/kerberos/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin" \
+	rpmbuild ${rpmbuild_args} -bs ${tmp_specs}/${PKG}.spec
+	/usr/bin/mock -r scripts-fc15-i386 --arch=i686 ${rpmbuild_args} --define="_lib lib" -v --rebuild `ls -t ${out_srpms}/${PKG}-[0-9]*.src.rpm | head -1`
+
+$(filter-out %.i686,$(oursrc)): %: setup
+	PATH="/usr/kerberos/sbin:/usr/kerberos/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin" \
+	rpmbuild ${rpmbuild_args} -bs ${tmp_specs}/${PKG}.spec
+	/usr/bin/mock -r scripts-fc15-`uname -m` ${rpmbuild_args} -v --rebuild `ls -t ${out_srpms}/${PKG}-[0-9]*.src.rpm | head -1`
+
+$(upstream) openafs-kernel: rpmbuild_args += --define 'scriptsversion $(shell svnversion ${patches} | tr ':' '_')'
+
+$(filter %.i686,$(upstream)): %.i686: setup patch-specs
+	rpmbuild ${rpmbuild_args} -bs ${tmp_specs}/${PKG}.spec
+	/usr/bin/mock -r scripts-fc15-i386 --arch=i686 ${rpmbuild_args} -v --rebuild `ls -t ${out_srpms}/${PKG}-[0-9]*.src.rpm | head -1`
+
+$(filter-out %.i686,$(upstream)): %: setup patch-specs
+	rpmbuild ${rpmbuild_args} -bs ${tmp_specs}/${PKG}.spec
+	/usr/bin/mock -r scripts-fc15-`uname -m` ${rpmbuild_args} -v --rebuild `ls -t ${out_srpms}/${PKG}-[0-9]*.src.rpm | head -1`
+
+openafs-kernel: setup
+	PATH="/usr/kerberos/sbin:/usr/kerberos/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin" \
+	rpmbuild ${rpmbuild_args} -bs ${tmp_specs}/openafs*.spec
+	/usr/bin/mock -r scripts-fc15-`uname -m` ${rpmbuild_args} -v --rebuild `ls -t ${out_srpms}/openafs*.src.rpm | head -1`
+
+#sort -n sorts "2.6.25-1" later than "2.6.25.1-1", so it's Wrong
+#kernvers = $(shell rpm -q --qf "%{Version}-%{Release}\n" --whatprovides kernel | sort -n | tail -n1)
+kernvers = $(shell uname -r | sed "s/\(.*\)[.].*/\1/")
+kvariants = ''
+openafs_rpmbuild_args = --define "fedorakmod 1" --define "kvariants $(kvariants)" --define "kernvers $(kernvers)"
+openafs: rpmbuild_args += $(openafs_rpmbuild_args)
+openafs-kernel: rpmbuild_args += $(openafs_rpmbuild_args) --define "build_userspace 0" --define "build_modules 1"
+
+frob-openafs:
+	@set -ex; \
+	if [ ! -d "/etc/openafs/" ]; then \
+	echo "/etc/openafs does not exist"; \
+	exit 1; \
+	else \
+	ln -nfs /etc/openafs/* /usr/vice/etc/; \
+	fi
+
+# XXX: We need to figure out what's going on with compat-readline43
+#	rpm -ivh http://kojipkgs.fedoraproject.org/packages/compat-readline43/4.3/3/i386/compat-readline43-4.3-3.i386.rpm
+#	rpm -ivh http://download.fedora.redhat.com/pub/fedora/linux/core/6/i386/os/Fedora/RPMS/compat-readline43-4.3-3.i386.rpm
+
+fedora:
+	make upstream
+	rpm -ivh $(out_rpms)/`uname -m`/openafs-devel*.rpm
+	make oursrc
Index: tags/fc15-eol/server/fedora/config/etc/aliases
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/aliases	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/aliases	(revision 2244)
@@ -0,0 +1,109 @@
+#
+#  Aliases in this file will NOT be expanded in the header from
+#  Mail, but WILL be visible over networks or from /bin/mail.
+#
+#	>>>>>>>>>>	The program "newaliases" must be run after
+#	>> NOTE >>	this file is updated for any changes to
+#	>>>>>>>>>>	show through to sendmail.
+#
+
+# Basic system aliases -- these MUST be present.
+mailer-daemon:	postmaster
+postmaster:	root
+
+# General redirections for pseudo accounts.
+bin:		root
+daemon:		root
+adm:		root
+lp:		root
+sync:		root
+shutdown:	root
+halt:		root
+mail:		root
+news:		root
+uucp:		root
+operator:	root
+games:		root
+gopher:		root
+ftp:		root
+nobody:		root
+radiusd:	root
+nut:		root
+dbus:		root
+vcsa:		root
+canna:		root
+wnn:		root
+rpm:		root
+nscd:		root
+pcap:		root
+apache:		root
+webalizer:	root
+dovecot:	root
+fax:		root
+quagga:		root
+radvd:		root
+pvm:		root
+amanda:		root
+privoxy:	root
+ident:		root
+named:		root
+xfs:		root
+gdm:		root
+mailnull:	root
+postgres:	root
+sshd:		root
+smmsp:		root
+postfix:	root
+netdump:	root
+ldap:		root
+squid:		root
+ntp:		root
+mysql:		root
+desktop:	root
+rpcuser:	root
+rpc:		root
+nfsnobody:	root
+
+ingres:		root
+system:		root
+toor:		root
+manager:	root
+dumper:		root
+abuse:		root
+
+newsadm:	news
+newsadmin:	news
+usenet:		news
+ftpadm:		ftp
+ftpadmin:	ftp
+ftp-adm:	ftp
+ftp-admin:	ftp
+www:		webmaster
+webmaster:	root
+noc:		root
+security:	root
+hostmaster:	root
+
+# trap decode to catch security attacks
+decode:		root
+
+# Person who should get root's mail
+root:		andersk@mit.edu, quentin@mit.edu, geofft+root@mit.edu, mitchb@mit.edu, ezyang@mit.edu, xavid@mit.edu, adehnert-sipb@mit.edu, achernya@mit.edu
+
+scripts:	root
+signup:		root
+afsagent:	root
+logview:	root
+scripts-build:	root
+
+# People who are abusing or otherwise causing problems with the mail system
+# Put "/dev/null" as the target of their alias
+# srimano: has a phpBB generating a lot of backscatter
+srimano:	/dev/null
+# dbriggs: phpBB: added 2011-06-25, see mail to -root 2011-03-27, 2011-06-03
+dbriggs:	/dev/null
+# ro21531: spam to rosmosis.net: added 2011-06-25, see mail to -root 2011-06-03
+ro21531:	/dev/null
+
+# Temporary to clear the queue
+# Should be deleted if left uncommitted
Index: tags/fc15-eol/server/fedora/config/etc/auto.master
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/auto.master	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/auto.master	(revision 2244)
@@ -0,0 +1,1 @@
+/mit hesiod:hesiod
Index: tags/fc15-eol/server/fedora/config/etc/cron.d/check-filecaps
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/cron.d/check-filecaps	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/cron.d/check-filecaps	(revision 2244)
@@ -0,0 +1,2 @@
+MAILTO=scripts-root@mit.edu
+27 5 * * * root find / -xdev -not -perm -o=x -prune -o -type f -print0 | xargs -0r /usr/sbin/getcap | cut -d' ' -f1 | grep -Fxvf /etc/scripts/allowed-filecaps.list | sed 's/^/Extra file_caps binary: /'
Index: tags/fc15-eol/server/fedora/config/etc/cron.d/check-setugid
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/cron.d/check-setugid	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/cron.d/check-setugid	(revision 2244)
@@ -0,0 +1,2 @@
+MAILTO=scripts-root@mit.edu
+23 5 * * * root find / -xdev -not -perm -o=x -prune -o -type f -perm /ug=s -print | grep -Fxvf /etc/scripts/allowed-setugid.list | sed 's/^/Extra set[ug]id binary: /'
Index: tags/fc15-eol/server/fedora/config/etc/cron.d/scripts-cron_status
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/cron.d/scripts-cron_status	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/cron.d/scripts-cron_status	(revision 2244)
@@ -0,0 +1,1 @@
+* * * * * scripts touch /afs/athena.mit.edu/contrib/scripts/cron_scripts/cron_status_flag/$(hostname -f) > /dev/null 2>&1
Index: tags/fc15-eol/server/fedora/config/etc/cron.daily/num-crontabs
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/cron.daily/num-crontabs	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/cron.daily/num-crontabs	(revision 2244)
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+numcrontabs=$(ls -1 /var/spool/cron | wc -l)
+if [ $numcrontabs -lt 100 ] && [ $numcrontabs -gt 0 ]; then
+    msg="$(hostname --fqdn) has $numcrontabs files in /var/spool/cron and should have none or hundreds."
+    logger -u /dev/log -p authpriv.info -t num-crontabs "$msg"
+    echo "$msg"
+fi
Index: tags/fc15-eol/server/fedora/config/etc/dirsrv/slapd-scripts/schema/98scripts-vhost.ldif
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/dirsrv/slapd-scripts/schema/98scripts-vhost.ldif	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/dirsrv/slapd-scripts/schema/98scripts-vhost.ldif	(revision 2244)
@@ -0,0 +1,26 @@
+#
+# BEGIN COPYRIGHT BLOCK
+# This Program is free software; you can redistribute it and/or modify it under
+# the terms of the GNU General Public License as published by the Free Software
+# Foundation; version 2 of the License.
+# 
+# This Program is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License along with
+# this Program; if not, write to the Free Software Foundation, Inc., 59 Temple
+# Place, Suite 330, Boston, MA 02111-1307 USA.
+# 
+# Copyright (C) 2008 Geoffrey Thomas
+# END COPYRIGHT BLOCK
+#
+#
+# Schema for representing a version control repository location
+#
+dn: cn=schema
+attributeTypes: ( 1.2.840.113554.4.2.1.1 NAME 'scriptsVhostName' DESC 'Canonical server name' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'scripts.mit.edu' )
+attributeTypes: ( 1.2.840.113554.4.2.1.2 NAME 'scriptsVhostAlias' DESC 'Other server names' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'scripts.mit.edu' )
+attributeTypes: ( 1.2.840.113554.4.2.1.3 NAME 'scriptsVhostDirectory' DESC 'Directory under $HOME/Scripts/$service for the root of this service' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'scripts.mit.edu' )
+attributeTypes: ( 1.2.840.113554.4.2.1.4 NAME 'scriptsVhostAccount' DESC 'User account for finding home direcory and suexec uid/gid' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORIGIN 'scripts.mit.edu' )
+objectClasses: ( 1.2.840.113554.4.2.2.1 NAME 'scriptsVhost' DESC 'Configuration for a scripts virtual host' SUP top AUXILIARY MUST ( scriptsVhostName $ scriptsVhostDirectory $ scriptsVhostAccount ) MAY ( scriptsVhostAlias ) X-ORIGIN 'scripts.mit.edu' )
Index: tags/fc15-eol/server/fedora/config/etc/dirsrv/slapd-scripts/schema/99mod_vhost_ldap.ldif
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/dirsrv/slapd-scripts/schema/99mod_vhost_ldap.ldif	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/dirsrv/slapd-scripts/schema/99mod_vhost_ldap.ldif	(revision 2244)
@@ -0,0 +1,107 @@
+#
+################################################################################
+#
+dn: cn=schema
+#
+################################################################################
+#
+attributeTypes: (
+  1.3.6.1.4.1.8387.1.1.2
+  NAME 'apacheServerName'
+  DESC 'mod_vhost_ldap: Apache ServerName'
+  SUP name
+  EQUALITY caseIgnoreMatch
+  SUBSTR caseIgnoreSubstringsMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256}
+  SINGLE-VALUE
+  )
+#
+################################################################################
+#
+attributeTypes: (
+  1.3.6.1.4.1.8387.1.1.3
+  NAME 'apacheServerAlias'
+  DESC 'mod_vhost_ldap: Apache ServerAlias'
+  SUP name
+  EQUALITY caseIgnoreMatch
+  SUBSTR caseIgnoreSubstringsMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256}
+  )
+#
+################################################################################
+#
+attributeTypes: (
+  1.3.6.1.4.1.8387.1.1.4
+  NAME 'apacheDocumentRoot'
+  DESC 'mod_vhost_ldap: Apache DocumentRoot'
+  SUP name
+  EQUALITY caseIgnoreMatch
+  SUBSTR caseIgnoreSubstringsMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256}
+  SINGLE-VALUE
+  )
+#
+################################################################################
+#
+attributeTypes: (
+  1.3.6.1.4.1.8387.1.1.5
+  NAME 'apacheServerAdmin'
+  DESC 'mod_vhost_ldap: Apache ServerAdmin'
+  SUP name
+  EQUALITY caseIgnoreMatch
+  SUBSTR caseIgnoreSubstringsMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256}
+  SINGLE-VALUE
+  )
+#
+################################################################################
+#
+attributeTypes: (
+  1.3.6.1.4.1.14287.1.1.6
+  NAME 'apacheScriptAlias'
+  DESC 'mod_cfg_ldap: Apache ScriptAlias'
+  SUP name
+  EQUALITY caseIgnoreMatch
+  SUBSTR caseIgnoreSubstringsMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256}
+  SINGLE-VALUE
+  )
+#
+################################################################################
+#
+attributeTypes: (
+  1.3.6.1.4.1.8387.1.1.7
+  NAME 'apacheSuexecUid'
+  DESC 'mod_vhost_ldap: Apache SuexecUid'
+  SUP name
+  EQUALITY caseIgnoreMatch
+  SUBSTR caseIgnoreSubstringsMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256}
+  SINGLE-VALUE
+  )
+#
+################################################################################
+#
+attributeTypes: (
+  1.3.6.1.4.1.8387.1.1.8
+  NAME 'apacheSuexecGid'
+  DESC 'mod_vhost_ldap: Apache SuexecGid'
+  SUP name
+  EQUALITY caseIgnoreMatch
+  SUBSTR caseIgnoreSubstringsMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256}
+  SINGLE-VALUE
+  )
+#
+################################################################################
+#
+objectClasses: (
+  1.3.6.1.4.1.8387.1.2.1
+  NAME 'apacheConfig'
+  SUP 'top'
+  MUST ( apacheServerName $ apacheDocumentRoot )
+  MAY ( apacheServerAlias $ apacheServerAdmin $ apacheScriptAlias $ apacheSuexecUid $ apacheSuexecGid )
+  )
+#
+################################################################################
+#
Index: tags/fc15-eol/server/fedora/config/etc/environment
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/environment	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/environment	(revision 2244)
@@ -0,0 +1,1 @@
+JAVA_TOOL_OPTIONS="-Xmx128M -XX:MaxPermSize=64M"
Index: tags/fc15-eol/server/fedora/config/etc/freshclam.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/freshclam.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/freshclam.conf	(revision 2244)
@@ -0,0 +1,175 @@
+##
+## Example config file for freshclam
+## Please read the freshclam.conf(5) manual before editing this file.
+##
+
+
+# Comment or remove the line below.
+#Example
+
+# Path to the database directory.
+# WARNING: It must match clamd.conf's directive!
+# Default: hardcoded (depends on installation options)
+DatabaseDirectory /var/lib/clamav
+
+# Path to the log file (make sure it has proper permissions)
+# Default: disabled
+UpdateLogFile /var/log/freshclam.log
+
+# Maximum size of the log file.
+# Value of 0 disables the limit.
+# You may use 'M' or 'm' for megabytes (1M = 1m = 1048576 bytes)
+# and 'K' or 'k' for kilobytes (1K = 1k = 1024 bytes).
+# in bytes just don't use modifiers.
+# Default: 1M
+#LogFileMaxSize 2M
+
+# Log time with each message.
+# Default: no
+#LogTime yes
+
+# Enable verbose logging.
+# Default: no
+#LogVerbose yes
+
+# Use system logger (can work together with UpdateLogFile).
+# Default: no
+#LogSyslog yes
+
+# Specify the type of syslog messages - please refer to 'man syslog'
+# for facility names.
+# Default: LOG_LOCAL6
+#LogFacility LOG_MAIL
+
+# This option allows you to save the process identifier of the daemon
+# Default: disabled
+#PidFile /var/run/freshclam.pid
+
+# By default when started freshclam drops privileges and switches to the
+# "clamav" user. This directive allows you to change the database owner.
+# Default: clamav (may depend on installation options)
+#DatabaseOwner clamav
+
+# Initialize supplementary group access (freshclam must be started by root).
+# Default: no
+#AllowSupplementaryGroups yes
+
+# Use DNS to verify virus database version. Freshclam uses DNS TXT records
+# to verify database and software versions. With this directive you can change
+# the database verification domain.
+# WARNING: Do not touch it unless you're configuring freshclam to use your
+# own database verification domain.
+# Default: current.cvd.clamav.net
+#DNSDatabaseInfo current.cvd.clamav.net
+
+# Uncomment the following line and replace XY with your country
+# code. See http://www.iana.org/cctld/cctld-whois.htm for the full list.
+#DatabaseMirror db.XY.clamav.net
+
+# database.clamav.net is a round-robin record which points to our most 
+# reliable mirrors. It's used as a fall back in case db.XY.clamav.net is 
+# not working. DO NOT TOUCH the following line unless you know what you
+# are doing.
+DatabaseMirror database.clamav.net
+
+# How many attempts to make before giving up.
+# Default: 3 (per mirror)
+#MaxAttempts 5
+
+# With this option you can control scripted updates. It's highly recommended
+# to keep it enabled.
+# Default: yes
+#ScriptedUpdates yes
+
+# By default freshclam will keep the local databases (.cld) uncompressed to
+# make their handling faster. With this option you can enable the compression;
+# the change will take effect with the next database update.
+# Default: no
+#CompressLocalDatabase no
+
+# Number of database checks per day.
+# Default: 12 (every two hours)
+#Checks 24
+
+# Proxy settings
+# Default: disabled
+#HTTPProxyServer myproxy.com
+#HTTPProxyPort 1234
+#HTTPProxyUsername myusername
+#HTTPProxyPassword mypass
+
+# If your servers are behind a firewall/proxy which applies User-Agent
+# filtering you can use this option to force the use of a different
+# User-Agent header.
+# Default: clamav/version_number
+#HTTPUserAgent SomeUserAgentIdString
+
+# Use aaa.bbb.ccc.ddd as client address for downloading databases. Useful for
+# multi-homed systems.
+# Default: Use OS'es default outgoing IP address.
+#LocalIPAddress aaa.bbb.ccc.ddd
+
+# Send the RELOAD command to clamd.
+# Default: no
+#NotifyClamd /path/to/clamd.conf
+
+# Run command after successful database update.
+# Default: disabled
+#OnUpdateExecute command
+
+# Run command when database update process fails.
+# Default: disabled
+#OnErrorExecute command
+
+# Run command when freshclam reports outdated version.
+# In the command string %v will be replaced by the new version number.
+# Default: disabled
+#OnOutdatedExecute command
+
+# Don't fork into background.
+# Default: no
+#Foreground yes
+
+# Enable debug messages in libclamav.
+# Default: no
+#Debug yes
+
+# Timeout in seconds when connecting to database server.
+# Default: 30
+#ConnectTimeout 60
+
+# Timeout in seconds when reading from database server.
+# Default: 30
+#ReceiveTimeout 60
+
+# When enabled freshclam will submit statistics to the ClamAV Project about
+# the latest virus detections in your environment. The ClamAV maintainers
+# will then use this data to determine what types of malware are the most
+# detected in the field and in what geographic area they are.
+# This feature requires LogTime and LogFile to be enabled in clamd.conf.
+# Default: no
+#SubmitDetectionStats /path/to/clamd.conf
+
+# Country of origin of malware/detection statistics (for statistical
+# purposes only). The statistics collector at ClamAV.net will look up
+# your IP address to determine the geographical origin of the malware
+# reported by your installation. If this installation is mainly used to
+# scan data which comes from a different location, please enable this
+# option and enter a two-letter code (see http://www.iana.org/domains/root/db/)
+# of the country of origin.
+# Default: disabled
+#DetectionStatsCountry country-code
+
+# This option enables support for Google Safe Browsing. When activated for
+# the first time, freshclam will download a new database file (safebrowsing.cvd)
+# which will be automatically loaded by clamd and clamscan during the next
+# reload, provided that the heuristic phishing detection is turned on. This
+# database includes information about websites that may be phishing sites or
+# possible sources of malware. When using this option, it's mandatory to run
+# freshclam at least every 30 minutes.
+# Freshclam uses the ClamAV's mirror infrastructure to distribute the
+# database and its updates but all the contents are provided under Google's
+# terms of use. See http://code.google.com/support/bin/answer.py?answer=70015
+# and http://safebrowsing.clamav.net for more information.
+# Default: disabled
+#SafeBrowsing yes
Index: tags/fc15-eol/server/fedora/config/etc/fuse.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/fuse.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/fuse.conf	(revision 2244)
@@ -0,0 +1,1 @@
+user_allow_other
Index: tags/fc15-eol/server/fedora/config/etc/ha.d/ha.cf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/ha.d/ha.cf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/ha.d/ha.cf	(revision 2244)
@@ -0,0 +1,9 @@
+logfacility	local0
+udpport	695
+bcast	eth0
+mcast eth0 225.0.0.1 695 1 0
+auto_failback off
+node	old-faithful
+node	better-mousetrap
+respawn hacluster /usr/lib64/heartbeat/ipfail
+apiauth ipfail gid=haclient uid=hacluster
Index: tags/fc15-eol/server/fedora/config/etc/ha.d/haresources
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/ha.d/haresources	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/ha.d/haresources	(revision 2244)
@@ -0,0 +1,1 @@
+old-faithful crond
Index: tags/fc15-eol/server/fedora/config/etc/hesiod.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/hesiod.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/hesiod.conf	(revision 2244)
@@ -0,0 +1,2 @@
+rhs=.ATHENA.MIT.EDU
+lhs=.ns
Index: tags/fc15-eol/server/fedora/config/etc/hosts
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/hosts	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/hosts	(revision 2244)
@@ -0,0 +1,32 @@
+# Do not remove the following line, or various programs
+# that require network functionality will fail.
+127.0.0.1	localhost.localdomain localhost
+::1		localhost.localdomain localhost
+
+18.181.0.43	scripts.mit.edu scripts
+18.181.0.46	scripts-vhosts.mit.edu scripts-vhosts
+18.181.0.50	scripts-cert.mit.edu scripts-cert
+18.181.0.52	sql.mit.edu sql
+18.181.0.229	scripts-test.mit.edu scripts-test
+
+18.181.0.57	better-mousetrap.mit.edu better-mousetrap scripts1.mit.edu scripts1
+18.181.0.53	old-faithful.mit.edu old-faithful scripts2.mit.edu scripts2
+18.181.0.167	bees-knees.mit.edu bees-knees sx-blade-4.mit.edu sx-blade-4 scripts3.mit.edu scripts3
+18.181.0.228	cats-whiskers.mit.edu cats-whiskers scripts4.mit.edu scripts4
+18.181.0.236	whole-enchilada.mit.edu whole-enchilada scripts5.mit.edu scripts5
+18.181.0.237	pancake-bunny.mit.edu pancake-bunny scripts6.mit.edu scripts6
+18.181.0.234	busy-beaver.mit.edu busy-beaver scripts7.mit.edu scripts7
+18.181.0.235	real-mccoy.mit.edu real-mccoy scripts8.mit.edu scripts8
+18.181.0.135	shining-armor.mit.edu shining-armor scripts9.mit.edu scripts9
+18.181.0.141	golden-egg.mit.edu golden-egg scripts10.mit.edu scripts10
+
+172.21.0.57	better-mousetrap.mit.edu
+172.21.0.53	old-faithful.mit.edu
+172.21.0.167	bees-knees.mit.edu
+172.21.0.228	cats-whiskers.mit.edu
+172.21.0.236	whole-enchilada.mit.edu
+172.21.0.237	pancake-bunny.mit.edu
+172.21.0.234	busy-beaver.mit.edu
+172.21.0.235	real-mccoy.mit.edu
+172.21.0.135	shining-armor.mit.edu
+172.21.0.141	golden-egg.mit.edu
Index: tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/auth_sslcert.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/auth_sslcert.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/auth_sslcert.conf	(revision 2244)
@@ -0,0 +1,8 @@
+LoadModule auth_sslcert_module modules/mod_auth_sslcert.so
+LoadModule authz_afsgroup_module modules/mod_authz_afsgroup.so
+LoadModule auth_optional_module modules/mod_auth_optional.so
+
+<Directory />
+AuthSSLCertVar		SSL_CLIENT_S_DN_Email
+AuthSSLCertStripSuffix	"@MIT.EDU"
+</Directory>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/scripts-special.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/scripts-special.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/scripts-special.conf	(revision 2244)
@@ -0,0 +1,42 @@
+Alias /__scripts/heartbeat /afs/athena.mit.edu/contrib/scripts/web_scripts/heartbeat
+Alias /__scripts/django/media /usr/lib/python2.7/site-packages/django/contrib/admin/media
+Alias /__scripts /afs/athena.mit.edu/contrib/scripts/www
+
+<Directory /afs/athena.mit.edu/contrib/scripts/www>
+    <Files *>
+	SetHandler none
+    </Files>
+</Directory>
+
+<Directory /usr/lib/python2.7/site-packages/django/contrib/admin/media>
+    <Files *>
+	SetHandler none
+    </Files>
+</Directory>
+
+<Location /__scripts/needcerts>
+    RewriteEngine On
+
+    RewriteCond %{HTTP_HOST} !:444$
+    RewriteCond %{SERVER_NAME} ^(.*\.)?scripts$
+    RewriteCond %{THE_REQUEST} ^[^\ ]*\ (.*)\ .*
+    RewriteRule ^ https://%{SERVER_NAME}.mit.edu:444%1 [L,R]
+
+    RewriteCond %{HTTP_HOST} !:444$
+    RewriteCond %{SERVER_NAME} !=scripts-cert.mit.edu
+    RewriteCond %{SERVER_NAME} !=scripts-cert
+    RewriteCond %{THE_REQUEST} ^[^\ ]*\ (.*)\ .*
+    RewriteRule ^ https://%{SERVER_NAME}:444%1 [L,R]
+
+    RewriteCond %{HTTP_USER_AGENT} Mac\ OS\ X.*AppleWebKit
+    RewriteRule /afs/athena.mit.edu/contrib/scripts/www/needcerts(.*) /__scripts/certerror$1 [L]
+
+    RewriteRule /afs/athena.mit.edu/contrib/scripts/www/needcerts(.+) $1 [L]
+    RewriteRule /afs/athena.mit.edu/contrib/scripts/www/needcerts /__scripts/unauthorized.html [L]
+</Location>
+
+<Location /__scripts/certerror>
+    SSLVerifyClient require
+    RewriteRule /afs/athena.mit.edu/contrib/scripts/www/certerror(.+) $1 [L]
+    RewriteRule /afs/athena.mit.edu/contrib/scripts/www/certerror /__scripts/unauthorized.html [L]
+</Location>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/scripts-vhost-names.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/scripts-vhost-names.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/scripts-vhost-names.conf	(revision 2244)
@@ -0,0 +1,16 @@
+ServerName scripts.mit.edu
+ServerAlias \
+    scripts 18.181.0.43 \
+    scripts-vhosts.mit.edu scripts-vhosts 18.181.0.46 \
+    scripts-test.mit.edu scripts-test 18.181.0.229 \
+    better-mousetrap.mit.edu better-mousetrap b-m.mit.edu b-m scripts1.mit.edu scripts1 18.181.0.57 \
+    old-faithful.mit.edu old-faithful o-f.mit.edu o-f scripts2.mit.edu scripts2 18.181.0.53 \
+    bees-knees.mit.edu bees-knees b-k.mit.edu b-k sx-blade-4.mit.edu sx-blade-4 scripts3.mit.edu scripts3 18.181.0.167 \
+    cats-whiskers.mit.edu cats-whiskers c-w.mit.edu c-w scripts4.mit.edu scripts4 18.181.0.228 \
+    whole-enchilada.mit.edu whole-enchilada w-e.mit.edu w-e scripts5.mit.edu scripts5 18.181.0.236 \
+    pancake-bunny.mit.edu pancake-bunny p-b.mit.edu p-b scripts6.mit.edu scripts6 18.181.0.237 \
+    busy-beaver.mit.edu busy-beaver b-b.mit.edu b-b scripts7.mit.edu scripts7 18.181.0.234 \
+    real-mccoy.mit.edu real-mccoy r-m.mit.edu r-m scripts8.mit.edu scripts8 18.181.0.235 \
+    shining-armor.mit.edu shining-armor s-a.mit.edu s-a scripts9.mit.edu scripts9 18.181.0.135 \
+    golden-egg.mit.edu golden-egg g-e.mit.edu g-e scripts10.mit.edu scripts10 18.181.0.141 \
+    localhost 127.0.0.1 ::1
Index: tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/scripts-vhost.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/scripts-vhost.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/scripts-vhost.conf	(revision 2244)
@@ -0,0 +1,30 @@
+DocumentRoot /afs/athena.mit.edu/contrib/scripts/web_scripts/home
+SuExecUserGroup scripts users
+UserDir enabled
+UserDir web_scripts
+# Comment the following line out to take the machine out of the LVS pool
+# You'll also need to prevent it from listening on 443 or 444
+Alias /heartbeat /afs/athena.mit.edu/contrib/scripts/web_scripts/heartbeat
+Alias /src /afs/athena.mit.edu/contrib/scripts/src
+Redirect /sql https://scripts.mit.edu/~sql
+
+<IfModule mod_status.c>
+    <Location "/server-status">
+        AuthType Basic
+        AuthName "scripts status"
+        AuthBasicProvider file
+        AuthUserFile /etc/munin/apache-htpasswd
+        Require valid-user
+        SetHandler server-status
+        PermitStatusHandler on
+    </Location>
+</IfModule>
+
+<Location ~ "/(robots\.txt|favicon\.ico)">
+    RewriteEngine On
+    RewriteBase /~scripts
+    RewriteCond %{REQUEST_FILENAME} !-f
+    RewriteRule .*(favicon\.ico) $1 [L,NS]
+    RewriteCond %{REQUEST_FILENAME} !-f
+    RewriteRule .*(robots\.txt) $1 [L,NS]
+</Location>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/vhost_ldap.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/vhost_ldap.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/vhost_ldap.conf	(revision 2244)
@@ -0,0 +1,12 @@
+#
+# mod_vhost_ldap allows you to keep your virtual host configuration
+# in an LDAP directory and update it in nearly realtime.
+#
+
+### NOTE ###
+### mod_vhost_ldap depends on mod_ldap ###
+### you have to enable mod_ldap as well ###
+
+VhostLDAPEnabled on
+VhostLDAPUrl "ldap://127.0.0.1/ou=VirtualHosts,dc=scripts,dc=mit,dc=edu"
+VhostLDAPFallback notfound.example.com
Index: tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/vhosts-common-ssl-cert.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/vhosts-common-ssl-cert.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/vhosts-common-ssl-cert.conf	(revision 2244)
@@ -0,0 +1,4 @@
+# This file will be included inside VirtualHost blocks that use
+# certificate auth.
+
+SSLVerifyClient optional
Index: tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/vhosts-common-ssl.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/vhosts-common-ssl.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/vhosts-common-ssl.conf	(revision 2244)
@@ -0,0 +1,3 @@
+# This file will be included inside each <VirtualHost *:443> block.
+
+SSLEngine on
Index: tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/vhosts-common.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/vhosts-common.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/conf.d/vhosts-common.conf	(revision 2244)
@@ -0,0 +1,2 @@
+# This file will be included inside each <VirtualHost *:80> block.
+
Index: tags/fc15-eol/server/fedora/config/etc/httpd/conf/httpd.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/conf/httpd.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/conf/httpd.conf	(revision 2244)
@@ -0,0 +1,421 @@
+ServerRoot /etc/httpd
+PidFile run/httpd.pid
+Timeout 300
+KeepAlive On
+MaxKeepAliveRequests 1000
+KeepAliveTimeout 15
+
+<IfModule mpm_prefork_module>
+    MinSpareServers 5
+    MaxSpareServers 50
+    StartServers 8
+    ServerLimit 512
+    MaxClients 512
+    MaxRequestsPerChild 10000
+</IfModule>
+
+<IfModule mpm_worker_module>
+    StartServers 3
+    MinSpareThreads 75
+    MaxSpareThreads 250
+    ServerLimit 64
+    ThreadsPerChild 32
+    MaxClients 1024
+    MaxRequestsPerChild 10000
+</IfModule>
+
+<IfModule mpm_event_module>
+    StartServers 3
+    MinSpareThreads 75
+    MaxSpareThreads 250
+    ServerLimit 64
+    ThreadsPerChild 32
+    MaxClients 2048
+    MaxRequestsPerChild 10000
+</IfModule>
+
+LoadModule auth_basic_module modules/mod_auth_basic.so
+LoadModule auth_digest_module modules/mod_auth_digest.so
+LoadModule authn_file_module modules/mod_authn_file.so
+LoadModule authn_alias_module modules/mod_authn_alias.so
+LoadModule authn_anon_module modules/mod_authn_anon.so
+#LoadModule authn_dbm_module modules/mod_authn_dbm.so
+LoadModule authn_default_module modules/mod_authn_default.so
+LoadModule authz_host_module modules/mod_authz_host.so
+LoadModule authz_user_module modules/mod_authz_user.so
+LoadModule authz_owner_module modules/mod_authz_owner.so
+LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
+#LoadModule authz_dbm_module modules/mod_authz_dbm.so
+LoadModule authz_default_module modules/mod_authz_default.so
+LoadModule ldap_module modules/mod_ldap.so
+#LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
+LoadModule include_module modules/mod_include.so
+LoadModule log_config_module modules/mod_log_config.so
+#LoadModule logio_module modules/mod_logio.so
+LoadModule env_module modules/mod_env.so
+LoadModule ext_filter_module modules/mod_ext_filter.so
+#LoadModule mime_magic_module modules/mod_mime_magic.so
+LoadModule expires_module modules/mod_expires.so
+LoadModule deflate_module modules/mod_deflate.so
+LoadModule headers_module modules/mod_headers.so
+#LoadModule usertrack_module modules/mod_usertrack.so
+LoadModule setenvif_module modules/mod_setenvif.so
+LoadModule mime_module modules/mod_mime.so
+#LoadModule dav_module modules/mod_dav.so
+LoadModule status_module modules/mod_status.so
+LoadModule autoindex_module modules/mod_autoindex.so
+#LoadModule info_module modules/mod_info.so
+#LoadModule dav_fs_module modules/mod_dav_fs.so
+#LoadModule vhost_alias_module modules/mod_vhost_alias.so
+LoadModule negotiation_module modules/mod_negotiation.so
+LoadModule dir_module modules/mod_dir.so
+LoadModule actions_module modules/mod_actions.so
+#LoadModule speling_module modules/mod_speling.so
+LoadModule userdir_module modules/mod_userdir.so
+LoadModule alias_module modules/mod_alias.so
+LoadModule rewrite_module modules/mod_rewrite.so
+LoadModule proxy_module modules/mod_proxy.so
+LoadModule proxy_http_module modules/mod_proxy_http.so
+#LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
+#LoadModule proxy_connect_module modules/mod_proxy_connect.so
+#LoadModule cache_module modules/mod_cache.so
+LoadModule suexec_module modules/mod_suexec.so
+#LoadModule disk_cache_module modules/mod_disk_cache.so
+#LoadModule file_cache_module modules/mod_file_cache.so
+#LoadModule mem_cache_module modules/mod_mem_cache.so
+LoadModule cgi_module modules/mod_cgi.so
+LoadModule ssl_module modules/mod_ssl.so
+LoadModule vhost_ldap_module modules/mod_vhost_ldap.so
+
+User apache
+Group apache
+
+#ErrorDocument  403  /403-404.html
+#ErrorDocument  404  /403-404.html
+#ErrorDocument  500  /script_error.html
+
+UserDir disabled
+
+<Directory />
+    AllowOverride None
+    Options FollowSymLinks IncludesNoExec
+</Directory>
+
+<Directory /afs/*/*/web_scripts>
+    AllowOverride All
+</Directory>
+<Directory /afs/*/*/*/web_scripts>
+    AllowOverride All
+</Directory>
+<Directory /afs/*/*/*/*/web_scripts>
+    AllowOverride All
+</Directory>
+<Directory /afs/*/*/*/*/*/web_scripts>
+    AllowOverride All
+</Directory>
+<Directory /afs/*/*/*/*/*/*/web_scripts>
+    AllowOverride All
+</Directory>
+<Directory /afs/*/*/*/*/*/*/*/web_scripts>
+    AllowOverride All
+</Directory>
+<Directory /afs/*/*/*/*/*/*/*/*/web_scripts>
+    AllowOverride All
+</Directory>
+
+<IfModule mod_dir.c>
+    DirectoryIndex index index.html index.htm index.cgi index.pl index.php index.py index.shtml index.exe index.fcgi
+</IfModule>
+
+AccessFileName .htaccess
+
+<Files ~ "^\.ht">
+    Order Allow,Deny
+    Deny from all
+</Files>
+
+UseCanonicalName Off
+TypesConfig /etc/mime.types
+DefaultType text/plain
+#MIMEMagicFile conf/magic
+
+HostnameLookups Off
+ErrorLog "/home/logview/error_log"
+LogLevel warn
+LogFormat "%V %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
+LogFormat "%h %l %u %t \"%r\" %>s %b" common
+LogFormat "%a %V %U" statistics
+#CustomLog /var/log/httpd/access_log combined
+#CustomLog "|/etc/httpd/statistics_log_mitonly.sh" statistics
+ServerSignature Off
+ServerAdmin scripts@mit.edu
+ServerTokens Prod
+
+<IfModule mod_autoindex.c>
+    Alias /__scripts/icons /var/www/icons
+    <Directory /var/www/icons>
+        Options Indexes
+        AllowOverride None
+        <Files ~ "\.(gif|png)$">
+            SetHandler default-handler
+        </Files>
+    </Directory>
+
+    IndexOptions FancyIndexing VersionSort NameWidth=* HTMLTable
+
+    AddIconByEncoding (CMP,/__scripts/icons/compressed.gif) x-compress x-gzip
+
+    AddIconByType (TXT,/__scripts/icons/text.gif) text/*
+    AddIconByType (IMG,/__scripts/icons/image2.gif) image/*
+    AddIconByType (SND,/__scripts/icons/sound2.gif) audio/*
+    AddIconByType (VID,/__scripts/icons/movie.gif) video/*
+
+    AddIcon /__scripts/icons/binary.gif .bin .exe
+    AddIcon /__scripts/icons/binhex.gif .hqx
+    AddIcon /__scripts/icons/tar.gif .tar
+    AddIcon /__scripts/icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
+    AddIcon /__scripts/icons/compressed.gif .Z .z .tgz .gz .zip
+    AddIcon /__scripts/icons/a.gif .ps .ai .eps
+    AddIcon /__scripts/icons/layout.gif .html .shtml .htm .pdf
+    AddIcon /__scripts/icons/text.gif .txt
+    AddIcon /__scripts/icons/c.gif .c
+    AddIcon /__scripts/icons/p.gif .pl .py
+    AddIcon /__scripts/icons/f.gif .for
+    AddIcon /__scripts/icons/dvi.gif .dvi
+    AddIcon /__scripts/icons/uuencoded.gif .uu
+    AddIcon /__scripts/icons/script.gif .conf .sh .shar .csh .ksh .tcl
+    AddIcon /__scripts/icons/tex.gif .tex
+    AddIcon /__scripts/icons/bomb.gif core
+
+    AddIcon /__scripts/icons/back.gif ..
+    AddIcon /__scripts/icons/hand.right.gif README
+    AddIcon /__scripts/icons/folder.gif ^^DIRECTORY^^
+    AddIcon /__scripts/icons/blank.gif ^^BLANKICON^^
+
+    DefaultIcon /__scripts/icons/unknown.gif
+
+    ReadmeName README
+    HeaderName HEADER
+    
+    IndexIgnore .??* *~ *# RCS CVS *,v *,t
+</IfModule>
+
+<IfModule mod_mime.c>
+    AddType application/xhtml+xml         .xhtml
+    AddType application/http-index-format .hti
+    AddType text/html                     .html
+    AddType text/css                      .css
+    AddType text/xsl                      .xslt
+    AddType application/x-javascript      .js
+    AddType application/xml               .xml
+    AddType image/svg+xml                 .svg
+    AddType application/vnd.mozilla.xul+xml .xul
+    AddType application/rdf+xml             .rdf
+    AddType application/x-xpinstall         .xpi
+    AddType text/xml .xsl
+    AddType text/html .shtml
+    AddHandler server-parsed .shtml
+
+    AddEncoding x-compress Z
+    AddEncoding x-gzip gz tgz
+
+    AddLanguage da .dk
+    AddLanguage nl .nl
+    AddLanguage en .en
+    AddLanguage et .ee
+    AddLanguage fr .fr
+    AddLanguage de .de
+    AddLanguage el .el
+    AddLanguage it .it
+    AddLanguage ja .ja
+    AddCharset ISO-2022-JP .jis
+    AddLanguage pl .po
+    AddCharset ISO-8859-2 .iso-pl
+    AddLanguage pt .pt
+    AddLanguage pt-br .pt-br
+    AddLanguage ltz .lu
+    AddLanguage ca .ca
+    AddLanguage es .es
+    AddLanguage sv .se
+    AddLanguage cz .cz
+
+    <IfModule mod_negotiation.c>
+        LanguagePriority en da nl et fr de el it ja pl pt pt-br ltz ca es sv
+    </IfModule>
+
+    AddType application/x-tar .tgz
+    AddType image/bmp .bmp
+
+    AddType text/x-hdml .hdml
+</IfModule>
+
+<IfModule mod_setenvif.c>
+    BrowserMatch "Mozilla/2" nokeepalive
+    BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0
+    BrowserMatch "RealPlayer 4\.0" force-response-1.0
+    BrowserMatch "Java/1\.0" force-response-1.0
+    BrowserMatch "JDK/1\.0" force-response-1.0
+    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
+</IfModule>
+
+Listen 80
+
+RLimitCPU 300 300
+RLimitMEM 1610612736 1610612736
+RLimitNPROC 4096 4096
+
+NameVirtualHost *:80
+NameVirtualHost *:443
+NameVirtualHost *:444
+NameVirtualHost 18.181.0.50:80
+NameVirtualHost 18.181.0.50:443
+NameVirtualHost 18.181.0.50:444
+
+ServerName localhost
+DocumentRoot /afs/athena.mit.edu/contrib/scripts/www
+
+ExtendedStatus On
+RewriteEngine Off
+
+ProxyRequests Off
+
+<Location /robots.txt>
+    ErrorDocument 404 "No robots.txt.
+</Location>
+<Location /favicon.ico>
+    ErrorDocument 404 "No favicon.ico.
+</Location>
+
+<VirtualHost 18.181.0.50:80>
+    ServerName scripts-cert.mit.edu
+    ServerAlias scripts-cert
+    Include conf.d/scripts-vhost.conf
+    Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+# LDAP vhost, w00t w00t
+<VirtualHost *:80>
+    Include conf.d/vhost_ldap.conf
+    Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<VirtualHost *:80>
+    Include conf.d/scripts-vhost-names.conf
+    Include conf.d/scripts-vhost.conf
+    Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+    Listen 443
+    Listen 444
+
+    AddType application/x-x509-ca-cert .crt
+    AddType application/x-pkcs7-crl    .crl
+
+    # This directive allows insecure renegotiations to succeed for browsers
+    # that do not yet support RFC 5746.  It should be removed when enough
+    # of the world has caught up.
+    SSLInsecureRenegotiation on
+
+    SSLPassPhraseDialog  builtin
+    SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000)
+    SSLSessionCacheTimeout 28800
+    SSLMutex default
+    SSLRandomSeed startup file:/dev/urandom 256
+    SSLRandomSeed connect builtin
+    SSLCryptoDevice builtin
+    SSLCertificateFile /etc/pki/tls/certs/star.scripts.pem
+    SSLCertificateKeyFile /etc/pki/tls/private/scripts-1024.key
+    SSLCACertificateFile /etc/pki/tls/certs/ca.pem
+    SSLVerifyClient none
+    SSLOptions +StdEnvVars
+    SSLProtocol all -SSLv2
+    SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
+    <VirtualHost 18.181.0.50:443 18.181.0.50:444>
+        ServerName scripts-cert.mit.edu
+        ServerAlias scripts-cert
+        Include conf.d/scripts-vhost.conf
+        Include conf.d/vhosts-common-ssl.conf
+        SSLCertificateFile /etc/pki/tls/certs/scripts-cert.pem
+        SSLCertificateChainFile /etc/pki/tls/certs/scripts-cert.pem
+        SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+        Include conf.d/vhosts-common-ssl-cert.conf
+    </VirtualHost>
+    <VirtualHost 18.181.0.43:443>
+        Include conf.d/scripts-vhost-names.conf
+        Include conf.d/scripts-vhost.conf
+        Include conf.d/vhosts-common-ssl.conf
+        SSLCertificateFile /etc/pki/tls/certs/scripts.pem
+        SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+        SSLCertificateChainFile /etc/pki/tls/certs/scripts.pem
+    </VirtualHost>
+    <VirtualHost 18.181.0.43:444>
+        Include conf.d/scripts-vhost-names.conf
+        Include conf.d/scripts-vhost.conf
+        Include conf.d/vhosts-common-ssl.conf
+        Include conf.d/vhosts-common-ssl-cert.conf
+        SSLCertificateFile /etc/pki/tls/certs/scripts.pem
+        SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+        SSLCertificateChainFile /etc/pki/tls/certs/scripts.pem
+    </VirtualHost>
+    # LDAP vhost, w00t w00t
+    <VirtualHost *:443>
+        ServerName localhost
+        Include conf.d/vhost_ldap.conf
+        Include conf.d/vhosts-common-ssl.conf
+    </VirtualHost>
+    # LDAP vhost, w00t w00t
+    <VirtualHost *:444>
+        ServerName localhost
+        Include conf.d/vhost_ldap.conf
+        Include conf.d/vhosts-common-ssl.conf
+        Include conf.d/vhosts-common-ssl-cert.conf
+    </VirtualHost>
+</IfModule>
+Include vhosts.d/*.conf
+<IfModule ssl_module>
+    <VirtualHost *:443>
+        ServerName scripts.scripts.mit.edu
+        ServerAlias *.scripts.mit.edu *.scripts
+        SSLCertificateFile /etc/pki/tls/certs/star.scripts.pem
+        Include conf.d/vhost_ldap.conf
+        Include conf.d/vhosts-common-ssl.conf
+    </VirtualHost>
+    <VirtualHost *:443>
+        Include conf.d/scripts-vhost-names.conf
+        Include conf.d/scripts-vhost.conf
+        Include conf.d/vhosts-common-ssl.conf
+    </VirtualHost>
+    <VirtualHost *:444>
+        ServerName scripts.scripts.mit.edu
+        ServerAlias *.scripts.mit.edu *.scripts
+        SSLCertificateFile /etc/pki/tls/certs/star.scripts.pem
+        Include conf.d/vhost_ldap.conf
+        Include conf.d/vhosts-common-ssl.conf
+        Include conf.d/vhosts-common-ssl-cert.conf
+    </VirtualHost>
+    <VirtualHost *:444>
+        Include conf.d/scripts-vhost-names.conf
+        Include conf.d/scripts-vhost.conf
+        Include conf.d/vhosts-common-ssl.conf
+        Include conf.d/vhosts-common-ssl-cert.conf
+    </VirtualHost>
+</IfModule>
+
+LoadModule fcgid_module modules/mod_fcgid.so
+AddHandler fcgid-script fcgi
+<Files *.fcgi>
+        Options +ExecCGI
+</Files>
+SocketPath /var/run/mod_fcgid
+SharememPath /var/run/mod_fcgid/fcgid_shm
+IPCCommTimeout 300
+FcgidMaxRequestLen 209715200
+FcgidIdleTimeout 600
+FcgidMaxProcessesPerClass 10
+FcgidMinProcessesPerClass 0
+FcgidMaxRequestsPerProcess 10000
+
+Include conf.d/auth_sslcert.conf
+Include conf.d/execsys.conf
+Include conf.d/scripts-special.conf
Index: tags/fc15-eol/server/fedora/config/etc/httpd/statistics_log_mitonly.sh
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/statistics_log_mitonly.sh	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/statistics_log_mitonly.sh	(revision 2244)
@@ -0,0 +1,11 @@
+#!/bin/sh
+perl -ne 'BEGIN { $| = 1 }
+next unless /^18\./;
+next if /^18\.181\./;
+chomp; split;
+if ($_[1] eq "scripts.mit.edu" && $_[2] =~ m|/(~[^/]+)/|) {
+print "$1\n";
+} else {
+print "$_[1]\n";
+}' >> /var/log/httpd/statistics_log
+#awk '/^18\./ && ! /^18.181/ { print $2; fflush() }' >> /var/log/httpd/statistics_log
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/ai6034.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/ai6034.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/ai6034.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName ai6034.mit.edu
+	ServerAlias ai6034
+	DocumentRoot /afs/athena.mit.edu/course/6/6.034/web_scripts
+	Alias /~6.034 /afs/athena.mit.edu/course/6/6.034/web_scripts
+	SuExecUserGroup 6.034 6.034
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName ai6034.mit.edu
+		ServerAlias ai6034
+		DocumentRoot /afs/athena.mit.edu/course/6/6.034/web_scripts
+		Alias /~6.034 /afs/athena.mit.edu/course/6/6.034/web_scripts
+		SuExecUserGroup 6.034 6.034
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/ai6034.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName ai6034.mit.edu
+		ServerAlias ai6034
+		DocumentRoot /afs/athena.mit.edu/course/6/6.034/web_scripts
+		Alias /~6.034 /afs/athena.mit.edu/course/6/6.034/web_scripts
+		SuExecUserGroup 6.034 6.034
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/ai6034.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/ailg-bdf.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/ailg-bdf.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/ailg-bdf.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName ailg-bdf.mit.edu
+	ServerAlias ailg-bdf
+	DocumentRoot /afs/athena.mit.edu/org/a/ailg/web_scripts/bdf
+	Alias /~ailg /afs/athena.mit.edu/org/a/ailg/web_scripts
+	SuExecUserGroup ailg ailg
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName ailg-bdf.mit.edu
+		ServerAlias ailg-bdf
+		DocumentRoot /afs/athena.mit.edu/org/a/ailg/web_scripts/bdf
+		Alias /~ailg /afs/athena.mit.edu/org/a/ailg/web_scripts
+		SuExecUserGroup ailg ailg
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/ailg-bdf.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName ailg-bdf.mit.edu
+		ServerAlias ailg-bdf
+		DocumentRoot /afs/athena.mit.edu/org/a/ailg/web_scripts/bdf
+		Alias /~ailg /afs/athena.mit.edu/org/a/ailg/web_scripts
+		SuExecUserGroup ailg ailg
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/ailg-bdf.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/asa.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/asa.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/asa.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName asa.mit.edu
+	ServerAlias asa
+	DocumentRoot /afs/athena.mit.edu/activity/a/asa-db/web_scripts/db
+	Alias /~asa-db /afs/athena.mit.edu/activity/a/asa-db/web_scripts
+	SuExecUserGroup asa-db asa-db
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName asa.mit.edu
+		ServerAlias asa
+		DocumentRoot /afs/athena.mit.edu/activity/a/asa-db/web_scripts/db
+		Alias /~asa-db /afs/athena.mit.edu/activity/a/asa-db/web_scripts
+		SuExecUserGroup asa-db asa-db
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/asa.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName asa.mit.edu
+		ServerAlias asa
+		DocumentRoot /afs/athena.mit.edu/activity/a/asa-db/web_scripts/db
+		Alias /~asa-db /afs/athena.mit.edu/activity/a/asa-db/web_scripts
+		SuExecUserGroup asa-db asa-db
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/asa.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/ashdown.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/ashdown.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/ashdown.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName ashdown.mit.edu
+	ServerAlias ashdown
+	DocumentRoot /afs/athena.mit.edu/activity/a/ashdown/web_scripts
+	Alias /~ashdown /afs/athena.mit.edu/activity/a/ashdown/web_scripts
+	SuExecUserGroup ashdown ashdown
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName ashdown.mit.edu
+		ServerAlias ashdown
+		DocumentRoot /afs/athena.mit.edu/activity/a/ashdown/web_scripts
+		Alias /~ashdown /afs/athena.mit.edu/activity/a/ashdown/web_scripts
+		SuExecUserGroup ashdown ashdown
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/ashdown.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName ashdown.mit.edu
+		ServerAlias ashdown
+		DocumentRoot /afs/athena.mit.edu/activity/a/ashdown/web_scripts
+		Alias /~ashdown /afs/athena.mit.edu/activity/a/ashdown/web_scripts
+		SuExecUserGroup ashdown ashdown
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/ashdown.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/axo.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/axo.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/axo.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName axo.mit.edu
+	ServerAlias axo
+	DocumentRoot /afs/athena.mit.edu/activity/a/axo/web_scripts/site
+	Alias /~axo /afs/athena.mit.edu/activity/a/axo/web_scripts
+	SuExecUserGroup axo axo
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName axo.mit.edu
+		ServerAlias axo
+		DocumentRoot /afs/athena.mit.edu/activity/a/axo/web_scripts/site
+		Alias /~axo /afs/athena.mit.edu/activity/a/axo/web_scripts
+		SuExecUserGroup axo axo
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/axo.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName axo.mit.edu
+		ServerAlias axo
+		DocumentRoot /afs/athena.mit.edu/activity/a/axo/web_scripts/site
+		Alias /~axo /afs/athena.mit.edu/activity/a/axo/web_scripts
+		SuExecUserGroup axo axo
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/axo.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/bakerfoundation.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/bakerfoundation.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/bakerfoundation.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName bakerfoundation.mit.edu
+	ServerAlias bakerfoundation
+	DocumentRoot /afs/athena.mit.edu/activity/b/baker-foundation/web_scripts/foundation
+	Alias /~baker-foundation /afs/athena.mit.edu/activity/b/baker-foundation/web_scripts
+	SuExecUserGroup baker-foundation baker-foundation
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName bakerfoundation.mit.edu
+		ServerAlias bakerfoundation
+		DocumentRoot /afs/athena.mit.edu/activity/b/baker-foundation/web_scripts/foundation
+		Alias /~baker-foundation /afs/athena.mit.edu/activity/b/baker-foundation/web_scripts
+		SuExecUserGroup baker-foundation baker-foundation
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/bakerfoundation.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName bakerfoundation.mit.edu
+		ServerAlias bakerfoundation
+		DocumentRoot /afs/athena.mit.edu/activity/b/baker-foundation/web_scripts/foundation
+		Alias /~baker-foundation /afs/athena.mit.edu/activity/b/baker-foundation/web_scripts
+		SuExecUserGroup baker-foundation baker-foundation
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/bakerfoundation.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/barnowl.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/barnowl.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/barnowl.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName barnowl.mit.edu
+	ServerAlias barnowl
+	DocumentRoot /afs/sipb.mit.edu/project/barnowl/web_scripts
+	Alias /~barnowl /afs/sipb.mit.edu/project/barnowl/web_scripts
+	SuExecUserGroup barnowl barnowl
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName barnowl.mit.edu
+		ServerAlias barnowl
+		DocumentRoot /afs/sipb.mit.edu/project/barnowl/web_scripts
+		Alias /~barnowl /afs/sipb.mit.edu/project/barnowl/web_scripts
+		SuExecUserGroup barnowl barnowl
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/barnowl.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName barnowl.mit.edu
+		ServerAlias barnowl
+		DocumentRoot /afs/sipb.mit.edu/project/barnowl/web_scripts
+		Alias /~barnowl /afs/sipb.mit.edu/project/barnowl/web_scripts
+		SuExecUserGroup barnowl barnowl
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/barnowl.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/bc.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/bc.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/bc.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName bc.mit.edu
+	ServerAlias bc
+	DocumentRoot /afs/athena.mit.edu/activity/b/bc-desk/web_scripts
+	Alias /~bc-desk /afs/athena.mit.edu/activity/b/bc-desk/web_scripts
+	SuExecUserGroup bc-desk bc-desk
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName bc.mit.edu
+		ServerAlias bc
+		DocumentRoot /afs/athena.mit.edu/activity/b/bc-desk/web_scripts
+		Alias /~bc-desk /afs/athena.mit.edu/activity/b/bc-desk/web_scripts
+		SuExecUserGroup bc-desk bc-desk
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/bc.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName bc.mit.edu
+		ServerAlias bc
+		DocumentRoot /afs/athena.mit.edu/activity/b/bc-desk/web_scripts
+		Alias /~bc-desk /afs/athena.mit.edu/activity/b/bc-desk/web_scripts
+		SuExecUserGroup bc-desk bc-desk
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/bc.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/blog.gregbrockman.com.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/blog.gregbrockman.com.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/blog.gregbrockman.com.conf	(revision 2244)
@@ -0,0 +1,36 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName blog.gregbrockman.com
+	
+	DocumentRoot /afs/athena.mit.edu/user/g/d/gdb/web_scripts/blog
+	Alias /~gdb /afs/athena.mit.edu/user/g/d/gdb/web_scripts
+	SuExecUserGroup gdb gdb
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName blog.gregbrockman.com
+		
+		DocumentRoot /afs/athena.mit.edu/user/g/d/gdb/web_scripts/blog
+		Alias /~gdb /afs/athena.mit.edu/user/g/d/gdb/web_scripts
+		SuExecUserGroup gdb gdb
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/blog.gregbrockman.com.pem
+		SSLCertificateChainFile /etc/pki/tls/certs/blog.gregbrockman.com.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName blog.gregbrockman.com
+		
+		DocumentRoot /afs/athena.mit.edu/user/g/d/gdb/web_scripts/blog
+		Alias /~gdb /afs/athena.mit.edu/user/g/d/gdb/web_scripts
+		SuExecUserGroup gdb gdb
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/blog.gregbrockman.com.pem
+		SSLCertificateChainFile /etc/pki/tls/certs/blog.gregbrockman.com.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/bluechips.emergent-studios.com.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/bluechips.emergent-studios.com.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/bluechips.emergent-studios.com.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName bluechips.emergent-studios.com
+	
+	DocumentRoot /afs/sipb.mit.edu/contrib/blue-sun/web_scripts/bluechips.emergent-studios.com
+	Alias /~blue-sun /afs/sipb.mit.edu/contrib/blue-sun/web_scripts
+	SuExecUserGroup blue-sun blue-sun
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName bluechips.emergent-studios.com
+		
+		DocumentRoot /afs/sipb.mit.edu/contrib/blue-sun/web_scripts/bluechips.emergent-studios.com
+		Alias /~blue-sun /afs/sipb.mit.edu/contrib/blue-sun/web_scripts
+		SuExecUserGroup blue-sun blue-sun
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/bluechips.emergent-studios.com.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName bluechips.emergent-studios.com
+		
+		DocumentRoot /afs/sipb.mit.edu/contrib/blue-sun/web_scripts/bluechips.emergent-studios.com
+		Alias /~blue-sun /afs/sipb.mit.edu/contrib/blue-sun/web_scripts
+		SuExecUserGroup blue-sun blue-sun
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/bluechips.emergent-studios.com.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/carepackages.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/carepackages.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/carepackages.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName carepackages.mit.edu
+	ServerAlias carepackages
+	DocumentRoot /afs/athena.mit.edu/user/a/f/afarrell/web_scripts/uso
+	Alias /~afarrell /afs/athena.mit.edu/user/a/f/afarrell/web_scripts
+	SuExecUserGroup afarrell afarrell
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName carepackages.mit.edu
+		ServerAlias carepackages
+		DocumentRoot /afs/athena.mit.edu/user/a/f/afarrell/web_scripts/uso
+		Alias /~afarrell /afs/athena.mit.edu/user/a/f/afarrell/web_scripts
+		SuExecUserGroup afarrell afarrell
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/carepackages.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName carepackages.mit.edu
+		ServerAlias carepackages
+		DocumentRoot /afs/athena.mit.edu/user/a/f/afarrell/web_scripts/uso
+		Alias /~afarrell /afs/athena.mit.edu/user/a/f/afarrell/web_scripts
+		SuExecUserGroup afarrell afarrell
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/carepackages.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/cdsa.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/cdsa.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/cdsa.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName cdsa.mit.edu
+	ServerAlias cdsa
+	DocumentRoot /afs/athena.mit.edu/org/c/cdsa/web_scripts
+	Alias /~cdsa /afs/athena.mit.edu/org/c/cdsa/web_scripts
+	SuExecUserGroup cdsa cdsa
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName cdsa.mit.edu
+		ServerAlias cdsa
+		DocumentRoot /afs/athena.mit.edu/org/c/cdsa/web_scripts
+		Alias /~cdsa /afs/athena.mit.edu/org/c/cdsa/web_scripts
+		SuExecUserGroup cdsa cdsa
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/cdsa.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName cdsa.mit.edu
+		ServerAlias cdsa
+		DocumentRoot /afs/athena.mit.edu/org/c/cdsa/web_scripts
+		Alias /~cdsa /afs/athena.mit.edu/org/c/cdsa/web_scripts
+		SuExecUserGroup cdsa cdsa
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/cdsa.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/classmates.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/classmates.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/classmates.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName classmates.mit.edu
+	ServerAlias classmates
+	DocumentRoot /afs/athena.mit.edu/user/k/e/keone/web_scripts/social/classmates
+	Alias /~keone /afs/athena.mit.edu/user/k/e/keone/web_scripts
+	SuExecUserGroup keone keone
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName classmates.mit.edu
+		ServerAlias classmates
+		DocumentRoot /afs/athena.mit.edu/user/k/e/keone/web_scripts/social/classmates
+		Alias /~keone /afs/athena.mit.edu/user/k/e/keone/web_scripts
+		SuExecUserGroup keone keone
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/classmates.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName classmates.mit.edu
+		ServerAlias classmates
+		DocumentRoot /afs/athena.mit.edu/user/k/e/keone/web_scripts/social/classmates
+		Alias /~keone /afs/athena.mit.edu/user/k/e/keone/web_scripts
+		SuExecUserGroup keone keone
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/classmates.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/classof2014.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/classof2014.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/classof2014.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName classof2014.mit.edu
+	ServerAlias classof2014
+	DocumentRoot /afs/athena.mit.edu/activity/other/2014/web_scripts
+	Alias /~2014 /afs/athena.mit.edu/activity/other/2014/web_scripts
+	SuExecUserGroup 2014 2014
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName classof2014.mit.edu
+		ServerAlias classof2014
+		DocumentRoot /afs/athena.mit.edu/activity/other/2014/web_scripts
+		Alias /~2014 /afs/athena.mit.edu/activity/other/2014/web_scripts
+		SuExecUserGroup 2014 2014
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/classof2014.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName classof2014.mit.edu
+		ServerAlias classof2014
+		DocumentRoot /afs/athena.mit.edu/activity/other/2014/web_scripts
+		Alias /~2014 /afs/athena.mit.edu/activity/other/2014/web_scripts
+		SuExecUserGroup 2014 2014
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/classof2014.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/courseroad.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/courseroad.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/courseroad.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName courseroad.mit.edu
+	ServerAlias courseroad
+	DocumentRoot /afs/athena.mit.edu/user/d/a/dannybd/web_scripts/courseroad
+	Alias /~dannybd /afs/athena.mit.edu/user/d/a/dannybd/web_scripts
+	SuExecUserGroup dannybd dannybd
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName courseroad.mit.edu
+		ServerAlias courseroad
+		DocumentRoot /afs/athena.mit.edu/user/d/a/dannybd/web_scripts/courseroad
+		Alias /~dannybd /afs/athena.mit.edu/user/d/a/dannybd/web_scripts
+		SuExecUserGroup dannybd dannybd
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/courseroad.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName courseroad.mit.edu
+		ServerAlias courseroad
+		DocumentRoot /afs/athena.mit.edu/user/d/a/dannybd/web_scripts/courseroad
+		Alias /~dannybd /afs/athena.mit.edu/user/d/a/dannybd/web_scripts
+		SuExecUserGroup dannybd dannybd
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/courseroad.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/crew.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/crew.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/crew.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName crew.mit.edu
+	ServerAlias crew
+	DocumentRoot /afs/athena.mit.edu/activity/m/mitcrew/web_scripts
+	Alias /~mitcrew /afs/athena.mit.edu/activity/m/mitcrew/web_scripts
+	SuExecUserGroup mitcrew mitcrew
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName crew.mit.edu
+		ServerAlias crew
+		DocumentRoot /afs/athena.mit.edu/activity/m/mitcrew/web_scripts
+		Alias /~mitcrew /afs/athena.mit.edu/activity/m/mitcrew/web_scripts
+		SuExecUserGroup mitcrew mitcrew
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/crew.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName crew.mit.edu
+		ServerAlias crew
+		DocumentRoot /afs/athena.mit.edu/activity/m/mitcrew/web_scripts
+		Alias /~mitcrew /afs/athena.mit.edu/activity/m/mitcrew/web_scripts
+		SuExecUserGroup mitcrew mitcrew
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/crew.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/crosslinks.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/crosslinks.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/crosslinks.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName crosslinks.mit.edu
+	ServerAlias crosslinks
+	DocumentRoot /afs/athena.mit.edu/org/c/crosslinks/web_scripts/Crosslinks
+	Alias /~crosslinks /afs/athena.mit.edu/org/c/crosslinks/web_scripts
+	SuExecUserGroup crosslinks crosslinks
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName crosslinks.mit.edu
+		ServerAlias crosslinks
+		DocumentRoot /afs/athena.mit.edu/org/c/crosslinks/web_scripts/Crosslinks
+		Alias /~crosslinks /afs/athena.mit.edu/org/c/crosslinks/web_scripts
+		SuExecUserGroup crosslinks crosslinks
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/crosslinks.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName crosslinks.mit.edu
+		ServerAlias crosslinks
+		DocumentRoot /afs/athena.mit.edu/org/c/crosslinks/web_scripts/Crosslinks
+		Alias /~crosslinks /afs/athena.mit.edu/org/c/crosslinks/web_scripts
+		SuExecUserGroup crosslinks crosslinks
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/crosslinks.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/cs6090.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/cs6090.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/cs6090.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName cs6090.mit.edu
+	ServerAlias cs6090
+	DocumentRoot /afs/athena.mit.edu/course/6/6.090/web_scripts
+	Alias /~6.090 /afs/athena.mit.edu/course/6/6.090/web_scripts
+	SuExecUserGroup 6.090 6.090
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName cs6090.mit.edu
+		ServerAlias cs6090
+		DocumentRoot /afs/athena.mit.edu/course/6/6.090/web_scripts
+		Alias /~6.090 /afs/athena.mit.edu/course/6/6.090/web_scripts
+		SuExecUserGroup 6.090 6.090
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/cs6090.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName cs6090.mit.edu
+		ServerAlias cs6090
+		DocumentRoot /afs/athena.mit.edu/course/6/6.090/web_scripts
+		Alias /~6.090 /afs/athena.mit.edu/course/6/6.090/web_scripts
+		SuExecUserGroup 6.090 6.090
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/cs6090.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/dchang.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/dchang.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/dchang.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName dchang.mit.edu
+	ServerAlias dchang
+	DocumentRoot /afs/athena.mit.edu/user/d/c/dchang/web_scripts
+	Alias /~dchang /afs/athena.mit.edu/user/d/c/dchang/web_scripts
+	SuExecUserGroup dchang dchang
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName dchang.mit.edu
+		ServerAlias dchang
+		DocumentRoot /afs/athena.mit.edu/user/d/c/dchang/web_scripts
+		Alias /~dchang /afs/athena.mit.edu/user/d/c/dchang/web_scripts
+		SuExecUserGroup dchang dchang
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/dchang.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName dchang.mit.edu
+		ServerAlias dchang
+		DocumentRoot /afs/athena.mit.edu/user/d/c/dchang/web_scripts
+		Alias /~dchang /afs/athena.mit.edu/user/d/c/dchang/web_scripts
+		SuExecUserGroup dchang dchang
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/dchang.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/debathena.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/debathena.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/debathena.conf	(revision 2244)
@@ -0,0 +1,37 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName debathena.mit.edu
+	ServerAlias *.debathena.com *.debathena.net *.debathena.org debathena debathena.com debathena.net debathena.org
+	DocumentRoot /afs/sipb.mit.edu/project/debathena/web_scripts
+	Alias /~debathena /afs/sipb.mit.edu/project/debathena/web_scripts
+	SuExecUserGroup debathena debathena
+	Include conf.d/vhosts-common.conf
+	CustomLog /home/logview/debathena.log combined
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName debathena.mit.edu
+		ServerAlias *.debathena.com *.debathena.net *.debathena.org debathena debathena.com debathena.net debathena.org
+		DocumentRoot /afs/sipb.mit.edu/project/debathena/web_scripts
+		Alias /~debathena /afs/sipb.mit.edu/project/debathena/web_scripts
+		SuExecUserGroup debathena debathena
+		Include conf.d/vhosts-common-ssl.conf
+		CustomLog /home/logview/debathena.log combined
+		SSLCertificateFile /etc/pki/tls/certs/debathena.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName debathena.mit.edu
+		ServerAlias *.debathena.com *.debathena.net *.debathena.org debathena debathena.com debathena.net debathena.org
+		DocumentRoot /afs/sipb.mit.edu/project/debathena/web_scripts
+		Alias /~debathena /afs/sipb.mit.edu/project/debathena/web_scripts
+		SuExecUserGroup debathena debathena
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		CustomLog /home/logview/debathena.log combined
+		SSLCertificateFile /etc/pki/tls/certs/debathena.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/eastgate.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/eastgate.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/eastgate.conf	(revision 2244)
@@ -0,0 +1,36 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName eastgate.mit.edu
+	ServerAlias eastgate
+	DocumentRoot /afs/athena.mit.edu/activity/e/eastgate/web_scripts
+	Alias /~eastgate /disabled/afs/athena.mit.edu/activity/e/eastgate/web_scripts
+	SuExecUserGroup eastgate eastgate
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName eastgate.mit.edu
+		ServerAlias eastgate
+		DocumentRoot /afs/athena.mit.edu/activity/e/eastgate/web_scripts
+		Alias /~eastgate /disabled/afs/athena.mit.edu/activity/e/eastgate/web_scripts
+		SuExecUserGroup eastgate eastgate
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/eastgate.pem
+		SSLCertificateChainFile /etc/pki/tls/certs/eastgate.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName eastgate.mit.edu
+		ServerAlias eastgate
+		DocumentRoot /afs/athena.mit.edu/activity/e/eastgate/web_scripts
+		Alias /~eastgate /disabled/afs/athena.mit.edu/activity/e/eastgate/web_scripts
+		SuExecUserGroup eastgate eastgate
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/eastgate.pem
+		SSLCertificateChainFile /etc/pki/tls/certs/eastgate.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/ec.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/ec.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/ec.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName ec.mit.edu
+	ServerAlias ec
+	DocumentRoot /afs/athena.mit.edu/activity/e/ec/web_scripts
+	Alias /~ec /afs/athena.mit.edu/activity/e/ec/web_scripts
+	SuExecUserGroup ec ec
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName ec.mit.edu
+		ServerAlias ec
+		DocumentRoot /afs/athena.mit.edu/activity/e/ec/web_scripts
+		Alias /~ec /afs/athena.mit.edu/activity/e/ec/web_scripts
+		SuExecUserGroup ec ec
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/ec.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName ec.mit.edu
+		ServerAlias ec
+		DocumentRoot /afs/athena.mit.edu/activity/e/ec/web_scripts
+		Alias /~ec /afs/athena.mit.edu/activity/e/ec/web_scripts
+		SuExecUserGroup ec ec
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/ec.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/familynet.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/familynet.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/familynet.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName familynet.mit.edu
+	ServerAlias familynet
+	DocumentRoot /afs/athena.mit.edu/org/f/familynet/web_scripts
+	Alias /~familynet /afs/athena.mit.edu/org/f/familynet/web_scripts
+	SuExecUserGroup familynet familynet
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName familynet.mit.edu
+		ServerAlias familynet
+		DocumentRoot /afs/athena.mit.edu/org/f/familynet/web_scripts
+		Alias /~familynet /afs/athena.mit.edu/org/f/familynet/web_scripts
+		SuExecUserGroup familynet familynet
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/familynet.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName familynet.mit.edu
+		ServerAlias familynet
+		DocumentRoot /afs/athena.mit.edu/org/f/familynet/web_scripts
+		Alias /~familynet /afs/athena.mit.edu/org/f/familynet/web_scripts
+		SuExecUserGroup familynet familynet
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/familynet.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/finboard.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/finboard.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/finboard.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName finboard.mit.edu
+	ServerAlias finboard
+	DocumentRoot /afs/athena.mit.edu/activity/f/finboard/web_scripts/finboard
+	Alias /~finboard /afs/athena.mit.edu/activity/f/finboard/web_scripts
+	SuExecUserGroup finboard finboard
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName finboard.mit.edu
+		ServerAlias finboard
+		DocumentRoot /afs/athena.mit.edu/activity/f/finboard/web_scripts/finboard
+		Alias /~finboard /afs/athena.mit.edu/activity/f/finboard/web_scripts
+		SuExecUserGroup finboard finboard
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/finboard.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName finboard.mit.edu
+		ServerAlias finboard
+		DocumentRoot /afs/athena.mit.edu/activity/f/finboard/web_scripts/finboard
+		Alias /~finboard /afs/athena.mit.edu/activity/f/finboard/web_scripts
+		SuExecUserGroup finboard finboard
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/finboard.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/fridget.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/fridget.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/fridget.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName fridget.mit.edu
+	ServerAlias fridget
+	DocumentRoot /afs/athena.mit.edu/user/k/r/kristjan/web_scripts/fridget
+	Alias /~kristjan /afs/athena.mit.edu/user/k/r/kristjan/web_scripts
+	SuExecUserGroup kristjan kristjan
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName fridget.mit.edu
+		ServerAlias fridget
+		DocumentRoot /afs/athena.mit.edu/user/k/r/kristjan/web_scripts/fridget
+		Alias /~kristjan /afs/athena.mit.edu/user/k/r/kristjan/web_scripts
+		SuExecUserGroup kristjan kristjan
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/fridget.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName fridget.mit.edu
+		ServerAlias fridget
+		DocumentRoot /afs/athena.mit.edu/user/k/r/kristjan/web_scripts/fridget
+		Alias /~kristjan /afs/athena.mit.edu/user/k/r/kristjan/web_scripts
+		SuExecUserGroup kristjan kristjan
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/fridget.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/gsc.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/gsc.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/gsc.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName gsc.mit.edu
+	ServerAlias gsc
+	DocumentRoot /afs/athena.mit.edu/activity/g/gsc/web_scripts
+	Alias /~gsc /afs/athena.mit.edu/activity/g/gsc/web_scripts
+	SuExecUserGroup gsc gsc
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName gsc.mit.edu
+		ServerAlias gsc
+		DocumentRoot /afs/athena.mit.edu/activity/g/gsc/web_scripts
+		Alias /~gsc /afs/athena.mit.edu/activity/g/gsc/web_scripts
+		SuExecUserGroup gsc gsc
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/gsc.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName gsc.mit.edu
+		ServerAlias gsc
+		DocumentRoot /afs/athena.mit.edu/activity/g/gsc/web_scripts
+		Alias /~gsc /afs/athena.mit.edu/activity/g/gsc/web_scripts
+		SuExecUserGroup gsc gsc
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/gsc.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/hmmt.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/hmmt.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/hmmt.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName hmmt.mit.edu
+	ServerAlias hmmt
+	DocumentRoot /afs/athena.mit.edu/activity/h/hmmt/web_scripts
+	Alias /~hmmt /afs/athena.mit.edu/activity/h/hmmt/web_scripts
+	SuExecUserGroup hmmt hmmt
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName hmmt.mit.edu
+		ServerAlias hmmt
+		DocumentRoot /afs/athena.mit.edu/activity/h/hmmt/web_scripts
+		Alias /~hmmt /afs/athena.mit.edu/activity/h/hmmt/web_scripts
+		SuExecUserGroup hmmt hmmt
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/hmmt.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName hmmt.mit.edu
+		ServerAlias hmmt
+		DocumentRoot /afs/athena.mit.edu/activity/h/hmmt/web_scripts
+		Alias /~hmmt /afs/athena.mit.edu/activity/h/hmmt/web_scripts
+		SuExecUserGroup hmmt hmmt
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/hmmt.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/impact.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/impact.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/impact.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName impact.mit.edu
+	ServerAlias impact
+	DocumentRoot /afs/athena.mit.edu/org/m/mitimpact/web_scripts
+	Alias /~mitimpact /afs/athena.mit.edu/org/m/mitimpact/web_scripts
+	SuExecUserGroup mitimpact mitimpact
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName impact.mit.edu
+		ServerAlias impact
+		DocumentRoot /afs/athena.mit.edu/org/m/mitimpact/web_scripts
+		Alias /~mitimpact /afs/athena.mit.edu/org/m/mitimpact/web_scripts
+		SuExecUserGroup mitimpact mitimpact
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/impact.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName impact.mit.edu
+		ServerAlias impact
+		DocumentRoot /afs/athena.mit.edu/org/m/mitimpact/web_scripts
+		Alias /~mitimpact /afs/athena.mit.edu/org/m/mitimpact/web_scripts
+		SuExecUserGroup mitimpact mitimpact
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/impact.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/isawyou.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/isawyou.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/isawyou.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName isawyou.mit.edu
+	ServerAlias isawyou
+	DocumentRoot /afs/sipb.mit.edu/contrib/isawyou/web_scripts
+	Alias /~isawyou /afs/sipb.mit.edu/contrib/isawyou/web_scripts
+	SuExecUserGroup isawyou isawyou
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName isawyou.mit.edu
+		ServerAlias isawyou
+		DocumentRoot /afs/sipb.mit.edu/contrib/isawyou/web_scripts
+		Alias /~isawyou /afs/sipb.mit.edu/contrib/isawyou/web_scripts
+		SuExecUserGroup isawyou isawyou
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/isawyou.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName isawyou.mit.edu
+		ServerAlias isawyou
+		DocumentRoot /afs/sipb.mit.edu/contrib/isawyou/web_scripts
+		Alias /~isawyou /afs/sipb.mit.edu/contrib/isawyou/web_scripts
+		SuExecUserGroup isawyou isawyou
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/isawyou.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/ldpreload.com.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/ldpreload.com.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/ldpreload.com.conf	(revision 2244)
@@ -0,0 +1,36 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName ldpreload.com
+	ServerAlias www.ldpreload.com
+	DocumentRoot /afs/athena.mit.edu/user/g/e/geofft/web_scripts/geofft
+	Alias /~geofft /afs/athena.mit.edu/user/g/e/geofft/web_scripts
+	SuExecUserGroup geofft geofft
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName ldpreload.com
+		ServerAlias www.ldpreload.com
+		DocumentRoot /afs/athena.mit.edu/user/g/e/geofft/web_scripts/geofft
+		Alias /~geofft /afs/athena.mit.edu/user/g/e/geofft/web_scripts
+		SuExecUserGroup geofft geofft
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/ldpreload.com.pem
+		SSLCertificateChainFile /etc/pki/tls/certs/ldpreload.com.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName ldpreload.com
+		ServerAlias www.ldpreload.com
+		DocumentRoot /afs/athena.mit.edu/user/g/e/geofft/web_scripts/geofft
+		Alias /~geofft /afs/athena.mit.edu/user/g/e/geofft/web_scripts
+		SuExecUserGroup geofft geofft
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/ldpreload.com.pem
+		SSLCertificateChainFile /etc/pki/tls/certs/ldpreload.com.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/listmon.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/listmon.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/listmon.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName listmon.mit.edu
+	ServerAlias listmon
+	DocumentRoot /afs/athena.mit.edu/user/a/s/aseering/web_scripts/listmon
+	Alias /~aseering /afs/athena.mit.edu/user/a/s/aseering/web_scripts
+	SuExecUserGroup aseering aseering
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName listmon.mit.edu
+		ServerAlias listmon
+		DocumentRoot /afs/athena.mit.edu/user/a/s/aseering/web_scripts/listmon
+		Alias /~aseering /afs/athena.mit.edu/user/a/s/aseering/web_scripts
+		SuExecUserGroup aseering aseering
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/listmon.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName listmon.mit.edu
+		ServerAlias listmon
+		DocumentRoot /afs/athena.mit.edu/user/a/s/aseering/web_scripts/listmon
+		Alias /~aseering /afs/athena.mit.edu/user/a/s/aseering/web_scripts
+		SuExecUserGroup aseering aseering
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/listmon.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/maseeh.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/maseeh.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/maseeh.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName maseeh.mit.edu
+	ServerAlias maseeh
+	DocumentRoot /afs/athena.mit.edu/activity/m/maseeh/web_scripts/www
+	Alias /~maseeh /afs/athena.mit.edu/activity/m/maseeh/web_scripts
+	SuExecUserGroup maseeh maseeh
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName maseeh.mit.edu
+		ServerAlias maseeh
+		DocumentRoot /afs/athena.mit.edu/activity/m/maseeh/web_scripts/www
+		Alias /~maseeh /afs/athena.mit.edu/activity/m/maseeh/web_scripts
+		SuExecUserGroup maseeh maseeh
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/maseeh.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName maseeh.mit.edu
+		ServerAlias maseeh
+		DocumentRoot /afs/athena.mit.edu/activity/m/maseeh/web_scripts/www
+		Alias /~maseeh /afs/athena.mit.edu/activity/m/maseeh/web_scripts
+		SuExecUserGroup maseeh maseeh
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/maseeh.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/metu.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/metu.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/metu.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName metu.mit.edu
+	ServerAlias metu
+	DocumentRoot /afs/athena.mit.edu/org/m/metu/web_scripts/openings
+	Alias /~metu /afs/athena.mit.edu/org/m/metu/web_scripts
+	SuExecUserGroup metu metu
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName metu.mit.edu
+		ServerAlias metu
+		DocumentRoot /afs/athena.mit.edu/org/m/metu/web_scripts/openings
+		Alias /~metu /afs/athena.mit.edu/org/m/metu/web_scripts
+		SuExecUserGroup metu metu
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/metu.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName metu.mit.edu
+		ServerAlias metu
+		DocumentRoot /afs/athena.mit.edu/org/m/metu/web_scripts/openings
+		Alias /~metu /afs/athena.mit.edu/org/m/metu/web_scripts
+		SuExecUserGroup metu metu
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/metu.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/mitsoc.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/mitsoc.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/mitsoc.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName mitsoc.mit.edu
+	ServerAlias mitsoc
+	DocumentRoot /afs/athena.mit.edu/activity/m/mitsoc/web_scripts
+	Alias /~mitsoc /afs/athena.mit.edu/activity/m/mitsoc/web_scripts
+	SuExecUserGroup mitsoc mitsoc
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName mitsoc.mit.edu
+		ServerAlias mitsoc
+		DocumentRoot /afs/athena.mit.edu/activity/m/mitsoc/web_scripts
+		Alias /~mitsoc /afs/athena.mit.edu/activity/m/mitsoc/web_scripts
+		SuExecUserGroup mitsoc mitsoc
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/mitsoc.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName mitsoc.mit.edu
+		ServerAlias mitsoc
+		DocumentRoot /afs/athena.mit.edu/activity/m/mitsoc/web_scripts
+		Alias /~mitsoc /afs/athena.mit.edu/activity/m/mitsoc/web_scripts
+		SuExecUserGroup mitsoc mitsoc
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/mitsoc.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/next.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/next.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/next.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName next.mit.edu
+	ServerAlias next
+	DocumentRoot /afs/athena.mit.edu/activity/n/next/web_scripts/root
+	Alias /~next /afs/athena.mit.edu/activity/n/next/web_scripts
+	SuExecUserGroup next next
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName next.mit.edu
+		ServerAlias next
+		DocumentRoot /afs/athena.mit.edu/activity/n/next/web_scripts/root
+		Alias /~next /afs/athena.mit.edu/activity/n/next/web_scripts
+		SuExecUserGroup next next
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/next.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName next.mit.edu
+		ServerAlias next
+		DocumentRoot /afs/athena.mit.edu/activity/n/next/web_scripts/root
+		Alias /~next /afs/athena.mit.edu/activity/n/next/web_scripts
+		SuExecUserGroup next next
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/next.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/nudelta.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/nudelta.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/nudelta.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName nudelta.mit.edu
+	ServerAlias nudelta
+	DocumentRoot /afs/athena.mit.edu/activity/n/ndelta/web_scripts/www
+	Alias /~ndelta /afs/athena.mit.edu/activity/n/ndelta/web_scripts
+	SuExecUserGroup ndelta ndelta
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName nudelta.mit.edu
+		ServerAlias nudelta
+		DocumentRoot /afs/athena.mit.edu/activity/n/ndelta/web_scripts/www
+		Alias /~ndelta /afs/athena.mit.edu/activity/n/ndelta/web_scripts
+		SuExecUserGroup ndelta ndelta
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/nudelta.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName nudelta.mit.edu
+		ServerAlias nudelta
+		DocumentRoot /afs/athena.mit.edu/activity/n/ndelta/web_scripts/www
+		Alias /~ndelta /afs/athena.mit.edu/activity/n/ndelta/web_scripts
+		SuExecUserGroup ndelta ndelta
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/nudelta.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/peoplesearch.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/peoplesearch.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/peoplesearch.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName peoplesearch.mit.edu
+	ServerAlias peoplesearch
+	DocumentRoot /afs/athena.mit.edu/user/d/c/dchang/web_scripts/lookup
+	Alias /~dchang /afs/athena.mit.edu/user/d/c/dchang/web_scripts
+	SuExecUserGroup dchang dchang
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName peoplesearch.mit.edu
+		ServerAlias peoplesearch
+		DocumentRoot /afs/athena.mit.edu/user/d/c/dchang/web_scripts/lookup
+		Alias /~dchang /afs/athena.mit.edu/user/d/c/dchang/web_scripts
+		SuExecUserGroup dchang dchang
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/peoplesearch.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName peoplesearch.mit.edu
+		ServerAlias peoplesearch
+		DocumentRoot /afs/athena.mit.edu/user/d/c/dchang/web_scripts/lookup
+		Alias /~dchang /afs/athena.mit.edu/user/d/c/dchang/web_scripts
+		SuExecUserGroup dchang dchang
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/peoplesearch.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/picker.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/picker.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/picker.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName picker.mit.edu
+	ServerAlias picker
+	DocumentRoot /afs/athena.mit.edu/course/urop/picker/web_scripts
+	Alias /~picker /afs/athena.mit.edu/course/urop/picker/web_scripts
+	SuExecUserGroup picker picker
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName picker.mit.edu
+		ServerAlias picker
+		DocumentRoot /afs/athena.mit.edu/course/urop/picker/web_scripts
+		Alias /~picker /afs/athena.mit.edu/course/urop/picker/web_scripts
+		SuExecUserGroup picker picker
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/picker.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName picker.mit.edu
+		ServerAlias picker
+		DocumentRoot /afs/athena.mit.edu/course/urop/picker/web_scripts
+		Alias /~picker /afs/athena.mit.edu/course/urop/picker/web_scripts
+		SuExecUserGroup picker picker
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/picker.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/pickr.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/pickr.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/pickr.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName pickr.mit.edu
+	ServerAlias pickr
+	DocumentRoot /afs/athena.mit.edu/course/urop/picker/web_scripts
+	Alias /~picker /afs/athena.mit.edu/course/urop/picker/web_scripts
+	SuExecUserGroup picker picker
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName pickr.mit.edu
+		ServerAlias pickr
+		DocumentRoot /afs/athena.mit.edu/course/urop/picker/web_scripts
+		Alias /~picker /afs/athena.mit.edu/course/urop/picker/web_scripts
+		SuExecUserGroup picker picker
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/pickr.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName pickr.mit.edu
+		ServerAlias pickr
+		DocumentRoot /afs/athena.mit.edu/course/urop/picker/web_scripts
+		Alias /~picker /afs/athena.mit.edu/course/urop/picker/web_scripts
+		SuExecUserGroup picker picker
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/pickr.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/psetcentral.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/psetcentral.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/psetcentral.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName psetcentral.mit.edu
+	ServerAlias psetcentral
+	DocumentRoot /afs/athena.mit.edu/course/21/21w785/web_scripts/psetcentral
+	Alias /~21w785 /afs/athena.mit.edu/course/21/21w785/web_scripts
+	SuExecUserGroup 21w785 21w785
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName psetcentral.mit.edu
+		ServerAlias psetcentral
+		DocumentRoot /afs/athena.mit.edu/course/21/21w785/web_scripts/psetcentral
+		Alias /~21w785 /afs/athena.mit.edu/course/21/21w785/web_scripts
+		SuExecUserGroup 21w785 21w785
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/psetcentral.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName psetcentral.mit.edu
+		ServerAlias psetcentral
+		DocumentRoot /afs/athena.mit.edu/course/21/21w785/web_scripts/psetcentral
+		Alias /~21w785 /afs/athena.mit.edu/course/21/21w785/web_scripts
+		SuExecUserGroup 21w785 21w785
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/psetcentral.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/random-hall.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/random-hall.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/random-hall.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName random-hall.mit.edu
+	ServerAlias random-hall
+	DocumentRoot /afs/athena.mit.edu/activity/r/random-hall/web_scripts
+	Alias /~random-hall /afs/athena.mit.edu/activity/r/random-hall/web_scripts
+	SuExecUserGroup random-hall random-hall
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName random-hall.mit.edu
+		ServerAlias random-hall
+		DocumentRoot /afs/athena.mit.edu/activity/r/random-hall/web_scripts
+		Alias /~random-hall /afs/athena.mit.edu/activity/r/random-hall/web_scripts
+		SuExecUserGroup random-hall random-hall
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/random-hall.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName random-hall.mit.edu
+		ServerAlias random-hall
+		DocumentRoot /afs/athena.mit.edu/activity/r/random-hall/web_scripts
+		Alias /~random-hall /afs/athena.mit.edu/activity/r/random-hall/web_scripts
+		SuExecUserGroup random-hall random-hall
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/random-hall.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/reify-vhost.py
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/reify-vhost.py	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/reify-vhost.py	(revision 2244)
@@ -0,0 +1,89 @@
+#!/usr/bin/python
+#
+# Converts an apacheConfig record from LDAP, as used by mod_vhost_ldap,
+# into a <VirtualHost> record as used in an Apache conf.d directory.
+# Useful for adding things like SSL server certs that mod_vhost_ldap
+# doesn't support.
+#
+# Usage:
+# scripts# cd /etc/httpd/vhosts.d
+# scripts# ./reify-vhost.py geofft > geofft.conf
+# scripts# service httpd graceful
+# 
+# Geoffrey Thomas <geofft@mit.edu>, 2008, public domain.
+
+# Note: As of 1/2011 we are inserting SSLCertificateKeyFile into reified
+# hosts, because previously-acqured certificates were signed with an
+# older (1024-bit) key. Sometime around 2014 when our last cert with
+# this key expires, we can update /etc/httpd/conf/httpd.conf to point to
+# the current key instead of the old one, and stop inserting this into
+# individual vhost records. -geofft
+
+import ldap
+import ldap.filter
+import pwd
+import sys
+
+ll = ldap.initialize("ldapi://%2fvar%2frun%2fslapd-scripts.socket/")
+ll.simple_bind_s("", "")
+
+host = sys.argv[1]
+
+r = ll.search_s(
+    "ou=VirtualHosts,dc=scripts,dc=mit,dc=edu",
+    ldap.SCOPE_SUBTREE,
+    ldap.filter.filter_format(
+            "(&(objectClass=apacheConfig)" +
+            "(|(apacheServerName=%s)" +
+            "(apacheServerAlias=%s)))",
+           [host, host]))
+if len(r) != 0:
+    user = pwd.getpwuid(int(r[0][1]['apacheSuexecUid'][0]))
+    serveralias = ""
+    if 'apacheServerAlias' in r[0][1]:
+        serveralias = "ServerAlias "+" ".join(r[0][1]['apacheServerAlias'])
+    print """# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName %(servername)s
+	%(serveralias)s
+	DocumentRoot %(docroot)s
+	Alias /~%(uname)s %(homedir)s/web_scripts
+	SuExecUserGroup %(uname)s %(uname)s
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName %(servername)s
+		%(serveralias)s
+		DocumentRoot %(docroot)s
+		Alias /~%(uname)s %(homedir)s/web_scripts
+		SuExecUserGroup %(uname)s %(uname)s
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/%(hname)s.pem
+		SSLCertificateChainFile /etc/pki/tls/certs/%(hname)s.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName %(servername)s
+		%(serveralias)s
+		DocumentRoot %(docroot)s
+		Alias /~%(uname)s %(homedir)s/web_scripts
+		SuExecUserGroup %(uname)s %(uname)s
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/%(hname)s.pem
+		SSLCertificateChainFile /etc/pki/tls/certs/%(hname)s.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>""" % {
+    'servername': r[0][1]['apacheServerName'][0],
+    'serveralias': serveralias,
+    'docroot': r[0][1]['apacheDocumentRoot'][0],
+    'uname': user[0],
+    'homedir': user[5],
+    'hname': host
+}
+
+# vim: set ts=4 sw=4 et:
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/rpl.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/rpl.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/rpl.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName rpl.mit.edu
+	ServerAlias rpl
+	DocumentRoot /afs/athena.mit.edu/org/r/rpl/web_scripts
+	Alias /~rpl /afs/athena.mit.edu/org/r/rpl/web_scripts
+	SuExecUserGroup rpl rpl
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName rpl.mit.edu
+		ServerAlias rpl
+		DocumentRoot /afs/athena.mit.edu/org/r/rpl/web_scripts
+		Alias /~rpl /afs/athena.mit.edu/org/r/rpl/web_scripts
+		SuExecUserGroup rpl rpl
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/rpl.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName rpl.mit.edu
+		ServerAlias rpl
+		DocumentRoot /afs/athena.mit.edu/org/r/rpl/web_scripts
+		Alias /~rpl /afs/athena.mit.edu/org/r/rpl/web_scripts
+		SuExecUserGroup rpl rpl
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/rpl.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/sayno.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/sayno.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/sayno.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName sayno.mit.edu
+	ServerAlias sayno
+	DocumentRoot /afs/sipb.mit.edu/contrib/cfs/web_scripts/sayno
+	Alias /~cfs /afs/sipb.mit.edu/contrib/cfs/web_scripts
+	SuExecUserGroup cfs cfs
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName sayno.mit.edu
+		ServerAlias sayno
+		DocumentRoot /afs/sipb.mit.edu/contrib/cfs/web_scripts/sayno
+		Alias /~cfs /afs/sipb.mit.edu/contrib/cfs/web_scripts
+		SuExecUserGroup cfs cfs
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/sayno.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName sayno.mit.edu
+		ServerAlias sayno
+		DocumentRoot /afs/sipb.mit.edu/contrib/cfs/web_scripts/sayno
+		Alias /~cfs /afs/sipb.mit.edu/contrib/cfs/web_scripts
+		SuExecUserGroup cfs cfs
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/sayno.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/schuh.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/schuh.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/schuh.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName schuh.mit.edu
+	ServerAlias schuh
+	DocumentRoot /afs/athena.mit.edu/org/s/schuhgroup/web_scripts
+	Alias /~schuhgroup /afs/athena.mit.edu/org/s/schuhgroup/web_scripts
+	SuExecUserGroup schuhgroup schuhgroup
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName schuh.mit.edu
+		ServerAlias schuh
+		DocumentRoot /afs/athena.mit.edu/org/s/schuhgroup/web_scripts
+		Alias /~schuhgroup /afs/athena.mit.edu/org/s/schuhgroup/web_scripts
+		SuExecUserGroup schuhgroup schuhgroup
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/schuh.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName schuh.mit.edu
+		ServerAlias schuh
+		DocumentRoot /afs/athena.mit.edu/org/s/schuhgroup/web_scripts
+		Alias /~schuhgroup /afs/athena.mit.edu/org/s/schuhgroup/web_scripts
+		SuExecUserGroup schuhgroup schuhgroup
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/schuh.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/signup.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/signup.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/signup.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName signup.mit.edu
+	ServerAlias signup
+	DocumentRoot /afs/athena.mit.edu/user/d/h/dheera/web_scripts/signup
+	Alias /~dheera /afs/athena.mit.edu/user/d/h/dheera/web_scripts
+	SuExecUserGroup dheera dheera
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName signup.mit.edu
+		ServerAlias signup
+		DocumentRoot /afs/athena.mit.edu/user/d/h/dheera/web_scripts/signup
+		Alias /~dheera /afs/athena.mit.edu/user/d/h/dheera/web_scripts
+		SuExecUserGroup dheera dheera
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/signup.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName signup.mit.edu
+		ServerAlias signup
+		DocumentRoot /afs/athena.mit.edu/user/d/h/dheera/web_scripts/signup
+		Alias /~dheera /afs/athena.mit.edu/user/d/h/dheera/web_scripts
+		SuExecUserGroup dheera dheera
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/signup.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/sipb.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/sipb.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/sipb.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName sipb.mit.edu
+	ServerAlias sipb sipb.org www.sipb.org
+	DocumentRoot /afs/sipb.mit.edu/project/sipb-www/web_scripts/sipb
+	Alias /~sipb-www /afs/sipb.mit.edu/project/sipb-www/web_scripts
+	SuExecUserGroup sipb-www sipb-www
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName sipb.mit.edu
+		ServerAlias sipb sipb.org www.sipb.org
+		DocumentRoot /afs/sipb.mit.edu/project/sipb-www/web_scripts/sipb
+		Alias /~sipb-www /afs/sipb.mit.edu/project/sipb-www/web_scripts
+		SuExecUserGroup sipb-www sipb-www
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/sipb.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName sipb.mit.edu
+		ServerAlias sipb sipb.org www.sipb.org
+		DocumentRoot /afs/sipb.mit.edu/project/sipb-www/web_scripts/sipb
+		Alias /~sipb-www /afs/sipb.mit.edu/project/sipb-www/web_scripts
+		SuExecUserGroup sipb-www sipb-www
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/sipb.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/stalk.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/stalk.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/stalk.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName stalk.mit.edu
+	ServerAlias stalk
+	DocumentRoot /afs/athena.mit.edu/user/d/c/dchang/web_scripts/lookup
+	Alias /~dchang /afs/athena.mit.edu/user/d/c/dchang/web_scripts
+	SuExecUserGroup dchang dchang
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName stalk.mit.edu
+		ServerAlias stalk
+		DocumentRoot /afs/athena.mit.edu/user/d/c/dchang/web_scripts/lookup
+		Alias /~dchang /afs/athena.mit.edu/user/d/c/dchang/web_scripts
+		SuExecUserGroup dchang dchang
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/stalk.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName stalk.mit.edu
+		ServerAlias stalk
+		DocumentRoot /afs/athena.mit.edu/user/d/c/dchang/web_scripts/lookup
+		Alias /~dchang /afs/athena.mit.edu/user/d/c/dchang/web_scripts
+		SuExecUserGroup dchang dchang
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/stalk.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/swe.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/swe.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/swe.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName swe.mit.edu
+	ServerAlias swe
+	DocumentRoot /afs/athena.mit.edu/activity/s/swe/web_scripts
+	Alias /~swe /afs/athena.mit.edu/activity/s/swe/web_scripts
+	SuExecUserGroup swe swe
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName swe.mit.edu
+		ServerAlias swe
+		DocumentRoot /afs/athena.mit.edu/activity/s/swe/web_scripts
+		Alias /~swe /afs/athena.mit.edu/activity/s/swe/web_scripts
+		SuExecUserGroup swe swe
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/swe.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName swe.mit.edu
+		ServerAlias swe
+		DocumentRoot /afs/athena.mit.edu/activity/s/swe/web_scripts
+		Alias /~swe /afs/athena.mit.edu/activity/s/swe/web_scripts
+		SuExecUserGroup swe swe
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/swe.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/techfair.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/techfair.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/techfair.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName techfair.mit.edu
+	ServerAlias techfair
+	DocumentRoot /afs/athena.mit.edu/activity/t/techfair/web_scripts
+	Alias /~techfair /afs/athena.mit.edu/activity/t/techfair/web_scripts
+	SuExecUserGroup techfair techfair
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName techfair.mit.edu
+		ServerAlias techfair
+		DocumentRoot /afs/athena.mit.edu/activity/t/techfair/web_scripts
+		Alias /~techfair /afs/athena.mit.edu/activity/t/techfair/web_scripts
+		SuExecUserGroup techfair techfair
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/techfair.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName techfair.mit.edu
+		ServerAlias techfair
+		DocumentRoot /afs/athena.mit.edu/activity/t/techfair/web_scripts
+		Alias /~techfair /afs/athena.mit.edu/activity/t/techfair/web_scripts
+		SuExecUserGroup techfair techfair
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/techfair.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/template
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/template	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/template	(revision 2244)
@@ -0,0 +1,32 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName hname.mit.edu
+	ServerAlias hname
+	DocumentRoot /afs/athena.mit.edu/path/web_scripts/subdir
+	Alias /~uname /afs/athena.mit.edu/path/web_scripts
+	SuExecUserGroup uname uname
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName hname.mit.edu
+		ServerAlias hname
+		DocumentRoot /afs/athena.mit.edu/path/web_scripts/subdir
+		Alias /~uname /afs/athena.mit.edu/path/web_scripts
+		SuExecUserGroup uname uname
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/hname.pem
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName hname.mit.edu
+		ServerAlias hname
+		DocumentRoot /afs/athena.mit.edu/path/web_scripts/subdir
+		Alias /~uname /afs/athena.mit.edu/path/web_scripts
+		SuExecUserGroup uname uname
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/hname.pem
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/tf.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/tf.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/tf.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName tf.mit.edu
+	ServerAlias tf
+	DocumentRoot /afs/athena.mit.edu/activity/t/techfair/web_scripts
+	Alias /~techfair /afs/athena.mit.edu/activity/t/techfair/web_scripts
+	SuExecUserGroup techfair techfair
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName tf.mit.edu
+		ServerAlias tf
+		DocumentRoot /afs/athena.mit.edu/activity/t/techfair/web_scripts
+		Alias /~techfair /afs/athena.mit.edu/activity/t/techfair/web_scripts
+		SuExecUserGroup techfair techfair
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/tf.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName tf.mit.edu
+		ServerAlias tf
+		DocumentRoot /afs/athena.mit.edu/activity/t/techfair/web_scripts
+		Alias /~techfair /afs/athena.mit.edu/activity/t/techfair/web_scripts
+		SuExecUserGroup techfair techfair
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/tf.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/tibetforum.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/tibetforum.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/tibetforum.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName tibetforum.mit.edu
+	ServerAlias tibetforum
+	DocumentRoot /afs/athena.mit.edu/activity/c/cssa/web_scripts/phpbb
+	Alias /~cssa /afs/athena.mit.edu/activity/c/cssa/web_scripts
+	SuExecUserGroup cssa cssa
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName tibetforum.mit.edu
+		ServerAlias tibetforum
+		DocumentRoot /afs/athena.mit.edu/activity/c/cssa/web_scripts/phpbb
+		Alias /~cssa /afs/athena.mit.edu/activity/c/cssa/web_scripts
+		SuExecUserGroup cssa cssa
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/tibetforum.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName tibetforum.mit.edu
+		ServerAlias tibetforum
+		DocumentRoot /afs/athena.mit.edu/activity/c/cssa/web_scripts/phpbb
+		Alias /~cssa /afs/athena.mit.edu/activity/c/cssa/web_scripts
+		SuExecUserGroup cssa cssa
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/tibetforum.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/ties.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/ties.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/ties.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName ties.mit.edu
+	ServerAlias ties
+	DocumentRoot /afs/athena.mit.edu/user/n/a/nagaraj/web_scripts/ties
+	Alias /~nagaraj /afs/athena.mit.edu/user/n/a/nagaraj/web_scripts
+	SuExecUserGroup nagaraj nagaraj
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName ties.mit.edu
+		ServerAlias ties
+		DocumentRoot /afs/athena.mit.edu/user/n/a/nagaraj/web_scripts/ties
+		Alias /~nagaraj /afs/athena.mit.edu/user/n/a/nagaraj/web_scripts
+		SuExecUserGroup nagaraj nagaraj
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/ties.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName ties.mit.edu
+		ServerAlias ties
+		DocumentRoot /afs/athena.mit.edu/user/n/a/nagaraj/web_scripts/ties
+		Alias /~nagaraj /afs/athena.mit.edu/user/n/a/nagaraj/web_scripts
+		SuExecUserGroup nagaraj nagaraj
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/ties.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/tours.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/tours.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/tours.conf	(revision 2244)
@@ -0,0 +1,36 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName tours.mit.edu
+	ServerAlias tours
+	DocumentRoot /afs/athena.mit.edu/org/t/tours/web_scripts
+	Alias /~tours /afs/athena.mit.edu/org/t/tours/web_scripts
+	SuExecUserGroup tours tours
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName tours.mit.edu
+		ServerAlias tours
+		DocumentRoot /afs/athena.mit.edu/org/t/tours/web_scripts
+		Alias /~tours /afs/athena.mit.edu/org/t/tours/web_scripts
+		SuExecUserGroup tours tours
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/tours.pem
+		SSLCertificateChainFile /etc/pki/tls/certs/tours.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName tours.mit.edu
+		ServerAlias tours
+		DocumentRoot /afs/athena.mit.edu/org/t/tours/web_scripts
+		Alias /~tours /afs/athena.mit.edu/org/t/tours/web_scripts
+		SuExecUserGroup tours tours
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/tours.pem
+		SSLCertificateChainFile /etc/pki/tls/certs/tours.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/twentytwelve.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/twentytwelve.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/twentytwelve.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName twentytwelve.mit.edu
+	ServerAlias twentytwelve
+	DocumentRoot /afs/athena.mit.edu/activity/other/2012/web_scripts
+	Alias /~2012 /afs/athena.mit.edu/activity/other/2012/web_scripts
+	SuExecUserGroup 2012 2012
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName twentytwelve.mit.edu
+		ServerAlias twentytwelve
+		DocumentRoot /afs/athena.mit.edu/activity/other/2012/web_scripts
+		Alias /~2012 /afs/athena.mit.edu/activity/other/2012/web_scripts
+		SuExecUserGroup 2012 2012
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/twentytwelve.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName twentytwelve.mit.edu
+		ServerAlias twentytwelve
+		DocumentRoot /afs/athena.mit.edu/activity/other/2012/web_scripts
+		Alias /~2012 /afs/athena.mit.edu/activity/other/2012/web_scripts
+		SuExecUserGroup 2012 2012
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/twentytwelve.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/ua.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/ua.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/ua.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName ua.mit.edu
+	ServerAlias ua
+	DocumentRoot /afs/athena.mit.edu/activity/u/ua/web_scripts/wiki
+	Alias /~ua /afs/athena.mit.edu/activity/u/ua/web_scripts
+	SuExecUserGroup ua ua
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName ua.mit.edu
+		ServerAlias ua
+		DocumentRoot /afs/athena.mit.edu/activity/u/ua/web_scripts/wiki
+		Alias /~ua /afs/athena.mit.edu/activity/u/ua/web_scripts
+		SuExecUserGroup ua ua
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/ua.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName ua.mit.edu
+		ServerAlias ua
+		DocumentRoot /afs/athena.mit.edu/activity/u/ua/web_scripts/wiki
+		Alias /~ua /afs/athena.mit.edu/activity/u/ua/web_scripts
+		SuExecUserGroup ua ua
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/ua.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/wakeup.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/wakeup.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/wakeup.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName wakeup.mit.edu
+	ServerAlias wakeup
+	DocumentRoot /afs/sipb.mit.edu/project/voip/web_scripts/wakeup
+	Alias /~sipb-voip /afs/sipb.mit.edu/project/voip/web_scripts
+	SuExecUserGroup sipb-voip sipb-voip
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName wakeup.mit.edu
+		ServerAlias wakeup
+		DocumentRoot /afs/sipb.mit.edu/project/voip/web_scripts/wakeup
+		Alias /~sipb-voip /afs/sipb.mit.edu/project/voip/web_scripts
+		SuExecUserGroup sipb-voip sipb-voip
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/wakeup.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName wakeup.mit.edu
+		ServerAlias wakeup
+		DocumentRoot /afs/sipb.mit.edu/project/voip/web_scripts/wakeup
+		Alias /~sipb-voip /afs/sipb.mit.edu/project/voip/web_scripts
+		SuExecUserGroup sipb-voip sipb-voip
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/wakeup.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/westgate.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/westgate.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/westgate.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName westgate.mit.edu
+	ServerAlias westgate
+	DocumentRoot /afs/athena.mit.edu/activity/w/westgate/web_scripts
+	Alias /~westgate /afs/athena.mit.edu/activity/w/westgate/web_scripts
+	SuExecUserGroup westgate westgate
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName westgate.mit.edu
+		ServerAlias westgate
+		DocumentRoot /afs/athena.mit.edu/activity/w/westgate/web_scripts
+		Alias /~westgate /afs/athena.mit.edu/activity/w/westgate/web_scripts
+		SuExecUserGroup westgate westgate
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/westgate.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName westgate.mit.edu
+		ServerAlias westgate
+		DocumentRoot /afs/athena.mit.edu/activity/w/westgate/web_scripts
+		Alias /~westgate /afs/athena.mit.edu/activity/w/westgate/web_scripts
+		SuExecUserGroup westgate westgate
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/westgate.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/whatsnext.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/whatsnext.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/httpd/vhosts.d/whatsnext.conf	(revision 2244)
@@ -0,0 +1,34 @@
+# do not trailing-slash DocumentRoot
+
+<VirtualHost *:80>
+	ServerName whatsnext.mit.edu
+	ServerAlias whatsnext
+	DocumentRoot /afs/sipb.mit.edu/contrib/cfs/web_scripts
+	Alias /~cfs /afs/sipb.mit.edu/contrib/cfs/web_scripts
+	SuExecUserGroup cfs cfs
+	Include conf.d/vhosts-common.conf
+</VirtualHost>
+
+<IfModule ssl_module>
+	<VirtualHost *:443>
+		ServerName whatsnext.mit.edu
+		ServerAlias whatsnext
+		DocumentRoot /afs/sipb.mit.edu/contrib/cfs/web_scripts
+		Alias /~cfs /afs/sipb.mit.edu/contrib/cfs/web_scripts
+		SuExecUserGroup cfs cfs
+		Include conf.d/vhosts-common-ssl.conf
+		SSLCertificateFile /etc/pki/tls/certs/whatsnext.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+	<VirtualHost *:444>
+		ServerName whatsnext.mit.edu
+		ServerAlias whatsnext
+		DocumentRoot /afs/sipb.mit.edu/contrib/cfs/web_scripts
+		Alias /~cfs /afs/sipb.mit.edu/contrib/cfs/web_scripts
+		SuExecUserGroup cfs cfs
+		Include conf.d/vhosts-common-ssl.conf
+		Include conf.d/vhosts-common-ssl-cert.conf
+		SSLCertificateFile /etc/pki/tls/certs/whatsnext.pem
+		SSLCertificateKeyFile /etc/pki/tls/private/scripts.key
+	</VirtualHost>
+</IfModule>
Index: tags/fc15-eol/server/fedora/config/etc/issue.net
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/issue.net	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/issue.net	(revision 2244)
@@ -0,0 +1,1 @@
+If you have trouble logging in, see http://scripts.mit.edu/faq/41/.
Index: tags/fc15-eol/server/fedora/config/etc/issue.net.no_tkt
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/issue.net.no_tkt	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/issue.net.no_tkt	(revision 2244)
@@ -0,0 +1,5 @@
+You must log in to the scripts service using Kerberos tickets, but
+your ssh client did not pass a valid ticket to the scripts server.
+
+See http://scripts.mit.edu/faq/41
+
Index: tags/fc15-eol/server/fedora/config/etc/issue.net.no_user
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/issue.net.no_user	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/issue.net.no_user	(revision 2244)
@@ -0,0 +1,3 @@
+You do not appear to be signed up for the scripts.mit.edu service.
+
+You may sign up at http://scripts.mit.edu/
Index: tags/fc15-eol/server/fedora/config/etc/krb5.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/krb5.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/krb5.conf	(revision 2244)
@@ -0,0 +1,117 @@
+[libdefaults]
+	allow_weak_crypto = true
+	default_realm = ATHENA.MIT.EDU
+# The following krb5.conf variables are only for MIT Kerberos.
+	krb4_config = /etc/krb.conf
+	krb4_realms = /etc/krb.realms
+	kdc_timesync = 1
+	ccache_type = 4
+	forwardable = true
+	proxiable = true
+	v4_instance_resolve = false
+	v4_name_convert = {
+		host = {
+			rcmd = host
+			ftp = ftp
+		}
+		plain = {
+			something = something-else
+		}
+	}
+
+[realms]
+	ATHENA.MIT.EDU = {
+		kdc = kerberos.mit.edu:88
+		kdc = kerberos-1.mit.edu:88
+		kdc = kerberos-2.mit.edu:88
+		kdc = kerberos-3.mit.edu:88
+		admin_server = kerberos.mit.edu
+		default_domain = mit.edu
+	}
+	MEDIA-LAB.MIT.EDU = {
+		kdc = kerberos.media.mit.edu
+		admin_server = kerberos.media.mit.edu
+	}
+	ZONE.MIT.EDU = {
+		kdc = casio.mit.edu
+		kdc = seiko.mit.edu
+		admin_server = casio.mit.edu
+	}
+	MOOF.MIT.EDU = {
+		kdc = three-headed-dogcow.mit.edu:88
+		kdc = three-headed-dogcow-1.mit.edu:88
+		admin_server = three-headed-dogcow.mit.edu
+	}
+	CYGNUS.COM = {
+		kdc = KERBEROS.CYGNUS.COM
+		kdc = KERBEROS-1.CYGNUS.COM
+		admin_server = KERBEROS.CYGNUS.COM
+	}
+	GREY17.ORG = {
+		kdc = kerberos.grey17.org
+		admin_server = kerberos.grey17.org
+	}
+	IHTFP.ORG = {
+		kdc = kerberos.ihtfp.org
+		admin_server = kerberos.ihtfp.org
+	}
+	GNU.ORG = {
+		kdc = kerberos.gnu.org
+		kdc = kerberos-2.gnu.org
+		kdc = kerberos-3.gnu.org
+		admin_server = kerberos.gnu.org
+	}
+	1TS.ORG = {
+		kdc = kerberos.1ts.org
+		admin_server = kerberos.1ts.org
+	}
+	GRATUITOUS.ORG = {
+		kdc = kerberos.gratuitous.org
+		admin_server = kerberos.gratuitous.org
+	}
+	DOOMCOM.ORG = {
+		kdc = kerberos.doomcom.org
+		admin_server = kerberos.doomcom.org
+	}
+	ANDREW.CMU.EDU = {
+		kdc = vice28.fs.andrew.cmu.edu
+		kdc = vice2.fs.andrew.cmu.edu
+		kdc = vice11.fs.andrew.cmu.edu
+		kdc = vice12.fs.andrew.cmu.edu
+		admin_server = vice28.fs.andrew.cmu.edu
+		default_domain = andrew.cmu.edu
+	}
+	CS.CMU.EDU = {
+		kdc = kerberos.cs.cmu.edu
+		kdc = kerberos-2.srv.cs.cmu.edu
+		admin_server = kerberos.cs.cmu.edu
+	}
+	DEMENTIA.ORG = {
+		kdc = kerberos.dementia.org
+		kdc = kerberos2.dementia.org
+		admin_server = kerberos.dementia.org
+	}
+	CSAIL.MIT.EDU = {
+		kdc = kerberos-1.csail.mit.edu
+		kdc = kerberos-2.csail.mit.edu
+		admin_server = kerberos.csail.mit.edu
+		default_domain = csail.mit.edu
+		krb524_server = krb524.csail.mit.edu
+	}
+
+[domain_realm]
+	.mit.edu = ATHENA.MIT.EDU
+	mit.edu = ATHENA.MIT.EDU
+	.media.mit.edu = MEDIA-LAB.MIT.EDU
+	media.mit.edu = MEDIA-LAB.MIT.EDU
+	.whoi.edu = ATHENA.MIT.EDU
+	whoi.edu = ATHENA.MIT.EDU
+	.csail.mit.edu = CSAIL.MIT.EDU
+        csail.mit.edu = CSAIL.MIT.EDU
+        .ai.mit.edu = CSAIL.MIT.EDU
+        ai.mit.edu = CSAIL.MIT.EDU
+	.stanford.edu = stanford.edu
+
+[login]
+	krb4_convert = true
+	krb4_get_tickets = true
Index: tags/fc15-eol/server/fedora/config/etc/logrotate.d/httpd
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/logrotate.d/httpd	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/logrotate.d/httpd	(revision 2244)
@@ -0,0 +1,22 @@
+/var/log/httpd/*.log /home/logview/*log {
+    rotate 0
+    daily
+    missingok
+    notifempty
+    create 640 root logview
+    sharedscripts
+    postrotate
+	/bin/kill -HUP `cat /var/run/httpd/httpd.pid 2>/dev/null` 2> /dev/null || true
+    endscript
+}
+
+/var/log/httpd/statistics_log {
+    rotate 14
+    daily
+    missingok
+    notifempty
+    sharedscripts
+    postrotate
+	/bin/kill -HUP `cat /var/run/httpd/httpd.pid 2>/dev/null` 2> /dev/null || true
+    endscript
+}
Index: tags/fc15-eol/server/fedora/config/etc/logwatch/scripts/services/named
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/logwatch/scripts/services/named	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/logwatch/scripts/services/named	(revision 2244)
@@ -0,0 +1,568 @@
+##########################################################################
+# $Id: named,v 1.52 2007/04/28 20:58:39 bjorn Exp $
+##########################################################################
+# $Log: named,v $
+# Revision 1.52  2007/04/28 20:58:39  bjorn
+# More generic RCODE handling - prints summary of unexpected DNS RCODEs.
+#
+# Revision 1.51  2007/04/15 20:03:25  bjorn
+# Filtering updating zones with views, based on submittal by
+# Jesper K. Pedersen.
+#
+# Revision 1.50  2007/02/16 03:36:25  bjorn
+# Filtering some D-BUS statements, by Ivana Varekova.
+#
+# Revision 1.49  2007/01/29 18:28:38  bjorn
+# Better formatting of output, by Markus Lude.
+#
+# Revision 1.48  2006/11/12 21:14:02  bjorn
+# Filtering 'transfer started' message, by Russell Coker / Tom London.
+#
+# Revision 1.47  2006/10/20 21:02:00  bjorn
+# Typo fixed by Alex S.
+#
+# Revision 1.46  2006/10/20 16:44:38  bjorn
+# Changed regexp to handle IPV6, by Willi Mann.
+#
+# Revision 1.45  2006/09/15 15:40:58  bjorn
+# Additional filtering by Ivana Varekova.
+#
+# Revision 1.44  2006/03/20 20:42:57  bjorn
+# Additional filtering, by Ivana Varekova.
+#
+# Revision 1.43  2005/11/30 05:01:44  bjorn
+# Don't search for info: string (for Debian), by Willi Mann.
+#
+# Revision 1.42  2005/11/24 16:48:30  bjorn
+# Handles additional statements, by Ivana Varekova.
+#
+# Revision 1.41  2005/09/29 15:02:52  bjorn
+# Filtering 'succeeded' by Ivana Varekova.
+#
+# Revision 1.40  2005/04/15 21:44:35  bjorn
+# testing from anonymous
+#
+# Revision 1.39  2005/04/15 21:36:59  bjorn
+# typo fixed in 'named' release during 2004
+#
+# Revision 1.38  2005/04/13 17:24:13  kirk
+# Test change
+#
+# Revision 1.37  2005/02/24 17:08:04  kirk
+# Applying consolidated patches from Mike Tremaine
+#
+# Revision 1.9  2005/02/21 19:09:52  mgt
+# Bump to 5.2.8 removed some cvs logs -mgt
+#
+# Revision 1.8  2005/02/16 00:43:28  mgt
+# Added #vi tag to everything, updated ignore.conf with comments, added emerge and netopia to the tree from Laurent -mgt
+#
+# Revision 1.7  2005/02/13 17:15:40  mgt
+# perl -w corrections for uninit stuff -mgt
+#
+# Revision 1.6  2004/10/11 18:14:47  mgt
+# update from Laurent -mgt
+#
+# Revision 1.41  2004/09/29 10:33:29  laurent Dufour <laurent.dufour@havas.com>
+# Removed some ^ in regex to prevent message not being in start on line to be matched
+# Added some check for error in named zone config file
+# Added some check for message not being matched
+#
+# Revision 1.4  2004/07/29 19:33:29  mgt
+# Chmod and removed perl call -mgt
+#
+# Revision 1.3  2004/07/10 01:54:35  mgt
+# sync with kirk -mgt
+#
+#########################################################################
+
+########################################################
+# This was written and is maintained by:
+#    Kirk Bauer <kirk@kaybee.org>
+#
+# Please send all comments, suggestions, bug reports,
+#    etc, to kirk@kaybee.org.
+########################################################
+
+use Logwatch ':ip';
+
+
+#$DoLookup = ValueOrDefault($ENV{'named_ip_lookup'}, 0);
+$Debug = ValueOrDefault($ENV{'LOGWATCH_DEBUG'}, 0);
+$Detail = ValueOrDefault($ENV{'LOGWATCH_DETAIL_LEVEL'}, 0);
+
+# Avoid "Use of uninitialized value" warning messages.
+sub ValueOrDefault {
+    my ($value, $default) = @_;
+    return ($value ? $value : $default);
+}
+
+if ( $Debug >= 5 ) {
+    print STDERR "\n\nDEBUG: Inside NAMED Filter \n\n";
+    $DebugCounter = 1;
+}
+
+
+while (defined($ThisLine = <STDIN>)) {
+ if ( $Debug >= 30 ) {
+        print STDERR "DEBUG($DebugCounter): $ThisLine";
+        $DebugCounter++;
+    }
+
+   if (
+      ($ThisLine =~ /RR negative cache entry/) or
+      ($ThisLine =~ /ns_....: .* NS points to CNAME/) or
+      ($ThisLine =~ /accept: connection reset by peer/) or
+      ($ThisLine =~ /Connection reset by peer/) or
+      # typo fixed in 2004 release
+      ($ThisLine =~ /transfer(r)?ed serial/) or
+      ($ThisLine =~ /There may be a name server already running/) or
+      ($ThisLine =~ /exiting/) or
+      ($ThisLine =~ /running/) or
+      ($ThisLine =~ /NSTATS /) or
+      ($ThisLine =~ /Cleaned cache of \d+ RRs/) or
+      ($ThisLine =~ /USAGE \d+ \d+ CPU=\d+.*/) or
+      ($ThisLine =~ /XSTATS /) or
+      ($ThisLine =~ /Ready to answer queries/) or
+      ($ThisLine =~ /Forwarding source address is/) or
+      ($ThisLine =~ /bad referral/) or
+      ($ThisLine =~ /prerequisite not satisfied/) or
+      ($ThisLine =~ /(rcvd|Sent) NOTIFY/) or
+      ($ThisLine =~ /ns_resp: TCP truncated/) or
+      ($ThisLine =~ /No possible A RRs/) or
+      ($ThisLine =~ /points to a CNAME/) or
+      ($ThisLine =~ /dangling CNAME pointer/) or
+      ($ThisLine =~ /listening on/) or
+      ($ThisLine =~ /unrelated additional info/) or
+      ($ThisLine =~ /Response from unexpected source/) or
+      ($ThisLine =~ /No root nameservers for class IN/) or
+      ($ThisLine =~ /recvfrom: No route to host/) or
+      ($ThisLine =~ /(C|c)onnection refused/) or
+      ($ThisLine =~ /lame server resolving/) or
+      ($ThisLine =~ /transfer of/) or
+      ($ThisLine =~ /using \d+ CPU/) or
+      ($ThisLine =~ /loading configuration/) or
+      ($ThisLine =~ /command channel listening/) or
+      ($ThisLine =~ /no IPv6 interfaces found/) or
+      ($ThisLine =~ /^running/) or
+      ($ThisLine =~ /^exiting/) or
+      ($ThisLine =~ /no longer listening/) or
+      ($ThisLine =~ /the default for the .* option is now/) or
+      ($ThisLine =~ /stopping command channel on \S+/) or
+      ($ThisLine =~ /Malformed response from/) or
+      ($ThisLine =~ /client .* response from Internet for .*/) or
+      ($ThisLine =~ /client .+ query \(cache\) '.*' denied/) or
+      ($ThisLine =~ /client .+#\d+: query:/) or
+      # Do we really want to ignore these?
+      #($ThisLine =~ /unknown logging category/) or
+      ($ThisLine =~ /could not open entropy source/) or
+      ($ThisLine =~ /\/etc\/rndc.key: file not found/) or
+      ($ThisLine =~ /sending notifies/) or
+      # file syntax error get reported twice and are already caught below
+      ($ThisLine =~ /loading master file/) or
+      ($ThisLine =~ /^ succeeded$/) or
+      ($ThisLine =~ /\*\*\* POKED TIMER \*\*\*/) or
+      # The message about the end of transfer is the interesting one
+      ($ThisLine =~ /: Transfer started./) or
+      ($ThisLine =~ /D-BUS service (disabled|enabled)./) or
+      ($ThisLine =~ /D-BUS dhcdbd subscription disabled./) or
+      ($ThisLine =~ /automatic empty zone/) or
+      ($ThisLine =~ /binding TCP socket: address in use/) or
+      ($ThisLine =~ /dbus_mgr initialization failed. D-BUS service is disabled./) or
+      ($ThisLine =~ /dbus_svc_add_filter failed/) or
+      ($ThisLine =~ /isc_log_open 'named.run' failed: permission denied/) or 
+      ($ThisLine =~ /weak RSASHA1 \(5\) key found \(exponent=3\)/) or 
+      ($ThisLine =~ /Bad file descriptor/) or 
+      ($ThisLine =~ /open: .*: file not found/) or
+      ($ThisLine =~ /queries: client [0-9.#:]* view localhost_resolver: query: .* IN .*/) or
+      ($ThisLine =~ /zone .*: NS '.*' is a CNAME \(illegal\)/) or
+      ($ThisLine =~ /zone .*: zone serial unchanged. zone may fail to transfer to slaves/) or
+      ($ThisLine =~ /zone .*: loading from master file .* failed/) or
+      ($ThisLine =~ /zone .*: NS '.*' has no address records/) or
+      ($ThisLine =~ /^no valid (DS|KEY|RRSIG) resolving/) or
+      ($ThisLine =~ /^not insecure resolving/) or
+      ($ThisLine =~ /.*: not a valid number$/) or
+      ($ThisLine =~ /.*: unexpected end of input/) or
+      ($ThisLine =~ /too many timeouts resolving '.*' .*: disabling EDNS/) or
+      ($ThisLine =~ /too many timeouts resolving '.*' .*: reducing the advertised EDNS UDP packet size to .* octets/) or
+      ($ThisLine =~ /reloading zones succeeded/) or
+      ($ThisLine =~ /success resolving '.*' \(in '.*'?\) after disabling EDNS/) or
+      ($ThisLine =~ /success resolving '.*' \(in '.*'?\) after reducing the advertised EDNS UDP packet size to 512 octets/) or
+      ($ThisLine =~ /the working directory is not writable/) or
+      ($ThisLine =~ /using default UDP\/IPv[46] port range: \[[0-9]*, [0-9]*\]/) or
+      ($ThisLine =~ /adjusted limit on open files from [0-9]* to [0-9]*/) or
+      ($ThisLine =~ /using up to [0-9]* sockets/) or
+      ($ThisLine =~ /built with/)
+      # too many timeouts resolving 'ns-ext.nrt1.isc.org/AAAA' (in '.'?): disabling EDNS: 3 Time(s)
+   ) {
+      # Don't care about these...
+   } elsif (
+      ($ThisLine =~ /starting\..*named/) or
+      ($ThisLine =~ /starting BIND/) or
+      ($ThisLine =~ /named startup succeeded/)
+   ) {
+      $StartNamed++;
+   } elsif ( $ThisLine =~ /(reloading nameserver|named reload succeeded)/ ) {
+      $ReloadNamed++;
+   } elsif (
+      ($ThisLine =~ /shutting down/) or
+      ($ThisLine =~ /named shutting down/ ) or
+      ($ThisLine =~ /named shutdown succeeded/ )
+   ) {
+      $ShutdownNamed++;
+   } elsif ( ($Host, $Zone) = ( $ThisLine =~ /client ([^\#]+)#[^\:]+: zone transfer '(.+)' denied/ ) ) {
+      $DeniedZoneTransfers{$Host}{$Zone}++;
+   } elsif ( ($Zone) = ( $ThisLine =~ /cache zone \"(.*)\" loaded/ ) ) {
+      $ZoneLoaded{"cache $Zone"}++;
+   } elsif ( ($Zone) = ( $ThisLine =~ /cache zone \"(.*)\" .* loaded/ ) ) {
+      $ZoneLoaded{"cache $Zone"}++;
+   } elsif ( ($Zone) = ( $ThisLine =~ /primary zone \"(.+)\" loaded/ ) ) {
+      $ZoneLoaded{$Zone}++;
+   } elsif ( ($Zone) = ( $ThisLine =~ /master zone \"(.+)\" .* loaded/ ) ) {
+      $ZoneLoaded{$Zone}++;
+   } elsif ( ($Zone) = ( $ThisLine =~ /secondary zone \"(.+)\" loaded/ ) ) {
+      $ZoneLoaded{"secondary $Zone"}++;
+   } elsif ( ($Zone) = ( $ThisLine =~ /slave zone \"(.+)\" .* loaded/ ) ) {
+      $ZoneLoaded{"secondary $Zone"}++;
+   } elsif ( ($Zone) = ( $ThisLine =~ /zone (.+)\: loaded serial/ ) ) {
+      $ZoneLoaded{$Zone}++;
+   } elsif ( (undef,$Addr,undef,$Server) = ( $ThisLine =~ /ame server (on|resolving) '(.+)' \(in .+\):\s+(\[.+\]\.\d+)?\s*'?(.+)'?:?/ ) ) {
+      $LameServer{"$Addr ($Server)"}++;
+   } elsif ( ($Zone) = ( $ThisLine =~ /Zone \"(.+)\" was removed/ ) ) {
+      $ZoneRemoved{$Zone}++;
+   } elsif ( ($Zone) = ( $ThisLine =~ /received notify for zone '(.*)'/ ) ) {
+      $ZoneReceivedNotify{$Zone}++;
+   } elsif ( ($Zone) = ( $ThisLine =~ /zone (.*): notify from .* up to date/ ) ) {
+      $ZoneReceivedNotify{$Zone}++;
+   } elsif ( ($Host) = ( $ThisLine =~ /([^ ]+) has CNAME and other data \(invalid\)/ ) ) {
+      push @CNAMEAndOther, $Host;
+   } elsif ( ($File,$Line,$Entry,$Error) = ( $ThisLine =~ /dns_master_load: ([^:]+):(\d+): ([^ ]+): (.+)$/ ) ) {
+      $ZoneFileErrors{$File}{"$Entry: $Error"}++;
+   } elsif ( ($File,$Line,$Entry,$Error) = ( $ThisLine =~ /warning: ([^:]+):(\d+): (.+)$/ ) ) {
+      $ZoneFileErrors{$File}{"file does not end with newline: $Error"}++;
+   } elsif ( ($Way,$Host) = ( $ThisLine =~ /([^ ]+): sendto\(\[([^ ]+)\].+\): Network is unreachable/ ) ) {
+      $FullHost = LookupIP ($Host);
+      $NetworkUnreachable{$Way}{$FullHost}++;
+   } elsif ( ($Zone,$Message) = ( $ThisLine =~ /client [^\#]+#[^\:]+: (?:view \w+: )?updating zone '([^\:]+)': (.*)$/ ) ) {
+      $ZoneUpdates{$Zone}{$Message}++;
+   } elsif ( ($Host,$Zone) = ( $ThisLine =~ /approved AXFR from \[(.+)\]\..+ for \"(.+)\"/ ) ) {
+      $FullHost = LookupIP ($Host);
+      $AXFR{$Zone}{$FullHost}++;
+   } elsif ( ($Client) = ( $ThisLine =~ /warning: client (.*) no more TCP clients/ ) ) {
+      $FullClient = LookupIP ($Client);
+      $DeniedTCPClient{$FullClient}++;
+   } elsif ( ($Client) = ( $ThisLine =~ /client (.*)#\d+: query \(cache\) denied/ ) ) {
+      $FullClient = LookupIP ($Client);
+      $DeniedQuery{$FullClient}++;
+   } elsif ( ($Rhost, $Ldom) = ($ThisLine =~ /client ([\d\.]+)#\d+: update '(.*)' denied/)) {
+      $UpdateDenied{"$Rhost ($Ldom)"}++;
+   } elsif ( ($Zone) = ($ThisLine =~ /zone '([0-9a-zA-Z.-]+)' allows updates by IP address, which is insecure/)) {
+      $InsecUpdate{$Zone}++;
+   } elsif ( ($Zone) = ($ThisLine =~ /zone ([0-9a-zA-Z.\/-]+): journal rollforward failed: journal out of sync with zone/)) {
+      $JournalFail{$Zone}++;
+   } elsif ( ($Channel,$Reason) = ($ThisLine =~ /couldn't add command channel (.+#\d+): (.*)$/)) {
+      $ChannelAddFail{$Channel}{$Reason}++;
+   } elsif ( ($Zone,$Host,$Reason) = ($ThisLine =~ /zone ([^ ]*)\/IN: refresh: failure trying master ([^ ]*)#\d+: (.*)/) ) {
+      $MasterFailure{"$Zone from $Host"}{$Reason}++;
+   } elsif ( ($Zone) = ($ThisLine =~ /zone ([^\/]+)\/.+: refresh: non-authoritative answer from master/)) {
+      $NonAuthoritative{$Zone}++;
+   } elsif ( ($ThisLine =~ /unexpected RCODE \((.*)\) resolving/) ){
+      $UnexpRCODE{$1}++;
+   } elsif ( ($ThisLine =~ /FORMERR resolving '[^ ]+: [0-9.#]+/) ) {
+      chomp($ThisLine);
+      $FormErr{$ThisLine}++;
+   } elsif ( ($ThisLine =~ /found [0-9]* CPU(s)?, using [0-9]* worker thread(s)?/) ) {
+      chomp($ThisLine);
+      $StartLog{$ThisLine}++;
+   } elsif ( (($File,$Line,$Problem) = ($ThisLine =~ /\/etc\/(rndc.key|named.conf):([0-9]+): (unknown option '[^ ]*')/)) or
+	     (($File,$Line,$Problem) = ($ThisLine =~ /\/etc\/(rndc.key|named.conf):([0-9]+): ('[^ ]' expected near end of file)/)) or
+	     (($File,$Line,$Problem) = ($ThisLine =~ /\/etc\/(named.*.conf):([0-9]+): (.*)/)) or
+	     (($File,$Line,$Problem) = ($ThisLine =~ /()()(could not configure root hints from '.*': file not found)/))) {
+       $ConfProb{$File}{"$Line,$Problem"}++;
+   } elsif ( (($ErrorText) = ($ThisLine =~ /^(RUNTIME_CHECK.*)/))or
+	     (($ErrorText) = ($ThisLine =~ /^(.* REQUIRE.* failed.*)$/)) or
+	     (($ErrorText) = ($ThisLine =~ /(.*: fatal error)/)) ) {
+      $NError{$ErrorText}++;
+   } elsif ( ($From,$Log) = ($ThisLine =~ /invalid command from ([.0-9]*)#[0-9]*: (.*)/) ) {
+      $CCMessages{"$From,$Log"}++;
+   } elsif ( (($Log) = ($ThisLine =~ /(freezing .*zone.*)/)) or
+	     (($Log) = ($ThisLine =~ /(thawing .*zone.*)/)) ) {
+      $CCMessages2{$Log}++;
+   } elsif (($CCC) = ($ThisLine =~ /unknown control channel command '(.*)'/)) {
+      $UnknownCCCommands{$CCC}++;
+   } elsif (($CCC) = ($ThisLine =~ /received control channel command '(.*)'/)) {
+      $CCCommands{$CCC}++;
+   } elsif (($Name,$Address) = ($ThisLine =~ /network unreachable resolving '(.*)': (.*)/)) {
+      $NUR{$Name}{$Address}++;
+   } elsif (($Name,$Address) = ($ThisLine =~ /host unreachable resolving '(.*)': (.*)/)) {
+      $HUR{$Name}{$Address}++;
+   } else {
+      # Report any unmatched entries...
+      # remove PID from named messages
+      $ThisLine =~ s/(client [.0-9]+)\S+/$1/;
+      chomp($ThisLine);
+      $OtherList{$ThisLine}++;
+   }
+}
+
+#######################################
+
+if ( ( $Detail >= 5 ) and ($StartNamed) ) {
+   print "Named started: $StartNamed Time(s)\n";
+}
+
+if ( ( $Detail >= 5 ) and ($ReloadNamed) ) {
+   print "Named reloaded: $ReloadNamed Time(s)\n";
+}
+
+if ( ( $Detail >= 5 ) and ($ShutdownNamed) ) {
+   print "Named shutdown: $ShutdownNamed Time(s)\n";
+}
+
+if ( ( $Detail >= 5 ) and (keys %ZoneLoaded) ) {
+   print "\nLoaded Zones:\n";
+   foreach $ThisOne (sort {$a cmp $b} keys %ZoneLoaded) {
+      print "   $ThisOne: $ZoneLoaded{$ThisOne} Time(s)\n";
+   }
+}
+
+if ( ( $Detail >= 5 ) and (keys %ZoneReceivedNotify) ) {
+   print "\nZones receiving notify:\n";
+   foreach $ThisOne (sort {$a cmp $b} keys %ZoneReceivedNotify) {
+      print "   $ThisOne: $ZoneReceivedNotify{$ThisOne} Time(s)\n";
+   }
+}
+
+if ( ($Detail >= 5) and (keys %ChannelAddFail) ) {
+   print "\nCan't add command channel:\n";
+   foreach $Channel (sort {$a cmp $b} keys %ChannelAddFail) {
+      print "   $Channel:\n";
+      foreach $Reason (sort {$a cmp $b} keys %{$ChannelAddFail{$Channel}}) {
+         print "      $Reason: $ChannelAddFail{$Channel}{$Reason} Time(s)\n";
+      }
+   }
+}
+
+if ( ($Detail >= 5) and (keys %MasterFailure) ) {
+   print "\nFailure trying to refresh zone:\n";
+   foreach $Zone (sort {$a cmp $b} keys %MasterFailure) {
+      print "   $Zone:\n";
+      foreach $Reason (sort {$a cmp $b} keys %{$MasterFailure{$Zone}}) {
+         print "      $Reason: $MasterFailure{$Zone}{$Reason}++ Time(s)\n";
+      }
+   }
+}
+
+if ( ( $Detail >= 5 ) and (keys %DeniedZoneTransfers) ) {
+   print "\nDenied Zone Transfers:\n";
+   foreach my $Host (keys %DeniedZoneTransfers) {
+      print "   $Host:\n";
+      foreach my $Zone (keys %{$DeniedZoneTransfers{$Host}}) {
+         print "      $Zone: $DeniedZoneTransfers{$Host}{$Zone} Time(s)\n";
+      }
+      print "\n";
+   }
+}
+
+if ( ( $Detail >= 5 ) and (keys %ZoneRemoved) ) {
+   print "\nRemoved Zones:\n";
+   foreach $ThisOne (sort {$a cmp $b} keys %ZoneRemoved) {
+      print "   $ThisOne: $ZoneRemoved{$ThisOne} Time(s)\n";
+   }
+}
+
+if ( ( $Detail >= 5 ) and (keys %AXFR) ) {
+   print "\nZone Transfers:\n";
+   foreach $ThisOne (keys %AXFR) {
+      print "   Zone: $ThisOne\n";
+      foreach $Temp (keys %{$AXFR{$ThisOne}}) {
+         print "      by $Temp: $AXFR{$ThisOne}{$Temp} Time(s)\n";
+      }
+   }
+}
+
+if ( ( $Detail >= 5 ) and (keys %DeniedTCPClient) ) {
+   print "\nno more TCP clients warning:\n";
+   foreach $ThisOne (keys %DeniedTCPClient) {
+      print "   from $ThisOne: $DeniedTCPClient{$ThisOne} Time(s)\n";
+   }
+}
+
+if ( ( $Detail >= 5 ) and (keys %DeniedQuery) ) {
+   print "\nQueries (cache) that were denied:\n";
+   foreach $ThisOne (keys %DeniedQuery) {
+      print "   from $ThisOne: $DeniedQuery{$ThisOne} Time(s)\n";
+   }
+}
+
+if ( ( $Detail >= 10 ) and (@CNAMEAndOther) ) {
+   print "\nThese hosts have CNAME and other data (invalid):\n";
+   foreach $ThisOne (@CNAMEAndOther) {
+      print "   $ThisOne\n";
+   }
+}
+
+if ( ( $Detail >= 5 ) and (keys %ZoneFileErrors) ) {
+   print "\nSyntax errors in zone files:\n";
+   for $File (keys %ZoneFileErrors) {
+      print "   $File\n";
+      for $Error ( keys %{$ZoneFileErrors{$File}} ) {
+         print "      \"$Error\" " . $ZoneFileErrors{$File}{$Error} . " Time(s)\n";
+      }
+   }
+}
+
+if ( ( $Detail >= 10 ) and (keys %LameServer) ) {
+   print "\nThese addresses had lame server references:\n";
+   foreach $ThisOne (keys %LameServer) {
+      print "   $ThisOne: $LameServer{$ThisOne} Time(s)\n";
+   }
+}
+
+if ( ( $Detail >= 10 ) and (keys %NonAuthoritative) ) {
+   print "\nNon-authoritative answer from master for these zones:\n";
+   foreach $ThisOne (keys %NonAuthoritative) {
+      print "   " . $ThisOne . ": " . $NonAuthoritative{$ThisOne} . " Time(s)\n";
+   }
+}
+
+if ( ( $Detail >= 10 ) and (keys %NetworkUnreachable) ) {
+   print "\nNetwork is unreachable for:\n";
+   foreach $ThisOne (sort {$a cmp $b} keys %NetworkUnreachable) {
+      print "   $ThisOne:\n";
+      foreach $Host (sort {$a cmp $b} keys %{$NetworkUnreachable{$ThisOne}}) {
+         print "      $Host: $NetworkUnreachable{$ThisOne}{$Host} Time(s)\n";
+      } 
+   }
+}
+
+if ( ( $Detail >= 10 ) and (keys %NUR) ) {
+   print "\nNetwork unreachable resolving for:\n";
+   foreach $ThisOne (sort {$a cmp $b} keys %NUR) {
+      print "   $ThisOne:\n";
+      foreach $Host (sort {$a cmp $b} keys %{$NUR{$ThisOne}}) {
+         print "      $Host: $NUR{$ThisOne}{$Host} Time(s)\n";
+      }
+   }
+}
+
+if ( ( $Detail >= 10 ) and (keys %HUR) ) {
+   print "\nHost unreachable resolving for:\n";
+   foreach $ThisOne (sort {$a cmp $b} keys %HUR) {
+       print "   $ThisOne:\n";
+       foreach $Host (sort {$a cmp $b} keys %{$HUR{$ThisOne}}) {
+          print "      $Host: $HUR{$ThisOne}{$Host} Time(s)\n";
+       }
+   }
+}
+
+if ( ( $Detail >= 5 ) and (keys %ZoneUpdates) ) {
+   print "\nZone Updates:\n";
+   foreach $ThisOne (sort {$a cmp $b} keys %ZoneUpdates) {
+      print "   $ThisOne:\n";
+      foreach $Message (sort {$a cmp $b} keys %{$ZoneUpdates{$ThisOne}}) {
+         print "      $Message: $ZoneUpdates{$ThisOne}{$Message} Time(s)\n";
+      } 
+   }
+}
+
+if ( keys %UpdateDenied ) {
+   print "\nZone update refused:\n";
+   foreach $ThisOne (sort {$a cmp $b} keys %UpdateDenied) {
+      print "   $ThisOne: $UpdateDenied{$ThisOne} Time(s)\n";
+   }
+}
+
+if ( keys %InsecUpdate ) {
+   print "\nInsecure zones (dynamic update allowed by IP address):\n";
+   foreach $ThisOne (sort {$a cmp $b} keys %InsecUpdate) {
+      print "   " . $ThisOne . ": " . $InsecUpdate{$ThisOne} . " Time(s)\n";
+   }
+}
+
+if ( keys %JournalFail ) {
+   print "\nJournall rollforward failed:\n";
+   foreach $ThisOne (sort {$a cmp $b} keys %JournalFail) {
+      print "   " . $ThisOne . ": " . $JournalFail{$ThisOne} . " Time(s)\n";
+   }
+}
+
+if (keys %ConfProb) {
+   print "\n Errors in configuration files\n";
+   foreach $File (sort keys %ConfProb) {
+      if ($File =~ /.+/) {
+        print "   file " . $File . "\n";
+        foreach (keys %{$ConfProb{$File}}) {
+           ($Line,$Problem) = split ",";
+           print "      " . $File . ":" . "$Line" . ": " . $Problem . ": " . $ConfProb{$File}{"$Line,$Problem"} . " Time(s)\n";
+        }
+      }
+      else {
+        foreach (keys %{$ConfProb{$File}}) {
+           ($Line,$Problem) = split ",";
+            print "   " . $Problem . ": " . $ConfProb{$File}{"$Line,$Problem"} . " Time(s)\n";
+        }
+      }
+   }
+}
+
+if (($Detail >= 5) and (keys %UnexpRCODE)) {
+   print "\n Unexpected DNS RCODEs:\n";
+   foreach $ThisOne (keys %UnexpRCODE) {
+      print "   " . $ThisOne . ": " . $UnexpRCODE{$ThisOne} . " Time(s)\n";
+   }
+}
+
+if (($Detail >= 5) and (keys %FormErr)) {
+   print "\n Incorrect response format:\n";
+   foreach $ThisOne (keys %FormErr) {
+      print "   " . $ThisOne . ": " . $FormErr{$ThisOne} . " Time(s)\n";
+   }
+}
+
+if (($Detail >= 10) and (keys %StartLog)) {
+   print "\n Named startup logs:\n";
+   foreach $ThisOne (keys %StartLog) {
+      print "   " . $ThisOne . ": " . $StartLog{$ThisOne} . " Time(s)\n";
+   }
+}
+
+if (keys %NError) {
+   print "\n Errors:\n";
+   foreach $ThisOne (keys %NError) {
+      print "   " . $ThisOne . ": " . $NError{$ThisOne} . " Time(s)\n";
+   }
+}
+
+if ((keys %CCMessages) or (keys %CCMessages2)){
+   print "\n Messages from control channel\n";
+   foreach (keys %CCMessages) {
+      ($From,$Log) = split ",";
+      print "   " . $From . ": " . $Log . ": " . $CCMessages{"$From,$Log"} . " Time(s)\n";
+   }
+   foreach $ThisOne (keys %CCMessages2) {
+      print "   " . $ThisOne . ": " . $CCMessages2{$ThisOne} . " Time(s)\n";
+   }
+}
+
+if ((keys %CCCommands) or (keys %UnknownCCCommands)) {
+   print "\nReceived control channel commands\n";
+   foreach $ThisOne (keys %CCCommands) {
+      print "   " . $ThisOne . ": " . $CCCommands{$ThisOne} . " Time(s)\n";
+   }
+   foreach $ThisOne (keys %UnknownCCCommands) {
+      print "   " . $ThisOne . "(unknown command): " . $CCCommands{$ThisOne} . " Time(s)\n";
+   }               
+}
+
+if (keys %OtherList) {
+   print "\n**Unmatched Entries**\n";
+   foreach $line (sort {$a cmp $b} keys %OtherList) {
+      print "   $line: $OtherList{$line} Time(s)\n";
+   }
+}
+
+exit(0);
+
+# vi: shiftwidth=3 tabstop=3 syntax=perl et
+
Index: tags/fc15-eol/server/fedora/config/etc/mock/scripts-fc11-i386.cfg
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/mock/scripts-fc11-i386.cfg	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/mock/scripts-fc11-i386.cfg	(revision 2244)
@@ -0,0 +1,44 @@
+config_opts['root'] = 'fedora-11-i386'
+config_opts['target_arch'] = 'i586'
+config_opts['chroot_setup_cmd'] = 'groupinstall buildsys-build'
+config_opts['dist'] = 'fc11'  # only useful for --resultdir variable subst
+
+config_opts['yum.conf'] = """
+[main]
+cachedir=/var/cache/yum
+debuglevel=1
+reposdir=/dev/null
+logfile=/var/log/yum.log
+retries=20
+obsoletes=1
+gpgcheck=0
+assumeyes=1
+
+# repos
+
+[fedora]
+name=fedora
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=fedora-11&arch=i386
+failovermethod=priority
+
+[updates-released]
+name=updates
+#mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f11&arch=i386
+baseurl=http://dl.fedoraproject.org/pub/fedora/linux/updates/11/i386/
+failovermethod=priority
+
+[local]
+name=local
+baseurl=file:///home/scripts-build/mock-local/
+cost=2000
+enabled=1
+
+[scripts]
+name=Scripts
+baseurl=http://web.mit.edu/scripts/yum-repos/rpm-fc11/
+enabled=1
+gpgcheck=0
+"""
+
+
+
Index: tags/fc15-eol/server/fedora/config/etc/mock/scripts-fc11-x86_64.cfg
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/mock/scripts-fc11-x86_64.cfg	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/mock/scripts-fc11-x86_64.cfg	(revision 2244)
@@ -0,0 +1,47 @@
+config_opts['root'] = 'fedora-11-x86_64'
+config_opts['target_arch'] = 'x86_64'
+config_opts['chroot_setup_cmd'] = 'groupinstall buildsys-build'
+config_opts['dist'] = 'fc11'  # only useful for --resultdir variable subst
+
+config_opts['yum.conf'] = """
+[main]
+cachedir=/var/cache/yum
+debuglevel=1
+reposdir=/dev/null
+logfile=/var/log/yum.log
+retries=20
+obsoletes=1
+gpgcheck=0
+assumeyes=1
+# grub/syslinux on x86_64 need glibc-devel.i386 which pulls in glibc.i386, need to exclude all
+# .i?86 packages except these.
+#exclude=[0-9A-Za-fh-z]*.i?86 g[0-9A-Za-km-z]*.i?86 gl[0-9A-Za-hj-z]*.i?86 gli[0-9A-Zac-z]*.i?86 glib[0-9A-Za-bd-z]*.i?86
+# The above is not needed anymore with yum multilib policy of "best" which is the default in Fedora.
+
+# repos
+
+[fedora]
+name=fedora
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=fedora-11&arch=x86_64
+failovermethod=priority
+
+[updates-released]
+name=updates
+#mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f11&arch=x86_64
+baseurl=http://dl.fedoraproject.org/pub/fedora/linux/updates/11/x86_64/
+failovermethod=priority
+
+[local]
+name=local
+baseurl=file:///home/scripts-build/mock-local/
+cost=2000
+enabled=1
+
+[scripts]
+name=Scripts
+baseurl=http://web.mit.edu/scripts/yum-repos/rpm-fc11/
+enabled=1
+gpgcheck=0
+"""
+
+
Index: tags/fc15-eol/server/fedora/config/etc/mock/scripts-fc13-i386.cfg
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/mock/scripts-fc13-i386.cfg	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/mock/scripts-fc13-i386.cfg	(revision 2244)
@@ -0,0 +1,40 @@
+config_opts['root'] = 'fedora-13-i386'
+config_opts['target_arch'] = 'i686'
+config_opts['chroot_setup_cmd'] = 'groupinstall buildsys-build'
+config_opts['dist'] = 'fc13'  # only useful for --resultdir variable subst
+
+config_opts['yum.conf'] = """
+[main]
+cachedir=/var/cache/yum
+debuglevel=1
+reposdir=/dev/null
+logfile=/var/log/yum.log
+retries=20
+obsoletes=1
+gpgcheck=0
+assumeyes=1
+
+# repos
+
+[fedora]
+name=fedora
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=fedora-13&arch=i386
+failovermethod=priority
+
+[updates-released]
+name=updates
+baseurl=http://dl.fedoraproject.org/pub/fedora/linux/updates/13/i386/
+failovermethod=priority
+
+[local]
+name=local
+baseurl=file:///home/scripts-build/mock-local/
+cost=2000
+enabled=1
+
+[scripts]
+name=Scripts
+baseurl=http://web.mit.edu/scripts/yum-repos/rpm-fc13/
+enabled=1
+gpgcheck=0
+""" # end config_opts['yum.conf']
Index: tags/fc15-eol/server/fedora/config/etc/mock/scripts-fc13-x86_64.cfg
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/mock/scripts-fc13-x86_64.cfg	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/mock/scripts-fc13-x86_64.cfg	(revision 2244)
@@ -0,0 +1,53 @@
+config_opts['root'] = 'fedora-13-x86_64'
+config_opts['target_arch'] = 'x86_64'
+config_opts['chroot_setup_cmd'] = 'groupinstall buildsys-build'
+config_opts['dist'] = 'fc13'  # only useful for --resultdir variable subst
+
+config_opts['yum.conf'] = """
+[main]
+cachedir=/var/cache/yum
+debuglevel=1
+reposdir=/dev/null
+logfile=/var/log/yum.log
+retries=20
+obsoletes=1
+gpgcheck=0
+assumeyes=1
+# grub/syslinux on x86_64 need glibc-devel.i386 which pulls in glibc.i386, need to exclude all
+# .i?86 packages except these.
+#exclude=[0-9A-Za-fh-z]*.i?86 g[0-9A-Za-km-z]*.i?86 gl[0-9A-Za-hj-z]*.i?86 gli[0-9A-Zac-z]*.i?86 glib[0-9A-Za-bd-z]*.i?86
+# The above is not needed anymore with yum multilib policy of "best" which is the default in Fedora.
+
+# repos
+
+[fedora]
+name=fedora
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=fedora-13&arch=x86_64
+failovermethod=priority
+
+[updates-released]
+name=updates
+#mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f13&arch=x86_64
+baseurl=http://dl.fedoraproject.org/pub/fedora/linux/updates/13/x86_64/
+failovermethod=priority
+
+[updates-testing]
+name=updates-testing
+baseurl=http://dl.fedoraproject.org/pub/fedora/linux/updates/testing/13/x86_64/
+failovermethod=priority
+enabled=0
+
+[local]
+name=local
+baseurl=file:///home/scripts-build/mock-local/
+cost=2000
+enabled=1
+
+[scripts]
+name=Scripts
+baseurl=http://web.mit.edu/scripts/yum-repos/rpm-fc13/
+enabled=1
+gpgcheck=0
+"""
+
+
Index: tags/fc15-eol/server/fedora/config/etc/mock/scripts-fc15-i386.cfg
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/mock/scripts-fc15-i386.cfg	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/mock/scripts-fc15-i386.cfg	(revision 2244)
@@ -0,0 +1,44 @@
+config_opts['root'] = 'fedora-15-i386'
+config_opts['target_arch'] = 'i686'
+config_opts['legal_host_arches'] = ('i386', 'i586', 'i686', 'x86_64')
+config_opts['chroot_setup_cmd'] = 'groupinstall buildsys-build'
+config_opts['dist'] = 'fc15'  # only useful for --resultdir variable subst
+
+config_opts['yum.conf'] = """
+[main]
+cachedir=/var/cache/yum
+debuglevel=1
+reposdir=/dev/null
+logfile=/var/log/yum.log
+retries=20
+obsoletes=1
+gpgcheck=0
+assumeyes=1
+syslog_ident=mock
+syslog_device=
+
+# repos
+
+[fedora]
+name=fedora
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=fedora-15&arch=i386
+failovermethod=priority
+
+[updates-released]
+name=updates
+#mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f15&arch=i386
+baseurl=http://dl.fedoraproject.org/pub/fedora/linux/updates/15/i386/
+failovermethod=priority
+
+[local]
+name=local
+baseurl=file:///home/scripts-build/mock-local/
+cost=2000
+enabled=1
+
+[scripts]
+name=Scripts
+baseurl=http://web.mit.edu/scripts/yum-repos/rpm-fc15/
+enabled=1
+gpgcheck=0
+"""
Index: tags/fc15-eol/server/fedora/config/etc/mock/scripts-fc15-x86_64.cfg
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/mock/scripts-fc15-x86_64.cfg	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/mock/scripts-fc15-x86_64.cfg	(revision 2244)
@@ -0,0 +1,48 @@
+config_opts['root'] = 'fedora-15-x86_64'
+config_opts['target_arch'] = 'x86_64'
+config_opts['legal_host_arches'] = ('x86_64')
+config_opts['chroot_setup_cmd'] = 'groupinstall buildsys-build'
+config_opts['dist'] = 'fc15'  # only useful for --resultdir variable subst
+
+config_opts['yum.conf'] = """
+[main]
+cachedir=/var/cache/yum
+debuglevel=1
+reposdir=/dev/null
+logfile=/var/log/yum.log
+retries=20
+obsoletes=1
+gpgcheck=0
+assumeyes=1
+syslog_ident=mock
+syslog_device=
+# grub/syslinux on x86_64 need glibc-devel.i386 which pulls in glibc.i386, need to exclude all
+# .i?86 packages except these.
+#exclude=[0-9A-Za-fh-z]*.i?86 g[0-9A-Za-km-z]*.i?86 gl[0-9A-Za-hj-z]*.i?86 gli[0-9A-Zac-z]*.i?86 glib[0-9A-Za-bd-z]*.i?86
+# The above is not needed anymore with yum multilib policy of "best" which is the default in Fedora.
+
+# repos
+
+[fedora]
+name=fedora
+mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=fedora-15&arch=x86_64
+failovermethod=priority
+
+[updates-released]
+name=updates
+#mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=updates-released-f15&arch=x86_64
+baseurl=http://dl.fedoraproject.org/pub/fedora/linux/updates/15/x86_64/
+failovermethod=priority
+
+[local]
+name=local
+baseurl=file:///home/scripts-build/mock-local/ 
+cost=2000
+enabled=1
+
+[scripts]
+name=Scripts
+baseurl=http://web.mit.edu/scripts/yum-repos/rpm-fc15/
+enabled=1
+gpgcheck=0
+"""
Index: tags/fc15-eol/server/fedora/config/etc/modules-load.d/fuse.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/modules-load.d/fuse.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/modules-load.d/fuse.conf	(revision 2244)
@@ -0,0 +1,1 @@
+fuse
Index: tags/fc15-eol/server/fedora/config/etc/munin/apache-htpasswd
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/munin/apache-htpasswd	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/munin/apache-htpasswd	(revision 2244)
@@ -0,0 +1,2 @@
+munin:$apr1$OHrCw...$YROR8zbWmgxWL9netgXGi.
+geofft:AvCSyg9e75YZM
Index: tags/fc15-eol/server/fedora/config/etc/munin/munin-node.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/munin/munin-node.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/munin/munin-node.conf	(revision 2244)
@@ -0,0 +1,45 @@
+#
+# Example config-file for munin-node
+#
+
+log_level 4
+log_file /var/log/munin/munin-node.log
+pid_file /var/run/munin/munin-node.pid
+
+background 1
+setseid 1
+
+user munin
+group munin
+setsid yes
+
+# Regexps for files to ignore
+
+ignore_file ~$
+ignore_file \.bak$
+ignore_file %$
+ignore_file \.dpkg-(tmp|new|old|dist)$
+ignore_file \.rpm(save|new)$
+ignore_file \.pod$
+
+# Set this if the client doesn't report the correct hostname when
+# telnetting to localhost, port 4949
+#
+#host_name x86-3.fedora.phx.redhat.com
+
+# A list of addresses that are allowed to connect.  This must be a
+# regular expression, due to brain damage in Net::Server, which
+# doesn't understand CIDR-style network notation.  You may repeat
+# the allow line as many times as you'd like
+
+allow ^127\.0\.0\.1$
+allow ^18\.187\.1\.128$
+allow ^18\.181\.0\.65$
+
+# Which address to bind to;
+host *
+# host 127.0.0.1
+
+# And which port
+port 4949
+
Index: tags/fc15-eol/server/fedora/config/etc/munin/plugin-conf.d/apache_accesses
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/munin/plugin-conf.d/apache_accesses	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/munin/plugin-conf.d/apache_accesses	(revision 2244)
@@ -0,0 +1,2 @@
+[apache_accesses]
+env.url http://munin:SsQWsHZWU5OJJOob78pD3UbxKu42Ka9ExGx9zYmvrWE1O5PCq4sBWJsQaJENi4R@127.0.0.1:%d/server-status/?auto
Index: tags/fc15-eol/server/fedora/config/etc/munin/plugin-conf.d/apache_processes
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/munin/plugin-conf.d/apache_processes	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/munin/plugin-conf.d/apache_processes	(revision 2244)
@@ -0,0 +1,2 @@
+[apache_processes]
+env.url http://munin:SsQWsHZWU5OJJOob78pD3UbxKu42Ka9ExGx9zYmvrWE1O5PCq4sBWJsQaJENi4R@127.0.0.1:%d/server-status/?auto
Index: tags/fc15-eol/server/fedora/config/etc/munin/plugin-conf.d/apache_volume
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/munin/plugin-conf.d/apache_volume	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/munin/plugin-conf.d/apache_volume	(revision 2244)
@@ -0,0 +1,2 @@
+[apache_volume]
+env.url http://munin:SsQWsHZWU5OJJOob78pD3UbxKu42Ka9ExGx9zYmvrWE1O5PCq4sBWJsQaJENi4R@127.0.0.1:%d/server-status/?auto
Index: tags/fc15-eol/server/fedora/config/etc/munin/plugin-conf.d/hddtemp_smartctl
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/munin/plugin-conf.d/hddtemp_smartctl	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/munin/plugin-conf.d/hddtemp_smartctl	(revision 2244)
@@ -0,0 +1,4 @@
+[hddtemp_smartctl]
+user root
+env.drives sda sdb
+command sudo -E %c
Index: tags/fc15-eol/server/fedora/config/etc/munin/plugin-conf.d/munin-node
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/munin/plugin-conf.d/munin-node	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/munin/plugin-conf.d/munin-node	(revision 2244)
@@ -0,0 +1,46 @@
+# This file is used to configure how the plugins are invoked.
+# Place in /etc/munin/plugin-conf.d/ or corresponding directory.
+#
+# PLEASE NOTE: Changes in the plugin-conf.d directory are only
+# read at munin-node startup, so restart at any changes.
+#
+#  user <user>         # Set the user to run the plugin as
+#  group <group>       # Set the group to run the plugin as
+#  command <command>   # Run <command> instead of the plugin. %c
+# 	                 expands to what would normally be run.
+#  env.<variable> <value> # Sets <variable> in the plugin's environment, see the
+#                        individual plugins to find out which variables they
+#                        care about.
+#
+#
+
+[mysql*]
+#env.mysqlopts -u someuser
+
+[exim*]
+group mail
+
+[cps*]
+user root
+
+[apt]
+user root
+
+[vlan*]
+user root
+
+[postfix*]
+user root
+
+[smart_*]
+user root
+command sudo %c
+
+[sensors_*]
+user root
+command sudo %c
+
+[if_*]
+user root
+command sudo -E %c
+env.PATH /usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin
Index: tags/fc15-eol/server/fedora/config/etc/munin/plugin-conf.d/postfix
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/munin/plugin-conf.d/postfix	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/munin/plugin-conf.d/postfix	(revision 2244)
@@ -0,0 +1,5 @@
+[postfix*]
+user root
+env.logfile maillog
+env.logdir /var/log
+command sudo -E %c
Index: tags/fc15-eol/server/fedora/config/etc/munin/plugin-conf.d/sendmail
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/munin/plugin-conf.d/sendmail	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/munin/plugin-conf.d/sendmail	(revision 2244)
@@ -0,0 +1,4 @@
+[sendmail*]
+user root
+env.mspqueue /var/spool/clientmqueue
+command sudo -E %c
Index: tags/fc15-eol/server/fedora/config/etc/munin/plugins/apache_accesses
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/munin/plugins/apache_accesses	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/munin/plugins/apache_accesses	(revision 2244)
@@ -0,0 +1,1 @@
+link /usr/share/munin/plugins/apache_accesses
Index: tags/fc15-eol/server/fedora/config/etc/munin/plugins/apache_processes
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/munin/plugins/apache_processes	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/munin/plugins/apache_processes	(revision 2244)
@@ -0,0 +1,1 @@
+link /usr/share/munin/plugins/apache_processes
Index: tags/fc15-eol/server/fedora/config/etc/munin/plugins/apache_volume
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/munin/plugins/apache_volume	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/munin/plugins/apache_volume	(revision 2244)
@@ -0,0 +1,1 @@
+link /usr/share/munin/plugins/apache_volume
Index: tags/fc15-eol/server/fedora/config/etc/nagios/check_afs
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/nagios/check_afs	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/nagios/check_afs	(revision 2244)
@@ -0,0 +1,22 @@
+#!/bin/sh
+. /usr/lib64/nagios/plugins/utils.sh
+
+if [ $# -ge 1 ]; then
+    CHECKS=`/usr/bin/fs checks -cell "$1" -fast`
+else
+    CHECKS=`/usr/bin/fs checks -all -fast`
+fi
+
+STATUS=$?
+
+$ECHO "$CHECKS"
+
+if [ $STATUS -gt 0 ]; then
+    if $ECHO "$CHECKS" | grep -i COCYTUS >/dev/null; then
+	exit $STATE_CRITICAL;
+    else
+	exit $STATE_WARNING;
+    fi
+else
+    exit $STATE_OK;
+fi
Index: tags/fc15-eol/server/fedora/config/etc/nagios/check_cron_working
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/nagios/check_cron_working	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/nagios/check_cron_working	(revision 2244)
@@ -0,0 +1,2 @@
+#!/bin/bash
+exec /usr/lib64/nagios/plugins/check_file_age -f /afs/athena.mit.edu/contrib/scripts/cron_scripts/cron_status_flag/$(hostname -f)
Index: tags/fc15-eol/server/fedora/config/etc/nagios/check_kern_taint
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/nagios/check_kern_taint	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/nagios/check_kern_taint	(revision 2244)
@@ -0,0 +1,48 @@
+#!/bin/sh
+. /usr/lib64/nagios/plugins/utils.sh
+
+taintval=$(cat /proc/sys/kernel/tainted)
+
+if [ "$taintval" = 0 ]; then
+    $ECHO "Not tainted"
+    exit $STATE_OK
+fi
+
+# This is a bash reimplementation of kernel/panic.c:print_tainted
+# Letters are as follows:
+# (As quoted from http://lxr.linux.no/#linux+v2.6.38/kernel/panic.c#L181)
+# *      print_tainted - return a string to represent the kernel taint state.
+# *
+# *  'P' - Proprietary module has been loaded.
+# *  'F' - Module has been forcibly loaded.
+# *  'S' - SMP with CPUs not designed for SMP.
+# *  'R' - User forced a module unload.
+# *  'M' - System experienced a machine check exception.
+# *  'B' - System has hit bad_page.
+# *  'U' - Userspace-defined naughtiness.
+# *  'D' - Kernel has oopsed before
+# *  'A' - ACPI table overridden.
+# *  'W' - Taint on warning.
+# *  'C' - modules from drivers/staging are loaded.
+# *  'I' - Working around severe firmware bug.
+# *
+
+flag=1
+taints=""
+for i in P F S R M B U D A W C I; do
+    if [ $(($taintval & $flag)) -ne 0 ]; then
+	taints="$taints$i"
+    else
+	taints="$taints "
+    fi
+    flag=$(($flag * 2))
+done
+
+$ECHO "Tainted: $taints"
+
+case "$taints" in
+    *M*|*B*|*D*) exit $STATE_CRITICAL;;
+    *U*|*W*) exit $STATE_WARNING;;
+    *) exit $STATE_OK;;
+esac
+
Index: tags/fc15-eol/server/fedora/config/etc/nagios/check_ldap_mmr
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/nagios/check_ldap_mmr	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/nagios/check_ldap_mmr	(revision 2244)
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+exec /usr/bin/sudo -u signup /etc/nagios/check_ldap_mmr.real
Index: tags/fc15-eol/server/fedora/config/etc/nagios/check_ldap_mmr.real
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/nagios/check_ldap_mmr.real	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/nagios/check_ldap_mmr.real	(revision 2244)
@@ -0,0 +1,104 @@
+#!/usr/bin/perl -w
+
+# Originally by Emmanuel BUU <emmanuel.buu@ives.fr> (c) IVèS 2008
+# Adapted for scripts.mit.edu by Mitchell Berger <mitchb@mit.edu>
+
+use Net::LDAP;
+use strict;
+
+my $nl  = $ENV{'USE_NEWLINES'} ? "\n" : "";
+my $tab = $ENV{'USE_NEWLINES'} ? "  " : "";
+
+# Nagios codes
+my %ERRORS=('OK'=>0, 'WARNING'=>1, 'CRITICAL'=>2, 'UNKNOWN'=>3, 'DEPENDENT'=>4);
+
+my $ldapserver = 'localhost';
+my $user = 'cn=Directory Manager';
+my $passwdfile = '/etc/signup-ldap-pw';
+my $configBase = "cn=config";
+my $replicatedBase = "dc=scripts,dc=mit,dc=edu";
+my $server="nsDS5ReplicaHost";
+my $status="nsds5replicaLastUpdateStatus";
+my $laststart="nsds5replicaLastUpdateStart";
+my $lastend="nsds5replicaLastUpdateEnd";
+ 
+my $ldap=ConnectLdap();
+my $result=LDAPSearch($ldap,"objectClass=nsDS5ReplicationAgreement","",$configBase);
+my @entries = $result->entries;
+my $replicaErrors = 0;
+my $conflictErrors = 0;
+my $errorstring = "Replication error(s): $nl";
+foreach my $entr ( @entries ) {
+    my $servername=$entr->get_value($server);
+    my $serverstatus=$entr->get_value($status);
+    my $serverlaststart=$entr->get_value($laststart);
+    my $serverlastend=$entr->get_value($lastend);
+    my $statuscode = $serverstatus;
+    $statuscode =~ s/(^[-0123456789]+) (.*$)/$1/;
+    $serverlaststart =~ s/(....)(..)(..)(..)(..)(..)./$1-$2-$3\ $4:$5:$6/;
+    $serverlastend =~ s/(....)(..)(..)(..)(..)(..)./$1-$2-$3\ $4:$5:$6/;
+    print "Replication to $servername last operation $serverlaststart $nl";
+    print $tab . "Status: $serverstatus.     $nl";
+    if ($statuscode) {
+        $replicaErrors++;
+        $errorstring = $errorstring . $serverstatus . ", ";
+    }
+}
+print "$nl";
+
+$result=LDAPSearch($ldap,"nsds5ReplConflict=*",["nsds5ReplConflict"],$replicatedBase);
+@entries = $result->entries;
+foreach my $entr ( @entries ) {
+    my $conflictingDN=$entr->dn();
+    my $conflictDesc=$entr->get_value("nsds5ReplConflict");
+    print "Conflict found for DN $conflictingDN $nl";
+    print $tab . "Reason: $conflictDesc.     $nl";
+    $conflictErrors++;
+    $errorstring = $errorstring . $conflictDesc . ", ";
+}
+print "$nl";
+
+if ($conflictErrors > 0) {
+    &nagios_return("CRITICAL", $errorstring);
+} elsif ($replicaErrors > 0) {
+    &nagios_return("WARNING", $errorstring);
+} else {
+    &nagios_return("OK", "All replicas are OK and no conflicts are present");
+}
+
+sub ConnectLdap {
+    my $ldap = Net::LDAP->new ( $ldapserver ) or die "$@";
+    open (PASSWD, $passwdfile) || &nagios_return("CRITICAL", "Could not read credentials");
+    my $passwd = <PASSWD>;
+    close (PASSWD);
+    my $mesg = $ldap->bind ( "$user", password => "$passwd" , version => 3 );
+    if ($mesg->code) {
+        &nagios_return("CRITICAL", "Failed to bind to LDAP: " . $mesg->error);
+    }
+    return $ldap;
+}
+
+sub LDAPSearch {
+    my ($ldap,$searchString,$attrs,$base) = @_;
+    my $result = $ldap->search ( base    => "$base",
+                                 scope   => "sub",
+                                 filter  => "$searchString",
+                                 attrs   =>  $attrs
+                               );
+}
+
+sub nagios_return($$) {
+    my ($ret, $message) = @_;
+    my ($retval, $retstr);
+    if (defined($ERRORS{$ret})) {
+        $retval = $ERRORS{$ret};
+        $retstr = $ret;
+    } else {
+        $retstr = 'UNKNOWN';
+        $retval = $ERRORS{$retstr};
+    }
+    $message = "$retstr - $message\n";
+    print $message;
+    exit $retval;
+}
+
Index: tags/fc15-eol/server/fedora/config/etc/nagios/nrpe.cfg
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/nagios/nrpe.cfg	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/nagios/nrpe.cfg	(revision 2244)
@@ -0,0 +1,226 @@
+#############################################################################
+# Sample NRPE Config File 
+# Written by: Ethan Galstad (nagios@nagios.org)
+# 
+# Last Modified: 11-23-2007
+#
+# NOTES:
+# This is a sample configuration file for the NRPE daemon.  It needs to be
+# located on the remote host that is running the NRPE daemon, not the host
+# from which the check_nrpe client is being executed.
+#############################################################################
+
+
+# LOG FACILITY
+# The syslog facility that should be used for logging purposes.
+
+log_facility=daemon
+
+
+
+# PID FILE
+# The name of the file in which the NRPE daemon should write it's process ID
+# number.  The file is only written if the NRPE daemon is started by the root
+# user and is running in standalone mode.
+
+pid_file=/var/run/nrpe.pid
+
+
+
+# PORT NUMBER
+# Port number we should wait for connections on.
+# NOTE: This must be a non-priviledged port (i.e. > 1024).
+# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
+
+server_port=5666
+
+
+
+# SERVER ADDRESS
+# Address that nrpe should bind to in case there are more than one interface
+# and you do not want nrpe to bind on all interfaces.
+# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
+
+#server_address=127.0.0.1
+
+
+
+# NRPE USER
+# This determines the effective user that the NRPE daemon should run as.  
+# You can either supply a username or a UID.
+# 
+# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
+
+nrpe_user=nrpe
+
+
+
+# NRPE GROUP
+# This determines the effective group that the NRPE daemon should run as.  
+# You can either supply a group name or a GID.
+# 
+# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
+
+nrpe_group=nrpe
+
+
+
+# ALLOWED HOST ADDRESSES
+# This is an optional comma-delimited list of IP address or hostnames 
+# that are allowed to talk to the NRPE daemon.
+#
+# Note: The daemon only does rudimentary checking of the client's IP
+# address.  I would highly recommend adding entries in your /etc/hosts.allow
+# file to allow only the specified host to connect to the port
+# you are running this daemon on.
+#
+# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
+
+allowed_hosts=18.181.0.61,18.181.0.65,18.181.0.51
+ 
+
+
+# COMMAND ARGUMENT PROCESSING
+# This option determines whether or not the NRPE daemon will allow clients
+# to specify arguments to commands that are executed.  This option only works
+# if the daemon was configured with the --enable-command-args configure script
+# option.  
+#
+# *** ENABLING THIS OPTION IS A SECURITY RISK! *** 
+# Read the SECURITY file for information on some of the security implications
+# of enabling this variable.
+#
+# Values: 0=do not allow arguments, 1=allow command arguments
+
+dont_blame_nrpe=0
+
+
+
+# COMMAND PREFIX
+# This option allows you to prefix all commands with a user-defined string.
+# A space is automatically added between the specified prefix string and the
+# command line from the command definition.
+#
+# *** THIS EXAMPLE MAY POSE A POTENTIAL SECURITY RISK, SO USE WITH CAUTION! ***
+# Usage scenario: 
+# Execute restricted commmands using sudo.  For this to work, you need to add
+# the nagios user to your /etc/sudoers.  An example entry for alllowing 
+# execution of the plugins from might be:
+#
+# nagios          ALL=(ALL) NOPASSWD: /usr/lib/nagios/plugins/
+#
+# This lets the nagios user run all commands in that directory (and only them)
+# without asking for a password.  If you do this, make sure you don't give
+# random users write access to that directory or its contents!
+
+# command_prefix=/usr/bin/sudo 
+
+
+
+# DEBUGGING OPTION
+# This option determines whether or not debugging messages are logged to the
+# syslog facility.
+# Values: 0=debugging off, 1=debugging on
+
+debug=0
+
+
+
+# COMMAND TIMEOUT
+# This specifies the maximum number of seconds that the NRPE daemon will
+# allow plugins to finish executing before killing them off.
+
+command_timeout=60
+
+
+
+# CONNECTION TIMEOUT
+# This specifies the maximum number of seconds that the NRPE daemon will
+# wait for a connection to be established before exiting. This is sometimes
+# seen where a network problem stops the SSL being established even though
+# all network sessions are connected. This causes the nrpe daemons to
+# accumulate, eating system resources. Do not set this too low.
+
+connection_timeout=300
+
+
+
+# WEEK RANDOM SEED OPTION
+# This directive allows you to use SSL even if your system does not have
+# a /dev/random or /dev/urandom (on purpose or because the necessary patches
+# were not applied). The random number generator will be seeded from a file
+# which is either a file pointed to by the environment valiable $RANDFILE
+# or $HOME/.rnd. If neither exists, the pseudo random number generator will
+# be initialized and a warning will be issued.
+# Values: 0=only seed from /dev/[u]random, 1=also seed from weak randomness
+
+#allow_weak_random_seed=1
+
+
+
+# INCLUDE CONFIG FILE
+# This directive allows you to include definitions from an external config file.
+
+#include=<somefile.cfg>
+
+
+
+# INCLUDE CONFIG DIRECTORY
+# This directive allows you to include definitions from config files (with a
+# .cfg extension) in one or more directories (with recursion).
+
+#include_dir=<somedirectory>
+#include_dir=<someotherdirectory>
+
+
+
+# COMMAND DEFINITIONS
+# Command definitions that this daemon will run.  Definitions
+# are in the following format:
+#
+# command[<command_name>]=<command_line>
+#
+# When the daemon receives a request to return the results of <command_name>
+# it will execute the command specified by the <command_line> argument.
+#
+# Unlike Nagios, the command line cannot contain macros - it must be
+# typed exactly as it should be executed.
+#
+# Note: Any plugins that are used in the command lines must reside
+# on the machine that this daemon is running on!  The examples below
+# assume that you have plugins installed in a /usr/local/nagios/libexec
+# directory.  Also note that you will have to modify the definitions below
+# to match the argument format the plugins expect.  Remember, these are
+# examples only!
+
+
+# The following examples use hardcoded command arguments...
+
+#command[check_users]=/usr/lib64/nagios/plugins/check_users -w 5 -c 10
+#command[check_load]=/usr/lib64/nagios/plugins/check_load -w 15,10,5 -c 30,25,20
+#command[check_hda1]=/usr/lib64/nagios/plugins/check_disk -w 20% -c 10% -p /dev/hda1
+#command[check_zombie_procs]=/usr/lib64/nagios/plugins/check_procs -w 5 -c 10 -s Z
+#command[check_total_procs]=/usr/lib64/nagios/plugins/check_procs -w 150 -c 200 
+
+
+# The following examples allow user-supplied arguments and can
+# only be used if the NRPE daemon was compiled with support for 
+# command arguments *AND* the dont_blame_nrpe directive in this
+# config file is set to '1'.  This poses a potential security risk, so
+# make sure you read the SECURITY file before doing this.
+
+command[check_users]=/usr/lib64/nagios/plugins/check_users -w 25 -c 50
+command[check_load]=/usr/lib64/nagios/plugins/check_load -w 50:50:50 -c 100:50:50
+command[check_disk]=/usr/lib64/nagios/plugins/check_disk -w 10% -c 5% -A -i ^/mnt
+command[check_procs_cpu]=/usr/lib64/nagios/plugins/check_procs -w 4 -c 6 -P 50
+command[check_procs_crond]=/usr/lib64/nagios/plugins/check_procs -w 1: -c 1: -C crond
+command[check_procs_nscd]=/usr/lib64/nagios/plugins/check_procs -w 1:256 -c 1:512 -u nscd
+command[check_procs_postfix]=/usr/lib64/nagios/plugins/check_procs -w 1:128 -c 1:256 -u postfix
+command[check_postfix_mailq]=/usr/lib64/nagios/plugins/check_mailq -w 500 -c 1000 -M postfix
+command[check_afs]=/etc/nagios/check_afs
+command[check_afs_athena]=/etc/nagios/check_afs athena
+command[check_afs_sipb]=/etc/nagios/check_afs sipb
+command[check_cron_working]=/etc/nagios/check_cron_working
+command[check_ldap_mmr]=/etc/nagios/check_ldap_mmr
+command[check_kern_taint]=/etc/nagios/check_kern_taint
+command[check_backend]=/usr/lib64/nagios/plugins/check_ping -H 172.21.0.52 -w 500.0,30% -c 3000.0,80%   # sql.mit.edu backend IP
Index: tags/fc15-eol/server/fedora/config/etc/named.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/named.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/named.conf	(revision 2244)
@@ -0,0 +1,39 @@
+//
+// named.conf
+//
+// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
+// server as a caching only nameserver (as a localhost DNS resolver only).
+//
+// See /usr/share/doc/bind*/sample/ for example named configuration files.
+//
+
+options {
+	listen-on port 53 { 127.0.0.1; };
+	listen-on-v6 port 53 { ::1; };
+	directory 	"/var/named";
+	dump-file 	"/var/named/data/cache_dump.db";
+        statistics-file "/var/named/data/named_stats.txt";
+        memstatistics-file "/var/named/data/named_mem_stats.txt";
+	allow-query     { localhost; };
+	recursion yes;
+	#dnssec-enable yes;
+	#dnssec-validation yes;
+	#dnssec-lookaside . trust-anchor dlv.isc.org.;
+};
+
+logging {
+        channel default_debug {
+                file "data/named.run";
+                severity dynamic;
+        };
+};
+
+zone "." IN {
+	type hint;
+	file "named.ca";
+};
+
+include "/etc/named.rfc1912.zones";
+
+#include "/etc/pki/dnssec-keys//named.dnssec.keys";
+#include "/etc/pki/dnssec-keys//dlv/dlv.isc.org.conf";
Index: tags/fc15-eol/server/fedora/config/etc/nscd.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/nscd.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/nscd.conf	(revision 2244)
@@ -0,0 +1,80 @@
+#
+# /etc/nscd.conf
+#
+# An example Name Service Cache config file.  This file is needed by nscd.
+#
+# Legal entries are:
+#
+#	logfile			<file>
+#	debug-level		<level>
+#	threads			<initial #threads to use>
+#	max-threads		<maximum #threads to use>
+#	server-user             <user to run server as instead of root>
+#		server-user is ignored if nscd is started with -S parameters
+#       stat-user               <user who is allowed to request statistics>
+#	reload-count		unlimited|<number>
+#	paranoia		<yes|no>
+#	restart-interval	<time in seconds>
+#
+#       enable-cache		<service> <yes|no>
+#	positive-time-to-live	<service> <time in seconds>
+#	negative-time-to-live   <service> <time in seconds>
+#       suggested-size		<service> <prime number>
+#	check-files		<service> <yes|no>
+#	persistent		<service> <yes|no>
+#	shared			<service> <yes|no>
+#	max-db-size		<service> <number bytes>
+#	auto-propagate		<service> <yes|no>
+#
+# Currently supported cache names (services): passwd, group, hosts, services
+#
+
+
+	logfile			/var/log/nscd.log
+	threads			32
+	max-threads		128
+	server-user		nscd
+#	stat-user		somebody
+	debug-level		0
+#31
+#	reload-count		5
+#	paranoia		yes
+#	restart-interval	3600
+
+	enable-cache		passwd		yes
+	positive-time-to-live	passwd		120
+	negative-time-to-live	passwd		5
+	suggested-size		passwd		1999
+	check-files		passwd		yes
+	persistent		passwd		no
+	shared			passwd		yes
+	max-db-size		passwd		33554432
+	auto-propagate		passwd		yes
+
+	enable-cache		group		yes
+	positive-time-to-live	group		3600
+	negative-time-to-live	group		5
+	suggested-size		group		1999
+	check-files		group		yes
+	persistent		group		no
+	shared			group		yes
+	max-db-size		group		33554432
+	auto-propagate		group		yes
+
+	enable-cache		hosts		no
+	positive-time-to-live	hosts		3600
+	negative-time-to-live	hosts		20
+	suggested-size		hosts		1999
+	check-files		hosts		yes
+	persistent		hosts		yes
+	shared			hosts		yes
+	max-db-size		hosts		33554432
+
+	enable-cache		services	no
+	positive-time-to-live	services	28800
+	negative-time-to-live	services	20
+	suggested-size		services	211
+	check-files		services	yes
+	persistent		services	yes
+	shared			services	yes
+	max-db-size		services	33554432
Index: tags/fc15-eol/server/fedora/config/etc/nslcd.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/nslcd.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/nslcd.conf	(revision 2244)
@@ -0,0 +1,139 @@
+# This is the configuration file for the LDAP nameservice
+# switch library's nslcd daemon. It configures the mapping
+# between NSS names (see /etc/nsswitch.conf) and LDAP
+# information in the directory.
+# See the manual page nslcd.conf(5) for more information.
+
+# The user and group nslcd should run as.
+uid nslcd
+gid ldap
+
+# The uri pointing to the LDAP server to use for name lookups.
+# Multiple entries may be specified. The address that is used
+# here should be resolvable without using LDAP (obviously).
+#uri ldap://127.0.0.1/
+#uri ldaps://127.0.0.1/
+#uri ldapi://%2fvar%2frun%2fldapi_sock/
+# Note: %2f encodes the '/' used as directory separator
+# uri ldap://127.0.0.1/
+
+# The LDAP version to use (defaults to 3
+# if supported by client library)
+#ldap_version 3
+
+# The distinguished name of the search base.
+# base dc=example,dc=com
+
+# The distinguished name to bind to the server with.
+# Optional: default is to bind anonymously.
+#binddn cn=proxyuser,dc=example,dc=com
+
+# The credentials to bind with.
+# Optional: default is no credentials.
+# Note that if you set a bindpw you should check the permissions of this file.
+#bindpw secret
+
+# The distinguished name to perform password modifications by root by.
+#rootpwmoddn cn=admin,dc=example,dc=com
+
+# The default search scope.
+#scope sub
+#scope one
+#scope base
+
+# Customize certain database lookups.
+#base   group  ou=Groups,dc=example,dc=com
+#base   passwd ou=People,dc=example,dc=com
+#base   shadow ou=People,dc=example,dc=com
+#scope  group  onelevel
+#scope  hosts  sub
+
+# Bind/connect timelimit.
+#bind_timelimit 30
+
+# Search timelimit.
+#timelimit 30
+
+# Idle timelimit. nslcd will close connections if the
+# server has not been contacted for the number of seconds.
+#idle_timelimit 3600
+
+# Use StartTLS without verifying the server certificate.
+#ssl start_tls
+#tls_reqcert never
+
+# CA certificates for server certificate verification
+#tls_cacertdir /etc/ssl/certs
+#tls_cacertfile /etc/ssl/ca.cert
+
+# Seed the PRNG if /dev/urandom is not provided
+#tls_randfile /var/run/egd-pool
+
+# SSL cipher suite
+# See man ciphers for syntax
+#tls_ciphers TLSv1
+
+# Client certificate and key
+# Use these, if your server requires client authentication.
+#tls_cert
+#tls_key
+
+# NDS mappings
+#map group uniqueMember member
+
+# Mappings for Services for UNIX 3.5
+#filter passwd (objectClass=User)
+#map    passwd uid              msSFU30Name
+#map    passwd userPassword     msSFU30Password
+#map    passwd homeDirectory    msSFU30HomeDirectory
+#map    passwd homeDirectory    msSFUHomeDirectory
+#filter shadow (objectClass=User)
+#map    shadow uid              msSFU30Name
+#map    shadow userPassword     msSFU30Password
+#filter group  (objectClass=Group)
+#map    group  uniqueMember     msSFU30PosixMember
+
+# Mappings for Services for UNIX 2.0
+#filter passwd (objectClass=User)
+#map    passwd uid              msSFUName
+#map    passwd userPassword     msSFUPassword
+#map    passwd homeDirectory    msSFUHomeDirectory
+#map    passwd gecos            msSFUName
+#filter shadow (objectClass=User)
+#map    shadow uid              msSFUName
+#map    shadow userPassword     msSFUPassword
+#map    shadow shadowLastChange pwdLastSet
+#filter group  (objectClass=Group)
+#map    group  uniqueMember     posixMember
+
+# Mappings for Active Directory
+#pagesize 1000
+#referrals off
+#filter passwd (&(objectClass=user)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*))
+#map    passwd uid              sAMAccountName
+#map    passwd homeDirectory    unixHomeDirectory
+#map    passwd gecos            displayName
+#filter shadow (&(objectClass=user)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*))
+#map    shadow uid              sAMAccountName
+#map    shadow shadowLastChange pwdLastSet
+#filter group  (objectClass=group)
+#map    group  uniqueMember     member
+
+# Mappings for AIX SecureWay
+#filter passwd (objectClass=aixAccount)
+#map    passwd uid              userName
+#map    passwd userPassword     passwordChar
+#map    passwd uidNumber        uid
+#map    passwd gidNumber        gid
+#filter group  (objectClass=aixAccessGroup)
+#map    group  cn               groupName
+#map    group  uniqueMember     member
+#map    group  gidNumber        gid
+# This comment prevents repeated auto-migration of settings.
+uri ldapi://%2fvar%2frun%2fslapd-scripts.socket/
+base dc=scripts,dc=mit,dc=edu
+base   group  ou=Groups,dc=scripts,dc=mit,dc=edu
+base   passwd ou=People,dc=scripts,dc=mit,dc=edu
+timelimit 120
+bind_timelimit 120
+idle_timelimit 3600
Index: tags/fc15-eol/server/fedora/config/etc/nsswitch.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/nsswitch.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/nsswitch.conf	(revision 2244)
@@ -0,0 +1,74 @@
+#
+# /etc/nsswitch.conf
+#
+# An example Name Service Switch config file. This file should be
+# sorted with the most-used services at the beginning.
+#
+# The entry '[NOTFOUND=return]' means that the search for an
+# entry should stop if the search in the previous entry turned
+# up nothing. Note that if the search failed due to some other reason
+# (like no NIS server responding) then the search continues with the
+# next entry.
+#
+# Legal entries are:
+#
+#	nisplus or nis+		Use NIS+ (NIS version 3)
+#	nis or yp		Use NIS (NIS version 2), also called YP
+#	dns			Use DNS (Domain Name Service)
+#	files			Use the local files
+#	db			Use the local database (.db) files
+#	compat			Use NIS on compat mode
+#	hesiod			Use Hesiod for user lookups
+#	[NOTFOUND=return]	Stop searching if not found so far
+#
+
+# To use db, put the "db" in front of "files" for entries you want to be
+# looked up first in the databases
+#
+# Example:
+#passwd:    db files nisplus nis
+#shadow:    db files nisplus nis
+#group:     db files nisplus nis
+
+# With nss_nonlocal:
+passwd:     files nonlocal
+passwd_nonlocal: ldap
+shadow:     files
+group:      files nonlocal
+group_nonlocal: ldap
+
+## Without nss_nonlocal:
+#passwd:	  files ldap
+#group:	  files ldap
+#shadow:     files
+#passwd: files ldap
+#group: files ldap
+
+#hosts:     db files nisplus nis dns
+hosts:      files dns
+#hosts:      files mdns4_minimal [NOTFOUND=return] dns
+
+# Example - obey only what nisplus tells us...
+#services:   nisplus [NOTFOUND=return] files
+#networks:   nisplus [NOTFOUND=return] files
+#protocols:  nisplus [NOTFOUND=return] files
+#rpc:        nisplus [NOTFOUND=return] files
+#ethers:     nisplus [NOTFOUND=return] files
+#netmasks:   nisplus [NOTFOUND=return] files     
+
+bootparams: nisplus [NOTFOUND=return] files
+
+ethers:     files
+netmasks:   files
+networks:   files
+protocols:  files
+rpc:        files
+services:   files
+
+netgroup:   nisplus
+
+publickey:  nisplus
+
+automount:  files nisplus
+aliases:    files nisplus
+
Index: tags/fc15-eol/server/fedora/config/etc/ntp.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/ntp.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/ntp.conf	(revision 2244)
@@ -0,0 +1,8 @@
+restrict default kod nomodify notrap nopeer noquery
+restrict 127.0.0.1
+server time.mit.edu
+server tick.mit.edu
+server	127.127.1.0
+fudge	127.127.1.0 stratum 10
+driftfile /var/lib/ntp/drift
+keys /etc/ntp/keys
Index: tags/fc15-eol/server/fedora/config/etc/openafs/CellAlias
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/openafs/CellAlias	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/openafs/CellAlias	(revision 2244)
@@ -0,0 +1,15 @@
+#
+# This file can be used to specify AFS cell aliases, one per line.
+# The syntax to specify "my" as an alias for "my.cell.name" is:
+#
+#   my.cell.name	my
+
+athena.mit.edu		athena
+csail.mit.edu		csail
+dev.mit.edu		dev
+lees.mit.edu		lees
+net.mit.edu		net
+ops.mit.edu		ops
+sipb.mit.edu		sipb
+andrew.cmu.edu		andrew
+acpub.duke.edu		acpub
Index: tags/fc15-eol/server/fedora/config/etc/openafs/NetRestrict
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/openafs/NetRestrict	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/openafs/NetRestrict	(revision 2244)
@@ -0,0 +1,12 @@
+18.181.0.46
+18.181.0.50
+18.181.0.49
+18.181.0.43
+172.21.0.57
+172.21.0.53
+172.21.0.167
+172.21.0.228
+172.21.0.236
+172.21.0.237
+172.21.0.234
+172.21.0.235
Index: tags/fc15-eol/server/fedora/config/etc/openafs/ThisCell
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/openafs/ThisCell	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/openafs/ThisCell	(revision 2244)
@@ -0,0 +1,1 @@
+athena.mit.edu
Index: tags/fc15-eol/server/fedora/config/etc/pam.d/crond
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pam.d/crond	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pam.d/crond	(revision 2244)
@@ -0,0 +1,12 @@
+#
+# The PAM configuration file for the cron daemon
+#
+#
+auth	   sufficient pam_rootok.so
+auth       required   pam_env.so
+auth       include    system-auth
+account    required   pam_access.so
+account    include    system-auth
+session    required   pam_loginuid.so
+session    [default=1 success=ignore] pam_succeed_if.so user notin root quiet
+session    include    system-auth
Index: tags/fc15-eol/server/fedora/config/etc/pam.d/mock
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pam.d/mock	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pam.d/mock	(revision 2244)
@@ -0,0 +1,15 @@
+#%PAM-1.0
+auth		sufficient	pam_rootok.so
+auth		sufficient	pam_succeed_if.so user ingroup mock use_uid quiet
+# Uncomment the following line to implicitly trust users in the "wheel" group.
+#auth		sufficient	pam_wheel.so trust use_uid
+# Uncomment the following line to require a user to be in the "wheel" group.
+#auth		required	pam_wheel.so use_uid
+#auth		include		system-auth
+auth		required	pam_deny.so
+account		sufficient	pam_succeed_if.so user ingroup mock use_uid quiet
+#account		include		system-auth
+account		required	pam_deny.so
+password	include		system-auth
+session		include		system-auth
+session		optional	pam_xauth.so
Index: tags/fc15-eol/server/fedora/config/etc/pam.d/sshd
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pam.d/sshd	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pam.d/sshd	(revision 2244)
@@ -0,0 +1,23 @@
+#%PAM-1.0
+# Authentication modules
+
+# If their user exists (success),
+auth	[success=ignore ignore=ignore default=1]	pam_succeed_if.so uid >= 0
+# print the "You don't have tickets" error:
+auth	[success=die ignore=reset default=die]	pam_echo.so file=/etc/issue.net.no_tkt
+# else print the "your account doesn't exist" error:
+auth	[success=die ignore=reset default=die]	pam_echo.so file=/etc/issue.net.no_user
+
+# Set environment variables:
+auth       required     pam_env.so
+# Use Unix authentication and succeed immediately (sufficient):
+auth       sufficient   pam_unix.so try_first_pass
+# If they somehow slipped through, deny:
+auth	   required	pam_deny.so
+
+account    required     pam_nologin.so
+account    include      system-auth
+password   include      system-auth
+session    optional     pam_keyinit.so force revoke
+session    include      system-auth
+session    required     pam_loginuid.so
Index: tags/fc15-eol/server/fedora/config/etc/php.d/_scripts.ini
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/php.d/_scripts.ini	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/php.d/_scripts.ini	(revision 2244)
@@ -0,0 +1,5 @@
+zend_extension = /usr/lib64/php/modules/scripts.so
+cgi.fix_pathinfo=1
+cgi.force_redirect = 0
+memory_limit = 1024M
+date.timezone = America/New_York
Index: tags/fc15-eol/server/fedora/config/etc/php.d/dom.ini
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/php.d/dom.ini	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/php.d/dom.ini	(revision 2244)
@@ -0,0 +1,1 @@
+extension = dom.so
Index: tags/fc15-eol/server/fedora/config/etc/php.d/mysql.ini
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/php.d/mysql.ini	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/php.d/mysql.ini	(revision 2244)
@@ -0,0 +1,1 @@
+extension = mysql.so
Index: tags/fc15-eol/server/fedora/config/etc/php.ini
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/php.ini	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/php.ini	(revision 2244)
@@ -0,0 +1,181 @@
+[PHP]
+engine = On
+zend.ze1_compatibility_mode = Off
+short_open_tag = On
+asp_tags = Off
+precision    =  14
+y2k_compliance = On
+output_buffering = 4096
+zlib.output_compression = Off
+implicit_flush = Off
+unserialize_callback_func=
+serialize_precision = 100
+allow_call_time_pass_reference = Off
+safe_mode = Off
+safe_mode_gid = Off
+safe_mode_include_dir =
+safe_mode_exec_dir =
+safe_mode_allowed_env_vars = PHP_
+safe_mode_protected_env_vars = LD_LIBRARY_PATH
+disable_functions =
+disable_classes =
+expose_php = On
+max_execution_time = 30     ; Maximum execution time of each script, in seconds
+max_input_time = 60	; Maximum amount of time each script may spend parsing request data
+memory_limit = 1024M      ; Maximum amount of memory a script may consume (16MB)
+error_reporting  =  E_ALL
+display_errors = Off
+display_startup_errors = Off
+log_errors = On
+log_errors_max_len = 1024
+ignore_repeated_errors = Off
+ignore_repeated_source = Off
+report_memleaks = On
+track_errors = Off
+variables_order = "EGPCS"
+register_globals = Off
+register_long_arrays = Off
+register_argc_argv = Off
+auto_globals_jit = On
+post_max_size = 8M
+magic_quotes_gpc = Off
+magic_quotes_runtime = Off
+magic_quotes_sybase = Off
+auto_prepend_file =
+auto_append_file =
+default_mimetype = "text/html"
+doc_root =
+user_dir =
+extension_dir = "/usr/lib64/php/modules"
+enable_dl = On
+file_uploads = On
+upload_max_filesize = 2M
+allow_url_fopen = On
+allow_url_include = Off
+default_socket_timeout = 60
+[date]
+date.timezone = "US/Eastern"
+[filter]
+[iconv]
+[sqlite]
+[xmlrpc]
+[Pcre]
+[Syslog]
+define_syslog_variables  = Off
+[mail function]
+smtp_port = 25
+sendmail_path = /usr/sbin/sendmail -t -i
+[SQL]
+sql.safe_mode = Off
+[ODBC]
+odbc.allow_persistent = On
+odbc.check_persistent = On
+odbc.max_persistent = -1
+odbc.max_links = -1
+odbc.defaultlrl = 4096
+odbc.defaultbinmode = 1
+[MySQL]
+mysql.allow_persistent = On
+mysql.max_persistent = -1
+mysql.max_links = -1
+mysql.default_port =
+mysql.default_socket =
+mysql.default_host = 'sql.mit.edu'
+mysql.default_user =
+mysql.default_password =
+mysql.connect_timeout = 60
+mysql.trace_mode = Off
+[MySQLi]
+mysqli.max_links = -1
+mysqli.default_port = 3306
+mysqli.default_socket =
+mysqli.default_host =
+mysqli.default_user =
+mysqli.default_pw =
+mysqli.reconnect = Off
+[mSQL]
+msql.allow_persistent = On
+msql.max_persistent = -1
+msql.max_links = -1
+[PostgresSQL]
+pgsql.allow_persistent = On
+pgsql.auto_reset_persistent = Off
+pgsql.max_persistent = -1
+pgsql.max_links = -1
+pgsql.ignore_notice = 0
+pgsql.log_notice = 0
+[Sybase]
+sybase.allow_persistent = On
+sybase.max_persistent = -1
+sybase.max_links = -1
+sybase.min_error_severity = 10
+sybase.min_message_severity = 10
+sybase.compatability_mode = Off
+[Sybase-CT]
+sybct.allow_persistent = On
+sybct.max_persistent = -1
+sybct.max_links = -1
+sybct.min_server_severity = 10
+sybct.min_client_severity = 10
+[bcmath]
+bcmath.scale = 0
+[browscap]
+[Informix]
+ifx.default_host =
+ifx.default_user =
+ifx.default_password =
+ifx.allow_persistent = On
+ifx.max_persistent = -1
+ifx.max_links = -1
+ifx.textasvarchar = 0
+ifx.byteasvarchar = 0
+ifx.charasvarchar = 0
+ifx.blobinfile = 0
+ifx.nullformat = 0
+[Session]
+session.save_handler = files
+session.save_path = "/tmp/sessions"
+session.use_cookies = 1
+session.name = PHPSESSID
+session.auto_start = 0
+session.cookie_lifetime = 0
+session.cookie_path = /
+session.cookie_domain =
+session.cookie_httponly = 
+session.serialize_handler = php
+session.gc_probability = 1
+session.gc_divisor     = 1000
+session.gc_maxlifetime = 1440
+session.bug_compat_42 = 0
+session.bug_compat_warn = 1
+session.referer_check =
+session.entropy_length = 0
+session.entropy_file =
+session.cache_limiter = nocache
+session.cache_expire = 180
+session.use_trans_sid = 0
+session.hash_function = 0
+session.hash_bits_per_character = 5
+url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry"
+[MSSQL]
+mssql.allow_persistent = On
+mssql.max_persistent = -1
+mssql.max_links = -1
+mssql.min_error_severity = 10
+mssql.min_message_severity = 10
+mssql.compatability_mode = Off
+mssql.secure_connection = Off
+[Assertion]
+[COM]
+[mbstring]
+[FrontBase]
+[gd]
+[exif]
+[Tidy]
+tidy.clean_output = Off
+[soap]
+soap.wsdl_cache_enabled=1
+soap.wsdl_cache_dir="/tmp"
+soap.wsdl_cache_ttl=86400
+[cgi]
+cgi.fix_pathinfo = 1
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ai6034.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ai6034.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ai6034.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Fri Aug 19 09:30:50 2011
+Date: Fri, 19 Aug 2011 09:30:48 -0400
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1702392] certificate renewal for scripts-vhost ai6034.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            ab:08:ed:7a:2f:37:38:c3:9f:6c:01:8e:ff:f2:82:40
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Aug 17 16:00:00 2011 GMT
+            Not After : Aug 16 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=ai6034.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        0e:54:0f:38:76:76:1a:05:e4:2c:b7:55:b3:ae:08:0d:2a:b7:
+        94:67:e5:0b:37:cd:1f:7b:0e:70:70:a6:9a:0f:2b:ed:24:66:
+        00:90:35:d0:7d:98:78:68:9e:73:8a:98:43:db:63:c8:10:63:
+        ce:45:d5:f5:31:69:bf:56:25:92:f3:0c:83:a5:a9:58:94:b9:
+        99:25:7a:db:a5:ca:22:47:20:de:f4:3c:b1:73:ae:9f:7b:17:
+        86:7f:0b:ca:52:cd:55:8a:05:1d:5d:87:61:d1:cf:c7:af:43:
+        7c:e1:d4:9b:8d:31:ce:ef:51:ec:fe:f7:63:38:d8:63:cd:5a:
+        ff:ef
+-----BEGIN CERTIFICATE-----
+MIIFAjCCBGugAwIBAgIRAKsI7XovNzjDn2wBjv/ygkAwDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMTA4MTcxNjAwMDBaFw0x
+MjA4MTYxNjAwMDBaMIHQMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTEXMBUGA1UEAxMOYWk2MDM0Lm1pdC5lZHUx
+HjAcBgkqhkiG9w0BCQEWD3NjcmlwdHNAbWl0LmVkdTCCAiIwDQYJKoZIhvcNAQEB
+BQADggIPADCCAgoCggIBAL+j8nuYzBanV+aShTRW8eNig55qTzWd8M+Jh3Pjk/e3
+AVc4bun8WU0k66cXR8osUQ5FyLdoyQ4yJuCR0wZcjHwObJkMskYFD03xsMdeNQZi
+/irWDxsstQIkTMMGceyUyh2qr365LcBVS8y8UT12aFvT7TXQA7obbPOg2NPca0Sw
+XgFR0wLMStpSEt41MWkWWkiLD86tTeTVixE2f4cc/YTaQy6HL0FwrK3fVMDt9iFR
++sUG8BvrobC/TRxCNIrVb/clZnOPYMTXjTOR9EY6lwlZAf/DZJRASDBo8G4DJnTC
+obPXy5T8blOKKp79sU/EdFYlYx+qvZUleJxFRhsMIXHrhJTQsvHaUvbRf2MdCCNS
+X8L5TaykROWaVHD8yfzU1LcddZUA478+TPNDw5bHCSopRRLSMdZ5TIrnVCcixoCu
+hyNW8Y1Jm8j67TNbX1Z2yA9+hRRpxEgxBzmlNIHyaxVQIvu7LK1LhOpVZPfeVp3Q
+ttB9HhtRUDdElObEFetFMfGz7A+zqQz4HEfHUQAF7+6wPZ9+B6c46INMPds0tiQM
+kFfA+dBkFIqTR5tB9aMUHZ4YXdXYZq/188gvvKcCp+/c8A7HR40u1qhiQpNbfPU1
++DEQezjUQCRogRMny/t2DtGZFNjV6/dpZI+vj4K7JCn51CkdzuYUukyLCf9Gzott
+AgMBAAGjgaswgagwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBeAwJwYDVR0l
+BCAwHgYIKwYBBQUHAwEGCCsGAQUFBwMEBggrBgEFBQcDAjALBgNVHQ8EBAMCBeAw
+HQYDVR0OBBYEFMsRtwFfhlVPRV6rJ2m+4TyJelViMDMGA1UdHwQsMCowKKAmoCSG
+Imh0dHA6Ly9jYS5taXQuZWR1L2NhL21pdHNlcnZlci5jcmwwDQYJKoZIhvcNAQEF
+BQADgYEADlQPOHZ2GgXkLLdVs64IDSq3lGflCzfNH3sOcHCmmg8r7SRmAJA10H2Y
+eGiec4qYQ9tjyBBjzkXV9TFpv1YlkvMMg6WpWJS5mSV626XKIkcg3vQ8sXOun3sX
+hn8LylLNVYoFHV2HYdHPx69DfOHUm40xzu9R7P73YzjYY81a/+8=
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ailg-bdf.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ailg-bdf.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ailg-bdf.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Tue Jul  5 15:06:58 2011
+Date: Tue, 5 Jul 2011 15:06:56 -0400
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1657448] certificate signing request for ailg-bdf.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            38:1f:e2:c8:5f:e3:26:1b:3f:fc:95:4a:c6:24:51:4d
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Jul  4 16:00:00 2011 GMT
+            Not After : Jul  4 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=ailg-bdf.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        66:12:b1:ad:fd:d3:45:d4:46:83:38:1e:4c:6c:32:23:29:f9:
+        a5:19:1d:07:e2:2a:b3:a3:3e:14:4e:cc:db:21:2c:b6:c6:36:
+        d9:a8:a5:3a:da:3a:99:f4:f9:f8:ce:f6:93:e1:af:d9:dd:8d:
+        ef:dc:db:48:37:2c:75:97:b9:20:16:80:2b:7f:3a:73:95:b4:
+        d2:c7:34:05:83:91:73:70:47:4a:59:99:bc:54:b5:e4:ec:08:
+        a7:cf:35:cf:18:eb:16:ad:9d:39:d4:9c:6a:24:87:16:af:e3:
+        10:65:e4:0e:94:91:2e:d8:50:ed:b6:ce:9e:d1:9a:5d:e9:a1:
+        d0:d9
+-----BEGIN CERTIFICATE-----
+MIIFAzCCBGygAwIBAgIQOB/iyF/jJhs//JVKxiRRTTANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMDcwNDE2MDAwMFoXDTEy
+MDcwNDE2MDAwMFowgdIxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRkwFwYDVQQDExBhaWxnLWJkZi5taXQuZWR1
+MR4wHAYJKoZIhvcNAQkBFg9zY3JpcHRzQG1pdC5lZHUwggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQC/o/J7mMwWp1fmkoU0VvHjYoOeak81nfDPiYdz45P3
+twFXOG7p/FlNJOunF0fKLFEORci3aMkOMibgkdMGXIx8DmyZDLJGBQ9N8bDHXjUG
+Yv4q1g8bLLUCJEzDBnHslModqq9+uS3AVUvMvFE9dmhb0+010AO6G2zzoNjT3GtE
+sF4BUdMCzEraUhLeNTFpFlpIiw/OrU3k1YsRNn+HHP2E2kMuhy9BcKyt31TA7fYh
+UfrFBvAb66Gwv00cQjSK1W/3JWZzj2DE140zkfRGOpcJWQH/w2SUQEgwaPBuAyZ0
+wqGz18uU/G5Tiiqe/bFPxHRWJWMfqr2VJXicRUYbDCFx64SU0LLx2lL20X9jHQgj
+Ul/C+U2spETlmlRw/Mn81NS3HXWVAOO/PkzzQ8OWxwkqKUUS0jHWeUyK51QnIsaA
+rocjVvGNSZvI+u0zW19WdsgPfoUUacRIMQc5pTSB8msVUCL7uyytS4TqVWT33lad
+0LbQfR4bUVA3RJTmxBXrRTHxs+wPs6kM+BxHx1EABe/usD2ffgenOOiDTD3bNLYk
+DJBXwPnQZBSKk0ebQfWjFB2eGF3V2Gav9fPIL7ynAqfv3PAOx0eNLtaoYkKTW3z1
+NfgxEHs41EAkaIETJ8v7dg7RmRTY1ev3aWSPr4+CuyQp+dQpHc7mFLpMiwn/Rs6L
+bQIDAQABo4GrMIGoMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgXgMCcGA1Ud
+JQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDBAYIKwYBBQUHAwIwCwYDVR0PBAQDAgXg
+MB0GA1UdDgQWBBTLEbcBX4ZVT0VeqydpvuE8iXpVYjAzBgNVHR8ELDAqMCigJqAk
+hiJodHRwOi8vY2EubWl0LmVkdS9jYS9taXRzZXJ2ZXIuY3JsMA0GCSqGSIb3DQEB
+BQUAA4GBAGYSsa3900XURoM4HkxsMiMp+aUZHQfiKrOjPhROzNshLLbGNtmopTra
+Opn0+fjO9pPhr9ndje/c20g3LHWXuSAWgCt/OnOVtNLHNAWDkXNwR0pZmbxUteTs
+CKfPNc8Y6xatnTnUnGokhxav4xBl5A6UkS7YUO22zp7Rml3podDZ
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/asa.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/asa.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/asa.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Thu Mar 29 13:45:20 2012
+Date: Thu, 29 Mar 2012 13:45:18 -0400
+From: mitcert@MIT.EDU
+To: achernya@mit.edu
+Subject: [help.mit.edu #1938931] certificate renewal for scripts-vhost asa.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            c6:db:43:24:bc:b9:65:e5:c7:32:8b:25:fc:76:81:ee
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Mar 28 16:00:00 2012 GMT
+            Not After : Mar 28 16:00:00 2013 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=asa.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        48:1c:cf:c1:73:3c:ba:43:26:49:cf:d7:95:cc:1a:cf:d3:5c:
+        dc:99:d7:e9:f6:b0:ee:52:49:b0:c8:69:bb:37:ab:b4:3c:c8:
+        d5:05:f2:f1:e7:e4:27:38:0f:b5:4c:31:a1:dd:72:f0:e5:70:
+        de:df:23:aa:88:ca:0d:a5:d4:8b:1a:cc:e6:e4:08:bf:d4:01:
+        fe:5d:22:be:18:d0:a5:31:ab:10:2b:58:42:b0:1d:33:f9:59:
+        14:33:9a:2c:2b:db:02:92:27:52:e1:82:cb:a3:73:f3:41:f6:
+        dc:a2:d6:b8:33:55:ce:fc:8c:87:02:46:47:32:82:5e:ca:e6:
+        b3:78
+-----BEGIN CERTIFICATE-----
+MIIE/zCCBGigAwIBAgIRAMbbQyS8uWXlxzKLJfx2ge4wDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMjAzMjgxNjAwMDBaFw0x
+MzAzMjgxNjAwMDBaMIHNMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTEUMBIGA1UEAxMLYXNhLm1pdC5lZHUxHjAc
+BgkqhkiG9w0BCQEWD3NjcmlwdHNAbWl0LmVkdTCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBAL+j8nuYzBanV+aShTRW8eNig55qTzWd8M+Jh3Pjk/e3AVc4
+bun8WU0k66cXR8osUQ5FyLdoyQ4yJuCR0wZcjHwObJkMskYFD03xsMdeNQZi/irW
+DxsstQIkTMMGceyUyh2qr365LcBVS8y8UT12aFvT7TXQA7obbPOg2NPca0SwXgFR
+0wLMStpSEt41MWkWWkiLD86tTeTVixE2f4cc/YTaQy6HL0FwrK3fVMDt9iFR+sUG
+8BvrobC/TRxCNIrVb/clZnOPYMTXjTOR9EY6lwlZAf/DZJRASDBo8G4DJnTCobPX
+y5T8blOKKp79sU/EdFYlYx+qvZUleJxFRhsMIXHrhJTQsvHaUvbRf2MdCCNSX8L5
+TaykROWaVHD8yfzU1LcddZUA478+TPNDw5bHCSopRRLSMdZ5TIrnVCcixoCuhyNW
+8Y1Jm8j67TNbX1Z2yA9+hRRpxEgxBzmlNIHyaxVQIvu7LK1LhOpVZPfeVp3QttB9
+HhtRUDdElObEFetFMfGz7A+zqQz4HEfHUQAF7+6wPZ9+B6c46INMPds0tiQMkFfA
++dBkFIqTR5tB9aMUHZ4YXdXYZq/188gvvKcCp+/c8A7HR40u1qhiQpNbfPU1+DEQ
+ezjUQCRogRMny/t2DtGZFNjV6/dpZI+vj4K7JCn51CkdzuYUukyLCf9GzottAgMB
+AAGjgaswgagwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBeAwJwYDVR0lBCAw
+HgYIKwYBBQUHAwEGCCsGAQUFBwMEBggrBgEFBQcDAjALBgNVHQ8EBAMCBeAwHQYD
+VR0OBBYEFMsRtwFfhlVPRV6rJ2m+4TyJelViMDMGA1UdHwQsMCowKKAmoCSGImh0
+dHA6Ly9jYS5taXQuZWR1L2NhL21pdHNlcnZlci5jcmwwDQYJKoZIhvcNAQEFBQAD
+gYEASBzPwXM8ukMmSc/Xlcwaz9Nc3JnX6faw7lJJsMhpuzertDzI1QXy8efkJzgP
+tUwxod1y8OVw3t8jqojKDaXUixrM5uQIv9QB/l0ivhjQpTGrECtYQrAdM/lZFDOa
+LCvbApInUuGCy6Nz80H23KLWuDNVzvyMhwJGRzKCXsrms3g=
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ashdown.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ashdown.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ashdown.pem	(revision 2244)
@@ -0,0 +1,111 @@
+From mitcert@MIT.EDU Tue Nov  8 13:44:14 2011
+Date: Tue, 8 Nov 2011 13:44:13 -0500
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1791901] certificate signing request for scripts-vhost ashdown.mit.edu 
+
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            3f:ad:2c:25:f1:fc:32:b1:75:33:8f:8f:77:24:f1:0d
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Nov  7 17:00:00 2011 GMT
+            Not After : Nov  7 17:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=ashdown.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        44:d4:97:81:64:8d:bd:91:b2:4e:68:1a:d2:4a:a5:59:34:30:
+        f7:f6:fd:21:9b:e0:68:07:63:39:9c:c7:e6:c7:39:95:7c:55:
+        92:9b:bc:c2:39:ce:bb:74:78:72:ed:75:a7:9c:ce:82:1b:75:
+        e3:31:5c:77:34:0f:0c:ea:ec:53:79:f4:f6:76:1a:14:76:fc:
+        ab:6a:8c:b5:a7:89:5c:cd:ab:a5:ac:9d:b8:58:83:98:19:6b:
+        d8:6a:cb:f8:2d:60:ab:aa:f2:3b:45:16:8f:18:29:92:8b:96:
+        eb:06:34:08:32:27:70:a3:ab:37:32:fa:3f:73:da:18:94:9d:
+        22:91
+-----BEGIN CERTIFICATE-----
+MIIFAjCCBGugAwIBAgIQP60sJfH8MrF1M4+PdyTxDTANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMTEwNzE3MDAwMFoXDTEy
+MTEwNzE3MDAwMFowgdExCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRgwFgYDVQQDEw9hc2hkb3duLm1pdC5lZHUx
+HjAcBgkqhkiG9w0BCQEWD3NjcmlwdHNAbWl0LmVkdTCCAiIwDQYJKoZIhvcNAQEB
+BQADggIPADCCAgoCggIBAL+j8nuYzBanV+aShTRW8eNig55qTzWd8M+Jh3Pjk/e3
+AVc4bun8WU0k66cXR8osUQ5FyLdoyQ4yJuCR0wZcjHwObJkMskYFD03xsMdeNQZi
+/irWDxsstQIkTMMGceyUyh2qr365LcBVS8y8UT12aFvT7TXQA7obbPOg2NPca0Sw
+XgFR0wLMStpSEt41MWkWWkiLD86tTeTVixE2f4cc/YTaQy6HL0FwrK3fVMDt9iFR
++sUG8BvrobC/TRxCNIrVb/clZnOPYMTXjTOR9EY6lwlZAf/DZJRASDBo8G4DJnTC
+obPXy5T8blOKKp79sU/EdFYlYx+qvZUleJxFRhsMIXHrhJTQsvHaUvbRf2MdCCNS
+X8L5TaykROWaVHD8yfzU1LcddZUA478+TPNDw5bHCSopRRLSMdZ5TIrnVCcixoCu
+hyNW8Y1Jm8j67TNbX1Z2yA9+hRRpxEgxBzmlNIHyaxVQIvu7LK1LhOpVZPfeVp3Q
+ttB9HhtRUDdElObEFetFMfGz7A+zqQz4HEfHUQAF7+6wPZ9+B6c46INMPds0tiQM
+kFfA+dBkFIqTR5tB9aMUHZ4YXdXYZq/188gvvKcCp+/c8A7HR40u1qhiQpNbfPU1
++DEQezjUQCRogRMny/t2DtGZFNjV6/dpZI+vj4K7JCn51CkdzuYUukyLCf9Gzott
+AgMBAAGjgaswgagwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBeAwJwYDVR0l
+BCAwHgYIKwYBBQUHAwEGCCsGAQUFBwMEBggrBgEFBQcDAjALBgNVHQ8EBAMCBeAw
+HQYDVR0OBBYEFMsRtwFfhlVPRV6rJ2m+4TyJelViMDMGA1UdHwQsMCowKKAmoCSG
+Imh0dHA6Ly9jYS5taXQuZWR1L2NhL21pdHNlcnZlci5jcmwwDQYJKoZIhvcNAQEF
+BQADgYEARNSXgWSNvZGyTmga0kqlWTQw9/b9IZvgaAdjOZzH5sc5lXxVkpu8wjnO
+u3R4cu11p5zOght14zFcdzQPDOrsU3n09nYaFHb8q2qMtaeJXM2rpayduFiDmBlr
+2GrL+C1gq6ryO0UWjxgpkouW6wY0CDIncKOrNzL6P3PaGJSdIpE=
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/axo.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/axo.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/axo.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Mon Aug  1 15:03:52 2011
+Date: Mon, 1 Aug 2011 15:03:51 -0400
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1682240] certificate renewal for scripts-vhost axo.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            37:0b:1f:8e:6e:25:a6:57:db:02:42:b5:49:8d:cd:2e
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Jul 31 16:00:00 2011 GMT
+            Not After : Jul 31 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=axo.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        98:d5:7b:4f:ac:5d:5c:97:20:fa:67:7d:60:d6:63:d5:c5:ff:
+        9e:42:8b:9d:ed:9a:5e:37:d7:2c:73:5f:62:27:29:53:c8:25:
+        fb:5a:98:1e:1b:f8:a0:b3:70:93:f7:7c:a2:04:e0:52:66:a1:
+        e0:10:23:ff:19:cb:9a:82:52:49:9f:34:81:a8:62:28:14:02:
+        16:fb:1e:de:2c:3c:93:c7:47:c2:aa:7b:40:83:38:54:f8:86:
+        00:0e:cb:5e:81:eb:ad:df:cc:47:7d:df:c9:b7:c2:9d:ff:ae:
+        1e:5b:eb:8d:a0:52:31:19:22:e4:4a:b3:0c:da:28:51:4d:34:
+        f8:34
+-----BEGIN CERTIFICATE-----
+MIIE/jCCBGegAwIBAgIQNwsfjm4lplfbAkK1SY3NLjANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMDczMTE2MDAwMFoXDTEy
+MDczMTE2MDAwMFowgc0xCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRQwEgYDVQQDEwtheG8ubWl0LmVkdTEeMBwG
+CSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkqhkiG9w0BAQEFAAOC
+Ag8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mHc+OT97cBVzhu
+6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGwx141BmL+KtYP
+Gyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY09xrRLBeAVHT
+AsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9UwO32IVH6xQbw
+G+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjwbgMmdMKhs9fL
+lPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/Yx0II1JfwvlN
+rKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudUJyLGgK6HI1bx
+jUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk995WndC20H0e
+G1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w92zS2JAyQV8D5
+0GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJCk1t89TX4MRB7
+ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ/0bOi20CAwEA
+AaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF4DAnBgNVHSUEIDAe
+BggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1UdDwQEAwIF4DAdBgNV
+HQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCwwKjAooCagJIYiaHR0
+cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkqhkiG9w0BAQUFAAOB
+gQCY1XtPrF1clyD6Z31g1mPVxf+eQoud7ZpeN9csc19iJylTyCX7WpgeG/igs3CT
+93yiBOBSZqHgECP/GcuaglJJnzSBqGIoFAIW+x7eLDyTx0fCqntAgzhU+IYADste
+geut38xHfd/Jt8Kd/64eW+uNoFIxGSLkSrMM2ihRTTT4NA==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/bakerfoundation.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/bakerfoundation.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/bakerfoundation.pem	(revision 2244)
@@ -0,0 +1,109 @@
+Subject: [help.mit.edu #1820526] CSR for bakerfoundation.mit.edu 
+From: mitcert@MIT.EDU
+To: ezyang@mit.edu
+Date: Tue, 6 Dec 2011 15:07:57 -0500
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            5e:32:8c:04:b9:a3:0c:49:f2:07:6f:d9:61:95:f4:14
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Dec  5 17:00:00 2011 GMT
+            Not After : Dec  5 17:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=bakerfoundation.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        6f:cd:7a:05:c6:48:36:59:63:c9:68:f0:6f:30:8f:fc:45:6b:
+        82:c9:63:c1:99:e6:27:18:a8:2f:db:ef:49:5c:ce:30:a1:b7:
+        c8:16:2a:0a:72:e1:c7:88:40:82:45:f8:19:1e:ba:9b:f0:6d:
+        ce:f0:9f:d7:91:02:a8:3e:62:07:5f:6e:1c:fe:9a:35:09:c9:
+        3a:c7:25:97:cc:d1:2a:9c:de:20:ad:f3:f2:68:3f:34:9b:1c:
+        d6:09:73:2e:f8:dd:18:0e:4a:61:e0:2d:07:e8:30:43:01:ff:
+        49:53:28:5b:2e:12:a5:94:30:a9:1d:4b:4f:e2:34:60:d4:71:
+        59:c8
+-----BEGIN CERTIFICATE-----
+MIIFCjCCBHOgAwIBAgIQXjKMBLmjDEnyB2/ZYZX0FDANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMTIwNTE3MDAwMFoXDTEy
+MTIwNTE3MDAwMFowgdkxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMSAwHgYDVQQDExdiYWtlcmZvdW5kYXRpb24u
+bWl0LmVkdTEeMBwGCSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkq
+hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3w
+z4mHc+OT97cBVzhu6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUP
+TfGwx141BmL+KtYPGyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts
+86DY09xrRLBeAVHTAsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCs
+rd9UwO32IVH6xQbwG+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBI
+MGjwbgMmdMKhs9fLlPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS
+9tF/Yx0II1JfwvlNrKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlM
+iudUJyLGgK6HI1bxjUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE
+6lVk995WndC20H0eG1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjo
+g0w92zS2JAyQV8D50GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7W
+qGJCk1t89TX4MRB7ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6
+TIsJ/0bOi20CAwEAAaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF
+4DAnBgNVHSUEIDAeBggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1Ud
+DwQEAwIF4DAdBgNVHQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCww
+KjAooCagJIYiaHR0cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkq
+hkiG9w0BAQUFAAOBgQBvzXoFxkg2WWPJaPBvMI/8RWuCyWPBmeYnGKgv2+9JXM4w
+obfIFioKcuHHiECCRfgZHrqb8G3O8J/XkQKoPmIHX24c/po1Cck6xyWXzNEqnN4g
+rfPyaD80mxzWCXMu+N0YDkph4C0H6DBDAf9JUyhbLhKllDCpHUtP4jRg1HFZyA==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/barnowl.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/barnowl.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/barnowl.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Sat Oct 15 11:09:48 2011
+Date: Sat, 15 Oct 2011 11:09:47 -0400
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1768745] certificate renewal for scripts-vhost barnowl.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            fd:ac:24:cf:01:84:69:58:3f:21:6e:7a:b4:c8:57:29
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Oct 13 16:00:00 2011 GMT
+            Not After : Oct 11 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=barnowl.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        04:91:75:59:50:a1:47:bf:da:db:39:67:ca:8a:e0:21:c7:5c:
+        53:c2:28:92:42:5d:15:b5:91:f3:2b:b5:db:8b:0f:3e:b5:92:
+        7b:8b:6c:83:d1:7f:99:ff:d8:0e:e0:b8:cc:93:75:83:6a:43:
+        36:b3:9a:bd:a4:93:19:8e:e2:0e:75:80:df:6f:c4:f5:b9:83:
+        ff:e8:05:38:72:3e:29:2f:44:b2:0e:63:0c:9c:40:0b:b7:a8:
+        9c:9e:6d:05:f8:b6:33:58:e0:a3:25:b3:40:51:4d:45:0d:38:
+        b2:92:01:72:d8:3d:07:0b:a2:67:3e:ae:a8:1c:07:ed:c5:fb:
+        34:51
+-----BEGIN CERTIFICATE-----
+MIIFAzCCBGygAwIBAgIRAP2sJM8BhGlYPyFuerTIVykwDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMTEwMTMxNjAwMDBaFw0x
+MjEwMTExNjAwMDBaMIHRMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTEYMBYGA1UEAxMPYmFybm93bC5taXQuZWR1
+MR4wHAYJKoZIhvcNAQkBFg9zY3JpcHRzQG1pdC5lZHUwggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQC/o/J7mMwWp1fmkoU0VvHjYoOeak81nfDPiYdz45P3
+twFXOG7p/FlNJOunF0fKLFEORci3aMkOMibgkdMGXIx8DmyZDLJGBQ9N8bDHXjUG
+Yv4q1g8bLLUCJEzDBnHslModqq9+uS3AVUvMvFE9dmhb0+010AO6G2zzoNjT3GtE
+sF4BUdMCzEraUhLeNTFpFlpIiw/OrU3k1YsRNn+HHP2E2kMuhy9BcKyt31TA7fYh
+UfrFBvAb66Gwv00cQjSK1W/3JWZzj2DE140zkfRGOpcJWQH/w2SUQEgwaPBuAyZ0
+wqGz18uU/G5Tiiqe/bFPxHRWJWMfqr2VJXicRUYbDCFx64SU0LLx2lL20X9jHQgj
+Ul/C+U2spETlmlRw/Mn81NS3HXWVAOO/PkzzQ8OWxwkqKUUS0jHWeUyK51QnIsaA
+rocjVvGNSZvI+u0zW19WdsgPfoUUacRIMQc5pTSB8msVUCL7uyytS4TqVWT33lad
+0LbQfR4bUVA3RJTmxBXrRTHxs+wPs6kM+BxHx1EABe/usD2ffgenOOiDTD3bNLYk
+DJBXwPnQZBSKk0ebQfWjFB2eGF3V2Gav9fPIL7ynAqfv3PAOx0eNLtaoYkKTW3z1
+NfgxEHs41EAkaIETJ8v7dg7RmRTY1ev3aWSPr4+CuyQp+dQpHc7mFLpMiwn/Rs6L
+bQIDAQABo4GrMIGoMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgXgMCcGA1Ud
+JQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDBAYIKwYBBQUHAwIwCwYDVR0PBAQDAgXg
+MB0GA1UdDgQWBBTLEbcBX4ZVT0VeqydpvuE8iXpVYjAzBgNVHR8ELDAqMCigJqAk
+hiJodHRwOi8vY2EubWl0LmVkdS9jYS9taXRzZXJ2ZXIuY3JsMA0GCSqGSIb3DQEB
+BQUAA4GBAASRdVlQoUe/2ts5Z8qK4CHHXFPCKJJCXRW1kfMrtduLDz61knuLbIPR
+f5n/2A7guMyTdYNqQzazmr2kkxmO4g51gN9vxPW5g//oBThyPikvRLIOYwycQAu3
+qJyebQX4tjNY4KMls0BRTUUNOLKSAXLYPQcLomc+rqgcB+3F+zRR
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/bc.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/bc.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/bc.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Thu Mar 29 13:44:52 2012
+Date: Thu, 29 Mar 2012 13:44:49 -0400
+From: mitcert@MIT.EDU
+To: achernya@mit.edu
+Subject: [help.mit.edu #1938930] certificate renewal for scripts-vhost bc.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            c9:b6:55:c1:c2:29:32:7e:43:18:35:ee:e2:a9:4c:35
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Mar 28 16:00:00 2012 GMT
+            Not After : Mar 28 16:00:00 2013 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=bc.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        3f:85:e9:b2:d4:58:d8:1d:7c:db:74:61:03:e7:c6:12:67:8a:
+        26:07:ad:d5:81:6b:e9:79:d4:fe:7a:e0:9f:c9:ab:3d:09:56:
+        70:bb:b4:3e:3c:be:64:2f:7f:a3:fa:de:a6:c9:be:5e:a1:d3:
+        48:be:b0:46:c4:92:3d:74:d2:38:c0:7a:1e:60:b1:ab:30:5a:
+        39:0b:16:fa:01:7a:d3:fe:05:22:ca:cb:0b:89:5a:f4:e5:3d:
+        f3:15:40:87:20:96:e1:04:84:3f:c3:2c:08:91:2d:f2:0f:84:
+        d2:e2:57:d8:00:9a:47:06:00:ec:51:fd:3e:7e:61:ac:11:75:
+        03:ad
+-----BEGIN CERTIFICATE-----
+MIIE/jCCBGegAwIBAgIRAMm2VcHCKTJ+Qxg17uKpTDUwDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMjAzMjgxNjAwMDBaFw0x
+MzAzMjgxNjAwMDBaMIHMMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTETMBEGA1UEAxMKYmMubWl0LmVkdTEeMBwG
+CSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkqhkiG9w0BAQEFAAOC
+Ag8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mHc+OT97cBVzhu
+6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGwx141BmL+KtYP
+Gyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY09xrRLBeAVHT
+AsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9UwO32IVH6xQbw
+G+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjwbgMmdMKhs9fL
+lPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/Yx0II1JfwvlN
+rKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudUJyLGgK6HI1bx
+jUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk995WndC20H0e
+G1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w92zS2JAyQV8D5
+0GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJCk1t89TX4MRB7
+ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ/0bOi20CAwEA
+AaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF4DAnBgNVHSUEIDAe
+BggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1UdDwQEAwIF4DAdBgNV
+HQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCwwKjAooCagJIYiaHR0
+cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkqhkiG9w0BAQUFAAOB
+gQA/hemy1FjYHXzbdGED58YSZ4omB63VgWvpedT+euCfyas9CVZwu7Q+PL5kL3+j
++t6myb5eodNIvrBGxJI9dNI4wHoeYLGrMFo5Cxb6AXrT/gUiyssLiVr05T3zFUCH
+IJbhBIQ/wywIkS3yD4TS4lfYAJpHBgDsUf0+fmGsEXUDrQ==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/blog.gregbrockman.com.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/blog.gregbrockman.com.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/blog.gregbrockman.com.pem	(revision 2244)
@@ -0,0 +1,121 @@
+blog_gregbrockman_com.crt
+-----BEGIN CERTIFICATE-----
+MIIGNDCCBRygAwIBAgIQAdZltKTcjnqxE5k6xsKK5jANBgkqhkiG9w0BAQUFADBx
+MQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD
+VQQHEwdTYWxmb3JkMRowGAYDVQQKExFDb21vZG8gQ0EgTGltaXRlZDEXMBUGA1UE
+AxMOUG9zaXRpdmVTU0wgQ0EwHhcNMTIwMTIyMDAwMDAwWhcNMTMwMTIxMjM1OTU5
+WjBZMSEwHwYDVQQLExhEb21haW4gQ29udHJvbCBWYWxpZGF0ZWQxFDASBgNVBAsT
+C1Bvc2l0aXZlU1NMMR4wHAYDVQQDExVibG9nLmdyZWdicm9ja21hbi5jb20wggIi
+MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC/o/J7mMwWp1fmkoU0VvHjYoOe
+ak81nfDPiYdz45P3twFXOG7p/FlNJOunF0fKLFEORci3aMkOMibgkdMGXIx8DmyZ
+DLJGBQ9N8bDHXjUGYv4q1g8bLLUCJEzDBnHslModqq9+uS3AVUvMvFE9dmhb0+01
+0AO6G2zzoNjT3GtEsF4BUdMCzEraUhLeNTFpFlpIiw/OrU3k1YsRNn+HHP2E2kMu
+hy9BcKyt31TA7fYhUfrFBvAb66Gwv00cQjSK1W/3JWZzj2DE140zkfRGOpcJWQH/
+w2SUQEgwaPBuAyZ0wqGz18uU/G5Tiiqe/bFPxHRWJWMfqr2VJXicRUYbDCFx64SU
+0LLx2lL20X9jHQgjUl/C+U2spETlmlRw/Mn81NS3HXWVAOO/PkzzQ8OWxwkqKUUS
+0jHWeUyK51QnIsaArocjVvGNSZvI+u0zW19WdsgPfoUUacRIMQc5pTSB8msVUCL7
+uyytS4TqVWT33lad0LbQfR4bUVA3RJTmxBXrRTHxs+wPs6kM+BxHx1EABe/usD2f
+fgenOOiDTD3bNLYkDJBXwPnQZBSKk0ebQfWjFB2eGF3V2Gav9fPIL7ynAqfv3PAO
+x0eNLtaoYkKTW3z1NfgxEHs41EAkaIETJ8v7dg7RmRTY1ev3aWSPr4+CuyQp+dQp
+Hc7mFLpMiwn/Rs6LbQIDAQABo4IB3jCCAdowHwYDVR0jBBgwFoAUuMoR6QYxedvD
+lMboGSq8uzUWMaQwHQYDVR0OBBYEFMsRtwFfhlVPRV6rJ2m+4TyJelViMA4GA1Ud
+DwEB/wQEAwIFoDAMBgNVHRMBAf8EAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggr
+BgEFBQcDAjBGBgNVHSAEPzA9MDsGCysGAQQBsjEBAgIHMCwwKgYIKwYBBQUHAgEW
+Hmh0dHA6Ly93d3cucG9zaXRpdmVzc2wuY29tL0NQUzBpBgNVHR8EYjBgMC+gLaAr
+hilodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9Qb3NpdGl2ZVNTTENBLmNybDAtoCug
+KYYnaHR0cDovL2NybC5jb21vZG8ubmV0L1Bvc2l0aXZlU1NMQ0EuY3JsMGsGCCsG
+AQUFBwEBBF8wXTA1BggrBgEFBQcwAoYpaHR0cDovL2NydC5jb21vZG9jYS5jb20v
+UG9zaXRpdmVTU0xDQS5jcnQwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmNvbW9k
+b2NhLmNvbTA7BgNVHREENDAyghVibG9nLmdyZWdicm9ja21hbi5jb22CGXd3dy5i
+bG9nLmdyZWdicm9ja21hbi5jb20wDQYJKoZIhvcNAQEFBQADggEBAB7MDgyAb9aD
+NdTlWepNxjjO02YV7FHbAWeolR/vDomlx1BDbhlet0OL1PfP5iD1OltK7VNEvouX
+e+TSPuouJkH9CFXAwGKrJnrPRPWiFO8FiFlEG9FBwfNOKkJBwEl4gncDXbSJa2+C
+nGHJxt52ZXVC4LasbmV+nyJSGVZF7ovdIJa1dmjKs6jxJdm7H3Wa/jxHPQDJs3XH
+ItNb1Piku5+Zber5E89rQdDdDDHA+7vlfMgJs4L3TPnPWsdysqPIfaVh8AhIL9bR
+yFY0dia2VUuRKbQld2YYvHyoYT2UdvrAyDYd5o9yoMzda5ZHkPpUwcz+BV13fU8i
+mMpY8lfzCLI=
+-----END CERTIFICATE-----
+PositiveSSLCA.crt
+-----BEGIN CERTIFICATE-----
+MIIFAzCCA+ugAwIBAgIQTM1KmltFEyGMz5AviytRcTANBgkqhkiG9w0BAQUFADCB
+lzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug
+Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho
+dHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xHzAdBgNVBAMTFlVUTi1VU0VSRmlyc3Qt
+SGFyZHdhcmUwHhcNMDYwOTE4MDAwMDAwWhcNMjAwNTMwMTA0ODM4WjBxMQswCQYD
+VQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdT
+YWxmb3JkMRowGAYDVQQKExFDb21vZG8gQ0EgTGltaXRlZDEXMBUGA1UEAxMOUG9z
+aXRpdmVTU0wgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC9T3lY
+IpPJKD5SEQAvwKkgitctVR4Q57h/4oYqpOxe6eSSWJZUDfMXukGeFZFV78LuACAY
+RYMm3yDMPbOhEzEKIVx5g3mrJBVcVvC0lZih2tIb6ha1y7ewwVP5pEba8C4kuGKe
+joteK1qWoOpQ6Yj7KCpNmpxIT4O2h65Pxci12f2+P9GnncYsEw3AAcezcPOPabuw
+PBDf6wkAhD9u7/zjLbTHXRHM9/Lx9uLjAH4SDt6NfQDKOj32cuh5JaYIFveriP9W
+XgkXwFqCBWI0KyhIMpfQhAysExjbnmbHqhSLEWlN8QnTul2piDdi2L8Dm53X5gV+
+wmpSqo0HgOqODvMdAgMBAAGjggFuMIIBajAfBgNVHSMEGDAWgBShcl8mGyiYQ5Vd
+BzfVhZadS9LDRTAdBgNVHQ4EFgQUuMoR6QYxedvDlMboGSq8uzUWMaQwDgYDVR0P
+AQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwewYDVR0fBHQwcjA4oDagNIYy
+aHR0cDovL2NybC5jb21vZG9jYS5jb20vVVROLVVTRVJGaXJzdC1IYXJkd2FyZS5j
+cmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29tb2RvLm5ldC9VVE4tVVNFUkZpcnN0LUhh
+cmR3YXJlLmNybDCBhgYIKwYBBQUHAQEEejB4MDsGCCsGAQUFBzAChi9odHRwOi8v
+Y3J0LmNvbW9kb2NhLmNvbS9VVE5BZGRUcnVzdFNlcnZlckNBLmNydDA5BggrBgEF
+BQcwAoYtaHR0cDovL2NydC5jb21vZG8ubmV0L1VUTkFkZFRydXN0U2VydmVyQ0Eu
+Y3J0MA0GCSqGSIb3DQEBBQUAA4IBAQAdtOf5GEhd7fpawx3jt++GFclsE0kWDTGM
+MVzn2odkjq8SFqRaLZIaOz4hZaoXw5V+QBz9FGkGGM2sMexq8RaeiSY9WyGN6Oj5
+qz2qPMuZ8oZfiFMVBRflqNKFp05Jfdbdx4/OiL9lBeAUtTF37r0qhujop2ot2mUZ
+jGfibfZKhWaDtjJNn0IjF9dFQWp2BNStuY9u3MI+6VHyntjzf/tQKvCL/W8NIjYu
+zg5G8t6P2jt9HpOs/PQyKw+rAR+lQI/jJJkfXbKqDLnioeeSDJBLU30fKO5WPa8Y
+Z0nf1R7CqJgrTEeDgUwuRMLvyGPui3tbMfYmYb95HLCpTqnJUHvi
+-----END CERTIFICATE-----
+UTNAddTrustServerCA.crt
+-----BEGIN CERTIFICATE-----
+MIIEhjCCA26gAwIBAgIQUkIGSk83/kNpSHqWZ/9dJzANBgkqhkiG9w0BAQUFADBv
+MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFk
+ZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBF
+eHRlcm5hbCBDQSBSb290MB4XDTA1MDYwNzA4MDkxMFoXDTIwMDUzMDEwNDgzOFow
+gZcxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJVVDEXMBUGA1UEBxMOU2FsdCBMYWtl
+IENpdHkxHjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEhMB8GA1UECxMY
+aHR0cDovL3d3dy51c2VydHJ1c3QuY29tMR8wHQYDVQQDExZVVE4tVVNFUkZpcnN0
+LUhhcmR3YXJlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsffDOD+0
+qH/POYJRZ9Btn9L/WPPnnyvsDYlUmbk4mRb34CF5SMK7YXQSlh08anLVPBBnOjnt
+KxPNZuuVCTOkbJex6MbswXV5nEZejavQav25KlUXEFSzGfCa9vGxXbanbfvgcRdr
+ooj7AN/+GjF3DJoBerEy4ysBBzhuw6VeI7xFm3tQwckwj9vlK3rTW/szQB6g1ZgX
+vIuHw4nTXaCOsqqq9o5piAbF+okh8widaS4JM5spDUYPjMxJNLBpUb35Bs1orWZM
+vD6sYb0KiA7I3z3ufARMnQpea5HW7sftKI2rTYeJc9BupNAeFosU4XZEA39jrOTN
+SZzFkvSrMqFIWwIDAQABo4H0MIHxMB8GA1UdIwQYMBaAFK29mHo0tCb3+sQmVO8D
+veAky1QaMB0GA1UdDgQWBBShcl8mGyiYQ5VdBzfVhZadS9LDRTAOBgNVHQ8BAf8E
+BAMCAQYwDwYDVR0TAQH/BAUwAwEB/zARBgNVHSAECjAIMAYGBFUdIAAwewYDVR0f
+BHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20vQWRkVHJ1c3RFeHRl
+cm5hbENBUm9vdC5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29tb2RvLm5ldC9BZGRU
+cnVzdEV4dGVybmFsQ0FSb290LmNybDANBgkqhkiG9w0BAQUFAAOCAQEAYGQ5WaJD
+ZS79+R/WrjO76FMTxIjuIxpszthkWVNTkOg239T88055L9XmjwzvKkFtcb2beDgj
+03BLhgz9EqciYhLYzOBR7y3lzQxFoura7X7s9zKa5wU1Xm7CLGhonf+M8cpVh8Qv
+sUAG3IQiXG2zzdGbGgozKGYWDL0zwvYH8eOheZTg+NDQ099Shj+p4ckdPoaEsdtf
+7uRJQ8E5fc8vlqd1XX5nZ4TlWSBAvzcivwdDtDDhQ4rNA11tuSnZhKf1YmOEhtY3
+vm9nu/9iVzmdDE2yKmE9HZzvmncgoC/uGnKdsJ2/eBMnBwpgEZP1Dy7J72skg/6b
+kLRLaIHQwvrgPw==
+-----END CERTIFICATE-----
+AddTrustExternalCARoot.crt
+-----BEGIN CERTIFICATE-----
+MIIENjCCAx6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJTRTEU
+MBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFkZFRydXN0IEV4dGVybmFs
+IFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBFeHRlcm5hbCBDQSBSb290
+MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFowbzELMAkGA1UEBhMCU0Ux
+FDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRlcm5h
+bCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9v
+dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALf3GjPm8gAELTngTlvt
+H7xsD821+iO2zt6bETOXpClMfZOfvUq8k+0DGuOPz+VtUFrWlymUWoCwSXrbLpX9
+uMq/NzgtHj6RQa1wVsfwTz/oMp50ysiQVOnGXw94nZpAPA6sYapeFI+eh6FqUNzX
+mk6vBbOmcZSccbNQYArHE504B4YCqOmoaSYYkKtMsE8jqzpPhNjfzp/haW+710LX
+a0Tkx63ubUFfclpxCDezeWWkWaCUN/cALw3CknLa0Dhy2xSoRcRdKn23tNbE7qzN
+E0S3ySvdQwAl+mG5aWpYIxG3pzOPVnVZ9c0p10a3CitlttNCbxWyuHv77+ldU9U0
+WicCAwEAAaOB3DCB2TAdBgNVHQ4EFgQUrb2YejS0Jvf6xCZU7wO94CTLVBowCwYD
+VR0PBAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wgZkGA1UdIwSBkTCBjoAUrb2YejS0
+Jvf6xCZU7wO94CTLVBqhc6RxMG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRU
+cnVzdCBBQjEmMCQGA1UECxMdQWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsx
+IjAgBgNVBAMTGUFkZFRydXN0IEV4dGVybmFsIENBIFJvb3SCAQEwDQYJKoZIhvcN
+AQEFBQADggEBALCb4IUlwtYj4g+WBpKdQZic2YR5gdkeWxQHIzZlj7DYd7usQWxH
+YINRsPkyPef89iYTx4AWpb9a/IfPeHmJIZriTAcKhjW88t5RxNKWt9x+Tu5w/Rw5
+6wwCURQtjr0W4MHfRnXnJK3s9EK0hZNwEGe6nQY1ShjTK3rMUUKhemPR5ruhxSvC
+Nr4TDea9Y355e6cJDUCrat2PisP29owaQgVR1EX1n6diIWgVIEM8med8vSTYqZEX
+c4g/VhsxOBi0cQ+azcgOno4uG+GMmIPLHzHxREzGBHNJdmAPx/i9F4BrLunMTA5a
+mnkPIAou1Z5jJh5VkpTYghdae9C8x49OhgQ=
+-----END CERTIFICATE-----
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/bluechips.emergent-studios.com.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/bluechips.emergent-studios.com.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/bluechips.emergent-studios.com.pem	(revision 2244)
@@ -0,0 +1,150 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 275891 (0x435b3)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=IL, O=StartCom Ltd., OU=Secure Digital Certificate Signing, CN=StartCom Class 1 Primary Intermediate Server CA
+        Validity
+            Not Before: Sep 12 00:58:16 2011 GMT
+            Not After : Sep 12 14:56:41 2012 GMT
+        Subject: description=508223-DC90aIhDy1Y0fd12, CN=bluechips.emergent-studios.com/emailAddress=evan@ebroder.net
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (4096 bit)
+                Modulus:
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            X509v3 Key Usage: 
+                Digital Signature, Key Encipherment, Key Agreement
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 Authority Key Identifier: 
+                keyid:EB:42:34:D0:98:B0:AB:9F:F4:1B:6B:08:F7:CC:64:2E:EF:0E:2C:45
+
+            X509v3 Subject Alternative Name: 
+                DNS:bluechips.emergent-studios.com, DNS:emergent-studios.com
+            X509v3 Certificate Policies: 
+                Policy: 1.3.6.1.4.1.23223.1.2.2
+                  CPS: http://www.startssl.com/policy.pdf
+                  CPS: http://www.startssl.com/intermediate.pdf
+                  User Notice:
+                    Organization: StartCom Certification Authority
+                    Number: 1
+                    Explicit Text: This certificate was issued according to the Class 1 Validation requirements of the StartCom CA policy, reliance only for the intended purpose in compliance of the relying party obligations.
+                  User Notice:
+                    Organization: StartCom Certification Authority
+                    Number: 2
+                    Explicit Text: Liability and warranties are limited! See section "Legal and Limitations" of the StartCom CA policy.
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://crl.startssl.com/crt1-crl.crl
+
+            Authority Information Access: 
+                OCSP - URI:http://ocsp.startssl.com/sub/class1/server/ca
+                CA Issuers - URI:http://aia.startssl.com/certs/sub.class1.server.ca.crt
+
+            X509v3 Issuer Alternative Name: 
+                URI:http://www.startssl.com/
+    Signature Algorithm: sha1WithRSAEncryption
+        14:17:ec:4c:8b:bd:41:b3:23:4b:d6:9f:b5:e9:61:e5:33:70:
+        c6:3b:f7:be:af:c1:d3:26:fa:c4:a4:14:ca:87:b6:a0:fc:cd:
+        63:7c:33:7d:4d:11:8f:cb:9a:b0:6e:6d:0f:89:9f:aa:f5:af:
+        1f:98:03:9a:e8:69:10:d6:5d:1b:7a:7e:bf:26:74:fb:1a:23:
+        3d:12:4b:d7:b4:c1:64:87:56:b6:c9:53:1a:9e:b9:f2:72:a3:
+        1d:6a:f1:b9:b4:e3:6c:6a:6f:fe:5f:13:6f:cc:f6:0c:79:9f:
+        28:35:87:a2:14:fe:37:45:a5:fb:cb:b6:55:c0:37:d8:64:72:
+        29:5e:4e:0c:cf:f4:1a:a5:96:f1:e9:f6:6b:6b:5f:5f:94:05:
+        7a:30:bd:f2:61:5a:d1:bd:0a:a4:13:d9:60:0e:f1:af:15:db:
+        a7:e9:c4:bf:5d:a9:56:39:1a:d3:d7:cc:c6:5d:25:90:3c:3f:
+        c8:6a:1e:34:d0:1e:97:9d:6d:af:16:5a:64:5f:7a:bf:d2:d4:
+        10:8d:e1:ad:75:75:86:7b:ab:5d:f3:27:39:a3:a9:67:18:1a:
+        6a:a3:98:98:f4:1d:15:d4:db:40:c0:fb:cf:6a:95:ae:c2:a1:
+        64:32:dd:3f:9f:ff:bc:fa:ea:f0:46:4f:23:a0:39:27:1c:91:
+        c8:f2:1c:80
+-----BEGIN CERTIFICATE-----
+MIIIPDCCBySgAwIBAgIDBDWzMA0GCSqGSIb3DQEBBQUAMIGMMQswCQYDVQQGEwJJ
+TDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0
+YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3Mg
+MSBQcmltYXJ5IEludGVybWVkaWF0ZSBTZXJ2ZXIgQ0EwHhcNMTEwOTEyMDA1ODE2
+WhcNMTIwOTEyMTQ1NjQxWjBsMSAwHgYDVQQNExc1MDgyMjMtREM5MGFJaER5MVkw
+ZmQxMjEnMCUGA1UEAxMeYmx1ZWNoaXBzLmVtZXJnZW50LXN0dWRpb3MuY29tMR8w
+HQYJKoZIhvcNAQkBFhBldmFuQGVicm9kZXIubmV0MIICIjANBgkqhkiG9w0BAQEF
+AAOCAg8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mHc+OT97cB
+Vzhu6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGwx141BmL+
+KtYPGyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY09xrRLBe
+AVHTAsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9UwO32IVH6
+xQbwG+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjwbgMmdMKh
+s9fLlPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/Yx0II1Jf
+wvlNrKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudUJyLGgK6H
+I1bxjUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk995WndC2
+0H0eG1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w92zS2JAyQ
+V8D50GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJCk1t89TX4
+MRB7ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ/0bOi20C
+AwEAAaOCA8QwggPAMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgOoMBMGA1UdJQQMMAoG
+CCsGAQUFBwMBMB0GA1UdDgQWBBTLEbcBX4ZVT0VeqydpvuE8iXpVYjAfBgNVHSME
+GDAWgBTrQjTQmLCrn/Qbawj3zGQu7w4sRTA/BgNVHREEODA2gh5ibHVlY2hpcHMu
+ZW1lcmdlbnQtc3R1ZGlvcy5jb22CFGVtZXJnZW50LXN0dWRpb3MuY29tMIICIQYD
+VR0gBIICGDCCAhQwggIQBgsrBgEEAYG1NwECAjCCAf8wLgYIKwYBBQUHAgEWImh0
+dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0
+dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgfcGCCsGAQUF
+BwICMIHqMCcWIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MAMCAQEa
+gb5UaGlzIGNlcnRpZmljYXRlIHdhcyBpc3N1ZWQgYWNjb3JkaW5nIHRvIHRoZSBD
+bGFzcyAxIFZhbGlkYXRpb24gcmVxdWlyZW1lbnRzIG9mIHRoZSBTdGFydENvbSBD
+QSBwb2xpY3ksIHJlbGlhbmNlIG9ubHkgZm9yIHRoZSBpbnRlbmRlZCBwdXJwb3Nl
+IGluIGNvbXBsaWFuY2Ugb2YgdGhlIHJlbHlpbmcgcGFydHkgb2JsaWdhdGlvbnMu
+MIGcBggrBgEFBQcCAjCBjzAnFiBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhv
+cml0eTADAgECGmRMaWFiaWxpdHkgYW5kIHdhcnJhbnRpZXMgYXJlIGxpbWl0ZWQh
+IFNlZSBzZWN0aW9uICJMZWdhbCBhbmQgTGltaXRhdGlvbnMiIG9mIHRoZSBTdGFy
+dENvbSBDQSBwb2xpY3kuMDUGA1UdHwQuMCwwKqAooCaGJGh0dHA6Ly9jcmwuc3Rh
+cnRzc2wuY29tL2NydDEtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEF
+BQcwAYYtaHR0cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczEvc2VydmVy
+L2NhMEIGCCsGAQUFBzAChjZodHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0cy9z
+dWIuY2xhc3MxLnNlcnZlci5jYS5jcnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5z
+dGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUAA4IBAQAUF+xMi71BsyNL1p+16WHl
+M3DGO/e+r8HTJvrEpBTKh7ag/M1jfDN9TRGPy5qwbm0PiZ+q9a8fmAOa6GkQ1l0b
+en6/JnT7GiM9EkvXtMFkh1a2yVManrnycqMdavG5tONsam/+XxNvzPYMeZ8oNYei
+FP43RaX7y7ZVwDfYZHIpXk4Mz/QapZbx6fZra19flAV6ML3yYVrRvQqkE9lgDvGv
+Fdun6cS/XalWORrT18zGXSWQPD/Iah400B6XnW2vFlpkX3q/0tQQjeGtdXWGe6td
+8yc5o6lnGBpqo5iY9B0V1NtAwPvPapWuwqFkMt0/n/+8+urwRk8joDknHJHI8hyA
+-----END CERTIFICATE-----
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ca.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ca.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ca.pem	(revision 2244)
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDODCCAqGgAwIBAgIBATANBgkqhkiG9w0BAQUFADBsMQswCQYDVQQGEwJVUzEW
+MBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMlTWFzc2FjaHVzZXR0cyBJ
+bnN0aXR1dGUgb2YgVGVjaG5vbG9neTEVMBMGA1UECxMMQ2xpZW50IENBIHYxMB4X
+DTA2MDYwNzIyMDcyNVoXDTI2MDgwMTIyMDcyNVowbDELMAkGA1UEBhMCVVMxFjAU
+BgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMgSW5z
+dGl0dXRlIG9mIFRlY2hub2xvZ3kxFTATBgNVBAsTDENsaWVudCBDQSB2MTCBnzAN
+BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwV11Ca4OyWTnlF6FH8z8MwCUa3L5JxuF
+srLsz7arGeTDS39WjWywDgCZM3vOCvOpziGFYzicS7n4JQuy04QuT+6Xdc2bEx7u
+JOhoeTz/VypA4DIwcsv20I63Cgr14aMNz5Ur4KWQjyn6zcgQ276fnM/cJD3wzAzX
+2fU9mF/1LFECAwEAAaOB6TCB5jAdBgNVHQ4EFgQUARibj0xtym66P6slAv0eCMB6
+wo8wgZYGA1UdIwSBjjCBi4AUARibj0xtym66P6slAv0eCMB6wo+hcKRuMGwxCzAJ
+BgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNldHRzMS4wLAYDVQQKEyVNYXNz
+YWNodXNldHRzIEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MRUwEwYDVQQLEwxDbGll
+bnQgQ0EgdjGCAQEwDAYDVR0TBAUwAwEB/zALBgNVHQ8EBAMCAQYwEQYJYIZIAYb4
+QgEBBAQDAgEGMA0GCSqGSIb3DQEBBQUAA4GBAC/J7KTQjDXUi9xANDWxZmKc02Yn
+90TBhqbg/f7em6/9SHO9vcSGr04atve79wCxgM46m1Hvd493sxyTgPJSH5Un6GrK
+8CQ1Iyqq4gXvjLBORblricOCnyu5KaaZ63NjYxnjwvwN2uy9opsuXmijMAJ/gL7r
+4Gd9vK+Uzsz0qmJP
+-----END CERTIFICATE-----
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/carepackages.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/carepackages.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/carepackages.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Fri Apr  6 16:53:19 2012
+Date: Fri, 6 Apr 2012 16:53:17 -0400
+From: mitcert@MIT.EDU
+To: achernya@mit.edu
+Subject: [help.mit.edu #1948946] certificate renewal for scripts-vhost carepackages.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            0a:91:73:90:71:e9:a7:75:8a:df:48:65:d3:20:7b:33
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Apr  5 16:00:00 2012 GMT
+            Not After : Apr  4 16:00:00 2013 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=carepackages.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        7d:dc:a7:37:45:ad:a1:70:67:76:03:eb:02:1d:4c:e4:20:2a:
+        9e:6c:fb:f9:5c:2b:4a:d1:45:f5:63:a2:62:e0:1d:03:9d:0b:
+        67:b6:90:d5:cf:52:dd:70:a2:12:81:0e:90:63:c4:f1:6c:c4:
+        36:b1:a0:38:53:1d:23:e1:86:53:df:fa:05:b5:19:0c:e9:81:
+        e4:84:5a:db:38:a2:16:11:ab:97:8d:3a:dc:0d:1d:55:03:a5:
+        c2:0e:9d:c9:8f:95:ef:ea:92:6b:5b:79:3c:df:1b:be:f6:16:
+        eb:b1:77:9c:1d:4a:1a:b7:c0:79:f8:76:9b:65:93:f4:2f:83:
+        6a:13
+-----BEGIN CERTIFICATE-----
+MIIFBzCCBHCgAwIBAgIQCpFzkHHpp3WK30hl0yB7MzANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTEyMDQwNTE2MDAwMFoXDTEz
+MDQwNDE2MDAwMFowgdYxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMR0wGwYDVQQDExRjYXJlcGFja2FnZXMubWl0
+LmVkdTEeMBwGCSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkqhkiG
+9w0BAQEFAAOCAg8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mH
+c+OT97cBVzhu6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGw
+x141BmL+KtYPGyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY
+09xrRLBeAVHTAsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9U
+wO32IVH6xQbwG+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjw
+bgMmdMKhs9fLlPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/
+Yx0II1JfwvlNrKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudU
+JyLGgK6HI1bxjUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk
+995WndC20H0eG1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w9
+2zS2JAyQV8D50GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJC
+k1t89TX4MRB7ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ
+/0bOi20CAwEAAaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF4DAn
+BgNVHSUEIDAeBggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1UdDwQE
+AwIF4DAdBgNVHQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCwwKjAo
+oCagJIYiaHR0cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkqhkiG
+9w0BAQUFAAOBgQB93Kc3Ra2hcGd2A+sCHUzkICqebPv5XCtK0UX1Y6Ji4B0DnQtn
+tpDVz1LdcKISgQ6QY8TxbMQ2saA4Ux0j4YZT3/oFtRkM6YHkhFrbOKIWEauXjTrc
+DR1VA6XCDp3Jj5Xv6pJrW3k83xu+9hbrsXecHUoat8B5+HabZZP0L4NqEw==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/cdsa.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/cdsa.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/cdsa.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Sat Oct 15 11:13:18 2011
+Date: Sat, 15 Oct 2011 11:13:17 -0400
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1768741] certificate renewal for scripts-vhost cdsa.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            5e:3c:f7:87:9e:b4:94:13:2b:ac:44:39:34:cf:32:85
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Oct 13 16:00:00 2011 GMT
+            Not After : Oct 11 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=cdsa.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        2b:f5:4a:34:9a:65:3f:16:67:c1:6a:24:a7:21:27:55:11:f7:
+        82:b8:2b:27:6f:6a:ca:17:22:72:82:20:40:a0:f8:32:e5:3c:
+        04:d3:13:65:06:b1:58:cd:96:a4:39:36:18:94:d9:52:fe:18:
+        41:aa:16:37:4a:1f:e3:4a:2d:3e:b6:0b:b3:08:3b:ac:32:19:
+        6c:db:e9:51:9a:5b:16:fc:45:9c:04:fd:cd:c4:c9:74:d5:28:
+        1a:88:be:1c:c5:f1:11:93:eb:12:3c:76:a0:96:a5:4d:c9:bf:
+        82:50:39:b3:04:46:d7:61:e0:bf:fb:19:95:67:40:7c:d7:82:
+        9d:8f
+-----BEGIN CERTIFICATE-----
+MIIE/zCCBGigAwIBAgIQXjz3h560lBMrrEQ5NM8yhTANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMTAxMzE2MDAwMFoXDTEy
+MTAxMTE2MDAwMFowgc4xCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRUwEwYDVQQDEwxjZHNhLm1pdC5lZHUxHjAc
+BgkqhkiG9w0BCQEWD3NjcmlwdHNAbWl0LmVkdTCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBAL+j8nuYzBanV+aShTRW8eNig55qTzWd8M+Jh3Pjk/e3AVc4
+bun8WU0k66cXR8osUQ5FyLdoyQ4yJuCR0wZcjHwObJkMskYFD03xsMdeNQZi/irW
+DxsstQIkTMMGceyUyh2qr365LcBVS8y8UT12aFvT7TXQA7obbPOg2NPca0SwXgFR
+0wLMStpSEt41MWkWWkiLD86tTeTVixE2f4cc/YTaQy6HL0FwrK3fVMDt9iFR+sUG
+8BvrobC/TRxCNIrVb/clZnOPYMTXjTOR9EY6lwlZAf/DZJRASDBo8G4DJnTCobPX
+y5T8blOKKp79sU/EdFYlYx+qvZUleJxFRhsMIXHrhJTQsvHaUvbRf2MdCCNSX8L5
+TaykROWaVHD8yfzU1LcddZUA478+TPNDw5bHCSopRRLSMdZ5TIrnVCcixoCuhyNW
+8Y1Jm8j67TNbX1Z2yA9+hRRpxEgxBzmlNIHyaxVQIvu7LK1LhOpVZPfeVp3QttB9
+HhtRUDdElObEFetFMfGz7A+zqQz4HEfHUQAF7+6wPZ9+B6c46INMPds0tiQMkFfA
++dBkFIqTR5tB9aMUHZ4YXdXYZq/188gvvKcCp+/c8A7HR40u1qhiQpNbfPU1+DEQ
+ezjUQCRogRMny/t2DtGZFNjV6/dpZI+vj4K7JCn51CkdzuYUukyLCf9GzottAgMB
+AAGjgaswgagwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBeAwJwYDVR0lBCAw
+HgYIKwYBBQUHAwEGCCsGAQUFBwMEBggrBgEFBQcDAjALBgNVHQ8EBAMCBeAwHQYD
+VR0OBBYEFMsRtwFfhlVPRV6rJ2m+4TyJelViMDMGA1UdHwQsMCowKKAmoCSGImh0
+dHA6Ly9jYS5taXQuZWR1L2NhL21pdHNlcnZlci5jcmwwDQYJKoZIhvcNAQEFBQAD
+gYEAK/VKNJplPxZnwWokpyEnVRH3grgrJ29qyhcicoIgQKD4MuU8BNMTZQaxWM2W
+pDk2GJTZUv4YQaoWN0of40otPrYLswg7rDIZbNvpUZpbFvxFnAT9zcTJdNUoGoi+
+HMXxEZPrEjx2oJalTcm/glA5swRG12Hgv/sZlWdAfNeCnY8=
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/check.pl
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/check.pl	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/check.pl	(revision 2244)
@@ -0,0 +1,28 @@
+#!/usr/bin/perl
+
+use File::Basename;
+use Date::Parse;
+
+my $dir = dirname($0);
+chdir $dir or die "Failed to chdir('$dir'): $!";
+
+my $now = time();
+
+our $verbose = 0;
+$verbose = 1 if ($ARGV[0] eq "-v");
+
+use constant WARNING => 60*60*24*14; # Warn if a cert is expiring within 14 days
+
+foreach my $cert (glob "*.pem") {
+  open(X509, "-|", qw(openssl x509 -in), $cert, qw(-enddate -noout)) or die "Couldn't invoke openssl x509: $!";
+  chomp(my $exp = <X509>);
+  close(X509);
+  $exp =~ s/^notAfter=// or warn "Cert appears broken: $cert";
+
+  my $time = str2time($exp);
+
+  if ($verbose || ($time - $now) <= WARNING) {
+    printf "Certificate expiring in %.2f days: %s for ", (($time - $now) / (60.0*60*24)), $cert;
+    system(qw(openssl x509 -in), $cert, qw(-subject -noout));
+  }
+}
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/classmates.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/classmates.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/classmates.pem	(revision 2244)
@@ -0,0 +1,109 @@
+From mitcert@MIT.EDU Mon Jan 23 14:56:10 2012
+Date: Mon, 23 Jan 2012 14:56:09 -0500
+From: mitcert@MIT.EDU
+To: achernya@mit.edu
+Subject: [help.mit.edu #1868525] certificate renewal for scripts-vhost classmates.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            4f:3d:03:fa:fb:f8:ae:da:a8:3a:a3:72:8a:11:0b:d8
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Jan 22 17:00:00 2012 GMT
+            Not After : Jan 22 17:00:00 2013 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=classmates.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        0f:bb:81:7f:56:75:64:ae:17:21:6d:7c:5c:b9:3b:8e:a0:94:
+        e3:bc:9c:3d:57:2a:5b:7a:d6:11:d9:33:fa:70:12:8e:15:7a:
+        40:d3:01:76:60:cf:d8:8e:60:1f:83:3b:77:f2:2f:aa:9d:94:
+        dc:75:ad:bc:01:57:03:df:9a:37:b7:17:c8:0e:8a:14:9e:d8:
+        9a:42:08:79:2b:21:57:69:5c:a9:b3:e2:66:b0:d2:c2:d2:d5:
+        c0:70:11:5b:40:98:a8:c2:0f:51:f2:f7:90:e1:8c:b8:f5:1a:
+        28:e8:47:e3:b7:10:bc:03:07:3f:47:07:02:0a:7f:91:8d:f5:
+        54:e2
+-----BEGIN CERTIFICATE-----
+MIIFBTCCBG6gAwIBAgIQTz0D+vv4rtqoOqNyihEL2DANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTEyMDEyMjE3MDAwMFoXDTEz
+MDEyMjE3MDAwMFowgdQxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRswGQYDVQQDExJjbGFzc21hdGVzLm1pdC5l
+ZHUxHjAcBgkqhkiG9w0BCQEWD3NjcmlwdHNAbWl0LmVkdTCCAiIwDQYJKoZIhvcN
+AQEBBQADggIPADCCAgoCggIBAL+j8nuYzBanV+aShTRW8eNig55qTzWd8M+Jh3Pj
+k/e3AVc4bun8WU0k66cXR8osUQ5FyLdoyQ4yJuCR0wZcjHwObJkMskYFD03xsMde
+NQZi/irWDxsstQIkTMMGceyUyh2qr365LcBVS8y8UT12aFvT7TXQA7obbPOg2NPc
+a0SwXgFR0wLMStpSEt41MWkWWkiLD86tTeTVixE2f4cc/YTaQy6HL0FwrK3fVMDt
+9iFR+sUG8BvrobC/TRxCNIrVb/clZnOPYMTXjTOR9EY6lwlZAf/DZJRASDBo8G4D
+JnTCobPXy5T8blOKKp79sU/EdFYlYx+qvZUleJxFRhsMIXHrhJTQsvHaUvbRf2Md
+CCNSX8L5TaykROWaVHD8yfzU1LcddZUA478+TPNDw5bHCSopRRLSMdZ5TIrnVCci
+xoCuhyNW8Y1Jm8j67TNbX1Z2yA9+hRRpxEgxBzmlNIHyaxVQIvu7LK1LhOpVZPfe
+Vp3QttB9HhtRUDdElObEFetFMfGz7A+zqQz4HEfHUQAF7+6wPZ9+B6c46INMPds0
+tiQMkFfA+dBkFIqTR5tB9aMUHZ4YXdXYZq/188gvvKcCp+/c8A7HR40u1qhiQpNb
+fPU1+DEQezjUQCRogRMny/t2DtGZFNjV6/dpZI+vj4K7JCn51CkdzuYUukyLCf9G
+zottAgMBAAGjgaswgagwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBeAwJwYD
+VR0lBCAwHgYIKwYBBQUHAwEGCCsGAQUFBwMEBggrBgEFBQcDAjALBgNVHQ8EBAMC
+BeAwHQYDVR0OBBYEFMsRtwFfhlVPRV6rJ2m+4TyJelViMDMGA1UdHwQsMCowKKAm
+oCSGImh0dHA6Ly9jYS5taXQuZWR1L2NhL21pdHNlcnZlci5jcmwwDQYJKoZIhvcN
+AQEFBQADgYEAD7uBf1Z1ZK4XIW18XLk7jqCU47ycPVcqW3rWEdkz+nASjhV6QNMB
+dmDP2I5gH4M7d/Ivqp2U3HWtvAFXA9+aN7cXyA6KFJ7YmkIIeSshV2lcqbPiZrDS
+wtLVwHARW0CYqMIPUfL3kOGMuPUaKOhH47cQvAMHP0cHAgp/kY31VOI=
+-----END CERTIFICATE-----
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/classof2014.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/classof2014.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/classof2014.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Fri Aug 19 09:33:03 2011
+Date: Fri, 19 Aug 2011 09:33:02 -0400
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1702218] certificate signing request for scripts-vhost classof2014.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            7e:98:f3:19:0a:aa:5a:1b:7d:81:60:3e:b4:fe:90:87
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Aug 17 16:00:00 2011 GMT
+            Not After : Aug 16 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=classof2014.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        64:3a:a1:b9:8b:2c:f7:a8:7b:3d:97:bf:7b:58:5f:4e:f7:83:
+        8d:4a:a7:28:8b:ec:15:59:4b:29:3d:97:e6:f8:3f:c5:54:89:
+        1b:5c:0c:0c:5c:13:4d:59:63:01:99:4d:d4:b8:cf:9f:c6:c5:
+        13:70:df:cb:38:78:72:1c:8f:89:c7:26:ff:d0:43:e8:e2:8f:
+        87:2b:dc:3c:80:4b:cf:bc:49:45:d3:d0:f1:0c:90:00:f8:16:
+        d5:70:f5:23:c3:13:5c:b6:09:bd:e4:75:9e:b4:b3:24:d2:a5:
+        da:d5:68:32:75:55:46:b7:b6:5a:1a:32:87:80:2c:73:a9:6e:
+        08:6b
+-----BEGIN CERTIFICATE-----
+MIIFBjCCBG+gAwIBAgIQfpjzGQqqWht9gWA+tP6QhzANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMDgxNzE2MDAwMFoXDTEy
+MDgxNjE2MDAwMFowgdUxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRwwGgYDVQQDExNjbGFzc29mMjAxNC5taXQu
+ZWR1MR4wHAYJKoZIhvcNAQkBFg9zY3JpcHRzQG1pdC5lZHUwggIiMA0GCSqGSIb3
+DQEBAQUAA4ICDwAwggIKAoICAQC/o/J7mMwWp1fmkoU0VvHjYoOeak81nfDPiYdz
+45P3twFXOG7p/FlNJOunF0fKLFEORci3aMkOMibgkdMGXIx8DmyZDLJGBQ9N8bDH
+XjUGYv4q1g8bLLUCJEzDBnHslModqq9+uS3AVUvMvFE9dmhb0+010AO6G2zzoNjT
+3GtEsF4BUdMCzEraUhLeNTFpFlpIiw/OrU3k1YsRNn+HHP2E2kMuhy9BcKyt31TA
+7fYhUfrFBvAb66Gwv00cQjSK1W/3JWZzj2DE140zkfRGOpcJWQH/w2SUQEgwaPBu
+AyZ0wqGz18uU/G5Tiiqe/bFPxHRWJWMfqr2VJXicRUYbDCFx64SU0LLx2lL20X9j
+HQgjUl/C+U2spETlmlRw/Mn81NS3HXWVAOO/PkzzQ8OWxwkqKUUS0jHWeUyK51Qn
+IsaArocjVvGNSZvI+u0zW19WdsgPfoUUacRIMQc5pTSB8msVUCL7uyytS4TqVWT3
+3lad0LbQfR4bUVA3RJTmxBXrRTHxs+wPs6kM+BxHx1EABe/usD2ffgenOOiDTD3b
+NLYkDJBXwPnQZBSKk0ebQfWjFB2eGF3V2Gav9fPIL7ynAqfv3PAOx0eNLtaoYkKT
+W3z1NfgxEHs41EAkaIETJ8v7dg7RmRTY1ev3aWSPr4+CuyQp+dQpHc7mFLpMiwn/
+Rs6LbQIDAQABo4GrMIGoMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgXgMCcG
+A1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDBAYIKwYBBQUHAwIwCwYDVR0PBAQD
+AgXgMB0GA1UdDgQWBBTLEbcBX4ZVT0VeqydpvuE8iXpVYjAzBgNVHR8ELDAqMCig
+JqAkhiJodHRwOi8vY2EubWl0LmVkdS9jYS9taXRzZXJ2ZXIuY3JsMA0GCSqGSIb3
+DQEBBQUAA4GBAGQ6obmLLPeoez2Xv3tYX073g41KpyiL7BVZSyk9l+b4P8VUiRtc
+DAxcE01ZYwGZTdS4z5/GxRNw38s4eHIcj4nHJv/QQ+jij4cr3DyAS8+8SUXT0PEM
+kAD4FtVw9SPDE1y2Cb3kdZ60syTSpdrVaDJ1VUa3tloaMoeALHOpbghr
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/courseroad.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/courseroad.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/courseroad.pem	(revision 2244)
@@ -0,0 +1,121 @@
+From achernya@MIT.EDU Thu Apr 26 15:33:41 2012
+Date: Thu, 26 Apr 2012 22:33:37 +0000
+From: Alexander Chernyakhovsky <achernya@MIT.EDU>
+To: "scripts-root@mit.edu" <scripts-root@mit.edu>
+Subject: FW: [help.mit.edu #1967190] certificate signing request for scripts-vhost courseroad.mit.edu 
+
+Hi,
+
+Could someone please install this certificate?
+
+-Alex
+________________________________________
+From: mitcert@MIT.EDU [mitcert@MIT.EDU]
+Sent: Thursday, April 26, 2012 10:57 AM
+To: Alexander Chernyakhovsky
+Subject: [help.mit.edu #1967190] certificate signing request for scripts-vhost courseroad.mit.edu
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            7f:a7:fe:92:1a:7f:42:d6:33:23:2f:09:04:59:fb:0b
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Apr 24 16:00:00 2012 GMT
+            Not After : Apr 25 16:00:00 2013 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=courseroad.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints:
+                CA:FALSE
+            Netscape Cert Type:
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage:
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage:
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier:
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points:
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        8b:17:f3:95:a6:a9:bb:0a:db:71:ee:41:6d:48:90:f0:79:58:
+        3f:39:5a:68:db:83:d6:5c:f6:01:ae:79:87:3f:3e:c2:e8:c3:
+        bb:80:c8:ae:ce:ab:6e:6f:fe:65:22:ff:bd:f8:4e:67:c4:ba:
+        85:90:b6:e7:63:53:aa:c2:66:83:ee:06:6a:16:88:f9:73:66:
+        b9:31:c9:3a:b9:7c:05:77:4b:b0:1c:48:8c:61:df:67:10:a2:
+        74:02:0f:f8:e8:b4:ce:ea:fc:39:8d:27:09:c3:de:32:7a:83:
+        07:16:29:fb:91:e0:39:74:37:5c:f1:c2:a5:b3:cb:5b:34:f4:
+        da:52
+-----BEGIN CERTIFICATE-----
+MIIFBTCCBG6gAwIBAgIQf6f+khp/QtYzIy8JBFn7CzANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTEyMDQyNDE2MDAwMFoXDTEz
+MDQyNTE2MDAwMFowgdQxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRswGQYDVQQDExJjb3Vyc2Vyb2FkLm1pdC5l
+ZHUxHjAcBgkqhkiG9w0BCQEWD3NjcmlwdHNAbWl0LmVkdTCCAiIwDQYJKoZIhvcN
+AQEBBQADggIPADCCAgoCggIBAL+j8nuYzBanV+aShTRW8eNig55qTzWd8M+Jh3Pj
+k/e3AVc4bun8WU0k66cXR8osUQ5FyLdoyQ4yJuCR0wZcjHwObJkMskYFD03xsMde
+NQZi/irWDxsstQIkTMMGceyUyh2qr365LcBVS8y8UT12aFvT7TXQA7obbPOg2NPc
+a0SwXgFR0wLMStpSEt41MWkWWkiLD86tTeTVixE2f4cc/YTaQy6HL0FwrK3fVMDt
+9iFR+sUG8BvrobC/TRxCNIrVb/clZnOPYMTXjTOR9EY6lwlZAf/DZJRASDBo8G4D
+JnTCobPXy5T8blOKKp79sU/EdFYlYx+qvZUleJxFRhsMIXHrhJTQsvHaUvbRf2Md
+CCNSX8L5TaykROWaVHD8yfzU1LcddZUA478+TPNDw5bHCSopRRLSMdZ5TIrnVCci
+xoCuhyNW8Y1Jm8j67TNbX1Z2yA9+hRRpxEgxBzmlNIHyaxVQIvu7LK1LhOpVZPfe
+Vp3QttB9HhtRUDdElObEFetFMfGz7A+zqQz4HEfHUQAF7+6wPZ9+B6c46INMPds0
+tiQMkFfA+dBkFIqTR5tB9aMUHZ4YXdXYZq/188gvvKcCp+/c8A7HR40u1qhiQpNb
+fPU1+DEQezjUQCRogRMny/t2DtGZFNjV6/dpZI+vj4K7JCn51CkdzuYUukyLCf9G
+zottAgMBAAGjgaswgagwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBeAwJwYD
+VR0lBCAwHgYIKwYBBQUHAwEGCCsGAQUFBwMEBggrBgEFBQcDAjALBgNVHQ8EBAMC
+BeAwHQYDVR0OBBYEFMsRtwFfhlVPRV6rJ2m+4TyJelViMDMGA1UdHwQsMCowKKAm
+oCSGImh0dHA6Ly9jYS5taXQuZWR1L2NhL21pdHNlcnZlci5jcmwwDQYJKoZIhvcN
+AQEFBQADgYEAixfzlaapuwrbce5BbUiQ8HlYPzlaaNuD1lz2Aa55hz8+wujDu4DI
+rs6rbm/+ZSL/vfhOZ8S6hZC252NTqsJmg+4GahaI+XNmuTHJOrl8BXdLsBxIjGHf
+ZxCidAIP+Oi0zur8OY0nCcPeMnqDBxYp+5HgOXQ3XPHCpbPLWzT02lI=
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/crew.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/crew.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/crew.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Mon Aug  1 15:02:44 2011
+Date: Mon, 1 Aug 2011 15:02:43 -0400
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1682239] certificate renewal for scripts-vhost crew.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            ef:b3:36:6e:78:fe:9b:92:ea:03:e8:d5:5f:a9:26:73
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Jul 31 16:00:00 2011 GMT
+            Not After : Jul 31 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=crew.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        9e:a2:83:4f:22:9d:58:08:91:0d:fd:de:9b:bd:b2:c9:2e:57:
+        8f:a3:c0:ff:0c:2f:1b:46:5b:82:cc:24:f3:4b:57:76:e5:2a:
+        c3:78:c1:c6:74:5c:2f:af:c6:ae:2e:81:ef:c8:ea:e2:bc:7b:
+        04:cd:27:f2:23:21:fc:8c:1c:9f:35:d3:ef:9d:86:e8:af:64:
+        97:8d:c1:63:f9:80:47:0f:a6:78:ef:55:e9:b7:00:31:14:85:
+        f4:c0:cb:0c:d8:d6:dc:cd:83:07:a3:81:67:38:5e:c2:46:c6:
+        dc:6d:c0:bb:bb:a6:c0:30:82:9b:0d:5b:6e:55:2a:f1:f6:f2:
+        b7:15
+-----BEGIN CERTIFICATE-----
+MIIFADCCBGmgAwIBAgIRAO+zNm54/puS6gPo1V+pJnMwDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMTA3MzExNjAwMDBaFw0x
+MjA3MzExNjAwMDBaMIHOMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTEVMBMGA1UEAxMMY3Jldy5taXQuZWR1MR4w
+HAYJKoZIhvcNAQkBFg9zY3JpcHRzQG1pdC5lZHUwggIiMA0GCSqGSIb3DQEBAQUA
+A4ICDwAwggIKAoICAQC/o/J7mMwWp1fmkoU0VvHjYoOeak81nfDPiYdz45P3twFX
+OG7p/FlNJOunF0fKLFEORci3aMkOMibgkdMGXIx8DmyZDLJGBQ9N8bDHXjUGYv4q
+1g8bLLUCJEzDBnHslModqq9+uS3AVUvMvFE9dmhb0+010AO6G2zzoNjT3GtEsF4B
+UdMCzEraUhLeNTFpFlpIiw/OrU3k1YsRNn+HHP2E2kMuhy9BcKyt31TA7fYhUfrF
+BvAb66Gwv00cQjSK1W/3JWZzj2DE140zkfRGOpcJWQH/w2SUQEgwaPBuAyZ0wqGz
+18uU/G5Tiiqe/bFPxHRWJWMfqr2VJXicRUYbDCFx64SU0LLx2lL20X9jHQgjUl/C
++U2spETlmlRw/Mn81NS3HXWVAOO/PkzzQ8OWxwkqKUUS0jHWeUyK51QnIsaArocj
+VvGNSZvI+u0zW19WdsgPfoUUacRIMQc5pTSB8msVUCL7uyytS4TqVWT33lad0LbQ
+fR4bUVA3RJTmxBXrRTHxs+wPs6kM+BxHx1EABe/usD2ffgenOOiDTD3bNLYkDJBX
+wPnQZBSKk0ebQfWjFB2eGF3V2Gav9fPIL7ynAqfv3PAOx0eNLtaoYkKTW3z1Nfgx
+EHs41EAkaIETJ8v7dg7RmRTY1ev3aWSPr4+CuyQp+dQpHc7mFLpMiwn/Rs6LbQID
+AQABo4GrMIGoMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgXgMCcGA1UdJQQg
+MB4GCCsGAQUFBwMBBggrBgEFBQcDBAYIKwYBBQUHAwIwCwYDVR0PBAQDAgXgMB0G
+A1UdDgQWBBTLEbcBX4ZVT0VeqydpvuE8iXpVYjAzBgNVHR8ELDAqMCigJqAkhiJo
+dHRwOi8vY2EubWl0LmVkdS9jYS9taXRzZXJ2ZXIuY3JsMA0GCSqGSIb3DQEBBQUA
+A4GBAJ6ig08inVgIkQ393pu9sskuV4+jwP8MLxtGW4LMJPNLV3blKsN4wcZ0XC+v
+xq4uge/I6uK8ewTNJ/IjIfyMHJ810++dhuivZJeNwWP5gEcPpnjvVem3ADEUhfTA
+ywzY1tzNgwejgWc4XsJGxtxtwLu7psAwgpsNW25VKvH28rcV
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/crosslinks.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/crosslinks.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/crosslinks.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Fri Sep 23 11:43:45 2011
+Date: Fri, 23 Sep 2011 11:43:44 -0400
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1746138] certificate signing request for scripts-vhost crosslinks.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            ef:de:cb:5e:53:c5:10:65:d2:46:38:56:c4:9f:cf:5e
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Sep 21 16:00:00 2011 GMT
+            Not After : Sep 20 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=crosslinks.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        81:d6:5e:78:c5:f5:49:f4:b4:eb:05:07:6f:c9:db:c2:0d:a3:
+        5f:c1:50:d8:1d:22:2b:c2:e6:cd:0a:e2:b4:fa:90:22:b5:6f:
+        2b:20:e0:04:50:2b:27:ff:d1:91:62:5f:6a:ba:00:f3:52:53:
+        ac:00:4c:e4:0f:f9:ae:e6:30:75:10:32:c5:63:a5:0a:62:13:
+        2b:49:6d:c4:8c:06:98:73:b8:b5:a4:91:90:db:1c:ea:55:02:
+        c7:07:38:e9:d3:38:42:ca:80:6f:7d:71:68:bf:13:5d:67:3f:
+        4a:e8:8d:56:94:8c:1e:c7:7f:7b:32:ce:e5:cd:78:67:4d:3d:
+        de:13
+-----BEGIN CERTIFICATE-----
+MIIFBjCCBG+gAwIBAgIRAO/ey15TxRBl0kY4VsSfz14wDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMTA5MjExNjAwMDBaFw0x
+MjA5MjAxNjAwMDBaMIHUMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTEbMBkGA1UEAxMSY3Jvc3NsaW5rcy5taXQu
+ZWR1MR4wHAYJKoZIhvcNAQkBFg9zY3JpcHRzQG1pdC5lZHUwggIiMA0GCSqGSIb3
+DQEBAQUAA4ICDwAwggIKAoICAQC/o/J7mMwWp1fmkoU0VvHjYoOeak81nfDPiYdz
+45P3twFXOG7p/FlNJOunF0fKLFEORci3aMkOMibgkdMGXIx8DmyZDLJGBQ9N8bDH
+XjUGYv4q1g8bLLUCJEzDBnHslModqq9+uS3AVUvMvFE9dmhb0+010AO6G2zzoNjT
+3GtEsF4BUdMCzEraUhLeNTFpFlpIiw/OrU3k1YsRNn+HHP2E2kMuhy9BcKyt31TA
+7fYhUfrFBvAb66Gwv00cQjSK1W/3JWZzj2DE140zkfRGOpcJWQH/w2SUQEgwaPBu
+AyZ0wqGz18uU/G5Tiiqe/bFPxHRWJWMfqr2VJXicRUYbDCFx64SU0LLx2lL20X9j
+HQgjUl/C+U2spETlmlRw/Mn81NS3HXWVAOO/PkzzQ8OWxwkqKUUS0jHWeUyK51Qn
+IsaArocjVvGNSZvI+u0zW19WdsgPfoUUacRIMQc5pTSB8msVUCL7uyytS4TqVWT3
+3lad0LbQfR4bUVA3RJTmxBXrRTHxs+wPs6kM+BxHx1EABe/usD2ffgenOOiDTD3b
+NLYkDJBXwPnQZBSKk0ebQfWjFB2eGF3V2Gav9fPIL7ynAqfv3PAOx0eNLtaoYkKT
+W3z1NfgxEHs41EAkaIETJ8v7dg7RmRTY1ev3aWSPr4+CuyQp+dQpHc7mFLpMiwn/
+Rs6LbQIDAQABo4GrMIGoMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgXgMCcG
+A1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDBAYIKwYBBQUHAwIwCwYDVR0PBAQD
+AgXgMB0GA1UdDgQWBBTLEbcBX4ZVT0VeqydpvuE8iXpVYjAzBgNVHR8ELDAqMCig
+JqAkhiJodHRwOi8vY2EubWl0LmVkdS9jYS9taXRzZXJ2ZXIuY3JsMA0GCSqGSIb3
+DQEBBQUAA4GBAIHWXnjF9Un0tOsFB2/J28INo1/BUNgdIivC5s0K4rT6kCK1bysg
+4ARQKyf/0ZFiX2q6APNSU6wATOQP+a7mMHUQMsVjpQpiEytJbcSMBphzuLWkkZDb
+HOpVAscHOOnTOELKgG99cWi/E11nP0rojVaUjB7Hf3syzuXNeGdNPd4T
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/cs6090.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/cs6090.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/cs6090.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Thu Jan 12 16:08:17 2012
+Date: Thu, 12 Jan 2012 16:08:15 -0500
+From: mitcert@MIT.EDU
+To: achernya@mit.edu
+Subject: [help.mit.edu #1857759] certificate renewal for scripts-vhost cs6090.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            4d:ca:7c:3f:74:bb:9e:63:23:a0:f9:21:9a:5b:22:b6
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Jan 11 17:00:00 2012 GMT
+            Not After : Jan 10 17:00:00 2013 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=cs6090.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        2f:54:31:1a:5a:d3:e9:0c:23:15:26:29:47:eb:46:e7:b7:eb:
+        cd:51:b0:e8:99:29:6d:d6:4f:3c:f0:0d:2c:3f:7e:f5:82:86:
+        2c:f3:eb:0f:8c:73:b0:42:02:32:fd:0a:57:6f:b9:1b:78:ae:
+        71:e6:ac:fb:bd:9a:8b:aa:38:83:3a:3d:d7:73:1f:eb:9c:40:
+        00:04:89:ba:4d:cf:1e:5b:fe:7b:e9:ce:2e:90:a5:03:73:61:
+        44:90:1c:f8:40:ec:ff:55:42:a7:4a:eb:8c:21:ab:d9:2e:f3:
+        0a:41:30:86:11:db:f6:d9:64:d5:c9:d2:f8:e6:89:ea:b2:49:
+        0b:ff
+-----BEGIN CERTIFICATE-----
+MIIFATCCBGqgAwIBAgIQTcp8P3S7nmMjoPkhmlsitjANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTEyMDExMTE3MDAwMFoXDTEz
+MDExMDE3MDAwMFowgdAxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRcwFQYDVQQDEw5jczYwOTAubWl0LmVkdTEe
+MBwGCSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkqhkiG9w0BAQEF
+AAOCAg8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mHc+OT97cB
+Vzhu6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGwx141BmL+
+KtYPGyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY09xrRLBe
+AVHTAsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9UwO32IVH6
+xQbwG+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjwbgMmdMKh
+s9fLlPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/Yx0II1Jf
+wvlNrKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudUJyLGgK6H
+I1bxjUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk995WndC2
+0H0eG1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w92zS2JAyQ
+V8D50GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJCk1t89TX4
+MRB7ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ/0bOi20C
+AwEAAaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF4DAnBgNVHSUE
+IDAeBggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1UdDwQEAwIF4DAd
+BgNVHQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCwwKjAooCagJIYi
+aHR0cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkqhkiG9w0BAQUF
+AAOBgQAvVDEaWtPpDCMVJilH60bnt+vNUbDomSlt1k888A0sP371goYs8+sPjHOw
+QgIy/QpXb7kbeK5x5qz7vZqLqjiDOj3Xcx/rnEAABIm6Tc8eW/576c4ukKUDc2FE
+kBz4QOz/VUKnSuuMIavZLvMKQTCGEdv22WTVydL45onqskkL/w==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/dchang.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/dchang.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/dchang.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Mon Mar  5 17:44:38 2012
+Date: Mon, 5 Mar 2012 17:44:36 -0500
+From: mitcert@MIT.EDU
+To: achernya@mit.edu
+Subject: [help.mit.edu #1913659] certificate signing request for scripts-vhost dchang.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            5e:5d:7b:b6:d4:e2:9b:30:5a:4b:4a:41:d0:7c:d2:58
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Mar  4 17:00:00 2012 GMT
+            Not After : Mar  5 17:00:00 2013 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=dchang.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        44:c3:a5:2b:99:0b:d0:93:20:94:11:a3:f3:20:bd:cc:a6:5e:
+        15:ab:f4:2c:d1:8e:d6:8f:88:7e:9d:65:ed:d6:57:6d:d7:11:
+        b7:02:4e:7d:a3:91:e5:5b:d7:2f:74:1b:2e:0c:cf:ac:fd:e1:
+        d3:ea:27:64:f5:b1:6a:c0:e4:8f:c3:9f:3d:c6:68:e4:91:6f:
+        4d:96:84:51:b5:f4:38:ba:4e:9d:7d:10:2c:ce:9d:c4:80:5a:
+        2e:1f:03:54:c5:6c:7f:02:1f:b7:ce:aa:e2:cf:99:b5:a5:f1:
+        0d:6d:4d:ea:dd:16:ac:00:88:2c:73:d4:cf:d8:3f:1c:f3:38:
+        87:19
+-----BEGIN CERTIFICATE-----
+MIIFATCCBGqgAwIBAgIQXl17ttTimzBaS0pB0HzSWDANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTEyMDMwNDE3MDAwMFoXDTEz
+MDMwNTE3MDAwMFowgdAxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRcwFQYDVQQDEw5kY2hhbmcubWl0LmVkdTEe
+MBwGCSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkqhkiG9w0BAQEF
+AAOCAg8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mHc+OT97cB
+Vzhu6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGwx141BmL+
+KtYPGyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY09xrRLBe
+AVHTAsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9UwO32IVH6
+xQbwG+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjwbgMmdMKh
+s9fLlPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/Yx0II1Jf
+wvlNrKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudUJyLGgK6H
+I1bxjUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk995WndC2
+0H0eG1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w92zS2JAyQ
+V8D50GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJCk1t89TX4
+MRB7ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ/0bOi20C
+AwEAAaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF4DAnBgNVHSUE
+IDAeBggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1UdDwQEAwIF4DAd
+BgNVHQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCwwKjAooCagJIYi
+aHR0cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkqhkiG9w0BAQUF
+AAOBgQBEw6UrmQvQkyCUEaPzIL3Mpl4Vq/Qs0Y7Wj4h+nWXt1ldt1xG3Ak59o5Hl
+W9cvdBsuDM+s/eHT6idk9bFqwOSPw589xmjkkW9NloRRtfQ4uk6dfRAszp3EgFou
+HwNUxWx/Ah+3zqriz5m1pfENbU3q3RasAIgsc9TP2D8c8ziHGQ==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/debathena.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/debathena.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/debathena.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Mon Dec 19 16:31:29 2011
+Date: Mon, 19 Dec 2011 16:31:27 -0500
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1834662] certificate renewal for scripts-vhost debathena.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            c7:14:15:31:37:de:2c:da:d3:8b:4e:ad:87:8a:cc:f3
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Dec 18 17:00:00 2011 GMT
+            Not After : Dec 18 17:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=debathena.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        38:fc:94:f1:f2:a2:6a:ae:9d:7f:46:db:33:39:33:a0:80:3c:
+        92:94:28:cd:7c:55:0f:f0:29:5b:de:b4:ff:d2:08:d7:5b:73:
+        7f:90:30:94:fa:6c:cc:da:1a:83:94:ba:33:22:17:9f:0c:a0:
+        0a:9f:a0:06:f9:f9:cf:a9:07:7d:9a:c0:6d:5d:1d:8a:71:50:
+        b6:9c:0b:1e:2c:4b:12:e5:50:8b:d9:fc:ff:53:3d:00:31:8f:
+        f4:b0:1d:77:7f:f2:21:b9:22:58:82:db:6e:8f:1f:1e:46:96:
+        e0:26:a4:46:0c:cf:4a:51:fc:f7:8f:9f:28:3e:c5:1c:c1:05:
+        69:a3
+-----BEGIN CERTIFICATE-----
+MIIFBTCCBG6gAwIBAgIRAMcUFTE33iza04tOrYeKzPMwDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMTEyMTgxNzAwMDBaFw0x
+MjEyMTgxNzAwMDBaMIHTMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTEaMBgGA1UEAxMRZGViYXRoZW5hLm1pdC5l
+ZHUxHjAcBgkqhkiG9w0BCQEWD3NjcmlwdHNAbWl0LmVkdTCCAiIwDQYJKoZIhvcN
+AQEBBQADggIPADCCAgoCggIBAL+j8nuYzBanV+aShTRW8eNig55qTzWd8M+Jh3Pj
+k/e3AVc4bun8WU0k66cXR8osUQ5FyLdoyQ4yJuCR0wZcjHwObJkMskYFD03xsMde
+NQZi/irWDxsstQIkTMMGceyUyh2qr365LcBVS8y8UT12aFvT7TXQA7obbPOg2NPc
+a0SwXgFR0wLMStpSEt41MWkWWkiLD86tTeTVixE2f4cc/YTaQy6HL0FwrK3fVMDt
+9iFR+sUG8BvrobC/TRxCNIrVb/clZnOPYMTXjTOR9EY6lwlZAf/DZJRASDBo8G4D
+JnTCobPXy5T8blOKKp79sU/EdFYlYx+qvZUleJxFRhsMIXHrhJTQsvHaUvbRf2Md
+CCNSX8L5TaykROWaVHD8yfzU1LcddZUA478+TPNDw5bHCSopRRLSMdZ5TIrnVCci
+xoCuhyNW8Y1Jm8j67TNbX1Z2yA9+hRRpxEgxBzmlNIHyaxVQIvu7LK1LhOpVZPfe
+Vp3QttB9HhtRUDdElObEFetFMfGz7A+zqQz4HEfHUQAF7+6wPZ9+B6c46INMPds0
+tiQMkFfA+dBkFIqTR5tB9aMUHZ4YXdXYZq/188gvvKcCp+/c8A7HR40u1qhiQpNb
+fPU1+DEQezjUQCRogRMny/t2DtGZFNjV6/dpZI+vj4K7JCn51CkdzuYUukyLCf9G
+zottAgMBAAGjgaswgagwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBeAwJwYD
+VR0lBCAwHgYIKwYBBQUHAwEGCCsGAQUFBwMEBggrBgEFBQcDAjALBgNVHQ8EBAMC
+BeAwHQYDVR0OBBYEFMsRtwFfhlVPRV6rJ2m+4TyJelViMDMGA1UdHwQsMCowKKAm
+oCSGImh0dHA6Ly9jYS5taXQuZWR1L2NhL21pdHNlcnZlci5jcmwwDQYJKoZIhvcN
+AQEFBQADgYEAOPyU8fKiaq6df0bbMzkzoIA8kpQozXxVD/ApW960/9II11tzf5Aw
+lPpszNoag5S6MyIXnwygCp+gBvn5z6kHfZrAbV0dinFQtpwLHixLEuVQi9n8/1M9
+ADGP9LAdd3/yIbkiWILbbo8fHkaW4CakRgzPSlH894+fKD7FHMEFaaM=
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/eastgate.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/eastgate.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/eastgate.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Tue Jan  3 11:08:29 2012
+Date: Tue, 3 Jan 2012 11:08:24 -0500
+From: mitcert@MIT.EDU
+To: achernya@mit.edu
+Subject: [help.mit.edu #1846036] certificate renewal for scripts-vhost eastgate.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            de:39:42:c7:9a:8d:44:c6:b5:75:ed:1c:26:35:74:28
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Jan  1 17:00:00 2012 GMT
+            Not After : Jan  2 17:00:00 2013 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=eastgate.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        bf:79:1f:eb:d1:bf:0b:1b:bb:5a:38:bc:f9:7f:33:30:80:3f:
+        69:1a:79:3b:db:a0:db:53:52:fb:11:a5:64:aa:84:26:ac:c7:
+        cf:d2:20:2d:39:46:f0:3e:98:35:de:e0:70:54:f5:d5:60:ae:
+        a9:ad:f3:3c:22:55:7c:09:aa:6e:96:e0:0e:72:03:a9:69:8b:
+        00:a3:3c:01:a5:3b:d0:78:fe:bb:0a:84:f2:57:ba:0e:40:0d:
+        5d:bc:8a:19:30:c5:67:a4:e3:07:59:03:af:7c:e0:5e:bb:44:
+        8f:27:4f:a2:d3:2e:e2:31:12:32:8e:60:2c:2a:05:ef:8a:62:
+        ad:b6
+-----BEGIN CERTIFICATE-----
+MIIFBDCCBG2gAwIBAgIRAN45QseajUTGtXXtHCY1dCgwDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMjAxMDExNzAwMDBaFw0x
+MzAxMDIxNzAwMDBaMIHSMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTEZMBcGA1UEAxMQZWFzdGdhdGUubWl0LmVk
+dTEeMBwGCSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkqhkiG9w0B
+AQEFAAOCAg8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mHc+OT
+97cBVzhu6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGwx141
+BmL+KtYPGyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY09xr
+RLBeAVHTAsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9UwO32
+IVH6xQbwG+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjwbgMm
+dMKhs9fLlPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/Yx0I
+I1JfwvlNrKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudUJyLG
+gK6HI1bxjUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk995W
+ndC20H0eG1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w92zS2
+JAyQV8D50GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJCk1t8
+9TX4MRB7ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ/0bO
+i20CAwEAAaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF4DAnBgNV
+HSUEIDAeBggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1UdDwQEAwIF
+4DAdBgNVHQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkqhkiG9w0B
+AQUFAAOBgQC/eR/r0b8LG7taOLz5fzMwgD9pGnk726DbU1L7EaVkqoQmrMfP0iAt
+OUbwPpg13uBwVPXVYK6prfM8IlV8CapuluAOcgOpaYsAozwBpTvQeP67CoTyV7oO
+QA1dvIoZMMVnpOMHWQOvfOBeu0SPJ0+i0y7iMRIyjmAsKgXvimKttg==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ec.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ec.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ec.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Tue Nov  8 13:57:32 2011
+Date: Tue, 8 Nov 2011 13:57:31 -0500
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1790879] certificate renewal for scripts-vhost ec.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            07:ee:1c:0e:0a:a9:bc:49:35:2d:73:48:63:3d:d0:7b
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Nov  7 17:00:00 2011 GMT
+            Not After : Nov  7 17:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=ec.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        4f:8b:e1:43:94:65:8a:6f:03:9a:8c:76:2c:86:e8:30:a2:2a:
+        ab:58:75:76:dc:93:ec:59:04:56:e0:32:6e:28:8a:4e:78:bc:
+        9d:f8:8f:95:19:f8:ef:d2:10:93:0f:65:73:5a:4a:2f:aa:f7:
+        3b:b0:aa:b8:47:0f:f7:40:eb:41:2d:ea:e1:2b:21:57:ef:34:
+        55:79:94:43:aa:07:6e:10:58:a0:9a:13:f2:c8:a7:4d:cd:f1:
+        fa:1a:97:e0:87:8e:ea:ec:b9:7a:b6:84:c5:57:06:cd:db:27:
+        fa:3b:c3:a9:85:08:6f:6e:59:06:03:e0:0e:54:64:8a:a6:24:
+        85:43
+-----BEGIN CERTIFICATE-----
+MIIE/TCCBGagAwIBAgIQB+4cDgqpvEk1LXNIYz3QezANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMTEwNzE3MDAwMFoXDTEy
+MTEwNzE3MDAwMFowgcwxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRMwEQYDVQQDEwplYy5taXQuZWR1MR4wHAYJ
+KoZIhvcNAQkBFg9zY3JpcHRzQG1pdC5lZHUwggIiMA0GCSqGSIb3DQEBAQUAA4IC
+DwAwggIKAoICAQC/o/J7mMwWp1fmkoU0VvHjYoOeak81nfDPiYdz45P3twFXOG7p
+/FlNJOunF0fKLFEORci3aMkOMibgkdMGXIx8DmyZDLJGBQ9N8bDHXjUGYv4q1g8b
+LLUCJEzDBnHslModqq9+uS3AVUvMvFE9dmhb0+010AO6G2zzoNjT3GtEsF4BUdMC
+zEraUhLeNTFpFlpIiw/OrU3k1YsRNn+HHP2E2kMuhy9BcKyt31TA7fYhUfrFBvAb
+66Gwv00cQjSK1W/3JWZzj2DE140zkfRGOpcJWQH/w2SUQEgwaPBuAyZ0wqGz18uU
+/G5Tiiqe/bFPxHRWJWMfqr2VJXicRUYbDCFx64SU0LLx2lL20X9jHQgjUl/C+U2s
+pETlmlRw/Mn81NS3HXWVAOO/PkzzQ8OWxwkqKUUS0jHWeUyK51QnIsaArocjVvGN
+SZvI+u0zW19WdsgPfoUUacRIMQc5pTSB8msVUCL7uyytS4TqVWT33lad0LbQfR4b
+UVA3RJTmxBXrRTHxs+wPs6kM+BxHx1EABe/usD2ffgenOOiDTD3bNLYkDJBXwPnQ
+ZBSKk0ebQfWjFB2eGF3V2Gav9fPIL7ynAqfv3PAOx0eNLtaoYkKTW3z1NfgxEHs4
+1EAkaIETJ8v7dg7RmRTY1ev3aWSPr4+CuyQp+dQpHc7mFLpMiwn/Rs6LbQIDAQAB
+o4GrMIGoMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgXgMCcGA1UdJQQgMB4G
+CCsGAQUFBwMBBggrBgEFBQcDBAYIKwYBBQUHAwIwCwYDVR0PBAQDAgXgMB0GA1Ud
+DgQWBBTLEbcBX4ZVT0VeqydpvuE8iXpVYjAzBgNVHR8ELDAqMCigJqAkhiJodHRw
+Oi8vY2EubWl0LmVkdS9jYS9taXRzZXJ2ZXIuY3JsMA0GCSqGSIb3DQEBBQUAA4GB
+AE+L4UOUZYpvA5qMdiyG6DCiKqtYdXbck+xZBFbgMm4oik54vJ34j5UZ+O/SEJMP
+ZXNaSi+q9zuwqrhHD/dA60Et6uErIVfvNFV5lEOqB24QWKCaE/LIp03N8foal+CH
+jursuXq2hMVXBs3bJ/o7w6mFCG9uWQYD4A5UZIqmJIVD
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/familynet.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/familynet.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/familynet.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Mon Aug  1 16:20:48 2011
+Date: Mon, 1 Aug 2011 16:20:47 -0400
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1682244] certificate renewal for scripts-vhost familynet.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            27:01:e3:60:aa:75:5d:de:8e:21:ca:46:d4:c0:4c:8a
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Jul 31 16:00:00 2011 GMT
+            Not After : Jul 31 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=familynet.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        17:ec:1f:ec:f2:35:db:74:f8:12:75:df:7b:c7:8a:55:4d:f5:
+        82:89:06:43:07:6d:75:16:05:f7:1f:2b:95:0d:14:a2:ca:a1:
+        0d:6d:80:6f:57:f1:d1:52:15:87:f3:24:20:be:a5:7c:47:e5:
+        5a:cc:ce:7a:b6:1c:8d:5b:9d:4c:a7:07:52:c2:60:5f:06:6c:
+        6e:35:8f:e3:33:c8:6a:dc:79:b2:c7:02:d4:2a:6b:52:91:c3:
+        f9:49:3d:79:da:42:cc:33:ac:37:d9:28:64:0b:d2:f7:37:46:
+        7e:be:bc:27:1b:c7:50:83:6f:7c:6d:bb:9a:1b:a8:5c:52:48:
+        8a:dd
+-----BEGIN CERTIFICATE-----
+MIIFBDCCBG2gAwIBAgIQJwHjYKp1Xd6OIcpG1MBMijANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMDczMTE2MDAwMFoXDTEy
+MDczMTE2MDAwMFowgdMxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRowGAYDVQQDExFmYW1pbHluZXQubWl0LmVk
+dTEeMBwGCSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkqhkiG9w0B
+AQEFAAOCAg8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mHc+OT
+97cBVzhu6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGwx141
+BmL+KtYPGyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY09xr
+RLBeAVHTAsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9UwO32
+IVH6xQbwG+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjwbgMm
+dMKhs9fLlPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/Yx0I
+I1JfwvlNrKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudUJyLG
+gK6HI1bxjUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk995W
+ndC20H0eG1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w92zS2
+JAyQV8D50GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJCk1t8
+9TX4MRB7ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ/0bO
+i20CAwEAAaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF4DAnBgNV
+HSUEIDAeBggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1UdDwQEAwIF
+4DAdBgNVHQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkqhkiG9w0B
+AQUFAAOBgQAX7B/s8jXbdPgSdd97x4pVTfWCiQZDB211FgX3HyuVDRSiyqENbYBv
+V/HRUhWH8yQgvqV8R+VazM56thyNW51MpwdSwmBfBmxuNY/jM8hq3HmyxwLUKmtS
+kcP5ST152kLMM6w32ShkC9L3N0Z+vrwnG8dQg298bbuaG6hcUkiK3Q==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/finboard.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/finboard.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/finboard.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Fri Apr  6 16:52:44 2012
+Date: Fri, 6 Apr 2012 16:52:43 -0400
+From: mitcert@MIT.EDU
+To: achernya@mit.edu
+Subject: [help.mit.edu #1948945] certificate renewal for scripts-vhost finboard.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            e2:7a:21:81:23:49:d6:8b:a9:b0:da:d1:c2:c5:55:18
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Apr  5 16:00:00 2012 GMT
+            Not After : Apr  4 16:00:00 2013 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=finboard.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        6c:de:a7:0e:c2:e8:5f:79:9e:5b:a5:d5:45:42:9e:38:a1:78:
+        f6:27:67:e2:cb:2c:e1:29:0c:12:6b:c4:9f:45:4d:46:32:fd:
+        69:f0:e6:fd:82:3c:a9:d6:b3:c4:f7:67:0d:86:e1:5e:81:32:
+        03:1a:67:df:0a:e8:94:59:37:81:8c:f4:37:14:ce:47:5c:24:
+        75:18:d8:63:59:75:88:a9:92:66:2e:5b:ed:ab:ec:51:cd:d9:
+        63:6d:2d:0d:bd:24:5c:39:fe:4d:8d:2c:05:ec:46:b9:63:00:
+        99:a9:5d:d2:79:78:71:0b:43:6f:49:f6:4e:71:6a:1d:19:33:
+        90:89
+-----BEGIN CERTIFICATE-----
+MIIFBDCCBG2gAwIBAgIRAOJ6IYEjSdaLqbDa0cLFVRgwDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMjA0MDUxNjAwMDBaFw0x
+MzA0MDQxNjAwMDBaMIHSMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTEZMBcGA1UEAxMQZmluYm9hcmQubWl0LmVk
+dTEeMBwGCSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkqhkiG9w0B
+AQEFAAOCAg8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mHc+OT
+97cBVzhu6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGwx141
+BmL+KtYPGyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY09xr
+RLBeAVHTAsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9UwO32
+IVH6xQbwG+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjwbgMm
+dMKhs9fLlPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/Yx0I
+I1JfwvlNrKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudUJyLG
+gK6HI1bxjUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk995W
+ndC20H0eG1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w92zS2
+JAyQV8D50GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJCk1t8
+9TX4MRB7ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ/0bO
+i20CAwEAAaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF4DAnBgNV
+HSUEIDAeBggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1UdDwQEAwIF
+4DAdBgNVHQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkqhkiG9w0B
+AQUFAAOBgQBs3qcOwuhfeZ5bpdVFQp44oXj2J2fiyyzhKQwSa8SfRU1GMv1p8Ob9
+gjyp1rPE92cNhuFegTIDGmffCuiUWTeBjPQ3FM5HXCR1GNhjWXWIqZJmLlvtq+xR
+zdljbS0NvSRcOf5NjSwF7Ea5YwCZqV3SeXhxC0NvSfZOcWodGTOQiQ==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/fridget.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/fridget.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/fridget.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Sat Oct 15 11:07:10 2011
+Date: Sat, 15 Oct 2011 11:07:09 -0400
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1768743] certificate renewal for scripts-vhost fridget.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            22:be:28:6e:be:c3:04:e8:ac:ce:06:c9:e3:53:29:d8
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Oct 13 16:00:00 2011 GMT
+            Not After : Oct 11 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=fridget.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        d0:90:d2:83:be:20:99:92:8b:e4:e5:aa:fc:e8:a1:9a:7d:fa:
+        b2:f3:ce:4f:9d:a1:74:c0:c0:33:3b:9c:0a:f5:77:94:91:bf:
+        b5:2e:21:3e:cb:c3:b7:3a:a3:40:22:9f:4e:1c:61:72:8d:cf:
+        0d:64:8f:c4:e2:22:79:24:5b:94:70:7b:e2:58:94:5f:28:5f:
+        8c:cd:8c:c9:83:76:1b:0a:99:cf:93:85:6d:41:2d:55:dc:77:
+        60:c0:94:e1:48:c7:cf:b4:40:8b:48:57:98:de:d9:19:99:d6:
+        8b:6d:41:73:f0:f0:ca:1a:09:01:5a:3c:a3:1c:92:bd:47:4e:
+        51:d5
+-----BEGIN CERTIFICATE-----
+MIIFAjCCBGugAwIBAgIQIr4obr7DBOiszgbJ41Mp2DANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMTAxMzE2MDAwMFoXDTEy
+MTAxMTE2MDAwMFowgdExCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRgwFgYDVQQDEw9mcmlkZ2V0Lm1pdC5lZHUx
+HjAcBgkqhkiG9w0BCQEWD3NjcmlwdHNAbWl0LmVkdTCCAiIwDQYJKoZIhvcNAQEB
+BQADggIPADCCAgoCggIBAL+j8nuYzBanV+aShTRW8eNig55qTzWd8M+Jh3Pjk/e3
+AVc4bun8WU0k66cXR8osUQ5FyLdoyQ4yJuCR0wZcjHwObJkMskYFD03xsMdeNQZi
+/irWDxsstQIkTMMGceyUyh2qr365LcBVS8y8UT12aFvT7TXQA7obbPOg2NPca0Sw
+XgFR0wLMStpSEt41MWkWWkiLD86tTeTVixE2f4cc/YTaQy6HL0FwrK3fVMDt9iFR
++sUG8BvrobC/TRxCNIrVb/clZnOPYMTXjTOR9EY6lwlZAf/DZJRASDBo8G4DJnTC
+obPXy5T8blOKKp79sU/EdFYlYx+qvZUleJxFRhsMIXHrhJTQsvHaUvbRf2MdCCNS
+X8L5TaykROWaVHD8yfzU1LcddZUA478+TPNDw5bHCSopRRLSMdZ5TIrnVCcixoCu
+hyNW8Y1Jm8j67TNbX1Z2yA9+hRRpxEgxBzmlNIHyaxVQIvu7LK1LhOpVZPfeVp3Q
+ttB9HhtRUDdElObEFetFMfGz7A+zqQz4HEfHUQAF7+6wPZ9+B6c46INMPds0tiQM
+kFfA+dBkFIqTR5tB9aMUHZ4YXdXYZq/188gvvKcCp+/c8A7HR40u1qhiQpNbfPU1
++DEQezjUQCRogRMny/t2DtGZFNjV6/dpZI+vj4K7JCn51CkdzuYUukyLCf9Gzott
+AgMBAAGjgaswgagwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBeAwJwYDVR0l
+BCAwHgYIKwYBBQUHAwEGCCsGAQUFBwMEBggrBgEFBQcDAjALBgNVHQ8EBAMCBeAw
+HQYDVR0OBBYEFMsRtwFfhlVPRV6rJ2m+4TyJelViMDMGA1UdHwQsMCowKKAmoCSG
+Imh0dHA6Ly9jYS5taXQuZWR1L2NhL21pdHNlcnZlci5jcmwwDQYJKoZIhvcNAQEF
+BQADgYEA0JDSg74gmZKL5OWq/Oihmn36svPOT52hdMDAMzucCvV3lJG/tS4hPsvD
+tzqjQCKfThxhco3PDWSPxOIieSRblHB74liUXyhfjM2MyYN2GwqZz5OFbUEtVdx3
+YMCU4UjHz7RAi0hXmN7ZGZnWi21Bc/DwyhoJAVo8oxySvUdOUdU=
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/gsc.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/gsc.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/gsc.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Tue Feb 21 12:04:47 2012
+Date: Tue, 21 Feb 2012 12:04:46 -0500
+From: mitcert@MIT.EDU
+To: achernya@mit.edu
+Subject: [help.mit.edu #1898846] certificate renewal for scripts-vhost gsc.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            f4:d9:df:b1:ad:e2:15:1c:b4:5d:77:fb:dc:f9:5b:93
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Feb 19 17:00:00 2012 GMT
+            Not After : Feb 20 17:00:00 2013 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=gsc.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        5e:0c:59:ed:68:ef:5a:38:20:58:d1:b1:fb:ed:7b:0d:9c:53:
+        f0:29:58:23:82:39:fa:3d:23:86:52:3f:68:b4:57:f9:f4:51:
+        9d:42:03:ff:bf:2f:49:62:6d:74:32:cb:2a:ba:2b:27:fd:8e:
+        01:48:2f:af:2d:66:e1:36:2c:59:b0:88:f9:cc:14:60:81:d1:
+        dc:e3:70:5f:5b:dd:21:fc:4a:09:d9:e3:cf:53:96:87:fe:89:
+        31:67:30:39:15:79:1b:d3:e7:c0:1b:c1:4f:98:ec:30:72:ef:
+        b1:a1:f6:57:06:64:ce:dd:56:58:b2:29:26:ff:9c:4b:f0:0d:
+        59:cd
+-----BEGIN CERTIFICATE-----
+MIIE/zCCBGigAwIBAgIRAPTZ37Gt4hUctF13+9z5W5MwDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMjAyMTkxNzAwMDBaFw0x
+MzAyMjAxNzAwMDBaMIHNMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTEUMBIGA1UEAxMLZ3NjLm1pdC5lZHUxHjAc
+BgkqhkiG9w0BCQEWD3NjcmlwdHNAbWl0LmVkdTCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBAL+j8nuYzBanV+aShTRW8eNig55qTzWd8M+Jh3Pjk/e3AVc4
+bun8WU0k66cXR8osUQ5FyLdoyQ4yJuCR0wZcjHwObJkMskYFD03xsMdeNQZi/irW
+DxsstQIkTMMGceyUyh2qr365LcBVS8y8UT12aFvT7TXQA7obbPOg2NPca0SwXgFR
+0wLMStpSEt41MWkWWkiLD86tTeTVixE2f4cc/YTaQy6HL0FwrK3fVMDt9iFR+sUG
+8BvrobC/TRxCNIrVb/clZnOPYMTXjTOR9EY6lwlZAf/DZJRASDBo8G4DJnTCobPX
+y5T8blOKKp79sU/EdFYlYx+qvZUleJxFRhsMIXHrhJTQsvHaUvbRf2MdCCNSX8L5
+TaykROWaVHD8yfzU1LcddZUA478+TPNDw5bHCSopRRLSMdZ5TIrnVCcixoCuhyNW
+8Y1Jm8j67TNbX1Z2yA9+hRRpxEgxBzmlNIHyaxVQIvu7LK1LhOpVZPfeVp3QttB9
+HhtRUDdElObEFetFMfGz7A+zqQz4HEfHUQAF7+6wPZ9+B6c46INMPds0tiQMkFfA
++dBkFIqTR5tB9aMUHZ4YXdXYZq/188gvvKcCp+/c8A7HR40u1qhiQpNbfPU1+DEQ
+ezjUQCRogRMny/t2DtGZFNjV6/dpZI+vj4K7JCn51CkdzuYUukyLCf9GzottAgMB
+AAGjgaswgagwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBeAwJwYDVR0lBCAw
+HgYIKwYBBQUHAwEGCCsGAQUFBwMEBggrBgEFBQcDAjALBgNVHQ8EBAMCBeAwHQYD
+VR0OBBYEFMsRtwFfhlVPRV6rJ2m+4TyJelViMDMGA1UdHwQsMCowKKAmoCSGImh0
+dHA6Ly9jYS5taXQuZWR1L2NhL21pdHNlcnZlci5jcmwwDQYJKoZIhvcNAQEFBQAD
+gYEAXgxZ7WjvWjggWNGx++17DZxT8ClYI4I5+j0jhlI/aLRX+fRRnUID/78vSWJt
+dDLLKrorJ/2OAUgvry1m4TYsWbCI+cwUYIHR3ONwX1vdIfxKCdnjz1OWh/6JMWcw
+ORV5G9PnwBvBT5jsMHLvsaH2VwZkzt1WWLIpJv+cS/ANWc0=
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/hmmt.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/hmmt.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/hmmt.pem	(revision 2244)
@@ -0,0 +1,107 @@
+Subject: [help.mit.edu #1769925] CSR for hmmt.mit.edu 
+From: mitcert@MIT.EDU
+To: ezyang@mit.edu
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            69:e5:74:56:cb:5c:2e:de:5e:11:6b:f7:d6:50:58:00
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Oct 16 16:00:00 2011 GMT
+            Not After : Oct 17 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=hmmt.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        6d:99:3a:04:c4:55:fe:bc:b7:da:b3:3d:13:78:70:0c:30:de:
+        e1:96:0a:81:3d:ac:e7:5f:8b:d8:b6:66:18:ec:a8:40:24:88:
+        ca:bb:ce:e1:ca:7f:d7:db:8b:61:1c:8d:20:6d:c2:04:4c:35:
+        08:6d:fd:94:41:52:7f:39:76:63:ae:cc:bb:1e:d6:b2:3c:18:
+        98:af:7b:4e:f5:26:de:8e:43:60:ce:40:90:8c:9a:b4:e1:06:
+        a1:bc:c7:c4:90:22:09:48:75:86:92:f5:30:77:ff:91:7f:90:
+        d4:ef:19:c5:27:30:4b:70:f5:02:ca:ce:48:e0:d4:f2:1b:fa:
+        ec:ce
+-----BEGIN CERTIFICATE-----
+MIIE/zCCBGigAwIBAgIQaeV0VstcLt5eEWv31lBYADANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMTAxNjE2MDAwMFoXDTEy
+MTAxNzE2MDAwMFowgc4xCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRUwEwYDVQQDEwxobW10Lm1pdC5lZHUxHjAc
+BgkqhkiG9w0BCQEWD3NjcmlwdHNAbWl0LmVkdTCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBAL+j8nuYzBanV+aShTRW8eNig55qTzWd8M+Jh3Pjk/e3AVc4
+bun8WU0k66cXR8osUQ5FyLdoyQ4yJuCR0wZcjHwObJkMskYFD03xsMdeNQZi/irW
+DxsstQIkTMMGceyUyh2qr365LcBVS8y8UT12aFvT7TXQA7obbPOg2NPca0SwXgFR
+0wLMStpSEt41MWkWWkiLD86tTeTVixE2f4cc/YTaQy6HL0FwrK3fVMDt9iFR+sUG
+8BvrobC/TRxCNIrVb/clZnOPYMTXjTOR9EY6lwlZAf/DZJRASDBo8G4DJnTCobPX
+y5T8blOKKp79sU/EdFYlYx+qvZUleJxFRhsMIXHrhJTQsvHaUvbRf2MdCCNSX8L5
+TaykROWaVHD8yfzU1LcddZUA478+TPNDw5bHCSopRRLSMdZ5TIrnVCcixoCuhyNW
+8Y1Jm8j67TNbX1Z2yA9+hRRpxEgxBzmlNIHyaxVQIvu7LK1LhOpVZPfeVp3QttB9
+HhtRUDdElObEFetFMfGz7A+zqQz4HEfHUQAF7+6wPZ9+B6c46INMPds0tiQMkFfA
++dBkFIqTR5tB9aMUHZ4YXdXYZq/188gvvKcCp+/c8A7HR40u1qhiQpNbfPU1+DEQ
+ezjUQCRogRMny/t2DtGZFNjV6/dpZI+vj4K7JCn51CkdzuYUukyLCf9GzottAgMB
+AAGjgaswgagwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBeAwJwYDVR0lBCAw
+HgYIKwYBBQUHAwEGCCsGAQUFBwMEBggrBgEFBQcDAjALBgNVHQ8EBAMCBeAwHQYD
+VR0OBBYEFMsRtwFfhlVPRV6rJ2m+4TyJelViMDMGA1UdHwQsMCowKKAmoCSGImh0
+dHA6Ly9jYS5taXQuZWR1L2NhL21pdHNlcnZlci5jcmwwDQYJKoZIhvcNAQEFBQAD
+gYEAbZk6BMRV/ry32rM9E3hwDDDe4ZYKgT2s51+L2LZmGOyoQCSIyrvO4cp/19uL
+YRyNIG3CBEw1CG39lEFSfzl2Y67Mux7WsjwYmK97TvUm3o5DYM5AkIyatOEGobzH
+xJAiCUh1hpL1MHf/kX+Q1O8ZxScwS3D1AsrOSODU8hv67M4=
+-----END CERTIFICATE-----
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/impact.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/impact.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/impact.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Mon Dec 19 16:34:22 2011
+Date: Mon, 19 Dec 2011 16:34:20 -0500
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1834661] certificate renewal for scripts-vhost impact.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            0d:25:a4:f7:28:7c:c6:21:cc:cf:c7:ec:e9:70:1a:c7
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Dec 18 17:00:00 2011 GMT
+            Not After : Dec 18 17:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=impact.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        9d:e6:78:31:1e:f2:bb:23:38:08:51:86:8e:8b:d0:c2:94:03:
+        f5:8d:a0:c6:6d:86:e6:31:a0:22:8d:7a:db:98:ef:97:4c:7c:
+        35:ab:c0:86:73:db:2d:cc:bb:75:8f:69:84:ac:fa:87:8b:ca:
+        a1:99:29:74:f1:f9:ee:fe:0b:e9:fb:6e:1b:3d:b1:13:98:64:
+        ed:21:a9:fd:42:9a:20:33:46:1c:1c:7e:cd:d7:16:e1:84:5e:
+        50:83:40:03:a8:98:44:55:c3:47:94:2e:fc:0b:df:0c:63:d8:
+        73:30:4e:49:af:48:3a:d7:e6:86:13:64:03:cd:29:b3:fe:a8:
+        94:71
+-----BEGIN CERTIFICATE-----
+MIIFATCCBGqgAwIBAgIQDSWk9yh8xiHMz8fs6XAaxzANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMTIxODE3MDAwMFoXDTEy
+MTIxODE3MDAwMFowgdAxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRcwFQYDVQQDEw5pbXBhY3QubWl0LmVkdTEe
+MBwGCSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkqhkiG9w0BAQEF
+AAOCAg8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mHc+OT97cB
+Vzhu6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGwx141BmL+
+KtYPGyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY09xrRLBe
+AVHTAsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9UwO32IVH6
+xQbwG+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjwbgMmdMKh
+s9fLlPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/Yx0II1Jf
+wvlNrKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudUJyLGgK6H
+I1bxjUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk995WndC2
+0H0eG1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w92zS2JAyQ
+V8D50GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJCk1t89TX4
+MRB7ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ/0bOi20C
+AwEAAaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF4DAnBgNVHSUE
+IDAeBggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1UdDwQEAwIF4DAd
+BgNVHQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCwwKjAooCagJIYi
+aHR0cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkqhkiG9w0BAQUF
+AAOBgQCd5ngxHvK7IzgIUYaOi9DClAP1jaDGbYbmMaAijXrbmO+XTHw1q8CGc9st
+zLt1j2mErPqHi8qhmSl08fnu/gvp+24bPbETmGTtIan9QpogM0YcHH7N1xbhhF5Q
+g0ADqJhEVcNHlC78C98MY9hzME5Jr0g61+aGE2QDzSmz/qiUcQ==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/isawyou.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/isawyou.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/isawyou.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Thu Jan 12 14:40:49 2012
+Date: Thu, 12 Jan 2012 14:40:47 -0500
+From: mitcert@MIT.EDU
+To: achernya@mit.edu
+Subject: [help.mit.edu #1857760] certificate renewal for scripts-vhost isawyou.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            9b:5e:3d:70:49:ee:f7:d4:a4:0c:9e:52:03:0a:c3:92
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Jan 11 17:00:00 2012 GMT
+            Not After : Jan 10 17:00:00 2013 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=isawyou.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        33:58:9e:2d:17:cf:48:d9:5f:94:86:13:d9:db:61:19:1e:db:
+        be:73:96:dd:97:97:ee:a3:91:68:c7:61:08:0f:a9:06:e7:85:
+        46:1c:bd:43:7a:8e:ed:e8:1e:56:bb:ed:9b:96:b5:c9:ba:6c:
+        fa:c1:1a:01:d2:a2:88:c8:81:41:ff:0e:d0:34:7e:aa:0e:19:
+        56:bc:b0:99:f6:e7:19:c5:03:c2:45:03:69:3d:1e:22:fa:2d:
+        f0:0a:c4:2f:b6:2f:ca:fa:0a:18:14:53:68:d1:ce:25:91:49:
+        78:5f:69:b7:20:26:fb:a2:65:b7:db:39:dd:e4:bc:4e:d9:04:
+        02:36
+-----BEGIN CERTIFICATE-----
+MIIFAzCCBGygAwIBAgIRAJtePXBJ7vfUpAyeUgMKw5IwDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMjAxMTExNzAwMDBaFw0x
+MzAxMTAxNzAwMDBaMIHRMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTEYMBYGA1UEAxMPaXNhd3lvdS5taXQuZWR1
+MR4wHAYJKoZIhvcNAQkBFg9zY3JpcHRzQG1pdC5lZHUwggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQC/o/J7mMwWp1fmkoU0VvHjYoOeak81nfDPiYdz45P3
+twFXOG7p/FlNJOunF0fKLFEORci3aMkOMibgkdMGXIx8DmyZDLJGBQ9N8bDHXjUG
+Yv4q1g8bLLUCJEzDBnHslModqq9+uS3AVUvMvFE9dmhb0+010AO6G2zzoNjT3GtE
+sF4BUdMCzEraUhLeNTFpFlpIiw/OrU3k1YsRNn+HHP2E2kMuhy9BcKyt31TA7fYh
+UfrFBvAb66Gwv00cQjSK1W/3JWZzj2DE140zkfRGOpcJWQH/w2SUQEgwaPBuAyZ0
+wqGz18uU/G5Tiiqe/bFPxHRWJWMfqr2VJXicRUYbDCFx64SU0LLx2lL20X9jHQgj
+Ul/C+U2spETlmlRw/Mn81NS3HXWVAOO/PkzzQ8OWxwkqKUUS0jHWeUyK51QnIsaA
+rocjVvGNSZvI+u0zW19WdsgPfoUUacRIMQc5pTSB8msVUCL7uyytS4TqVWT33lad
+0LbQfR4bUVA3RJTmxBXrRTHxs+wPs6kM+BxHx1EABe/usD2ffgenOOiDTD3bNLYk
+DJBXwPnQZBSKk0ebQfWjFB2eGF3V2Gav9fPIL7ynAqfv3PAOx0eNLtaoYkKTW3z1
+NfgxEHs41EAkaIETJ8v7dg7RmRTY1ev3aWSPr4+CuyQp+dQpHc7mFLpMiwn/Rs6L
+bQIDAQABo4GrMIGoMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgXgMCcGA1Ud
+JQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDBAYIKwYBBQUHAwIwCwYDVR0PBAQDAgXg
+MB0GA1UdDgQWBBTLEbcBX4ZVT0VeqydpvuE8iXpVYjAzBgNVHR8ELDAqMCigJqAk
+hiJodHRwOi8vY2EubWl0LmVkdS9jYS9taXRzZXJ2ZXIuY3JsMA0GCSqGSIb3DQEB
+BQUAA4GBADNYni0Xz0jZX5SGE9nbYRke275zlt2Xl+6jkWjHYQgPqQbnhUYcvUN6
+ju3oHla77ZuWtcm6bPrBGgHSoojIgUH/DtA0fqoOGVa8sJn25xnFA8JFA2k9HiL6
+LfAKxC+2L8r6ChgUU2jRziWRSXhfabcgJvuiZbfbOd3kvE7ZBAI2
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ldpreload.com.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ldpreload.com.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ldpreload.com.pem	(revision 2244)
@@ -0,0 +1,63 @@
+-----BEGIN CERTIFICATE-----
+MIIF1TCCBL2gAwIBAgIQUcT/rqk6bFsG+OiDSZj53DANBgkqhkiG9w0BAQUF
+ADBBMQswCQYDVQQGEwJGUjESMBAGA1UEChMJR0FOREkgU0FTMR4wHAYDVQQD
+ExVHYW5kaSBTdGFuZGFyZCBTU0wgQ0EwHhcNMTIwMjIyMDAwMDAwWhcNMTMw
+MjIxMjM1OTU5WjBYMSEwHwYDVQQLExhEb21haW4gQ29udHJvbCBWYWxpZGF0
+ZWQxGzAZBgNVBAsTEkdhbmRpIFN0YW5kYXJkIFNTTDEWMBQGA1UEAxMNbGRw
+cmVsb2FkLmNvbTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAL+j
+8nuYzBanV+aShTRW8eNig55qTzWd8M+Jh3Pjk/e3AVc4bun8WU0k66cXR8os
+UQ5FyLdoyQ4yJuCR0wZcjHwObJkMskYFD03xsMdeNQZi/irWDxsstQIkTMMG
+ceyUyh2qr365LcBVS8y8UT12aFvT7TXQA7obbPOg2NPca0SwXgFR0wLMStpS
+Et41MWkWWkiLD86tTeTVixE2f4cc/YTaQy6HL0FwrK3fVMDt9iFR+sUG8Bvr
+obC/TRxCNIrVb/clZnOPYMTXjTOR9EY6lwlZAf/DZJRASDBo8G4DJnTCobPX
+y5T8blOKKp79sU/EdFYlYx+qvZUleJxFRhsMIXHrhJTQsvHaUvbRf2MdCCNS
+X8L5TaykROWaVHD8yfzU1LcddZUA478+TPNDw5bHCSopRRLSMdZ5TIrnVCci
+xoCuhyNW8Y1Jm8j67TNbX1Z2yA9+hRRpxEgxBzmlNIHyaxVQIvu7LK1LhOpV
+ZPfeVp3QttB9HhtRUDdElObEFetFMfGz7A+zqQz4HEfHUQAF7+6wPZ9+B6c4
+6INMPds0tiQMkFfA+dBkFIqTR5tB9aMUHZ4YXdXYZq/188gvvKcCp+/c8A7H
+R40u1qhiQpNbfPU1+DEQezjUQCRogRMny/t2DtGZFNjV6/dpZI+vj4K7JCn5
+1CkdzuYUukyLCf9GzottAgMBAAGjggGwMIIBrDAfBgNVHSMEGDAWgBS2qP+i
+qC/Qps1LsWjz51AQMad5ITAdBgNVHQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6
+VWIwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYI
+KwYBBQUHAwEGCCsGAQUFBwMCMFYGA1UdIARPME0wSwYLKwYBBAGyMQECAhow
+PDA6BggrBgEFBQcCARYuaHR0cDovL3d3dy5nYW5kaS5uZXQvY29udHJhY3Rz
+L2ZyL3NzbC9jcHMvcGRmLzA8BgNVHR8ENTAzMDGgL6AthitodHRwOi8vY3Js
+LmdhbmRpLm5ldC9HYW5kaVN0YW5kYXJkU1NMQ0EuY3JsMGoGCCsGAQUFBwEB
+BF4wXDA3BggrBgEFBQcwAoYraHR0cDovL2NydC5nYW5kaS5uZXQvR2FuZGlT
+dGFuZGFyZFNTTENBLmNydDAhBggrBgEFBQcwAYYVaHR0cDovL29jc3AuZ2Fu
+ZGkubmV0MCsGA1UdEQQkMCKCDWxkcHJlbG9hZC5jb22CEXd3dy5sZHByZWxv
+YWQuY29tMA0GCSqGSIb3DQEBBQUAA4IBAQAIXsnlaB4VnchXtTlFRWb/G78/
+nO/YzlXBkoyN/m9ZFVK2UGmZOL+ns0CQGELdAPAwUvCBeG9gfDi3OMJAn3KM
+TDZapRagJBW9gsGC5I7k3ghtMLrF/HOlT3GIZaeSHBWzqT9TlLGWl+VYUptl
+HBsp9w4TYEGzTyhCyEl02G4684e134dopGjVLDzFVkyIaVYDDICnhQHJTwXx
+OaevFfsnMwoVJX0RrPncmJzlCIghMrtiJkR/8gEdHvPMwyr9606CNG7Kbqz0
+9HDwaIcMgCfo1trEXOO+QLQ6bWS8dE4HMFMOLOoXcF1pHeYvZLqEnJGM8Oqz
+y1/58Zpz9hB6QC6C
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEozCCA4ugAwIBAgIQWrYdrB5NogYUx1U9Pamy3DANBgkqhkiG9w0BAQUFADCB
+lzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug
+Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExho
+dHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xHzAdBgNVBAMTFlVUTi1VU0VSRmlyc3Qt
+SGFyZHdhcmUwHhcNMDgxMDIzMDAwMDAwWhcNMjAwNTMwMTA0ODM4WjBBMQswCQYD
+VQQGEwJGUjESMBAGA1UEChMJR0FOREkgU0FTMR4wHAYDVQQDExVHYW5kaSBTdGFu
+ZGFyZCBTU0wgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC2VD2l
+2w0ieFBqWiOJP5eh1AcaqVgIm6AVwzK2t/HouaVvrTf2bnEbtHUtSF6fxhWqge/l
+xIiVijpsd8y1zWXkZ+VzyVBSlMEnST6ga0EWQbaUmUGuPsviBkYJ6U2+yUxVqRh+
+pt9u/UqyzGxO2chQFZOz8unjwmqtOtX7w3lQnyV5KbJHZHwgPuIITZMpFLY0bs9x
+Rn52EPT9bKoB0sIG3pKDzFiQLpLeHmW3Yy89sutwjEzgvhWd3sFNVvgLxo4HuV3f
+lfB7QB8aLNecK0t29Fn1Q8EsZhCenmaWYJ0cdBtOGFwIsG5symkaAum7ynjvZi7j
+Mv1BXJV0gU302v5LAgMBAAGjggE+MIIBOjAfBgNVHSMEGDAWgBShcl8mGyiYQ5Vd
+BzfVhZadS9LDRTAdBgNVHQ4EFgQUtqj/oqgv0KbNS7Fo8+dQEDGneSEwDgYDVR0P
+AQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwGAYDVR0gBBEwDzANBgsrBgEE
+AbIxAQICGjBEBgNVHR8EPTA7MDmgN6A1hjNodHRwOi8vY3JsLnVzZXJ0cnVzdC5j
+b20vVVROLVVTRVJGaXJzdC1IYXJkd2FyZS5jcmwwdAYIKwYBBQUHAQEEaDBmMD0G
+CCsGAQUFBzAChjFodHRwOi8vY3J0LnVzZXJ0cnVzdC5jb20vVVROQWRkVHJ1c3RT
+ZXJ2ZXJfQ0EuY3J0MCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC51c2VydHJ1c3Qu
+Y29tMA0GCSqGSIb3DQEBBQUAA4IBAQAZU78DPZvia1r9ukkfT+zhxoI5PNIDBA+r
+ez6CqYUQH/TeMq9YP/9w8zAdly1MmuLsDD4ULS+YSJ2uFmqsLUKqtWSkcLvrc5R7
+RkznehR2W0wdhKEgdB8uS1xwiNy99xk97VkN4j8m4pyspDyVHPi+jAOu8OWcTbzH
+m1gAv6+t+jducW0YNA7B6mr4Dd9pVFYV8iiz/qRj7MUEZGC7/irw9IehsK69quQv
+4wMLL2ZfhaQye0btJQzn8bfnGf1gul+Hd96YB5bkXupjfajeVdphXDyQg0MEBzzd
+8/ifBlIK3se2e4/hEfcEejX/arxbx1BJCHBvlEPNnsdw8dvQbdqP
+-----END CERTIFICATE-----
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/listmon.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/listmon.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/listmon.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Tue Nov  8 14:12:06 2011
+Date: Tue, 8 Nov 2011 14:12:05 -0500
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1790876] certificate renewal for scripts-vhost listmon.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            7a:d6:17:1a:2c:89:33:fb:fd:28:f1:78:73:a9:b1:df
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Nov  7 17:00:00 2011 GMT
+            Not After : Nov  7 17:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=listmon.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        64:e9:e8:37:84:9e:28:a8:14:7a:d8:9d:f7:e2:9e:e7:d5:26:
+        5d:26:2c:a2:50:1d:95:83:91:35:6b:ab:e1:5a:e9:8c:85:84:
+        f2:90:0a:64:5e:cc:c0:89:82:a5:71:e5:61:3c:81:e5:53:9f:
+        f4:c1:88:4f:d3:aa:69:47:43:58:a6:a4:c0:54:ac:e4:b4:a3:
+        1f:f0:b3:8a:04:02:a8:da:be:44:c5:7d:29:92:d8:d3:1f:63:
+        f9:e0:55:e4:d0:e3:e2:e0:cf:8c:79:f5:dc:a1:75:44:93:d9:
+        e3:f1:3d:6b:fc:65:33:42:38:1a:55:50:71:a3:cf:b4:07:ee:
+        54:40
+-----BEGIN CERTIFICATE-----
+MIIFAjCCBGugAwIBAgIQetYXGiyJM/v9KPF4c6mx3zANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMTEwNzE3MDAwMFoXDTEy
+MTEwNzE3MDAwMFowgdExCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRgwFgYDVQQDEw9saXN0bW9uLm1pdC5lZHUx
+HjAcBgkqhkiG9w0BCQEWD3NjcmlwdHNAbWl0LmVkdTCCAiIwDQYJKoZIhvcNAQEB
+BQADggIPADCCAgoCggIBAL+j8nuYzBanV+aShTRW8eNig55qTzWd8M+Jh3Pjk/e3
+AVc4bun8WU0k66cXR8osUQ5FyLdoyQ4yJuCR0wZcjHwObJkMskYFD03xsMdeNQZi
+/irWDxsstQIkTMMGceyUyh2qr365LcBVS8y8UT12aFvT7TXQA7obbPOg2NPca0Sw
+XgFR0wLMStpSEt41MWkWWkiLD86tTeTVixE2f4cc/YTaQy6HL0FwrK3fVMDt9iFR
++sUG8BvrobC/TRxCNIrVb/clZnOPYMTXjTOR9EY6lwlZAf/DZJRASDBo8G4DJnTC
+obPXy5T8blOKKp79sU/EdFYlYx+qvZUleJxFRhsMIXHrhJTQsvHaUvbRf2MdCCNS
+X8L5TaykROWaVHD8yfzU1LcddZUA478+TPNDw5bHCSopRRLSMdZ5TIrnVCcixoCu
+hyNW8Y1Jm8j67TNbX1Z2yA9+hRRpxEgxBzmlNIHyaxVQIvu7LK1LhOpVZPfeVp3Q
+ttB9HhtRUDdElObEFetFMfGz7A+zqQz4HEfHUQAF7+6wPZ9+B6c46INMPds0tiQM
+kFfA+dBkFIqTR5tB9aMUHZ4YXdXYZq/188gvvKcCp+/c8A7HR40u1qhiQpNbfPU1
++DEQezjUQCRogRMny/t2DtGZFNjV6/dpZI+vj4K7JCn51CkdzuYUukyLCf9Gzott
+AgMBAAGjgaswgagwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBeAwJwYDVR0l
+BCAwHgYIKwYBBQUHAwEGCCsGAQUFBwMEBggrBgEFBQcDAjALBgNVHQ8EBAMCBeAw
+HQYDVR0OBBYEFMsRtwFfhlVPRV6rJ2m+4TyJelViMDMGA1UdHwQsMCowKKAmoCSG
+Imh0dHA6Ly9jYS5taXQuZWR1L2NhL21pdHNlcnZlci5jcmwwDQYJKoZIhvcNAQEF
+BQADgYEAZOnoN4SeKKgUetid9+Ke59UmXSYsolAdlYORNWur4VrpjIWE8pAKZF7M
+wImCpXHlYTyB5VOf9MGIT9OqaUdDWKakwFSs5LSjH/CzigQCqNq+RMV9KZLY0x9j
++eBV5NDj4uDPjHn13KF1RJPZ4/E9a/xlM0I4GlVQcaPPtAfuVEA=
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/maseeh.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/maseeh.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/maseeh.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Mon Oct 10 10:55:00 2011
+Date: Mon, 10 Oct 2011 10:54:58 -0400
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1762329] certificate signing request for scripts-vhost maseeh.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            64:9c:33:e3:b8:35:16:ae:bd:eb:3d:6e:f8:58:1d:02
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Oct  8 16:00:00 2011 GMT
+            Not After : Oct  9 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=maseeh.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        7f:7a:f5:3a:71:0e:10:56:4d:8c:92:dd:6e:23:00:6a:8a:ae:
+        18:8e:ff:58:9a:96:e9:35:42:57:0b:b2:aa:7a:d0:f1:16:83:
+        f6:ba:1b:ac:92:e4:48:f7:83:14:c4:07:fc:ab:af:2f:00:7d:
+        3c:d7:f3:57:21:3f:4c:35:de:f0:ed:f3:b5:6d:32:1e:52:c3:
+        1f:f5:bb:7b:ec:29:ee:a8:72:f4:8f:e6:f8:d0:eb:30:fa:aa:
+        b2:d9:f6:73:17:f3:30:9c:d8:98:62:f1:47:a7:d2:69:8e:3c:
+        e0:b3:cb:45:0b:95:1d:3f:24:cc:86:2c:bf:8a:7f:9b:b7:03:
+        fa:91
+-----BEGIN CERTIFICATE-----
+MIIFATCCBGqgAwIBAgIQZJwz47g1Fq696z1u+FgdAjANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMTAwODE2MDAwMFoXDTEy
+MTAwOTE2MDAwMFowgdAxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRcwFQYDVQQDEw5tYXNlZWgubWl0LmVkdTEe
+MBwGCSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkqhkiG9w0BAQEF
+AAOCAg8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mHc+OT97cB
+Vzhu6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGwx141BmL+
+KtYPGyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY09xrRLBe
+AVHTAsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9UwO32IVH6
+xQbwG+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjwbgMmdMKh
+s9fLlPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/Yx0II1Jf
+wvlNrKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudUJyLGgK6H
+I1bxjUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk995WndC2
+0H0eG1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w92zS2JAyQ
+V8D50GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJCk1t89TX4
+MRB7ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ/0bOi20C
+AwEAAaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF4DAnBgNVHSUE
+IDAeBggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1UdDwQEAwIF4DAd
+BgNVHQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCwwKjAooCagJIYi
+aHR0cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkqhkiG9w0BAQUF
+AAOBgQB/evU6cQ4QVk2Mkt1uIwBqiq4Yjv9YmpbpNUJXC7KqetDxFoP2uhuskuRI
+94MUxAf8q68vAH081/NXIT9MNd7w7fO1bTIeUsMf9bt77CnuqHL0j+b40Osw+qqy
+2fZzF/MwnNiYYvFHp9Jpjjzgs8tFC5UdPyTMhiy/in+btwP6kQ==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/metu.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/metu.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/metu.pem	(revision 2244)
@@ -0,0 +1,103 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            5e:4e:d2:f8:98:7b:fa:87:0a:75:67:5b:48:87:a8:0f
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Jul 19 16:00:00 2011 GMT
+            Not After : Jul 19 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=metu.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        00:8e:e4:59:71:5b:bd:23:0b:4d:1a:b0:3c:69:c7:f7:d3:31:
+        47:d3:e3:4c:a7:5d:8c:c8:d8:dc:22:4b:34:53:77:e0:85:ae:
+        47:72:88:01:9b:50:7d:96:36:bd:60:3d:81:49:fe:4d:2d:c6:
+        19:dc:7a:3e:32:b2:0e:16:bf:3e:1c:2e:7f:aa:63:9d:e2:bb:
+        a1:c6:01:dd:54:ea:6d:bf:6f:49:41:33:36:10:ee:e8:93:e2:
+        12:7b:72:d5:b0:0a:62:3f:4f:15:b0:20:a6:d6:3b:de:d1:fe:
+        0d:6f:de:26:c9:90:02:7b:9a:a6:d8:5f:9d:2f:41:03:01:58:
+        11:da
+-----BEGIN CERTIFICATE-----
+MIIE/zCCBGigAwIBAgIQXk7S+Jh7+ocKdWdbSIeoDzANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMDcxOTE2MDAwMFoXDTEy
+MDcxOTE2MDAwMFowgc4xCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRUwEwYDVQQDEwxtZXR1Lm1pdC5lZHUxHjAc
+BgkqhkiG9w0BCQEWD3NjcmlwdHNAbWl0LmVkdTCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBAL+j8nuYzBanV+aShTRW8eNig55qTzWd8M+Jh3Pjk/e3AVc4
+bun8WU0k66cXR8osUQ5FyLdoyQ4yJuCR0wZcjHwObJkMskYFD03xsMdeNQZi/irW
+DxsstQIkTMMGceyUyh2qr365LcBVS8y8UT12aFvT7TXQA7obbPOg2NPca0SwXgFR
+0wLMStpSEt41MWkWWkiLD86tTeTVixE2f4cc/YTaQy6HL0FwrK3fVMDt9iFR+sUG
+8BvrobC/TRxCNIrVb/clZnOPYMTXjTOR9EY6lwlZAf/DZJRASDBo8G4DJnTCobPX
+y5T8blOKKp79sU/EdFYlYx+qvZUleJxFRhsMIXHrhJTQsvHaUvbRf2MdCCNSX8L5
+TaykROWaVHD8yfzU1LcddZUA478+TPNDw5bHCSopRRLSMdZ5TIrnVCcixoCuhyNW
+8Y1Jm8j67TNbX1Z2yA9+hRRpxEgxBzmlNIHyaxVQIvu7LK1LhOpVZPfeVp3QttB9
+HhtRUDdElObEFetFMfGz7A+zqQz4HEfHUQAF7+6wPZ9+B6c46INMPds0tiQMkFfA
++dBkFIqTR5tB9aMUHZ4YXdXYZq/188gvvKcCp+/c8A7HR40u1qhiQpNbfPU1+DEQ
+ezjUQCRogRMny/t2DtGZFNjV6/dpZI+vj4K7JCn51CkdzuYUukyLCf9GzottAgMB
+AAGjgaswgagwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBeAwJwYDVR0lBCAw
+HgYIKwYBBQUHAwEGCCsGAQUFBwMEBggrBgEFBQcDAjALBgNVHQ8EBAMCBeAwHQYD
+VR0OBBYEFMsRtwFfhlVPRV6rJ2m+4TyJelViMDMGA1UdHwQsMCowKKAmoCSGImh0
+dHA6Ly9jYS5taXQuZWR1L2NhL21pdHNlcnZlci5jcmwwDQYJKoZIhvcNAQEFBQAD
+gYEAAI7kWXFbvSMLTRqwPGnH99MxR9PjTKddjMjY3CJLNFN34IWuR3KIAZtQfZY2
+vWA9gUn+TS3GGdx6PjKyDha/Phwuf6pjneK7ocYB3VTqbb9vSUEzNhDu6JPiEnty
+1bAKYj9PFbAgptY73tH+DW/eJsmQAnuapthfnS9BAwFYEdo=
+-----END CERTIFICATE-----
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/mitsoc.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/mitsoc.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/mitsoc.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Mon Aug  1 16:18:34 2011
+Date: Mon, 1 Aug 2011 16:18:33 -0400
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1682241] certificate renewal for scripts-vhost mitsoc.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            13:b1:cd:ed:14:31:87:d9:81:64:f9:d5:22:eb:a8:5c
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Jul 31 16:00:00 2011 GMT
+            Not After : Jul 31 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=mitsoc.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        07:cf:c0:b5:62:7a:bb:05:89:43:49:ea:c3:e9:75:0b:5c:f5:
+        2a:86:e5:2a:50:6f:57:68:e9:91:4c:9a:bb:97:a9:67:56:55:
+        a3:2c:38:c6:7e:88:ac:44:d9:23:c2:a5:74:44:fb:2e:59:db:
+        6c:a3:12:f3:0b:51:d4:88:6e:c8:bd:18:41:b8:d7:bb:22:31:
+        91:0a:c0:39:86:7d:d1:3b:c6:26:9d:c8:22:d9:42:53:cc:ac:
+        f6:c0:c7:25:b8:13:f2:8e:35:ca:a5:88:f6:fd:bb:f6:8a:0e:
+        68:6f:0a:f8:35:2c:68:7a:52:92:2b:5f:60:c7:8e:f3:8d:e0:
+        75:d5
+-----BEGIN CERTIFICATE-----
+MIIFATCCBGqgAwIBAgIQE7HN7RQxh9mBZPnVIuuoXDANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMDczMTE2MDAwMFoXDTEy
+MDczMTE2MDAwMFowgdAxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRcwFQYDVQQDEw5taXRzb2MubWl0LmVkdTEe
+MBwGCSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkqhkiG9w0BAQEF
+AAOCAg8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mHc+OT97cB
+Vzhu6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGwx141BmL+
+KtYPGyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY09xrRLBe
+AVHTAsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9UwO32IVH6
+xQbwG+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjwbgMmdMKh
+s9fLlPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/Yx0II1Jf
+wvlNrKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudUJyLGgK6H
+I1bxjUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk995WndC2
+0H0eG1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w92zS2JAyQ
+V8D50GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJCk1t89TX4
+MRB7ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ/0bOi20C
+AwEAAaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF4DAnBgNVHSUE
+IDAeBggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1UdDwQEAwIF4DAd
+BgNVHQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCwwKjAooCagJIYi
+aHR0cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkqhkiG9w0BAQUF
+AAOBgQAHz8C1Ynq7BYlDSerD6XULXPUqhuUqUG9XaOmRTJq7l6lnVlWjLDjGfois
+RNkjwqV0RPsuWdtsoxLzC1HUiG7IvRhBuNe7IjGRCsA5hn3RO8Ymncgi2UJTzKz2
+wMcluBPyjjXKpYj2/bv2ig5obwr4NSxoelKSK19gx47zjeB11Q==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/next.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/next.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/next.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Mon Aug  1 16:25:13 2011
+Date: Mon, 1 Aug 2011 16:25:11 -0400
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1682246] certificate renewal for scripts-vhost next.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            41:6d:f6:bd:a1:d6:f8:5e:f9:75:5b:58:0f:53:d3:ba
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Jul 31 16:00:00 2011 GMT
+            Not After : Jul 31 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=next.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        64:12:5b:44:aa:a9:9d:7e:87:2a:08:64:36:35:d8:4b:c8:be:
+        7b:ca:82:aa:49:17:ec:67:54:ca:25:b3:5c:be:10:8c:2d:99:
+        fb:64:58:d2:99:96:30:d6:21:1b:15:fb:ee:e4:2e:f5:5f:aa:
+        f4:cc:77:7a:4c:71:c2:b1:ca:64:2a:c1:fb:5a:b3:92:17:87:
+        89:36:b2:46:71:8e:ce:69:76:7f:5b:d9:f0:dc:55:68:a2:c1:
+        e7:70:2c:07:5a:7a:c9:4d:d2:72:3b:d8:0f:f3:7a:a0:9b:d0:
+        a8:83:3b:7b:f3:6d:07:b5:f8:54:ed:13:6d:be:5a:ef:19:e3:
+        40:97
+-----BEGIN CERTIFICATE-----
+MIIE/zCCBGigAwIBAgIQQW32vaHW+F75dVtYD1PTujANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMDczMTE2MDAwMFoXDTEy
+MDczMTE2MDAwMFowgc4xCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRUwEwYDVQQDEwxuZXh0Lm1pdC5lZHUxHjAc
+BgkqhkiG9w0BCQEWD3NjcmlwdHNAbWl0LmVkdTCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBAL+j8nuYzBanV+aShTRW8eNig55qTzWd8M+Jh3Pjk/e3AVc4
+bun8WU0k66cXR8osUQ5FyLdoyQ4yJuCR0wZcjHwObJkMskYFD03xsMdeNQZi/irW
+DxsstQIkTMMGceyUyh2qr365LcBVS8y8UT12aFvT7TXQA7obbPOg2NPca0SwXgFR
+0wLMStpSEt41MWkWWkiLD86tTeTVixE2f4cc/YTaQy6HL0FwrK3fVMDt9iFR+sUG
+8BvrobC/TRxCNIrVb/clZnOPYMTXjTOR9EY6lwlZAf/DZJRASDBo8G4DJnTCobPX
+y5T8blOKKp79sU/EdFYlYx+qvZUleJxFRhsMIXHrhJTQsvHaUvbRf2MdCCNSX8L5
+TaykROWaVHD8yfzU1LcddZUA478+TPNDw5bHCSopRRLSMdZ5TIrnVCcixoCuhyNW
+8Y1Jm8j67TNbX1Z2yA9+hRRpxEgxBzmlNIHyaxVQIvu7LK1LhOpVZPfeVp3QttB9
+HhtRUDdElObEFetFMfGz7A+zqQz4HEfHUQAF7+6wPZ9+B6c46INMPds0tiQMkFfA
++dBkFIqTR5tB9aMUHZ4YXdXYZq/188gvvKcCp+/c8A7HR40u1qhiQpNbfPU1+DEQ
+ezjUQCRogRMny/t2DtGZFNjV6/dpZI+vj4K7JCn51CkdzuYUukyLCf9GzottAgMB
+AAGjgaswgagwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBeAwJwYDVR0lBCAw
+HgYIKwYBBQUHAwEGCCsGAQUFBwMEBggrBgEFBQcDAjALBgNVHQ8EBAMCBeAwHQYD
+VR0OBBYEFMsRtwFfhlVPRV6rJ2m+4TyJelViMDMGA1UdHwQsMCowKKAmoCSGImh0
+dHA6Ly9jYS5taXQuZWR1L2NhL21pdHNlcnZlci5jcmwwDQYJKoZIhvcNAQEFBQAD
+gYEAZBJbRKqpnX6HKghkNjXYS8i+e8qCqkkX7GdUyiWzXL4QjC2Z+2RY0pmWMNYh
+GxX77uQu9V+q9Mx3ekxxwrHKZCrB+1qzkheHiTayRnGOzml2f1vZ8NxVaKLB53As
+B1p6yU3ScjvYD/N6oJvQqIM7e/NtB7X4VO0Tbb5a7xnjQJc=
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/nudelta.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/nudelta.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/nudelta.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Tue Jul  5 15:03:20 2011
+Date: Tue, 5 Jul 2011 15:03:18 -0400
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1657447] certificate signing request for nudelta.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            c1:d4:4f:e5:ff:e6:a4:6c:a6:0b:24:d7:88:0c:cc:75
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Jul  4 16:00:00 2011 GMT
+            Not After : Jul  4 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=nudelta.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        75:39:e0:d6:c2:fa:64:75:b2:e2:51:05:d5:3a:f0:2b:30:65:
+        24:53:03:4f:eb:e5:be:e4:73:43:7e:d7:5a:37:92:32:25:ad:
+        66:7b:8a:c7:b3:89:24:f5:98:e8:0a:b2:69:cf:8f:d4:29:37:
+        1c:55:93:90:5f:b8:d7:9f:69:99:cf:7a:43:45:e1:14:de:f9:
+        23:40:6b:99:82:fc:1c:cd:46:a8:8c:e8:85:33:d5:f5:5b:79:
+        79:d8:7d:ca:e9:d6:18:de:a6:2c:8a:00:6c:92:f7:6c:0a:67:
+        09:a7:d8:ef:26:62:5d:09:78:dc:05:6e:53:c2:f8:70:cc:08:
+        0e:39
+-----BEGIN CERTIFICATE-----
+MIIFAzCCBGygAwIBAgIRAMHUT+X/5qRspgsk14gMzHUwDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMTA3MDQxNjAwMDBaFw0x
+MjA3MDQxNjAwMDBaMIHRMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTEYMBYGA1UEAxMPbnVkZWx0YS5taXQuZWR1
+MR4wHAYJKoZIhvcNAQkBFg9zY3JpcHRzQG1pdC5lZHUwggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQC/o/J7mMwWp1fmkoU0VvHjYoOeak81nfDPiYdz45P3
+twFXOG7p/FlNJOunF0fKLFEORci3aMkOMibgkdMGXIx8DmyZDLJGBQ9N8bDHXjUG
+Yv4q1g8bLLUCJEzDBnHslModqq9+uS3AVUvMvFE9dmhb0+010AO6G2zzoNjT3GtE
+sF4BUdMCzEraUhLeNTFpFlpIiw/OrU3k1YsRNn+HHP2E2kMuhy9BcKyt31TA7fYh
+UfrFBvAb66Gwv00cQjSK1W/3JWZzj2DE140zkfRGOpcJWQH/w2SUQEgwaPBuAyZ0
+wqGz18uU/G5Tiiqe/bFPxHRWJWMfqr2VJXicRUYbDCFx64SU0LLx2lL20X9jHQgj
+Ul/C+U2spETlmlRw/Mn81NS3HXWVAOO/PkzzQ8OWxwkqKUUS0jHWeUyK51QnIsaA
+rocjVvGNSZvI+u0zW19WdsgPfoUUacRIMQc5pTSB8msVUCL7uyytS4TqVWT33lad
+0LbQfR4bUVA3RJTmxBXrRTHxs+wPs6kM+BxHx1EABe/usD2ffgenOOiDTD3bNLYk
+DJBXwPnQZBSKk0ebQfWjFB2eGF3V2Gav9fPIL7ynAqfv3PAOx0eNLtaoYkKTW3z1
+NfgxEHs41EAkaIETJ8v7dg7RmRTY1ev3aWSPr4+CuyQp+dQpHc7mFLpMiwn/Rs6L
+bQIDAQABo4GrMIGoMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgXgMCcGA1Ud
+JQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDBAYIKwYBBQUHAwIwCwYDVR0PBAQDAgXg
+MB0GA1UdDgQWBBTLEbcBX4ZVT0VeqydpvuE8iXpVYjAzBgNVHR8ELDAqMCigJqAk
+hiJodHRwOi8vY2EubWl0LmVkdS9jYS9taXRzZXJ2ZXIuY3JsMA0GCSqGSIb3DQEB
+BQUAA4GBAHU54NbC+mR1suJRBdU68CswZSRTA0/r5b7kc0N+11o3kjIlrWZ7isez
+iST1mOgKsmnPj9QpNxxVk5BfuNefaZnPekNF4RTe+SNAa5mC/BzNRqiM6IUz1fVb
+eXnYfcrp1hjepiyKAGyS92wKZwmn2O8mYl0JeNwFblPC+HDMCA45
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/peoplesearch.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/peoplesearch.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/peoplesearch.pem	(revision 2244)
@@ -0,0 +1,109 @@
+Subject: [help.mit.edu #1820530] CSR for peoplesearch.mit.edu 
+From: mitcert@MIT.EDU
+To: ezyang@mit.edu
+Date: Tue, 6 Dec 2011 15:04:19 -0500
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            4a:0a:8e:ff:dd:97:5e:3c:e3:43:15:d7:3a:83:65:40
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Dec  5 17:00:00 2011 GMT
+            Not After : Dec  5 17:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=peoplesearch.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        b3:b0:75:06:e3:95:80:18:8a:05:88:a1:27:cf:86:02:76:a7:
+        87:3c:91:5d:82:da:3a:ff:c7:34:80:3b:c0:f8:42:7c:f9:f5:
+        5e:31:e0:6a:bb:4d:a2:9b:fb:ef:d8:60:f2:b8:57:24:9e:23:
+        5d:da:ea:ea:8b:5d:95:d7:d4:22:3c:d1:1e:5a:57:c6:82:53:
+        f0:83:f3:72:84:46:7b:3d:ad:ab:78:30:59:28:ff:f9:6a:22:
+        42:e4:d5:af:fa:7a:38:b9:fe:8b:46:57:3f:32:c9:4b:cf:b8:
+        73:88:fb:29:06:3e:ef:a2:3f:9d:3a:53:b4:de:79:6a:0f:5c:
+        87:92
+-----BEGIN CERTIFICATE-----
+MIIFBzCCBHCgAwIBAgIQSgqO/92XXjzjQxXXOoNlQDANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMTIwNTE3MDAwMFoXDTEy
+MTIwNTE3MDAwMFowgdYxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMR0wGwYDVQQDExRwZW9wbGVzZWFyY2gubWl0
+LmVkdTEeMBwGCSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkqhkiG
+9w0BAQEFAAOCAg8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mH
+c+OT97cBVzhu6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGw
+x141BmL+KtYPGyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY
+09xrRLBeAVHTAsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9U
+wO32IVH6xQbwG+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjw
+bgMmdMKhs9fLlPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/
+Yx0II1JfwvlNrKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudU
+JyLGgK6HI1bxjUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk
+995WndC20H0eG1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w9
+2zS2JAyQV8D50GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJC
+k1t89TX4MRB7ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ
+/0bOi20CAwEAAaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF4DAn
+BgNVHSUEIDAeBggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1UdDwQE
+AwIF4DAdBgNVHQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCwwKjAo
+oCagJIYiaHR0cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkqhkiG
+9w0BAQUFAAOBgQCzsHUG45WAGIoFiKEnz4YCdqeHPJFdgto6/8c0gDvA+EJ8+fVe
+MeBqu02im/vv2GDyuFckniNd2urqi12V19QiPNEeWlfGglPwg/NyhEZ7Pa2reDBZ
+KP/5aiJC5NWv+no4uf6LRlc/MslLz7hziPspBj7voj+dOlO03nlqD1yHkg==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/picker.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/picker.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/picker.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Tue Jan  3 11:07:26 2012
+Date: Tue, 3 Jan 2012 11:07:24 -0500
+From: mitcert@MIT.EDU
+To: achernya@mit.edu
+Subject: [help.mit.edu #1846037] certificate renewal for scripts-vhost picker.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            78:76:e4:c1:f5:59:04:cd:24:39:17:f0:9f:34:da:ce
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Jan  1 17:00:00 2012 GMT
+            Not After : Jan  2 17:00:00 2013 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=picker.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        85:bf:fb:ec:77:ee:e8:3d:9c:7d:65:5e:dc:a3:f4:7e:ff:98:
+        06:98:36:6a:7e:7d:43:93:05:c6:16:2e:53:f4:07:fe:af:05:
+        cc:75:4f:de:6f:d0:03:3e:d1:83:4d:b2:da:2e:62:57:0b:34:
+        b8:98:73:15:84:d4:34:1b:4e:4b:9e:38:2e:17:61:8f:4b:af:
+        ed:22:ae:36:98:f8:b0:b7:fc:4f:35:21:73:c8:5e:35:d9:ca:
+        5d:18:cd:8a:9d:9a:06:8e:56:9f:ff:f8:15:d2:f4:73:30:c4:
+        df:4e:bd:dc:87:62:b8:34:9b:ae:58:6f:ed:33:b2:61:44:07:
+        b5:30
+-----BEGIN CERTIFICATE-----
+MIIFATCCBGqgAwIBAgIQeHbkwfVZBM0kORfwnzTazjANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTEyMDEwMTE3MDAwMFoXDTEz
+MDEwMjE3MDAwMFowgdAxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRcwFQYDVQQDEw5waWNrZXIubWl0LmVkdTEe
+MBwGCSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkqhkiG9w0BAQEF
+AAOCAg8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mHc+OT97cB
+Vzhu6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGwx141BmL+
+KtYPGyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY09xrRLBe
+AVHTAsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9UwO32IVH6
+xQbwG+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjwbgMmdMKh
+s9fLlPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/Yx0II1Jf
+wvlNrKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudUJyLGgK6H
+I1bxjUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk995WndC2
+0H0eG1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w92zS2JAyQ
+V8D50GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJCk1t89TX4
+MRB7ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ/0bOi20C
+AwEAAaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF4DAnBgNVHSUE
+IDAeBggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1UdDwQEAwIF4DAd
+BgNVHQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCwwKjAooCagJIYi
+aHR0cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkqhkiG9w0BAQUF
+AAOBgQCFv/vsd+7oPZx9ZV7co/R+/5gGmDZqfn1DkwXGFi5T9Af+rwXMdU/eb9AD
+PtGDTbLaLmJXCzS4mHMVhNQ0G05LnjguF2GPS6/tIq42mPiwt/xPNSFzyF412cpd
+GM2KnZoGjlaf//gV0vRzMMTfTr3ch2K4NJuuWG/tM7JhRAe1MA==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/pickr.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/pickr.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/pickr.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Tue Jan  3 13:25:20 2012
+Date: Tue, 3 Jan 2012 13:25:19 -0500
+From: mitcert@MIT.EDU
+To: achernya@mit.edu
+Subject: [help.mit.edu #1847684] certificate signing request for scripts-vhost pickr.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            d4:06:25:0f:20:0c:18:1b:1b:97:c7:72:05:3d:e5:f3
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Jan  2 17:00:00 2012 GMT
+            Not After : Jan  2 17:00:00 2013 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=pickr.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        09:47:31:95:9f:a3:6a:3c:00:42:9b:cf:7c:e8:ba:39:54:27:
+        66:eb:3b:47:62:c5:3e:1f:00:43:c2:4a:05:5b:c3:89:fd:ff:
+        76:59:1d:a3:f3:27:cb:83:1a:04:55:f4:9a:da:51:df:ec:22:
+        5b:29:9c:cd:82:eb:9b:26:83:3f:f7:0d:55:71:8a:1c:42:ab:
+        15:a4:68:de:9d:58:9d:e6:dd:64:28:d1:17:7e:1b:9e:2d:16:
+        6f:24:8c:71:73:85:3d:11:24:93:e0:0e:5d:1f:08:c3:ba:09:
+        31:3a:57:21:cd:18:bf:12:6d:60:7f:ca:a5:19:93:14:ab:93:
+        a3:c9
+-----BEGIN CERTIFICATE-----
+MIIFATCCBGqgAwIBAgIRANQGJQ8gDBgbG5fHcgU95fMwDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMjAxMDIxNzAwMDBaFw0x
+MzAxMDIxNzAwMDBaMIHPMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTEWMBQGA1UEAxMNcGlja3IubWl0LmVkdTEe
+MBwGCSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkqhkiG9w0BAQEF
+AAOCAg8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mHc+OT97cB
+Vzhu6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGwx141BmL+
+KtYPGyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY09xrRLBe
+AVHTAsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9UwO32IVH6
+xQbwG+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjwbgMmdMKh
+s9fLlPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/Yx0II1Jf
+wvlNrKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudUJyLGgK6H
+I1bxjUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk995WndC2
+0H0eG1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w92zS2JAyQ
+V8D50GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJCk1t89TX4
+MRB7ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ/0bOi20C
+AwEAAaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF4DAnBgNVHSUE
+IDAeBggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1UdDwQEAwIF4DAd
+BgNVHQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCwwKjAooCagJIYi
+aHR0cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkqhkiG9w0BAQUF
+AAOBgQAJRzGVn6NqPABCm8986Lo5VCdm6ztHYsU+HwBDwkoFW8OJ/f92WR2j8yfL
+gxoEVfSa2lHf7CJbKZzNguubJoM/9w1VcYocQqsVpGjenVid5t1kKNEXfhueLRZv
+JIxxc4U9ESST4A5dHwjDugkxOlchzRi/Em1gf8qlGZMUq5OjyQ==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/psetcentral.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/psetcentral.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/psetcentral.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Mon Jan 23 14:55:16 2012
+Date: Mon, 23 Jan 2012 14:55:14 -0500
+From: mitcert@MIT.EDU
+To: achernya@mit.edu
+Subject: [help.mit.edu #1868526] certificate renewal for scripts-vhost psetcentral.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            1d:a2:5a:7d:2a:5f:7b:5b:ae:5c:03:48:62:6c:3d:47
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Jan 22 17:00:00 2012 GMT
+            Not After : Jan 22 17:00:00 2013 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=psetcentral.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        63:d6:94:10:fc:73:c9:7a:b9:bf:cc:cc:14:31:0d:02:ba:b4:
+        04:ea:19:91:b9:ae:9a:13:e0:66:54:bd:3d:62:67:24:85:da:
+        eb:7e:cf:41:95:a8:17:3b:16:26:5c:97:ac:37:6f:b1:c1:68:
+        47:cb:23:ca:65:74:22:3f:9c:17:77:32:ec:b5:83:2e:8b:15:
+        59:60:fb:3a:e7:f1:a6:55:9f:98:10:c4:22:a7:5c:f7:8b:d3:
+        7b:5d:29:e9:6b:7c:8b:75:96:af:5f:13:da:8c:1b:07:e7:50:
+        b6:6e:d9:a9:0e:ac:9b:d3:af:f8:99:40:cf:f4:11:67:6f:a9:
+        d7:ee
+-----BEGIN CERTIFICATE-----
+MIIFBjCCBG+gAwIBAgIQHaJafSpfe1uuXANIYmw9RzANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTEyMDEyMjE3MDAwMFoXDTEz
+MDEyMjE3MDAwMFowgdUxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRwwGgYDVQQDExNwc2V0Y2VudHJhbC5taXQu
+ZWR1MR4wHAYJKoZIhvcNAQkBFg9zY3JpcHRzQG1pdC5lZHUwggIiMA0GCSqGSIb3
+DQEBAQUAA4ICDwAwggIKAoICAQC/o/J7mMwWp1fmkoU0VvHjYoOeak81nfDPiYdz
+45P3twFXOG7p/FlNJOunF0fKLFEORci3aMkOMibgkdMGXIx8DmyZDLJGBQ9N8bDH
+XjUGYv4q1g8bLLUCJEzDBnHslModqq9+uS3AVUvMvFE9dmhb0+010AO6G2zzoNjT
+3GtEsF4BUdMCzEraUhLeNTFpFlpIiw/OrU3k1YsRNn+HHP2E2kMuhy9BcKyt31TA
+7fYhUfrFBvAb66Gwv00cQjSK1W/3JWZzj2DE140zkfRGOpcJWQH/w2SUQEgwaPBu
+AyZ0wqGz18uU/G5Tiiqe/bFPxHRWJWMfqr2VJXicRUYbDCFx64SU0LLx2lL20X9j
+HQgjUl/C+U2spETlmlRw/Mn81NS3HXWVAOO/PkzzQ8OWxwkqKUUS0jHWeUyK51Qn
+IsaArocjVvGNSZvI+u0zW19WdsgPfoUUacRIMQc5pTSB8msVUCL7uyytS4TqVWT3
+3lad0LbQfR4bUVA3RJTmxBXrRTHxs+wPs6kM+BxHx1EABe/usD2ffgenOOiDTD3b
+NLYkDJBXwPnQZBSKk0ebQfWjFB2eGF3V2Gav9fPIL7ynAqfv3PAOx0eNLtaoYkKT
+W3z1NfgxEHs41EAkaIETJ8v7dg7RmRTY1ev3aWSPr4+CuyQp+dQpHc7mFLpMiwn/
+Rs6LbQIDAQABo4GrMIGoMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgXgMCcG
+A1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDBAYIKwYBBQUHAwIwCwYDVR0PBAQD
+AgXgMB0GA1UdDgQWBBTLEbcBX4ZVT0VeqydpvuE8iXpVYjAzBgNVHR8ELDAqMCig
+JqAkhiJodHRwOi8vY2EubWl0LmVkdS9jYS9taXRzZXJ2ZXIuY3JsMA0GCSqGSIb3
+DQEBBQUAA4GBAGPWlBD8c8l6ub/MzBQxDQK6tATqGZG5rpoT4GZUvT1iZySF2ut+
+z0GVqBc7FiZcl6w3b7HBaEfLI8pldCI/nBd3Muy1gy6LFVlg+zrn8aZVn5gQxCKn
+XPeL03tdKelrfIt1lq9fE9qMGwfnULZu2akOrJvTr/iZQM/0EWdvqdfu
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/random-hall.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/random-hall.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/random-hall.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Mon Aug  1 16:21:31 2011
+Date: Mon, 1 Aug 2011 16:21:30 -0400
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1682245] certificate renewal for scripts-vhost random-hall.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            37:70:19:6b:a5:1f:36:f3:66:96:a6:e2:87:bc:95:c0
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Jul 31 16:00:00 2011 GMT
+            Not After : Jul 31 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=random-hall.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        61:fb:f3:97:75:3f:3e:bd:ce:dd:a9:28:1d:e7:48:46:00:dd:
+        1e:b9:0e:e2:02:15:a4:28:74:f5:ac:88:a3:70:f5:e1:3e:19:
+        39:7e:2e:7c:b2:dd:4a:af:4c:d7:bd:8a:b1:a3:01:f3:a0:e7:
+        4b:01:4a:c8:62:30:0a:2c:59:dc:c8:01:02:d3:7a:9b:7c:9e:
+        f6:39:73:0f:84:d1:4a:fb:c1:86:85:9a:f9:91:2b:03:59:b9:
+        92:23:d3:24:3b:76:c3:ca:51:90:99:71:97:e8:d4:e2:65:72:
+        6d:50:9c:cc:9e:ee:8b:9e:74:0c:a0:a2:ef:14:b4:7f:6c:51:
+        d4:e0
+-----BEGIN CERTIFICATE-----
+MIIFBjCCBG+gAwIBAgIQN3AZa6UfNvNmlqbih7yVwDANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMDczMTE2MDAwMFoXDTEy
+MDczMTE2MDAwMFowgdUxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRwwGgYDVQQDExNyYW5kb20taGFsbC5taXQu
+ZWR1MR4wHAYJKoZIhvcNAQkBFg9zY3JpcHRzQG1pdC5lZHUwggIiMA0GCSqGSIb3
+DQEBAQUAA4ICDwAwggIKAoICAQC/o/J7mMwWp1fmkoU0VvHjYoOeak81nfDPiYdz
+45P3twFXOG7p/FlNJOunF0fKLFEORci3aMkOMibgkdMGXIx8DmyZDLJGBQ9N8bDH
+XjUGYv4q1g8bLLUCJEzDBnHslModqq9+uS3AVUvMvFE9dmhb0+010AO6G2zzoNjT
+3GtEsF4BUdMCzEraUhLeNTFpFlpIiw/OrU3k1YsRNn+HHP2E2kMuhy9BcKyt31TA
+7fYhUfrFBvAb66Gwv00cQjSK1W/3JWZzj2DE140zkfRGOpcJWQH/w2SUQEgwaPBu
+AyZ0wqGz18uU/G5Tiiqe/bFPxHRWJWMfqr2VJXicRUYbDCFx64SU0LLx2lL20X9j
+HQgjUl/C+U2spETlmlRw/Mn81NS3HXWVAOO/PkzzQ8OWxwkqKUUS0jHWeUyK51Qn
+IsaArocjVvGNSZvI+u0zW19WdsgPfoUUacRIMQc5pTSB8msVUCL7uyytS4TqVWT3
+3lad0LbQfR4bUVA3RJTmxBXrRTHxs+wPs6kM+BxHx1EABe/usD2ffgenOOiDTD3b
+NLYkDJBXwPnQZBSKk0ebQfWjFB2eGF3V2Gav9fPIL7ynAqfv3PAOx0eNLtaoYkKT
+W3z1NfgxEHs41EAkaIETJ8v7dg7RmRTY1ev3aWSPr4+CuyQp+dQpHc7mFLpMiwn/
+Rs6LbQIDAQABo4GrMIGoMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgXgMCcG
+A1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDBAYIKwYBBQUHAwIwCwYDVR0PBAQD
+AgXgMB0GA1UdDgQWBBTLEbcBX4ZVT0VeqydpvuE8iXpVYjAzBgNVHR8ELDAqMCig
+JqAkhiJodHRwOi8vY2EubWl0LmVkdS9jYS9taXRzZXJ2ZXIuY3JsMA0GCSqGSIb3
+DQEBBQUAA4GBAGH785d1Pz69zt2pKB3nSEYA3R65DuICFaQodPWsiKNw9eE+GTl+
+Lnyy3UqvTNe9irGjAfOg50sBSshiMAosWdzIAQLTept8nvY5cw+E0Ur7wYaFmvmR
+KwNZuZIj0yQ7dsPKUZCZcZfo1OJlcm1QnMye7ouedAygou8UtH9sUdTg
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/rpl.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/rpl.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/rpl.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Sun Sep 18 20:14:32 2011
+Date: Sun, 18 Sep 2011 20:14:31 -0400
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1739925] certificate signing request for scripts-vhost rpl.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            31:20:29:07:c1:47:e4:4d:d4:f4:d6:16:59:c9:ea:cb
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Sep 17 16:00:00 2011 GMT
+            Not After : Sep 17 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=rpl.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        79:33:7a:46:f0:be:8e:45:4d:da:4e:af:f0:15:8c:9e:e3:63:
+        07:ea:34:22:ee:ec:e2:a3:af:b7:57:27:cf:b3:26:63:1f:7d:
+        42:81:2e:b9:30:34:24:ac:23:df:d6:1a:12:59:21:55:2f:2d:
+        9e:99:83:b1:15:5d:a2:76:cd:51:25:81:da:46:c0:d7:e0:97:
+        b6:74:28:ef:b7:20:ee:72:76:48:ed:fe:65:50:25:2d:6d:fa:
+        df:67:f1:dc:cb:b4:83:12:96:56:29:1b:15:82:b1:d6:8a:be:
+        d7:6e:2d:29:11:38:07:e6:72:e6:e8:c5:53:0f:6e:98:34:f1:
+        be:ab
+-----BEGIN CERTIFICATE-----
+MIIE/jCCBGegAwIBAgIQMSApB8FH5E3U9NYWWcnqyzANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMDkxNzE2MDAwMFoXDTEy
+MDkxNzE2MDAwMFowgc0xCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRQwEgYDVQQDEwtycGwubWl0LmVkdTEeMBwG
+CSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkqhkiG9w0BAQEFAAOC
+Ag8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mHc+OT97cBVzhu
+6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGwx141BmL+KtYP
+Gyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY09xrRLBeAVHT
+AsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9UwO32IVH6xQbw
+G+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjwbgMmdMKhs9fL
+lPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/Yx0II1JfwvlN
+rKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudUJyLGgK6HI1bx
+jUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk995WndC20H0e
+G1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w92zS2JAyQV8D5
+0GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJCk1t89TX4MRB7
+ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ/0bOi20CAwEA
+AaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF4DAnBgNVHSUEIDAe
+BggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1UdDwQEAwIF4DAdBgNV
+HQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCwwKjAooCagJIYiaHR0
+cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkqhkiG9w0BAQUFAAOB
+gQB5M3pG8L6ORU3aTq/wFYye42MH6jQi7uzio6+3VyfPsyZjH31CgS65MDQkrCPf
+1hoSWSFVLy2emYOxFV2ids1RJYHaRsDX4Je2dCjvtyDucnZI7f5lUCUtbfrfZ/Hc
+y7SDEpZWKRsVgrHWir7Xbi0pETgH5nLm6MVTD26YNPG+qw==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/sayno.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/sayno.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/sayno.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Tue Nov  8 14:09:22 2011
+Date: Tue, 8 Nov 2011 14:09:21 -0500
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1790877] certificate renewal for scripts-vhost sayno.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            cd:fb:e7:e9:6f:c8:e5:ac:cf:64:34:1a:1d:d7:d3:7c
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Nov  7 17:00:00 2011 GMT
+            Not After : Nov  7 17:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=sayno.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        4f:fc:28:e3:65:5e:8c:6d:3f:e9:01:a4:23:95:61:a4:0f:ea:
+        6e:7f:d2:c0:4b:20:18:4b:1b:1a:19:f4:04:0a:15:47:4e:48:
+        25:06:f0:67:05:20:4d:36:0d:02:13:8a:cc:b6:3b:5a:b2:2f:
+        dc:20:5f:22:55:18:97:ec:68:5f:0a:0d:45:c2:f7:12:37:c9:
+        b2:82:22:51:b0:8d:41:a7:67:9e:87:74:3d:fd:05:97:22:08:
+        90:10:9a:13:8c:a7:39:4b:ed:e7:4c:0a:99:d7:b8:14:e4:ac:
+        aa:f5:7b:18:05:2f:b9:33:7f:53:8d:4c:eb:32:fa:e8:11:a5:
+        c8:d2
+-----BEGIN CERTIFICATE-----
+MIIFATCCBGqgAwIBAgIRAM375+lvyOWsz2Q0Gh3X03wwDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMTExMDcxNzAwMDBaFw0x
+MjExMDcxNzAwMDBaMIHPMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTEWMBQGA1UEAxMNc2F5bm8ubWl0LmVkdTEe
+MBwGCSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkqhkiG9w0BAQEF
+AAOCAg8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mHc+OT97cB
+Vzhu6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGwx141BmL+
+KtYPGyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY09xrRLBe
+AVHTAsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9UwO32IVH6
+xQbwG+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjwbgMmdMKh
+s9fLlPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/Yx0II1Jf
+wvlNrKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudUJyLGgK6H
+I1bxjUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk995WndC2
+0H0eG1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w92zS2JAyQ
+V8D50GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJCk1t89TX4
+MRB7ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ/0bOi20C
+AwEAAaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF4DAnBgNVHSUE
+IDAeBggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1UdDwQEAwIF4DAd
+BgNVHQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCwwKjAooCagJIYi
+aHR0cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkqhkiG9w0BAQUF
+AAOBgQBP/CjjZV6MbT/pAaQjlWGkD+puf9LASyAYSxsaGfQEChVHTkglBvBnBSBN
+Ng0CE4rMtjtasi/cIF8iVRiX7GhfCg1FwvcSN8mygiJRsI1Bp2eeh3Q9/QWXIgiQ
+EJoTjKc5S+3nTAqZ17gU5Kyq9XsYBS+5M39TjUzrMvroEaXI0g==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/schuh.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/schuh.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/schuh.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Mon Jan 30 09:07:05 2012
+Date: Mon, 30 Jan 2012 09:07:03 -0500
+From: mitcert@MIT.EDU
+To: achernya@mit.edu
+Subject: [help.mit.edu #1875469] certificate renewal for scripts-vhost schuh.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            82:36:a9:1c:b3:dc:e9:72:e9:66:1c:9b:2e:00:32:cb
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Jan 28 17:00:00 2012 GMT
+            Not After : Jan 29 17:00:00 2013 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=schuh.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        66:1a:be:fb:db:ab:f6:c6:82:64:b1:da:17:ac:a8:1a:60:ad:
+        60:24:c5:71:3b:65:d0:c6:52:99:3c:96:0f:b7:19:46:ad:15:
+        dc:50:aa:e3:ed:eb:1b:a1:b3:d5:b8:e5:04:62:99:35:17:ff:
+        db:30:82:c1:e0:89:b5:cd:4c:ed:84:01:03:ea:2c:63:35:e4:
+        f5:6d:28:d0:59:ae:e2:4b:00:e1:9a:23:5d:3b:01:96:8e:b3:
+        b6:24:9a:57:20:c0:fd:69:17:7a:ab:4e:f6:75:0e:8f:15:45:
+        3a:ff:b7:2c:65:62:94:4d:85:6b:59:fe:4e:03:d4:d3:76:c7:
+        36:3e
+-----BEGIN CERTIFICATE-----
+MIIFATCCBGqgAwIBAgIRAII2qRyz3Oly6WYcmy4AMsswDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMjAxMjgxNzAwMDBaFw0x
+MzAxMjkxNzAwMDBaMIHPMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTEWMBQGA1UEAxMNc2NodWgubWl0LmVkdTEe
+MBwGCSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkqhkiG9w0BAQEF
+AAOCAg8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mHc+OT97cB
+Vzhu6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGwx141BmL+
+KtYPGyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY09xrRLBe
+AVHTAsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9UwO32IVH6
+xQbwG+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjwbgMmdMKh
+s9fLlPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/Yx0II1Jf
+wvlNrKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudUJyLGgK6H
+I1bxjUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk995WndC2
+0H0eG1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w92zS2JAyQ
+V8D50GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJCk1t89TX4
+MRB7ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ/0bOi20C
+AwEAAaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF4DAnBgNVHSUE
+IDAeBggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1UdDwQEAwIF4DAd
+BgNVHQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCwwKjAooCagJIYi
+aHR0cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkqhkiG9w0BAQUF
+AAOBgQBmGr7726v2xoJksdoXrKgaYK1gJMVxO2XQxlKZPJYPtxlGrRXcUKrj7esb
+obPVuOUEYpk1F//bMILB4Im1zUzthAED6ixjNeT1bSjQWa7iSwDhmiNdOwGWjrO2
+JJpXIMD9aRd6q072dQ6PFUU6/7csZWKUTYVrWf5OA9TTdsc2Pg==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/scripts-cert.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/scripts-cert.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/scripts-cert.pem	(revision 2244)
@@ -0,0 +1,105 @@
+From mitcert@MIT.EDU Fri Jun  1 22:02:06 2012
+Date: Tue, 29 May 2012 10:02:50 -0400
+From: mitcert@MIT.EDU
+To: achernya@mit.edu
+Subject: [help.mit.edu #2003792] certificate renewal for scripts-vhost scripts-cert.mit.edu 
+Resent-Date: Sat, 2 Jun 2012 01:02:01 -0400 (EDT)
+Resent-From: Alexander Chernyakhovsky <achernya@MIT.EDU>
+Resent-To: scripts-root@mit.edu
+Resent-Subject: [help.mit.edu #2003792] certificate renewal for scripts-vhost
+ scripts-cert.mit.edu 
+
+-----BEGIN CERTIFICATE-----
+MIIGaDCCBVCgAwIBAgIRAKZGueBJm320erzjEGcNe0cwDQYJKoZIhvcNAQEFBQAw
+UTELMAkGA1UEBhMCVVMxEjAQBgNVBAoTCUludGVybmV0MjERMA8GA1UECxMISW5D
+b21tb24xGzAZBgNVBAMTEkluQ29tbW9uIFNlcnZlciBDQTAeFw0xMjA1MjkwMDAw
+MDBaFw0xNTA1MjkyMzU5NTlaMIHYMQswCQYDVQQGEwJVUzEOMAwGA1UEERMFMDIx
+MzkxCzAJBgNVBAgTAk1hMRIwEAYDVQQHEwlDYW1icmlkZ2UxHTAbBgNVBAkTFDc3
+IE1hc3NhY2h1c2V0dHMgQXZlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRzIEluc3Rp
+dHV0ZSBvZiBUZWNobm9sb2d5MSowKAYDVQQLFCFJbmZvcm1hdGlvbiBTZXJ2aWNl
+cyAmIFRlY2hub2xvZ3kxHTAbBgNVBAMTFHNjcmlwdHMtY2VydC5taXQuZWR1MIIC
+IjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KD
+nmpPNZ3wz4mHc+OT97cBVzhu6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5s
+mQyyRgUPTfGwx141BmL+KtYPGyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9Pt
+NdADuhts86DY09xrRLBeAVHTAsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpD
+LocvQXCsrd9UwO32IVH6xQbwG+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB
+/8NklEBIMGjwbgMmdMKhs9fLlPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuE
+lNCy8dpS9tF/Yx0II1JfwvlNrKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilF
+EtIx1nlMiudUJyLGgK6HI1bxjUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi
++7ssrUuE6lVk995WndC20H0eG1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9
+n34Hpzjog0w92zS2JAyQV8D50GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zw
+DsdHjS7WqGJCk1t89TX4MRB7ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnU
+KR3O5hS6TIsJ/0bOi20CAwEAAaOCAbEwggGtMB8GA1UdIwQYMBaAFEhPWvovSppe
+4FDza3tVpd71vjRdMB0GA1UdDgQWBBTLEbcBX4ZVT0VeqydpvuE8iXpVYjAOBgNV
+HQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYI
+KwYBBQUHAwIwXQYDVR0gBFYwVDBSBgwrBgEEAa4jAQQDAQEwQjBABggrBgEFBQcC
+ARY0aHR0cHM6Ly93d3cuaW5jb21tb24ub3JnL2NlcnQvcmVwb3NpdG9yeS9jcHNf
+c3NsLnBkZjA9BgNVHR8ENjA0MDKgMKAuhixodHRwOi8vY3JsLmluY29tbW9uLm9y
+Zy9JbkNvbW1vblNlcnZlckNBLmNybDBvBggrBgEFBQcBAQRjMGEwOQYIKwYBBQUH
+MAKGLWh0dHA6Ly9jZXJ0LmluY29tbW9uLm9yZy9JbkNvbW1vblNlcnZlckNBLmNy
+dDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuaW5jb21tb24ub3JnMB8GA1UdEQQY
+MBaCFHNjcmlwdHMtY2VydC5taXQuZWR1MA0GCSqGSIb3DQEBBQUAA4IBAQBtMgPK
+KTh0qEFMQKWmoF6BXaKKMSB0yLd6+Aqir7ZrjXwqia9Upv2V8kpdx4wlvXXccCpP
+QO59eMsnQ9tJ5pJH/5MCI+Rga+APHniQvHMZZrBMOvFIxyniqDh/ssqe8C1dhc7y
+vV7I9EtG7YKwhh8QhwAZa/MRarh6Ju0Gt3ZndxBqeqy8xtdQIchNWMf+s7mYOaxg
+E89HAObR/opXIe/+6pf66HQjoJ4yCqXTVgdZ7ArypfPx3jtE+jaegu4YZQuGddz9
+lkvzbmo00kTnvsrTJYjMUAioe3tzhYCApofGVC+OhPgb14oJ59bBjilKL/wYdyqG
+37DPCucaMJRyphEG
+-----END CERTIFICATE-----
+
+You will need to use the following Chain CA certificate:
+https://cert-manager.com/customer/InCommon/ssl?action=download&sslId=117402&format=x509IO
+
+-----BEGIN CERTIFICATE-----
+MIIENjCCAx6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJTRTEU
+MBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFkZFRydXN0IEV4dGVybmFs
+IFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBFeHRlcm5hbCBDQSBSb290
+MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFowbzELMAkGA1UEBhMCU0Ux
+FDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRlcm5h
+bCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9v
+dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALf3GjPm8gAELTngTlvt
+H7xsD821+iO2zt6bETOXpClMfZOfvUq8k+0DGuOPz+VtUFrWlymUWoCwSXrbLpX9
+uMq/NzgtHj6RQa1wVsfwTz/oMp50ysiQVOnGXw94nZpAPA6sYapeFI+eh6FqUNzX
+mk6vBbOmcZSccbNQYArHE504B4YCqOmoaSYYkKtMsE8jqzpPhNjfzp/haW+710LX
+a0Tkx63ubUFfclpxCDezeWWkWaCUN/cALw3CknLa0Dhy2xSoRcRdKn23tNbE7qzN
+E0S3ySvdQwAl+mG5aWpYIxG3pzOPVnVZ9c0p10a3CitlttNCbxWyuHv77+ldU9U0
+WicCAwEAAaOB3DCB2TAdBgNVHQ4EFgQUrb2YejS0Jvf6xCZU7wO94CTLVBowCwYD
+VR0PBAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wgZkGA1UdIwSBkTCBjoAUrb2YejS0
+Jvf6xCZU7wO94CTLVBqhc6RxMG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRU
+cnVzdCBBQjEmMCQGA1UECxMdQWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsx
+IjAgBgNVBAMTGUFkZFRydXN0IEV4dGVybmFsIENBIFJvb3SCAQEwDQYJKoZIhvcN
+AQEFBQADggEBALCb4IUlwtYj4g+WBpKdQZic2YR5gdkeWxQHIzZlj7DYd7usQWxH
+YINRsPkyPef89iYTx4AWpb9a/IfPeHmJIZriTAcKhjW88t5RxNKWt9x+Tu5w/Rw5
+6wwCURQtjr0W4MHfRnXnJK3s9EK0hZNwEGe6nQY1ShjTK3rMUUKhemPR5ruhxSvC
+Nr4TDea9Y355e6cJDUCrat2PisP29owaQgVR1EX1n6diIWgVIEM8med8vSTYqZEX
+c4g/VhsxOBi0cQ+azcgOno4uG+GMmIPLHzHxREzGBHNJdmAPx/i9F4BrLunMTA5a
+mnkPIAou1Z5jJh5VkpTYghdae9C8x49OhgQ=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEwzCCA6ugAwIBAgIQf3HB06ImsNKxE/PmgWdkPjANBgkqhkiG9w0BAQUFADBv
+MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFk
+ZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBF
+eHRlcm5hbCBDQSBSb290MB4XDTEwMTIwNzAwMDAwMFoXDTIwMDUzMDEwNDgzOFow
+UTELMAkGA1UEBhMCVVMxEjAQBgNVBAoTCUludGVybmV0MjERMA8GA1UECxMISW5D
+b21tb24xGzAZBgNVBAMTEkluQ29tbW9uIFNlcnZlciBDQTCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAJd8x8j+s+kgaqOkT46ONFYGs3psqhCbSGErNpBp
+4zQKR6e7e96qavvrgpWPyh1/r3WmqEzaIGdhGg2GwcrBh6+sTuTeYhsvnbGYr8YB
++xdw26wUWexvPzN/ppgL5OI4r/V/hW0OdASd9ieGx5uP53EqCPQDAkBjJH1AV49U
+4FR+thNIYfHezg69tvpNmLLZDY15puCqzQyRmqXfq3O7yhR4XEcpocrFup/H2mD3
+/+d/8tnaoS0PSRan0wCSz4pH2U341ZVm03T5gGMAT0yEFh+z9SQfoU7e6JXWsgsJ
+iyxrx1wvjGPJmctSsWJ7cwFif2Ns2Gig7mqojR8p89AYrK0CAwEAAaOCAXcwggFz
+MB8GA1UdIwQYMBaAFK29mHo0tCb3+sQmVO8DveAky1QaMB0GA1UdDgQWBBRIT1r6
+L0qaXuBQ82t7VaXe9b40XTAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB
+/wIBADARBgNVHSAECjAIMAYGBFUdIAAwRAYDVR0fBD0wOzA5oDegNYYzaHR0cDov
+L2NybC51c2VydHJ1c3QuY29tL0FkZFRydXN0RXh0ZXJuYWxDQVJvb3QuY3JsMIGz
+BggrBgEFBQcBAQSBpjCBozA/BggrBgEFBQcwAoYzaHR0cDovL2NydC51c2VydHJ1
+c3QuY29tL0FkZFRydXN0RXh0ZXJuYWxDQVJvb3QucDdjMDkGCCsGAQUFBzAChi1o
+dHRwOi8vY3J0LnVzZXJ0cnVzdC5jb20vQWRkVHJ1c3RVVE5TR0NDQS5jcnQwJQYI
+KwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEF
+BQADggEBAJNmIYB0RYVLwqvOMrAp/t3f1iRbvwNqb1A+DhuzDYijW+7EpBI7Vu8G
+f89/IZVWO0Ex/uGqk9KV85UNPEerylwmrT7x+Yw0bhG+9GfjAkn5pnx7ZCXdF0by
+UOPjCiE6SSTNxoRlaGdosEUtR5nNnKuGKRFy3NacNkN089SXnlag/l9AWNLV1358
+xY4asgRckmYOha0uBs7Io9jrFCeR3s8XMIFTtmYSrTfk9e+WXCAONumsYn0ZgYr1
+kGGmSavOPN/mymTugmU5RZUWukEGAJi6DFZh5MbGhgHPZqkiKQLWPc/EKo2Z3vsJ
+FJ4O0dXG14HdrSSrrAcF4h1ow3BmX9M=
+-----END CERTIFICATE-----
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/scripts.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/scripts.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/scripts.pem	(revision 2244)
@@ -0,0 +1,72 @@
+From mitcert@MIT.EDU Wed May 25 15:32:24 2011
+Date: Wed, 25 May 2011 15:32:22 -0400
+From: mitcert@MIT.EDU
+To: geofft@mit.edu
+Subject: [help.mit.edu #1615888] Equifax certificate renewal for scripts.mit.edu 
+
+5 Year ($300) Certificate:
+
+Web Server CERTIFICATE
+-----------------
+
+-----BEGIN CERTIFICATE-----
+MIIFvTCCBKWgAwIBAgIDAKAKMA0GCSqGSIb3DQEBBQUAMEAxCzAJBgNVBAYTAlVT
+MRcwFQYDVQQKEw5HZW9UcnVzdCwgSW5jLjEYMBYGA1UEAxMPR2VvVHJ1c3QgU1NM
+IENBMB4XDTExMDUyNDExNDA1MloXDTE2MDYyNDE2MjgwNlowgdwxKTAnBgNVBAUT
+IHNLTHQ1aW8zNjBqTS1vQWQyRUdMTkswRXJhWHdYRTQ2MQswCQYDVQQGEwJVUzEW
+MBQGA1UECBMNTWFzc2FjaHVzZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYD
+VQQKEyVNYXNzYWNodXNldHRzIEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYD
+VQQLEyNzY3JpcHRzLm1pdC5lZHUgd2ViIGhvc3Rpbmcgc2VydmljZTEYMBYGA1UE
+AxMPc2NyaXB0cy5taXQuZWR1MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
+AgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mHc+OT97cBVzhu6fxZTSTrpxdH
+yixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGwx141BmL+KtYPGyy1AiRMwwZx
+7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY09xrRLBeAVHTAsxK2lIS3jUx
+aRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9UwO32IVH6xQbwG+uhsL9NHEI0
+itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjwbgMmdMKhs9fLlPxuU4oqnv2x
+T8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/Yx0II1JfwvlNrKRE5ZpUcPzJ
+/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudUJyLGgK6HI1bxjUmbyPrtM1tf
+VnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk995WndC20H0eG1FQN0SU5sQV
+60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w92zS2JAyQV8D50GQUipNHm0H1
+oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJCk1t89TX4MRB7ONRAJGiBEyfL
++3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ/0bOi20CAwEAAaOCASEwggEd
+MB8GA1UdIwQYMBaAFEJ5VBthzVUrPmPVPEhX9Z/7Rc5KMA4GA1UdDwEB/wQEAwIF
+oDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwGgYDVR0RBBMwEYIPc2Ny
+aXB0cy5taXQuZWR1MD0GA1UdHwQ2MDQwMqAwoC6GLGh0dHA6Ly9ndHNzbC1jcmwu
+Z2VvdHJ1c3QuY29tL2NybHMvZ3Rzc2wuY3JsMB0GA1UdDgQWBBTLEbcBX4ZVT0Ve
+qydpvuE8iXpVYjAMBgNVHRMBAf8EAjAAMEMGCCsGAQUFBwEBBDcwNTAzBggrBgEF
+BQcwAoYnaHR0cDovL2d0c3NsLWFpYS5nZW90cnVzdC5jb20vZ3Rzc2wuY3J0MA0G
+CSqGSIb3DQEBBQUAA4IBAQAyzdBtuhneBsq8S1I1WA2vQn/qp4lfRoqNzdSCGixW
+rbk2RK/qMic7mwrOFX1ZYflCzWyuehcTOAKfjetVmyfs+81atmB/liLNGnpF0qSJ
+JQJbNemjf8KxQyXCFj/OXvUhG/lLh83FA2AGqvFAFiD8mVe/xmzbd7UsI1+EpaFd
+sKcn7f/3YQ25ADrfdOguuiXIGsWPKcApo09fK69NZZKjD9oQ6QFsj9Hyk8Ymyhf5
+bBtvqYOUQ5QMlYZ91Uy4CXVhx5mCo3L1ddXWDG/onDdcDI0LORxCgJVIqh+3g4vg
+QKJR/6V68wkGpGGblkWawj02bfcyMjc73TVIASl+QOi/
+-----END CERTIFICATE-----
+
+
+INTERMEDIATE CA:
+---------------------------------------
+
+-----BEGIN CERTIFICATE-----
+MIID2TCCAsGgAwIBAgIDAjbQMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT
+MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i
+YWwgQ0EwHhcNMTAwMjE5MjIzOTI2WhcNMjAwMjE4MjIzOTI2WjBAMQswCQYDVQQG
+EwJVUzEXMBUGA1UEChMOR2VvVHJ1c3QsIEluYy4xGDAWBgNVBAMTD0dlb1RydXN0
+IFNTTCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJCzgMHk5Uat
+cGA9uuUU3Z6KXot1WubKbUGlI+g5hSZ6p1V3mkihkn46HhrxJ6ujTDnMyz1Hr4Gu
+FmpcN+9FQf37mpc8oEOdxt8XIdGKolbCA0mEEoE+yQpUYGa5jFTk+eb5lPHgX3UR
+8im55IaisYmtph6DKWOy8FQchQt65+EuDa+kvc3nsVrXjAVaDktzKIt1XTTYdwvh
+dGLicTBi2LyKBeUxY0pUiWozeKdOVSQdl+8a5BLGDzAYtDRN4dgjOyFbLTAZJQ50
+96QhS6CkIMlszZhWwPKoXz4mdaAN+DaIiixafWcwqQ/RmXAueOFRJq9VeiS+jDkN
+d53eAsMMvR8CAwEAAaOB2TCB1jAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFEJ5
+VBthzVUrPmPVPEhX9Z/7Rc5KMB8GA1UdIwQYMBaAFMB6mGiNifurBWQMEX2qfWW4
+ysxOMBIGA1UdEwEB/wQIMAYBAf8CAQAwOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDov
+L2NybC5nZW90cnVzdC5jb20vY3Jscy9ndGdsb2JhbC5jcmwwNAYIKwYBBQUHAQEE
+KDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5nZW90cnVzdC5jb20wDQYJKoZI
+hvcNAQEFBQADggEBANTvU4ToGr2hiwTAqfVfoRB4RV2yV2pOJMtlTjGXkZrUJPji
+J2ZwMZzBYlQG55cdOprApClICq8kx6jEmlTBfEx4TCtoLF0XplR4TEbigMMfOHES
+0tdT41SFULgCy+5jOvhWiU1Vuy7AyBh3hjELC3DwfjWDpCoTZFZnNF0WX3OsewYk
+2k9QbSqr0E1TQcKOu3EDSSmGGM8hQkx0YlEVxW+o78Qn5Rsz3VqI138S0adhJR/V
+4NwdzxoQ2KDLX4z6DOW/cf/lXUQdpj6HR/oaToODEj+IZpWYeZqF6wJHzSXj8gYE
+TpnKXKBuervdo5AaRTPvvz7SBMS24CqFZUE+ENQ=
+-----END CERTIFICATE-----
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/signup.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/signup.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/signup.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Sat Oct 15 11:12:33 2011
+Date: Sat, 15 Oct 2011 11:12:32 -0400
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1768742] certificate renewal for scripts-vhost signup.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            7c:c7:5c:48:b3:4d:a3:59:e4:f9:5e:43:7b:f8:71:7e
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Oct 13 16:00:00 2011 GMT
+            Not After : Oct 11 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=signup.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        6e:7b:4e:89:f7:e0:7d:1e:f8:6a:04:e7:d1:77:af:fa:62:8c:
+        79:de:e5:f0:c1:77:33:18:cf:72:81:1d:2c:c6:4d:66:c7:c9:
+        19:50:27:a9:8b:09:42:e5:3d:b2:f6:bf:9b:cb:65:80:27:c4:
+        cd:5c:4e:0f:25:15:bd:e3:48:a7:3d:e9:c2:50:e9:8e:5c:93:
+        96:ab:a0:fe:fd:f0:73:19:de:c6:03:49:d0:49:b5:01:d9:cc:
+        c4:37:31:aa:d6:7c:12:d6:e3:85:bf:a3:05:d7:36:1f:03:a4:
+        21:91:eb:50:f2:f7:6c:4a:df:5e:93:c9:5d:12:b0:cd:c6:73:
+        86:5d
+-----BEGIN CERTIFICATE-----
+MIIFATCCBGqgAwIBAgIQfMdcSLNNo1nk+V5De/hxfjANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMTAxMzE2MDAwMFoXDTEy
+MTAxMTE2MDAwMFowgdAxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRcwFQYDVQQDEw5zaWdudXAubWl0LmVkdTEe
+MBwGCSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkqhkiG9w0BAQEF
+AAOCAg8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mHc+OT97cB
+Vzhu6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGwx141BmL+
+KtYPGyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY09xrRLBe
+AVHTAsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9UwO32IVH6
+xQbwG+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjwbgMmdMKh
+s9fLlPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/Yx0II1Jf
+wvlNrKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudUJyLGgK6H
+I1bxjUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk995WndC2
+0H0eG1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w92zS2JAyQ
+V8D50GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJCk1t89TX4
+MRB7ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ/0bOi20C
+AwEAAaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF4DAnBgNVHSUE
+IDAeBggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1UdDwQEAwIF4DAd
+BgNVHQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCwwKjAooCagJIYi
+aHR0cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkqhkiG9w0BAQUF
+AAOBgQBue06J9+B9HvhqBOfRd6/6Yox53uXwwXczGM9ygR0sxk1mx8kZUCepiwlC
+5T2y9r+by2WAJ8TNXE4PJRW940inPenCUOmOXJOWq6D+/fBzGd7GA0nQSbUB2czE
+NzGq1nwS1uOFv6MF1zYfA6QhketQ8vdsSt9ek8ldErDNxnOGXQ==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/sipb.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/sipb.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/sipb.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Sat Oct 15 11:06:27 2011
+Date: Sat, 15 Oct 2011 11:06:26 -0400
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1768746] certificate renewal for scripts-vhost sipb.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            26:5f:a6:7f:f1:b4:ff:ba:56:ed:1c:d5:17:b4:3d:71
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Oct 13 16:00:00 2011 GMT
+            Not After : Oct 11 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=sipb.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        cd:16:dd:d8:29:24:ff:85:36:9f:b0:40:29:ec:e7:7b:36:98:
+        a2:c3:2a:6a:5f:90:a5:78:e2:37:c1:09:a1:e8:44:75:8c:da:
+        fe:d8:e3:12:4b:09:da:99:9d:6c:82:2b:45:7e:cf:1f:91:cb:
+        74:f1:b9:d8:5e:a6:c7:52:58:91:4b:95:5b:27:4e:90:a1:ed:
+        bb:8b:dd:f7:bb:f3:4c:ee:ce:3a:16:5d:c5:bb:12:a7:14:1b:
+        98:93:31:60:70:68:9a:f3:d6:f8:a1:05:ee:5a:5b:0b:94:a9:
+        ba:dd:df:38:ec:78:17:2c:83:dc:4a:72:d6:d8:c6:d9:da:ac:
+        32:55
+-----BEGIN CERTIFICATE-----
+MIIE/zCCBGigAwIBAgIQJl+mf/G0/7pW7RzVF7Q9cTANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMTAxMzE2MDAwMFoXDTEy
+MTAxMTE2MDAwMFowgc4xCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRUwEwYDVQQDEwxzaXBiLm1pdC5lZHUxHjAc
+BgkqhkiG9w0BCQEWD3NjcmlwdHNAbWl0LmVkdTCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBAL+j8nuYzBanV+aShTRW8eNig55qTzWd8M+Jh3Pjk/e3AVc4
+bun8WU0k66cXR8osUQ5FyLdoyQ4yJuCR0wZcjHwObJkMskYFD03xsMdeNQZi/irW
+DxsstQIkTMMGceyUyh2qr365LcBVS8y8UT12aFvT7TXQA7obbPOg2NPca0SwXgFR
+0wLMStpSEt41MWkWWkiLD86tTeTVixE2f4cc/YTaQy6HL0FwrK3fVMDt9iFR+sUG
+8BvrobC/TRxCNIrVb/clZnOPYMTXjTOR9EY6lwlZAf/DZJRASDBo8G4DJnTCobPX
+y5T8blOKKp79sU/EdFYlYx+qvZUleJxFRhsMIXHrhJTQsvHaUvbRf2MdCCNSX8L5
+TaykROWaVHD8yfzU1LcddZUA478+TPNDw5bHCSopRRLSMdZ5TIrnVCcixoCuhyNW
+8Y1Jm8j67TNbX1Z2yA9+hRRpxEgxBzmlNIHyaxVQIvu7LK1LhOpVZPfeVp3QttB9
+HhtRUDdElObEFetFMfGz7A+zqQz4HEfHUQAF7+6wPZ9+B6c46INMPds0tiQMkFfA
++dBkFIqTR5tB9aMUHZ4YXdXYZq/188gvvKcCp+/c8A7HR40u1qhiQpNbfPU1+DEQ
+ezjUQCRogRMny/t2DtGZFNjV6/dpZI+vj4K7JCn51CkdzuYUukyLCf9GzottAgMB
+AAGjgaswgagwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBeAwJwYDVR0lBCAw
+HgYIKwYBBQUHAwEGCCsGAQUFBwMEBggrBgEFBQcDAjALBgNVHQ8EBAMCBeAwHQYD
+VR0OBBYEFMsRtwFfhlVPRV6rJ2m+4TyJelViMDMGA1UdHwQsMCowKKAmoCSGImh0
+dHA6Ly9jYS5taXQuZWR1L2NhL21pdHNlcnZlci5jcmwwDQYJKoZIhvcNAQEFBQAD
+gYEAzRbd2Ckk/4U2n7BAKeznezaYosMqal+QpXjiN8EJoehEdYza/tjjEksJ2pmd
+bIIrRX7PH5HLdPG52F6mx1JYkUuVWydOkKHtu4vd97vzTO7OOhZdxbsSpxQbmJMx
+YHBomvPW+KEF7lpbC5Sput3fOOx4FyyD3Epy1tjG2dqsMlU=
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/stalk.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/stalk.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/stalk.pem	(revision 2244)
@@ -0,0 +1,103 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            19:06:49:df:41:cf:91:ab:e3:58:cb:7b:5c:e7:40:9f
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Sep 26 16:00:00 2011 GMT
+            Not After : Sep 27 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=stalk.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        24:ad:ed:dc:34:12:e8:e9:d4:50:7a:d7:2e:79:3c:f2:e3:0e:
+        73:47:a8:9a:96:8b:1c:fc:52:85:22:07:a1:3e:e8:8d:22:77:
+        1e:f3:a2:24:6b:74:58:cc:b9:ba:a4:44:44:cf:15:32:66:34:
+        db:d5:7c:00:1e:12:eb:c5:e6:d6:7e:1b:73:ed:4d:a5:1c:b2:
+        66:83:21:55:77:dc:77:10:1b:73:9b:04:da:1a:ed:3f:01:ce:
+        7b:22:ac:f2:ee:61:dd:43:95:15:f2:fd:4e:9a:8d:d3:18:39:
+        fc:42:c3:92:3f:a0:d9:7d:87:e7:b8:3a:07:35:27:00:20:7a:
+        24:17
+-----BEGIN CERTIFICATE-----
+MIIFADCCBGmgAwIBAgIQGQZJ30HPkavjWMt7XOdAnzANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMDkyNjE2MDAwMFoXDTEy
+MDkyNzE2MDAwMFowgc8xCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRYwFAYDVQQDEw1zdGFsay5taXQuZWR1MR4w
+HAYJKoZIhvcNAQkBFg9zY3JpcHRzQG1pdC5lZHUwggIiMA0GCSqGSIb3DQEBAQUA
+A4ICDwAwggIKAoICAQC/o/J7mMwWp1fmkoU0VvHjYoOeak81nfDPiYdz45P3twFX
+OG7p/FlNJOunF0fKLFEORci3aMkOMibgkdMGXIx8DmyZDLJGBQ9N8bDHXjUGYv4q
+1g8bLLUCJEzDBnHslModqq9+uS3AVUvMvFE9dmhb0+010AO6G2zzoNjT3GtEsF4B
+UdMCzEraUhLeNTFpFlpIiw/OrU3k1YsRNn+HHP2E2kMuhy9BcKyt31TA7fYhUfrF
+BvAb66Gwv00cQjSK1W/3JWZzj2DE140zkfRGOpcJWQH/w2SUQEgwaPBuAyZ0wqGz
+18uU/G5Tiiqe/bFPxHRWJWMfqr2VJXicRUYbDCFx64SU0LLx2lL20X9jHQgjUl/C
++U2spETlmlRw/Mn81NS3HXWVAOO/PkzzQ8OWxwkqKUUS0jHWeUyK51QnIsaArocj
+VvGNSZvI+u0zW19WdsgPfoUUacRIMQc5pTSB8msVUCL7uyytS4TqVWT33lad0LbQ
+fR4bUVA3RJTmxBXrRTHxs+wPs6kM+BxHx1EABe/usD2ffgenOOiDTD3bNLYkDJBX
+wPnQZBSKk0ebQfWjFB2eGF3V2Gav9fPIL7ynAqfv3PAOx0eNLtaoYkKTW3z1Nfgx
+EHs41EAkaIETJ8v7dg7RmRTY1ev3aWSPr4+CuyQp+dQpHc7mFLpMiwn/Rs6LbQID
+AQABo4GrMIGoMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgXgMCcGA1UdJQQg
+MB4GCCsGAQUFBwMBBggrBgEFBQcDBAYIKwYBBQUHAwIwCwYDVR0PBAQDAgXgMB0G
+A1UdDgQWBBTLEbcBX4ZVT0VeqydpvuE8iXpVYjAzBgNVHR8ELDAqMCigJqAkhiJo
+dHRwOi8vY2EubWl0LmVkdS9jYS9taXRzZXJ2ZXIuY3JsMA0GCSqGSIb3DQEBBQUA
+A4GBACSt7dw0Eujp1FB61y55PPLjDnNHqJqWixz8UoUiB6E+6I0idx7zoiRrdFjM
+ubqkRETPFTJmNNvVfAAeEuvF5tZ+G3PtTaUcsmaDIVV33HcQG3ObBNoa7T8Bznsi
+rPLuYd1DlRXy/U6ajdMYOfxCw5I/oNl9h+e4Ogc1JwAgeiQX
+-----END CERTIFICATE-----
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/star.scripts.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/star.scripts.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/star.scripts.pem	(revision 2244)
@@ -0,0 +1,65 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 744584 (0xb5c88)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, O=Equifax, OU=Equifax Secure Certificate Authority
+        Validity
+            Not Before: Jun  4 09:13:16 2009 GMT
+            Not After : Jun  5 13:13:22 2014 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=Student Information Processing Board, CN=*.scripts.mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:b5:3e:21:4d:c1:89:6b:01:8c:47:80:fe:b3:37:
+                    27:76:f8:52:41:e6:a2:3d:4b:76:78:e5:f2:66:3c:
+                    0f:b1:ad:fb:97:8f:2e:a2:b6:53:d3:b6:0e:e2:66:
+                    f9:b9:0b:b7:ce:b4:d5:f5:1c:1f:6f:22:7d:48:f5:
+                    6d:f0:16:cd:8e:48:79:d1:14:4a:14:2f:2f:f8:c4:
+                    bd:1d:87:cf:7d:8b:5c:77:ad:58:24:b0:0e:a1:6d:
+                    d6:0a:c7:d8:bc:2f:67:65:c8:5d:d8:d8:31:c2:67:
+                    4b:4a:f4:a1:a5:54:82:af:cb:34:08:2a:04:7f:8e:
+                    7c:4c:b7:db:dc:6a:8a:5d:81
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Key Usage: critical
+                Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment
+            X509v3 Subject Key Identifier: 
+                54:11:7C:09:55:44:1C:94:45:A9:A2:76:46:2B:2C:24:26:6A:44:E8
+            X509v3 CRL Distribution Points: 
+                URI:http://crl.geotrust.com/crls/secureca.crl
+
+            X509v3 Authority Key Identifier: 
+                keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4
+
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+    Signature Algorithm: sha1WithRSAEncryption
+        2c:25:90:82:a2:82:e8:03:58:b4:38:11:bc:c0:b5:f0:44:ee:
+        b3:d9:5f:90:ab:b3:f6:24:fa:92:6b:9c:3a:7d:5d:89:f4:a2:
+        3c:2f:cb:85:b2:fe:b6:92:0f:1b:94:65:2d:d6:70:f8:9f:77:
+        9c:b3:20:fa:16:91:9d:e1:b7:64:07:27:42:8b:be:e2:f3:d9:
+        78:71:42:12:3d:6f:33:37:4b:01:2e:1d:87:25:48:bf:50:23:
+        7a:b0:02:41:5d:35:08:bf:e7:15:08:5c:11:7d:91:10:06:52:
+        19:d3:05:01:94:86:07:f7:76:41:e1:fb:d9:1c:d0:ee:74:9f:
+        51:66
+-----BEGIN CERTIFICATE-----
+MIIDKjCCApOgAwIBAgIDC1yIMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNVBAYTAlVT
+MRAwDgYDVQQKEwdFcXVpZmF4MS0wKwYDVQQLEyRFcXVpZmF4IFNlY3VyZSBDZXJ0
+aWZpY2F0ZSBBdXRob3JpdHkwHhcNMDkwNjA0MDkxMzE2WhcNMTQwNjA1MTMxMzIy
+WjCBtDELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxEjAQBgNV
+BAcTCUNhbWJyaWRnZTEuMCwGA1UEChMlTWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUg
+b2YgVGVjaG5vbG9neTEtMCsGA1UECxMkU3R1ZGVudCBJbmZvcm1hdGlvbiBQcm9j
+ZXNzaW5nIEJvYXJkMRowGAYDVQQDFBEqLnNjcmlwdHMubWl0LmVkdTCBnzANBgkq
+hkiG9w0BAQEFAAOBjQAwgYkCgYEAtT4hTcGJawGMR4D+szcndvhSQeaiPUt2eOXy
+ZjwPsa37l48uorZT07YO4mb5uQu3zrTV9RwfbyJ9SPVt8BbNjkh50RRKFC8v+MS9
+HYfPfYtcd61YJLAOoW3WCsfYvC9nZchd2NgxwmdLSvShpVSCr8s0CCoEf458TLfb
+3GqKXYECAwEAAaOBrjCBqzAOBgNVHQ8BAf8EBAMCBPAwHQYDVR0OBBYEFFQRfAlV
+RByURamidkYrLCQmakToMDoGA1UdHwQzMDEwL6AtoCuGKWh0dHA6Ly9jcmwuZ2Vv
+dHJ1c3QuY29tL2NybHMvc2VjdXJlY2EuY3JsMB8GA1UdIwQYMBaAFEjmaPkr0rKV
+10fYIyAQTzOYkJ/UMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkq
+hkiG9w0BAQUFAAOBgQAsJZCCooLoA1i0OBG8wLXwRO6z2V+Qq7P2JPqSa5w6fV2J
+9KI8L8uFsv62kg8blGUt1nD4n3ecsyD6FpGd4bdkBydCi77i89l4cUISPW8zN0sB
+Lh2HJUi/UCN6sAJBXTUIv+cVCFwRfZEQBlIZ0wUBlIYH93ZB4fvZHNDudJ9RZg==
+-----END CERTIFICATE-----
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/swe.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/swe.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/swe.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Mon Nov 14 17:50:51 2011
+Date: Mon, 14 Nov 2011 17:50:50 -0500
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1798248] certificate renewal for scripts-vhost swe.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            e5:97:39:ee:61:34:18:d4:6d:6c:9e:24:90:cd:34:6e
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Nov 13 17:00:00 2011 GMT
+            Not After : Nov 13 17:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=swe.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        97:75:9d:4c:92:4e:d4:ba:bc:e8:5f:ab:ff:11:7e:ad:1a:e6:
+        3f:e2:d7:92:3f:b7:94:d1:a8:a6:62:30:0d:08:5f:44:14:d3:
+        ba:bf:68:55:0b:d9:48:11:52:8e:bc:63:7e:84:94:68:bb:1b:
+        ce:5c:21:04:35:b1:42:ba:86:5e:41:a7:12:b4:39:51:99:17:
+        bc:2e:f2:f1:76:80:e4:7f:8b:7b:d1:7c:49:10:8b:86:1c:64:
+        f9:65:9e:9e:56:74:cc:b0:5d:4d:e5:b8:fb:66:23:05:cf:b7:
+        b6:1e:a7:05:65:9b:ae:8e:0c:86:de:1c:09:81:78:28:e9:b0:
+        8d:40
+-----BEGIN CERTIFICATE-----
+MIIE/zCCBGigAwIBAgIRAOWXOe5hNBjUbWyeJJDNNG4wDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMTExMTMxNzAwMDBaFw0x
+MjExMTMxNzAwMDBaMIHNMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTEUMBIGA1UEAxMLc3dlLm1pdC5lZHUxHjAc
+BgkqhkiG9w0BCQEWD3NjcmlwdHNAbWl0LmVkdTCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBAL+j8nuYzBanV+aShTRW8eNig55qTzWd8M+Jh3Pjk/e3AVc4
+bun8WU0k66cXR8osUQ5FyLdoyQ4yJuCR0wZcjHwObJkMskYFD03xsMdeNQZi/irW
+DxsstQIkTMMGceyUyh2qr365LcBVS8y8UT12aFvT7TXQA7obbPOg2NPca0SwXgFR
+0wLMStpSEt41MWkWWkiLD86tTeTVixE2f4cc/YTaQy6HL0FwrK3fVMDt9iFR+sUG
+8BvrobC/TRxCNIrVb/clZnOPYMTXjTOR9EY6lwlZAf/DZJRASDBo8G4DJnTCobPX
+y5T8blOKKp79sU/EdFYlYx+qvZUleJxFRhsMIXHrhJTQsvHaUvbRf2MdCCNSX8L5
+TaykROWaVHD8yfzU1LcddZUA478+TPNDw5bHCSopRRLSMdZ5TIrnVCcixoCuhyNW
+8Y1Jm8j67TNbX1Z2yA9+hRRpxEgxBzmlNIHyaxVQIvu7LK1LhOpVZPfeVp3QttB9
+HhtRUDdElObEFetFMfGz7A+zqQz4HEfHUQAF7+6wPZ9+B6c46INMPds0tiQMkFfA
++dBkFIqTR5tB9aMUHZ4YXdXYZq/188gvvKcCp+/c8A7HR40u1qhiQpNbfPU1+DEQ
+ezjUQCRogRMny/t2DtGZFNjV6/dpZI+vj4K7JCn51CkdzuYUukyLCf9GzottAgMB
+AAGjgaswgagwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBeAwJwYDVR0lBCAw
+HgYIKwYBBQUHAwEGCCsGAQUFBwMEBggrBgEFBQcDAjALBgNVHQ8EBAMCBeAwHQYD
+VR0OBBYEFMsRtwFfhlVPRV6rJ2m+4TyJelViMDMGA1UdHwQsMCowKKAmoCSGImh0
+dHA6Ly9jYS5taXQuZWR1L2NhL21pdHNlcnZlci5jcmwwDQYJKoZIhvcNAQEFBQAD
+gYEAl3WdTJJO1Lq86F+r/xF+rRrmP+LXkj+3lNGopmIwDQhfRBTTur9oVQvZSBFS
+jrxjfoSUaLsbzlwhBDWxQrqGXkGnErQ5UZkXvC7y8XaA5H+Le9F8SRCLhhxk+WWe
+nlZ0zLBdTeW4+2YjBc+3th6nBWWbro4Mht4cCYF4KOmwjUA=
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/techfair.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/techfair.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/techfair.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Mon Nov 14 17:52:13 2011
+Date: Mon, 14 Nov 2011 17:52:12 -0500
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1798246] certificate renewal for scripts-vhost techfair.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            b9:ae:4c:27:26:eb:5e:24:07:13:86:0d:fd:75:40:9c
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Nov 13 17:00:00 2011 GMT
+            Not After : Nov 13 17:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=techfair.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        82:62:bd:fc:b2:ee:09:38:1d:f9:e8:a6:5e:27:53:1a:37:ef:
+        4e:76:13:36:5b:d2:15:b2:7f:b4:74:35:d2:a7:21:1a:cf:49:
+        bd:b6:11:e2:01:8f:91:72:80:70:5b:03:cd:f9:73:79:81:99:
+        54:6f:d2:0f:df:07:ff:28:5f:8f:e9:cf:11:8d:7d:a7:e7:13:
+        09:00:06:75:b1:a7:29:f0:01:e1:00:bd:ed:2e:25:ee:c3:31:
+        e2:39:de:72:d7:8b:bc:60:da:85:58:8a:1e:e7:69:c5:91:b8:
+        3d:70:e1:7c:b1:fe:9d:6a:98:56:28:84:aa:6d:d1:10:f2:2d:
+        1d:4a
+-----BEGIN CERTIFICATE-----
+MIIFBDCCBG2gAwIBAgIRALmuTCcm614kBxOGDf11QJwwDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMTExMTMxNzAwMDBaFw0x
+MjExMTMxNzAwMDBaMIHSMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTEZMBcGA1UEAxMQdGVjaGZhaXIubWl0LmVk
+dTEeMBwGCSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkqhkiG9w0B
+AQEFAAOCAg8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mHc+OT
+97cBVzhu6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGwx141
+BmL+KtYPGyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY09xr
+RLBeAVHTAsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9UwO32
+IVH6xQbwG+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjwbgMm
+dMKhs9fLlPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/Yx0I
+I1JfwvlNrKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudUJyLG
+gK6HI1bxjUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk995W
+ndC20H0eG1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w92zS2
+JAyQV8D50GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJCk1t8
+9TX4MRB7ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ/0bO
+i20CAwEAAaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF4DAnBgNV
+HSUEIDAeBggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1UdDwQEAwIF
+4DAdBgNVHQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkqhkiG9w0B
+AQUFAAOBgQCCYr38su4JOB356KZeJ1MaN+9OdhM2W9IVsn+0dDXSpyEaz0m9thHi
+AY+RcoBwWwPN+XN5gZlUb9IP3wf/KF+P6c8RjX2n5xMJAAZ1sacp8AHhAL3tLiXu
+wzHiOd5y14u8YNqFWIoe52nFkbg9cOF8sf6daphWKISqbdEQ8i0dSg==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/tf.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/tf.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/tf.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Mon Nov 14 17:51:26 2011
+Date: Mon, 14 Nov 2011 17:51:24 -0500
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1798247] certificate renewal for scripts-vhost tf.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            1c:35:ed:44:22:72:df:53:6c:3e:30:0d:c1:0b:02:9b
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Nov 13 17:00:00 2011 GMT
+            Not After : Nov 13 17:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=tf.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        81:6c:6e:b5:b4:c4:4b:fd:de:0e:f8:30:3b:f8:71:22:ea:e0:
+        53:62:59:b5:e4:27:69:0d:d2:a6:52:fe:72:9b:ff:96:03:bd:
+        4c:fc:64:78:7c:53:de:c0:f7:cb:3b:1c:63:6f:dc:e4:3c:76:
+        3b:9a:03:b3:9d:6c:3a:f2:fe:fe:dc:04:2e:45:f4:ed:f8:7c:
+        66:68:57:9c:e7:25:31:40:18:80:57:e7:83:d3:21:64:ad:d2:
+        db:4a:4a:38:c2:fb:17:52:36:aa:7d:2a:7c:a2:b3:f7:4a:9c:
+        1a:a1:65:1c:e0:c6:41:69:94:a5:52:6b:ca:72:f6:39:f1:4f:
+        62:54
+-----BEGIN CERTIFICATE-----
+MIIE/TCCBGagAwIBAgIQHDXtRCJy31NsPjANwQsCmzANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMTExMzE3MDAwMFoXDTEy
+MTExMzE3MDAwMFowgcwxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRMwEQYDVQQDEwp0Zi5taXQuZWR1MR4wHAYJ
+KoZIhvcNAQkBFg9zY3JpcHRzQG1pdC5lZHUwggIiMA0GCSqGSIb3DQEBAQUAA4IC
+DwAwggIKAoICAQC/o/J7mMwWp1fmkoU0VvHjYoOeak81nfDPiYdz45P3twFXOG7p
+/FlNJOunF0fKLFEORci3aMkOMibgkdMGXIx8DmyZDLJGBQ9N8bDHXjUGYv4q1g8b
+LLUCJEzDBnHslModqq9+uS3AVUvMvFE9dmhb0+010AO6G2zzoNjT3GtEsF4BUdMC
+zEraUhLeNTFpFlpIiw/OrU3k1YsRNn+HHP2E2kMuhy9BcKyt31TA7fYhUfrFBvAb
+66Gwv00cQjSK1W/3JWZzj2DE140zkfRGOpcJWQH/w2SUQEgwaPBuAyZ0wqGz18uU
+/G5Tiiqe/bFPxHRWJWMfqr2VJXicRUYbDCFx64SU0LLx2lL20X9jHQgjUl/C+U2s
+pETlmlRw/Mn81NS3HXWVAOO/PkzzQ8OWxwkqKUUS0jHWeUyK51QnIsaArocjVvGN
+SZvI+u0zW19WdsgPfoUUacRIMQc5pTSB8msVUCL7uyytS4TqVWT33lad0LbQfR4b
+UVA3RJTmxBXrRTHxs+wPs6kM+BxHx1EABe/usD2ffgenOOiDTD3bNLYkDJBXwPnQ
+ZBSKk0ebQfWjFB2eGF3V2Gav9fPIL7ynAqfv3PAOx0eNLtaoYkKTW3z1NfgxEHs4
+1EAkaIETJ8v7dg7RmRTY1ev3aWSPr4+CuyQp+dQpHc7mFLpMiwn/Rs6LbQIDAQAB
+o4GrMIGoMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgXgMCcGA1UdJQQgMB4G
+CCsGAQUFBwMBBggrBgEFBQcDBAYIKwYBBQUHAwIwCwYDVR0PBAQDAgXgMB0GA1Ud
+DgQWBBTLEbcBX4ZVT0VeqydpvuE8iXpVYjAzBgNVHR8ELDAqMCigJqAkhiJodHRw
+Oi8vY2EubWl0LmVkdS9jYS9taXRzZXJ2ZXIuY3JsMA0GCSqGSIb3DQEBBQUAA4GB
+AIFsbrW0xEv93g74MDv4cSLq4FNiWbXkJ2kN0qZS/nKb/5YDvUz8ZHh8U97A98s7
+HGNv3OQ8djuaA7OdbDry/v7cBC5F9O34fGZoV5znJTFAGIBX54PTIWSt0ttKSjjC
++xdSNqp9Knyis/dKnBqhZRzgxkFplKVSa8py9jnxT2JU
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/tibetforum.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/tibetforum.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/tibetforum.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Mon Mar 12 14:28:19 2012
+Date: Mon, 12 Mar 2012 14:28:17 -0400
+From: mitcert@MIT.EDU
+To: achernya@mit.edu
+Subject: [help.mit.edu #1919659] certificate renewal for scripts-vhost tibetforum.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            88:ea:3d:45:7b:b4:7d:86:d8:a3:c8:2b:ba:0f:6c:ca
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Mar 11 16:00:00 2012 GMT
+            Not After : Mar 12 16:00:00 2013 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=tibetforum.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        d0:e0:42:a2:66:b7:a9:b8:62:20:c7:40:09:f7:6e:b9:48:d0:
+        41:78:d8:81:11:10:14:d6:6e:2d:cd:17:32:a5:6c:c7:d5:ae:
+        b0:a5:6c:96:34:97:77:79:72:0a:2b:29:5e:b9:90:b5:63:2f:
+        76:b9:65:80:99:d2:6a:e8:f5:72:53:cc:27:b0:00:7b:4b:6d:
+        2d:82:fa:c0:b6:22:47:cf:ff:2c:0b:f1:7c:ae:78:34:5b:0a:
+        ea:56:22:21:2e:73:b2:af:09:82:41:8e:fa:7b:45:03:7a:68:
+        dd:5c:af:8c:4f:0c:8d:88:11:f9:e7:b3:e0:58:6e:74:58:cf:
+        6b:46
+-----BEGIN CERTIFICATE-----
+MIIFBjCCBG+gAwIBAgIRAIjqPUV7tH2G2KPIK7oPbMowDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMjAzMTExNjAwMDBaFw0x
+MzAzMTIxNjAwMDBaMIHUMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTEbMBkGA1UEAxMSdGliZXRmb3J1bS5taXQu
+ZWR1MR4wHAYJKoZIhvcNAQkBFg9zY3JpcHRzQG1pdC5lZHUwggIiMA0GCSqGSIb3
+DQEBAQUAA4ICDwAwggIKAoICAQC/o/J7mMwWp1fmkoU0VvHjYoOeak81nfDPiYdz
+45P3twFXOG7p/FlNJOunF0fKLFEORci3aMkOMibgkdMGXIx8DmyZDLJGBQ9N8bDH
+XjUGYv4q1g8bLLUCJEzDBnHslModqq9+uS3AVUvMvFE9dmhb0+010AO6G2zzoNjT
+3GtEsF4BUdMCzEraUhLeNTFpFlpIiw/OrU3k1YsRNn+HHP2E2kMuhy9BcKyt31TA
+7fYhUfrFBvAb66Gwv00cQjSK1W/3JWZzj2DE140zkfRGOpcJWQH/w2SUQEgwaPBu
+AyZ0wqGz18uU/G5Tiiqe/bFPxHRWJWMfqr2VJXicRUYbDCFx64SU0LLx2lL20X9j
+HQgjUl/C+U2spETlmlRw/Mn81NS3HXWVAOO/PkzzQ8OWxwkqKUUS0jHWeUyK51Qn
+IsaArocjVvGNSZvI+u0zW19WdsgPfoUUacRIMQc5pTSB8msVUCL7uyytS4TqVWT3
+3lad0LbQfR4bUVA3RJTmxBXrRTHxs+wPs6kM+BxHx1EABe/usD2ffgenOOiDTD3b
+NLYkDJBXwPnQZBSKk0ebQfWjFB2eGF3V2Gav9fPIL7ynAqfv3PAOx0eNLtaoYkKT
+W3z1NfgxEHs41EAkaIETJ8v7dg7RmRTY1ev3aWSPr4+CuyQp+dQpHc7mFLpMiwn/
+Rs6LbQIDAQABo4GrMIGoMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgXgMCcG
+A1UdJQQgMB4GCCsGAQUFBwMBBggrBgEFBQcDBAYIKwYBBQUHAwIwCwYDVR0PBAQD
+AgXgMB0GA1UdDgQWBBTLEbcBX4ZVT0VeqydpvuE8iXpVYjAzBgNVHR8ELDAqMCig
+JqAkhiJodHRwOi8vY2EubWl0LmVkdS9jYS9taXRzZXJ2ZXIuY3JsMA0GCSqGSIb3
+DQEBBQUAA4GBANDgQqJmt6m4YiDHQAn3brlI0EF42IEREBTWbi3NFzKlbMfVrrCl
+bJY0l3d5cgorKV65kLVjL3a5ZYCZ0mro9XJTzCewAHtLbS2C+sC2IkfP/ywL8Xyu
+eDRbCupWIiEuc7KvCYJBjvp7RQN6aN1cr4xPDI2IEfnns+BYbnRYz2tG
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ties.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ties.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ties.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Mon May 14 09:29:28 2012
+Date: Mon, 14 May 2012 09:29:26 -0400
+From: mitcert@MIT.EDU
+To: achernya@mit.edu
+Subject: [help.mit.edu #1987094] certificate renewal for scripts-vhost ties.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            ad:4d:c7:9a:02:c8:7e:1c:b7:4d:e1:c4:bc:c8:69:fe
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: May 12 16:00:00 2012 GMT
+            Not After : May 14 16:00:00 2013 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=ties.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        23:ec:34:e2:79:a4:07:a4:12:8f:ce:72:42:7f:c7:30:4a:93:
+        7f:de:52:9f:76:0c:6b:41:fd:d5:09:45:33:84:9d:b4:6c:ec:
+        de:53:61:4d:78:06:34:3d:d2:2d:4b:16:0a:86:77:13:47:78:
+        4b:7e:4b:f6:fc:64:1d:13:5e:7a:dc:06:47:3a:34:74:7c:ee:
+        39:c0:5a:b2:9b:f3:b0:1e:5a:93:3e:a3:61:67:52:b2:db:13:
+        a2:ed:8c:d1:40:fe:1d:8e:53:e2:d5:e3:d4:f2:b2:d2:3f:8f:
+        f4:5f:a1:44:19:b8:6b:2d:86:5a:5c:d7:4f:11:11:3b:ae:dc:
+        93:92
+-----BEGIN CERTIFICATE-----
+MIIFADCCBGmgAwIBAgIRAK1Nx5oCyH4ct03hxLzIaf4wDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMjA1MTIxNjAwMDBaFw0x
+MzA1MTQxNjAwMDBaMIHOMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTEVMBMGA1UEAxMMdGllcy5taXQuZWR1MR4w
+HAYJKoZIhvcNAQkBFg9zY3JpcHRzQG1pdC5lZHUwggIiMA0GCSqGSIb3DQEBAQUA
+A4ICDwAwggIKAoICAQC/o/J7mMwWp1fmkoU0VvHjYoOeak81nfDPiYdz45P3twFX
+OG7p/FlNJOunF0fKLFEORci3aMkOMibgkdMGXIx8DmyZDLJGBQ9N8bDHXjUGYv4q
+1g8bLLUCJEzDBnHslModqq9+uS3AVUvMvFE9dmhb0+010AO6G2zzoNjT3GtEsF4B
+UdMCzEraUhLeNTFpFlpIiw/OrU3k1YsRNn+HHP2E2kMuhy9BcKyt31TA7fYhUfrF
+BvAb66Gwv00cQjSK1W/3JWZzj2DE140zkfRGOpcJWQH/w2SUQEgwaPBuAyZ0wqGz
+18uU/G5Tiiqe/bFPxHRWJWMfqr2VJXicRUYbDCFx64SU0LLx2lL20X9jHQgjUl/C
++U2spETlmlRw/Mn81NS3HXWVAOO/PkzzQ8OWxwkqKUUS0jHWeUyK51QnIsaArocj
+VvGNSZvI+u0zW19WdsgPfoUUacRIMQc5pTSB8msVUCL7uyytS4TqVWT33lad0LbQ
+fR4bUVA3RJTmxBXrRTHxs+wPs6kM+BxHx1EABe/usD2ffgenOOiDTD3bNLYkDJBX
+wPnQZBSKk0ebQfWjFB2eGF3V2Gav9fPIL7ynAqfv3PAOx0eNLtaoYkKTW3z1Nfgx
+EHs41EAkaIETJ8v7dg7RmRTY1ev3aWSPr4+CuyQp+dQpHc7mFLpMiwn/Rs6LbQID
+AQABo4GrMIGoMAkGA1UdEwQCMAAwEQYJYIZIAYb4QgEBBAQDAgXgMCcGA1UdJQQg
+MB4GCCsGAQUFBwMBBggrBgEFBQcDBAYIKwYBBQUHAwIwCwYDVR0PBAQDAgXgMB0G
+A1UdDgQWBBTLEbcBX4ZVT0VeqydpvuE8iXpVYjAzBgNVHR8ELDAqMCigJqAkhiJo
+dHRwOi8vY2EubWl0LmVkdS9jYS9taXRzZXJ2ZXIuY3JsMA0GCSqGSIb3DQEBBQUA
+A4GBACPsNOJ5pAekEo/OckJ/xzBKk3/eUp92DGtB/dUJRTOEnbRs7N5TYU14BjQ9
+0i1LFgqGdxNHeEt+S/b8ZB0TXnrcBkc6NHR87jnAWrKb87AeWpM+o2FnUrLbE6Lt
+jNFA/h2OU+LV49TystI/j/RfoUQZuGsthlpc108RETuu3JOS
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/tours.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/tours.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/tours.pem	(revision 2244)
@@ -0,0 +1,104 @@
+From mitcert@MIT.EDU Fri Jun  1 22:01:52 2012
+Date: Tue, 29 May 2012 10:01:50 -0400
+From: mitcert@MIT.EDU
+To: achernya@mit.edu
+Subject: [help.mit.edu #2003791] certificate renewal for scripts-vhost tours.mit.edu 
+Resent-Date: Sat, 2 Jun 2012 01:01:41 -0400 (EDT)
+Resent-From: Alexander Chernyakhovsky <achernya@MIT.EDU>
+Resent-To: scripts-root@mit.edu
+Resent-Subject: [help.mit.edu #2003791] certificate renewal for scripts-vhost
+ tours.mit.edu 
+
+-----BEGIN CERTIFICATE-----
+MIIGWTCCBUGgAwIBAgIQLiWSzLCF/wgkbnNU+K2oHDANBgkqhkiG9w0BAQUFADBR
+MQswCQYDVQQGEwJVUzESMBAGA1UEChMJSW50ZXJuZXQyMREwDwYDVQQLEwhJbkNv
+bW1vbjEbMBkGA1UEAxMSSW5Db21tb24gU2VydmVyIENBMB4XDTEyMDUyOTAwMDAw
+MFoXDTE1MDUyOTIzNTk1OVowgdExCzAJBgNVBAYTAlVTMQ4wDAYDVQQREwUwMjEz
+OTELMAkGA1UECBMCTWExEjAQBgNVBAcTCUNhbWJyaWRnZTEdMBsGA1UECRMUNzcg
+TWFzc2FjaHVzZXR0cyBBdmUxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMgSW5zdGl0
+dXRlIG9mIFRlY2hub2xvZ3kxKjAoBgNVBAsUIUluZm9ybWF0aW9uIFNlcnZpY2Vz
+ICYgVGVjaG5vbG9neTEWMBQGA1UEAxMNdG91cnMubWl0LmVkdTCCAiIwDQYJKoZI
+hvcNAQEBBQADggIPADCCAgoCggIBAL+j8nuYzBanV+aShTRW8eNig55qTzWd8M+J
+h3Pjk/e3AVc4bun8WU0k66cXR8osUQ5FyLdoyQ4yJuCR0wZcjHwObJkMskYFD03x
+sMdeNQZi/irWDxsstQIkTMMGceyUyh2qr365LcBVS8y8UT12aFvT7TXQA7obbPOg
+2NPca0SwXgFR0wLMStpSEt41MWkWWkiLD86tTeTVixE2f4cc/YTaQy6HL0FwrK3f
+VMDt9iFR+sUG8BvrobC/TRxCNIrVb/clZnOPYMTXjTOR9EY6lwlZAf/DZJRASDBo
+8G4DJnTCobPXy5T8blOKKp79sU/EdFYlYx+qvZUleJxFRhsMIXHrhJTQsvHaUvbR
+f2MdCCNSX8L5TaykROWaVHD8yfzU1LcddZUA478+TPNDw5bHCSopRRLSMdZ5TIrn
+VCcixoCuhyNW8Y1Jm8j67TNbX1Z2yA9+hRRpxEgxBzmlNIHyaxVQIvu7LK1LhOpV
+ZPfeVp3QttB9HhtRUDdElObEFetFMfGz7A+zqQz4HEfHUQAF7+6wPZ9+B6c46INM
+Pds0tiQMkFfA+dBkFIqTR5tB9aMUHZ4YXdXYZq/188gvvKcCp+/c8A7HR40u1qhi
+QpNbfPU1+DEQezjUQCRogRMny/t2DtGZFNjV6/dpZI+vj4K7JCn51CkdzuYUukyL
+Cf9GzottAgMBAAGjggGqMIIBpjAfBgNVHSMEGDAWgBRIT1r6L0qaXuBQ82t7VaXe
+9b40XTAdBgNVHQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwDgYDVR0PAQH/BAQD
+AgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMC
+MF0GA1UdIARWMFQwUgYMKwYBBAGuIwEEAwEBMEIwQAYIKwYBBQUHAgEWNGh0dHBz
+Oi8vd3d3LmluY29tbW9uLm9yZy9jZXJ0L3JlcG9zaXRvcnkvY3BzX3NzbC5wZGYw
+PQYDVR0fBDYwNDAyoDCgLoYsaHR0cDovL2NybC5pbmNvbW1vbi5vcmcvSW5Db21t
+b25TZXJ2ZXJDQS5jcmwwbwYIKwYBBQUHAQEEYzBhMDkGCCsGAQUFBzAChi1odHRw
+Oi8vY2VydC5pbmNvbW1vbi5vcmcvSW5Db21tb25TZXJ2ZXJDQS5jcnQwJAYIKwYB
+BQUHMAGGGGh0dHA6Ly9vY3NwLmluY29tbW9uLm9yZzAYBgNVHREEETAPgg10b3Vy
+cy5taXQuZWR1MA0GCSqGSIb3DQEBBQUAA4IBAQCCGBZNPC7xIb8x6jqtlL6Pk40A
+aNKztlcbbcpJ15y66HC7wCjad+7QE7yK7l7f6WlhTwnit6qXsczUQP3g3P2hoAoU
+okQ4r3sfelbmIvqlDayqODZwzK42AiIeG3lNR8EBp3EV+IU6uKp/llY3OtyEesCM
+MMOoXl26LirJwNKK2fe2/7jo6XdB3tF83zUP/AHExQAyivMNxvv3RH/TKR5ULXDZ
+iQGbXQns3IovjDcfDDg66JHz3cbgk8HBtPm/bvM0szpRnVSHwyTPLb/r1NzKIdn4
+2yWaF3/xBKqxqbTDJFoWQsiqUt9v9iDkgy1sM7DtwA9U1qF0mIiZ51BKGGBs
+-----END CERTIFICATE-----
+
+You will need to use the following Chain CA Certificate:
+https://cert-manager.com/customer/InCommon/ssl?action=download&sslId=117402&format=x509IO
+
+-----BEGIN CERTIFICATE-----
+MIIENjCCAx6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJTRTEU
+MBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFkZFRydXN0IEV4dGVybmFs
+IFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBFeHRlcm5hbCBDQSBSb290
+MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFowbzELMAkGA1UEBhMCU0Ux
+FDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRlcm5h
+bCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9v
+dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALf3GjPm8gAELTngTlvt
+H7xsD821+iO2zt6bETOXpClMfZOfvUq8k+0DGuOPz+VtUFrWlymUWoCwSXrbLpX9
+uMq/NzgtHj6RQa1wVsfwTz/oMp50ysiQVOnGXw94nZpAPA6sYapeFI+eh6FqUNzX
+mk6vBbOmcZSccbNQYArHE504B4YCqOmoaSYYkKtMsE8jqzpPhNjfzp/haW+710LX
+a0Tkx63ubUFfclpxCDezeWWkWaCUN/cALw3CknLa0Dhy2xSoRcRdKn23tNbE7qzN
+E0S3ySvdQwAl+mG5aWpYIxG3pzOPVnVZ9c0p10a3CitlttNCbxWyuHv77+ldU9U0
+WicCAwEAAaOB3DCB2TAdBgNVHQ4EFgQUrb2YejS0Jvf6xCZU7wO94CTLVBowCwYD
+VR0PBAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wgZkGA1UdIwSBkTCBjoAUrb2YejS0
+Jvf6xCZU7wO94CTLVBqhc6RxMG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRU
+cnVzdCBBQjEmMCQGA1UECxMdQWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsx
+IjAgBgNVBAMTGUFkZFRydXN0IEV4dGVybmFsIENBIFJvb3SCAQEwDQYJKoZIhvcN
+AQEFBQADggEBALCb4IUlwtYj4g+WBpKdQZic2YR5gdkeWxQHIzZlj7DYd7usQWxH
+YINRsPkyPef89iYTx4AWpb9a/IfPeHmJIZriTAcKhjW88t5RxNKWt9x+Tu5w/Rw5
+6wwCURQtjr0W4MHfRnXnJK3s9EK0hZNwEGe6nQY1ShjTK3rMUUKhemPR5ruhxSvC
+Nr4TDea9Y355e6cJDUCrat2PisP29owaQgVR1EX1n6diIWgVIEM8med8vSTYqZEX
+c4g/VhsxOBi0cQ+azcgOno4uG+GMmIPLHzHxREzGBHNJdmAPx/i9F4BrLunMTA5a
+mnkPIAou1Z5jJh5VkpTYghdae9C8x49OhgQ=
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEwzCCA6ugAwIBAgIQf3HB06ImsNKxE/PmgWdkPjANBgkqhkiG9w0BAQUFADBv
+MQswCQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFk
+ZFRydXN0IEV4dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBF
+eHRlcm5hbCBDQSBSb290MB4XDTEwMTIwNzAwMDAwMFoXDTIwMDUzMDEwNDgzOFow
+UTELMAkGA1UEBhMCVVMxEjAQBgNVBAoTCUludGVybmV0MjERMA8GA1UECxMISW5D
+b21tb24xGzAZBgNVBAMTEkluQ29tbW9uIFNlcnZlciBDQTCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAJd8x8j+s+kgaqOkT46ONFYGs3psqhCbSGErNpBp
+4zQKR6e7e96qavvrgpWPyh1/r3WmqEzaIGdhGg2GwcrBh6+sTuTeYhsvnbGYr8YB
++xdw26wUWexvPzN/ppgL5OI4r/V/hW0OdASd9ieGx5uP53EqCPQDAkBjJH1AV49U
+4FR+thNIYfHezg69tvpNmLLZDY15puCqzQyRmqXfq3O7yhR4XEcpocrFup/H2mD3
+/+d/8tnaoS0PSRan0wCSz4pH2U341ZVm03T5gGMAT0yEFh+z9SQfoU7e6JXWsgsJ
+iyxrx1wvjGPJmctSsWJ7cwFif2Ns2Gig7mqojR8p89AYrK0CAwEAAaOCAXcwggFz
+MB8GA1UdIwQYMBaAFK29mHo0tCb3+sQmVO8DveAky1QaMB0GA1UdDgQWBBRIT1r6
+L0qaXuBQ82t7VaXe9b40XTAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB
+/wIBADARBgNVHSAECjAIMAYGBFUdIAAwRAYDVR0fBD0wOzA5oDegNYYzaHR0cDov
+L2NybC51c2VydHJ1c3QuY29tL0FkZFRydXN0RXh0ZXJuYWxDQVJvb3QuY3JsMIGz
+BggrBgEFBQcBAQSBpjCBozA/BggrBgEFBQcwAoYzaHR0cDovL2NydC51c2VydHJ1
+c3QuY29tL0FkZFRydXN0RXh0ZXJuYWxDQVJvb3QucDdjMDkGCCsGAQUFBzAChi1o
+dHRwOi8vY3J0LnVzZXJ0cnVzdC5jb20vQWRkVHJ1c3RVVE5TR0NDQS5jcnQwJQYI
+KwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVzZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQEF
+BQADggEBAJNmIYB0RYVLwqvOMrAp/t3f1iRbvwNqb1A+DhuzDYijW+7EpBI7Vu8G
+f89/IZVWO0Ex/uGqk9KV85UNPEerylwmrT7x+Yw0bhG+9GfjAkn5pnx7ZCXdF0by
+UOPjCiE6SSTNxoRlaGdosEUtR5nNnKuGKRFy3NacNkN089SXnlag/l9AWNLV1358
+xY4asgRckmYOha0uBs7Io9jrFCeR3s8XMIFTtmYSrTfk9e+WXCAONumsYn0ZgYr1
+kGGmSavOPN/mymTugmU5RZUWukEGAJi6DFZh5MbGhgHPZqkiKQLWPc/EKo2Z3vsJ
+FJ4O0dXG14HdrSSrrAcF4h1ow3BmX9M=
+-----END CERTIFICATE-----
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/twentytwelve.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/twentytwelve.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/twentytwelve.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Sat Oct 15 11:10:42 2011
+Date: Sat, 15 Oct 2011 11:10:41 -0400
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1768744] certificate renewal for scripts-vhost twentytwelve.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            8c:b1:0c:7e:94:82:af:5d:33:40:88:2c:82:42:13:b8
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Oct 13 16:00:00 2011 GMT
+            Not After : Oct 11 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=twentytwelve.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        cc:f1:9d:ae:e8:e7:65:6c:3d:82:67:a9:20:32:14:52:a6:45:
+        3f:f9:b4:1f:7b:e5:d2:d6:52:55:16:87:5c:29:b1:80:7e:57:
+        da:a4:1d:04:ca:20:02:da:83:48:05:29:22:4b:65:7e:c1:d4:
+        3a:d6:53:43:65:b9:15:be:ff:99:07:66:26:b4:56:b9:7a:ac:
+        5b:41:3e:13:8a:25:c3:90:8a:ce:05:42:66:88:3d:a1:bf:d7:
+        c4:1d:0e:82:ed:0d:28:18:ec:d7:a6:1c:bf:4c:73:19:3c:b1:
+        5e:56:a0:33:a0:61:4b:3c:31:ea:58:79:af:8a:33:80:99:7f:
+        05:a1
+-----BEGIN CERTIFICATE-----
+MIIFCDCCBHGgAwIBAgIRAIyxDH6Ugq9dM0CILIJCE7gwDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMTEwMTMxNjAwMDBaFw0x
+MjEwMTExNjAwMDBaMIHWMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTEdMBsGA1UEAxMUdHdlbnR5dHdlbHZlLm1p
+dC5lZHUxHjAcBgkqhkiG9w0BCQEWD3NjcmlwdHNAbWl0LmVkdTCCAiIwDQYJKoZI
+hvcNAQEBBQADggIPADCCAgoCggIBAL+j8nuYzBanV+aShTRW8eNig55qTzWd8M+J
+h3Pjk/e3AVc4bun8WU0k66cXR8osUQ5FyLdoyQ4yJuCR0wZcjHwObJkMskYFD03x
+sMdeNQZi/irWDxsstQIkTMMGceyUyh2qr365LcBVS8y8UT12aFvT7TXQA7obbPOg
+2NPca0SwXgFR0wLMStpSEt41MWkWWkiLD86tTeTVixE2f4cc/YTaQy6HL0FwrK3f
+VMDt9iFR+sUG8BvrobC/TRxCNIrVb/clZnOPYMTXjTOR9EY6lwlZAf/DZJRASDBo
+8G4DJnTCobPXy5T8blOKKp79sU/EdFYlYx+qvZUleJxFRhsMIXHrhJTQsvHaUvbR
+f2MdCCNSX8L5TaykROWaVHD8yfzU1LcddZUA478+TPNDw5bHCSopRRLSMdZ5TIrn
+VCcixoCuhyNW8Y1Jm8j67TNbX1Z2yA9+hRRpxEgxBzmlNIHyaxVQIvu7LK1LhOpV
+ZPfeVp3QttB9HhtRUDdElObEFetFMfGz7A+zqQz4HEfHUQAF7+6wPZ9+B6c46INM
+Pds0tiQMkFfA+dBkFIqTR5tB9aMUHZ4YXdXYZq/188gvvKcCp+/c8A7HR40u1qhi
+QpNbfPU1+DEQezjUQCRogRMny/t2DtGZFNjV6/dpZI+vj4K7JCn51CkdzuYUukyL
+Cf9GzottAgMBAAGjgaswgagwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBeAw
+JwYDVR0lBCAwHgYIKwYBBQUHAwEGCCsGAQUFBwMEBggrBgEFBQcDAjALBgNVHQ8E
+BAMCBeAwHQYDVR0OBBYEFMsRtwFfhlVPRV6rJ2m+4TyJelViMDMGA1UdHwQsMCow
+KKAmoCSGImh0dHA6Ly9jYS5taXQuZWR1L2NhL21pdHNlcnZlci5jcmwwDQYJKoZI
+hvcNAQEFBQADgYEAzPGdrujnZWw9gmepIDIUUqZFP/m0H3vl0tZSVRaHXCmxgH5X
+2qQdBMogAtqDSAUpIktlfsHUOtZTQ2W5Fb7/mQdmJrRWuXqsW0E+E4olw5CKzgVC
+Zog9ob/XxB0Ogu0NKBjs16Ycv0xzGTyxXlagM6BhSzwx6lh5r4ozgJl/BaE=
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ua.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ua.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/ua.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Sat Oct 15 11:08:52 2011
+Date: Sat, 15 Oct 2011 11:08:51 -0400
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1768747] certificate renewal for scripts-vhost ua.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            99:c8:7c:70:b4:45:76:6f:9f:54:77:80:01:0c:5b:6c
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Oct 13 16:00:00 2011 GMT
+            Not After : Oct 11 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=ua.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        84:cd:bc:69:7b:24:e8:fc:88:9f:d7:14:f6:30:5b:62:7c:d2:
+        26:84:a2:d1:b8:08:e1:5d:b4:17:c4:e0:77:df:94:c5:29:38:
+        22:48:5f:44:23:7e:c7:fa:54:98:b3:a6:c7:f7:1b:fb:26:59:
+        9a:d6:e1:ea:d3:d7:27:e3:9b:02:79:13:00:27:e7:6c:77:fb:
+        4e:b7:0e:c3:bf:fd:76:60:a1:21:d9:1e:df:e4:54:fe:09:7b:
+        60:b1:71:aa:01:16:ff:98:94:da:03:77:86:fa:f2:3f:53:90:
+        49:c1:39:ae:b8:22:73:3a:58:11:7a:82:f7:a8:ee:0e:da:56:
+        ad:04
+-----BEGIN CERTIFICATE-----
+MIIE/jCCBGegAwIBAgIRAJnIfHC0RXZvn1R3gAEMW2wwDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMTEwMTMxNjAwMDBaFw0x
+MjEwMTExNjAwMDBaMIHMMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTETMBEGA1UEAxMKdWEubWl0LmVkdTEeMBwG
+CSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkqhkiG9w0BAQEFAAOC
+Ag8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mHc+OT97cBVzhu
+6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGwx141BmL+KtYP
+Gyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY09xrRLBeAVHT
+AsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9UwO32IVH6xQbw
+G+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjwbgMmdMKhs9fL
+lPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/Yx0II1JfwvlN
+rKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudUJyLGgK6HI1bx
+jUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk995WndC20H0e
+G1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w92zS2JAyQV8D5
+0GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJCk1t89TX4MRB7
+ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ/0bOi20CAwEA
+AaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF4DAnBgNVHSUEIDAe
+BggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1UdDwQEAwIF4DAdBgNV
+HQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCwwKjAooCagJIYiaHR0
+cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkqhkiG9w0BAQUFAAOB
+gQCEzbxpeyTo/Iif1xT2MFtifNImhKLRuAjhXbQXxOB335TFKTgiSF9EI37H+lSY
+s6bH9xv7Jlma1uHq09cn45sCeRMAJ+dsd/tOtw7Dv/12YKEh2R7f5FT+CXtgsXGq
+ARb/mJTaA3eG+vI/U5BJwTmuuCJzOlgReoL3qO4O2latBA==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/wakeup.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/wakeup.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/wakeup.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Mon Aug  1 16:20:05 2011
+Date: Mon, 1 Aug 2011 16:20:03 -0400
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1682243] certificate renewal for scripts-vhost wakeup.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            d6:e9:6c:d6:38:2e:87:6b:66:f7:15:2b:d9:ea:f8:27
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Jul 31 16:00:00 2011 GMT
+            Not After : Jul 31 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=wakeup.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        3a:2d:0d:e3:f0:4a:db:b5:58:03:8f:79:3b:3b:1e:8c:9d:b6:
+        cd:49:d9:da:a1:0c:44:f7:8c:25:27:cd:62:f0:9f:bb:4e:19:
+        ac:ea:f0:d4:36:a8:c7:30:c8:e4:06:66:ee:47:6c:4a:41:b9:
+        29:40:f1:5d:c8:94:3a:dc:ac:fa:be:77:ea:b8:95:15:40:f2:
+        e3:0e:39:24:d5:4f:07:54:18:48:67:f0:48:7c:08:a2:37:99:
+        ad:50:4c:b4:69:44:94:b7:14:78:40:48:63:87:b7:b8:d9:31:
+        f2:75:5d:f7:fa:29:9a:29:63:2a:d3:be:b0:9c:c7:f1:c6:a2:
+        08:9a
+-----BEGIN CERTIFICATE-----
+MIIFAjCCBGugAwIBAgIRANbpbNY4LodrZvcVK9nq+CcwDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMTA3MzExNjAwMDBaFw0x
+MjA3MzExNjAwMDBaMIHQMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTEXMBUGA1UEAxMOd2FrZXVwLm1pdC5lZHUx
+HjAcBgkqhkiG9w0BCQEWD3NjcmlwdHNAbWl0LmVkdTCCAiIwDQYJKoZIhvcNAQEB
+BQADggIPADCCAgoCggIBAL+j8nuYzBanV+aShTRW8eNig55qTzWd8M+Jh3Pjk/e3
+AVc4bun8WU0k66cXR8osUQ5FyLdoyQ4yJuCR0wZcjHwObJkMskYFD03xsMdeNQZi
+/irWDxsstQIkTMMGceyUyh2qr365LcBVS8y8UT12aFvT7TXQA7obbPOg2NPca0Sw
+XgFR0wLMStpSEt41MWkWWkiLD86tTeTVixE2f4cc/YTaQy6HL0FwrK3fVMDt9iFR
++sUG8BvrobC/TRxCNIrVb/clZnOPYMTXjTOR9EY6lwlZAf/DZJRASDBo8G4DJnTC
+obPXy5T8blOKKp79sU/EdFYlYx+qvZUleJxFRhsMIXHrhJTQsvHaUvbRf2MdCCNS
+X8L5TaykROWaVHD8yfzU1LcddZUA478+TPNDw5bHCSopRRLSMdZ5TIrnVCcixoCu
+hyNW8Y1Jm8j67TNbX1Z2yA9+hRRpxEgxBzmlNIHyaxVQIvu7LK1LhOpVZPfeVp3Q
+ttB9HhtRUDdElObEFetFMfGz7A+zqQz4HEfHUQAF7+6wPZ9+B6c46INMPds0tiQM
+kFfA+dBkFIqTR5tB9aMUHZ4YXdXYZq/188gvvKcCp+/c8A7HR40u1qhiQpNbfPU1
++DEQezjUQCRogRMny/t2DtGZFNjV6/dpZI+vj4K7JCn51CkdzuYUukyLCf9Gzott
+AgMBAAGjgaswgagwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBeAwJwYDVR0l
+BCAwHgYIKwYBBQUHAwEGCCsGAQUFBwMEBggrBgEFBQcDAjALBgNVHQ8EBAMCBeAw
+HQYDVR0OBBYEFMsRtwFfhlVPRV6rJ2m+4TyJelViMDMGA1UdHwQsMCowKKAmoCSG
+Imh0dHA6Ly9jYS5taXQuZWR1L2NhL21pdHNlcnZlci5jcmwwDQYJKoZIhvcNAQEF
+BQADgYEAOi0N4/BK27VYA495OzsejJ22zUnZ2qEMRPeMJSfNYvCfu04ZrOrw1Dao
+xzDI5AZm7kdsSkG5KUDxXciUOtys+r536riVFUDy4w45JNVPB1QYSGfwSHwIojeZ
+rVBMtGlElLcUeEBIY4e3uNkx8nVd9/opmiljKtO+sJzH8caiCJo=
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/westgate.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/westgate.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/westgate.pem	(revision 2244)
@@ -0,0 +1,110 @@
+From mitcert@MIT.EDU Mon Aug  1 16:19:21 2011
+Date: Mon, 1 Aug 2011 16:19:20 -0400
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1682242] certificate renewal for scripts-vhost westgate.mit.edu 
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            8e:83:9e:e2:bf:f4:73:bf:99:db:15:bc:33:1c:1e:5f
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Jul 31 16:00:00 2011 GMT
+            Not After : Jul 31 16:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=westgate.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        65:cf:42:92:4c:e7:1b:0e:1e:9a:16:63:3d:79:4d:cf:98:1e:
+        99:2b:8a:3e:19:fb:87:ca:31:2d:a2:32:6c:6b:57:a1:8b:ad:
+        c3:13:7c:d0:be:b5:c0:3c:62:2c:e0:64:c9:03:13:85:1a:5e:
+        5d:73:b6:96:cb:0a:b3:d0:1e:73:15:17:7c:cc:55:ac:a7:d3:
+        b4:91:1b:43:35:bc:7b:ed:7d:d9:f4:ec:5c:2a:4f:36:26:6c:
+        5f:fb:31:88:5b:af:42:5b:ab:a9:09:bf:18:1c:bc:51:e8:96:
+        4d:7b:bf:a3:d9:90:88:0a:3d:b8:98:18:3c:98:ce:a5:03:33:
+        0a:7b
+-----BEGIN CERTIFICATE-----
+MIIFBDCCBG2gAwIBAgIRAI6DnuK/9HO/mdsVvDMcHl8wDQYJKoZIhvcNAQEFBQAw
+ezELMAkGA1UEBhMCVVMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxLjAsBgNVBAoT
+JU1hc3NhY2h1c2V0dHMgSW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxJDAiBgNVBAsT
+G01JVCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xMTA3MzExNjAwMDBaFw0x
+MjA3MzExNjAwMDBaMIHSMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVz
+ZXR0czESMBAGA1UEBxMJQ2FtYnJpZGdlMS4wLAYDVQQKEyVNYXNzYWNodXNldHRz
+IEluc3RpdHV0ZSBvZiBUZWNobm9sb2d5MSwwKgYDVQQLEyNzY3JpcHRzLm1pdC5l
+ZHUgd2ViIGhvc3Rpbmcgc2VydmljZTEZMBcGA1UEAxMQd2VzdGdhdGUubWl0LmVk
+dTEeMBwGCSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkqhkiG9w0B
+AQEFAAOCAg8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mHc+OT
+97cBVzhu6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGwx141
+BmL+KtYPGyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY09xr
+RLBeAVHTAsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9UwO32
+IVH6xQbwG+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjwbgMm
+dMKhs9fLlPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/Yx0I
+I1JfwvlNrKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudUJyLG
+gK6HI1bxjUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk995W
+ndC20H0eG1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w92zS2
+JAyQV8D50GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJCk1t8
+9TX4MRB7ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ/0bO
+i20CAwEAAaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF4DAnBgNV
+HSUEIDAeBggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1UdDwQEAwIF
+4DAdBgNVHQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkqhkiG9w0B
+AQUFAAOBgQBlz0KSTOcbDh6aFmM9eU3PmB6ZK4o+GfuHyjEtojJsa1ehi63DE3zQ
+vrXAPGIs4GTJAxOFGl5dc7aWywqz0B5zFRd8zFWsp9O0kRtDNbx77X3Z9OxcKk82
+Jmxf+zGIW69CW6upCb8YHLxR6JZNe7+j2ZCICj24mBg8mM6lAzMKew==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/whatsnext.pem
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/whatsnext.pem	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/certs/whatsnext.pem	(revision 2244)
@@ -0,0 +1,111 @@
+From mitcert@MIT.EDU Tue Nov  8 13:53:45 2011
+Date: Tue, 8 Nov 2011 13:53:43 -0500
+From: "mitcert@MIT.EDU" <mitcert@MIT.EDU>
+To: Alexander Chernyakhovsky <achernya@mit.edu>
+Subject: [help.mit.edu #1790878] certificate renewal for scripts-vhost whatsnext.mit.edu 
+
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            4a:b2:76:19:b0:f3:bb:76:33:12:97:e5:cf:b2:f3:b8
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=Massachusetts, O=Massachusetts Institute of Technology, OU=MIT Certification Authority
+        Validity
+            Not Before: Nov  7 17:00:00 2011 GMT
+            Not After : Nov  7 17:00:00 2012 GMT
+        Subject: C=US, ST=Massachusetts, L=Cambridge, O=Massachusetts Institute of Technology, OU=scripts.mit.edu web hosting service, CN=whatsnext.mit.edu/emailAddress=scripts@mit.edu
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (4096 bit)
+                Modulus (4096 bit):
+                    00:bf:a3:f2:7b:98:cc:16:a7:57:e6:92:85:34:56:
+                    f1:e3:62:83:9e:6a:4f:35:9d:f0:cf:89:87:73:e3:
+                    93:f7:b7:01:57:38:6e:e9:fc:59:4d:24:eb:a7:17:
+                    47:ca:2c:51:0e:45:c8:b7:68:c9:0e:32:26:e0:91:
+                    d3:06:5c:8c:7c:0e:6c:99:0c:b2:46:05:0f:4d:f1:
+                    b0:c7:5e:35:06:62:fe:2a:d6:0f:1b:2c:b5:02:24:
+                    4c:c3:06:71:ec:94:ca:1d:aa:af:7e:b9:2d:c0:55:
+                    4b:cc:bc:51:3d:76:68:5b:d3:ed:35:d0:03:ba:1b:
+                    6c:f3:a0:d8:d3:dc:6b:44:b0:5e:01:51:d3:02:cc:
+                    4a:da:52:12:de:35:31:69:16:5a:48:8b:0f:ce:ad:
+                    4d:e4:d5:8b:11:36:7f:87:1c:fd:84:da:43:2e:87:
+                    2f:41:70:ac:ad:df:54:c0:ed:f6:21:51:fa:c5:06:
+                    f0:1b:eb:a1:b0:bf:4d:1c:42:34:8a:d5:6f:f7:25:
+                    66:73:8f:60:c4:d7:8d:33:91:f4:46:3a:97:09:59:
+                    01:ff:c3:64:94:40:48:30:68:f0:6e:03:26:74:c2:
+                    a1:b3:d7:cb:94:fc:6e:53:8a:2a:9e:fd:b1:4f:c4:
+                    74:56:25:63:1f:aa:bd:95:25:78:9c:45:46:1b:0c:
+                    21:71:eb:84:94:d0:b2:f1:da:52:f6:d1:7f:63:1d:
+                    08:23:52:5f:c2:f9:4d:ac:a4:44:e5:9a:54:70:fc:
+                    c9:fc:d4:d4:b7:1d:75:95:00:e3:bf:3e:4c:f3:43:
+                    c3:96:c7:09:2a:29:45:12:d2:31:d6:79:4c:8a:e7:
+                    54:27:22:c6:80:ae:87:23:56:f1:8d:49:9b:c8:fa:
+                    ed:33:5b:5f:56:76:c8:0f:7e:85:14:69:c4:48:31:
+                    07:39:a5:34:81:f2:6b:15:50:22:fb:bb:2c:ad:4b:
+                    84:ea:55:64:f7:de:56:9d:d0:b6:d0:7d:1e:1b:51:
+                    50:37:44:94:e6:c4:15:eb:45:31:f1:b3:ec:0f:b3:
+                    a9:0c:f8:1c:47:c7:51:00:05:ef:ee:b0:3d:9f:7e:
+                    07:a7:38:e8:83:4c:3d:db:34:b6:24:0c:90:57:c0:
+                    f9:d0:64:14:8a:93:47:9b:41:f5:a3:14:1d:9e:18:
+                    5d:d5:d8:66:af:f5:f3:c8:2f:bc:a7:02:a7:ef:dc:
+                    f0:0e:c7:47:8d:2e:d6:a8:62:42:93:5b:7c:f5:35:
+                    f8:31:10:7b:38:d4:40:24:68:81:13:27:cb:fb:76:
+                    0e:d1:99:14:d8:d5:eb:f7:69:64:8f:af:8f:82:bb:
+                    24:29:f9:d4:29:1d:ce:e6:14:ba:4c:8b:09:ff:46:
+                    ce:8b:6d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Cert Type: 
+                SSL Client, SSL Server, S/MIME
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, E-mail Protection, TLS Web Client Authentication
+            X509v3 Key Usage: 
+                Digital Signature, Non Repudiation, Key Encipherment
+            X509v3 Subject Key Identifier: 
+                CB:11:B7:01:5F:86:55:4F:45:5E:AB:27:69:BE:E1:3C:89:7A:55:62
+            X509v3 CRL Distribution Points: 
+                URI:http://ca.mit.edu/ca/mitserver.crl
+
+    Signature Algorithm: sha1WithRSAEncryption
+        c6:8a:ba:e5:c4:05:81:eb:cd:2e:c0:30:03:6f:6c:2e:17:72:
+        ec:a6:ea:06:1a:15:4a:f4:fd:4a:78:e8:2c:0a:07:0a:39:78:
+        61:2c:c2:3c:e0:18:0b:c7:1f:a8:71:7f:ee:da:57:5f:f4:ce:
+        54:b8:0d:22:81:0c:67:12:69:20:aa:bb:f5:86:32:a7:91:93:
+        3f:fe:ba:73:05:67:b2:3b:e3:45:94:78:6f:0c:46:e8:c4:3a:
+        1a:5b:f5:b8:34:d1:e2:74:87:0d:ca:4b:b5:48:c4:14:c6:9e:
+        bd:5b:20:c4:04:1b:68:5b:37:33:5d:5f:77:b8:ad:15:a0:d2:
+        1d:ec
+-----BEGIN CERTIFICATE-----
+MIIFBDCCBG2gAwIBAgIQSrJ2GbDzu3YzEpflz7LzuDANBgkqhkiG9w0BAQUFADB7
+MQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEuMCwGA1UEChMl
+TWFzc2FjaHVzZXR0cyBJbnN0aXR1dGUgb2YgVGVjaG5vbG9neTEkMCIGA1UECxMb
+TUlUIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTExMTEwNzE3MDAwMFoXDTEy
+MTEwNzE3MDAwMFowgdMxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
+dHRzMRIwEAYDVQQHEwlDYW1icmlkZ2UxLjAsBgNVBAoTJU1hc3NhY2h1c2V0dHMg
+SW5zdGl0dXRlIG9mIFRlY2hub2xvZ3kxLDAqBgNVBAsTI3NjcmlwdHMubWl0LmVk
+dSB3ZWIgaG9zdGluZyBzZXJ2aWNlMRowGAYDVQQDExF3aGF0c25leHQubWl0LmVk
+dTEeMBwGCSqGSIb3DQEJARYPc2NyaXB0c0BtaXQuZWR1MIICIjANBgkqhkiG9w0B
+AQEFAAOCAg8AMIICCgKCAgEAv6Pye5jMFqdX5pKFNFbx42KDnmpPNZ3wz4mHc+OT
+97cBVzhu6fxZTSTrpxdHyixRDkXIt2jJDjIm4JHTBlyMfA5smQyyRgUPTfGwx141
+BmL+KtYPGyy1AiRMwwZx7JTKHaqvfrktwFVLzLxRPXZoW9PtNdADuhts86DY09xr
+RLBeAVHTAsxK2lIS3jUxaRZaSIsPzq1N5NWLETZ/hxz9hNpDLocvQXCsrd9UwO32
+IVH6xQbwG+uhsL9NHEI0itVv9yVmc49gxNeNM5H0RjqXCVkB/8NklEBIMGjwbgMm
+dMKhs9fLlPxuU4oqnv2xT8R0ViVjH6q9lSV4nEVGGwwhceuElNCy8dpS9tF/Yx0I
+I1JfwvlNrKRE5ZpUcPzJ/NTUtx11lQDjvz5M80PDlscJKilFEtIx1nlMiudUJyLG
+gK6HI1bxjUmbyPrtM1tfVnbID36FFGnESDEHOaU0gfJrFVAi+7ssrUuE6lVk995W
+ndC20H0eG1FQN0SU5sQV60Ux8bPsD7OpDPgcR8dRAAXv7rA9n34Hpzjog0w92zS2
+JAyQV8D50GQUipNHm0H1oxQdnhhd1dhmr/XzyC+8pwKn79zwDsdHjS7WqGJCk1t8
+9TX4MRB7ONRAJGiBEyfL+3YO0ZkU2NXr92lkj6+PgrskKfnUKR3O5hS6TIsJ/0bO
+i20CAwEAAaOBqzCBqDAJBgNVHRMEAjAAMBEGCWCGSAGG+EIBAQQEAwIF4DAnBgNV
+HSUEIDAeBggrBgEFBQcDAQYIKwYBBQUHAwQGCCsGAQUFBwMCMAsGA1UdDwQEAwIF
+4DAdBgNVHQ4EFgQUyxG3AV+GVU9FXqsnab7hPIl6VWIwMwYDVR0fBCwwKjAooCag
+JIYiaHR0cDovL2NhLm1pdC5lZHUvY2EvbWl0c2VydmVyLmNybDANBgkqhkiG9w0B
+AQUFAAOBgQDGirrlxAWB680uwDADb2wuF3LspuoGGhVK9P1KeOgsCgcKOXhhLMI8
+4BgLxx+ocX/u2ldf9M5UuA0igQxnEmkgqrv1hjKnkZM//rpzBWeyO+NFlHhvDEbo
+xDoaW/W4NNHidIcNyku1SMQUxp69WyDEBBtoWzczXV93uK0VoNId7A==
+-----END CERTIFICATE-----
+
Index: tags/fc15-eol/server/fedora/config/etc/pki/tls/openssl.cnf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/pki/tls/openssl.cnf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/pki/tls/openssl.cnf	(revision 2244)
@@ -0,0 +1,318 @@
+#
+# OpenSSL example configuration file.
+# This is mostly being used for generation of certificate requests.
+#
+
+# This definition stops the following lines choking if HOME isn't
+# defined.
+HOME			= .
+RANDFILE		= $ENV::HOME/.rnd
+
+# Extra OBJECT IDENTIFIER info:
+#oid_file		= $ENV::HOME/.oid
+oid_section		= new_oids
+
+# To use this configuration file with the "-extfile" option of the
+# "openssl x509" utility, name here the section containing the
+# X.509v3 extensions to use:
+# extensions		= 
+# (Alternatively, use a configuration file that has only
+# X.509v3 extensions in its main [= default] section.)
+
+[ new_oids ]
+
+# We can add new OIDs in here for use by 'ca' and 'req'.
+# Add a simple OID like this:
+# testoid1=1.2.3.4
+# Or use config file substitution like this:
+# testoid2=${testoid1}.5.6
+
+####################################################################
+[ ca ]
+default_ca	= CA_default		# The default ca section
+
+####################################################################
+[ CA_default ]
+
+dir		= ../../CA		# Where everything is kept
+certs		= $dir/certs		# Where the issued certs are kept
+crl_dir		= $dir/crl		# Where the issued crl are kept
+database	= $dir/index.txt	# database index file.
+#unique_subject	= no			# Set to 'no' to allow creation of
+					# several ctificates with same subject.
+new_certs_dir	= $dir/newcerts		# default place for new certs.
+
+certificate	= $dir/cacert.pem 	# The CA certificate
+serial		= $dir/serial 		# The current serial number
+crlnumber	= $dir/crlnumber	# the current crl number
+					# must be commented out to leave a V1 CRL
+crl		= $dir/crl.pem 		# The current CRL
+private_key	= $dir/private/cakey.pem# The private key
+RANDFILE	= $dir/private/.rand	# private random number file
+
+x509_extensions	= usr_cert		# The extentions to add to the cert
+
+# Comment out the following two lines for the "traditional"
+# (and highly broken) format.
+name_opt 	= ca_default		# Subject Name options
+cert_opt 	= ca_default		# Certificate field options
+
+# Extension copying option: use with caution.
+# copy_extensions = copy
+
+# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
+# so this is commented out by default to leave a V1 CRL.
+# crlnumber must also be commented out to leave a V1 CRL.
+# crl_extensions	= crl_ext
+
+default_days	= 365			# how long to certify for
+default_crl_days= 30			# how long before next CRL
+default_md	= sha1			# which md to use.
+preserve	= no			# keep passed DN ordering
+
+# A few difference way of specifying how similar the request should look
+# For type CA, the listed attributes must be the same, and the optional
+# and supplied fields are just that :-)
+policy		= policy_match
+
+# For the CA policy
+[ policy_match ]
+countryName		= match
+stateOrProvinceName	= match
+organizationName	= match
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+
+# For the 'anything' policy
+# At this point in time, you must list all acceptable 'object'
+# types.
+[ policy_anything ]
+countryName		= optional
+stateOrProvinceName	= optional
+localityName		= optional
+organizationName	= optional
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+
+####################################################################
+[ req ]
+default_bits		= 1024
+default_md		= sha1
+default_keyfile 	= privkey.pem
+distinguished_name	= req_distinguished_name
+attributes		= req_attributes
+x509_extensions	= v3_ca	# The extentions to add to the self signed cert
+
+# Passwords for private keys if not present they will be prompted for
+# input_password = secret
+# output_password = secret
+
+# This sets a mask for permitted string types. There are several options. 
+# default: PrintableString, T61String, BMPString.
+# pkix	 : PrintableString, BMPString.
+# utf8only: only UTF8Strings.
+# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).
+# MASK:XXXX a literal mask value.
+# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings
+# so use this option with caution!
+# we use PrintableString+UTF8String mask so if pure ASCII texts are used
+# the resulting certificates are compatible with Netscape
+string_mask = MASK:0x2002
+
+# req_extensions = v3_req # The extensions to add to a certificate request
+
+[ req_distinguished_name ]
+countryName			= Country Name (2 letter code)
+countryName_default		= US
+countryName_min			= 2
+countryName_max			= 2
+
+stateOrProvinceName		= State or Province Name (full name)
+stateOrProvinceName_default	= Massachusetts
+
+localityName			= Locality Name (eg, city)
+localityName_default		= Cambridge
+
+0.organizationName		= Organization Name (eg, company)
+0.organizationName_default	= Massachusetts Institute of Technology
+
+# we can do this but it is not needed normally :-)
+#1.organizationName		= Second Organization Name (eg, company)
+#1.organizationName_default	= World Wide Web Pty Ltd
+
+organizationalUnitName		= OU
+organizationalUnitName_default	= scripts.mit.edu web hosting service
+
+commonName			= Common Name (eg, your name or your server\'s hostname)
+commonName_max			= 64
+
+emailAddress			= Email Address
+emailAddress_max		= 64
+emailAddress_default		= scripts@mit.edu
+
+# SET-ex3			= SET extension number 3
+
+[ req_attributes ]
+challengePassword		= A challenge password
+challengePassword_min		= 4
+challengePassword_max		= 20
+
+unstructuredName		= An optional company name
+
+[ usr_cert ]
+
+# These extensions are added when 'ca' signs a request.
+
+# This goes against PKIX guidelines but some CAs do it and some software
+# requires this to avoid interpreting an end user certificate as a CA.
+
+basicConstraints=CA:FALSE
+
+# Here are some examples of the usage of nsCertType. If it is omitted
+# the certificate can be used for anything *except* object signing.
+
+# This is OK for an SSL server.
+# nsCertType			= server
+
+# For an object signing certificate this would be used.
+# nsCertType = objsign
+
+# For normal client use this is typical
+# nsCertType = client, email
+
+# and for everything including object signing:
+# nsCertType = client, email, objsign
+
+# This is typical in keyUsage for a client certificate.
+# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+# This will be displayed in Netscape's comment listbox.
+nsComment			= "OpenSSL Generated Certificate"
+
+# PKIX recommendations harmless if included in all certificates.
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
+
+# This stuff is for subjectAltName and issuerAltname.
+# Import the email address.
+# subjectAltName=email:copy
+# An alternative to produce certificates that aren't
+# deprecated according to PKIX.
+# subjectAltName=email:move
+
+# Copy subject details
+# issuerAltName=issuer:copy
+
+#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
+#nsBaseUrl
+#nsRevocationUrl
+#nsRenewalUrl
+#nsCaPolicyUrl
+#nsSslServerName
+
+[ v3_req ]
+
+# Extensions to add to a certificate request
+
+basicConstraints = CA:FALSE
+keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+[ v3_ca ]
+
+
+# Extensions for a typical CA
+
+
+# PKIX recommendation.
+
+subjectKeyIdentifier=hash
+
+authorityKeyIdentifier=keyid:always,issuer:always
+
+# This is what PKIX recommends but some broken software chokes on critical
+# extensions.
+#basicConstraints = critical,CA:true
+# So we do this instead.
+basicConstraints = CA:true
+
+# Key usage: this is typical for a CA certificate. However since it will
+# prevent it being used as an test self-signed certificate it is best
+# left out by default.
+# keyUsage = cRLSign, keyCertSign
+
+# Some might want this also
+# nsCertType = sslCA, emailCA
+
+# Include email address in subject alt name: another PKIX recommendation
+# subjectAltName=email:copy
+# Copy issuer details
+# issuerAltName=issuer:copy
+
+# DER hex encoding of an extension: beware experts only!
+# obj=DER:02:03
+# Where 'obj' is a standard or added object
+# You can even override a supported extension:
+# basicConstraints= critical, DER:30:03:01:01:FF
+
+[ crl_ext ]
+
+# CRL extensions.
+# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
+
+# issuerAltName=issuer:copy
+authorityKeyIdentifier=keyid:always,issuer:always
+
+[ proxy_cert_ext ]
+# These extensions should be added when creating a proxy certificate
+
+# This goes against PKIX guidelines but some CAs do it and some software
+# requires this to avoid interpreting an end user certificate as a CA.
+
+basicConstraints=CA:FALSE
+
+# Here are some examples of the usage of nsCertType. If it is omitted
+# the certificate can be used for anything *except* object signing.
+
+# This is OK for an SSL server.
+# nsCertType			= server
+
+# For an object signing certificate this would be used.
+# nsCertType = objsign
+
+# For normal client use this is typical
+# nsCertType = client, email
+
+# and for everything including object signing:
+# nsCertType = client, email, objsign
+
+# This is typical in keyUsage for a client certificate.
+# keyUsage = nonRepudiation, digitalSignature, keyEncipherment
+
+# This will be displayed in Netscape's comment listbox.
+nsComment			= "OpenSSL Generated Certificate"
+
+# PKIX recommendations harmless if included in all certificates.
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer:always
+
+# This stuff is for subjectAltName and issuerAltname.
+# Import the email address.
+# subjectAltName=email:copy
+# An alternative to produce certificates that aren't
+# deprecated according to PKIX.
+# subjectAltName=email:move
+
+# Copy subject details
+# issuerAltName=issuer:copy
+
+#nsCaRevocationUrl		= http://www.domain.dom/ca-crl.pem
+#nsBaseUrl
+#nsRevocationUrl
+#nsRenewalUrl
+#nsCaPolicyUrl
+#nsSslServerName
+
+# This really needs to be in place for it to be a proxy certificate.
+proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo
Index: tags/fc15-eol/server/fedora/config/etc/postfix/blocked_users
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/postfix/blocked_users	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/postfix/blocked_users	(revision 2244)
@@ -0,0 +1,1 @@
+raskar
Index: tags/fc15-eol/server/fedora/config/etc/postfix/main.cf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/postfix/main.cf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/postfix/main.cf	(revision 2244)
@@ -0,0 +1,34 @@
+#biff = no
+
+# appending .domain is the MUA's job.
+#append_dot_mydomain = no
+
+# Uncomment the next line to generate "delayed mail" warnings
+#delay_warning_time = 4h
+
+alias_maps = hash:/etc/aliases
+alias_database = hash:/etc/aliases
+myorigin = scripts.mit.edu
+mydestination = scripts.mit.edu, scripts, $myhostname, scripts-test.mit.edu, scripts-test, scripts-vhosts.mit.edu, scripts-vhosts, localhost
+relayhost =
+mynetworks = 127.0.0.0/8
+mailbox_command = /usr/bin/procmail -t -a "${EXTENSION}" ~/mail_scripts/procmailrc
+mailbox_size_limit = 0
+recipient_delimiter = +
+inet_interfaces = all
+readme_directory = /usr/share/doc/postfix-2.8.10/README_FILES
+sample_directory = /usr/share/doc/postfix-2.8.10/samples
+sendmail_path = /usr/sbin/sendmail
+html_directory = no
+setgid_group = postdrop
+command_directory = /usr/sbin
+manpage_directory = /usr/share/man
+daemon_directory = /usr/libexec/postfix
+newaliases_path = /usr/bin/newaliases
+mailq_path = /usr/bin/mailq
+queue_directory = /var/spool/postfix
+mail_owner = postfix
+virtual_alias_domains = hash:/etc/postfix/virtual, regexp:/etc/postfix/virtual_re, ldap:/etc/postfix/virtual-alias-domains-ldap.cf
+virtual_alias_maps = hash:/etc/postfix/virtual, regexp:/etc/postfix/virtual_re, ldap:/etc/postfix/virtual-alias-maps-ldap.cf
+data_directory = /var/lib/postfix
+authorized_submit_users = !/etc/postfix/blocked_users, static:all
Index: tags/fc15-eol/server/fedora/config/etc/postfix/virtual
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/postfix/virtual	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/postfix/virtual	(revision 2244)
@@ -0,0 +1,7 @@
+webmaster@szs.mit.edu jdaniel@mit.edu
+webmaster@webzephyr.mit.edu jdaniel@mit.edu
+@szs.mit.edu webzephyr
+@webzephyr.mit.edu webzephyr
+# Domains also match here
+szs.mit.edu true
+webzephyr.mit.edu true
Index: tags/fc15-eol/server/fedora/config/etc/postfix/virtual-alias-domains-ldap.cf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/postfix/virtual-alias-domains-ldap.cf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/postfix/virtual-alias-domains-ldap.cf	(revision 2244)
@@ -0,0 +1,21 @@
+# Find any vhost with a name or alias matching the domain of the e-mail
+# address.  We're queried with only the domain portion to determine whether
+# we accept mail at all for a given domain.  If we have no matching vhost
+# and return no records, Postfix will reject mail with a "Relay access denied"
+# error, unless the domain is configured in $mydestination.  We don't match
+# the scripts.mit.edu vhost here because otherwise it'll be treated as a
+# virtual alias domain and once we resolve an address to a scripts account,
+# we'll end up resolving the locker@scripts.mit.edu address to go to the
+# owners of the scripts.mit.edu vhost.  The value we return (if we return
+# anything at all) is supposedly arbitrary.  We choose to return the same
+# value we were queried with (the domain whose mail we host).  Protocol
+# version 3 is necessary to use ldapi.
+
+server_host = ldapi://%2fvar%2frun%2fslapd-scripts.socket/
+search_base = ou=VirtualHosts,dc=scripts,dc=mit,dc=edu
+query_filter = (&(objectClass=scriptsVhost)(|(scriptsVhostName=%s)(scriptsVhostAlias=%s))(!(scriptsVhostName=scripts.mit.edu)))
+result_attribute = scriptsVhostName
+result_format = %S
+bind = no
+version = 3
+
Index: tags/fc15-eol/server/fedora/config/etc/postfix/virtual-alias-maps-ldap.cf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/postfix/virtual-alias-maps-ldap.cf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/postfix/virtual-alias-maps-ldap.cf	(revision 2244)
@@ -0,0 +1,22 @@
+# Find any vhost with a name or alias matching the domain of the e-mail
+# address.  We're queried with an entire e-mail address, but are only
+# interested in checking whether the domain portion corresponds to a
+# vhost; we'll simply deliver any mail for the vhost to its owner, regardless
+# of the lefthand side of the address.  %d extracts only the domain.
+# We don't match the scripts.mit.edu vhost here because we don't want
+# to first resolve an arbitrary address to a scripts account, and then
+# end up sending their mail to the owners of the scripts.mit.edu vhost.
+# Once we've found the scriptsVhost object corresponding to the domain
+# the e-mail is for, we recursively search the suffix for the vhost's
+# scriptsVhostAccount, and take the uid from that object.  This uid is
+# the name of the locker that owns the vhost.  Protocol version 3 is
+# necessary to use ldapi.
+
+server_host = ldapi://%2fvar%2frun%2fslapd-scripts.socket/
+search_base = ou=VirtualHosts,dc=scripts,dc=mit,dc=edu
+query_filter = (&(objectClass=scriptsVhost)(|(scriptsVhostName=%d)(scriptsVhostAlias=%d))(!(scriptsVhostName=scripts.mit.edu)))
+result_attribute = uid
+special_result_attribute = scriptsVhostAccount
+bind = no
+version = 3
+
Index: tags/fc15-eol/server/fedora/config/etc/postfix/virtual_re
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/postfix/virtual_re	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/postfix/virtual_re	(revision 2244)
@@ -0,0 +1,3 @@
+/^(.*)@scripts.mit.edu$/ $1@scripts.mit.edu
+/^(.*)@([^@]*)\.scripts\.mit\.edu$/ $2+$1
+/^([^@]*)\.scripts\.mit\.edu$/ true
Index: tags/fc15-eol/server/fedora/config/etc/printcap
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/printcap	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/printcap	(revision 2244)
@@ -0,0 +1,3 @@
+# This file was automatically generated by cupsd(8) from the
+# /etc/cups/printers.conf file.  All changes to this file
+# will be lost.
Index: tags/fc15-eol/server/fedora/config/etc/rc.d/rc.local
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/rc.d/rc.local	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/rc.d/rc.local	(revision 2244)
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+touch /var/lock/subsys/local
+
+/bin/mkdir -pm 1773 /tmp/sessions
Index: tags/fc15-eol/server/fedora/config/etc/resolv.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/resolv.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/resolv.conf	(revision 2244)
@@ -0,0 +1,2 @@
+search mit.edu
+nameserver 127.0.0.1
Index: tags/fc15-eol/server/fedora/config/etc/scripts/allowed-filecaps.list
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/scripts/allowed-filecaps.list	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/scripts/allowed-filecaps.list	(revision 2244)
@@ -0,0 +1,4 @@
+/bin/ping
+/bin/ping6
+/usr/sbin/fping
+/usr/sbin/fping6
Index: tags/fc15-eol/server/fedora/config/etc/scripts/allowed-setugid.list
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/scripts/allowed-setugid.list	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/scripts/allowed-setugid.list	(revision 2244)
@@ -0,0 +1,18 @@
+/sbin/pam_timestamp_check
+/sbin/unix_chkpwd
+/usr/bin/at
+/usr/bin/crontab
+/usr/bin/locate
+/usr/bin/screen
+/usr/bin/sudo
+/usr/bin/sudoedit
+/usr/libexec/openssh/ssh-keysign
+/usr/libexec/polkit-1/polkit-agent-helper-1
+/usr/libexec/pt_chown
+/usr/libexec/utempter/utempter
+/usr/local/bin/logview
+/usr/sbin/lockdev
+/usr/sbin/mtr
+/usr/sbin/postdrop
+/usr/sbin/postqueue
+/usr/sbin/userhelper
Index: tags/fc15-eol/server/fedora/config/etc/scripts/modprobe
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/scripts/modprobe	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/scripts/modprobe	(revision 2244)
@@ -0,0 +1,19 @@
+#!/bin/sh
+if [ $# -eq 3 ] && [ "$1" = "-q" ] && [ "$2" = "--" ] && [ "$3" = "binfmt-464c" ]; then
+    # 464c are the second two bytes of the ELF magic.  This module
+    # doesn't exist; being called for it indicates the in-kernel
+    # binfmt_elf decided to return ENOEXEC for this ELF file for some
+    # reason.
+    exit 1
+fi
+(
+    echo "Ignoring request from kernel: modprobe $*"
+    stacks=$(grep -ls request_module /proc/*/stack)
+    if [ "$stacks" ]; then
+	ps -Lfwp $(for stack in $stacks; do
+		proc="${stack%/stack}"
+		echo "${proc#/proc/}";
+	    done)
+    fi
+) | logger -p authpriv.info
+false
Index: tags/fc15-eol/server/fedora/config/etc/security/limits.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/security/limits.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/security/limits.conf	(revision 2244)
@@ -0,0 +1,60 @@
+# /etc/security/limits.conf
+#
+#Each line describes a limit for a user in the form:
+#
+#<domain>        <type>  <item>  <value>
+#
+#Where:
+#<domain> can be:
+#        - an user name
+#        - a group name, with @group syntax
+#        - the wildcard *, for default entry
+#        - the wildcard %, can be also used with %group syntax,
+#                 for maxlogin limit
+#
+#<type> can have the two values:
+#        - "soft" for enforcing the soft limits
+#        - "hard" for enforcing hard limits
+#
+#<item> can be one of the following:
+#        - core - limits the core file size (KB)
+#        - data - max data size (KB)
+#        - fsize - maximum filesize (KB)
+#        - memlock - max locked-in-memory address space (KB)
+#        - nofile - max number of open files
+#        - rss - max resident set size (KB)
+#        - stack - max stack size (KB)
+#        - cpu - max CPU time (MIN)
+#        - nproc - max number of processes
+#        - as - address space limit (KB)
+#        - maxlogins - max number of logins for this user
+#        - maxsyslogins - max number of logins on the system
+#        - priority - the priority to run user process with
+#        - locks - max number of file locks the user can hold
+#        - sigpending - max number of pending signals
+#        - msgqueue - max memory used by POSIX message queues (bytes)
+#        - nice - max nice priority allowed to raise to values: [-20, 19]
+#        - rtprio - max realtime priority
+#
+#<domain>      <type>  <item>         <value>
+#
+
+# No limits for root
+root             -
+scripts-build    -
+
+# For everyone else,
+*                soft    core            0
+*                -       rss             524268
+*                -       data            1048576
+*                -       as              1572864
+
+#*               soft    core            0
+#*               hard    rss             10000
+#@student        hard    nproc           20
+#@faculty        soft    nproc           20
+#@faculty        hard    nproc           50
+#ftp             hard    nproc           0
+#@student        -       maxlogins       4
+
+# End of file
Index: tags/fc15-eol/server/fedora/config/etc/selinux/strict/contexts/userhelper_context
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/selinux/strict/contexts/userhelper_context	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/selinux/strict/contexts/userhelper_context	(revision 2244)
@@ -0,0 +1,1 @@
+user_u:user_r:user_setuid_t:s0
Index: tags/fc15-eol/server/fedora/config/etc/selinux/strict/contexts/users/root
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/selinux/strict/contexts/users/root	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/selinux/strict/contexts/users/root	(revision 2244)
@@ -0,0 +1,9 @@
+system_r:local_login_t:s0  sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0
+system_r:crond_t:s0	sysadm_r:sysadm_crond_t:s0 staff_r:staff_crond_t:s0 user_r:user_crond_t:s0
+staff_r:staff_su_t:s0	sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0
+sysadm_r:sysadm_su_t:s0	sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0
+user_r:user_su_t:s0	sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0
+#
+# Uncomment if you want to automatically login as sysadm_r
+#
+#system_r:sshd_t:s0 sysadm_r:sysadm_t:s0 staff_r:staff_t:s0 user_r:user_t:s0
Index: tags/fc15-eol/server/fedora/config/etc/snmp/snmpd.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/snmp/snmpd.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/snmp/snmpd.conf	(revision 2244)
@@ -0,0 +1,1 @@
+rocommunity public
Index: tags/fc15-eol/server/fedora/config/etc/ssh/shosts.equiv
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/ssh/shosts.equiv	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/ssh/shosts.equiv	(revision 2244)
@@ -0,0 +1,20 @@
+better-mousetrap.mit.edu
+old-faithful.mit.edu
+bees-knees.mit.edu
+cats-whiskers.mit.edu
+pancake-bunny.mit.edu
+busy-beaver.mit.edu
+real-mccoy.mit.edu
+shining-armor.mit.edu
+whole-enchilada.mit.edu
+golden-egg.mit.edu
+172.21.0.53
+172.21.0.57
+172.21.0.167
+172.21.0.228
+172.21.0.237
+172.21.0.234
+172.21.0.235
+172.21.0.135
+172.21.0.236
+172.21.0.141
Index: tags/fc15-eol/server/fedora/config/etc/ssh/ssh_config
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/ssh/ssh_config	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/ssh/ssh_config	(revision 2244)
@@ -0,0 +1,56 @@
+#	$OpenBSD: ssh_config,v 1.23 2007/06/08 04:40:40 pvalchev Exp $
+
+# This is the ssh client system-wide configuration file.  See
+# ssh_config(5) for more information.  This file provides defaults for
+# users, and the values can be changed in per-user configuration files
+# or on the command line.
+
+# Configuration data is parsed as follows:
+#  1. command line options
+#  2. user-specific file
+#  3. system-wide file
+# Any configuration value is only changed the first time it is set.
+# Thus, host-specific definitions should be at the beginning of the
+# configuration file, and defaults at the end.
+
+# Site-wide defaults for some commonly used options.  For a comprehensive
+# list of available options, their meanings and defaults, please see the
+# ssh_config(5) man page.
+
+# Host *
+#   ForwardAgent no
+#   ForwardX11 no
+#   RhostsRSAAuthentication no
+#   RSAAuthentication yes
+   EnableSSHKeysign yes
+   PasswordAuthentication no
+   HostbasedAuthentication yes
+#   GSSAPIAuthentication no
+#   GSSAPIDelegateCredentials no
+#   BatchMode no
+#   CheckHostIP yes
+#   AddressFamily any
+#   ConnectTimeout 0
+#   StrictHostKeyChecking ask
+#   IdentityFile ~/.ssh/identity
+#   IdentityFile ~/.ssh/id_rsa
+#   IdentityFile ~/.ssh/id_dsa
+#   Port 22
+#   Protocol 2,1
+#   Cipher 3des
+#   Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
+#   MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160
+#   EscapeChar ~
+#   Tunnel no
+#   TunnelDevice any:any
+#   PermitLocalCommand no
+Host *
+	GSSAPIAuthentication yes
+# If this option is set to yes then remote X11 clients will have full access
+# to the original X11 display. As virtually no X11 client supports the untrusted
+# mode correctly we set this to yes.
+	ForwardX11Trusted yes
+# Send locale-related environment variables
+	SendEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES 
+	SendEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT 
+	SendEnv LC_IDENTIFICATION LC_ALL LANGUAGE
Index: tags/fc15-eol/server/fedora/config/etc/ssh/ssh_known_hosts
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/ssh/ssh_known_hosts	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/ssh/ssh_known_hosts	(revision 2244)
@@ -0,0 +1,10 @@
+real-mccoy.mit.edu,real-mccoy,r-m.mit.edu,r-m,scripts8.mit.edu,scripts8,18.181.0.235,172.21.0.235 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAuEpkEgaIgjK7F1gV81lLSYTwSqIZX/9IJs37VaJCsJFv3D86uuJSdfI3Y94fPn2OH6AxfdaqGNksVdi27mKQfzvCB4ogjQgxmM391MIDLd+izZDY0YvCb4DqJLMJUpX49cNUMkj+/rJg1O0K2w/lb8DGr7wdoLSPKCUJNJv5WMMDxpFL253lPELsmnds4T+R6LpTt6W9+FalHl84me51sEjV9PbmhcTaNwuoJStAjhrKPfgHHDIKNyCUvaVkoHPXEsdzz00yY7i57djyZlzPV/jM7LKar+Xw2LB0Z3098IQcdbD8zmz2DdakPTlShxavNPC6kZDZ3WVqziC+bszaSQ==
+busy-beaver.mit.edu,busy-beaver,b-b.mit.edu,b-b,scripts7.mit.edu,scripts7,18.181.0.234,172.21.0.234 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAuEpkEgaIgjK7F1gV81lLSYTwSqIZX/9IJs37VaJCsJFv3D86uuJSdfI3Y94fPn2OH6AxfdaqGNksVdi27mKQfzvCB4ogjQgxmM391MIDLd+izZDY0YvCb4DqJLMJUpX49cNUMkj+/rJg1O0K2w/lb8DGr7wdoLSPKCUJNJv5WMMDxpFL253lPELsmnds4T+R6LpTt6W9+FalHl84me51sEjV9PbmhcTaNwuoJStAjhrKPfgHHDIKNyCUvaVkoHPXEsdzz00yY7i57djyZlzPV/jM7LKar+Xw2LB0Z3098IQcdbD8zmz2DdakPTlShxavNPC6kZDZ3WVqziC+bszaSQ==
+pancake-bunny.mit.edu,pancake-bunny,p-b.mit.edu,p-b,scripts6.mit.edu,scripts6,18.181.0.237,172.21.0.237 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAuEpkEgaIgjK7F1gV81lLSYTwSqIZX/9IJs37VaJCsJFv3D86uuJSdfI3Y94fPn2OH6AxfdaqGNksVdi27mKQfzvCB4ogjQgxmM391MIDLd+izZDY0YvCb4DqJLMJUpX49cNUMkj+/rJg1O0K2w/lb8DGr7wdoLSPKCUJNJv5WMMDxpFL253lPELsmnds4T+R6LpTt6W9+FalHl84me51sEjV9PbmhcTaNwuoJStAjhrKPfgHHDIKNyCUvaVkoHPXEsdzz00yY7i57djyZlzPV/jM7LKar+Xw2LB0Z3098IQcdbD8zmz2DdakPTlShxavNPC6kZDZ3WVqziC+bszaSQ==
+cats-whiskers.mit.edu,cats-whiskers,c-w.mit.edu,c-w,scripts4.mit.edu,scripts4,18.181.0.228,172.21.0.228 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAuEpkEgaIgjK7F1gV81lLSYTwSqIZX/9IJs37VaJCsJFv3D86uuJSdfI3Y94fPn2OH6AxfdaqGNksVdi27mKQfzvCB4ogjQgxmM391MIDLd+izZDY0YvCb4DqJLMJUpX49cNUMkj+/rJg1O0K2w/lb8DGr7wdoLSPKCUJNJv5WMMDxpFL253lPELsmnds4T+R6LpTt6W9+FalHl84me51sEjV9PbmhcTaNwuoJStAjhrKPfgHHDIKNyCUvaVkoHPXEsdzz00yY7i57djyZlzPV/jM7LKar+Xw2LB0Z3098IQcdbD8zmz2DdakPTlShxavNPC6kZDZ3WVqziC+bszaSQ==
+bees-knees.mit.edu,bees-knees,b-k.mit.edu,b-k,scripts3.mit.edu,scripts3,18.181.0.167,172.21.0.167 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAuEpkEgaIgjK7F1gV81lLSYTwSqIZX/9IJs37VaJCsJFv3D86uuJSdfI3Y94fPn2OH6AxfdaqGNksVdi27mKQfzvCB4ogjQgxmM391MIDLd+izZDY0YvCb4DqJLMJUpX49cNUMkj+/rJg1O0K2w/lb8DGr7wdoLSPKCUJNJv5WMMDxpFL253lPELsmnds4T+R6LpTt6W9+FalHl84me51sEjV9PbmhcTaNwuoJStAjhrKPfgHHDIKNyCUvaVkoHPXEsdzz00yY7i57djyZlzPV/jM7LKar+Xw2LB0Z3098IQcdbD8zmz2DdakPTlShxavNPC6kZDZ3WVqziC+bszaSQ==
+better-mousetrap.mit.edu,better-mousetrap,b-m.mit.edu,b-m,scripts1.mit.edu,scripts1,18.181.0.57,172.21.0.57 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAuEpkEgaIgjK7F1gV81lLSYTwSqIZX/9IJs37VaJCsJFv3D86uuJSdfI3Y94fPn2OH6AxfdaqGNksVdi27mKQfzvCB4ogjQgxmM391MIDLd+izZDY0YvCb4DqJLMJUpX49cNUMkj+/rJg1O0K2w/lb8DGr7wdoLSPKCUJNJv5WMMDxpFL253lPELsmnds4T+R6LpTt6W9+FalHl84me51sEjV9PbmhcTaNwuoJStAjhrKPfgHHDIKNyCUvaVkoHPXEsdzz00yY7i57djyZlzPV/jM7LKar+Xw2LB0Z3098IQcdbD8zmz2DdakPTlShxavNPC6kZDZ3WVqziC+bszaSQ==
+old-faithful.mit.edu,old-faithful,o-f.mit.edu,o-f,scripts2.mit.edu,scripts2,18.181.0.53,172.21.0.53 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAuEpkEgaIgjK7F1gV81lLSYTwSqIZX/9IJs37VaJCsJFv3D86uuJSdfI3Y94fPn2OH6AxfdaqGNksVdi27mKQfzvCB4ogjQgxmM391MIDLd+izZDY0YvCb4DqJLMJUpX49cNUMkj+/rJg1O0K2w/lb8DGr7wdoLSPKCUJNJv5WMMDxpFL253lPELsmnds4T+R6LpTt6W9+FalHl84me51sEjV9PbmhcTaNwuoJStAjhrKPfgHHDIKNyCUvaVkoHPXEsdzz00yY7i57djyZlzPV/jM7LKar+Xw2LB0Z3098IQcdbD8zmz2DdakPTlShxavNPC6kZDZ3WVqziC+bszaSQ==
+whole-enchilada.mit.edu,whole-enchilada,w-e.mit.edu,w-e,scripts5.mit.edu,scripts5,18.181.0.236,172.21.0.236 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAuEpkEgaIgjK7F1gV81lLSYTwSqIZX/9IJs37VaJCsJFv3D86uuJSdfI3Y94fPn2OH6AxfdaqGNksVdi27mKQfzvCB4ogjQgxmM391MIDLd+izZDY0YvCb4DqJLMJUpX49cNUMkj+/rJg1O0K2w/lb8DGr7wdoLSPKCUJNJv5WMMDxpFL253lPELsmnds4T+R6LpTt6W9+FalHl84me51sEjV9PbmhcTaNwuoJStAjhrKPfgHHDIKNyCUvaVkoHPXEsdzz00yY7i57djyZlzPV/jM7LKar+Xw2LB0Z3098IQcdbD8zmz2DdakPTlShxavNPC6kZDZ3WVqziC+bszaSQ==
+shining-armor.mit.edu,shining-armor,s-a.mit.edu,s-a,scripts9.mit.edu,scripts9,18.181.0.135,172.21.0.135 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAuEpkEgaIgjK7F1gV81lLSYTwSqIZX/9IJs37VaJCsJFv3D86uuJSdfI3Y94fPn2OH6AxfdaqGNksVdi27mKQfzvCB4ogjQgxmM391MIDLd+izZDY0YvCb4DqJLMJUpX49cNUMkj+/rJg1O0K2w/lb8DGr7wdoLSPKCUJNJv5WMMDxpFL253lPELsmnds4T+R6LpTt6W9+FalHl84me51sEjV9PbmhcTaNwuoJStAjhrKPfgHHDIKNyCUvaVkoHPXEsdzz00yY7i57djyZlzPV/jM7LKar+Xw2LB0Z3098IQcdbD8zmz2DdakPTlShxavNPC6kZDZ3WVqziC+bszaSQ==
+golden-egg.mit.edu,golden-egg,g-e.mit.edu,g-e,scripts10.mit.edu,scripts10,18.181.0.141,172.21.0.141 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAuEpkEgaIgjK7F1gV81lLSYTwSqIZX/9IJs37VaJCsJFv3D86uuJSdfI3Y94fPn2OH6AxfdaqGNksVdi27mKQfzvCB4ogjQgxmM391MIDLd+izZDY0YvCb4DqJLMJUpX49cNUMkj+/rJg1O0K2w/lb8DGr7wdoLSPKCUJNJv5WMMDxpFL253lPELsmnds4T+R6LpTt6W9+FalHl84me51sEjV9PbmhcTaNwuoJStAjhrKPfgHHDIKNyCUvaVkoHPXEsdzz00yY7i57djyZlzPV/jM7LKar+Xw2LB0Z3098IQcdbD8zmz2DdakPTlShxavNPC6kZDZ3WVqziC+bszaSQ==
Index: tags/fc15-eol/server/fedora/config/etc/ssh/sshd_config
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/ssh/sshd_config	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/ssh/sshd_config	(revision 2244)
@@ -0,0 +1,22 @@
+Protocol 2
+SyslogFacility AUTHPRIV
+PasswordAuthentication no
+ChallengeResponseAuthentication yes
+GSSAPIAuthentication yes
+GSSAPICleanupCredentials yes
+GSSAPIStrictAcceptorCheck no
+UsePAM yes
+AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
+AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
+AcceptEnv LC_IDENTIFICATION LC_ALL
+AcceptEnv EDITOR VISUAL
+X11Forwarding no
+Banner /etc/issue.net
+Subsystem sftp /usr/libexec/openssh/sftp-server
+LogLevel VERBOSE
+
+# See trac #23
+HostbasedAuthentication yes
+IgnoreRhosts yes
+IgnoreUserKnownHosts yes
+DenyUsers root@old-faithful.mit.edu root@better-mousetrap.mit.edu root@bees-knees.mit.edu root@cats-whiskers.mit.edu root@pancake-bunny.mit.edu root@busy-beaver.mit.edu root@real-mccoy.mit.edu root@whole-enchilada.mit.edu root@shining-armor.mit.edu root@golden-egg.mit.edu
Index: tags/fc15-eol/server/fedora/config/etc/sudoers
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/sudoers	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/sudoers	(revision 2244)
@@ -0,0 +1,78 @@
+## Sudoers allows particular users to run various commands as
+## the root user, without needing the root password.
+##
+## Examples are provided at the bottom of the file for collections
+## of related commands, which can then be delegated out to particular
+## users or groups.
+## 
+## This file must be edited with the 'visudo' command.
+
+## Host Aliases
+## Groups of machines. You may prefer to use hostnames (perhaps using 
+## wildcards for entire domains) or IP addresses instead.
+# Host_Alias     FILESERVERS = fs1, fs2
+# Host_Alias     MAILSERVERS = smtp, smtp2
+
+## User Aliases
+## These aren't often necessary, as you can use regular groups
+## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname 
+## rather than USERALIAS
+# User_Alias ADMINS = jsmith, mikem
+
+
+## Command Aliases
+## These are groups of related commands...
+
+## Networking
+Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool
+
+## Installation and management of software
+Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum
+
+## Services
+Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig
+
+## Updating the locate database
+Cmnd_Alias LOCATE = /usr/bin/updatedb
+
+## Storage
+Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount
+
+## Delegating permissions
+Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp 
+
+## Processes
+Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall
+
+## Drivers
+Cmnd_Alias DRIVERS = /sbin/modprobe
+
+#Defaults    requiretty
+
+Defaults    env_reset
+Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
+Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
+Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
+Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
+Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"
+Defaults    env_keep += "USE_NEWLINES"
+
+## Next comes the main part: which users can run what software on 
+## which machines (the sudoers file can be shared between multiple
+## systems).
+## Syntax:
+##
+## 	user	MACHINE=COMMANDS
+##
+## The COMMANDS section may have other options added to it.
+##
+## Allow root to run any commands anywhere 
+root	ALL=(ALL) 	ALL
+
+scripts	ALL=(root)	NOPASSWD: /usr/local/sbin/ldap-backup ""
+nrpe	ALL=(signup)	NOPASSWD: /etc/nagios/check_ldap_mmr.real
+
+Defaults:munin !syslog
+
+munin ALL=(root) SETENV: NOPASSWD: /etc/munin/plugins/postfix_mailqueue , /etc/munin/plugins/postfix_mailvolume , /etc/munin/plugins/hddtemp_smartctl , /etc/munin/plugins/sendmail* , /etc/munin/plugins/if_* , /etc/munin/plugins/if_err_eth2
+munin ALL=(root) NOPASSWD: /etc/munin/plugins/smart_*, /etc/munin/plugins/sensors_*
Index: tags/fc15-eol/server/fedora/config/etc/sysconfig/crond
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/sysconfig/crond	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/sysconfig/crond	(revision 2244)
@@ -0,0 +1,12 @@
+# Settings for the CRON daemon.
+# CRONDARGS= :  any extra command-line startup arguments for crond
+# CRON_VALIDATE_MAILRCPTS=1:a non-empty value of this variable will
+#                           enable vixie-cron-4.1's validation of 
+#                           mail recipient names, which would then be
+#                           restricted to contain only the chars
+#                           from this tr(1) set : [@!:%-_.,:alnum:]
+#                           otherwise mailing is not attempted.
+CRONDARGS="-m '/usr/sbin/sendmail -FCronDaemon -i -odi -oem -oi -t'"
+
+# Force crond to always run with tokens
+su -c '/home/afsagent/renew' -l afsagent || :
Index: tags/fc15-eol/server/fedora/config/etc/sysconfig/dirsrv
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/sysconfig/dirsrv	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/sysconfig/dirsrv	(revision 2244)
@@ -0,0 +1,49 @@
+# This file is sourced by dirsrv upon startup to set
+# the default environment for all directory server instances.
+# To set instance specific defaults, use the file in the same
+# directory called dirsrv-instance where "instance"
+# is the name of your directory server instance e.g.
+# dirsrv-localhost for the slapd-localhost instance.
+
+# In order to make more file descriptors available
+# to the directory server, first make sure the system
+# hard limits are raised, then use ulimit - uncomment
+# out the following line and change the value to the
+# desired value
+# ulimit -n 8192
+
+# A per instance keytab does not make much sense for servers.
+# Kerberos clients use the machine FQDN to obtain a ticket like ldap/FQDN, there
+# is nothing that can make a client understand how to get a per-instance ticket.
+# Therefore by default a keytab should be considered a per server option.
+
+# Also this file is sourced for all instances, so again all
+# instances would ultimately get the same keytab.
+
+# Finally a keytab is normally named either krb5.keytab or <service>.keytab
+
+# In order to use SASL/GSSAPI (Kerberos) the directory
+# server needs to know where to find its keytab
+# file - uncomment the following line and set
+# the path and filename appropriately
+KRB5_KTNAME=/etc/dirsrv/keytab ; export KRB5_KTNAME
+
+# other environment settings can be added here too
+OS=`uname -s`
+# use the new mt slab memory allocator on Solaris
+# this requires Solaris 9 update 3 or later
+if [ "$OS" = "SunOS" -a -f /usr/lib/libumem.so ] ; then
+    LD_PRELOAD=/usr/lib/libumem.so
+    export LD_PRELOAD
+fi
+if [ "$OS" = "SunOS" -a -f /usr/lib/64/libumem.so ] ; then
+    LD_PRELOAD_64=/usr/lib/64/libumem.so
+    export LD_PRELOAD_64
+fi
+
+# how many seconds to wait for the startpid file to show
+# up before we assume there is a problem and fail to start
+#STARTPID_TIME=10 ; export STARTPID_TIME
+# how many seconds to wait for the pid file to show
+# up before we assume there is a problem and fail to start
+#PID_TIME=600 ; export PID_TIME
Index: tags/fc15-eol/server/fedora/config/etc/sysconfig/freshclam
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/sysconfig/freshclam	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/sysconfig/freshclam	(revision 2244)
@@ -0,0 +1,24 @@
+## When changing the periodicity of freshclam runs in the crontab,
+## this value must be adjusted also. Its value is the timespan between
+## two subsequent freshclam runs in minutes. E.g. for the default
+##
+## | 0 */3 * * *  ...
+##
+## crontab line, the value is 180 (minutes).
+# FRESHCLAM_MOD=
+
+## A predefined value for the delay in seconds. By default, the value is
+## calculated by the 'hostid' program. This predefined value guarantees
+## constant timespans of 3 hours between two subsequent freshclam runs.
+##
+## This option accepts two special values:
+## 'disabled-warn'  ...  disables the automatic freshclam update and
+##                         gives out a warning
+## 'disabled'       ...  disables the automatic freshclam silently
+# FRESHCLAM_DELAY=
+
+
+### !!!!! REMOVE ME !!!!!!
+### REMOVE ME: By default, the freshclam update is disabled to avoid
+### REMOVE ME: network access without prior activation
+#FRESHCLAM_DELAY=disabled-warn	# REMOVE ME
Index: tags/fc15-eol/server/fedora/config/etc/sysconfig/httpd
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/sysconfig/httpd	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/sysconfig/httpd	(revision 2244)
@@ -0,0 +1,30 @@
+# Configuration file for the httpd service.
+
+#
+# The default processing model (MPM) is the process-based
+# 'prefork' model.  A thread-based model, 'worker', is also
+# available, but does not work with some modules (such as PHP).
+# The service must be stopped before changing this variable.
+#
+HTTPD=/usr/sbin/httpd.worker
+
+#
+# To pass additional options (for instance, -D definitions) to the
+# httpd binary at startup, set OPTIONS here.
+#
+#OPTIONS=
+
+#
+# By default, the httpd process is started in the C locale; to 
+# change the locale in which the server runs, the HTTPD_LANG
+# variable can be set.
+#
+#HTTPD_LANG=C
+
+#
+# When stopping the server a 10 second timeout is allowed before
+# forcibly terminating the parent process (with a SIGKILL signal).
+# To allow a longer delay, set the STOP_TIMEOUT variable.
+#
+#STOP_TIMEOUT=10
+#
Index: tags/fc15-eol/server/fedora/config/etc/sysconfig/iptables
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/sysconfig/iptables	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/sysconfig/iptables	(revision 2244)
@@ -0,0 +1,8 @@
+# Generated by iptables-save v1.3.5 on Tue Jul 18 01:46:04 2006
+*filter
+:INPUT ACCEPT [0:0]
+-A INPUT -p udp -m udp --dport 161 ! -s 18.0.0.0/8 -j REJECT
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+COMMIT
+# Completed on Tue Jul 18 01:46:04 2006
Index: tags/fc15-eol/server/fedora/config/etc/sysconfig/iptables-config
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/sysconfig/iptables-config	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/sysconfig/iptables-config	(revision 2244)
@@ -0,0 +1,48 @@
+# Load additional iptables modules (nat helpers)
+#   Default: -none-
+# Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which
+# are loaded after the firewall rules are applied. Options for the helpers are
+# stored in /etc/modprobe.conf.
+IPTABLES_MODULES=""
+
+# Unload modules on restart and stop
+#   Value: yes|no,  default: yes
+# This option has to be 'yes' to get to a sane state for a firewall
+# restart or stop. Only set to 'no' if there are problems unloading netfilter
+# modules.
+IPTABLES_MODULES_UNLOAD="yes"
+
+# Save current firewall rules on stop.
+#   Value: yes|no,  default: no
+# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets stopped
+# (e.g. on system shutdown).
+IPTABLES_SAVE_ON_STOP="no"
+
+# Save current firewall rules on restart.
+#   Value: yes|no,  default: no
+# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets
+# restarted.
+IPTABLES_SAVE_ON_RESTART="no"
+
+# Save (and restore) rule and chain counter.
+#   Value: yes|no,  default: no
+# Save counters for rules and chains to /etc/sysconfig/iptables if
+# 'service iptables save' is called or on stop or restart if SAVE_ON_STOP or
+# SAVE_ON_RESTART is enabled.
+IPTABLES_SAVE_COUNTER="no"
+
+# Numeric status output
+#   Value: yes|no,  default: yes
+# Print IP addresses and port numbers in numeric format in the status output.
+IPTABLES_STATUS_NUMERIC="yes"
+
+# Verbose status output
+#   Value: yes|no,  default: yes
+# Print info about the number of packets and bytes plus the "input-" and
+# "outputdevice" in the status output.
+IPTABLES_STATUS_VERBOSE="no"
+
+# Status output with numbered lines
+#   Value: yes|no,  default: yes
+# Print a counter/number for every rule in the status output.
+IPTABLES_STATUS_LINENUMBERS="yes"
Index: tags/fc15-eol/server/fedora/config/etc/sysconfig/network-scripts/ifcfg-lo:0
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/sysconfig/network-scripts/ifcfg-lo:0	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/sysconfig/network-scripts/ifcfg-lo:0	(revision 2244)
@@ -0,0 +1,5 @@
+DEVICE=lo:0
+IPADDR=18.181.0.46
+NETMASK=255.255.255.255
+NETWORK=18.181.0.0
+ONBOOT=yes
Index: tags/fc15-eol/server/fedora/config/etc/sysconfig/network-scripts/ifcfg-lo:1
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/sysconfig/network-scripts/ifcfg-lo:1	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/sysconfig/network-scripts/ifcfg-lo:1	(revision 2244)
@@ -0,0 +1,5 @@
+DEVICE=lo:1
+IPADDR=18.181.0.50
+NETMASK=255.255.255.255
+NETWORK=18.181.0.0
+ONBOOT=yes
Index: tags/fc15-eol/server/fedora/config/etc/sysconfig/network-scripts/ifcfg-lo:2
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/sysconfig/network-scripts/ifcfg-lo:2	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/sysconfig/network-scripts/ifcfg-lo:2	(revision 2244)
@@ -0,0 +1,5 @@
+DEVICE=lo:2
+IPADDR=18.181.0.49
+NETMASK=255.255.255.255
+NETWORK=18.181.0.0
+ONBOOT=yes
Index: tags/fc15-eol/server/fedora/config/etc/sysconfig/network-scripts/ifcfg-lo:3
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/sysconfig/network-scripts/ifcfg-lo:3	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/sysconfig/network-scripts/ifcfg-lo:3	(revision 2244)
@@ -0,0 +1,5 @@
+DEVICE=lo:3
+IPADDR=18.181.0.43
+NETMASK=255.255.255.255
+NETWORK=18.181.0.0
+ONBOOT=yes
Index: tags/fc15-eol/server/fedora/config/etc/sysconfig/network-scripts/route-eth1
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/sysconfig/network-scripts/route-eth1	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/sysconfig/network-scripts/route-eth1	(revision 2244)
@@ -0,0 +1,15 @@
+18.181.0.47 via 172.21.0.47
+18.181.0.55 via 172.21.0.55
+18.181.0.56 via 172.21.0.56
+18.181.0.52 via 172.21.0.52
+18.181.0.57 via 172.21.0.57
+18.181.0.53 via 172.21.0.53
+18.181.0.167 via 172.21.0.167
+18.181.0.228 via 172.21.0.228
+18.181.0.236 via 172.21.0.236
+18.181.0.237 via 172.21.0.237
+18.181.0.234 via 172.21.0.234
+18.181.0.235 via 172.21.0.235
+18.181.0.135 via 172.21.0.135
+18.181.0.141 via 172.21.0.141
+18.181.0.199 via 172.21.0.199
Index: tags/fc15-eol/server/fedora/config/etc/sysconfig/networking/profiles/default/resolv.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/sysconfig/networking/profiles/default/resolv.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/sysconfig/networking/profiles/default/resolv.conf	(revision 2244)
@@ -0,0 +1,2 @@
+search mit.edu
+nameserver 127.0.0.1
Index: tags/fc15-eol/server/fedora/config/etc/sysconfig/openafs
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/sysconfig/openafs	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/sysconfig/openafs	(revision 2244)
@@ -0,0 +1,2 @@
+AFSD_ARGS="-afsdb -dynroot -fakestat-all -stat 25000 -daemons 100 -volumes 4000 -files 400000 -chunksize 19"
+BOSSERVER_ARGS=
Index: tags/fc15-eol/server/fedora/config/etc/sysconfig/sysstat
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/sysconfig/sysstat	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/sysconfig/sysstat	(revision 2244)
@@ -0,0 +1,13 @@
+# sysstat-9.0.6.1 configuration file.
+
+# How long to keep log files (in days).
+# If value is greater than 28, then log files are kept in
+# multiple directories, one for each month.
+HISTORY=30
+
+# Compress (using gzip or bzip2) sa and sar files older than (in days):
+COMPRESSAFTER=10
+
+# Parameters for system activity collector (see sadc man-page) which
+# are used for the generation of log files
+SADC_OPTIONS="-S DISK"
Index: tags/fc15-eol/server/fedora/config/etc/sysctl.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/sysctl.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/sysctl.conf	(revision 2244)
@@ -0,0 +1,15 @@
+net.ipv4.ip_forward = 1
+net.ipv4.conf.all.rp_filter = 2
+net.ipv4.conf.default.accept_source_route = 0
+kernel.panic = 5
+kernel.sysrq = 1
+kernel.core_uses_pid = 1
+vm.panic_on_oom = 1
+net.ipv4.tcp_syncookies = 1
+net.ipv4.conf.default.arp_ignore = 1
+net.ipv4.conf.default.arp_announce = 2
+net.ipv4.conf.all.arp_ignore = 1
+net.ipv4.conf.all.arp_announce = 2
+net.ipv4.tcp_keepalive_time = 825
+afs.GCPAGs = 0
+kernel.modprobe = /etc/scripts/modprobe
Index: tags/fc15-eol/server/fedora/config/etc/syslog-ng/d_zroot.pl
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/syslog-ng/d_zroot.pl	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/syslog-ng/d_zroot.pl	(revision 2244)
@@ -0,0 +1,150 @@
+#!/usr/bin/perl
+
+use strict;
+use warnings;
+use Sys::Hostname;
+use Time::HiRes qw(ualarm);
+use File::Temp;
+
+our $ZCLASS = "scripts-auto";
+our @USERS = qw/root logview/;
+my $k5login;
+open $k5login, '/root/.k5login';
+our @RECIPIENTS = map {chomp; m|([^/@]*)| && $1} <$k5login>;
+close $k5login;
+
+our %USERS;
+@USERS{@USERS} = undef;
+
+sub zwrite($;$$\@) {
+    my ($message, $class, $instance, $recipref) = @_;
+    my @recipients = ();
+    if (defined($recipref)) {
+        if (@$recipref) {
+            @recipients = @$recipref;
+        } else {
+            $message = '@b(Empty recipient list specified, message redacted)';
+            $class = $ZCLASS;
+        }
+    }
+    $class ||= $ZCLASS;
+    $instance ||= 'root.'.hostname;
+    open(ZWRITE, "|-", qw|/usr/bin/zwrite -d -n -O log -c|, $class, '-i', $instance, '-s', hostname, @recipients) or die "Couldn't open zwrite";
+    print ZWRITE $message;
+    close(ZWRITE);
+}
+
+unless (@RECIPIENTS) {
+    # Also give a warning at startup
+    zwrite('@b(No .k5login found, sensitive logs will not be zephyred)', $ZCLASS);
+}
+
+my %toclass;
+
+my %sshkeys;
+
+sub buildKeyMap($) {
+    my ($file) = @_;
+    open (KEYS, $file) or (warn "Couldn't open $file: $!\n" and return);
+    while (<KEYS>) {
+	chomp;
+	my ($fingerprint, $comment) = parseKey($_);
+	$sshkeys{$fingerprint} = $comment;
+    }
+    close(KEYS);
+}
+
+sub parseKey($) {
+    my ($key) = @_;
+    my $tmp = new File::Temp;
+    print $tmp $key;
+    close $tmp;
+    open (KEYGEN, "-|", qw(/usr/bin/ssh-keygen -l -f), $tmp) or die "Couldn't call ssh-keygen: $!";
+    my ($line) = <KEYGEN>;
+    close(KEYGEN);
+    my (undef, $fingerprint, undef) = split(' ', $line, 3);
+    my (undef, undef, $comment) = split(' ', $key, 3);
+    #print "$fingerprint $comment";
+    return ($fingerprint, $comment);
+}
+
+buildKeyMap("/root/.ssh/authorized_keys");
+buildKeyMap("/root/.ssh/authorized_keys2");
+
+my @message;
+
+while (my $line = <>) {
+    @message = $line;
+    eval {
+        local $SIG{ALRM} = sub { die "alarm\n" }; # NB: \n required
+        ualarm(500*1000);
+        while (<>) { push @message, $_; }
+    };
+    chomp @message;
+    map { s/^(.*?): // } @message;
+    %toclass = ();
+    foreach my $message (@message) {
+	sub sendmsg ($;$) {
+	    my ($message, $class) = @_;
+	    $class ||= $ZCLASS;
+	    $toclass{$class} .= $message."\n";
+	}
+	if ($message =~ m|Accepted (\S+) for (\S+)|) {
+	    sendmsg($message) if exists $USERS{$2}
+	} elsif ($message =~ m|Authorized to (\S+),|) {
+	    sendmsg($message) if exists $USERS{$1};
+	} elsif ($message =~ m|Root (\S+) shell|) {
+	    sendmsg($message);
+	} elsif ($message =~ m|pam_unix\(([^:]+):session\): session \S+ for user (\S+)|) {
+	    sendmsg($message) if $1 ne "cron" and exists $USERS{$2};
+	} elsif ($message =~ m|^Found matching (\w+) key: (\S+)|) {
+	    if ($sshkeys{$2}) {
+		sendmsg($message." (".$sshkeys{$2}.")");
+	    } else {
+		sendmsg($message." (UNKNOWN KEY)");
+	    }
+	} elsif ($message =~ m|^Out of memory:|) {
+	    sendmsg($message);
+	} elsif ($message =~ m|^giving \S+ admin rights|) {
+	    sendmsg($message);
+	} elsif ($message =~ m|^Connection closed|) {
+	    # Do nothing
+	} elsif ($message =~ m|^Closing connection to |) {
+	} elsif ($message =~ m|^Connection from (\S+) port (\S+)|) {
+	} elsif ($message =~ m|^Invalid user|) {
+	} elsif ($message =~ m|^input_userauth_request: invalid user|) {
+	} elsif ($message =~ m|^Received disconnect from|) {
+	} elsif ($message =~ m|^Postponed keyboard-interactive|) {
+	} elsif ($message =~ m|^Failed keyboard-interactive/pam|) {
+	} elsif ($message =~ m|^fatal: Read from socket failed: Connection reset by peer$|) {
+	} elsif ($message =~ m|^reverse mapping checking getaddrinfo|) {
+	} elsif ($message =~ m|^pam_succeed_if\(sshd\:auth\)\:|) {
+	} elsif ($message =~ m|^error: PAM: Authentication failure|) {
+	} elsif ($message =~ m|^pam_unix\(sshd:auth\): authentication failure|) {
+	} elsif ($message =~ m|^pam_unix\(sshd:auth\): check pass; user unknown|) {
+	} elsif ($message =~ m|^Postponed keyboard-interactive for invalid user |) {
+	} elsif ($message =~ m|^Failed keyboard-interactive/pam for invalid user |) {
+	} elsif ($message =~ m|^Postponed gssapi-with-mic for |) {
+	} elsif ($message =~ m|^Address \S+ maps to \S+, but this does not map back to the address|) {
+	} elsif ($message =~ m|^Nasty PTR record .* is set up for .*, ignoring|) {
+	} elsif ($message =~ m|^User child is on pid \d+$|) {
+	} elsif ($message =~ m|^Transferred: sent \d+, received \d+ bytes$|) {
+	} elsif ($message =~ m|^Setting tty modes failed: Invalid argument$|) {
+	} elsif ($message =~ m|^ *nrpe .* COMMAND=/etc/nagios/check_ldap_mmr.real$|) {
+	} elsif ($message =~ m|^ *root : TTY=|) {
+	} elsif ($message =~ m|^Set /proc/self/oom_adj to |) {
+	} elsif ($message =~ m|^Set /proc/self/oom_score_adj to |) {
+	} elsif ($message =~ m|^fatal: mm_request_receive: read: Connection reset by peer$|) {
+	} else {
+	    sendmsg($message, "scripts-spew");
+	}
+    }
+
+    foreach my $class (keys %toclass) {
+	if ($class eq $ZCLASS) {
+	    zwrite($toclass{$class}, $class);
+	} else {
+	    zwrite($toclass{$class}, $class, undef, @RECIPIENTS);
+	}
+    }
+}
Index: tags/fc15-eol/server/fedora/config/etc/syslog-ng/syslog-ng.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/syslog-ng/syslog-ng.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/syslog-ng/syslog-ng.conf	(revision 2244)
@@ -0,0 +1,73 @@
+@version:3.2
+
+# syslog-ng configuration file.
+#
+# This should behave pretty much like the original syslog on RedHat. But
+# it could be configured a lot smarter.
+#
+# See syslog-ng(8) and syslog-ng.conf(5) for more information.
+#
+
+options {
+	flush_lines (0);
+	time_reopen (10);
+	log_fifo_size (1000);
+	long_hostnames (off);
+	use_dns (no);
+	use_fqdn (no);
+	create_dirs (no);
+	keep_hostname (yes);
+	stats_freq (0);
+};
+
+source s_sys {
+	file ("/proc/kmsg" program_override("kernel: "));
+	unix-dgram ("/dev/log");
+	internal();
+	# udp(ip(0.0.0.0) port(514));
+};
+
+destination d_cons { file("/dev/console"); };
+destination d_mesg { file("/var/log/messages"); };
+destination d_auth { file("/var/log/secure"); };
+destination d_mail { file("/var/log/maillog" flush_lines(10)); };
+destination d_spol { file("/var/log/spooler"); };
+destination d_boot { file("/var/log/boot.log"); };
+destination d_cron { file("/var/log/cron"); };
+#destination d_kern { file("/var/log/kern"); };
+destination d_mlal { usertty("*"); };
+
+destination d_zroot { program("/etc/syslog-ng/d_zroot.pl"); };
+#destination d_watch { program("/usr/local/libexec/watch-syslog.py"); };
+
+#filter f_kernel     { facility(kern); };
+filter f_default    { level(info..emerg) and
+                        not (facility(mail)
+                        or facility(authpriv) 
+                        or facility(cron)); };
+filter f_auth       { facility(authpriv); };
+filter f_mail       { facility(mail); };
+filter f_emergency  { level(emerg); };
+filter f_news       { facility(uucp) or
+                        (facility(news) 
+                        and level(crit..emerg)); };
+filter f_boot   { facility(local7); };
+filter f_cron   { facility(cron); };
+
+filter f_oom { facility(kern) and (match("Out of memory:") or match("Killed process")); };
+
+#log { source(s_sys); filter(f_kernel); destination(d_cons); };
+#log { source(s_sys); filter(f_kernel); destination(d_kern); };
+log { source(s_sys); filter(f_default); destination(d_mesg); };
+log { source(s_sys); filter(f_auth); destination(d_auth); };
+log { source(s_sys); filter(f_mail); destination(d_mail); };
+log { source(s_sys); filter(f_emergency); destination(d_mlal); };
+log { source(s_sys); filter(f_news); destination(d_spol); };
+log { source(s_sys); filter(f_boot); destination(d_boot); };
+log { source(s_sys); filter(f_cron); destination(d_cron); };
+
+log { source(s_sys); filter(f_auth); destination(d_zroot); };
+#log { source(s_sys); filter(f_default); destination(d_watch); };
+log { source(s_sys); filter(f_oom); destination(d_zroot); };
+
+# vim:ft=syslog-ng:ai:si:ts=4:sw=4:et:
Index: tags/fc15-eol/server/fedora/config/etc/syslog.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/syslog.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/syslog.conf	(revision 2244)
@@ -0,0 +1,28 @@
+# Log all kernel messages to the console.
+# Logging much else clutters up the screen.
+#kern.*							/dev/console
+
+# Log anything (except mail) of level info or higher.
+# Don't log private authentication messages!
+*.info;mail.none;authpriv.none;cron.none;local0.none	/var/log/messages
+
+# The authpriv file has restricted access.
+authpriv.*						/var/log/secure
+
+# Log all the mail messages in one place.
+mail.*							-/var/log/maillog
+
+
+# Log cron stuff
+cron.*							/var/log/cron
+
+# Everybody gets emergency messages
+*.emerg							*
+
+# Save news errors of level crit and higher in a special file.
+uucp,news.crit						/var/log/spooler
+
+# Save boot messages also to boot.log
+local7.*						/var/log/boot.log
+
+local0.info	/var/log/heartbeat.log
Index: tags/fc15-eol/server/fedora/config/etc/systemd/system.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/systemd/system.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/systemd/system.conf	(revision 2244)
@@ -0,0 +1,25 @@
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU General Public License as published by
+#  the Free Software Foundation; either version 2 of the License, or
+#  (at your option) any later version.
+#
+# See systemd.conf(5) for details
+
+[Manager]
+#LogLevel=info
+#LogTarget=syslog-or-kmsg
+#LogColor=yes
+#LogLocation=no
+#DumpCore=yes
+#CrashShell=no
+#ShowStatus=yes
+#SysVConsole=yes
+#CrashChVT=1
+#CPUAffinity=1 2
+#MountAuto=yes
+#SwapAuto=yes
+#DefaultControllers=cpu
+#DefaultStandardOutput=inherit
+#DefaultStandardError=inherit
Index: tags/fc15-eol/server/fedora/config/etc/systemd/system/afs-000.mount
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/systemd/system/afs-000.mount	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/systemd/system/afs-000.mount	(revision 2244)
@@ -0,0 +1,10 @@
+[Unit]
+Description=FUSE better mousetrap filesystem
+After=openafs-client.service
+[Mount]
+What=/usr/sbin/better-mousetrapfs
+Where=/afs/000
+Type=fuse
+Options=defaults,nonempty
+[Install]
+WantedBy=multi-user.target
Index: tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/afs-000.mount
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/afs-000.mount	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/afs-000.mount	(revision 2244)
@@ -0,0 +1,1 @@
+link /etc/systemd/system/afs-000.mount
Index: tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/crond.service
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/crond.service	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/crond.service	(revision 2244)
@@ -0,0 +1,1 @@
+link /lib/systemd/system/crond.service
Index: tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/ntpd.service
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/ntpd.service	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/ntpd.service	(revision 2244)
@@ -0,0 +1,1 @@
+link /lib/systemd/system/ntpd.service
Index: tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/openafs-client.service
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/openafs-client.service	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/openafs-client.service	(revision 2244)
@@ -0,0 +1,1 @@
+link /lib/systemd/system/openafs-client.service
Index: tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/remote-fs.target
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/remote-fs.target	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/remote-fs.target	(revision 2244)
@@ -0,0 +1,1 @@
+link /lib/systemd/system/remote-fs.target
Index: tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/scripts-afsagent-startup.service
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/scripts-afsagent-startup.service	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/scripts-afsagent-startup.service	(revision 2244)
@@ -0,0 +1,1 @@
+link /lib/systemd/system/scripts-afsagent-startup.service
Index: tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/scripts-afsagent.service
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/scripts-afsagent.service	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/scripts-afsagent.service	(revision 2244)
@@ -0,0 +1,1 @@
+link /lib/systemd/system/scripts-afsagent.service
Index: tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/scripts-afsagent.timer
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/scripts-afsagent.timer	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/scripts-afsagent.timer	(revision 2244)
@@ -0,0 +1,1 @@
+link /lib/systemd/system/scripts-afsagent.timer
Index: tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/scripts-whoisd.service
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/scripts-whoisd.service	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/scripts-whoisd.service	(revision 2244)
@@ -0,0 +1,1 @@
+link /lib/systemd/system/scripts-whoisd.service
Index: tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/syslog-ng.service
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/syslog-ng.service	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/syslog-ng.service	(revision 2244)
@@ -0,0 +1,1 @@
+link /lib/systemd/system/syslog-ng.service
Index: tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/yum-updatesd.service
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/yum-updatesd.service	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/systemd/system/multi-user.target.wants/yum-updatesd.service	(revision 2244)
@@ -0,0 +1,1 @@
+link /lib/systemd/system/yum-updatesd.service
Index: tags/fc15-eol/server/fedora/config/etc/vimrc
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/vimrc	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/vimrc	(revision 2244)
@@ -0,0 +1,60 @@
+if v:lang =~ "utf8$" || v:lang =~ "UTF-8$"
+   set fileencodings=ucs-bom,utf-8,latin1
+endif
+
+set nocompatible	" Use Vim defaults (much better!)
+set bs=indent,eol,start		" allow backspacing over everything in insert mode
+"set ai			" always set autoindenting on
+"set backup		" keep a backup file
+set viminfo=		" don't keep a viminfo file
+set history=50		" keep 50 lines of command line history
+set ruler		" show the cursor position all the time
+
+" Only do this part when compiled with support for autocommands
+if has("autocmd")
+  " In text files, always limit the width of text to 78 characters
+  autocmd BufRead *.txt set tw=78
+  " When editing a file, always jump to the last cursor position
+  autocmd BufReadPost *
+  \ if line("'\"") > 0 && line ("'\"") <= line("$") |
+  \   exe "normal! g'\"" |
+  \ endif
+  " don't write swapfile on most commonly used directories for NFS mounts or USB sticks
+  autocmd BufNewFile,BufReadPre /media/*,/mnt/* set directory=~/tmp,/var/tmp,/tmp
+  " start with spec file template
+  autocmd BufNewFile *.spec 0r /usr/share/vim/vimfiles/template.spec
+endif
+
+if has("cscope") && filereadable("/usr/bin/cscope")
+   set csprg=/usr/bin/cscope
+   set csto=0
+   set cst
+   set nocsverb
+   " add any database in current directory
+   if filereadable("cscope.out")
+      cs add cscope.out
+   " else add database pointed to by environment
+   elseif $CSCOPE_DB != ""
+      cs add $CSCOPE_DB
+   endif
+   set csverb
+endif
+
+" Switch syntax highlighting on, when the terminal has colors
+" Also switch on highlighting the last used search pattern.
+if &t_Co > 2 || has("gui_running")
+  syntax on
+  set hlsearch
+endif
+
+filetype plugin on
+
+if &term=="xterm"
+     set t_Co=8
+     set t_Sb=[4%dm
+     set t_Sf=[3%dm
+endif
+
+" Don't wake up system with blinking cursor:
+" http://www.linuxpowertop.org/known.php
+let &guicursor = &guicursor . ",a:blinkon0"
Index: tags/fc15-eol/server/fedora/config/etc/yum.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/yum.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/yum.conf	(revision 2244)
@@ -0,0 +1,16 @@
+[main]
+cachedir=/var/cache/yum
+keepcache=0
+debuglevel=2
+logfile=/var/log/yum.log
+exactarch=1
+obsoletes=1
+gpgcheck=1
+plugins=1
+metadata_expire=1800
+installonlypkgs=kernel kernel-devel kmod-openafs ghc-cgi ghc-cgi-devel
+# Don't ever remove installonly packages:
+installonly_limit=0
+
+# PUT YOUR REPOS HERE OR IN separate files named file.repo
+# in /etc/yum.repos.d
Index: tags/fc15-eol/server/fedora/config/etc/yum.repos.d/fedora-updates-testing.repo
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/yum.repos.d/fedora-updates-testing.repo	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/yum.repos.d/fedora-updates-testing.repo	(revision 2244)
@@ -0,0 +1,29 @@
+[updates-testing]
+name=Fedora $releasever - $basearch - Test Updates
+failovermethod=priority
+#baseurl=http://download.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/$basearch/
+baseurl=http://dl.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/$basearch/
+#mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f$releasever&arch=$basearch
+enabled=0
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$basearch
+
+[updates-testing-debuginfo]
+name=Fedora $releasever - $basearch - Test Updates Debug
+failovermethod=priority
+#baseurl=http://download.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/$basearch/debug/
+baseurl=http://dl.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/$basearch/debug/
+#mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-debug-f$releasever&arch=$basearch
+enabled=0
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$basearch
+
+[updates-testing-source]
+name=Fedora $releasever - Test Updates Source
+failovermethod=priority
+#baseurl=http://download.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/SRPMS/
+baseurl=http://dl.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/SRPMS/
+#mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-source-f$releasever&arch=$basearch
+enabled=0
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$basearch
Index: tags/fc15-eol/server/fedora/config/etc/yum.repos.d/fedora-updates.repo
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/yum.repos.d/fedora-updates.repo	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/yum.repos.d/fedora-updates.repo	(revision 2244)
@@ -0,0 +1,29 @@
+[updates]
+name=Fedora $releasever - $basearch - Updates
+failovermethod=priority
+#baseurl=http://download.fedoraproject.org/pub/fedora/linux/updates/$releasever/$basearch/
+baseurl=http://dl.fedoraproject.org/pub/fedora/linux/updates/$releasever/$basearch/
+#mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f$releasever&arch=$basearch
+enabled=1
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$basearch
+
+[updates-debuginfo]
+name=Fedora $releasever - $basearch - Updates - Debug
+failovermethod=priority
+#baseurl=http://download.fedoraproject.org/pub/fedora/linux/updates/$releasever/$basearch/debug/
+baseurl=http://dl.fedoraproject.org/pub/fedora/linux/updates/$releasever/$basearch/debug/
+#mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=updates-released-debug-f$releasever&arch=$basearch
+enabled=0
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$basearch
+
+[updates-source]
+name=Fedora $releasever - Updates Source
+failovermethod=priority
+#baseurl=http://download.fedoraproject.org/pub/fedora/linux/updates/$releasever/SRPMS/
+baseurl=http://dl.fedoraproject.org/pub/fedora/linux/updates/$releasever/SRPMS/
+#mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=updates-released-source-f$releasever&arch=$basearch
+enabled=0
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$basearch
Index: tags/fc15-eol/server/fedora/config/etc/yum.repos.d/scripts.repo
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/yum.repos.d/scripts.repo	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/yum.repos.d/scripts.repo	(revision 2244)
@@ -0,0 +1,11 @@
+[scripts]
+name=Scripts
+baseurl=http://web.mit.edu/scripts/yum-repos/rpm-fc15/
+enabled=1
+gpgcheck=0
+
+[scripts-testing]
+name=Scripts Testing
+baseurl=http://web.mit.edu/scripts/yum-repos/rpm-fc15-testing/
+enabled=0
+gpgcheck=0
Index: tags/fc15-eol/server/fedora/config/etc/yum/post-actions/capoverride.action
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/yum/post-actions/capoverride.action	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/yum/post-actions/capoverride.action	(revision 2244)
@@ -0,0 +1,7 @@
+/usr/sbin/mtr:install:setcap -r /usr/sbin/mtr
+/usr/bin/rsh:install:setcap -r /usr/bin/rsh
+/usr/bin/rcp:install:setcap -r /usr/bin/rcp
+/usr/bin/gnome-keyring-daemon:install:setcap -r /usr/bin/gnome-keyring-daemon
+/usr/bin/newrole:install:setcap -r /usr/bin/newrole
+/usr/bin/rlogin:install:setcap -r /usr/bin/rlogin
+/usr/libexec/pt_chown:install:setcap -r /usr/libexec/pt_chown
Index: tags/fc15-eol/server/fedora/config/etc/yum/post-actions/statoverride.action
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/yum/post-actions/statoverride.action	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/yum/post-actions/statoverride.action	(revision 2244)
@@ -0,0 +1,31 @@
+/bin/cgexec:install:chmod ug-s /bin/cgexec
+/bin/fusermount:install:chmod ug-s /bin/fusermount
+/bin/mount:install:chmod ug-s /bin/mount
+/bin/su:install:chmod ug-s /bin/su
+/bin/umount:install:chmod ug-s /bin/umount
+/sbin/mount.nfs:install:chmod ug-s /sbin/mount.nfs
+/sbin/netreport:install:chmod ug-s /sbin/netreport
+/usr/bin/chage:install:chmod ug-s /usr/bin/chage
+/usr/bin/chfn:install:chmod ug-s /usr/bin/chfn
+/usr/bin/chsh:install:chmod ug-s /usr/bin/chsh
+/usr/bin/gpasswd:install:chmod ug-s /usr/bin/gpasswd
+/usr/bin/lockfile:install:chmod ug-s /usr/bin/lockfile
+/usr/bin/newgrp:install:chmod ug-s /usr/bin/newgrp
+/usr/bin/newrole:install:chmod ug-s /usr/bin/newrole
+/usr/bin/passwd:install:chmod ug-s /usr/bin/passwd
+/usr/bin/rcp:install:chmod ug-s /usr/bin/rcp
+/usr/bin/rlogin:install:chmod ug-s /usr/bin/rlogin
+/usr/bin/rsh:install:chmod ug-s /usr/bin/rsh
+/usr/bin/sperl5.10.1:install:chmod ug-s /usr/bin/sperl5.10.1
+/usr/bin/ssh-agent:install:chmod ug-s /usr/bin/ssh-agent
+/usr/bin/wall:install:chmod ug-s /usr/bin/wall
+/usr/bin/write:install:chmod ug-s /usr/bin/write
+/usr/bin/Xorg:install:chmod ug-s /usr/bin/Xorg
+/usr/bin/ksu:install:chmod ug-s /usr/bin/ksu
+/usr/lib64/nspluginwrapper/plugin-config:install:chmod ug-s /usr/lib64/nspluginwrapper/plugin-config
+/usr/lib64/vte/gnome-pty-helper:install:chmod ug-s /usr/lib64/vte/gnome-pty-helper
+/usr/libexec/kde4/kpac_dhcp_helper:install:chmod ug-s /usr/libexec/kde4/kpac_dhcp_helper
+/usr/sbin/ccreds_chkpwd:install:chmod ug-s /usr/sbin/ccreds_chkpwd
+/usr/sbin/userisdnctl:install:chmod ug-s /usr/sbin/userisdnctl
+/usr/sbin/usernetctl:install:chmod ug-s /usr/sbin/usernetctl
+/usr/bin/pkexec:install:chmod ug-s /usr/bin/pkexec
Index: tags/fc15-eol/server/fedora/config/etc/yum/yum-updatesd.conf
===================================================================
--- tags/fc15-eol/server/fedora/config/etc/yum/yum-updatesd.conf	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/etc/yum/yum-updatesd.conf	(revision 2244)
@@ -0,0 +1,18 @@
+[main]
+# how often to check for new updates (in seconds)
+run_interval = 14400
+# how often to allow checking on request (in seconds)
+updaterefresh = 600
+
+# how to send notifications (valid: dbus, email, syslog)
+emit_via = dbus email
+# should we listen via dbus to give out update information/check for
+# new updates 
+dbus_listener = yes
+
+# automatically install updates
+do_update = no
+# automatically download updates
+do_download = yes
+# automatically download deps of updates
+do_download_deps = yes
Index: tags/fc15-eol/server/fedora/config/gems.py
===================================================================
--- tags/fc15-eol/server/fedora/config/gems.py	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/gems.py	(revision 2244)
@@ -0,0 +1,18 @@
+#!/usr/bin/python
+"""Retrieve local ruby gem list from scripts.mit.edu
+
+Joe Presbrey <presbrey@mit.edu"""
+
+import commands, re, sys
+
+def scripts_gems():
+    o = commands.getoutput('gem list --local')
+    return map(lambda x: len(x) > 1 and (x[0], x[1].split(', ')) or x,
+               re.findall('([^\s]+)\s\(([^\)]+)\)', o))
+
+if __name__ == "__main__":
+    for x in scripts_gems():
+        if x[0] == 'sources': continue
+        #print >>sys.stderr, x
+        for y in x[1]:
+            print 'gem install %s --version %s -y' % (x[0], y)
Index: tags/fc15-eol/server/fedora/config/home/scripts-build/.rpmmacros
===================================================================
--- tags/fc15-eol/server/fedora/config/home/scripts-build/.rpmmacros	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/home/scripts-build/.rpmmacros	(revision 2244)
@@ -0,0 +1,3 @@
+%_topdir %(echo $HOME)/rpmbuild
+%_smp_mflags  -j3
+%__arch_install_post   /usr/lib/rpm/check-rpaths   /usr/lib/rpm/check-buildroot
Index: tags/fc15-eol/server/fedora/config/php.sh
===================================================================
--- tags/fc15-eol/server/fedora/config/php.sh	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/php.sh	(revision 2244)
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+mkdir -p /etc/php.d/disable
+mv -f /etc/php.d/*.ini -u /etc/php.d/disable/
+rm -f /etc/php.d/*.ini
+pushd /etc/php.d/ >/dev/null
+touch `ls /etc/php.d/disable/*.ini | cut -d/ -f5` -t01010000
+popd >/dev/null
+
+svn revert /etc/php.d/scripts.ini
+
+restorecon -R /etc
Index: tags/fc15-eol/server/fedora/config/rpms.sh
===================================================================
--- tags/fc15-eol/server/fedora/config/rpms.sh	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/rpms.sh	(revision 2244)
@@ -0,0 +1,12 @@
+#!/bin/bash
+#
+# Retrieve package list from scripts.mit.edu
+# Install them with yum
+#
+# Joe Presbrey <presbrey@mit.edu>
+#
+# Skip openafs (custom built), kernel (pedantic), and pubkeys.
+
+ssh root@scripts.mit.edu rpm -qa --qf '%{name}.%{arch}\\n' | grep -v openafs | grep -v kernel | grep -v pubkey > rpms.log
+
+yum install `cat rpms.log`
Index: tags/fc15-eol/server/fedora/config/selinux.sh
===================================================================
--- tags/fc15-eol/server/fedora/config/selinux.sh	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/selinux.sh	(revision 2244)
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+SESTAT=`getenforce`
+setenforce 0
+semanage user -P user -R user_r -R afsagent_r -a afsagent_u
+semanage login -s afsagent_u -a afsagent
+setenforce $SESTAT
Index: tags/fc15-eol/server/fedora/config/services.sh
===================================================================
--- tags/fc15-eol/server/fedora/config/services.sh	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/services.sh	(revision 2244)
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+S_ON='acpid auditd autofs crond execsys-binfmt httpd ip6tables iptables lm_sensors mcstrans mdmonitor named network nrpe openafs-client restorecond sshd syslog sysstat zhm ntpd netfs nfslock portmap'
+S_OFF='NetworkManager NetworkManagerDispatcher anacron atd avahi-dnsconfd capi cpuspeed cups dc_client dc_server dhcdbd diskdump firstboot gpm haldaemon irda isdn kudzu mdmpd messagebus multipathd netdump netplugd nscd pcscd psacct rdisc readahead_later rpcgssd rpcidmapd rpcsvcgssd saslauthd sendmail snmpd snmptrapd spamassassin wpa_supplicant ypbind avahi-daemon readahead_early xfs xinetd yum-updatesd irqbalance smartd postfix nfs'
+
+for s in $S_OFF; do
+	/sbin/chkconfig $s off
+	/sbin/service $s stop
+done
+
+for s in $S_ON; do
+	/sbin/chkconfig --add $s
+	/sbin/chkconfig $s on
+	#/sbin/service $s status || runcon system_u:system_r:initrc_t:s0 /sbin/service $s start
+done
+
+restorecon -R /etc
Index: tags/fc15-eol/server/fedora/config/signup.py
===================================================================
--- tags/fc15-eol/server/fedora/config/signup.py	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/signup.py	(revision 2244)
@@ -0,0 +1,37 @@
+#!/usr/bin/python
+"""Add system users from external passwd and group files
+Joe Presbrey <presbrey@mit.edu>
+
+arguments: <passwd-file> <group-file>"""
+
+
+import commands
+import os,sys,string
+#import athena
+
+def do_groupfile(f):
+	for x in f.readlines():
+		gname = x.strip().split(':')[0]
+		gid = x.strip().split(':')[2]
+		c = commands.getstatusoutput('groupadd -g ' + gid + ' ' + gname)
+		if c[0] == 0:
+			print "group " + gname + "/" + gid + " added successfully."
+
+def do_userfile(f):
+	for x in f.readlines():
+		name = x.strip().split(':')[0]
+		#uathena = AthenaUser(name)
+		uid = x.strip().split(':')[2]
+		gid = x.strip().split(':')[3]
+		home = x.strip().split(':')[5]
+		if uid > 100:
+			c = commands.getstatusoutput('useradd -M -d ' + home + ' -u ' + uid + ' -g ' + gid + ' -G users -s /usr/local/bin/mbash ' + name)
+			if c[0] == 0:
+				print "user " + name + "/" + uid + " added successfully."
+
+if __name__ == "__main__":
+	if len(sys.argv) != 3:
+		print __doc__
+	else:
+		do_groupfile(file(sys.argv[2]))
+		do_userfile(file(sys.argv[1]))
Index: tags/fc15-eol/server/fedora/config/usr/vice/etc/CellServDB.local
===================================================================
--- tags/fc15-eol/server/fedora/config/usr/vice/etc/CellServDB.local	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/usr/vice/etc/CellServDB.local	(revision 2244)
@@ -0,0 +1,660 @@
+>athena.mit.edu         #MIT/Athena cell
+18.3.48.11                      #aether.mit.edu
+18.9.48.11                      #castor.mit.edu
+18.9.48.12                      #pollux.mit.edu.
+>net.mit.edu            #MIT/Network Group cell
+18.7.7.73                       #gracie.mit.edu
+18.7.21.95                      #george.mit.edu
+>numenor.mit.edu        #Project Numenor
+18.243.2.49                     #numenor.mit.edu
+>sipb.mit.edu           #MIT/SIPB cell
+18.181.0.19                     #reynelda.mit.edu
+18.181.0.22                     #rosebud.mit.edu
+18.181.0.23                     #ronald-ann.mit.edu
+>grand.central.org      #GCO Public CellServDB 14 Aug 2011
+18.9.48.14                      #grand.mit.edu
+128.2.203.61                    #penn.central.org
+130.237.48.87                   #andrew.e.kth.se
+>wu-wien.ac.at          #University of Economics, Vienna, Austria
+137.208.3.33                    #goya.wu-wien.ac.at
+137.208.7.57                    #caravaggio.wu-wien.ac.at
+137.208.127.57                  #vermeer.wu-wien.ac.at
+>hephy.at               #hephy-vienna
+193.170.243.10                  #mowgli.oeaw.ac.at
+193.170.243.12                  #baloo.oeaw.ac.at
+193.170.243.14                  #akela.oeaw.ac.at
+>cgv.tugraz.at          #CGV cell
+129.27.218.30                   #phobos.cgv.tugraz.at
+129.27.218.31                   #deimos.cgv.tugraz.at
+129.27.218.32                   #trinculo.cgv.tugraz.at
+>itp.tugraz.at          #Institute of Theoretical and Computational Physics, TU Graz, Aus
+129.27.161.7                    #faepafs1.tu-graz.ac.at
+129.27.161.15                   #faepafs2.tu-graz.ac.at
+129.27.161.114                  #faepafs3.tu-graz.ac.at
+>sums.math.mcgill.ca    #Society of Undergraduate Mathematics Students of McGill Universi
+132.216.24.122                  #germain.sums.math.mcgill.ca
+132.216.24.125                  #turing.sums.math.mcgill.ca
+>ualberta.ca            #University of Alberta
+129.128.1.131                   #file13.ucs.ualberta.ca
+129.128.98.17                   #mystery.ucs.ualberta.ca
+129.128.125.40                  #drake.ucs.ualberta.ca
+>cern.ch                #European Laboratory for Particle Physics, Geneva
+137.138.128.148                 #afsdb1.cern.ch
+137.138.246.50                  #afsdb3.cern.ch
+137.138.246.51                  #afsdb2.cern.ch
+>ams.cern.ch            #AMS Experiment
+137.138.188.185                 #ams.cern.ch
+137.138.199.58                  #pcamsf4.cern.ch
+>epfl.ch                #Swiss Federal Institute of Technology at Lausanne
+128.178.109.111                 #kd1.epfl.ch
+128.178.109.112                 #kd2.epfl.ch
+128.178.109.113                 #kd3.epfl.ch
+>ethz.ch                #Swiss Federal Inst. of Tech. - Zurich, Switzerland
+82.130.118.32                   #afs-db-1.ethz.ch
+>psi.ch                 #Paul Scherrer Institut - Villigen, Switzerland
+129.129.190.140                 #afs00.psi.ch
+129.129.190.141                 #afs01.psi.ch
+129.129.190.142                 #afs02.psi.ch
+>extundo.com            #Simon Josefsson's cell
+195.42.214.241                  #slipsten.extundo.com
+>freedaemon.com         #Free Daemon Consulting, Oklahoma City, OK, USA
+66.210.104.254                  #afs0.freedaemon.com
+>membrain.com           #membrain.com
+66.93.118.125                   #stormy
+130.85.24.11                    #weasel
+130.85.24.13                    #straykitten
+>sodre.cx               #Sodre.cx
+128.8.140.165                   #greed.sodre.cx
+>ruk.cuni.cz            #Charles University Computer Centre, Prague, CR
+195.113.0.36                    #asterix.ruk.cuni.cz
+195.113.0.37                    #obelix.ruk.cuni.cz
+195.113.0.40                    #sal.ruk.cuni.cz
+>ics.muni.cz            #Masaryk university
+147.251.3.11                    #grond.ics.muni.cz
+147.251.3.15                    #nimloth.ics.muni.cz
+147.251.3.19                    #sirion.ics.muni.cz
+>zcu.cz                 #University of West Bohemia, Czech Republic
+147.228.10.18                   #sauron.zcu.cz
+147.228.52.10                   #oknos.zcu.cz
+147.228.52.17                   #nic.zcu.cz
+>desy.de                #Deutsches Elektronen-Synchrotron
+131.169.2.19                    #afsdb2.desy.de
+131.169.2.20                    #afsdb3.desy.de
+131.169.244.60                  #solar00.desy.de
+>naf.desy.de            #National Analysis Facility at DESY
+141.34.220.32                   #tcsh1-vm1.naf.desy.de
+141.34.230.33                   #tcsh2-vm1.naf.desy.de
+141.34.230.34                   #tcsh3-vm1.naf.desy.de
+>gppc.de                #GPP Chemnitz mbH
+213.187.92.33                   #gpp1.gppc.de
+213.187.92.34                   #paulchen.gppc.de
+213.187.92.35                   #lotus.gppc.de
+>cms.hu-berlin.de       #Humboldt University Berlin
+141.20.1.65                     #commodus.cms.hu-berlin.de
+141.20.1.66                     #faustinus.cms.hu-berlin.de
+141.20.1.67                     #marcellus.cms.hu-berlin.de
+>ifh.de                 #DESY Zeuthen
+141.34.22.10                    #romulus.ifh.de
+141.34.22.11                    #remus.ifh.de
+141.34.22.29                    #hekate.ifh.de
+>integra-ev.de          #INTEGRA e.V.
+134.155.48.8                    #afsdb2.integra-ev.de
+134.155.48.63                   #afsdb1.integra-ev.de
+>lrz-muenchen.de        #Leibniz Computing Centre, Germany
+129.187.10.36                   #afs1.lrz-muenchen.de
+129.187.10.56                   #afs3.lrz-muenchen.de
+129.187.10.57                   #afs2.lrz-muenchen.de
+>ipp-garching.mpg.de    #Institut fuer Plasmaphysik
+130.183.9.5                     #afs-db1.rzg.mpg.de
+130.183.14.14                   #afs-db3.bc.rzg.mpg.de
+130.183.100.10                  #afs-db2.aug.ipp-garching.mpg.de
+>mpe.mpg.de             #MPE cell
+130.183.130.7                   #irafs1.mpe-garching.mpg.de
+130.183.134.20                  #irafs2.mpe-garching.mpg.de
+>nicsys.de              #NICsys GbR
+213.187.80.3                    #attila.nicsys.de
+>i1.informatik.rwth-aachen.de #Informatik I, RWTH Aachen
+137.226.244.79                  #remus.informatik.rwth-aachen.de
+>combi.tfh-wildau.de    #Philips Research Lab
+194.95.50.106                   #joda13.combi.tfh-wildau.de
+>tu-berlin.de           #TU Berlin
+130.149.204.10                  #afsc-pr-1.tubit.tu-berlin.de
+130.149.204.11                  #afsc-pr-2.tubit.tu-berlin.de
+130.149.204.70                  #afsc-ba-1.tubit.tu-berlin.de
+>tu-bs.de               #Technical University of Braunschweig, Germany
+134.169.1.1                     #rzafs1.rz.tu-bs.de
+134.169.1.5                     #rzafs2.rz.tu-bs.de
+134.169.1.6                     #rzafs3.rz.tu-bs.de
+>tu-chemnitz.de         #Technische Universitaet Chemnitz, Germany
+134.109.2.1                     #zuse.hrz.tu-chemnitz.de
+134.109.2.2                     #andrew.hrz.tu-chemnitz.de
+134.109.2.15                    #phoenix.hrz.tu-chemnitz.de
+>e18.ph.tum.de          #Experimental Physics, TU Munich, Germany
+129.187.154.165                 #dionysos.e18.physik.tu-muenchen.de
+129.187.154.223                 #hamlet.e18.physik.tu-muenchen.de
+>atlass01.physik.uni-bonn.de #Bonn ATLAS
+131.220.165.43                  #atlass01.physik.uni-bonn.de
+>uni-freiburg.de        #Albert-Ludwigs-Universitat Freiburg
+132.230.6.237                   #sv8.ruf.uni-freiburg.de
+132.230.6.239                   #sv10.ruf.uni-freiburg.de
+>physik.uni-freiburg.de #Institute of Physics, University Freiburg, Germany
+132.230.6.234                   #afs1.ruf.uni-freiburg.de
+132.230.6.235                   #afs2.ruf.uni-freiburg.de
+132.230.77.16                   #hepafs.physik.uni-freiburg.de
+>physnet.uni-hamburg.de #PHYSnet-Rechenzentrum university of hamburg
+134.100.106.44                  #afs-core.physnet.uni-hamburg.de
+134.100.106.45                  #afs-core2.physnet.uni-hamburg.de
+134.100.106.47                  #afs-core3.physnet.uni-hamburg.de
+>mathi.uni-heidelberg.de #Uni Heidelberg (Mathematisches Institut)
+129.206.26.241                  #hactar.mathi.uni-heidelberg.de
+>urz.uni-heidelberg.de  #Uni Heidelberg (Rechenzentrum)
+129.206.119.10                  #afsdb.urz.uni-heidelberg.de
+129.206.119.16                  #afsdb1.urz.uni-heidelberg.de
+129.206.119.17                  #afsdb2.urz.uni-heidelberg.de
+>ziti.uni-heidelberg.de #Institute of Computer Science at the University of Heidelberg
+147.142.42.246                  #mp-sun.ziti.uni-heidelberg.de
+147.142.42.252                  #mp-pizza.ziti.uni-heidelberg.de
+>uni-hohenheim.de       #University of Hohenheim
+144.41.2.2                      #rs13.serv.uni-hohenheim.de
+144.41.2.3                      #rs14.serv.uni-hohenheim.de
+144.41.2.4                      #rs15.serv.uni-hohenheim.de
+>rz.uni-jena.de         #Rechenzentrum University of Jena, Germany
+141.35.2.180                    #afs00.rz.uni-jena.de
+141.35.2.181                    #afs01.rz.uni-jena.de
+141.35.2.182                    #afs02.rz.uni-jena.de
+>meteo.uni-koeln.de     #Univ. of Cologne - Inst. for Geophysics & Meteorology
+134.95.144.22                   #afs1.meteo.uni-koeln.de
+134.95.144.24                   #afs2.meteo.uni-koeln.de
+>rrz.uni-koeln.de       #University of Cologne - Reg Comp Center
+134.95.19.3                     #afsdb1.rrz.uni-koeln.de
+134.95.19.4                     #afsdb2.rrz.uni-koeln.de
+134.95.19.10                    #lyra.rrz.uni-koeln.de
+134.95.67.97                    #afs.thp.uni-koeln.de
+134.95.112.8                    #ladon.rrz.uni-koeln.de
+>physik.uni-mainz.de    #institute of physics, university Mainz, Germany
+134.93.130.93                   #hardy.physik.uni-mainz.de
+>uni-mannheim.de        #Uni Mannheim (Rechenzentrum)
+134.155.97.204                  #afsdb1.uni-mannheim.de
+134.155.97.205                  #afsdb2.uni-mannheim.de
+134.155.97.206                  #afsdb3.uni-mannheim.de
+>uni-paderborn.de       #University of Paderborn, Germany
+131.234.137.10                  #afsdb1.uni-paderborn.de
+131.234.137.11                  #afsdb2.uni-paderborn.de
+131.234.137.12                  #afsdb3.uni-paderborn.de
+>physik.uni-wuppertal.de #Physics department of Bergische Universität Wuppertal
+132.195.104.3                   #afs1.physik.uni-wuppertal.de
+132.195.104.230                 #afs2.physik.uni-wuppertal.de
+>s-et.aau.dk            #Aalborg Univ., The Student Society, Denmark
+130.225.196.22                  #afs.s-et.aau.dk
+>ies.auc.dk             #Aalborg Univ., Inst. of Electronic Systems, Denmark
+130.225.51.73                   #afsdb1.kom.auc.dk
+130.225.51.74                   #afsdb2.kom.auc.dk
+130.225.51.85                   #afsdb3.kom.auc.dk
+>asu.edu                #Arizona State University
+129.219.10.69                   #authen2.asu.edu
+129.219.10.70                   #authen1.asu.edu
+129.219.10.72                   #authen3.asu.edu
+>mars.asu.edu           #Mars Space Flight Facility - ASU Mars Research
+149.169.146.57                  #kdc1.mars.asu.edu
+149.169.146.58                  #kdc2.mars.asu.edu
+149.169.146.59                  #kdc3.mars.asu.edu
+>hep.caltech.edu        #Caltech High Energy Physics
+131.215.116.20                  #afs.hep.caltech.edu
+>ugcs.caltech.edu       #Caltech UGCS lab
+131.215.176.65                  #afs-c.ugcs.caltech.edu
+131.215.176.67                  #afs-a.ugcs.caltech.edu
+131.215.176.68                  #afs-b.ugcs.caltech.edu
+>clarkson.edu           #Clarkson University, Potsdam, New York USA
+128.153.1.111                   #arthur.clarkson.edu
+128.153.9.111                   #lancelot.clarkson.edu
+128.153.17.111                  #uther.clarkson.edu
+>andrew.cmu.edu         #Carnegie Mellon University - Computing Services Cell
+128.2.10.2                      #afsdb-01.andrew.cmu.edu
+128.2.10.7                      #afsdb-02.andrew.cmu.edu
+128.2.10.11                     #afsdb-03.andrew.cmu.edu
+>mw.andrew.cmu.edu      #Carnegie Mellon University - Middleware Test Cell
+128.2.234.24                    #null.andrew.cmu.edu
+128.2.234.170                   #mw-mgr.andrew.cmu.edu
+>club.cc.cmu.edu        #Carnegie Mellon University Computer Club
+128.2.204.149                   #barium.club.cc.cmu.edu
+128.237.157.11                  #sodium.club.cc.cmu.edu
+128.237.157.13                  #potassium.club.cc.cmu.edu
+>chem.cmu.edu           #Carnegie Mellon University - Chemistry Dept.
+128.2.40.134                    #afs.chem.cmu.edu
+128.2.40.140                    #afs2.chem.cmu.edu
+>cs.cmu.edu             #Carnegie Mellon University - School of Comp. Sci.
+128.2.172.58                    #date.srv.cs.cmu.edu
+128.2.172.60                    #fig.srv.cs.cmu.edu
+128.2.200.97                    #watermelon.srv.cs.cmu.edu
+>ece.cmu.edu            #Carnegie Mellon University - Elec. Comp. Eng. Dept.
+128.2.129.7                     #porok.ece.cmu.edu
+128.2.129.8                     #vicio.ece.cmu.edu
+128.2.129.9                     #e-xing.ece.cmu.edu
+>scotch.ece.cmu.edu     #CMU ECE CALCM research group
+128.2.134.82                    #lagavulin.ece.cmu.edu
+>qatar.cmu.edu          #Carnegie Mellon University - Qatar
+86.36.46.6                      #afs1.qatar.cmu.edu
+86.36.46.7                      #afs2.qatar.cmu.edu
+>sbp.ri.cmu.edu         #Carnegie Mellon University - Sensor Based Planning Lab
+128.2.179.12                    #nihao.sbp.ri.cmu.edu
+128.2.179.113                   #youtheman.sbp.ri.cmu.edu
+>cnf.cornell.edu        #CNF
+128.253.198.9                   #hole.cnf.cornell.edu
+128.253.198.27                  #smoke.cnf.cornell.edu
+128.253.198.231                 #mist.cnf.cornell.edu
+>math.cornell.edu       #Cornell Math Dept
+128.84.234.12                   #pooh.math.cornell.edu
+128.84.234.16                   #bernoulli.math.cornell.edu
+128.84.234.162                  #dyno.math.cornell.edu
+>msc.cornell.edu        #Cornell University Materials Science Center
+128.84.231.242                  #miranda.ccmr.cornell.edu
+128.84.241.35                   #co.ccmr.cornell.edu
+128.84.249.78                   #dax.ccmr.cornell.edu
+>dbic.dartmouth.edu     #Dartmouth Brain Imaging Center
+129.170.30.143                  #dbicafs1.dartmouth.edu
+129.170.30.144                  #dbicafs2.dartmouth.edu
+129.170.30.145                  #dbicafs3.dartmouth.edu
+>northstar.dartmouth.edu #Dartmouth College Research Computing
+129.170.16.22                   #halley.dartmouth.edu
+129.170.16.26                   #andromeda.dartmouth.edu
+129.170.16.43                   #cygnusx1.dartmouth.edu
+>cs.hm.edu              #Department Computer Science Munich University Of Applied Science
+129.187.208.31                  #afs1.cs.hm.edu
+>eecs.harvard.edu       #Harvard - EECS
+140.247.60.64                   #lefkada.eecs.harvard.edu
+140.247.60.83                   #corfu.eecs.harvard.edu
+>iastate.edu            #Iowa State University
+129.186.1.243                   #afsdb-1.iastate.edu
+129.186.6.243                   #afsdb-2.iastate.edu
+129.186.142.243                 #afsdb-3.iastate.edu
+>msu.edu                #Michigan State University Main Cell
+35.9.7.10                       #afsdb0.cl.msu.edu
+>nd.edu                 #University of Notre Dame
+129.74.223.17                   #john.helios.nd.edu
+129.74.223.33                   #lizardo.helios.nd.edu
+129.74.223.65                   #buckaroo.helios.nd.edu
+>crc.nd.edu             #University of Notre Dame - Center for Research Computing
+129.74.85.34                    #afsdb1.crc.nd.edu
+129.74.85.35                    #afsdb2.crc.nd.edu
+129.74.85.36                    #afsdb3.crc.nd.edu
+>pitt.edu               #University of Pittsburgh
+136.142.8.15                    #afs09.srv.cis.pitt.edu
+136.142.8.20                    #afs10.srv.cis.pitt.edu
+136.142.8.21                    #afs11.srv.cis.pitt.edu
+>cs.pitt.edu            #University of Pittsburgh - Computer Science
+130.49.220.11                   #afs01.cs.pitt.edu
+130.49.220.12                   #afs02.cs.pitt.edu
+130.49.220.13                   #afs03.cs.pitt.edu
+>psc.edu                #PSC (Pittsburgh Supercomputing Center)
+128.182.59.182                  #shaggy.psc.edu
+128.182.66.184                  #velma.psc.edu
+128.182.66.185                  #daphne.psc.edu
+>scoobydoo.psc.edu      #PSC Test Cell
+128.182.59.181                  #scooby.psc.edu
+>cede.psu.edu           #Penn State - Center for Engr. Design & Entrepeneurship
+146.186.218.10                  #greenly.cede.psu.edu
+146.186.218.60                  #b50.cede.psu.edu
+146.186.218.246                 #stalin.cede.psu.edu
+>rose-hulman.edu        #Rose-Hulman Institute of Technology
+137.112.7.11                    #afs1.rose-hulman.edu
+137.112.7.12                    #afs2.rose-hulman.edu
+137.112.7.13                    #afs3.rose-hulman.edu
+>cs.rose-hulman.edu     #Rose-Hulman CS Department
+137.112.40.10                   #galaxy.cs.rose-hulman.edu
+>rpi.edu                #Rensselaer Polytechnic Institute
+128.113.22.11                   #saul.server.rpi.edu
+128.113.22.12                   #joab.server.rpi.edu
+128.113.22.13                   #korah.server.rpi.edu
+128.113.22.14                   #achan.server.rpi.edu
+>hep.sc.edu             #University of South Carolina, Dept. of Physics
+129.252.78.77                   #cpeven.physics.sc.edu
+>cs.stanford.edu        #Stanford University Computer Science Department
+171.64.64.10                    #cs-afs-1.Stanford.EDU
+171.64.64.66                    #cs-afs-2.stanford.edu
+171.64.64.69                    #cs-afs-3.stanford.edu
+>ir.stanford.edu        #Stanford University
+171.64.7.222                    #afsdb1.stanford.edu
+171.64.7.234                    #afsdb2.stanford.edu
+171.64.7.246                    #afsdb3.stanford.edu
+>slac.stanford.edu      #Stanford Linear Accelerator Center
+134.79.18.25                    #afsdb1.slac.stanford.edu
+134.79.18.26                    #afsdb2.slac.stanford.edu
+134.79.18.27                    #afsdb3.slac.stanford.edu
+>physics.ucsb.edu       #UC Santa Barbara, Physics Dept
+128.111.18.161                  #ledzeppelin.physics.ucsb.edu
+>cats.ucsc.edu          #UC Santa Cruz, Comp and Tech Services, California U.S.A
+128.114.123.14                  #elan.ucsc.edu
+128.114.123.15                  #ichabod.ucsc.edu
+128.114.123.18                  #maneki.ucsc.edu
+>acm.uiuc.edu           #ACM at the University of Illinois
+128.174.251.8                   #alnitak.acm.uiuc.edu
+128.174.251.9                   #alnilam.acm.uiuc.edu
+128.174.251.10                  #mintaka.acm.uiuc.edu
+>ncsa.uiuc.edu          #National Center for Supercomputing Applications at Illinois
+141.142.192.66                  #nile-vm.ncsa.uiuc.edu
+141.142.192.143                 #congo-vm.ncsa.uiuc.edu
+141.142.192.144                 #kaskaskia-vm.ncsa.uiuc.edu
+>umbc.edu               #University of Maryland, Baltimore County
+130.85.24.23                    #db2.afs.umbc.edu
+130.85.24.87                    #db3.afs.umbc.edu
+130.85.24.101                   #db1.afs.umbc.edu
+>glue.umd.edu           #University of Maryland - Project Glue
+128.8.70.11                     #olmec.umd.edu
+128.8.236.4                     #egypt.umd.edu
+128.8.236.230                   #babylon.umd.edu
+>wam.umd.edu            #University of Maryland Network WAM Project
+128.8.70.9                      #csc-srv.wam.umd.edu
+128.8.236.5                     #avw-srv.wam.umd.edu
+128.8.236.231                   #ptx-srv.wam.umd.edu
+>umich.edu              #University of Michigan - Campus
+141.211.1.32                    #fear.ifs.umich.edu
+141.211.1.33                    #surprise.ifs.umich.edu
+141.211.1.34                    #ruthless.ifs.umich.edu
+>atlas.umich.edu        #ATLAS group cell in physics at University of Michigan
+141.211.43.102                  #linat02.grid.umich.edu
+141.211.43.103                  #linat03.grid.umich.edu
+141.211.43.104                  #linat04.grid.umich.edu
+>citi.umich.edu         #University of Michigan - Center for Information Technology Integ
+141.212.112.5                   #babylon.citi.umich.edu
+>sph.umich.edu          #University of Michigan -- School of Public  Health
+141.211.51.137                  #afssph7.sph.umich.edu
+141.211.51.139                  #afssph0.sph.umich.edu
+141.211.51.142                  #afssph6.sph.umich.edu
+>isis.unc.edu           #Univ. of NC at Chapel Hill - ITS
+152.2.1.5                       #db0.isis.unc.edu
+152.2.1.6                       #db1.isis.unc.edu
+152.2.1.7                       #db2.isis.unc.edu
+>physics.unc.edu        #Univ. of NC at Chapel Hill, Dept. of Physics
+152.2.4.1                       #who.physics.unc.edu
+152.2.4.3                       #what.physics.unc.edu
+152.2.4.5                       #when.physics.unc.edu
+>uncc.edu               #University of NC at Charlotte Mosaic AFS Cell
+152.15.10.70                    #as-sm1.uncc.edu
+152.15.93.186                   #as-ece1.uncc.edu
+152.15.181.175                  #as-me1.uncc.edu
+>eng.utah.edu           #University of Utah - Engineering
+155.98.111.9                    #lenny.eng.utah.edu
+155.98.111.10                   #carl.eng.utah.edu
+>cs.uwm.edu             #University of Wisconsin--Milwaukee
+129.89.38.124                   #solomons.cs.uwm.edu
+>cs.wisc.edu            #Univ. of Wisconsin-Madison, Computer Sciences Dept.
+128.105.132.14                  #timon.cs.wisc.edu
+128.105.132.15                  #pumbaa.cs.wisc.edu
+128.105.132.16                  #zazu.cs.wisc.edu
+>engr.wisc.edu          #University of Wisconsin-Madison, College of Engineering
+144.92.13.14                    #larry.cae.wisc.edu
+144.92.13.15                    #curly.cae.wisc.edu
+144.92.13.16                    #moe.cae.wisc.edu
+>hep.wisc.edu           #University of Wisconsin -- High Energy Physics
+128.104.28.219                  #anise.hep.wisc.edu
+144.92.180.7                    #rosemary.hep.wisc.edu
+144.92.180.30                   #fennel.hep.wisc.edu
+>physics.wisc.edu       #Univ. of Wisconsin-Madison, Physics Department
+128.104.160.13                  #kendra.physics.wisc.edu
+128.104.160.14                  #fray.physics.wisc.edu
+128.104.160.15                  #buffy.physics.wisc.edu
+>ciemat.es              #Ciemat, Madrid, Spain
+130.206.11.42                   #afsdb1.ciemat.es
+130.206.11.217                  #afsdb2.ciemat.es
+130.206.11.247                  #afsdb3.ciemat.es
+>ifca.unican.es         #Instituto de Fisica de Cantabria (IFCA), Santander, Spain
+193.144.209.20                  #gridwall.ifca.unican.es
+>ific.uv.es             #Instituto de Fisica Corpuscular, Valencia, Spain
+147.156.163.11                  #alpha.ific.uv.es
+>dapnia.saclay.cea.fr   #CEA DAPNIA
+132.166.32.7                    #dphrsg.saclay.cea.fr
+132.166.32.12                   #dphrsl.saclay.cea.fr
+>in2p3.fr               #IN2P3 production cell
+134.158.104.11                  #ccafsdb01.in2p3.fr
+134.158.104.12                  #ccafsdb02.in2p3.fr
+134.158.232.11                  #ccafsdb1.in2p3.fr
+134.158.232.12                  #ccafsdb2.in2p3.fr
+134.158.232.13                  #ccafsdb3.in2p3.fr
+>mcc.ac.gb              #University of Manchester
+130.88.203.41                   #nevis.mc.man.ac.uk
+130.88.203.144                  #eryri.mc.man.ac.uk
+130.88.203.145                  #scafell.mc.man.ac.uk
+>anl.gov                #Argonne National Laboratory
+146.137.96.33                   #arteus.it.anl.gov
+146.137.162.88                  #agamemnon.it.anl.gov
+146.137.194.80                  #antenor.it.anl.gov
+>rhic.bnl.gov           #Relativistic Heavy Ion Collider
+130.199.6.51                    #rafs03.rcf.bnl.gov
+130.199.6.52                    #rafs02.rcf.bnl.gov
+130.199.6.69                    #rafs01.rcf.bnl.gov
+>usatlas.bnl.gov        #US Atlas Tier 1 Facility at BNL
+130.199.48.32                   #aafs01.usatlas.bnl.gov
+130.199.48.33                   #aafs02.usatlas.bnl.gov
+130.199.48.34                   #aafs03.usatlas.bnl.gov
+>fnal.gov               #Fermi National Acclerator Laboratory
+131.225.68.1                    #fsus01.fnal.gov
+131.225.68.4                    #fsus03.fnal.gov
+131.225.68.14                   #fsus04.fnal.gov
+>jpl.nasa.gov           #Jet Propulsion Laboratory
+137.78.160.21                   #afsdb08.jpl.nasa.gov
+137.78.160.22                   #afsdb09.jpl.nasa.gov
+137.78.160.23                   #afsdb10.jpl.nasa.gov
+>nersc.gov              #National Energy Research Supercomputer Center
+128.55.128.250                  #mars.nersc.gov
+128.55.128.252                  #alfred.nersc.gov
+128.55.128.254                  #lurch.nersc.gov
+>doe.atomki.hu          #Institute of Nuclear Research (MTA ATOMKI), Debrecen, Hungary
+193.6.179.31                    #afs.doe.atomki.hu
+>bme.hu                 #Budapest University of Technology and Economics
+152.66.241.6                    #afs.iit.bme.hu
+>kfki.hu                #Research Institute for Nuclear and Particle Physics - Budapest,H
+148.6.8.14                      #afs.kfki.hu
+>caspur.it              #CASPUR Inter-University Computing Consortium, Rome
+193.204.5.45                    #pomodoro.caspur.it
+193.204.5.46                    #banana.caspur.it
+193.204.5.50                    #maslo.caspur.it
+>enea.it                #ENEA New Tech. Energy & Environment Agency, Italy
+192.107.54.5                    #aixfs.frascati.enea.it
+192.107.54.11                   #rs2ced.frascati.enea.it
+192.107.54.12                   #43p.frascati.enea.it
+>fusione.it             #Assoz. FUSIONE/Euratom, ENEA, Frascati-Italy
+192.107.90.2                    #fusafs1.frascati.enea.it
+192.107.90.3                    #fusafs2.frascati.enea.it
+192.107.90.4                    #fusafs3.frascati.enea.it
+>icemb.it               #ICEMB, Universita' La Sapienza - Rome - Italy
+193.204.6.130                   #icembfs.caspur.it
+>ictp.it                #The Abdus Salam International Centre for Theoretical Physics (IC
+140.105.34.7                    #afsdb1.ictp.it
+140.105.34.8                    #afsdb2.ictp.it
+>infn.it                #Istituto Nazionale di Fisica Nucleare (INFN), Italia
+131.154.1.7                     #afscnaf.infn.it
+141.108.26.75                   #afsrm1.roma1.infn.it
+192.84.134.75                   #afsna.na.infn.it
+>ba.infn.it             #INFN, Sezione di Bari
+193.206.185.235                 #baafsserver.ba.infn.it
+193.206.185.236                 #debsrv.ba.infn.it
+>kloe.infn.it           #INFN, KLOE experiment at Laboratori di Frascati
+192.135.25.111                  #kloeafs1.lnf.infn.it
+192.135.25.112                  #kloeafs2.lnf.infn.it
+>le.infn.it             #INFN, Sezione di Lecce
+192.84.152.40                   #afs01.le.infn.it
+192.84.152.148                  #afs02.le.infn.it
+>lnf.infn.it            #INFN, Laboratori Nazionali di Frascati
+193.206.84.121                  #afs1.lnf.infn.it
+193.206.84.122                  #afs2.lnf.infn.it
+193.206.84.123                  #afs3.lnf.infn.it
+>lngs.infn.it           #INFN, Laboratori Nazionali del Gran Sasso
+192.84.135.21                   #afs1.lngs.infn.it
+192.84.135.133                  #afs2.lngs.infn.it
+>pi.infn.it             #INFN, Sezione di Pisa
+192.84.133.50                   #aix1.pi.infn.it
+212.189.152.6                   #afs1.pi.infn.it
+212.189.152.7                   #afs2.pi.infn.it
+>roma3.infn.it          #Istituto Nazionale di Fisica Nucleare (INFN), Italia
+193.205.159.17                  #afsrm3.roma3.infn.it
+>psm.it                 #Progetto San Marco, Universita' di Roma-1
+151.100.1.65                    #atlante.psm.uniroma1.it
+>tgrid.it               #CASPUR-CILEA-CINECA Grid Cell
+193.204.5.33                    #cccgrid.caspur.it
+>math.unifi.it          #math.unifi.it
+150.217.34.182                  #xeno.math.unifi.it
+>ing.uniroma1.it        #Universita' La Sapienza, Fac. Ingeneria
+151.100.85.253                  #alfa.ing.uniroma1.it
+>dia.uniroma3.it        #University Roma Tre - DIA
+193.204.161.67                  #srv.dia.uniroma3.it
+193.204.161.79                  #aux.dia.uniroma3.it
+193.204.161.118                 #afs.dia.uniroma3.it
+>vn.uniroma3.it         #University of Rome 3, Area Vasca Navale
+193.204.161.136                 #alfa.dia.uniroma3.it
+193.204.161.137                 #beta.dia.uniroma3.it
+193.204.161.138                 #gamma.dia.uniroma3.it
+>italia                 #Italian public AFS cell
+193.204.5.9                     #afs.caspur.it
+>cmf.nrl.navy.mil       #Naval Research Laboratory - Center for Computational Science
+134.207.12.68                   #picard.cmf.nrl.navy.mil
+134.207.12.69                   #riker.cmf.nrl.navy.mil
+134.207.12.70                   #kirk.cmf.nrl.navy.mil
+>lcp.nrl.navy.mil       #Naval Research Lab - Lab for Computational Physics
+132.250.114.2                   #afs1.lcp.nrl.navy.mil
+132.250.114.4                   #afs2.lcp.nrl.navy.mil
+132.250.114.6                   #afs3.lcp.nrl.navy.mil
+>crossproduct.net       #crossproduct.net
+207.114.88.164                  #enigma.crossproduct.net
+>epitech.net            #EPITECH, France
+163.5.255.41                    #afs-db-1.epitech.net
+163.5.255.42                    #afs-db-2.epitech.net
+>es.net                 #Energy Sciences Net
+198.128.3.21                    #fs1.es.net
+198.128.3.22                    #fs2.es.net
+198.128.3.23                    #fs3.es.net
+>gorlaeus.net           #Gorlaeus Laboratories, Leiden University
+132.229.170.27                  #fwncisafs1.gorlaeus.net
+>laroia.net             #Laroia Networks
+66.66.102.254                   #supercore.laroia.net
+>sinenomine.net         #Sine Nomine Associates
+72.73.25.18                     #afsdb2.sinenomine.net
+72.73.30.74                     #afsdb3.sinenomine.net
+74.121.192.42                   #afsdb1.sinenomine.net
+>slackers.net           #The Slackers' Network
+199.4.150.159                   #alexandria.slackers.net
+>tproa.net              #The People's Republic of Ames
+204.11.35.83                    #service-3.tproa.net
+204.11.35.84                    #service-4.tproa.net
+204.11.35.85                    #service-5.tproa.net
+>interdose.net          #Interdose Ltd. & Co. KG, Germany
+80.190.171.42                   #bfd9000.tow5.interdose.net
+80.190.171.43                   #bfd9001.tow5.interdose.net
+>nikhef.nl              #The Dutch National Institute for High Energy Physics
+192.16.185.26                   #afs1.nikhef.nl
+192.16.185.27                   #afs2.nikhef.nl
+>1ts.org                #1TS.ORG, Cambridge, MA
+69.25.196.126                   #neuromancer.1ts.org
+>acm-csuf.org           #California State Univerisity Fullerton ACM
+137.151.29.193                  #afs1.acm-csuf.org
+>adrake.org             #adrake.org
+128.2.98.241                    #afs.adrake.org
+>bazquux.org            #Baz Quux Organization
+66.207.142.196                  #baxquux.org
+>coed.org               #Adam Pennington's Cell
+66.93.61.184                    #vice1.coed.org
+128.237.157.35                  #vice3.coed.org
+>dementia.org           #Dementia Unlimited (old)
+128.2.13.209                    #dedlock.dementix.org
+128.2.234.204                   #vorkana.dementix.org
+128.2.235.26                    #meredith.dementix.org
+>dementix.org           #Dementia Unlimited
+128.2.13.209                    #dedlock.dementix.org
+128.2.234.204                   #vorkana.dementix.org
+128.2.235.26                    #meredith.dementix.org
+>idahofuturetruck.org   #University of Idaho hybrid vehicle development
+12.18.238.210                   #dsle210.fsr.net
+>jeaton.org             #jeaton.org (Jeffrey Eaton, jeaton@jeaton.org)
+128.2.234.89                    #jeaton-org-01.jeaton.org
+128.2.234.92                    #jeaton-org-02.jeaton.org
+>mrow.org               #MROW.ORG and RITLUG Cell
+88.198.46.111                   #mrow.org
+129.21.205.119                  #mirror.rit.edu
+>mrph.org               #Mrph
+66.207.133.1                    #sanber.mrph.org
+128.2.99.209                    #hernandarias.mrph.org
+>mstacm.org             #Missouri Science & Technology - ACM
+131.151.249.193                 #acm.mst.edu
+>nomh.org               #nomh.org
+204.29.154.12                   #iota.nomh.org
+204.29.154.32                   #adversity.xi.nomh.org
+>oc7.org                #The OC7 Project
+128.2.122.140                   #knife.oc7.org
+207.22.77.170                   #spoon.oc7.org
+>pfriedma.org           #pfriedma.org
+72.95.215.18                    #vice.pfriedma.org
+>riscpkg.org            #The RISC OS Packaging Project
+83.104.175.10                   #delenn.riscpkg.org
+>kth.se                 #Royal Institute of Technology, Stockholm, Sweden
+130.237.32.145                  #sonen.e.kth.se
+130.237.48.7                    #anden.e.kth.se
+130.237.48.244                  #fadern.e.kth.se
+>ict.kth.se             #Royal Institute of Technology, Information and Communication tec
+130.237.216.11                  #afsdb1.ict.kth.se
+130.237.216.12                  #afsdb2.ict.kth.se
+130.237.216.13                  #afsdb3.ict.kth.se
+>isk.kth.se             #Royal Institute of Technology, ISK
+130.237.216.17                  #afsdb1.isk.kth.se
+130.237.216.82                  #afsdb2.isk.kth.se
+130.237.216.83                  #afsdb3.isk.kth.se
+>it.kth.se              #Royal Institute of Technology, Teleinformatics, Kista
+130.237.216.14                  #afsdb1.it.kth.se
+130.237.216.15                  #afsdb2.it.kth.se
+130.237.216.16                  #afsdb3.it.kth.se
+>md.kth.se              #Royal Institute of Technology, MMK
+130.237.57.21                   #euler.md.kth.se
+130.237.57.68                   #trinity.md.kth.se
+130.237.57.72                   #morpheus.md.kth.se
+>mech.kth.se            #Royal Institute of Technology, MECH
+130.237.233.142                 #matterhorn.mech.kth.se
+130.237.233.143                 #castor.mech.kth.se
+130.237.233.144                 #pollux.mech.kth.se
+>nada.kth.se            #Royal Institute of Technology, NADA
+130.237.222.20                  #kosmos.nada.kth.se
+130.237.223.12                  #sputnik.nada.kth.se
+130.237.224.78                  #mir.nada.kth.se
+130.237.227.23                  #gagarin.nada.kth.se
+130.237.228.28                  #laika.nada.kth.se
+>pdc.kth.se             #Royal Institute of Technology, PDC
+130.237.232.29                  #crab.pdc.kth.se
+130.237.232.112                 #anna.pdc.kth.se
+130.237.232.114                 #hokkigai.pdc.kth.se
+>stacken.kth.se         #Stacken Computer Club
+130.237.234.3                   #milko.stacken.kth.se
+130.237.234.43                  #hot.stacken.kth.se
+130.237.234.101                 #fishburger.stacken.kth.se
+>syd.kth.se             #Royal Institute of Technology, KTH-Syd
+130.237.83.23                   #afs.haninge.kth.se
+>physto.se              #Physics department Stockholm University
+130.237.205.36                  #sysafs1.physto.se
+130.237.205.72                  #sysafs2.physto.se
+>sanchin.se             #Sanchin Consulting AB, Sweden
+192.195.148.10                  #sesan.sanchin.se
+>su.se                  #Stockholm University
+130.237.162.81                  #afsdb1.su.se
+130.237.162.82                  #afsdb2.su.se
+130.237.162.230                 #afsdb3.su.se
+>f9.ijs.si              #F9, Jozef Stefan Institue
+194.249.156.1                   #brenta.ijs.si
+>p-ng.si                #Nova Gorica Polytechnic
+193.2.120.2                     #solkan.p-ng.si
+>ihep.su                #Institute for High-Energy Physics
+194.190.165.195                 #afssrv00.ihep.su
+>hep-ex.physics.metu.edu.tr #METU Department of Physics, Experimental HEP group, Ankara/Turke
+144.122.31.131                  #neutrino.physics.metu.edu.tr
+>phy.bris.ac.uk         #Bristol University - physics
+137.222.74.18                   #zen.phy.bris.ac.uk
+>inf.ed.ac.uk           #School of Informatics, University of Edinburgh
+129.215.64.16                   #afsdb0.inf.ed.ac.uk
+129.215.64.17                   #afsdb1.inf.ed.ac.uk
+129.215.64.18                   #afsdb2.inf.ed.ac.uk
+>ic.ac.uk               #Imperial College London
+155.198.63.148                  #icafs2.cc.ic.ac.uk
+155.198.63.149                  #icafs1.cc.ic.ac.uk
+>hep.man.ac.uk          #Manchester HEP
+194.36.2.3                      #afs1.hep.man.ac.uk
+194.36.2.4                      #afs2.hep.man.ac.uk
+194.36.2.5                      #afs3.hep.man.ac.uk
+>rl.ac.uk               #Rutherford Appleton Lab, England
+130.246.183.203                 #afs1.gridpp.rl.ac.uk
+130.246.183.204                 #afs2.gridpp.rl.ac.uk
+130.246.183.205                 #afs3.gridpp.rl.ac.uk
Index: tags/fc15-eol/server/fedora/config/usr/vice/etc/CellServDB.mousetrap
===================================================================
--- tags/fc15-eol/server/fedora/config/usr/vice/etc/CellServDB.mousetrap	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/usr/vice/etc/CellServDB.mousetrap	(revision 2244)
@@ -0,0 +1,1 @@
+>000                    #better-mousetrapfs (see /usr/local/sbin/better-mousetrapfs)
Index: tags/fc15-eol/server/fedora/config/usr/vice/etc/NetRestrict
===================================================================
--- tags/fc15-eol/server/fedora/config/usr/vice/etc/NetRestrict	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/usr/vice/etc/NetRestrict	(revision 2244)
@@ -0,0 +1,1 @@
+link /etc/openafs/NetRestrict
Index: tags/fc15-eol/server/fedora/config/usr/vice/etc/README
===================================================================
--- tags/fc15-eol/server/fedora/config/usr/vice/etc/README	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/usr/vice/etc/README	(revision 2244)
@@ -0,0 +1,14 @@
+CellServDB maintains a mapping of cell names to IP addresses of servers
+serving them.
+
+Under normal operation, CellServDB.dist (which is distributed by the
+OpenAFS package) and CellServDB.local (which is normally empty, but can
+be used to add local AFS cells.)
+
+However, we patch OpenAFS's systemd unit file to instead concatenate
+CellServDB.local (which is Athena Ops provided database) and
+CellServDB.mousetrap (which is a bogus entry for better-mousetrapfs,
+which catches and kills 'find /afs').
+
+CellServDB.mousetrap must be concatenated at the end, as readdir on
+/afs returns cells in reverse order they are in CellServDB.
Index: tags/fc15-eol/server/fedora/config/usr/vice/etc/ThisCell
===================================================================
--- tags/fc15-eol/server/fedora/config/usr/vice/etc/ThisCell	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/usr/vice/etc/ThisCell	(revision 2244)
@@ -0,0 +1,1 @@
+athena.mit.edu
Index: tags/fc15-eol/server/fedora/config/usr/vice/etc/cacheinfo
===================================================================
--- tags/fc15-eol/server/fedora/config/usr/vice/etc/cacheinfo	(revision 2244)
+++ tags/fc15-eol/server/fedora/config/usr/vice/etc/cacheinfo	(revision 2244)
@@ -0,0 +1,1 @@
+/afs:/usr/vice/cache:10000000
Index: tags/fc15-eol/server/fedora/ref-prepatch/README
===================================================================
--- tags/fc15-eol/server/fedora/ref-prepatch/README	(revision 2244)
+++ tags/fc15-eol/server/fedora/ref-prepatch/README	(revision 2244)
@@ -0,0 +1,5 @@
+This directory contains some reference Fedora source files that are known to
+work with our patches.
+
+This information is useful to have around when a patch does not apply or does
+not work.
Index: tags/fc15-eol/server/fedora/ref-prepatch/VERSIONS
===================================================================
--- tags/fc15-eol/server/fedora/ref-prepatch/VERSIONS	(revision 2244)
+++ tags/fc15-eol/server/fedora/ref-prepatch/VERSIONS	(revision 2244)
@@ -0,0 +1,2 @@
+krb5.spec and kuserok.c from FC6's krb5-1.5-7.src.rpm
+httpd.spec and suexec.c from FC6's httpd-2.2.3-5.src.rpm
Index: tags/fc15-eol/server/fedora/ref-prepatch/httpd.spec
===================================================================
--- tags/fc15-eol/server/fedora/ref-prepatch/httpd.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/ref-prepatch/httpd.spec	(revision 2244)
@@ -0,0 +1,686 @@
+%define contentdir /var/www
+%define suexec_caller apache
+%define mmn 20051115
+%define vstring Fedora
+%define distro Fedora Core
+
+Summary: Apache HTTP Server
+Name: httpd
+Version: 2.2.3
+Release: 5
+URL: http://httpd.apache.org/
+Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.gz
+Source1: index.html
+Source3: httpd.logrotate
+Source4: httpd.init
+Source5: httpd.sysconf
+Source7: powered_by_fedora.png
+Source10: httpd.conf
+Source11: ssl.conf
+Source12: welcome.conf
+Source13: manual.conf
+Source14: proxy_ajp.conf
+# Documentation
+Source30: migration.xml
+Source31: migration.css
+Source32: html.xsl
+Source33: README.confd
+# build/scripts patches
+Patch1: httpd-2.1.10-apctl.patch
+Patch2: httpd-2.1.10-apxs.patch
+Patch3: httpd-2.0.45-deplibs.patch
+Patch4: httpd-2.1.10-disablemods.patch
+Patch5: httpd-2.1.10-layout.patch
+Patch6: httpd-2.2.2-ac260.patch
+# Features/functional changes
+Patch20: httpd-2.0.48-release.patch
+Patch21: httpd-2.0.40-xfsz.patch
+Patch22: httpd-2.1.10-pod.patch
+Patch23: httpd-2.0.45-export.patch
+Patch24: httpd-2.0.48-corelimit.patch
+Patch25: httpd-2.0.54-selinux.patch
+# Bug fixes
+Patch50: httpd-2.0.45-encode.patch
+Patch54: httpd-2.2.0-authnoprov.patch
+License: Apache Software License
+Group: System Environment/Daemons
+BuildRoot: %{_tmppath}/%{name}-root
+BuildRequires: autoconf, perl, pkgconfig, xmlto >= 0.0.11, findutils
+BuildRequires: db4-devel, expat-devel, zlib-devel, libselinux-devel
+BuildRequires: apr-devel >= 1.2.0, apr-util-devel >= 1.2.0, pcre-devel >= 5.0, 
+Requires: /etc/mime.types, gawk, /usr/share/magic.mime, /usr/bin/find
+Requires: initscripts >= 8.36
+Obsoletes: httpd-suexec
+Prereq: /sbin/chkconfig, /bin/mktemp, /bin/rm, /bin/mv
+Prereq: sh-utils, textutils, /usr/sbin/useradd
+Provides: webserver
+Provides: httpd-mmn = %{mmn}
+Obsoletes: apache, secureweb, mod_dav, mod_gzip, stronghold-apache, stronghold-htdocs
+Obsoletes: mod_put, mod_roaming, mod_jk
+Conflicts: pcre < 4.0
+
+%description
+The Apache HTTP Server is a powerful, efficient, and extensible
+web server.
+
+%package devel
+Group: Development/Libraries
+Summary: Development tools for the Apache HTTP server.
+Obsoletes: secureweb-devel, apache-devel, stronghold-apache-devel
+Requires: apr-devel, apr-util-devel, pkgconfig
+Requires: httpd = %{version}-%{release}
+
+%description devel
+The httpd-devel package contains the APXS binary and other files
+that you need to build Dynamic Shared Objects (DSOs) for the
+Apache HTTP Server.
+
+If you are installing the Apache HTTP server and you want to be
+able to compile or develop additional modules for Apache, you need
+to install this package.
+
+%package manual
+Group: Documentation
+Summary: Documentation for the Apache HTTP server.
+Requires: httpd = %{version}-%{release}
+Obsoletes: secureweb-manual, apache-manual
+
+%description manual
+The httpd-manual package contains the complete manual and
+reference guide for the Apache HTTP server. The information can
+also be found at http://httpd.apache.org/docs/2.2/.
+
+%package -n mod_ssl
+Group: System Environment/Daemons
+Summary: SSL/TLS module for the Apache HTTP server
+Epoch: 1
+BuildRequires: openssl-devel, distcache-devel
+Requires(post): openssl >= 0.9.7f-4, /bin/cat
+Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmn}
+Obsoletes: stronghold-mod_ssl
+
+%description -n mod_ssl
+The mod_ssl module provides strong cryptography for the Apache Web
+server via the Secure Sockets Layer (SSL) and Transport Layer
+Security (TLS) protocols.
+
+%prep
+%setup -q
+%patch1 -p1 -b .apctl
+%patch2 -p1 -b .apxs
+%patch3 -p1 -b .deplibs
+%patch4 -p1 -b .disablemods
+%patch5 -p1 -b .layout
+%patch6 -p1 -b .ac260
+
+%patch21 -p0 -b .xfsz
+%patch22 -p1 -b .pod
+%patch23 -p1 -b .export
+%patch24 -p1 -b .corelimit
+%patch25 -p1 -b .selinux
+
+# no -b to prevent droplets in install root
+%patch50 -p1
+%patch54 -p1 -b .authnoprov
+
+# Patch in vendor/release string
+sed "s/@RELEASE@/%{vstring}/" < %{PATCH20} | patch -p1
+
+# Safety check: prevent build if defined MMN does not equal upstream MMN.
+vmmn=`echo MODULE_MAGIC_NUMBER_MAJOR | cpp -include include/ap_mmn.h | sed -n '/^2/p'`
+if test "x${vmmn}" != "x%{mmn}"; then
+   : Error: Upstream MMN is now ${vmmn}, packaged MMN is %{mmn}.
+   : Update the mmn macro and rebuild.
+   exit 1
+fi
+
+: Building for '%{distro}' with MMN %{mmn} and vendor string '%{vstring}'
+
+%build
+# forcibly prevent use of bundled apr, apr-util, pcre
+rm -rf srclib/{apr,apr-util,pcre}
+
+# regenerate configure scripts
+autoheader && autoconf || exit 1
+
+# Limit size of CHANGES to recent history
+echo '1,/Changes with Apache MPM/wq' | ed CHANGES
+
+# Before configure; fix location of build dir in generated apxs
+%{__perl} -pi -e "s:\@exp_installbuilddir\@:%{_libdir}/httpd/build:g" \
+	support/apxs.in
+# update location of migration guide in apachectl
+%{__perl} -pi -e "s:\@docdir\@:%{_docdir}/%{name}-%{version}:g" \
+	support/apachectl.in
+
+# Build the migration guide
+sed 's/@DISTRO@/%{distro}/' < $RPM_SOURCE_DIR/migration.xml > migration.xml
+xmlto -x $RPM_SOURCE_DIR/html.xsl html-nochunks migration.xml
+cp $RPM_SOURCE_DIR/migration.css . # make %%doc happy
+
+CFLAGS=$RPM_OPT_FLAGS
+SH_LDFLAGS="-Wl,-z,relro"
+export CFLAGS SH_LDFLAGS
+
+function mpmbuild()
+{
+mpm=$1; shift
+mkdir $mpm; pushd $mpm
+../configure \
+ 	--prefix=%{_sysconfdir}/httpd \
+ 	--exec-prefix=%{_prefix} \
+ 	--bindir=%{_bindir} \
+ 	--sbindir=%{_sbindir} \
+ 	--mandir=%{_mandir} \
+	--libdir=%{_libdir} \
+	--sysconfdir=%{_sysconfdir}/httpd/conf \
+	--includedir=%{_includedir}/httpd \
+	--libexecdir=%{_libdir}/httpd/modules \
+	--datadir=%{contentdir} \
+        --with-installbuilddir=%{_libdir}/httpd/build \
+	--with-mpm=$mpm \
+        --with-apr=%{_prefix} --with-apr-util=%{_prefix} \
+	--enable-suexec --with-suexec \
+	--with-suexec-caller=%{suexec_caller} \
+	--with-suexec-docroot=%{contentdir} \
+	--with-suexec-logfile=%{_localstatedir}/log/httpd/suexec.log \
+	--with-suexec-bin=%{_sbindir}/suexec \
+	--with-suexec-uidmin=500 --with-suexec-gidmin=100 \
+        --enable-pie \
+        --with-pcre \
+	$*
+
+make %{?_smp_mflags}
+popd
+}
+
+# Build everything and the kitchen sink with the prefork build
+mpmbuild prefork \
+        --enable-mods-shared=all \
+	--enable-ssl --with-ssl --enable-distcache \
+	--enable-proxy \
+        --enable-cache --enable-mem-cache \
+        --enable-file-cache --enable-disk-cache \
+        --enable-ldap --enable-authnz-ldap \
+        --enable-cgid \
+        --enable-authn-anon --enable-authn-alias
+
+# For the other MPMs, just build httpd and no optional modules
+mpmbuild worker --enable-modules=none
+#mpmbuild event --enable-modules=none
+
+%install
+rm -rf $RPM_BUILD_ROOT
+
+# Classify ab and logresolve as section 1 commands, as they are in /usr/bin
+mv docs/man/ab.8 docs/man/ab.1
+mv docs/man/logresolve.8 docs/man/logresolve.1
+
+pushd prefork
+make DESTDIR=$RPM_BUILD_ROOT install
+popd
+
+# install alternative MPMs
+install -m 755 worker/httpd $RPM_BUILD_ROOT%{_sbindir}/httpd.worker
+#install -m 755 event/httpd $RPM_BUILD_ROOT%{_sbindir}/httpd.event
+
+# install conf file/directory
+mkdir $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.d
+install -m 644 $RPM_SOURCE_DIR/README.confd \
+    $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.d/README
+for f in ssl.conf welcome.conf manual.conf proxy_ajp.conf; do
+  install -m 644 $RPM_SOURCE_DIR/$f $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf.d/$f
+done
+
+rm $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf/*.conf
+install -m 644 $RPM_SOURCE_DIR/httpd.conf \
+   $RPM_BUILD_ROOT%{_sysconfdir}/httpd/conf/httpd.conf
+
+mkdir $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig
+install -m 644 $RPM_SOURCE_DIR/httpd.sysconf \
+   $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/httpd
+
+# for holding mod_dav lock database
+mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/lib/dav
+
+# create a prototype session cache
+mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/cache/mod_ssl
+touch $RPM_BUILD_ROOT%{_localstatedir}/cache/mod_ssl/scache.{dir,pag,sem}
+
+# create cache root
+mkdir $RPM_BUILD_ROOT%{_localstatedir}/cache/mod_proxy
+
+# move utilities to /usr/bin
+mv $RPM_BUILD_ROOT%{_sbindir}/{ab,htdbm,logresolve,htpasswd,htdigest} \
+   $RPM_BUILD_ROOT%{_bindir}
+
+# Make the MMN accessible to module packages
+echo %{mmn} > $RPM_BUILD_ROOT%{_includedir}/httpd/.mmn
+
+# docroot
+mkdir $RPM_BUILD_ROOT%{contentdir}/html
+install -m 644 $RPM_SOURCE_DIR/index.html \
+	$RPM_BUILD_ROOT%{contentdir}/error/noindex.html
+
+# remove manual sources
+find $RPM_BUILD_ROOT%{contentdir}/manual \( \
+    -name \*.xml -o -name \*.xml.* -o -name \*.ent -o -name \*.xsl -o -name \*.dtd \
+    \) -print0 | xargs -0 rm -f
+
+# Strip the manual down just to English and replace the typemaps with flat files:
+set +x
+for f in `find $RPM_BUILD_ROOT%{contentdir}/manual -name \*.html -type f`; do
+   if test -f ${f}.en; then
+      cp ${f}.en ${f}
+      rm ${f}.*
+   fi
+done
+set -x
+
+install -m 644 $RPM_SOURCE_DIR/powered_by_fedora.png \
+	$RPM_BUILD_ROOT%{contentdir}/icons
+
+# logs
+rmdir $RPM_BUILD_ROOT%{_sysconfdir}/httpd/logs
+mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/log/httpd
+
+# symlinks for /etc/httpd
+ln -s ../..%{_localstatedir}/log/httpd $RPM_BUILD_ROOT/etc/httpd/logs
+ln -s ../..%{_localstatedir}/run $RPM_BUILD_ROOT/etc/httpd/run
+ln -s ../..%{_libdir}/httpd/modules $RPM_BUILD_ROOT/etc/httpd/modules
+
+# install SYSV init stuff
+mkdir -p $RPM_BUILD_ROOT/etc/rc.d/init.d
+install -m755 $RPM_SOURCE_DIR/httpd.init \
+	$RPM_BUILD_ROOT/etc/rc.d/init.d/httpd
+%{__perl} -pi -e "s:\@docdir\@:%{_docdir}/%{name}-%{version}:g" \
+	$RPM_BUILD_ROOT/etc/rc.d/init.d/httpd	
+
+# install log rotation stuff
+mkdir -p $RPM_BUILD_ROOT/etc/logrotate.d
+install -m644 $RPM_SOURCE_DIR/httpd.logrotate \
+	$RPM_BUILD_ROOT/etc/logrotate.d/httpd
+
+# fix man page paths
+sed -e "s|/usr/local/apache2/conf/httpd.conf|/etc/httpd/conf/httpd.conf|" \
+    -e "s|/usr/local/apache2/conf/mime.types|/etc/mime.types|" \
+    -e "s|/usr/local/apache2/conf/magic|/etc/httpd/conf/magic|" \
+    -e "s|/usr/local/apache2/logs/error_log|/var/log/httpd/error_log|" \
+    -e "s|/usr/local/apache2/logs/access_log|/var/log/httpd/access_log|" \
+    -e "s|/usr/local/apache2/logs/httpd.pid|/var/run/httpd.pid|" \
+    -e "s|/usr/local/apache2|/etc/httpd|" < docs/man/httpd.8 \
+  > $RPM_BUILD_ROOT%{_mandir}/man8/httpd.8
+
+# Make ap_config_layout.h libdir-agnostic
+sed -i '/.*DEFAULT_..._LIBEXECDIR/d;/DEFAULT_..._INSTALLBUILDDIR/d' \
+    $RPM_BUILD_ROOT%{_includedir}/httpd/ap_config_layout.h
+
+# Remove unpackaged files
+rm -f $RPM_BUILD_ROOT%{_libdir}/*.exp \
+      $RPM_BUILD_ROOT/etc/httpd/conf/mime.types \
+      $RPM_BUILD_ROOT%{_libdir}/httpd/modules/*.exp \
+      $RPM_BUILD_ROOT%{_libdir}/httpd/build/config.nice \
+      $RPM_BUILD_ROOT%{_bindir}/ap?-config \
+      $RPM_BUILD_ROOT%{_sbindir}/{checkgid,dbmmanage,envvars*} \
+      $RPM_BUILD_ROOT%{contentdir}/htdocs/* \
+      $RPM_BUILD_ROOT%{_mandir}/man1/dbmmanage.* \
+      $RPM_BUILD_ROOT%{contentdir}/cgi-bin/*
+
+rm -rf $RPM_BUILD_ROOT/etc/httpd/conf/{original,extra}
+
+# Make suexec a+rw so it can be stripped.  %%files lists real permissions
+chmod 755 $RPM_BUILD_ROOT%{_sbindir}/suexec
+
+%pre
+# Add the "apache" user
+/usr/sbin/useradd -c "Apache" -u 48 \
+	-s /sbin/nologin -r -d %{contentdir} apache 2> /dev/null || :
+
+%triggerpostun -- apache < 2.0, stronghold-apache < 2.0
+/sbin/chkconfig --add httpd
+
+# Prevent removal of index.html on upgrades from 1.3
+%triggerun -- apache < 2.0, stronghold-apache < 2.0
+if [ -r %{contentdir}/index.html -a ! -r %{contentdir}/index.html.rpmold ]; then
+  mv %{contentdir}/index.html %{contentdir}/index.html.rpmold
+fi
+
+%post
+# Register the httpd service
+/sbin/chkconfig --add httpd
+
+%preun
+if [ $1 = 0 ]; then
+	/sbin/service httpd stop > /dev/null 2>&1
+	/sbin/chkconfig --del httpd
+fi
+
+%define sslcert %{_sysconfdir}/pki/tls/certs/localhost.crt
+%define sslkey %{_sysconfdir}/pki/tls/private/localhost.key
+
+%post -n mod_ssl
+umask 077
+
+if [ ! -f %{sslkey} ] ; then
+%{_bindir}/openssl genrsa -rand /proc/apm:/proc/cpuinfo:/proc/dma:/proc/filesystems:/proc/interrupts:/proc/ioports:/proc/pci:/proc/rtc:/proc/uptime 1024 > %{sslkey} 2> /dev/null
+fi
+
+FQDN=`hostname`
+if [ "x${FQDN}" = "x" ]; then
+   FQDN=localhost.localdomain
+fi
+
+if [ ! -f %{sslcert} ] ; then
+cat << EOF | %{_bindir}/openssl req -new -key %{sslkey} \
+         -x509 -days 365 -set_serial $RANDOM \
+         -out %{sslcert} 2>/dev/null
+--
+SomeState
+SomeCity
+SomeOrganization
+SomeOrganizationalUnit
+${FQDN}
+root@${FQDN}
+EOF
+fi
+
+%check
+# Check the built modules are all PIC
+if readelf -d $RPM_BUILD_ROOT%{_libdir}/httpd/modules/*.so | grep TEXTREL; then
+   : modules contain non-relocatable code
+   exit 1
+fi
+
+# Verify that the same modules were built into the httpd binaries
+./prefork/httpd -l | grep -v prefork > prefork.mods
+for mpm in worker; do
+  ./${mpm}/httpd -l | grep -v ${mpm} > ${mpm}.mods
+  if ! diff -u prefork.mods ${mpm}.mods; then
+    : Different modules built into httpd binaries, will not proceed
+    exit 1
+  fi
+done
+
+%clean
+rm -rf $RPM_BUILD_ROOT
+
+%files
+%defattr(-,root,root)
+
+%doc ABOUT_APACHE README CHANGES LICENSE VERSIONING NOTICE
+%doc migration.html migration.css
+
+%dir %{_sysconfdir}/httpd
+%{_sysconfdir}/httpd/modules
+%{_sysconfdir}/httpd/logs
+%{_sysconfdir}/httpd/run
+%dir %{_sysconfdir}/httpd/conf
+%config %{_sysconfdir}/httpd/conf/httpd.conf
+%config(noreplace) %{_sysconfdir}/httpd/conf.d/welcome.conf
+%config(noreplace) %{_sysconfdir}/httpd/conf.d/proxy_ajp.conf
+%config(noreplace) %{_sysconfdir}/httpd/conf/magic
+
+%config(noreplace) %{_sysconfdir}/logrotate.d/httpd
+%config %{_sysconfdir}/rc.d/init.d/httpd
+
+%dir %{_sysconfdir}/httpd/conf.d
+%{_sysconfdir}/httpd/conf.d/README
+
+%config(noreplace) %{_sysconfdir}/sysconfig/httpd
+
+%{_bindir}/*
+%{_sbindir}/ht*
+%{_sbindir}/apachectl
+%{_sbindir}/rotatelogs
+%attr(4510,root,%{suexec_caller}) %{_sbindir}/suexec
+
+%dir %{_libdir}/httpd
+%dir %{_libdir}/httpd/modules
+%{_libdir}/httpd/modules/mod*.so
+%exclude %{_libdir}/httpd/modules/mod_ssl.so
+
+%dir %{contentdir}
+%dir %{contentdir}/cgi-bin
+%dir %{contentdir}/html
+%dir %{contentdir}/icons
+%dir %{contentdir}/error
+%dir %{contentdir}/error/include
+%{contentdir}/icons/*
+%{contentdir}/error/README
+%{contentdir}/error/noindex.html
+%config %{contentdir}/error/*.var
+%config %{contentdir}/error/include/*.html
+
+%attr(0700,root,root) %dir %{_localstatedir}/log/httpd
+%attr(0700,apache,apache) %dir %{_localstatedir}/lib/dav
+%attr(0700,apache,apache) %dir %{_localstatedir}/cache/mod_proxy
+
+%{_mandir}/man?/*
+%exclude %{_mandir}/man8/apxs.8*
+
+%files manual
+%defattr(-,root,root)
+%{contentdir}/manual
+%config %{_sysconfdir}/httpd/conf.d/manual.conf
+
+%files -n mod_ssl
+%defattr(-,root,root)
+%{_libdir}/httpd/modules/mod_ssl.so
+%config(noreplace) %{_sysconfdir}/httpd/conf.d/ssl.conf
+%attr(0700,apache,root) %dir %{_localstatedir}/cache/mod_ssl
+%attr(0600,apache,root) %ghost %{_localstatedir}/cache/mod_ssl/scache.dir
+%attr(0600,apache,root) %ghost %{_localstatedir}/cache/mod_ssl/scache.pag
+%attr(0600,apache,root) %ghost %{_localstatedir}/cache/mod_ssl/scache.sem
+
+%files devel
+%defattr(-,root,root)
+%{_includedir}/httpd
+%{_sbindir}/apxs
+%{_mandir}/man8/apxs.8*
+%dir %{_libdir}/httpd/build
+%{_libdir}/httpd/build/*.mk
+%{_libdir}/httpd/build/*.sh
+
+%changelog
+* Mon Sep 11 2006 Joe Orton <jorton@redhat.com> 2.2.3-5
+- updated "powered by Fedora" logo (#205573, Diana Fong)
+- tweak welcome page wording slightly (#205880)
+
+* Fri Aug 18 2006 Jesse Keating <jkeating@redhat.com> - 2.2.3-4
+- rebuilt with latest binutils to pick up 64K -z commonpagesize on ppc*
+  (#203001)
+
+* Thu Aug  3 2006 Joe Orton <jorton@redhat.com> 2.2.3-3
+- init: use killproc() delay to avoid race killing parent
+
+* Fri Jul 28 2006 Joe Orton <jorton@redhat.com> 2.2.3-2
+- update to 2.2.3
+- trim %%changelog to >=2.0.52
+
+* Thu Jul 20 2006 Joe Orton <jorton@redhat.com> 2.2.2-8
+- fix segfault on dummy connection failure at graceful restart (#199429)
+
+* Wed Jul 19 2006 Joe Orton <jorton@redhat.com> 2.2.2-7
+- fix "apxs -g"-generated Makefile
+- fix buildconf with autoconf 2.60
+
+* Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 2.2.2-5.1
+- rebuild
+
+* Wed Jun  7 2006 Joe Orton <jorton@redhat.com> 2.2.2-5
+- require pkgconfig for -devel (#194152)
+- fixes for installed support makefiles (special.mk et al)
+- BR autoconf
+
+* Fri Jun  2 2006 Joe Orton <jorton@redhat.com> 2.2.2-4
+- make -devel package multilib-safe (#192686)
+
+* Thu May 11 2006 Joe Orton <jorton@redhat.com> 2.2.2-3
+- build DSOs using -z relro linker flag
+
+* Wed May  3 2006 Joe Orton <jorton@redhat.com> 2.2.2-2
+- update to 2.2.2
+
+* Thu Apr  6 2006 Joe Orton <jorton@redhat.com> 2.2.0-6
+- rebuild to pick up apr-util LDAP interface fix (#188073)
+
+* Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> - (none):2.2.0-5.1.2
+- bump again for double-long bug on ppc(64)
+
+* Tue Feb 07 2006 Jesse Keating <jkeating@redhat.com> - (none):2.2.0-5.1.1
+- rebuilt for new gcc4.1 snapshot and glibc changes
+
+* Mon Feb  6 2006 Joe Orton <jorton@redhat.com> 2.2.0-5.1
+- mod_auth_basic/mod_authn_file: if no provider is configured,
+  and AuthUserFile is not configured, decline to handle authn
+  silently rather than failing noisily.
+
+* Fri Feb  3 2006 Joe Orton <jorton@redhat.com> 2.2.0-5
+- mod_ssl: add security fix for CVE-2005-3357 (#177914)
+- mod_imagemap: add security fix for CVE-2005-3352 (#177913)
+- add fix for AP_INIT_* designated initializers with C++ compilers
+- httpd.conf: enable HTMLTable in default IndexOptions
+- httpd.conf: add more "redirect-carefully" matches for DAV clients
+
+* Thu Jan  5 2006 Joe Orton <jorton@redhat.com> 2.2.0-4
+- mod_proxy_ajp: fix Cookie handling (Mladen Turk, r358769)
+
+* Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>
+- rebuilt
+
+* Wed Dec  7 2005 Joe Orton <jorton@redhat.com> 2.2.0-3
+- strip manual to just English content
+
+* Mon Dec  5 2005 Joe Orton <jorton@redhat.com> 2.2.0-2
+- don't strip C-L from HEAD responses (Greg Ames, #110552)
+- load mod_proxy_balancer by default
+- add proxy_ajp.conf to load/configure mod_proxy_ajp
+- Obsolete mod_jk
+- update docs URLs in httpd.conf/ssl.conf
+
+* Fri Dec  2 2005 Joe Orton <jorton@redhat.com> 2.2.0-1
+- update to 2.2.0
+
+* Wed Nov 30 2005 Joe Orton <jorton@redhat.com> 2.1.10-2
+- enable mod_authn_alias, mod_authn_anon
+- update default httpd.conf
+
+* Fri Nov 25 2005 Joe Orton <jorton@redhat.com> 2.1.10-1
+- update to 2.1.10
+- require apr >= 1.2.0, apr-util >= 1.2.0
+
+* Wed Nov  9 2005 Tomas Mraz <tmraz@redhat.com> 2.0.54-16
+- rebuilt against new openssl
+
+* Thu Nov  3 2005 Joe Orton <jorton@redhat.com> 2.0.54-15
+- log notice giving SELinux context at startup if enabled
+- drop SSLv2 and restrict default cipher suite in default
+ SSL configuration
+
+* Thu Oct 20 2005 Joe Orton <jorton@redhat.com> 2.0.54-14
+- mod_ssl: add security fix for SSLVerifyClient (CVE-2005-2700)
+- add security fix for byterange filter DoS (CVE-2005-2728)
+- add security fix for C-L vs T-E handling (CVE-2005-2088)
+- mod_ssl: add security fix for CRL overflow (CVE-2005-1268)
+- mod_ldap/mod_auth_ldap: add fixes from 2.0.x branch (upstream #34209 etc)
+- add fix for dummy connection handling (#167425)
+- mod_auth_digest: fix hostinfo comparison in CONNECT requests
+- mod_include: fix variable corruption in nested includes (upstream #12655)
+- mod_ssl: add fix for handling non-blocking reads
+- mod_ssl: fix to enable output buffering (upstream #35279)
+- mod_ssl: buffer request bodies for per-location renegotiation (upstream #12355)
+
+* Sat Aug 13 2005 Joe Orton <jorton@redhat.com> 2.0.54-13
+- don't load by default: mod_cern_meta, mod_asis
+- do load by default: mod_ext_filter (#165893)
+
+* Thu Jul 28 2005 Joe Orton <jorton@redhat.com> 2.0.54-12
+- drop broken epoch deps
+
+* Thu Jun 30 2005 Joe Orton <jorton@redhat.com> 2.0.54-11
+- mod_dav_fs: fix uninitialized variable (#162144)
+- add epoch to dependencies as appropriate
+- mod_ssl: drop dependencies on dev, make
+- mod_ssl: mark post script dependencies as such
+
+* Mon May 23 2005 Joe Orton <jorton@redhat.com> 2.0.54-10
+- remove broken symlink (Robert Scheck, #158404)
+
+* Wed May 18 2005 Joe Orton <jorton@redhat.com> 2.0.54-9
+- add piped logger fixes (w/Jeff Trawick)
+
+* Mon May  9 2005 Joe Orton <jorton@redhat.com> 2.0.54-8
+- drop old "powered by Red Hat" logos
+
+* Wed May  4 2005 Joe Orton <jorton@redhat.com> 2.0.54-7
+- mod_userdir: fix memory allocation issue (upstream #34588)
+- mod_ldap: fix memory corruption issue (Brad Nicholes, upstream #34618)
+
+* Tue Apr 26 2005 Joe Orton <jorton@redhat.com> 2.0.54-6
+- fix key/cert locations in post script
+
+* Mon Apr 25 2005 Joe Orton <jorton@redhat.com> 2.0.54-5
+- create default dummy cert in /etc/pki/tls
+- use a pseudo-random serial number on the dummy cert
+- change default ssl.conf to point at /etc/pki/tls
+- merge back -suexec subpackage; SELinux policy can now be
+  used to persistently disable suexec (#155716)
+- drop /etc/httpd/conf/ssl.* directories and Makefiles
+- unconditionally enable PIE support
+- mod_ssl: fix for picking up -shutdown options (upstream #34452)
+
+* Mon Apr 18 2005 Joe Orton <jorton@redhat.com> 2.0.54-4
+- replace PreReq with Requires(pre) 
+
+* Mon Apr 18 2005 Joe Orton <jorton@redhat.com> 2.0.54-3
+- update to 2.0.54
+
+* Tue Mar 29 2005 Joe Orton <jorton@redhat.com> 2.0.53-6
+- update default httpd.conf:
+ * clarify the comments on AddDefaultCharset usage (#135821)
+ * remove all the AddCharset default extensions
+ * don't load mod_imap by default
+ * synch with upstream 2.0.53 httpd-std.conf
+- mod_ssl: set user from SSLUserName in access hook (upstream #31418)
+- htdigest: fix permissions of created files (upstream #33765)
+- remove htsslpass
+
+* Wed Mar  2 2005 Joe Orton <jorton@redhat.com> 2.0.53-5
+- apachectl: restore use of $OPTIONS again
+
+* Wed Feb  9 2005 Joe Orton <jorton@redhat.com> 2.0.53-4
+- update to 2.0.53
+- move prefork/worker modules comparison to %%check
+
+* Mon Feb  7 2005 Joe Orton <jorton@redhat.com> 2.0.52-7
+- fix cosmetic issues in "service httpd reload"
+- move User/Group higher in httpd.conf (#146793)
+- load mod_logio by default in httpd.conf
+- apachectl: update for correct libselinux tools locations
+
+* Tue Nov 16 2004 Joe Orton <jorton@redhat.com> 2.0.52-6
+- add security fix for CVE CAN-2004-0942 (memory consumption DoS)
+- SELinux: run httpd -t under runcon in configtest (Steven Smalley)
+- fix SSLSessionCache comment for distcache in ssl.conf
+- restart using SIGHUP not SIGUSR1 after logrotate
+- add ap_save_brigade fix (upstream #31247)
+- mod_ssl: fix possible segfault in auth hook (upstream #31848)
+- add htsslpass(1) and configure as default SSLPassPhraseDialog (#128677)
+- apachectl: restore use of $OPTIONS
+- apachectl, httpd.init: refuse to restart if $HTTPD -t fails
+- apachectl: run $HTTPD -t in user SELinux context for configtest
+- update for pcre-5.0 header locations
+
+* Sat Nov 13 2004 Jeff Johnson <jbj@redhat.com> 2.0.52-5
+- rebuild against db-4.3.21 aware apr-util.
+
+* Thu Nov 11 2004 Jeff Johnson <jbj@jbj.org> 2.0.52-4
+- rebuild against db-4.3-21.
+
+* Thu Sep 28 2004 Joe Orton <jorton@redhat.com> 2.0.52-3
+- add dummy connection address fixes from HEAD
+- mod_ssl: add security fix for CAN-2004-0885
+
+* Tue Sep 28 2004 Joe Orton <jorton@redhat.com> 2.0.52-2
+- update to 2.0.52
+
Index: tags/fc15-eol/server/fedora/ref-prepatch/krb5.spec
===================================================================
--- tags/fc15-eol/server/fedora/ref-prepatch/krb5.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/ref-prepatch/krb5.spec	(revision 2244)
@@ -0,0 +1,1309 @@
+%if %{?WITH_SELINUX:0}%{!?WITH_SELINUX:1}
+%define WITH_SELINUX 0
+%endif
+
+%define krb5prefix %{_prefix}/kerberos
+
+# FIXME: is it upstream's intention that the new autoconf macro be installed?
+%define install_macro 0
+
+Summary: The Kerberos network authentication system.
+Name: krb5
+Version: 1.5
+Release: 7
+# Maybe we should explode from the now-available-to-everybody tarball instead?
+# http://web.mit.edu/kerberos/dist/krb5/1.5/krb5-1.5-signed.tar
+Source0: krb5-%{version}.tar.gz
+Source1: krb5-%{version}.tar.gz.asc
+Source2: kpropd.init
+Source3: krb524d.init
+Source4: kadmind.init
+Source5: krb5kdc.init
+Source6: krb5.conf
+Source7: krb5.sh
+Source8: krb5.csh
+Source9: kdcrotate
+Source10: kdc.conf
+Source11: kadm5.acl
+Source12: krsh
+Source13: krlogin
+Source14: eklogin.xinetd
+Source15: klogin.xinetd
+Source16: kshell.xinetd
+Source17: krb5-telnet.xinetd
+Source18: gssftp.xinetd
+Source19: krb5kdc.sysconfig
+Source20: kadmin.sysconfig
+Source21: krb524.sysconfig
+Source22: ekrb5-telnet.xinetd
+
+Patch2: krb5-1.3-manpage-paths.patch
+Patch3: krb5-1.3-netkit-rsh.patch
+Patch4: krb5-1.3-rlogind-environ.patch
+Patch5: krb5-1.3-ksu-access.patch
+Patch6: krb5-1.5-ksu-path.patch
+Patch9: krb5-1.5-brokenrev.patch
+Patch11: krb5-1.2.1-passive.patch
+Patch12: krb5-1.4-ktany.patch
+Patch13: krb5-1.3-large-file.patch
+Patch14: krb5-1.3-ftp-glob.patch
+Patch15: krb5-1.3-check.patch
+Patch16: krb5-1.5-no-rpath.patch
+Patch18: krb5-1.2.7-reject-bad-transited.patch
+Patch21: krb5-selinux.patch
+Patch23: krb5-1.3.1-dns.patch
+Patch25: krb5-1.4-null.patch
+Patch26: krb5-1.3.2-efence.patch
+Patch27: krb5-1.3.3-rcp-sendlarge.patch
+Patch29: krb5-1.3.5-kprop-mktemp.patch
+Patch30: krb5-1.3.4-send-pr-tempfile.patch
+Patch32: krb5-1.4-ncurses.patch
+Patch33: krb5-1.5-io.patch
+Patch35: krb5-1.5-fclose.patch
+Patch36: krb5-1.3.3-rcp-markus.patch
+Patch39: krb5-1.4.1-api.patch
+Patch40: krb5-1.4.1-telnet-environ.patch
+Patch41: krb5-1.2.7-login-lpass.patch
+Patch44: krb5-1.4.3-enospc.patch
+Patch45: krb5-1.5-gssinit.patch
+Patch46: http://web.mit.edu/kerberos/advisories/2006-001-patch_1.5.txt
+
+License: MIT, freely distributable.
+URL: http://web.mit.edu/kerberos/www/
+Group: System Environment/Libraries
+BuildRoot: %{_tmppath}/%{name}-%{version}-root
+Prereq: grep, info, sh-utils, /sbin/install-info
+BuildPrereq: autoconf, bison, e2fsprogs-devel >= 1.35, flex
+BuildPrereq: gzip, ncurses-devel, rsh, texinfo, tar
+
+Patch1000: krb5-kuserok-scripts.patch
+
+%description
+Kerberos V5 is a trusted-third-party network authentication system,
+which can improve your network's security by eliminating the insecure
+practice of cleartext passwords.
+
+%package devel
+Summary: Development files needed to compile Kerberos 5 programs.
+Group: Development/Libraries
+Requires: %{name}-libs = %{version}-%{release}, e2fsprogs-devel
+
+%description devel
+Kerberos is a network authentication system. The krb5-devel package
+contains the header files and libraries needed for compiling Kerberos
+5 programs. If you want to develop Kerberos-aware programs, you need
+to install this package.
+
+%package libs
+Summary: The shared libraries used by Kerberos 5.
+Group: System Environment/Libraries
+Prereq: grep, /sbin/ldconfig, sh-utils
+Obsoletes: krb5-configs
+
+%description libs
+Kerberos is a network authentication system. The krb5-libs package
+contains the shared libraries needed by Kerberos 5. If you are using
+Kerberos, you need to install this package.
+
+%package server
+Group: System Environment/Daemons
+Summary: The server programs for Kerberos 5.
+Requires: %{name}-libs = %{version}-%{release}
+Prereq: grep, /sbin/install-info, /bin/sh, sh-utils, /sbin/chkconfig
+
+%description server
+Kerberos is a network authentication system. The krb5-server package
+contains the programs that must be installed on a Kerberos 5 server.
+If you are installing a Kerberos 5 server, you need to install this
+package (in other words, most people should NOT install this
+package).
+
+%package workstation
+Summary: Kerberos 5 programs for use on workstations.
+Group: System Environment/Base
+Requires: %{name}-libs = %{version}-%{release}
+Prereq: grep, /sbin/install-info, /bin/sh, sh-utils
+# mktemp is used by krb5-send-pr
+Requires: mktemp
+
+%description workstation
+Kerberos is a network authentication system. The krb5-workstation
+package contains the basic Kerberos programs (kinit, klist, kdestroy,
+kpasswd) as well as kerberized versions of Telnet and FTP. If your
+network uses Kerberos, this package should be installed on every
+workstation.
+
+%changelog
+* Wed Sep  6 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-7
+- set SS_LIB at configure-time so that libss-using apps get working readline
+  support (#197044)
+
+* Fri Aug 18 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-6
+- switch to the updated patch for MITKRB-SA-2006-001
+
+* Tue Aug  8 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-5
+- apply patch to address MITKRB-SA-2006-001 (CVE-2006-3084)
+
+* Mon Aug  7 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-4
+- ensure that the gssapi library's been initialized before walking the
+  internal mechanism list in gss_release_oid(), needed if called from
+  gss_release_name() right after a gss_import_name() (#198092)
+
+* Tue Jul 25 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-3
+- rebuild
+
+* Tue Jul 25 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-2
+- pull up latest revision of patch to reduce lockups in rsh/rshd
+
+* Mon Jul 17 2006 Nalin Dahyabhai <nalin@redhat.com> - 1.5-1.2
+- rebuild
+
+* Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 1.5-1.1
+- rebuild
+
+* Thu Jul  6 2006 Nalin Dahyabhai <nalin@redhat.com> 1.5-1
+- build
+
+* Wed Jul  5 2006 Nalin Dahyabhai <nalin@redhat.com> 1.5-0
+- update to 1.5
+
+* Fri Jun 23 2006 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-9
+- mark profile.d config files noreplace (Laurent Rineau, #196447)
+
+* Thu Jun  8 2006 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-8
+- add buildprereq for autoconf
+
+* Mon May 22 2006 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-7
+- further munge krb5-config so that 'libdir=/usr/lib' is given even on 64-bit
+  architectures, to avoid multilib conflicts; other changes will conspire to
+  strip out the -L flag which uses this, so it should be harmless (#192692)
+
+* Fri Apr 28 2006 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-6
+- adjust the patch which removes the use of rpath to also produce a
+  krb5-config which is okay in multilib environments (#190118)
+- make the name-of-the-tempfile comment which compile_et adds to error code
+  headers always list the same file to avoid conflicts on multilib installations
+- strip SIZEOF_LONG out of krb5.h so that it doesn't conflict on multilib boxes
+- strip GSS_SIZEOF_LONG out of gssapi.h so that it doesn't conflict on mulitlib
+  boxes
+
+* Fri Apr 14 2006 Stepan Kasal <skasal@redhat.com> 1.4.3-5
+- Fix formatting typo in kinit.1 (krb5-kinit-man-typo.patch)
+
+* Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> 1.4.3-4.1
+- bump again for double-long bug on ppc(64)
+
+* Mon Feb  6 2006 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-4
+- give a little bit more information to the user when kinit gets the catch-all
+  I/O error (#180175)
+
+* Thu Jan 19 2006 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-3
+- rebuild properly when pthread_mutexattr_setrobust_np() is defined but not
+  declared, such as with recent glibc when _GNU_SOURCE isn't being used
+
+* Thu Jan 19 2006 Matthias Clasen <mclasen@redhat.com> 1.4.3-2
+- Use full paths in krb5.sh to avoid path lookups
+
+* Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>
+- rebuilt
+
+* Thu Dec  1 2005 Nalin Dahyabhai <nalin@redhat.com>
+- login: don't truncate passwords before passing them into crypt(), in
+  case they're significant (#149476)
+
+* Thu Nov 17 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-1
+- update to 1.4.3
+- make ksu setuid again (#137934, others)
+
+* Tue Sep 13 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.2-4
+- mark %%{krb5prefix}/man so that files which are packaged within it are
+  flagged as %%doc (#168163)
+
+* Tue Sep  6 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.2-3
+- add an xinetd configuration file for encryption-only telnetd, parallelling
+  the kshell/ekshell pair (#167535)
+
+* Wed Aug 31 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.2-2
+- change the default configured encryption type for KDC databases to the
+  compiled-in default of des3-hmac-sha1 (#57847)
+
+* Thu Aug 11 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.2-1
+- update to 1.4.2, incorporating the fixes for MIT-KRB5-SA-2005-002 and
+  MIT-KRB5-SA-2005-003
+
+* Wed Jun 29 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.1-6
+- rebuild
+
+* Wed Jun 29 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.1-5
+- fix telnet client environment variable disclosure the same way NetKit's
+  telnet client did (CAN-2005-0488) (#159305)
+- keep apps which call krb5_principal_compare() or krb5_realm_compare() with
+  malformed or NULL principal structures from crashing outright (Thomas Biege)
+  (#161475)
+
+* Tue Jun 28 2005 Nalin Dahyabhai <nalin@redhat.com>
+- apply fixes from draft of MIT-KRB5-SA-2005-002 (CAN-2005-1174,CAN-2005-1175)
+  (#157104)
+- apply fixes from draft of MIT-KRB5-SA-2005-003 (CAN-2005-1689) (#159755)
+
+* Fri Jun 24 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.1-4
+- fix double-close in keytab handling
+- add port of fixes for CAN-2004-0175 to krb5-aware rcp (#151612)
+
+* Fri May 13 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.1-3
+- prevent spurious EBADF in krshd when stdin is closed by the client while
+  the command is running (#151111)
+
+* Fri May 13 2005 Martin Stransky <stransky@redhat.com> 1.4.1-2
+- add deadlock patch, removed old patch
+
+* Fri May  6 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4.1-1
+- update to 1.4.1, incorporating fixes for CAN-2005-0468 and CAN-2005-0469
+- when starting the KDC or kadmind, if KRB5REALM is set via the /etc/sysconfig
+  file for the service, pass it as an argument for the -r flag
+
+* Wed Mar 23 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4-3
+- drop krshd patch for now
+
+* Thu Mar 17 2005 Nalin Dahyabhai <nalin@redhat.com>
+- add draft fix from Tom Yu for slc_add_reply() buffer overflow (CAN-2005-0469)
+- add draft fix from Tom Yu for env_opt_add() buffer overflow (CAN-2005-0468)
+
+* Wed Mar 16 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4-2
+- don't include <term.h> into the telnet client when we're not using curses
+
+* Thu Feb 24 2005 Nalin Dahyabhai <nalin@redhat.com> 1.4-1
+- update to 1.4
+  - v1.4 kadmin client requires a v1.4 kadmind on the server, or use the "-O"
+    flag to specify that it should communicate with the server using the older
+    protocol
+  - new libkrb5support library
+  - v5passwdd and kadmind4 are gone
+  - versioned symbols
+- pick up $KRB5KDC_ARGS from /etc/sysconfig/krb5kdc, if it exists, and pass
+  it on to krb5kdc
+- pick up $KADMIND_ARGS from /etc/sysconfig/kadmin, if it exists, and pass
+  it on to kadmind
+- pick up $KRB524D_ARGS from /etc/sysconfig/krb524, if it exists, and pass
+  it on to krb524d *instead of* "-m"
+- set "forwardable" in [libdefaults] in the default krb5.conf to match the
+  default setting which we supply for pam_krb5
+- set a default of 24h for "ticket_lifetime" in [libdefaults], reflecting the
+  compiled-in default
+
+* Mon Dec 20 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.6-3
+- rebuild
+
+* Mon Dec 20 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.6-2
+- rebuild
+
+* Mon Dec 20 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.6-1
+- update to 1.3.6, which includes the previous fix
+
+* Mon Dec 20 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.5-8
+- apply fix from Tom Yu for MITKRB5-SA-2004-004 (CAN-2004-1189)
+
+* Fri Dec 17 2004 Martin Stransky <stransky@redhat.com> 1.3.5-7
+- fix deadlock during file transfer via rsync/krsh
+- thanks goes to James Antil for hint
+
+* Fri Nov 26 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.5-6
+- rebuild
+
+* Mon Nov 22 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.5-3
+- fix predictable-tempfile-name bug in krb5-send-pr (CAN-2004-0971, #140036)
+
+* Tue Nov 16 2004 Nalin Dahyabhai <nalin@redhat.com>
+- silence compiler warning in kprop by using an in-memory ccache with a fixed
+  name instead of an on-disk ccache with a name generated by tmpnam()
+
+* Tue Nov 16 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.5-2
+- fix globbing patch port mode (#139075)
+
+* Mon Nov  1 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.5-1
+- fix segfault in telnet due to incorrect checking of gethostbyname_r result
+  codes (#129059)
+
+* Fri Oct 15 2004 Nalin Dahyabhai <nalin@redhat.com>
+- remove rc4-hmac:norealm and rc4-hmac:onlyrealm from the default list of
+  supported keytypes in kdc.conf -- they produce exactly the same keys as
+  rc4-hmac:normal because rc4 string-to-key ignores salts
+- nuke kdcrotate -- there are better ways to balance the load on KDCs, and
+  the SELinux policy for it would have been scary-looking
+- update to 1.3.5, mainly to include MITKRB5SA 2004-002 and 2004-003
+
+* Tue Aug 31 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-7
+- rebuild
+
+* Tue Aug 24 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-6
+- rebuild
+
+* Tue Aug 24 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-5
+- incorporate revised fixes from Tom Yu for CAN-2004-0642, CAN-2004-0644,
+  CAN-2004-0772
+
+* Mon Aug 23 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-4
+- rebuild
+
+* Mon Aug 23 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-3
+- incorporate fixes from Tom Yu for CAN-2004-0642, CAN-2004-0772
+  (MITKRB5-SA-2004-002, #130732)
+- incorporate fixes from Tom Yu for CAN-2004-0644 (MITKRB5-SA-2004-003, #130732)
+
+* Tue Jul 27 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-2
+- fix indexing error in server sorting patch (#127336)
+
+* Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>
+- rebuilt
+
+* Mon Jun 14 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-0.1
+- update to 1.3.4 final
+
+* Mon Jun  7 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.4-0
+- update to 1.3.4 beta1
+- remove MITKRB5-SA-2004-001, included in 1.3.4
+
+* Mon Jun  7 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-8
+- rebuild
+
+* Fri Jun  4 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-7
+- rebuild
+
+* Fri Jun  4 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-6
+- apply updated patch from MITKRB5-SA-2004-001 (revision 2004-06-02)
+
+* Tue Jun  1 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-5
+- rebuild
+
+* Tue Jun  1 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-4
+- apply patch from MITKRB5-SA-2004-001 (#125001)
+
+* Wed May 12 2004 Thomas Woerner <twoerner@redhat.com> 1.3.3-3
+- removed rpath
+
+* Thu Apr 15 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-2
+- re-enable large file support, fell out in 1.3-1
+- patch rcp to use long long and %%lld format specifiers when reporting file
+  sizes on large files
+
+* Tue Apr 13 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-1
+- update to 1.3.3
+
+* Wed Mar 10 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.2-1
+- update to 1.3.2
+
+* Mon Mar  8 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-12
+- rebuild
+
+* Tue Mar 02 2004 Elliot Lee <sopwith@redhat.com> 1.3.1-11.1
+- rebuilt
+
+* Fri Feb 13 2004 Elliot Lee <sopwith@redhat.com> 1.3.1-11
+- rebuilt
+
+* Mon Feb  9 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-10
+- catch krb4 send_to_kdc cases in kdc preference patch
+
+* Mon Feb  2 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-9
+- remove patch to set TERM in klogind which, combined with the upstream fix in
+  1.3.1, actually produces the bug now (#114762)
+
+* Mon Jan 19 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-8
+- when iterating over lists of interfaces which are "up" from getifaddrs(),
+  skip over those which have no address (#113347)
+
+* Mon Jan 12 2004 Nalin Dahyabhai <nalin@redhat.com>
+- prefer the kdc which last replied to a request when sending requests to kdcs
+
+* Mon Nov 24 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-7
+- fix combination of --with-netlib and --enable-dns (#82176)
+
+* Tue Nov 18 2003 Nalin Dahyabhai <nalin@redhat.com>
+- remove libdefault ticket_lifetime option from the default krb5.conf, it is
+  ignored by libkrb5
+
+* Thu Sep 25 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-6
+- fix bug in patch to make rlogind start login with a clean environment a la
+  netkit rlogin, spotted and fixed by Scott McClung
+
+* Tue Sep 23 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-5
+- include profile.d scriptlets in krb5-devel so that krb5-config will be in
+  the path if krb5-workstation isn't installed, reported by Kir Kolyshkin
+
+* Mon Sep  8 2003 Nalin Dahyabhai <nalin@redhat.com>
+- add more etypes (arcfour) to the default enctype list in kdc.conf
+- don't apply previous patch, refused upstream
+
+* Fri Sep  5 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-4
+- fix 32/64-bit bug storing and retrieving the issue_date in v4 credentials
+
+* Wed Sep 3 2003 Dan Walsh <dwalsh@redhat.com> 1.3.1-3
+- Don't check for write access on /etc/krb5.conf if SELinux
+
+* Tue Aug 26 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-2
+- fixup some int/pointer varargs wackiness
+
+* Tue Aug  5 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-1
+- rebuild
+
+* Mon Aug  4 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3.1-0
+- update to 1.3.1
+
+* Thu Jul 24 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3-2
+- pull fix for non-compliant encoding of salt field in etype-info2 preauth
+  data from 1.3.1 beta 1, until 1.3.1 is released.
+
+* Mon Jul 21 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3-1
+- update to 1.3
+
+* Mon Jul  7 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.8-4
+- correctly use stdargs
+
+* Wed Jun 18 2003 Nalin Dahyabhai <nalin@redhat.com> 1.3-0.beta.4
+- test update to 1.3 beta 4
+- ditch statglue build option
+- krb5-devel requires e2fsprogs-devel, which now provides libss and libcom_err
+
+* Wed Jun 04 2003 Elliot Lee <sopwith@redhat.com>
+- rebuilt
+
+* Wed May 21 2003 Jeremy Katz <katzj@redhat.com> 1.2.8-2
+- gcc 3.3 doesn't implement varargs.h, include stdarg.h instead
+
+* Wed Apr  9 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.8-1
+- update to 1.2.8
+
+* Mon Mar 31 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.7-14
+- fix double-free of enc_part2 in krb524d
+
+* Fri Mar 21 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.7-13
+- update to latest patch kit for MITKRB5-SA-2003-004
+
+* Wed Mar 19 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.7-12
+- add patch included in MITKRB5-SA-2003-003 (CAN-2003-0028)
+
+* Mon Mar 17 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.7-11
+- add patches from patchkit from MITKRB5-SA-2003-004 (CAN-2003-0138 and
+  CAN-2003-0139)
+
+* Thu Mar  6 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.7-10
+- rebuild
+
+* Thu Mar  6 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.7-9
+- fix buffer underrun in unparsing certain principals (CAN-2003-0082)
+
+* Tue Feb  4 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.7-8
+- add patch to document the reject-bad-transited option in kdc.conf
+
+* Mon Feb  3 2003 Nalin Dahyabhai <nalin@redhat.com>
+- add patch to fix server-side crashes when principals have no
+  components (CAN-2003-0072)
+
+* Thu Jan 23 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.7-7
+- add patch from Mark Cox for exploitable bugs in ftp client
+
+* Wed Jan 22 2003 Tim Powers <timp@redhat.com>
+- rebuilt
+
+* Wed Jan 15 2003 Nalin Dahyabhai <nalin@redhat.com> 1.2.7-5
+- use PICFLAGS when building code from the ktany patch
+
+* Thu Jan  9 2003 Bill Nottingham <notting@redhat.com> 1.2.7-4
+- debloat
+
+* Tue Jan  7 2003 Jeremy Katz <katzj@redhat.com> 1.2.7-3
+- include .so.* symlinks as well as .so.*.*
+
+* Mon Dec  9 2002 Jakub Jelinek <jakub@redhat.com> 1.2.7-2
+- always #include <errno.h> to access errno, never do it directly
+- enable LFS on a bunch of other 32-bit arches
+
+* Wed Dec  4 2002 Nalin Dahyabhai <nalin@redhat.com>
+- increase the maximum name length allowed by kuserok() to the higher value
+  used in development versions
+
+* Mon Dec  2 2002 Nalin Dahyabhai <nalin@redhat.com>
+- install src/krb524/README as README.krb524 in the -servers package,
+  includes information about converting for AFS principals
+
+* Fri Nov 15 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.7-1
+- update to 1.2.7
+- disable use of tcl
+
+* Mon Nov 11 2002 Nalin Dahyabhai <nalin@redhat.com>
+- update to 1.2.7-beta2 (internal only, not for release), dropping dnsparse
+  and kadmind4 fixes
+
+* Wed Oct 23 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.6-5
+- add patch for buffer overflow in kadmind4 (not used by default)
+
+* Fri Oct 11 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.6-4
+- drop a hunk from the dnsparse patch which is actually redundant (thanks to
+  Tom Yu)
+
+* Wed Oct  9 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.6-3
+- patch to handle truncated dns responses
+
+* Mon Oct  7 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.6-2
+- remove hashless key types from the default kdc.conf, they're not supposed to
+  be there, noted by Sam Hartman on krbdev
+
+* Fri Sep 27 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.6-1
+- update to 1.2.6
+
+* Fri Sep 13 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.5-7
+- use %%{_lib} for the sake of multilib systems
+
+* Fri Aug  2 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.5-6
+- add patch from Tom Yu for exploitable bugs in rpc code used in kadmind
+
+* Tue Jul 23 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.5-5
+- fix bug in krb5.csh which would cause the path check to always succeed
+
+* Fri Jul 19 2002 Jakub Jelinek <jakub@redhat.com> 1.2.5-4
+- build even libdb.a with -fPIC and $RPM_OPT_FLAGS.
+
+* Fri Jun 21 2002 Tim Powers <timp@redhat.com>
+- automated rebuild
+
+* Sun May 26 2002 Tim Powers <timp@redhat.com>
+- automated rebuild
+
+* Wed May  1 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.5-1
+- update to 1.2.5
+- disable statglue
+
+* Fri Mar  1 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.4-1
+- update to 1.2.4
+
+* Wed Feb 20 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.3-5
+- rebuild in new environment
+- reenable statglue
+
+* Sat Jan 26 2002 Florian La Roche <Florian.LaRoche@redhat.de>
+- prereq chkconfig for the server subpackage
+
+* Wed Jan 16 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.3-3
+- build without -g3, which gives us large static libraries in -devel
+
+* Tue Jan 15 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.3-2
+- reintroduce ld.so.conf munging in the -libs %%post
+
+* Thu Jan 10 2002 Nalin Dahyabhai <nalin@redhat.com> 1.2.3-1
+- rename the krb5 package back to krb5-libs; the previous rename caused
+  something of an uproar
+- update to 1.2.3, which includes the FTP and telnetd fixes
+- configure without --enable-dns-for-kdc --enable-dns-for-realm, which now set
+  the default behavior instead of enabling the feature (the feature is enabled
+  by --enable-dns, which we still use)
+- reenable optimizations on Alpha
+- support more encryption types in the default kdc.conf (heads-up from post
+  to comp.protocols.kerberos by Jason Heiss)
+
+* Fri Aug  3 2001 Nalin Dahyabhai <nalin@redhat.com> 1.2.2-14
+- rename the krb5-libs package to krb5 (naming a subpackage -libs when there
+  is no main package is silly)
+- move defaults for PAM to the appdefaults section of krb5.conf -- this is
+  the area where the krb5_appdefault_* functions look for settings)
+- disable statglue (warning: breaks binary compatibility with previous
+  packages, but has to be broken at some point to work correctly with
+  unpatched versions built with newer versions of glibc)
+
+* Fri Aug  3 2001 Nalin Dahyabhai <nalin@redhat.com> 1.2.2-13
+- bump release number and rebuild
+
+* Wed Aug  1 2001 Nalin Dahyabhai <nalin@redhat.com>
+- add patch to fix telnetd vulnerability
+
+* Fri Jul 20 2001 Nalin Dahyabhai <nalin@redhat.com>
+- tweak statglue.c to fix stat/stat64 aliasing problems
+- be cleaner in use of gcc to build shlibs
+
+* Wed Jul 11 2001 Nalin Dahyabhai <nalin@redhat.com>
+- use gcc to build shared libraries
+
+* Wed Jun 27 2001 Nalin Dahyabhai <nalin@redhat.com>
+- add patch to support "ANY" keytab type (i.e.,
+  "default_keytab_name = ANY:FILE:/etc/krb5.keytab,SRVTAB:/etc/srvtab"
+  patch from Gerald Britton, #42551)
+- build with -D_FILE_OFFSET_BITS=64 to get large file I/O in ftpd (#30697)
+- patch ftpd to use long long and %%lld format specifiers to support the SIZE
+  command on large files (also #30697)
+- don't use LOG_AUTH as an option value when calling openlog() in ksu (#45965)
+- implement reload in krb5kdc and kadmind init scripts (#41911)
+- lose the krb5server init script (not using it any more)
+
+* Sun Jun 24 2001 Elliot Lee <sopwith@redhat.com>
+- Bump release + rebuild.
+
+* Tue May 29 2001 Nalin Dahyabhai <nalin@redhat.com>
+- pass some structures by address instead of on the stack in krb5kdc
+
+* Tue May 22 2001 Nalin Dahyabhai <nalin@redhat.com>
+- rebuild in new environment
+
+* Thu Apr 26 2001 Nalin Dahyabhai <nalin@redhat.com>
+- add patch from Tom Yu to fix ftpd overflows (#37731)
+
+* Wed Apr 18 2001 Than Ngo <than@redhat.com>
+- disable optimizations on the alpha again
+
+* Fri Mar 30 2001 Nalin Dahyabhai <nalin@redhat.com>
+- add in glue code to make sure that libkrb5 continues to provide a
+  weak copy of stat()
+
+* Thu Mar 15 2001 Nalin Dahyabhai <nalin@redhat.com>
+- build alpha with -O0 for now
+
+* Thu Mar  8 2001 Nalin Dahyabhai <nalin@redhat.com>
+- fix the kpropd init script
+
+* Mon Mar  5 2001 Nalin Dahyabhai <nalin@redhat.com>
+- update to 1.2.2, which fixes some bugs relating to empty ETYPE-INFO
+- re-enable optimization on Alpha
+
+* Thu Feb  8 2001 Nalin Dahyabhai <nalin@redhat.com>
+- build alpha with -O0 for now
+- own %{_var}/kerberos
+
+* Tue Feb  6 2001 Nalin Dahyabhai <nalin@redhat.com>
+- own the directories which are created for each package (#26342)
+
+* Tue Jan 23 2001 Nalin Dahyabhai <nalin@redhat.com>
+- gettextize init scripts
+
+* Fri Jan 19 2001 Nalin Dahyabhai <nalin@redhat.com>
+- add some comments to the ksu patches for the curious
+- re-enable optimization on alphas
+
+* Mon Jan 15 2001 Nalin Dahyabhai <nalin@redhat.com>
+- fix krb5-send-pr (#18932) and move it from -server to -workstation
+- buildprereq libtermcap-devel
+- temporariliy disable optimization on alphas
+- gettextize init scripts
+
+* Tue Dec  5 2000 Nalin Dahyabhai <nalin@redhat.com>
+- force -fPIC
+
+* Fri Dec  1 2000 Nalin Dahyabhai <nalin@redhat.com>
+- rebuild in new environment
+
+* Tue Oct 31 2000 Nalin Dahyabhai <nalin@redhat.com>
+- add bison as a BuildPrereq (#20091)
+
+* Mon Oct 30 2000 Nalin Dahyabhai <nalin@redhat.com>
+- change /usr/dict/words to /usr/share/dict/words in default kdc.conf (#20000)
+
+* Thu Oct  5 2000 Nalin Dahyabhai <nalin@redhat.com>
+- apply kpasswd bug fixes from David Wragg
+
+* Wed Oct  4 2000 Nalin Dahyabhai <nalin@redhat.com>
+- make krb5-libs obsolete the old krb5-configs package (#18351)
+- don't quit from the kpropd init script if there's no principal database so
+  that you can propagate the first time without running kpropd manually
+- don't complain if /etc/ld.so.conf doesn't exist in the -libs %post
+
+* Tue Sep 12 2000 Nalin Dahyabhai <nalin@redhat.com>
+- fix credential forwarding problem in klogind (goof in KRB5CCNAME handling)
+  (#11588)
+- fix heap corruption bug in FTP client (#14301)
+
+* Wed Aug 16 2000 Nalin Dahyabhai <nalin@redhat.com>
+- fix summaries and descriptions
+- switched the default transfer protocol from PORT to PASV as proposed on
+  bugzilla (#16134), and to match the regular ftp package's behavior
+
+* Wed Jul 19 2000 Jeff Johnson <jbj@redhat.com>
+- rebuild to compress man pages.
+
+* Sat Jul 15 2000 Bill Nottingham <notting@redhat.com>
+- move initscript back
+
+* Fri Jul 14 2000 Nalin Dahyabhai <nalin@redhat.com>
+- disable servers by default to keep linuxconf from thinking they need to be
+  started when they don't
+
+* Thu Jul 13 2000 Prospector <bugzilla@redhat.com>
+- automatic rebuild
+
+* Mon Jul 10 2000 Nalin Dahyabhai <nalin@redhat.com>
+- change cleanup code in post to not tickle chkconfig
+- add grep as a Prereq: for -libs
+
+* Thu Jul  6 2000 Nalin Dahyabhai <nalin@redhat.com>
+- move condrestarts to postun
+- make xinetd configs noreplace
+- add descriptions to xinetd configs
+- add /etc/init.d as a prereq for the -server package
+- patch to properly truncate $TERM in krlogind
+
+* Fri Jun 30 2000 Nalin Dahyabhai <nalin@redhat.com>
+- update to 1.2.1
+- back out Tom Yu's patch, which is a big chunk of the 1.2 -> 1.2.1 update
+- start using the official source tarball instead of its contents
+
+* Thu Jun 29 2000 Nalin Dahyabhai <nalin@redhat.com>
+- Tom Yu's patch to fix compatibility between 1.2 kadmin and 1.1.1 kadmind
+- pull out 6.2 options in the spec file (sonames changing in 1.2 means it's not
+  compatible with other stuff in 6.2, so no need)
+
+* Wed Jun 28 2000 Nalin Dahyabhai <nalin@redhat.com>
+- tweak graceful start/stop logic in post and preun
+
+* Mon Jun 26 2000 Nalin Dahyabhai <nalin@redhat.com>
+- update to the 1.2 release
+- ditch a lot of our patches which went upstream
+- enable use of DNS to look up things at build-time
+- disable use of DNS to look up things at run-time in default krb5.conf
+- change ownership of the convert-config-files script to root.root
+- compress PS docs
+- fix some typos in the kinit man page
+- run condrestart in server post, and shut down in preun
+
+* Mon Jun 19 2000 Nalin Dahyabhai <nalin@redhat.com>
+- only remove old krb5server init script links if the init script is there
+
+* Sat Jun 17 2000 Nalin Dahyabhai <nalin@redhat.com>
+- disable kshell and eklogin by default
+
+* Thu Jun 15 2000 Nalin Dahyabhai <nalin@redhat.com>
+- patch mkdir/rmdir problem in ftpcmd.y
+- add condrestart option to init script
+- split the server init script into three pieces and add one for kpropd
+
+* Wed Jun 14 2000 Nalin Dahyabhai <nalin@redhat.com>
+- make sure workstation servers are all disabled by default
+- clean up krb5server init script
+
+* Fri Jun  9 2000 Nalin Dahyabhai <nalin@redhat.com>
+- apply second set of buffer overflow fixes from Tom Yu
+- fix from Dirk Husung for a bug in buffer cleanups in the test suite
+- work around possibly broken rev binary in running test suite
+- move default realm configs from /var/kerberos to %{_var}/kerberos
+
+* Tue Jun  6 2000 Nalin Dahyabhai <nalin@redhat.com>
+- make ksu and v4rcp owned by root
+
+* Sat Jun  3 2000 Nalin Dahyabhai <nalin@redhat.com>
+- use %%{_infodir} to better comply with FHS
+- move .so files to -devel subpackage
+- tweak xinetd config files (bugs #11833, #11835, #11836, #11840)
+- fix package descriptions again
+
+* Wed May 24 2000 Nalin Dahyabhai <nalin@redhat.com>
+- change a LINE_MAX to 1024, fix from Ken Raeburn
+- add fix for login vulnerability in case anyone rebuilds without krb4 compat
+- add tweaks for byte-swapping macros in krb.h, also from Ken
+- add xinetd config files
+- make rsh and rlogin quieter
+- build with debug to fix credential forwarding
+- add rsh as a build-time req because the configure scripts look for it to
+  determine paths
+
+* Wed May 17 2000 Nalin Dahyabhai <nalin@redhat.com>
+- fix config_subpackage logic
+
+* Tue May 16 2000 Nalin Dahyabhai <nalin@redhat.com>
+- remove setuid bit on v4rcp and ksu in case the checks previously added
+  don't close all of the problems in ksu
+- apply patches from Jeffrey Schiller to fix overruns Chris Evans found
+- reintroduce configs subpackage for use in the errata
+- add PreReq: sh-utils
+
+* Mon May 15 2000 Nalin Dahyabhai <nalin@redhat.com>
+- fix double-free in the kdc (patch merged into MIT tree)
+- include convert-config-files script as a documentation file
+
+* Wed May 03 2000 Nalin Dahyabhai <nalin@redhat.com>
+- patch ksu man page because the -C option never works
+- add access() checks and disable debug mode in ksu
+- modify default ksu build arguments to specify more directories in CMD_PATH
+  and to use getusershell()
+
+* Wed May 03 2000 Bill Nottingham <notting@redhat.com>
+- fix configure stuff for ia64
+
+* Mon Apr 10 2000 Nalin Dahyabhai <nalin@redhat.com>
+- add LDCOMBINE=-lc to configure invocation to use libc versioning (bug #10653)
+- change Requires: for/in subpackages to include %{version}
+
+* Wed Apr 05 2000 Nalin Dahyabhai <nalin@redhat.com>
+- add man pages for kerberos(1), kvno(1), .k5login(5)
+- add kvno to -workstation
+
+* Mon Apr 03 2000 Nalin Dahyabhai <nalin@redhat.com>
+- Merge krb5-configs back into krb5-libs.  The krb5.conf file is marked as
+  a %%config file anyway.
+- Make krb5.conf a noreplace config file.
+
+* Thu Mar 30 2000 Nalin Dahyabhai <nalin@redhat.com>
+- Make klogind pass a clean environment to children, like NetKit's rlogind does.
+
+* Wed Mar 08 2000 Nalin Dahyabhai <nalin@redhat.com>
+- Don't enable the server by default.
+- Compress info pages.
+- Add defaults for the PAM module to krb5.conf
+
+* Mon Mar 06 2000 Nalin Dahyabhai <nalin@redhat.com>
+- Correct copyright: it's exportable now, provided the proper paperwork is
+  filed with the government.
+
+* Fri Mar 03 2000 Nalin Dahyabhai <nalin@redhat.com>
+- apply Mike Friedman's patch to fix format string problems
+- don't strip off argv[0] when invoking regular rsh/rlogin
+
+* Thu Mar 02 2000 Nalin Dahyabhai <nalin@redhat.com>
+- run kadmin.local correctly at startup
+
+* Mon Feb 28 2000 Nalin Dahyabhai <nalin@redhat.com>
+- pass absolute path to kadm5.keytab if/when extracting keys at startup
+
+* Sat Feb 19 2000 Nalin Dahyabhai <nalin@redhat.com>
+- fix info page insertions
+
+* Wed Feb  9 2000 Nalin Dahyabhai <nalin@redhat.com>
+- tweak server init script to automatically extract kadm5 keys if
+  /var/kerberos/krb5kdc/kadm5.keytab doesn't exist yet
+- adjust package descriptions
+
+* Thu Feb  3 2000 Nalin Dahyabhai <nalin@redhat.com>
+- fix for potentially gzipped man pages
+
+* Fri Jan 21 2000 Nalin Dahyabhai <nalin@redhat.com>
+- fix comments in krb5-configs
+
+* Fri Jan  7 2000 Nalin Dahyabhai <nalin@redhat.com>
+- move /usr/kerberos/bin to end of PATH
+
+* Tue Dec 28 1999 Nalin Dahyabhai <nalin@redhat.com>
+- install kadmin header files
+
+* Tue Dec 21 1999 Nalin Dahyabhai <nalin@redhat.com>
+- patch around TIOCGTLC defined on alpha and remove warnings from libpty.h
+- add installation of info docs
+- remove krb4 compat patch because it doesn't fix workstation-side servers
+
+* Mon Dec 20 1999 Nalin Dahyabhai <nalin@redhat.com>
+- remove hesiod dependency at build-time
+
+* Sun Dec 19 1999 Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
+- rebuild on 1.1.1
+
+* Thu Oct  7 1999 Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
+- clean up init script for server, verify that it works [jlkatz]
+- clean up rotation script so that rc likes it better
+- add clean stanza
+
+* Mon Oct  4 1999 Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
+- backed out ncurses and makeshlib patches
+- update for krb5-1.1
+- add KDC rotation to rc.boot, based on ideas from Michael's C version
+
+* Mon Sep 26 1999 Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
+- added -lncurses to telnet and telnetd makefiles
+
+* Mon Jul  5 1999 Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
+- added krb5.csh and krb5.sh to /etc/profile.d
+
+* Mon Jun 22 1999 Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
+- broke out configuration files
+
+* Mon Jun 14 1999 Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
+- fixed server package so that it works now
+
+* Sat May 15 1999 Nalin Dahyabhai <nsdahya1@eos.ncsu.edu>
+- started changelog (previous package from zedz.net)
+- updated existing 1.0.5 RPM from Eos Linux to krb5 1.0.6
+- added --force to makeinfo commands to skip errors during build
+
+%prep
+%setup -q
+%patch2  -p1 -b .manpage-paths
+%patch3  -p1 -b .netkit-rsh
+%patch4  -p1 -b .rlogind-environ
+%patch5  -p1 -b .ksu-access
+%patch6  -p1 -b .ksu-path
+%patch9  -p1 -b .brokenrev
+%patch11 -p1 -b .passive
+%patch12 -p1 -b .ktany
+%patch13 -p1 -b .large-file
+%patch14 -p1 -b .ftp-glob
+%patch15 -p1 -b .check
+%patch16 -p1 -b .no-rpath
+%patch18 -p1 -b .reject-bad-transited
+%if %{WITH_SELINUX}
+%patch21 -p1 -b .selinux
+%endif
+%patch23 -p1 -b .dns
+%patch25 -p1 -b .null
+# Removes a malloc(0) case, nothing more.
+# %patch26 -p1 -b .efence
+%patch27 -p1 -b .rcp-sendlarge
+%patch29 -p1 -b .kprop-mktemp
+%patch30 -p1 -b .send-pr-tempfile
+%patch32 -p1 -b .ncurses
+%patch33 -p1 -b .io
+%patch35 -p1 -b .fclose
+%patch36 -p1 -b .rcp-markus
+%patch39 -p1 -b .api
+%patch40 -p1 -b .telnet-environ
+%patch41 -p1 -b .login-lpass
+%patch44 -p1 -b .enospc
+%patch45 -p1 -b .gssinit
+pushd src
+%patch46 -p0 -b .2006-001
+popd
+cp src/krb524/README README.krb524
+gzip doc/*.ps
+%patch1000 -p1 -b .scripts
+cd src
+top=`pwd`
+for configurein in `find -name configure.in -type f` ; do
+	pushd `dirname $configurein`
+	autoconf -I "$top"
+	popd
+done
+
+%build
+cd src
+INCLUDES=-I%{_includedir}/et
+# Get LFS support on systems that need it which aren't already 64-bit.
+%ifarch %{ix86} s390 ppc sparc
+DEFINES="-D_FILE_OFFSET_BITS=64" ; export DEFINES
+%endif
+CFLAGS="`echo $RPM_OPT_FLAGS $DEFINES $INCLUDES -fPIC`"
+CPPFLAGS="`echo $DEFINES $INCLUDES`"
+%configure \
+	CC=%{__cc} \
+	CFLAGS="$CFLAGS" \
+	LDFLAGS="-pie" \
+	CPPFLAGS="$CPPFLAGS" \
+	SS_LIB="-lss -lcurses" \
+	--enable-shared --enable-static \
+	--bindir=%{krb5prefix}/bin \
+	--mandir=%{krb5prefix}/man \
+	--sbindir=%{krb5prefix}/sbin \
+	--datadir=%{krb5prefix}/share \
+	--localstatedir=%{_var}/kerberos \
+	--with-krb4 \
+	--with-system-et \
+	--with-system-ss \
+	--with-netlib=-lresolv \
+	--without-tcl \
+	--enable-dns
+# Now build it.  Override the RPATH_FLAG and PROG_LIBPATH to drop the rpath, and
+# override LDCOMBINE to use gcc instead of ld to build shared libraries.
+make	RPATH_FLAG= PROG_RPATH= \
+	OBJLISTS="OBJS.ST OBJS.SH" \
+	LDCOMBINE='%{__cc} -shared -Wl,-soname=lib$(LIB)$(SHLIBSEXT) $(CFLAGS)'
+
+# Run the test suite.
+: make	RPATH_FLAG= PROG_RPATH= check TMPDIR=%{_tmppath}
+
+%install
+[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
+
+# Shell scripts wrappers for Kerberized rsh and rlogin.
+mkdir -p $RPM_BUILD_ROOT%{krb5prefix}/bin
+install -m 755 $RPM_SOURCE_DIR/{krsh,krlogin} $RPM_BUILD_ROOT/%{krb5prefix}/bin/
+
+# Info docs.
+mkdir -p $RPM_BUILD_ROOT%{_infodir}
+install -m 644 doc/*.info* $RPM_BUILD_ROOT%{_infodir}/
+# Forcefully compress the info pages so that we know the right file name to
+# pass to install-info in %%post.
+gzip $RPM_BUILD_ROOT%{_infodir}/*.info*
+
+# Sample KDC config files.
+mkdir -p $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc
+install -m 644 $RPM_SOURCE_DIR/kdc.conf  $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/
+install -m 644 $RPM_SOURCE_DIR/kadm5.acl $RPM_BUILD_ROOT%{_var}/kerberos/krb5kdc/
+
+# Login-time scriptlets to fix the PATH variable.
+mkdir -p $RPM_BUILD_ROOT/etc/profile.d
+install -m 644 $RPM_SOURCE_DIR/krb5.conf $RPM_BUILD_ROOT/etc/krb5.conf
+install -m 755 $RPM_SOURCE_DIR/krb5.{sh,csh} $RPM_BUILD_ROOT/etc/profile.d/
+
+# Server init scripts.
+mkdir -p $RPM_BUILD_ROOT/etc/rc.d/init.d
+install -m 755 $RPM_SOURCE_DIR/krb5kdc.init $RPM_BUILD_ROOT/etc/rc.d/init.d/krb5kdc
+install -m 755 $RPM_SOURCE_DIR/kadmind.init $RPM_BUILD_ROOT/etc/rc.d/init.d/kadmin
+install -m 755 $RPM_SOURCE_DIR/kpropd.init $RPM_BUILD_ROOT/etc/rc.d/init.d/kprop
+install -m 755 $RPM_SOURCE_DIR/krb524d.init $RPM_BUILD_ROOT/etc/rc.d/init.d/krb524
+mkdir -p $RPM_BUILD_ROOT/etc/sysconfig
+install -m 644 $RPM_SOURCE_DIR/krb5kdc.sysconfig $RPM_BUILD_ROOT/etc/sysconfig/krb5kdc
+install -m 644 $RPM_SOURCE_DIR/kadmin.sysconfig $RPM_BUILD_ROOT/etc/sysconfig/kadmin
+install -m 644 $RPM_SOURCE_DIR/krb524.sysconfig $RPM_BUILD_ROOT/etc/sysconfig/krb524
+
+# Xinetd configuration files.
+mkdir -p $RPM_BUILD_ROOT/etc/xinetd.d/
+for xinetd in eklogin klogin kshell ekrb5-telnet krb5-telnet gssftp ; do
+	install -m 644 $RPM_SOURCE_DIR/${xinetd}.xinetd \
+	$RPM_BUILD_ROOT/etc/xinetd.d/${xinetd}
+done
+
+# The rest of the binaries, headers, libraries, and docs.
+make -C src DESTDIR=$RPM_BUILD_ROOT install
+
+# Fixup permissions on header files.
+find $RPM_BUILD_ROOT/%{_includedir} -type d | xargs chmod 755
+find $RPM_BUILD_ROOT/%{_includedir} -type f | xargs chmod 644
+
+# Fixup strange shared library permissions.
+chmod 755 $RPM_BUILD_ROOT%{_libdir}/*.so{,.*}
+
+# Munge the krb5-config script to remove rpaths.
+sed "s|^CC_LINK=.*|CC_LINK='\$(CC) \$(PROG_LIBPATH)'|g" src/krb5-config > $RPM_BUILD_ROOT%{krb5prefix}/bin/krb5-config
+
+# Munge krb5-config yet again.  This is totally wrong for 64-bit, but chunks
+# of the no-rpath patch already conspire to strip out /usr/<anything> from the
+# list of link flags.
+sed -r -i -e 's|^libdir=/usr/lib(64)?$|libdir=/usr/lib|g' $RPM_BUILD_ROOT%{krb5prefix}/bin/krb5-config
+
+# Remove the randomly-generated compile-et filename comment from header files.
+sed -i -e 's|^ \* ettmp[^ \t]*\.h:$| * ettmpXXXXXX.h:|g' $RPM_BUILD_ROOT%{_includedir}/*{,/*}.h
+
+%if %{install_macro}
+# Install the autoconf macro.
+mkdir -p $RPM_BUILD_ROOT/%{_datadir}/aclocal
+install -m644 src/util/ac_check_krb5.m4 $RPM_BUILD_ROOT/%{_datadir}/aclocal/
+%endif
+
+%clean
+[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
+
+%post libs -p /sbin/ldconfig
+
+%postun libs -p /sbin/ldconfig
+
+%post server
+# Remove the init script for older servers.
+[ -x /etc/rc.d/init.d/krb5server ] && /sbin/chkconfig --del krb5server
+# Install the new ones.
+/sbin/chkconfig --add krb5kdc
+/sbin/chkconfig --add kadmin
+/sbin/chkconfig --add krb524
+/sbin/chkconfig --add kprop
+# Install info pages.
+/sbin/install-info %{_infodir}/krb425.info.gz %{_infodir}/dir
+/sbin/install-info %{_infodir}/krb5-admin.info.gz %{_infodir}/dir
+/sbin/install-info %{_infodir}/krb5-install.info.gz %{_infodir}/dir
+
+%preun server
+if [ "$1" = "0" ] ; then
+	/sbin/chkconfig --del krb5kdc
+	/sbin/chkconfig --del kadmin
+	/sbin/chkconfig --del krb524
+	/sbin/chkconfig --del kprop
+	/sbin/service krb5kdc stop > /dev/null 2>&1 || :
+	/sbin/service kadmin stop > /dev/null 2>&1 || :
+	/sbin/service krb524 stop > /dev/null 2>&1 || :
+	/sbin/service kprop stop > /dev/null 2>&1 || :
+	/sbin/install-info --delete %{_infodir}/krb425.info.gz %{_infodir}/dir
+	/sbin/install-info --delete %{_infodir}/krb5-admin.info.gz %{_infodir}/dir
+	/sbin/install-info --delete %{_infodir}/krb5-install.info.gz %{_infodir}/dir
+fi
+
+%postun server
+if [ "$1" -ge 1 ] ; then
+	/sbin/service krb5kdc condrestart > /dev/null 2>&1 || :
+	/sbin/service kadmin condrestart > /dev/null 2>&1 || :
+	/sbin/service krb524 condrestart > /dev/null 2>&1 || :
+	/sbin/service kprop condrestart > /dev/null 2>&1 || :
+fi
+
+%post workstation
+/sbin/install-info %{_infodir}/krb5-user.info %{_infodir}/dir
+/sbin/service xinetd reload > /dev/null 2>&1 || :
+
+%preun workstation
+if [ "$1" = "0" ] ; then
+	/sbin/install-info --delete %{_infodir}/krb5-user.info %{_infodir}/dir
+fi
+
+%postun workstation
+/sbin/service xinetd reload > /dev/null 2>&1 || :
+
+%files workstation
+%defattr(-,root,root)
+
+%config(noreplace) /etc/profile.d/krb5.sh
+%config(noreplace) /etc/profile.d/krb5.csh
+
+%config(noreplace) /etc/xinetd.d/*
+
+%docdir %{krb5prefix}/man
+%doc doc/krb5-user/*.html doc/user*.ps.gz src/config-files/services.append
+%doc doc/{ftp,kdestroy,kinit,klist,kpasswd,ksu,rcp,rlogin,rsh,telnet}.html
+%attr(0755,root,root) %doc src/config-files/convert-config-files
+%{_infodir}/krb5-user.info*
+
+%dir %{krb5prefix}
+%dir %{krb5prefix}/bin
+%dir %{krb5prefix}/man
+%dir %{krb5prefix}/man/man1
+%dir %{krb5prefix}/man/man5
+%dir %{krb5prefix}/man/man8
+%dir %{krb5prefix}/sbin
+
+%{krb5prefix}/bin/ftp
+%{krb5prefix}/man/man1/ftp.1*
+%{krb5prefix}/bin/gss-client
+%{krb5prefix}/bin/kdestroy
+%{krb5prefix}/man/man1/kdestroy.1*
+%{krb5prefix}/man/man1/kerberos.1*
+%{krb5prefix}/bin/kinit
+%{krb5prefix}/man/man1/kinit.1*
+%{krb5prefix}/bin/klist
+%{krb5prefix}/man/man1/klist.1*
+%{krb5prefix}/bin/kpasswd
+%{krb5prefix}/man/man1/kpasswd.1*
+%{krb5prefix}/bin/krb524init
+%{krb5prefix}/man/man1/krb524init.1*
+%{krb5prefix}/sbin/k5srvutil
+%{krb5prefix}/man/man8/k5srvutil.8*
+%{krb5prefix}/sbin/kadmin
+%{krb5prefix}/man/man8/kadmin.8*
+%{krb5prefix}/sbin/ktutil
+%{krb5prefix}/man/man8/ktutil.8*
+%attr(4755,root,root) %{krb5prefix}/bin/ksu
+%{krb5prefix}/man/man1/ksu.1*
+%{krb5prefix}/bin/kvno
+%{krb5prefix}/man/man1/kvno.1*
+%{krb5prefix}/bin/rcp
+%{krb5prefix}/man/man1/rcp.1*
+%{krb5prefix}/bin/krlogin
+%{krb5prefix}/bin/rlogin
+%{krb5prefix}/man/man1/rlogin.1*
+%{krb5prefix}/bin/krsh
+%{krb5prefix}/bin/rsh
+%{krb5prefix}/man/man1/rsh.1*
+%{krb5prefix}/bin/telnet
+%{krb5prefix}/man/man1/telnet.1*
+%{krb5prefix}/man/man1/tmac.doc*
+%attr(0755,root,root) %{krb5prefix}/bin/v4rcp
+%{krb5prefix}/man/man1/v4rcp.1*
+%{krb5prefix}/bin/sim_client
+%{krb5prefix}/bin/uuclient
+%{krb5prefix}/sbin/login.krb5
+%{krb5prefix}/man/man8/login.krb5.8*
+%{krb5prefix}/sbin/ftpd
+%{krb5prefix}/man/man8/ftpd.8*
+%{krb5prefix}/sbin/gss-server
+%{krb5prefix}/sbin/klogind
+%{krb5prefix}/man/man8/klogind.8*
+%{krb5prefix}/sbin/krb5-send-pr
+%{krb5prefix}/man/man1/krb5-send-pr.1*
+%{krb5prefix}/sbin/kshd
+%{krb5prefix}/man/man8/kshd.8*
+%{krb5prefix}/sbin/telnetd
+%{krb5prefix}/man/man8/telnetd.8*
+%{krb5prefix}/sbin/uuserver
+%{krb5prefix}/man/man5/.k5login.5*
+%{krb5prefix}/man/man5/krb5.conf.5*
+
+%files server
+%defattr(-,root,root)
+
+%config /etc/rc.d/init.d/krb5kdc
+%config /etc/rc.d/init.d/kadmin
+%config /etc/rc.d/init.d/krb524
+%config /etc/rc.d/init.d/kprop
+%config(noreplace) /etc/sysconfig/krb5kdc
+%config(noreplace) /etc/sysconfig/kadmin
+%config(noreplace) /etc/sysconfig/krb524
+
+%docdir %{krb5prefix}/man
+%doc doc/admin*.ps.gz doc/krb5-admin/*.html
+%doc doc/krb425*.ps.gz doc/krb425/*.html
+%doc doc/install*.ps.gz doc/krb5-install/*.html
+%doc README.krb524
+
+%{_infodir}/krb5-admin.info*
+%{_infodir}/krb5-install.info*
+%{_infodir}/krb425.info*
+
+%dir %{_var}/kerberos
+%dir %{_var}/kerberos/krb5kdc
+%config(noreplace) %{_var}/kerberos/krb5kdc/kdc.conf
+%config(noreplace) %{_var}/kerberos/krb5kdc/kadm5.acl
+
+%dir %{krb5prefix}/bin
+%dir %{_libdir}/krb5
+%dir %{_libdir}/krb5/plugins
+%dir %{_libdir}/krb5/plugins/kdb
+%{_libdir}/krb5/plugins/kdb/db2.so
+%dir %{krb5prefix}/man
+%dir %{krb5prefix}/man/man1
+%dir %{krb5prefix}/man/man5
+%dir %{krb5prefix}/man/man8
+%dir %{krb5prefix}/sbin
+
+%{krb5prefix}/man/man5/kdc.conf.5*
+%{krb5prefix}/sbin/kadmin.local
+%{krb5prefix}/man/man8/kadmin.local.8*
+%{krb5prefix}/sbin/kadmind
+%{krb5prefix}/man/man8/kadmind.8*
+%{krb5prefix}/sbin/kdb5_util
+%{krb5prefix}/man/man8/kdb5_util.8*
+%{krb5prefix}/sbin/kprop
+%{krb5prefix}/man/man8/kprop.8*
+%{krb5prefix}/sbin/kpropd
+%{krb5prefix}/man/man8/kpropd.8*
+%{krb5prefix}/sbin/krb524d
+%{krb5prefix}/man/man8/krb524d.8*
+%{krb5prefix}/sbin/krb5kdc
+%{krb5prefix}/man/man8/krb5kdc.8*
+%{krb5prefix}/sbin/sim_server
+# This is here for people who want to test their server, and also 
+# included in devel package for similar reasons.
+%{krb5prefix}/bin/sclient
+%{krb5prefix}/man/man1/sclient.1*
+%{krb5prefix}/sbin/sserver
+%{krb5prefix}/man/man8/sserver.8*
+
+%files libs
+%defattr(-,root,root)
+#%config /etc/rc.d/init.d/kdcrotate
+%config(noreplace) /etc/krb5.conf
+%docdir %{krb5prefix}/man
+%{_libdir}/lib*.so.*
+%dir %{_libdir}/krb5
+%dir %{_libdir}/krb5/plugins
+%{krb5prefix}/share
+
+%files devel
+%defattr(-,root,root)
+
+%config(noreplace) /etc/profile.d/krb5.sh
+%config(noreplace) /etc/profile.d/krb5.csh
+
+%docdir %{krb5prefix}/man
+%doc doc/api
+%doc doc/implement
+%doc doc/kadm5
+%doc doc/kadmin
+%doc doc/krb5-protocol
+%doc doc/rpc
+%doc doc/threads.txt
+
+%dir %{krb5prefix}
+%dir %{krb5prefix}/bin
+%dir %{krb5prefix}/man
+%dir %{krb5prefix}/man/man1
+%dir %{krb5prefix}/man/man8
+%dir %{krb5prefix}/sbin
+
+%{_includedir}/*
+%{_libdir}/lib*.a
+%{_libdir}/lib*.so
+%if %{install_macro}
+%{_datadir}/aclocal/*
+%endif
+
+%{krb5prefix}/bin/krb5-config
+%{krb5prefix}/bin/sclient
+%{krb5prefix}/man/man1/krb5-config.1*
+%{krb5prefix}/man/man1/sclient.1*
+%{krb5prefix}/man/man8/sserver.8*
+%{krb5prefix}/sbin/sserver
Index: tags/fc15-eol/server/fedora/ref-prepatch/kuserok.c
===================================================================
--- tags/fc15-eol/server/fedora/ref-prepatch/kuserok.c	(revision 2244)
+++ tags/fc15-eol/server/fedora/ref-prepatch/kuserok.c	(revision 2244)
@@ -0,0 +1,171 @@
+/*
+ * lib/krb5/os/kuserok.c
+ *
+ * Copyright 1990,1993 by the Massachusetts Institute of Technology.
+ * All Rights Reserved.
+ *
+ * Export of this software from the United States of America may
+ *   require a specific license from the United States Government.
+ *   It is the responsibility of any person or organization contemplating
+ *   export to obtain such a license before exporting.
+ * 
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission.  Furthermore if you modify this software you must label
+ * your software as modified software and not distribute it in such a
+ * fashion that it might be confused with the original M.I.T. software.
+ * M.I.T. makes no representations about the suitability of
+ * this software for any purpose.  It is provided "as is" without express
+ * or implied warranty.
+ * 
+ *
+ * krb5_kuserok()
+ */
+
+#include "k5-int.h"
+#if !defined(_WIN32)		/* Not yet for Windows */
+#include <stdio.h>
+#include <pwd.h>
+
+#if defined(_AIX) && defined(_IBMR2)
+#include <sys/access.h>
+/* xlc has a bug with "const" */
+#define getpwnam(user) getpwnam((char *)user)
+#endif
+
+#define MAX_USERNAME 65
+
+#if defined(__APPLE__) && defined(__MACH__)
+#include <hfs/hfs_mount.h>	/* XXX */
+#define FILE_OWNER_OK(UID)  ((UID) == 0 || (UID) == UNKNOWNUID)
+#else
+#define FILE_OWNER_OK(UID)  ((UID) == 0)
+#endif
+
+/*
+ * Given a Kerberos principal "principal", and a local username "luser",
+ * determine whether user is authorized to login according to the
+ * authorization file ("~luser/.k5login" by default).  Returns TRUE
+ * if authorized, FALSE if not authorized.
+ *
+ * If there is no account for "luser" on the local machine, returns
+ * FALSE.  If there is no authorization file, and the given Kerberos
+ * name "server" translates to the same name as "luser" (using
+ * krb5_aname_to_lname()), returns TRUE.  Otherwise, if the authorization file
+ * can't be accessed, returns FALSE.  Otherwise, the file is read for
+ * a matching principal name, instance, and realm.  If one is found,
+ * returns TRUE, if none is found, returns FALSE.
+ *
+ * The file entries are in the format produced by krb5_unparse_name(),
+ * one entry per line.
+ *
+ */
+
+krb5_boolean KRB5_CALLCONV
+krb5_kuserok(krb5_context context, krb5_principal principal, const char *luser)
+{
+    struct stat sbuf;
+    struct passwd *pwd;
+    char pbuf[MAXPATHLEN];
+    krb5_boolean isok = FALSE;
+    FILE *fp;
+    char kuser[MAX_USERNAME];
+    char *princname;
+    char linebuf[BUFSIZ];
+    char *newline;
+    int gobble;
+
+    /* no account => no access */
+    char pwbuf[BUFSIZ];
+    struct passwd pwx;
+    if (k5_getpwnam_r(luser, &pwx, pwbuf, sizeof(pwbuf), &pwd) != 0)
+	return(FALSE);
+    (void) strncpy(pbuf, pwd->pw_dir, sizeof(pbuf) - 1);
+    pbuf[sizeof(pbuf) - 1] = '\0';
+    (void) strncat(pbuf, "/.k5login", sizeof(pbuf) - 1 - strlen(pbuf));
+
+    if (access(pbuf, F_OK)) {	 /* not accessible */
+	/*
+	 * if he's trying to log in as himself, and there is no .k5login file,
+	 * let him.  To find out, call
+	 * krb5_aname_to_localname to convert the principal to a name
+	 * which we can string compare. 
+	 */
+	if (!(krb5_aname_to_localname(context, principal,
+				      sizeof(kuser), kuser))
+	    && (strcmp(kuser, luser) == 0)) {
+	    return(TRUE);
+	}
+    }
+    if (krb5_unparse_name(context, principal, &princname))
+	return(FALSE);			/* no hope of matching */
+
+    /* open ~/.k5login */
+    if ((fp = fopen(pbuf, "r")) == NULL) {
+	free(princname);
+	return(FALSE);
+    }
+    /*
+     * For security reasons, the .k5login file must be owned either by
+     * the user himself, or by root.  Otherwise, don't grant access.
+     */
+    if (fstat(fileno(fp), &sbuf)) {
+	fclose(fp);
+	free(princname);
+	return(FALSE);
+    }
+    if (sbuf.st_uid != pwd->pw_uid && !FILE_OWNER_OK(sbuf.st_uid)) {
+	fclose(fp);
+	free(princname);
+	return(FALSE);
+    }
+
+    /* check each line */
+    while (!isok && (fgets(linebuf, BUFSIZ, fp) != NULL)) {
+	/* null-terminate the input string */
+	linebuf[BUFSIZ-1] = '\0';
+	newline = NULL;
+	/* nuke the newline if it exists */
+	if ((newline = strchr(linebuf, '\n')))
+	    *newline = '\0';
+	if (!strcmp(linebuf, princname)) {
+	    isok = TRUE;
+	    continue;
+	}
+	/* clean up the rest of the line if necessary */
+	if (!newline)
+	    while (((gobble = getc(fp)) != EOF) && gobble != '\n');
+    }
+    free(princname);
+    fclose(fp);
+    return(isok);
+}
+
+#else /* _WIN32 */
+
+/*
+ * If the given Kerberos name "server" translates to the same name as "luser"
+ * (using * krb5_aname_to_lname()), returns TRUE.
+ */
+krb5_boolean KRB5_CALLCONV
+krb5_kuserok(context, principal, luser)
+    krb5_context context;
+    krb5_principal principal;
+    const char *luser;
+{
+    char kuser[50];
+
+    if (krb5_aname_to_localname(context, principal, sizeof(kuser), kuser))
+        return FALSE;
+
+    if (strcmp(kuser, luser) == 0)
+	    return TRUE;
+
+    return FALSE;
+}
+#endif /* _WIN32 */
Index: tags/fc15-eol/server/fedora/ref-prepatch/suexec.c
===================================================================
--- tags/fc15-eol/server/fedora/ref-prepatch/suexec.c	(revision 2244)
+++ tags/fc15-eol/server/fedora/ref-prepatch/suexec.c	(revision 2244)
@@ -0,0 +1,636 @@
+/* Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * suexec.c -- "Wrapper" support program for suEXEC behaviour for Apache
+ *
+ ***********************************************************************
+ *
+ * NOTE! : DO NOT edit this code!!!  Unless you know what you are doing,
+ *         editing this code might open up your system in unexpected
+ *         ways to would-be crackers.  Every precaution has been taken
+ *         to make this code as safe as possible; alter it at your own
+ *         risk.
+ *
+ ***********************************************************************
+ *
+ *
+ */
+
+#include "apr.h"
+#include "ap_config.h"
+#include "suexec.h"
+
+#include <sys/param.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <string.h>
+#include <time.h>
+#if APR_HAVE_UNISTD_H
+#include <unistd.h>
+#endif
+
+#include <stdio.h>
+#include <stdarg.h>
+#include <stdlib.h>
+
+#ifdef HAVE_PWD_H
+#include <pwd.h>
+#endif
+
+#ifdef HAVE_GRP_H
+#include <grp.h>
+#endif
+
+/*
+ ***********************************************************************
+ * There is no initgroups() in QNX, so I believe this is safe :-)
+ * Use cc -osuexec -3 -O -mf -DQNX suexec.c to compile.
+ *
+ * May 17, 1997.
+ * Igor N. Kovalenko -- infoh mail.wplus.net
+ ***********************************************************************
+ */
+
+#if defined(NEED_INITGROUPS)
+int initgroups(const char *name, gid_t basegid)
+{
+    /* QNX and MPE do not appear to support supplementary groups. */
+    return 0;
+}
+#endif
+
+#if defined(SUNOS4)
+extern char *sys_errlist[];
+#define strerror(x) sys_errlist[(x)]
+#endif
+
+#if defined(PATH_MAX)
+#define AP_MAXPATH PATH_MAX
+#elif defined(MAXPATHLEN)
+#define AP_MAXPATH MAXPATHLEN
+#else
+#define AP_MAXPATH 8192
+#endif
+
+#define AP_ENVBUF 256
+
+extern char **environ;
+static FILE *log = NULL;
+
+static const char *const safe_env_lst[] =
+{
+    /* variable name starts with */
+    "HTTP_",
+    "SSL_",
+
+    /* variable name is */
+    "AUTH_TYPE=",
+    "CONTENT_LENGTH=",
+    "CONTENT_TYPE=",
+    "DATE_GMT=",
+    "DATE_LOCAL=",
+    "DOCUMENT_NAME=",
+    "DOCUMENT_PATH_INFO=",
+    "DOCUMENT_ROOT=",
+    "DOCUMENT_URI=",
+    "GATEWAY_INTERFACE=",
+    "HTTPS=",
+    "LAST_MODIFIED=",
+    "PATH_INFO=",
+    "PATH_TRANSLATED=",
+    "QUERY_STRING=",
+    "QUERY_STRING_UNESCAPED=",
+    "REMOTE_ADDR=",
+    "REMOTE_HOST=",
+    "REMOTE_IDENT=",
+    "REMOTE_PORT=",
+    "REMOTE_USER=",
+    "REDIRECT_HANDLER=",
+    "REDIRECT_QUERY_STRING=",
+    "REDIRECT_REMOTE_USER=",
+    "REDIRECT_STATUS=",
+    "REDIRECT_URL=",
+    "REQUEST_METHOD=",
+    "REQUEST_URI=",
+    "SCRIPT_FILENAME=",
+    "SCRIPT_NAME=",
+    "SCRIPT_URI=",
+    "SCRIPT_URL=",
+    "SERVER_ADMIN=",
+    "SERVER_NAME=",
+    "SERVER_ADDR=",
+    "SERVER_PORT=",
+    "SERVER_PROTOCOL=",
+    "SERVER_SIGNATURE=",
+    "SERVER_SOFTWARE=",
+    "UNIQUE_ID=",
+    "USER_NAME=",
+    "TZ=",
+    NULL
+};
+
+
+static void err_output(int is_error, const char *fmt, va_list ap)
+{
+#ifdef AP_LOG_EXEC
+    time_t timevar;
+    struct tm *lt;
+
+    if (!log) {
+        if ((log = fopen(AP_LOG_EXEC, "a")) == NULL) {
+            fprintf(stderr, "suexec failure: could not open log file\n");
+            perror("fopen");
+            exit(1);
+        }
+    }
+
+    if (is_error) {
+        fprintf(stderr, "suexec policy violation: see suexec log for more "
+                        "details\n");
+    }
+
+    time(&timevar);
+    lt = localtime(&timevar);
+
+    fprintf(log, "[%d-%.2d-%.2d %.2d:%.2d:%.2d]: ",
+            lt->tm_year + 1900, lt->tm_mon + 1, lt->tm_mday,
+            lt->tm_hour, lt->tm_min, lt->tm_sec);
+
+    vfprintf(log, fmt, ap);
+
+    fflush(log);
+#endif /* AP_LOG_EXEC */
+    return;
+}
+
+static void log_err(const char *fmt,...)
+{
+#ifdef AP_LOG_EXEC
+    va_list ap;
+
+    va_start(ap, fmt);
+    err_output(1, fmt, ap); /* 1 == is_error */
+    va_end(ap);
+#endif /* AP_LOG_EXEC */
+    return;
+}
+
+static void log_no_err(const char *fmt,...)
+{
+#ifdef AP_LOG_EXEC
+    va_list ap;
+
+    va_start(ap, fmt);
+    err_output(0, fmt, ap); /* 0 == !is_error */
+    va_end(ap);
+#endif /* AP_LOG_EXEC */
+    return;
+}
+
+static void clean_env(void)
+{
+    char pathbuf[512];
+    char **cleanenv;
+    char **ep;
+    int cidx = 0;
+    int idx;
+
+    /* While cleaning the environment, the environment should be clean.
+     * (e.g. malloc() may get the name of a file for writing debugging info.
+     * Bad news if MALLOC_DEBUG_FILE is set to /etc/passwd.  Sprintf() may be
+     * susceptible to bad locale settings....)
+     * (from PR 2790)
+     */
+    char **envp = environ;
+    char *empty_ptr = NULL;
+
+    environ = &empty_ptr; /* VERY safe environment */
+
+    if ((cleanenv = (char **) calloc(AP_ENVBUF, sizeof(char *))) == NULL) {
+        log_err("failed to malloc memory for environment\n");
+        exit(120);
+    }
+
+    sprintf(pathbuf, "PATH=%s", AP_SAFE_PATH);
+    cleanenv[cidx] = strdup(pathbuf);
+    cidx++;
+
+    for (ep = envp; *ep && cidx < AP_ENVBUF-1; ep++) {
+        for (idx = 0; safe_env_lst[idx]; idx++) {
+            if (!strncmp(*ep, safe_env_lst[idx],
+                         strlen(safe_env_lst[idx]))) {
+                cleanenv[cidx] = *ep;
+                cidx++;
+                break;
+            }
+        }
+    }
+
+    cleanenv[cidx] = NULL;
+
+    environ = cleanenv;
+}
+
+int main(int argc, char *argv[])
+{
+    int userdir = 0;        /* ~userdir flag             */
+    uid_t uid;              /* user information          */
+    gid_t gid;              /* target group placeholder  */
+    char *target_uname;     /* target user name          */
+    char *target_gname;     /* target group name         */
+    char *target_homedir;   /* target home directory     */
+    char *actual_uname;     /* actual user name          */
+    char *actual_gname;     /* actual group name         */
+    char *prog;             /* name of this program      */
+    char *cmd;              /* command to be executed    */
+    char cwd[AP_MAXPATH];   /* current working directory */
+    char dwd[AP_MAXPATH];   /* docroot working directory */
+    struct passwd *pw;      /* password entry holder     */
+    struct group *gr;       /* group entry holder        */
+    struct stat dir_info;   /* directory info holder     */
+    struct stat prg_info;   /* program info holder       */
+
+    /*
+     * Start with a "clean" environment
+     */
+    clean_env();
+
+    prog = argv[0];
+    /*
+     * Check existence/validity of the UID of the user
+     * running this program.  Error out if invalid.
+     */
+    uid = getuid();
+    if ((pw = getpwuid(uid)) == NULL) {
+        log_err("crit: invalid uid: (%ld)\n", uid);
+        exit(102);
+    }
+    /*
+     * See if this is a 'how were you compiled' request, and
+     * comply if so.
+     */
+    if ((argc > 1)
+        && (! strcmp(argv[1], "-V"))
+        && ((uid == 0)
+#ifdef _OSD_POSIX
+        /* User name comparisons are case insensitive on BS2000/OSD */
+            || (! strcasecmp(AP_HTTPD_USER, pw->pw_name)))
+#else  /* _OSD_POSIX */
+            || (! strcmp(AP_HTTPD_USER, pw->pw_name)))
+#endif /* _OSD_POSIX */
+        ) {
+#ifdef AP_DOC_ROOT
+        fprintf(stderr, " -D AP_DOC_ROOT=\"%s\"\n", AP_DOC_ROOT);
+#endif
+#ifdef AP_GID_MIN
+        fprintf(stderr, " -D AP_GID_MIN=%d\n", AP_GID_MIN);
+#endif
+#ifdef AP_HTTPD_USER
+        fprintf(stderr, " -D AP_HTTPD_USER=\"%s\"\n", AP_HTTPD_USER);
+#endif
+#ifdef AP_LOG_EXEC
+        fprintf(stderr, " -D AP_LOG_EXEC=\"%s\"\n", AP_LOG_EXEC);
+#endif
+#ifdef AP_SAFE_PATH
+        fprintf(stderr, " -D AP_SAFE_PATH=\"%s\"\n", AP_SAFE_PATH);
+#endif
+#ifdef AP_SUEXEC_UMASK
+        fprintf(stderr, " -D AP_SUEXEC_UMASK=%03o\n", AP_SUEXEC_UMASK);
+#endif
+#ifdef AP_UID_MIN
+        fprintf(stderr, " -D AP_UID_MIN=%d\n", AP_UID_MIN);
+#endif
+#ifdef AP_USERDIR_SUFFIX
+        fprintf(stderr, " -D AP_USERDIR_SUFFIX=\"%s\"\n", AP_USERDIR_SUFFIX);
+#endif
+        exit(0);
+    }
+    /*
+     * If there are a proper number of arguments, set
+     * all of them to variables.  Otherwise, error out.
+     */
+    if (argc < 4) {
+        log_err("too few arguments\n");
+        exit(101);
+    }
+    target_uname = argv[1];
+    target_gname = argv[2];
+    cmd = argv[3];
+
+    /*
+     * Check to see if the user running this program
+     * is the user allowed to do so as defined in
+     * suexec.h.  If not the allowed user, error out.
+     */
+#ifdef _OSD_POSIX
+    /* User name comparisons are case insensitive on BS2000/OSD */
+    if (strcasecmp(AP_HTTPD_USER, pw->pw_name)) {
+        log_err("user mismatch (%s instead of %s)\n", pw->pw_name, AP_HTTPD_USER);
+        exit(103);
+    }
+#else  /*_OSD_POSIX*/
+    if (strcmp(AP_HTTPD_USER, pw->pw_name)) {
+        log_err("user mismatch (%s instead of %s)\n", pw->pw_name, AP_HTTPD_USER);
+        exit(103);
+    }
+#endif /*_OSD_POSIX*/
+
+    /*
+     * Check for a leading '/' (absolute path) in the command to be executed,
+     * or attempts to back up out of the current directory,
+     * to protect against attacks.  If any are
+     * found, error out.  Naughty naughty crackers.
+     */
+    if ((cmd[0] == '/') || (!strncmp(cmd, "../", 3))
+        || (strstr(cmd, "/../") != NULL)) {
+        log_err("invalid command (%s)\n", cmd);
+        exit(104);
+    }
+
+    /*
+     * Check to see if this is a ~userdir request.  If
+     * so, set the flag, and remove the '~' from the
+     * target username.
+     */
+    if (!strncmp("~", target_uname, 1)) {
+        target_uname++;
+        userdir = 1;
+    }
+
+    /*
+     * Error out if the target username is invalid.
+     */
+    if (strspn(target_uname, "1234567890") != strlen(target_uname)) {
+        if ((pw = getpwnam(target_uname)) == NULL) {
+            log_err("invalid target user name: (%s)\n", target_uname);
+            exit(105);
+        }
+    }
+    else {
+        if ((pw = getpwuid(atoi(target_uname))) == NULL) {
+            log_err("invalid target user id: (%s)\n", target_uname);
+            exit(121);
+        }
+    }
+
+    /*
+     * Error out if the target group name is invalid.
+     */
+    if (strspn(target_gname, "1234567890") != strlen(target_gname)) {
+        if ((gr = getgrnam(target_gname)) == NULL) {
+            log_err("invalid target group name: (%s)\n", target_gname);
+            exit(106);
+        }
+        gid = gr->gr_gid;
+        actual_gname = strdup(gr->gr_name);
+    }
+    else {
+        gid = atoi(target_gname);
+        actual_gname = strdup(target_gname);
+    }
+
+#ifdef _OSD_POSIX
+    /*
+     * Initialize BS2000 user environment
+     */
+    {
+        pid_t pid;
+        int status;
+
+        switch (pid = ufork(target_uname)) {
+        case -1:    /* Error */
+            log_err("failed to setup bs2000 environment for user %s: %s\n",
+                    target_uname, strerror(errno));
+            exit(150);
+        case 0:     /* Child */
+            break;
+        default:    /* Father */
+            while (pid != waitpid(pid, &status, 0))
+                ;
+            /* @@@ FIXME: should we deal with STOP signals as well? */
+            if (WIFSIGNALED(status)) {
+                kill (getpid(), WTERMSIG(status));
+            }
+            exit(WEXITSTATUS(status));
+        }
+    }
+#endif /*_OSD_POSIX*/
+
+    /*
+     * Save these for later since initgroups will hose the struct
+     */
+    uid = pw->pw_uid;
+    actual_uname = strdup(pw->pw_name);
+    target_homedir = strdup(pw->pw_dir);
+
+    /*
+     * Log the transaction here to be sure we have an open log
+     * before we setuid().
+     */
+    log_no_err("uid: (%s/%s) gid: (%s/%s) cmd: %s\n",
+               target_uname, actual_uname,
+               target_gname, actual_gname,
+               cmd);
+
+    /*
+     * Error out if attempt is made to execute as root or as
+     * a UID less than AP_UID_MIN.  Tsk tsk.
+     */
+    if ((uid == 0) || (uid < AP_UID_MIN)) {
+        log_err("cannot run as forbidden uid (%d/%s)\n", uid, cmd);
+        exit(107);
+    }
+
+    /*
+     * Error out if attempt is made to execute as root group
+     * or as a GID less than AP_GID_MIN.  Tsk tsk.
+     */
+    if ((gid == 0) || (gid < AP_GID_MIN)) {
+        log_err("cannot run as forbidden gid (%d/%s)\n", gid, cmd);
+        exit(108);
+    }
+
+    /*
+     * Change UID/GID here so that the following tests work over NFS.
+     *
+     * Initialize the group access list for the target user,
+     * and setgid() to the target group. If unsuccessful, error out.
+     */
+    if (((setgid(gid)) != 0) || (initgroups(actual_uname, gid) != 0)) {
+        log_err("failed to setgid (%ld: %s)\n", gid, cmd);
+        exit(109);
+    }
+
+    /*
+     * setuid() to the target user.  Error out on fail.
+     */
+    if ((setuid(uid)) != 0) {
+        log_err("failed to setuid (%ld: %s)\n", uid, cmd);
+        exit(110);
+    }
+
+    /*
+     * Get the current working directory, as well as the proper
+     * document root (dependant upon whether or not it is a
+     * ~userdir request).  Error out if we cannot get either one,
+     * or if the current working directory is not in the docroot.
+     * Use chdir()s and getcwd()s to avoid problems with symlinked
+     * directories.  Yuck.
+     */
+    if (getcwd(cwd, AP_MAXPATH) == NULL) {
+        log_err("cannot get current working directory\n");
+        exit(111);
+    }
+
+    if (userdir) {
+        if (((chdir(target_homedir)) != 0) ||
+            ((chdir(AP_USERDIR_SUFFIX)) != 0) ||
+            ((getcwd(dwd, AP_MAXPATH)) == NULL) ||
+            ((chdir(cwd)) != 0)) {
+            log_err("cannot get docroot information (%s)\n", target_homedir);
+            exit(112);
+        }
+    }
+    else {
+        if (((chdir(AP_DOC_ROOT)) != 0) ||
+            ((getcwd(dwd, AP_MAXPATH)) == NULL) ||
+            ((chdir(cwd)) != 0)) {
+            log_err("cannot get docroot information (%s)\n", AP_DOC_ROOT);
+            exit(113);
+        }
+    }
+
+    if ((strncmp(cwd, dwd, strlen(dwd))) != 0) {
+        log_err("command not in docroot (%s/%s)\n", cwd, cmd);
+        exit(114);
+    }
+
+    /*
+     * Stat the cwd and verify it is a directory, or error out.
+     */
+    if (((lstat(cwd, &dir_info)) != 0) || !(S_ISDIR(dir_info.st_mode))) {
+        log_err("cannot stat directory: (%s)\n", cwd);
+        exit(115);
+    }
+
+    /*
+     * Error out if cwd is writable by others.
+     */
+    if ((dir_info.st_mode & S_IWOTH) || (dir_info.st_mode & S_IWGRP)) {
+        log_err("directory is writable by others: (%s)\n", cwd);
+        exit(116);
+    }
+
+    /*
+     * Error out if we cannot stat the program.
+     */
+    if (((lstat(cmd, &prg_info)) != 0) || (S_ISLNK(prg_info.st_mode))) {
+        log_err("cannot stat program: (%s)\n", cmd);
+        exit(117);
+    }
+
+    /*
+     * Error out if the program is writable by others.
+     */
+    if ((prg_info.st_mode & S_IWOTH) || (prg_info.st_mode & S_IWGRP)) {
+        log_err("file is writable by others: (%s/%s)\n", cwd, cmd);
+        exit(118);
+    }
+
+    /*
+     * Error out if the file is setuid or setgid.
+     */
+    if ((prg_info.st_mode & S_ISUID) || (prg_info.st_mode & S_ISGID)) {
+        log_err("file is either setuid or setgid: (%s/%s)\n", cwd, cmd);
+        exit(119);
+    }
+
+    /*
+     * Error out if the target name/group is different from
+     * the name/group of the cwd or the program.
+     */
+    if ((uid != dir_info.st_uid) ||
+        (gid != dir_info.st_gid) ||
+        (uid != prg_info.st_uid) ||
+        (gid != prg_info.st_gid)) {
+        log_err("target uid/gid (%ld/%ld) mismatch "
+                "with directory (%ld/%ld) or program (%ld/%ld)\n",
+                uid, gid,
+                dir_info.st_uid, dir_info.st_gid,
+                prg_info.st_uid, prg_info.st_gid);
+        exit(120);
+    }
+    /*
+     * Error out if the program is not executable for the user.
+     * Otherwise, she won't find any error in the logs except for
+     * "[error] Premature end of script headers: ..."
+     */
+    if (!(prg_info.st_mode & S_IXUSR)) {
+        log_err("file has no execute permission: (%s/%s)\n", cwd, cmd);
+        exit(121);
+    }
+
+#ifdef AP_SUEXEC_UMASK
+    /*
+     * umask() uses inverse logic; bits are CLEAR for allowed access.
+     */
+    if ((~AP_SUEXEC_UMASK) & 0022) {
+        log_err("notice: AP_SUEXEC_UMASK of %03o allows "
+                "write permission to group and/or other\n", AP_SUEXEC_UMASK);
+    }
+    umask(AP_SUEXEC_UMASK);
+#endif /* AP_SUEXEC_UMASK */
+
+    /*
+     * Be sure to close the log file so the CGI can't
+     * mess with it.  If the exec fails, it will be reopened
+     * automatically when log_err is called.  Note that the log
+     * might not actually be open if AP_LOG_EXEC isn't defined.
+     * However, the "log" cell isn't ifdef'd so let's be defensive
+     * and assume someone might have done something with it
+     * outside an ifdef'd AP_LOG_EXEC block.
+     */
+    if (log != NULL) {
+        fclose(log);
+        log = NULL;
+    }
+
+    /*
+     * Execute the command, replacing our image with its own.
+     */
+#ifdef NEED_HASHBANG_EMUL
+    /* We need the #! emulation when we want to execute scripts */
+    {
+        extern char **environ;
+
+        ap_execve(cmd, &argv[3], environ);
+    }
+#else /*NEED_HASHBANG_EMUL*/
+    execv(cmd, &argv[3]);
+#endif /*NEED_HASHBANG_EMUL*/
+
+    /*
+     * (I can't help myself...sorry.)
+     *
+     * Uh oh.  Still here.  Where's the kaboom?  There was supposed to be an
+     * EARTH-shattering kaboom!
+     *
+     * Oh well, log the failure and error out.
+     */
+    log_err("(%d)%s: exec failed (%s)\n", errno, strerror(errno), cmd);
+    exit(255);
+}
Index: tags/fc15-eol/server/fedora/specs/accountadm.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/accountadm.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/accountadm.spec	(revision 2244)
@@ -0,0 +1,73 @@
+Summary: scripts.mit.edu locker administration system
+Group: Applications/System
+Name: accountadm
+Version: 0.%{scriptsversion}
+Release: 0
+Vendor: The scripts.mit.edu Team (scripts@mit.edu)
+URL: http://scripts.mit.edu
+License: GPL
+Source: %{name}.tar.gz 
+BuildRoot: %{_tmppath}/%(%{__id_u} -n)-%{name}-%{version}-root
+BuildRequires: scripts-openafs-devel, scripts-openafs-authlibs-devel
+BuildRequires: hesinfo
+BuildRequires: openldap-clients
+BuildRequires: krb5-devel
+BuildRequires: sudo
+Requires: hesinfo
+Requires: openldap-clients
+Requires: sudo
+%define debug_package %{nil}
+Prereq: /usr/bin/fs, /usr/bin/pts
+
+%description 
+
+scripts.mit.edu locker administration system
+Contains:
+ - Perl script for checking whether a user is a locker admin <admof>
+ - Perl script that handles signup requests <signup-scripts-backend>
+ - vhostadd,vhostedit: admin tools for adding and editing virtualhosts
+ - cronload: userspace tool for setting crontab from Athena
+See http://scripts.mit.edu/wiki for more information.
+
+%prep
+%setup -q -n %{name}
+
+%build
+./configure --with-fs=/usr/bin/fs --with-pts=/usr/bin/pts
+make
+
+%install
+[ $RPM_BUILD_ROOT != / ] && rm -rf $RPM_BUILD_ROOT
+make install DESTDIR=$RPM_BUILD_ROOT prefix=/usr/local
+
+%clean
+[ $RPM_BUILD_ROOT != / ] && rm -rf $RPM_BUILD_ROOT
+
+%files
+%defattr(0644, root, root)
+/usr/local/etc/mbashrc
+%defattr(0755, root, root)
+/usr/local/bin/mbash
+/usr/local/bin/admof
+/usr/local/bin/cronload
+/usr/local/sbin/ssh-admof
+/usr/local/sbin/signup-scripts-backend
+/usr/local/sbin/vhostadd
+/usr/local/sbin/vhostedit
+/usr/local/sbin/ldap-backup
+
+%pre
+groupadd -g 102 signup || [ $? -eq 9 ]
+useradd -u 102 -g signup -d /afs/athena.mit.edu/contrib/scripts/signup -M signup || [ $? -eq 9 ]
+
+%postun
+if [ "$1" = "0" ] ; then
+   userdel signup
+fi
+
+%changelog
+* Wed Dec 31 2008  Quentin Smith <quentin@mit.edu> - 0.917-0
+- don't delete signup user on upgrades
+
+* Sat Sep 30 2006  Jeff Arnold <jbarnold@MIT.EDU> 0.00
+- prerelease
Index: tags/fc15-eol/server/fedora/specs/athena-aclocal.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/athena-aclocal.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/athena-aclocal.spec	(revision 2244)
@@ -0,0 +1,38 @@
+# Make sure to update this to coincide with the most recent debathena-aclocal
+# release from http://debathena.mit.edu/apt/pool/debathena/d/debathena-aclocal/
+%define upstreamversion 1.1.2
+Name:		athena-aclocal
+Version:	%{upstreamversion}
+Release:	1.%{scriptsversion}%{?dist}
+Summary:	Common autoconf macros for Athena software
+Vendor:		The scripts.mit.edu Team (scripts@mit.edu)
+Group:		Development/Tools
+License:	MIT
+URL:		http://scripts.mit.edu/
+Source:		deb%{name}_%{upstreamversion}.tar.gz
+BuildRoot:	%(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
+Requires:	automake
+
+%description
+This package contains autoconf macros used in the building of multiple
+pieces of Athena software.  It is a clone of Debathena's debathena-aclocal.
+
+%prep
+%setup -q -n deb%{name}-%{upstreamversion}
+
+%install
+rm -rf %{buildroot}
+mkdir -p %{buildroot}%{_datadir}/aclocal
+cp aclocal/* %{buildroot}%{_datadir}/aclocal
+
+%clean
+rm -rf %{buildroot}
+
+%files
+%defattr(-,root,root,-)
+%{_datadir}/aclocal/*.m4
+
+%changelog
+* Sun May 29 2011 Mitchell Berger <mitchb@mit.edu> - 1.1.2-1
+- Initial packaging of Athena aclocal macros on Fedora
+
Index: tags/fc15-eol/server/fedora/specs/athrun.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/athrun.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/athrun.spec	(revision 2244)
@@ -0,0 +1,37 @@
+Summary: scripts.mit.edu version of Athena athrun utility
+Group: Applications/System
+Name: athrun
+Version: 0.%{scriptsversion}
+Release: 0
+Vendor: The scripts.mit.edu Team (scripts@mit.edu)
+URL: http://scripts.mit.edu
+License: MIT
+Source: %{name}.tar.gz 
+BuildRoot: %{_tmppath}/%(%{__id_u} -n)-%{name}-%{version}-root
+%define debug_package %{nil}
+
+%description 
+
+scripts.mit.edu version of Athena athrun utility
+
+%prep
+%setup -q -n %{name}
+
+%build
+./configure
+make
+
+%install
+[ $RPM_BUILD_ROOT != / ] && rm -rf $RPM_BUILD_ROOT
+make install DESTDIR=$RPM_BUILD_ROOT prefix=/usr/local
+
+%clean
+[ $RPM_BUILD_ROOT != / ] && rm -rf $RPM_BUILD_ROOT
+
+%files
+%defattr(0755, root, root)
+/usr/local/bin/athrun
+
+%changelog
+* Wed Jul 01 2009  Mitchell Berger <mitchb@MIT.EDU> 0.00
+- Initial version
Index: tags/fc15-eol/server/fedora/specs/discuss.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/discuss.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/discuss.spec	(revision 2244)
@@ -0,0 +1,112 @@
+# Make sure to update this to coincide with the most recent debathena-discuss
+# release from http://debathena.mit.edu/apt/pool/debathena/d/debathena-discuss/
+%define upstreamversion 10.0.13
+Name:		discuss
+Version:	%{upstreamversion}
+Release:	1.%{scriptsversion}%{?dist}
+Vendor:		The scripts.mit.edu Team (scripts@mit.edu)
+Summary:	A conferencing and mail archiving system
+Group:		Applications/Archiving
+License:	MIT
+URL:		http://scripts.mit.edu/
+Source0:	debathena-%{name}_%{upstreamversion}.orig.tar.gz
+Source1:	discuss.xinetd
+BuildRoot:	%(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
+BuildRequires:	athena-aclocal, byacc, libcom_err-devel, libss-devel, krb5-devel, zephyr-devel, readline-devel, less
+Requires:	less
+
+%description
+Discuss is a user-interface front end to a networked conferencing system.
+This is a clone of Debathena's debathena-discuss package.
+
+%prep
+%setup -q -n debathena-%{name}-%{upstreamversion}
+
+%build
+autoreconf -fi
+# automake doesn't like that there's no Makefile.am, but we're only
+# using it to copy in install-sh and config.{sub|guess}, so we don't
+# want the error return code to cause rpmbuild to bomb out.
+automake --add-missing --foreign || :
+%configure --without-krb4 --with-krb5 --with-zephyr --with-pager=/usr/bin/less
+make %{?_smp_mflags}
+
+%install
+rm -rf %{buildroot}
+make install DESTDIR=%{buildroot}
+# Unfortunately, discuss's build system doesn't presently support
+# building shared libraries, so we won't be installing any of the
+# dev stuff at all just yet.
+rm -rf %{buildroot}%{_includedir}
+rm -rf %{buildroot}%{_libdir}
+mkdir -p %{buildroot}%{_sysconfdir}/xinetd.d
+cp %{SOURCE1} %{buildroot}%{_sysconfdir}/xinetd.d/%{name}
+mkdir -p %{buildroot}%{_localstatedir}/spool/discuss
+
+%clean
+rm -rf %{buildroot}
+
+%files
+%defattr(755,root,root)
+%{_bindir}/crmtgs
+%{_bindir}/discuss
+%{_bindir}/dsc_setup
+%{_bindir}/dsgrep
+%{_bindir}/dsmail
+%{_bindir}/dspipe
+%{_bindir}/mkds
+%{_bindir}/pmtg
+%{_bindir}/rmds
+%{_libexecdir}/edsc
+%defattr(-,root,root,-)
+/usr/share/discuss
+%doc %{_mandir}/man1/*.1.gz
+%doc %{_mandir}/man8/*.8.gz
+
+%post
+if ! grep -q '^discuss[[:space:]]' %{_sysconfdir}/services; then
+    cat <<EOF >>%{_sysconfdir}/services
+discuss         2100/tcp                # Networked conferencing
+EOF
+fi
+
+%package emacs
+Summary: Emacs interface to discuss
+Group: Applications/Archiving
+Requires: %{name}%{?_isa} = %{version}-%{release}, emacs
+%description emacs
+Discuss is a user-interface front end to a networked conferencing system.
+This package contains an Emacs interface to discuss.
+
+%files emacs
+%defattr(-,root,root,-)
+%{_datadir}/emacs/site-lisp/*.el
+
+%package server
+Summary: A conferencing and mail archiving system
+Group: Applications/Archiving
+Requires(pre): shadow-utils
+Requires: %{name}%{?_isa} = %{version}-%{release}, xinetd
+%description server
+A conferencing and mail archiving system.
+This package contains the discuss server.
+
+%files server
+%defattr(755,root,root)
+%{_bindir}/create_mtg_dir
+%{_sbindir}/discussd
+%attr(4755,discuss,discuss) %{_sbindir}/disserve
+%attr(755,discuss,discuss) %{_localstatedir}/spool/discuss
+%attr(644,root,root) %config(noreplace) %{_sysconfdir}/xinetd.d/%{name}
+
+%pre server
+getent group discuss >/dev/null || groupadd -r discuss
+getent passwd discuss >/dev/null || \
+    useradd -r -M -g discuss -d /var/spool/discuss -s /sbin/nologin \
+    -c "Discuss server" discuss
+exit 0
+
+%changelog
+* Sun May 29 2011 Mitchell Berger <mitchb@mit.edu> - 10.0.13-1
+- Initial packaging of Discuss on Fedora
+
Index: tags/fc15-eol/server/fedora/specs/execsys.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/execsys.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/execsys.spec	(revision 2244)
@@ -0,0 +1,70 @@
+Summary: scripts.mit.edu glue associated with file execution
+Group: Applications/System
+Name: execsys
+Version: 0.%{scriptsversion}
+Release: 0
+Vendor: The scripts.mit.edu Team (scripts@mit.edu)
+URL: http://scripts.mit.edu
+License: GPL
+Requires: xinetd
+Source: %{name}.tar.gz
+BuildRoot: %{_tmppath}/%(%{__id_u} -n)-%{name}-%{version}-root
+%define debug_package %{nil}
+
+%description
+
+scripts.mit.edu glue associated with file execution
+Contains:
+ - Apache configuration file <execsys.conf>
+ - binfmt_misc init script <execsys-binfmt>
+ - Binary for serving static content <static-cat>
+See http://scripts.mit.edu/wiki for more information.
+
+%prep
+%setup -q -n %{name}
+
+%build
+./configure --prefix=/usr/local --with-pl=/usr/bin/perl --with-php=/usr/bin/php-cgi --with-py=/usr/bin/python --with-exe=/usr/bin/mono
+make SYSCATDIR=/usr/local/sbin
+
+%install
+[ $RPM_BUILD_ROOT != / ] && rm -rf $RPM_BUILD_ROOT
+make install DESTDIR=$RPM_BUILD_ROOT SYSCATDIR=/usr/local/sbin
+
+%clean
+[ $RPM_BUILD_ROOT != / ] && rm -rf $RPM_BUILD_ROOT
+
+%files
+%defattr(0644, root, root)
+/etc/httpd/conf.d/execsys.conf
+%defattr(0755, root, root)
+/usr/local/bin/static-cat
+/etc/init.d/execsys-binfmt
+/usr/local/sbin/ldapize.pl
+/usr/local/sbin/svnproxy.pl
+/usr/libexec/scripts-trusted/svn
+/etc/xinetd.d/scripts-svn
+/usr/local/sbin/gitproxy.pl
+/usr/libexec/scripts-trusted/git
+/etc/xinetd.d/scripts-git
+
+%post
+chkconfig --add execsys-binfmt
+service execsys-binfmt start
+service xinetd reload
+
+%preun
+if [ "$1" = "0" ] ; then
+   service execsys-binfmt stop
+   chkconfig --del execsys-binfmt
+fi
+
+%postun
+service xinetd reload
+
+%changelog
+* Wed Dec 31 2008  Quentin Smith <quentin@mit.edu>
+- don't stop execsys on package updates
+
+* Sat Sep 30 2006  Jeff Arnold <jbarnold@MIT.EDU> 0.00
+- initial prerelease version
Index: tags/fc15-eol/server/fedora/specs/fuse-better-mousetrapfs.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/fuse-better-mousetrapfs.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/fuse-better-mousetrapfs.spec	(revision 2244)
@@ -0,0 +1,40 @@
+Summary:        FUSE-Filesystem that logs and kills any accessors
+Group:          System Environment/Base
+Name:           fuse-better-mousetrapfs
+Version:        0
+Release:        1.%{scriptsversion}%{?dist}
+Vendor:         The scripts.mit.edu Team (scripts@mit.edu)
+URL:            http://scripts.mit.edu
+License:        BSD
+Source0:        %{name}.tar.gz
+BuildArch:	noarch
+
+%define debug_package %{nil}
+
+Requires:       fuse >= 2.2
+Requires:       fuse-python
+
+%description
+This is a FUSE-filesystem client which logs and kills any accessors.
+It is useful for detecting compromised accounts which are performing
+filesystem scans.
+
+%prep
+%setup -q -n %{name}
+
+%build
+
+%install
+rm -rf %{buildroot}
+install -D better-mousetrapfs %{buildroot}/usr/sbin/better-mousetrapfs
+
+%clean
+rm -rf %{buildroot}
+
+%files
+%defattr(-,root,root,-)
+/usr/sbin/better-mousetrapfs
+
+%changelog
+* Mon Mar 26 2012 Edward Z. Yang <ezyang@mit.edu> - 0-1.2150
+- Initial release.
Index: tags/fc15-eol/server/fedora/specs/ghc-MonadCatchIO-mtl.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/ghc-MonadCatchIO-mtl.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/ghc-MonadCatchIO-mtl.spec	(revision 2244)
@@ -0,0 +1,63 @@
+# For Haskell Packaging Guidelines see:
+# - https://fedoraproject.org/wiki/Packaging:Haskell
+# - https://fedoraproject.org/wiki/PackagingDrafts/Haskell
+
+%global pkg_name MonadCatchIO-mtl
+
+# common part of summary for all the subpackages
+%global common_summary Haskell %{pkg_name} library
+
+# main description used for all the subpackages
+%global common_description A %{pkg_name} library for Haskell.
+
+# Haskell library dependencies (used for buildrequires and devel/prof subpkg requires)
+%global ghc_pkg_deps ghc-mtl-devel
+
+# foreign library dependencies (used for buildrequires and devel subpkg requires)
+#%%global ghc_pkg_c_deps @CDEP1@-devel
+
+Name:           ghc-%{pkg_name}
+Version:        0.3.0.2
+Release:        0.%{scriptsversion}%{?dist}
+Summary:        %{common_summary}
+
+Group:          System Environment/Libraries
+License:        BSD
+URL:            http://hackage.haskell.org/package/%{pkg_name}
+Source0:        http://hackage.haskell.org/packages/archive/%{pkg_name}/%{version}/%{pkg_name}-%{version}.tar.gz
+# fedora ghc archs:
+ExclusiveArch:  %{ix86} x86_64 ppc alpha sparcv9
+BuildRequires:  ghc, ghc-doc, ghc-prof
+# macros for building haskell packages
+BuildRequires:  ghc-rpm-macros >= 0.7.3
+BuildRequires:  hscolour
+%{?ghc_pkg_deps:BuildRequires:  %{ghc_pkg_deps}, %(echo %{ghc_pkg_deps} | sed -e "s/\(ghc-[^, ]\+\)-devel/\1-doc,\1-prof/g")}
+%{?ghc_pkg_c_deps:BuildRequires:  %{ghc_pkg_c_deps}}
+
+%description
+%{common_description}
+
+
+%prep
+%setup -q -n %{pkg_name}-%{version}
+
+
+%build
+%ghc_lib_build
+
+
+%install
+%ghc_lib_install
+
+
+# define the devel and prof subpkgs, devel post[un] scripts, and filelists:
+# ghc-%pkg_name{,devel,prof}.files
+%ghc_lib_package
+
+
+%changelog
+* Mon May  2 2011 Alexander Chernyakhovsky <achernya@mit.edu> - 0.3.0.2-0
+- regenerated packaging with cabal2spec-0.22.5
+
+* Thu Sep  9 2010 Anders Kaseorg <andersk@mit.edu> - 0.3.0.1-0
+- initial packaging for Fedora automatically generated by cabal2spec-0.22.1
Index: tags/fc15-eol/server/fedora/specs/ghc-cgi.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/ghc-cgi.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/ghc-cgi.spec	(revision 2244)
@@ -0,0 +1,63 @@
+# For Haskell Packaging Guidelines see:
+# - https://fedoraproject.org/wiki/Packaging:Haskell
+# - https://fedoraproject.org/wiki/PackagingDrafts/Haskell
+
+%global pkg_name cgi
+
+# common part of summary for all the subpackages
+%global common_summary Haskell %{pkg_name} library
+
+# main description used for all the subpackages
+%global common_description A %{pkg_name} library for Haskell.
+
+# Haskell library dependencies (used for buildrequires and devel/prof subpkg requires)
+%global ghc_pkg_deps ghc-network-devel, ghc-parsec-devel, ghc-mtl-devel, ghc-MonadCatchIO-mtl-devel, ghc-xhtml-devel
+
+# foreign library dependencies (used for buildrequires and devel subpkg requires)
+#%%global ghc_pkg_c_deps @CDEP1@-devel
+
+Name:           ghc-%{pkg_name}
+Version:        3001.1.8.2
+Release:        0.%{scriptsversion}%{?dist}
+Summary:        %{common_summary}
+
+Group:          System Environment/Libraries
+License:        BSD
+URL:            http://hackage.haskell.org/package/%{pkg_name}
+Source0:        http://hackage.haskell.org/packages/archive/%{pkg_name}/%{version}/%{pkg_name}-%{version}.tar.gz
+# fedora ghc archs:
+ExclusiveArch:  %{ix86} x86_64 ppc alpha sparcv9
+BuildRequires:  ghc, ghc-doc, ghc-prof
+# macros for building haskell packages
+BuildRequires:  ghc-rpm-macros >= 0.7.3
+BuildRequires:  hscolour
+%{?ghc_pkg_deps:BuildRequires:  %{ghc_pkg_deps}, %(echo %{ghc_pkg_deps} | sed -e "s/\(ghc-[^, ]\+\)-devel/\1-doc,\1-prof/g")}
+%{?ghc_pkg_c_deps:BuildRequires:  %{ghc_pkg_c_deps}}
+
+%description
+%{common_description}
+
+
+%prep
+%setup -q -n %{pkg_name}-%{version}
+
+
+%build
+%ghc_lib_build
+
+
+%install
+%ghc_lib_install
+
+
+# define the devel and prof subpkgs, devel post[un] scripts, and filelists:
+# ghc-%pkg_name{,devel,prof}.files
+%ghc_lib_package
+
+
+%changelog
+* Mon May  2 2011 Alexander Chernyakhovsky <achernya@mit.edu> - 3001.1.8.2-0
+- regenerated packaging with cabal2spec-0.22.5
+
+* Thu Sep  9 2010 Anders Kaseorg <andersk@mit.edu> - 3001.1.8.1-0
+- initial packaging for Fedora automatically generated by cabal2spec-0.22.1
Index: tags/fc15-eol/server/fedora/specs/ghc-unix-handle.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/ghc-unix-handle.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/ghc-unix-handle.spec	(revision 2244)
@@ -0,0 +1,63 @@
+# For Haskell Packaging Guidelines see:
+# - https://fedoraproject.org/wiki/Packaging:Haskell
+# - https://fedoraproject.org/wiki/PackagingDrafts/Haskell
+
+%global pkg_name unix-handle
+
+# common part of summary for all the subpackages
+%global common_summary Haskell %{pkg_name} library
+
+# main description used for all the subpackages
+%global common_description A %{pkg_name} library for Haskell.
+
+# Haskell library dependencies (used for buildrequires and devel/prof subpkg requires)
+#%%global ghc_pkg_deps ghc-@DEP1@-devel, ghc-@DEP2@-devel
+
+# foreign library dependencies (used for buildrequires and devel subpkg requires)
+#%%global ghc_pkg_c_deps @CDEP1@-devel
+
+Name:           ghc-%{pkg_name}
+Version:        0.0.0
+Release:        0.%{scriptsversion}%{?dist}
+Summary:        %{common_summary}
+
+Group:          System Environment/Libraries
+License:        BSD
+URL:            http://hackage.haskell.org/package/%{pkg_name}
+Source0:        http://hackage.haskell.org/packages/archive/%{pkg_name}/%{version}/%{pkg_name}-%{version}.tar.gz
+# fedora ghc archs:
+ExclusiveArch:  %{ix86} x86_64 ppc alpha sparcv9
+BuildRequires:  ghc, ghc-doc, ghc-prof
+# macros for building haskell packages
+BuildRequires:  ghc-rpm-macros >= 0.7.3
+BuildRequires:  hscolour
+%{?ghc_pkg_deps:BuildRequires:  %{ghc_pkg_deps}, %(echo %{ghc_pkg_deps} | sed -e "s/\(ghc-[^, ]\+\)-devel/\1-doc,\1-prof/g")}
+%{?ghc_pkg_c_deps:BuildRequires:  %{ghc_pkg_c_deps}}
+
+%description
+%{common_description}
+
+
+%prep
+%setup -q -n %{pkg_name}-%{version}
+
+
+%build
+%ghc_lib_build
+
+
+%install
+%ghc_lib_install
+
+
+# define the devel and prof subpkgs, devel post[un] scripts, and filelists:
+# ghc-%pkg_name{,devel,prof}.files
+%ghc_lib_package
+
+
+%changelog
+* Mon May  2 2011 Alexander Chernyakhovsky <achernya@mit.edu> - 0.0.0-0
+- regenerated packaging with cabal2spec-0.22.5
+
+* Thu Sep  9 2010 Anders Kaseorg <andersk@mit.edu> - 0.0.0-0
+- initial packaging for Fedora automatically generated by cabal2spec-0.22.1
Index: tags/fc15-eol/server/fedora/specs/httpd.spec.patch
===================================================================
--- tags/fc15-eol/server/fedora/specs/httpd.spec.patch	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/httpd.spec.patch	(revision 2244)
@@ -0,0 +1,85 @@
+--- httpd.spec.~1~	2012-02-13 09:46:36.000000000 -0500
++++ httpd.spec	2012-03-26 01:33:53.247271289 -0400
+@@ -8,7 +8,7 @@
+ Summary: Apache HTTP Server
+ Name: httpd
+ Version: 2.2.22
+-Release: 1%{?dist}
++Release: 1%{?dist}.scripts.%{scriptsversion}
+ URL: http://httpd.apache.org/
+ Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
+ Source1: index.html
+@@ -54,6 +54,15 @@
+ Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa}
+ Requires: httpd-tools = %{version}-%{release}, apr-util-ldap, systemd-units
+ 
++Provides: scripts-httpd = %{version}-%{release}
++Patch1000: httpd-suexec-scripts.patch
++Patch1003: httpd-2.2.x-mod_status-security.patch
++Patch1004: httpd-2.2.x-304.patch
++Patch1005: httpd-2.2.x-mod_ssl-sessioncaching.patch
++Patch1006: httpd-suexec-cloexec.patch
++Patch1007: httpd-fixup-vhost.patch
++Patch1008: httpd-sysv-deps.patch
++
+ %description
+ The Apache HTTP Server is a powerful, efficient, and extensible
+ web server.
+@@ -64,6 +76,7 @@
+ Obsoletes: secureweb-devel, apache-devel, stronghold-apache-devel
+ Requires: apr-devel, apr-util-devel, pkgconfig
+ Requires: httpd = %{version}-%{release}
++Provides: scripts-httpd-devel = %{version}-%{release}
+ 
+ %description devel
+ The httpd-devel package contains the APXS binary and other files
+@@ -102,6 +115,7 @@
+ Requires(post): openssl, /bin/cat
+ Requires(pre): httpd
+ Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
++Provides: scripts-mod_ssl
+ Obsoletes: stronghold-mod_ssl
+ 
+ %description -n mod_ssl
+@@ -110,6 +124,11 @@
+ Security (TLS) protocols.
+ 
+ %prep
++
++# Horrible hack to patch the httpd.init file
++cd $RPM_SOURCE_DIR
++%patch1008 -p1 -b .sysv-deps
++
+ %setup -q
+ %patch1 -p1 -b .apctl
+ %patch2 -p1 -b .apxs
+@@ -128,6 +147,14 @@
+ # Patch in vendor/release string
+ sed "s/@RELEASE@/%{vstring}/" < %{PATCH20} | patch -p1
+ 
++%patch1000 -p1 -b .scripts
++%patch1003 -p1 -b .permitstatus
++%patch1004 -p1 -b .scripts-304
++%patch1005 -p1 -b .ssl-sessioncache
++%patch1006 -p1 -b .cloexec
++%patch1007 -p1 -b .fixup-vhost
++# Note that patch1008 is not here, as it patches the initscript elsewhere in this .spec
++
+ # Safety check: prevent build if defined MMN does not equal upstream MMN.
+ vmmn=`echo MODULE_MAGIC_NUMBER_MAJOR | cpp -include include/ap_mmn.h | sed -n '/^2/p'`
+ if test "x${vmmn}" != "x%{mmn}"; then
+@@ -175,10 +205,12 @@
+         --with-apr=%{_prefix} --with-apr-util=%{_prefix} \
+ 	--enable-suexec --with-suexec \
+ 	--with-suexec-caller=%{suexec_caller} \
+-	--with-suexec-docroot=%{contentdir} \
++	--with-suexec-docroot=/ \
++	--with-suexec-userdir=web_scripts \
++	--with-suexec-trusteddir=/usr/libexec/scripts-trusted \
+ 	--with-suexec-logfile=%{_localstatedir}/log/httpd/suexec.log \
+ 	--with-suexec-bin=%{_sbindir}/suexec \
+-	--with-suexec-uidmin=500 --with-suexec-gidmin=100 \
++	--with-suexec-uidmin=50 --with-suexec-gidmin=50 \
+         --enable-pie \
+         --with-pcre \
+ 	$*
Index: tags/fc15-eol/server/fedora/specs/httpdmods.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/httpdmods.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/httpdmods.spec	(revision 2244)
@@ -0,0 +1,57 @@
+Summary: scripts.mit.edu custom apache modules
+Group: Applications/System
+Name: httpdmods 
+Version: 0.%{scriptsversion}
+Release: 0
+Vendor: The scripts.mit.edu Team (scripts@mit.edu)
+URL: http://scripts.mit.edu
+License: GPL
+Source: %{name}.tar.gz 
+BuildRoot: %{_tmppath}/%(%{__id_u} -n)-%{name}-%{version}-root
+BuildRequires: scripts-httpd-devel >= 2.2.15-1.fc11.1.scripts.1606
+Requires: httpd%{?_isa}
+Requires: scripts-httpd >= 2.2.15-1.fc11.1.scripts.1606
+%define debug_package %{nil}
+
+%description 
+
+scripts.mit.edu custom apache modules
+Contains:
+ - module to do authentication based on SSL certificates <mod_auth_sslcert>
+ - module to do authorization based on Athena AFS groups <mod_authz_afsgroup>
+ - module to enable optional authentication <mod_auth_optional>
+ - module to get vhosts from LDAP, taken from Debian <mod_vhost_ldap>
+ - module to use the original destination address of a request that
+     has gone through something like a transparent proxy <mod_original_dst>
+See http://scripts.mit.edu/wiki for more information.
+
+%prep
+%setup -q -n %{name}
+
+%build
+./configure CFLAGS="-I/usr/include/httpd -I/usr/include/apr-1"
+make
+
+%install
+[ $RPM_BUILD_ROOT != / ] && rm -rf $RPM_BUILD_ROOT
+install -D .libs/mod_auth_sslcert.so $RPM_BUILD_ROOT/usr/lib64/httpd/modules/mod_auth_sslcert.so
+install -D .libs/mod_authz_afsgroup.so $RPM_BUILD_ROOT/usr/lib64/httpd/modules/mod_authz_afsgroup.so
+install -D .libs/mod_auth_optional.so $RPM_BUILD_ROOT/usr/lib64/httpd/modules/mod_auth_optional.so
+install -D .libs/mod_vhost_ldap.so $RPM_BUILD_ROOT/usr/lib64/httpd/modules/mod_vhost_ldap.so
+install -D .libs/mod_original_dst.so $RPM_BUILD_ROOT/usr/lib64/httpd/modules/mod_original_dst.so
+
+%clean
+[ $RPM_BUILD_ROOT != / ] && rm -rf $RPM_BUILD_ROOT
+
+%files
+%defattr(0755, root, root)
+/usr/lib64/httpd/modules/mod_auth_sslcert.so
+/usr/lib64/httpd/modules/mod_authz_afsgroup.so
+/usr/lib64/httpd/modules/mod_auth_optional.so
+/usr/lib64/httpd/modules/mod_vhost_ldap.so
+/usr/lib64/httpd/modules/mod_original_dst.so
+
+%changelog
+
+* Sun Jan 13 2006  Jeff Arnold <jbarnold@MIT.EDU> 0.00
+- initial prerelease version
Index: tags/fc15-eol/server/fedora/specs/krb5.spec.patch
===================================================================
--- tags/fc15-eol/server/fedora/specs/krb5.spec.patch	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/krb5.spec.patch	(revision 2244)
@@ -0,0 +1,36 @@
+--- krb5.spec.~1~	2012-03-08 16:20:41.000000000 -0500
++++ krb5.spec	2012-04-01 22:07:14.834013302 -0400
+@@ -6,7 +6,7 @@
+ Summary: The Kerberos network authentication system
+ Name: krb5
+ Version: 1.9.3
+-Release: 1%{?dist}
++Release: 1%{?dist}.scripts.%{scriptsversion}
+ # Maybe we should explode from the now-available-to-everybody tarball instead?
+ # http://web.mit.edu/kerberos/dist/krb5/1.9/krb5-1.9.3-signed.tar
+ Source0: krb5-%{version}.tar.gz
+@@ -64,6 +64,8 @@
+ Patch102: krb5-1.9-7048.patch
+ Patch103: krb5-kvno-230379.patch
+ 
++Patch1000: krb5-kuserok-scripts.patch
++
+ License: MIT
+ URL: http://web.mit.edu/kerberos/www/
+ Group: System Environment/Libraries
+@@ -113,6 +115,7 @@
+ %package libs
+ Summary: The shared libraries used by Kerberos 5
+ Group: System Environment/Libraries
++Provides: scripts-krb5-libs, scripts-krb5-libs%{?_isa}
+ 
+ %description libs
+ Kerberos is a network authentication system. The krb5-libs package
+@@ -219,6 +222,7 @@
+ %patch101 -p1 -b .7047
+ %patch102 -p1 -b .7048
+ %patch103 -p1 -b .kvno
++%patch1000 -p1 -b .kuserok
+ gzip doc/*.ps
+ 
+ sed -i -e '1s!\[twoside\]!!;s!%\(\\usepackage{hyperref}\)!\1!' doc/api/library.tex
Index: tags/fc15-eol/server/fedora/specs/logview.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/logview.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/logview.spec	(revision 2244)
@@ -0,0 +1,55 @@
+Summary: scripts.mit.edu logview program
+Group: Applications/System
+Name: logview
+Version: 0.%{scriptsversion}
+Release: 0
+Vendor: The scripts.mit.edu Team (scripts@mit.edu)
+URL: http://scripts.mit.edu
+License: GPL
+Source: %{name}.tar.gz 
+BuildRoot: %{_tmppath}/%(%{__id_u} -n)-%{name}-%{version}-root
+%define debug_package %{nil}
+
+%description 
+
+scripts.mit.edu logview program
+See http://scripts.mit.edu/wiki for more information.
+
+%prep
+%setup -q -n %{name}
+
+%build
+./configure
+make
+
+%install
+[ $RPM_BUILD_ROOT != / ] && rm -rf $RPM_BUILD_ROOT
+make install DESTDIR=$RPM_BUILD_ROOT prefix=/usr/local
+
+%clean
+[ $RPM_BUILD_ROOT != / ] && rm -rf $RPM_BUILD_ROOT
+
+%pre
+useradd logview || [ $? -eq 9 ]
+chmod 710 /home/logview
+
+%postun
+if [ "$1" = "0" ] ; then
+   userdel logview
+fi
+
+%files
+%defattr(0755, root, root)
+/usr/local/bin/logview.pl
+%defattr(2755, root, logview)
+/usr/local/bin/logview
+
+%changelog
+* Wed Dec 31 2008  Quentin Smith <quentin@mit.edu>
+- ignore preexisting user
+
+* Wed Dec 31 2008  Quentin Smith <quentin@mit.edu> - 0.917-0
+- don't delete logview user on upgrades
+
+* Tue Jan 30 2006  Jeff Arnold <jbarnold@MIT.EDU> 0.00
+- prerelease
Index: tags/fc15-eol/server/fedora/specs/moira.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/moira.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/moira.spec	(revision 2244)
@@ -0,0 +1,236 @@
+# Make sure to update these to coincide with the most recent debathena-moira
+# release from http://debathena.mit.edu/apt/pool/debathena/d/debathena-moira/
+%define upstreamversion 4.0.0
+%define snapshotversion svn20100405
+Summary: moira libraries, clients, and friends
+Group: Applications/System
+Name: moira
+Version: %{upstreamversion}
+Release: 6.%{scriptsversion}.%{snapshotversion}
+Vendor: The scripts.mit.edu Team (scripts@mit.edu)
+URL: http://scripts.mit.edu
+License: MIT
+Source: debathena-%{name}_%{upstreamversion}+%{snapshotversion}.orig.tar.gz
+BuildRoot: %{_tmppath}/%(%{__id_u} -n)-%{name}-%{version}-root
+#TODO: might really need mit-zephyr-devel, something for autotools-dev
+BuildRequires: readline-devel, e2fsprogs-devel, ncurses-devel, krb5-devel, hesiod-devel
+Patch1: moira-update-server.rc.patch
+Patch2: moira-fix-manpage-paths.patch
+
+%description
+The moira library and clients.  Clone of debathena-moira.
+See http://scripts.mit.edu/wiki for more information.
+
+%prep
+%setup -q -n debathena-%{name}-%{upstreamversion}+%{snapshotversion}
+%patch1
+%patch2 -p1
+
+%build
+# Hack: Add /usr/include/et to put com_err.h on the C include path.
+# Can remove this once the maintainer of the relevant package symlinks
+# com_err.h in /usr/include.
+# (See https://bugzilla.redhat.com/show_bug.cgi?id=550889)
+# TODO: --with-zephyr is currently borked
+%configure --without-krb4 --with-krb5 --with-hesiod --without-zephyr --without-oracle --without-afs --disable-rpath --with-com_err=/usr CFLAGS='-I /usr/include/et'
+make %{?_smp_mflags}
+
+%install
+rm -rf %{buildroot}
+make install DESTDIR=%{buildroot}
+mv %{buildroot}/%{_bindir}/chfn %{buildroot}/%{_bindir}/chfn.moira
+mv %{buildroot}/%{_bindir}/chsh %{buildroot}/%{_bindir}/chsh.moira
+mv %{buildroot}/%{_mandir}/man1/chsh.1 \
+   %{buildroot}/%{_mandir}/man1/chsh.moira.1
+mv %{buildroot}/%{_mandir}/man1/chfn.1 \
+   %{buildroot}/%{_mandir}/man1/chfn.moira.1
+install -m 755 -d %{buildroot}/%{_initddir}
+install -m 755 moira-update-server.init %{buildroot}/%{_initddir}/moira-update-server
+# Hack: These man files are installed but no package uses them
+rm %{buildroot}/%{_mandir}/man8/dcm.8
+rm %{buildroot}/%{_mandir}/man8/moirad.8
+rm %{buildroot}/%{_mandir}/man8/reg_svr.8
+rm %{buildroot}/%{_mandir}/man8/setquota.8
+rm %{buildroot}/%{_mandir}/man8/startdcm.8
+rm %{buildroot}/%{_mandir}/man8/startmoira.8
+rm %{buildroot}/%{_mandir}/man8/startreg.8
+
+%clean
+rm -rf %{buildroot}
+
+# clients
+%package clients
+Summary: Clients for the Moira database
+Group: Applications/System
+# Might need mit-zephyr-devel
+# Requires: mit-zephyr
+%description clients
+Moira is the Athena Service Management system.  It serves as the 
+central repository for information about users, groups hosts, print 
+queues, and several other aspects of the Athena environment.
+
+This package contains clients such as moira, stella, blanche, etc.
+
+%files clients
+%defattr(755,root,root)
+%{_bindir}/addusr
+%{_bindir}/blanche
+%{_bindir}/chfn.moira
+%{_bindir}/chpobox
+%{_bindir}/chsh.moira
+%{_bindir}/eunice
+%{_bindir}/mitch
+%{_bindir}/namespace
+%{_bindir}/moira
+%{_bindir}/mrcheck
+%{_bindir}/mrtest
+%{_bindir}/stanley
+%{_bindir}/stella
+%{_bindir}/mailmaint
+%{_bindir}/listmaint
+%{_bindir}/dcmmaint
+%{_bindir}/usermaint
+%{_bindir}/update_test
+%defattr(-,root,root)
+%doc %{_mandir}/man1/*
+%doc %{_mandir}/man8/mrtest.8.gz
+
+
+# update-server
+%package update-server
+Summary: Athena update_server
+Group: Applications/System
+# Might need mit-zephyr-devel
+# Requires: mit-zephyr
+Requires(post): chkconfig
+Requires(preun): chkconfig
+%description update-server
+Moira is the Athena Service Management system.  It serves as the 
+central repository for information about users, groups hosts, print 
+queues, and several other aspects of the Athena environment.
+
+This package contains the update_server daemon, which is used for
+servers that automatically receive information dumps from moira.
+
+%files update-server
+%defattr(-,root,root)
+%doc %{_mandir}/man8/update_server.8.gz
+%config(noreplace) %{_sysconfdir}/moira.conf
+%defattr(755,root,root)
+%{_sbindir}/update_server
+%{_initddir}/moira-update-server
+
+%post update-server
+/sbin/chkconfig --add moira-update-server
+%{_initddir}/moira-update-server condrestart
+
+%preun update-server
+if [ $1 = 0 ] ; then
+    /sbin/service moira-update-server stop >/dev/null 2>&1
+    /sbin/chkconfig --del moira-update-server
+fi
+
+# libmoira0
+%package -n libmoira0
+Summary: The Moira library
+Group: System Environment/Libraries
+%description -n libmoira0
+Moira is the Athena Service Management system.  It serves as the 
+central repository for information about users, groups hosts, print 
+queues, and several other aspects of the Athena environment.
+
+This package contains the shared Moira library.
+
+%post -n libmoira0 -p /sbin/ldconfig
+%postun -n libmoira0 -p /sbin/ldconfig
+
+%files -n libmoira0
+%defattr(-,root,root)
+%{_libdir}/libmoira.so.*
+
+# libmoira-devel
+%package -n libmoira-devel
+Summary: Development files for Moira library
+Group: Development/Libraries
+# Might need mit-zephyr-devel
+# Requires: mit-zephyr
+Requires: libmoira0 = %{version}-%{release}, e2fsprogs-devel, krb5-devel, hesiod-devel
+%description -n libmoira-devel
+Moira is the Athena Service Management system.  It serves as the 
+central repository for information about users, groups hosts, print 
+queues, and several other aspects of the Athena environment.
+
+This package contains headers and static libraries for development.
+
+%post -n libmoira-devel -p /sbin/ldconfig
+%postun -n libmoira-devel -p /sbin/ldconfig
+
+%files -n libmoira-devel
+%defattr(-,root,root)
+%{_includedir}/moira
+%exclude %{_includedir}/moira/mrclient.h
+%doc %{_mandir}/man3/*
+%{_libdir}/libmoira.so
+%{_libdir}/libmoira.la
+%{_libdir}/libmoira.a
+
+# libmrclient0
+%package -n libmrclient0
+Summary: The Moira client library
+Group: System Environment/Libraries
+%description -n libmrclient0
+Moira is the Athena Service Management system.  It serves as the 
+central repository for information about users, groups hosts, print 
+queues, and several other aspects of the Athena environment.
+
+This package contains the shared Moira client library.
+
+%post -n libmrclient0 -p /sbin/ldconfig
+%postun -n libmrclient0 -p /sbin/ldconfig
+
+%files -n libmrclient0
+%defattr(-,root,root)
+%{_libdir}/libmrclient.so.*
+
+# libmrclient-devel
+%package -n libmrclient-devel
+Summary: Development files for Moira client library
+Group: Development/Libraries
+Requires: libmrclient0 = %{version}-%{release}, libmoira-devel = %{version}-%{release}
+%description -n libmrclient-devel
+Moira is the Athena Service Management system.  It serves as the 
+central repository for information about users, groups hosts, print 
+queues, and several other aspects of the Athena environment.
+
+This package contains headers and static libraries for development.
+
+%post -n libmrclient-devel -p /sbin/ldconfig
+%postun -n libmrclient-devel -p /sbin/ldconfig
+
+%files -n libmrclient-devel
+%defattr(-,root,root)
+%{_includedir}/moira/mrclient.h
+%{_libdir}/libmrclient.so
+%{_libdir}/libmrclient.la
+%{_libdir}/libmrclient.a
+
+%changelog
+* Thu Apr 08 2010 Mitchell Berger <mitchb@mit.edu> - 4.0.0-6.1534.svn20100405
+- Update to new original upstream version (svn snapshot)
+
+* Thu Feb 25 2010 Mitchell Berger <mitchb@mit.edu> - 4.0.0-5.1490.svn20100225
+- Update to new original upstream version (svn snapshot)
+
+* Thu Feb 25 2010 Mitchell Berger <mitchb@mit.edu> - 4.0.0-4.1489M.svn20100223
+- Update to new original upstream version (svn snapshot)
+- Drop install-headers patch which was incorporated upstream (from Debathena)
+
+* Tue Jan 05 2010 Mitchell Berger <mitchb@mit.edu> - 4.0.0-3.1405M.svn20100104
+- Update to new original upstream version (svn snapshot)
+- Build and install libmrclient as a shared library (from Debathena)
+
+* Mon Dec 28 2009 Mitchell Berger <mitchb@mit.edu> - 4.0.0-2.1402.cvs20091228
+- Update to new upstream version, including eunice printer client
+
+* Sat Dec 26 2009 Greg Brockman <gdb@mit.edu> - 4.0.0-2.1380.cvs20091116
+- Initial packaging of Moira on Fedora
Index: tags/fc15-eol/server/fedora/specs/nss_nonlocal.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/nss_nonlocal.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/nss_nonlocal.spec	(revision 2244)
@@ -0,0 +1,77 @@
+Summary: nsswitch proxy module to prevent local account spoofing
+Group: System Environment/Libraries
+Name: nss_nonlocal
+Version: 2.0
+Release: 1
+URL: http://debathena.mit.edu/nss_nonlocal/
+BuildRequires: autoconf
+BuildRequires: automake
+BuildRequires: libtool
+License: LGPLv2+
+Source: %{name}.tar.gz
+BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+Requires(pre): shadow-utils
+
+%description
+This nsswitch module acts as a proxy for other nsswitch modules like hesiod,
+but prevents non-local users from potentially gaining local privileges by
+spoofing local UIDs and GIDs.
+
+%prep
+%setup -q -n %{name}
+
+cat >find_requires.sh <<EOF
+#!/bin/sh
+%{__find_requires} | grep -v GLIBC_PRIVATE
+exit 0
+EOF
+chmod +x find_requires.sh
+%define _use_internal_dependency_generator 0
+%define __find_requires %{_builddir}/%{buildsubdir}/find_requires.sh
+
+%build
+autoreconf -i
+%configure --libdir=/%{_lib}
+make
+
+%install
+[ $RPM_BUILD_ROOT != / ] && rm -rf $RPM_BUILD_ROOT
+make install DESTDIR=$RPM_BUILD_ROOT
+
+%clean
+[ $RPM_BUILD_ROOT != / ] && rm -rf $RPM_BUILD_ROOT
+
+%files
+%defattr(-, root, root)
+%doc README
+/%{_lib}/libnss_nonlocal.so.*
+
+%pre
+getent passwd nss-nonlocal-users >/dev/null || \
+    useradd -r -g nobody -d / -s /sbin/nologin \
+    -c 'Magic user for local group whitelist' nss-nonlocal-users
+getent group nss-local-users || groupadd -r nss-local-users
+getent group nss-nonlocal-users || groupadd -r nss-nonlocal-users
+exit 0
+
+%post
+/sbin/ldconfig
+
+%postun
+/sbin/ldconfig
+
+%changelog
+
+* Tue Mar 29 2011 Anders Kaseorg <andersk@mit.edu> 2.0-1
+- New upstream version.
+
+* Sun May  2 2010 Anders Kaseorg <andersk@mit.edu> 1.11-1
+- New upstream version.
+
+* Fri Mar 12 2010 Mitchell Berger <mitchb@mit.edu> 1.9-1
+- Per Fedora packaging guidelines, don't ever remove groups.
+- Rebuild to ensure that the nss-nonlocal-users group is added, even if it was
+  previously rejected by a buggy groupadd with an incorrect name length limit.
+
+* Thu May  8 2008 Anders Kaseorg <andersk@mit.edu> 1.6-0
+- Initial RPM release.
Index: tags/fc15-eol/server/fedora/specs/openafs.spec.patch
===================================================================
--- tags/fc15-eol/server/fedora/specs/openafs.spec.patch	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/openafs.spec.patch	(revision 2244)
@@ -0,0 +1,107 @@
+--- openafs.spec	2012-02-13 15:41:02.757592190 -0500
++++ openafs.spec.~3~	2012-02-13 15:48:25.366294629 -0500
+@@ -4,7 +4,7 @@
+ %define pkgvers 1.6.0
+ # for beta/rc releases make pkgrel 0.<tag>
+ # for real releases make pkgrel 1 (or more for extra releases)
+-%define pkgrel 1
++%define pkgrel 1.99.scripts.%{scriptsversion}
+ 
+ %{!?fedorakmod: %define fedorakmod 1}
+ %{!?build_dkmspkg: %define build_dkmspkg 1}
+@@ -237,6 +237,11 @@
+ 
+ ExclusiveArch: %{ix86} x86_64 ia64 s390 s390x sparc64 ppc ppc64
+ 
++Patch1000: openafs-scripts.patch
++Patch1001: openafs-systemd-remote-fs.patch
++Patch1002: openafs-systemd-crond.patch
++Patch1003: openafs-systemd-csdb.patch
++
+ #    http://dl.openafs.org/dl/openafs/candidate/%{afsvers}/...
+ Source0: http://www.openafs.org/dl/openafs/%{afsvers}/openafs-%{afsvers}-src.tar.bz2
+ Source1: http://www.openafs.org/dl/openafs/%{afsvers}/openafs-%{afsvers}-doc.tar.bz2
+@@ -316,6 +325,7 @@
+ %if %{build_userspace}
+ 
+ %package client
++Provides: scripts-openafs-client
+ Requires: binutils, openafs = %{version}
+ 
+ %if %{fedorakmod}
+@@ -376,6 +386,7 @@
+ 
+ %if %{build_authlibs}
+ %package authlibs
++Provides: scripts-openafs-authlibs
+ Summary: OpenAFS authentication shared libraries
+ Group: Networking/Filesystems
+ 
+@@ -392,6 +403,7 @@
+ %endif
+ 
+ %package authlibs-devel
++Provides: scripts-openafs-authlibs-devel
+ %if %{build_authlibs}
+ Requires: openafs-authlibs = %{version}-%{release}
+ %endif
+@@ -410,6 +422,7 @@
+ libraries.
+ 
+ %package devel
++Provides: scripts-openafs-devel
+ Summary: OpenAFS Development Libraries and Headers
+ Group: Development/Filesystems
+ Requires: openafs = %{version}-%{release}
+@@ -439,6 +452,7 @@
+ administrators.
+ 
+ %package kernel-source
++Provides: scripts-openafs-kernel-source
+ Summary: OpenAFS Kernel Module source tree
+ Group: Networking/Filesystems
+ Provides: openafs-kernel = %{version}
+@@ -488,6 +502,7 @@
+ 
+ %if %{krb5support}
+ %package krb5
++Provides: scripts-openafs-krb5
+ Summary: OpenAFS programs to use with krb5
+ Requires: openafs = %{version}
+ Group: Networking/Filesystems
+@@ -514,7 +529,7 @@
+ %if %{build_modules}
+ 
+ %if %{fedorakmod}
+-%{expand:%(%{kmodtool} rpmtemplate %{kmod_name} %{kverrel} %{kvariants} 2>/dev/null)}
++%{expand:%(%{kmodtool} rpmtemplate %{kmod_name} %{kverrel} %{kvariants} | sed '/^%package/ aProvides: scripts-kmod-openafs' 2>/dev/null)}
+ 
+ %else
+ 
+@@ -671,6 +686,12 @@
+ #%setup -q -n %{srcdir}
+ %setup -q -b 1 -n %{srcdir}
+ 
++# Apply the Scripts patch
++%patch1000 -p1 -b .scripts
++%patch1001 -p1 -b .systemd-remote-fs
++%patch1002 -p1 -b .systemd-crond
++%patch1003 -p1 -b .systemd-csdb
++
+ ##############################################################################
+ #
+ # building
+@@ -1212,6 +1237,13 @@
+ rm -f $RPM_BUILD_ROOT%{_libdir}/libafsrpc.so
+ rm -f $RPM_BUILD_ROOT%{_libdir}/libafsauthent.so.*
+ rm -f $RPM_BUILD_ROOT%{_libdir}/libafsrpc.so.*
++%else
++chmod +x $RPM_BUILD_ROOT%{_libdir}/libafsauthent.so
++chmod +x $RPM_BUILD_ROOT%{_libdir}/libafsrpc.so
++chmod +x $RPM_BUILD_ROOT%{_libdir}/libafsauthent.so.*
++chmod +x $RPM_BUILD_ROOT%{_libdir}/libafsrpc.so.*
++chmod +x $RPM_BUILD_ROOT%{_libdir}/libkopenafs.so
++chmod +x $RPM_BUILD_ROOT%{_libdir}/libkopenafs.so.*
+ %endif
+ 
+ %endif
Index: tags/fc15-eol/server/fedora/specs/openssh.spec.patch
===================================================================
--- tags/fc15-eol/server/fedora/specs/openssh.spec.patch	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/openssh.spec.patch	(revision 2244)
@@ -0,0 +1,36 @@
+--- openssh.spec.~1~	2012-02-14 11:06:13.000000000 -0500
++++ openssh.spec	2012-02-25 13:02:28.660616538 -0500
+@@ -78,7 +78,7 @@
+ Summary: An open source implementation of SSH protocol versions 1 and 2
+ Name: openssh
+ Version: %{openssh_ver}
+-Release: %{openssh_rel}%{?dist}%{?rescue_rel}
++Release: %{openssh_rel}%{?dist}%{?rescue_rel}.scripts.%{scriptsversion}
+ URL: http://www.openssh.com/portable.html
+ #URL1: http://pamsshagentauth.sourceforge.net
+ #Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
+@@ -92,6 +92,7 @@
+ Source3: sshd.init
+ Source4: http://prdownloads.sourceforge.net/pamsshagentauth/pam_ssh_agent_auth/pam_ssh_agent_auth-%{pam_ssh_agent_ver}.tar.bz2
+ Source5: pam_ssh_agent-rmheaders
++Patch1001: openssh-4.7p1-gssapi-name-in-env.patch
+ 
+ Patch100: openssh-5.6p1-wIm.patch
+ Patch0: openssh-5.6p1-redhat.patch
+@@ -214,6 +215,7 @@
+ Requires(pre): /usr/sbin/useradd
+ Requires: pam >= 1.0.1-3
+ Requires: fipscheck-lib%{_isa} >= 1.3.0
++Provides: scripts-openssh-server
+ 
+ %if %{ldap}
+ %package ldap
+@@ -333,6 +335,8 @@
+ %patch83 -p0 -b .oomkiller
+ %patch84 -p1 -b .legacy
+ 
++%patch1001 -p1 -b .gssapi-env
++
+ autoreconf
+ pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
+ autoreconf
Index: tags/fc15-eol/server/fedora/specs/php_scripts.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/php_scripts.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/php_scripts.spec	(revision 2244)
@@ -0,0 +1,41 @@
+Summary: scripts.mit.edu php logging module
+Group: Applications/System
+Name: php_scripts
+Version: 0.%{scriptsversion}
+Release: 0
+Vendor: The scripts.mit.edu Team (scripts@mit.edu)
+URL: http://scripts.mit.edu
+License: GPL
+Source: %{name}.tar.gz 
+BuildRoot: %{_tmppath}/%(%{__id_u} -n)-%{name}-%{version}-root
+BuildRequires: php-devel
+%define debug_package %{nil}
+
+%description 
+
+scripts.mit.edu php logging module
+
+%prep
+%setup -q -n %{name}
+
+%build
+cp php_scripts-config.m4 config.m4
+phpize
+./configure
+make
+
+%install
+[ $RPM_BUILD_ROOT != / ] && rm -rf $RPM_BUILD_ROOT
+install -D .libs/scripts.so $RPM_BUILD_ROOT/usr/lib64/php/modules/scripts.so
+
+%clean
+[ $RPM_BUILD_ROOT != / ] && rm -rf $RPM_BUILD_ROOT
+
+%files
+%defattr(0755, root, root)
+/usr/lib64/php/modules/scripts.so
+
+%changelog
+
+* Fri Jul 03 2009  Mitchell Berger <mitchb@MIT.EDU> 0.00
+- initial version
Index: tags/fc15-eol/server/fedora/specs/python-afs.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/python-afs.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/python-afs.spec	(revision 2244)
@@ -0,0 +1,49 @@
+Name:           python-afs
+Version:        0.1.1
+%define commit_hash dceee3da
+%define tag_hash fb29c26
+Release:        0.%{scriptsversion}%{?dist}
+Summary:        Python access to AFS library
+
+Group:          Development/Languages
+License:        GPL
+URL:            http://github.com/ebroder/pyafs
+Source0:        http://github.com/ebroder/pyafs/tarball/%{version}/ebroder-%{name}-%{version}-0-g%{commit_hash}.tar.gz
+Patch1:         https://github.com/ebroder/pyafs/commit/94a09d55edd7d3c1b53424ee1a39245db751c5e9.patch
+Patch2:         https://github.com/ebroder/pyafs/commit/d6425bd9fa52034a2a62ed95c8fec8cbcfd2707d.patch
+BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+
+BuildRequires:  python-devel, python-setuptools, Cython, openafs-devel, openafs-authlibs-devel, krb5-devel
+
+%description
+Get at AFS from Python.
+
+
+%prep
+%setup -q -n ebroder-pyafs-%{tag_hash}
+%patch1 -p1
+%patch2 -p1
+
+
+%build
+CFLAGS="$RPM_OPT_FLAGS" CPPFLAGS="-I%{_includedir}/et" %{__python} setup.py build
+
+
+%install
+rm -rf $RPM_BUILD_ROOT
+%{__python} setup.py install -O1 --skip-build --root $RPM_BUILD_ROOT
+
+ 
+%clean
+rm -rf $RPM_BUILD_ROOT
+
+
+%files
+%defattr(-,root,root,-)
+%{python_sitearch}/*
+
+
+%changelog
+* Thu Dec 15 2011 Alex Dehnert <adehnert@mit.edu> - 0.1.1
+- Initial RPM release
+
Index: tags/fc15-eol/server/fedora/specs/python-zephyr.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/python-zephyr.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/python-zephyr.spec	(revision 2244)
@@ -0,0 +1,50 @@
+%{!?python_sitearch: %global python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(1))")}
+
+Name:           python-zephyr
+Version:        0.2.0
+%define commit_hash c9a7f05
+%define tag_hash ed65206
+Release:        0.%{scriptsversion}%{?dist}
+Summary:        Python access to zephyr library
+
+Group:          Development/Languages
+License:        MIT
+URL:            http://github.com/ebroder/python-zephyr
+Source0:        http://github.com/ebroder/python-zephyr/tarball/%{version}/ebroder-%{name}-%{version}-0-g%{commit_hash}.tar.gz
+Patch1:         http://github.com/ebroder/python-zephyr/commit/944b3c3a2a2476758268d4b75b65c2ec38fa46e7.patch
+BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+
+BuildRequires:  python-devel, python-setuptools, Pyrex, zephyr-devel, libcom_err-devel
+
+%description
+Get at the zephyr library from Python.  Woo.
+
+
+%prep
+%setup -q -n ebroder-%{name}-%{tag_hash}
+%patch1 -p1
+
+
+%build
+CFLAGS="$RPM_OPT_FLAGS" CPPFLAGS="-I%{_includedir}/et" %{__python} setup.py build
+
+
+%install
+rm -rf $RPM_BUILD_ROOT
+%{__python} setup.py install -O1 --skip-build --root $RPM_BUILD_ROOT
+
+ 
+%clean
+rm -rf $RPM_BUILD_ROOT
+
+
+%files
+%defattr(-,root,root,-)
+%doc
+%{python_sitearch}/*
+
+
+%changelog
+* Sun Sep 19 2010 Anders Kaseorg <andersk@mit.edu> - 0.2.0-0
+- Initial RPM release
+
Index: tags/fc15-eol/server/fedora/specs/redland-bindings.spec.patch
===================================================================
--- tags/fc15-eol/server/fedora/specs/redland-bindings.spec.patch	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/redland-bindings.spec.patch	(revision 2244)
@@ -0,0 +1,20 @@
+--- redland-bindings.spec.old	2011-10-12 14:51:58.000000000 -0400
++++ redland-bindings.spec	2011-10-13 10:15:24.000000000 -0400
+@@ -1,6 +1,6 @@
+ Name:           redland-bindings
+ Version:        1.0.11.1
+-Release:        6%{?dist}
++Release:        6%{?dist}.scripts.%{scriptsversion}
+ Summary:        Redland RDF Application Framework API Bindings
+ 
+ Group:          System Environment/Libraries
+@@ -137,6 +137,9 @@
+ autoconf
+ automake
+ 
++# Horrible hack to make PHP work
++sed -i -e 's/zend_error_noreturn/zend_error/' php/*
++
+ # when specifying system redland, the configure check for the version
+ # allows newer redland libraries; without it it doesn't.
+ # authors says that older bindings work with newer redlands.
Index: tags/fc15-eol/server/fedora/specs/rubygems.spec.patch
===================================================================
--- tags/fc15-eol/server/fedora/specs/rubygems.spec.patch	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/rubygems.spec.patch	(revision 2244)
@@ -0,0 +1,30 @@
+--- rubygems.spec.~1~	2012-04-20 14:46:27.000000000 -0400
++++ rubygems.spec	2012-05-03 14:12:52.421863447 -0400
+@@ -15,7 +15,7 @@
+ Summary:	The Ruby standard for packaging ruby libraries
+ Name:		rubygems
+ Version:	1.7.2
+-Release:	5%{?dist}
++Release:	5%{?dist}.scripts.%{scriptsversion}
+ Group:		Development/Libraries
+ # No GPL version is specified.
+ License:	Ruby or GPL+
+@@ -42,6 +42,9 @@
+ # Insecure connection to SSL repository fix
+ Patch10:	rubygems-1.x.x-ssl-connection-don_t-revert.patch
+ 
++Provides: scripts-rubygems = %{version}-%{release}
++Patch1000: rubygems-rails-require-thread.patch
++
+ Requires:	ruby(abi) = 1.8
+ Requires:	ruby >= 1.8.7
+ Requires:	ruby-rdoc
+@@ -83,6 +86,8 @@
+ %patch7 -p1 -b .esc.skip
+ %patch10 -p1 -b .ssl
+ 
++%patch1000 -p1 -b .thread
++
+ # Some of the library files start with #! which rpmlint doesn't like
+ # and doesn't make much sense
+ for f in `find lib -name \*.rb` ; do
Index: tags/fc15-eol/server/fedora/specs/scripts-base.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/scripts-base.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/scripts-base.spec	(revision 2244)
@@ -0,0 +1,58 @@
+Summary: scripts.mit.edu base packages
+Group: Applications/System
+Name: scripts-base
+Version: 0.%{scriptsversion}
+Release: 0
+Vendor: The scripts.mit.edu Team (scripts@mit.edu)
+URL: http://scripts.mit.edu
+License: GPL
+Source: %{name}.tar.gz 
+BuildRoot: %{_tmppath}/%(%{__id_u} -n)-%{name}-%{version}-root
+%define all_archs() %1%{?_isa}, %{?__isa_name: %1(%{__isa_name}-32)}
+Requires: accountadm
+Requires: execsys
+Requires: scripts-kmod-openafs
+Requires: %{all_archs scripts-krb5-libs}
+Requires: scripts-httpd
+Requires: scripts-mod_ssl
+Requires: scripts-openafs-client
+Requires: scripts-openafs-authlibs
+Requires: scripts-openafs-devel
+Requires: scripts-openafs-krb5
+Requires: scripts-openssh-server
+Requires: scripts-static-cat
+Requires: scripts-rubygems
+Requires: sql-signup
+Requires: tokensys
+Requires: whoisd
+Requires: logview
+Requires: fuse-better-mousetrapfs
+Requires: %{all_archs nss-pam-ldapd}
+Requires: php_scripts
+Requires: zephyr
+Requires: %{all_archs zephyr-libs}
+Requires: httpdmods
+Requires: %{all_archs nss_nonlocal}
+%define debug_package %{nil}
+
+%description 
+
+scripts.mit.edu base package
+Contains:
+ - Dependencies to install rpms required for base scripts functionality
+See http://scripts.mit.edu/wiki for more information.
+
+%prep
+%setup -q -n %{name}
+
+%build
+
+%install
+
+%clean
+
+%files
+
+%changelog
+* Thu Jan  1 2009  Quentin Smith <quentin@mit.edu>
+- prerelease
Index: tags/fc15-eol/server/fedora/specs/scripts-static-cat.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/scripts-static-cat.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/scripts-static-cat.spec	(revision 2244)
@@ -0,0 +1,50 @@
+# For Haskell Packaging Guidelines see:
+# - https://fedoraproject.org/wiki/Packaging:Haskell
+# - https://fedoraproject.org/wiki/PackagingDrafts/Haskell
+
+# Link Haskell libs statically for 3x faster startup speed.
+%define ghc_without_dynamic 1
+
+Name:           scripts-static-cat
+Version:        0.0
+Release:        0.%{scriptsversion}%{?dist}
+Summary:        static-cat for scripts.mit.edu
+
+Group:          Applications/System
+License:        GPL
+URL:            http://scripts.mit.edu/
+Source0:        %{name}.tar.gz
+# fedora ghc archs:
+ExclusiveArch:  %{ix86} x86_64 ppc alpha sparcv9
+BuildRequires:  ghc-devel
+# macros for building haskell packages
+BuildRequires:  ghc-rpm-macros >= 0.7.0
+BuildRequires:  ghc-cgi-devel >= 3001.1.8, ghc-MonadCatchIO-mtl-devel, ghc-unix-handle-devel
+
+%description
+static-cat is a binary for serving static content on scripts.mit.edu.
+
+
+%prep
+%setup -q -n %{name}
+
+
+%build
+%ghc_bin_build
+
+
+%install
+%ghc_bin_install
+
+
+%files
+%defattr(-,root,root,-)
+%attr(755,root,root) %{_bindir}/static-cat
+
+
+%changelog
+* Mon May  2 2011 Alexander Chernyakhovsky <achernya@mit.edu> - 0.0-0
+- regenerated packaging with cabal2spec-0.22.5
+
+* Thu Sep  9 2010 Anders Kaseorg <andersk@mit.edu> - 0.0-0
+- initial packaging for Fedora automatically generated by cabal2spec-0.22.1
Index: tags/fc15-eol/server/fedora/specs/scripts-wizard.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/scripts-wizard.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/scripts-wizard.spec	(revision 2244)
@@ -0,0 +1,37 @@
+Name:           scripts-wizard
+Version:        0
+Release:        1.%{scriptsversion}%{?dist}
+Summary:        Symlink for the scripts.mit.edu wizard autoinstaller system
+
+Group:          Development/Tools
+License:        MIT
+URL:            http://scripts.mit.edu
+Source0:        %{name}.tar.gz
+
+%define debug_package %{nil}
+
+%description
+
+Symlink for the scripts.mit.edu wizard autoinstaller system
+
+%prep
+%setup -q -n %{name}
+
+%build
+
+%install
+rm -rf %{buildroot}
+mkdir -p %{buildroot}/usr/local/bin
+ln -s /afs/athena.mit.edu/contrib/scripts/wizard/bin/wizard %{buildroot}/usr/local/bin/wizard
+
+%clean
+rm -rf %{buildroot}
+
+%files
+%defattr(-,root,root,-)
+/usr/local/bin/wizard
+
+%changelog
+* Thu Mar 04 2010 Mitchell Berger <mitchb@mit.edu> - 0-1.1503
+- Initial release
+
Index: tags/fc15-eol/server/fedora/specs/sql-signup.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/sql-signup.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/sql-signup.spec	(revision 2244)
@@ -0,0 +1,44 @@
+Summary:        Signup interface to <sql.mit.edu> for <scripts.mit.edu>.
+Group:			Applications/System
+Name:           sql-signup
+Version:        0.%{scriptsversion}
+Release:        0
+Vendor:			The scripts.mit.edu Team (scripts@mit.edu)
+URL:			http://scripts.mit.edu
+License:        GPL
+Source0:        %{name}.tar.gz
+BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+%define debug_package %{nil}
+
+BuildRequires:  make
+Requires:       pam, usermode
+
+%description
+
+
+%prep
+%setup -q -n %{name}
+
+%build
+
+
+%install
+rm -rf $RPM_BUILD_ROOT
+make install DESTDIR=$RPM_BUILD_ROOT prefix=/usr/local
+
+%clean
+rm -rf $RPM_BUILD_ROOT
+
+%files
+%defattr(-,root,root,-)
+%defattr(755,root,root,-)
+%{_bindir}/sql-signup
+%{_sbindir}/sql-signup
+%defattr(644,root,root,-)
+%config /etc/pam.d/sql-signup
+%config /etc/security/console.apps/sql-signup
+
+%changelog
+
+* Fri Jan 26 2007 Joe Presbrey <presbrey@mit.edu> 0.00
+- prerelease
Index: tags/fc15-eol/server/fedora/specs/tokensys.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/tokensys.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/tokensys.spec	(revision 2244)
@@ -0,0 +1,104 @@
+Summary: scripts.mit.edu AFS administration system
+Group: Applications/System
+Name: tokensys
+Version: 0.%{scriptsversion}
+Release: 0
+Vendor: The scripts.mit.edu Team (scripts@mit.edu)
+URL: http://scripts.mit.edu
+License: GPL
+Source: %{name}.tar.gz
+BuildRoot: %{_tmppath}/%(%{__id_u} -n)-%{name}-%{version}-root
+%define debug_package %{nil}
+Prereq: /usr/bin/kinit, /usr/bin/aklog
+Requires(post): systemd-units
+Requires(preun): systemd-units
+Requires(postun): systemd-units
+BuildRequires: systemd-units
+
+%description
+
+scripts.mit.edu AFS administration system
+Contains:
+ - A shell script for renewing the scripts AFS credentials <renew>
+ - A shell script for configuring scripts AFS <scripts-afsagent-startup>
+ - systemd units for running the above
+See http://scripts.mit.edu/wiki for more information.
+
+%prep
+%setup -q -n %{name}
+
+%build
+./configure --with-kinit=/usr/bin/kinit --with-aklog=/usr/bin/aklog --with-fs=/usr/bin/fs
+
+%install
+[ $RPM_BUILD_ROOT != / ] && rm -rf $RPM_BUILD_ROOT
+install -D renew $RPM_BUILD_ROOT/home/afsagent/renew
+install -D scripts-afsagent-startup $RPM_BUILD_ROOT/usr/local/libexec/scripts-afsagent-startup
+install -D scripts-afsagent-startup.service $RPM_BUILD_ROOT%{_unitdir}/scripts-afsagent-startup.service
+install -D scripts-afsagent.service $RPM_BUILD_ROOT%{_unitdir}/scripts-afsagent.service
+install -D scripts-afsagent.timer $RPM_BUILD_ROOT%{_unitdir}/scripts-afsagent.timer
+
+%clean
+[ $RPM_BUILD_ROOT != / ] && rm -rf $RPM_BUILD_ROOT
+
+%files
+%defattr(0644,root,root)
+%{_unitdir}/*.service
+%{_unitdir}/*.timer
+%defattr(0755, afsagent, afsagent)
+/home/afsagent/renew
+/usr/local/libexec/scripts-afsagent-startup
+
+%pre
+groupadd -g 101 afsagent || [ $? -eq 9 ]
+useradd -u 101 -g 101 afsagent || [ $? -eq 9 ]
+
+%post
+/bin/systemctl enable scripts-afsagent-startup.service >/dev/null 2>&1 || :
+/bin/systemctl enable scripts-afsagent.service >/dev/null 2>&1 || :
+/bin/systemctl enable scripts-afsagent.timer >/dev/null 2>&1 || :
+
+if [ $1 -eq 1 ] ; then 
+    # Initial installation 
+    /bin/systemctl daemon-reload >/dev/null 2>&1 || :
+fi
+
+%preun
+if [ $1 -eq 0 ] ; then
+    # Package removal, not upgrade
+    /bin/systemctl --no-reload disable scripts-afsagent-startup.service > /dev/null 2>&1 || :
+    /bin/systemctl --no-reload disable scripts-afsagent.service > /dev/null 2>&1 || :
+    /bin/systemctl --no-reload disable scripts-afsagent.timer > /dev/null 2>&1 || :
+    /bin/systemctl stop scripts-afsagent-startup.service > /dev/null 2>&1 || :
+    /bin/systemctl stop scripts-afsagent.service > /dev/null 2>&1 || :
+    /bin/systemctl stop scripts-afsagent.timer > /dev/null 2>&1 || :
+fi
+
+%postun
+/bin/systemctl daemon-reload >/dev/null 2>&1 || :
+if [ $1 -ge 1 ] ; then
+    # Package upgrade, not uninstall
+    /bin/systemctl try-restart scripts-afsagent.service >/dev/null 2>&1 || :
+fi
+
+if [ "$1" = "0" ] ; then
+   userdel -r afsagent
+fi
+
+%changelog
+* Mon Nov 21 2011  Quentin Smith <quentin@mit.edu>
+- add systemd units
+- remove crontab
+
+* Tue Aug 17 2010  Geoffrey Thomas <geofft@mit.edu>
+- aklog csail as well
+
+* Wed Dec 31 2008  Quentin Smith <quentin@mit.edu>
+- only remove afsagent user on erase
+- ignore preexisting user
+
+* Wed Apr 11 2007  Joe Presbrey <presbrey@mit.edu>
+- crontab moved system-wide (/etc/cron.d) to isolate from fail-over cron service
+
+* Sat Sep 30 2006  Jeff Arnold <jbarnold@MIT.EDU> 0.00
+- initial prerelease version
Index: tags/fc15-eol/server/fedora/specs/whoisd.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/whoisd.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/whoisd.spec	(revision 2244)
@@ -0,0 +1,62 @@
+Summary:   whoisd for <scripts.mit.edu> (virtualhost aware)
+Group:     Applications/System
+Name:      whoisd
+Version:   0.%{scriptsversion}
+Release:   1
+Vendor:    The scripts.mit.edu Team (scripts@mit.edu)
+URL:       http://scripts.mit.edu
+License:   GPL
+Source0:   %{name}.tar.gz
+
+%define debug_package %{nil}
+
+Requires:      python-twisted-core
+BuildRequires: systemd-units
+
+Requires(post):   systemd-units
+Requires(preun):  systemd-units
+Requires(postun): systemd-units
+Requires(post):   systemd-sysv
+
+%description
+
+
+%prep
+%setup -q -n %{name}
+
+%build
+./configure
+
+%install
+make install DESTDIR=$RPM_BUILD_ROOT exec_prefix=/usr/local
+
+%post
+if [ $1 -eq 1 ] ; then
+    # Initial installation
+    /bin/systemctl enable scripts-whoisd.service >/dev/null 2>&1 || :
+fi
+
+%preun
+if [ $1 -eq 0 ]; then
+    /bin/systemctl --no-reload disable scripts-whoisd.service >/dev/null 2>&1 || :
+    /bin/systemctl stop scripts-whoisd.service > /dev/null 2>&1 || :
+fi
+
+%postun
+/bin/systemctl daemon-reload >/dev/null 2>&1 || :
+if [ $1 -ge 1 ]; then
+    /bin/systemctl try-restart scripts-whoisd.service >/dev/null 2>&1 || :
+fi
+
+%files
+%defattr(0644,root,root,-)
+/usr/local/libexec/whoisd.tac
+%defattr(0644,root,root)
+/lib/systemd/system/scripts-whoisd.service
+
+%changelog
+* Thu Aug 25 2011 Alexander Chernyakhovsky <achernya@mit.edu> 0-1
+- package systemd service file
+
+* Tue Jun 03 2008 Joe Presbrey <presbrey@mit.edu> 0.00
+- prerelease
Index: tags/fc15-eol/server/fedora/specs/zephyr.spec
===================================================================
--- tags/fc15-eol/server/fedora/specs/zephyr.spec	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/zephyr.spec	(revision 2244)
@@ -0,0 +1,156 @@
+Name:           zephyr
+Version:        3.0.2
+Release:        0.%{scriptsversion}%{?dist}
+Summary:        Client programs for the Zephyr real-time messaging system
+
+Group:          Applications/Communications
+License:        MIT
+URL:            http://zephyr.1ts.org/
+Source0:        http://zephyr.1ts.org/export/HEAD/distribution/%{name}-%{version}.tar.gz
+Source1:        zhm.init
+BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+
+BuildRequires:  krb5-devel hesiod-devel libss-devel libcom_err-devel readline-devel bison
+Requires:       %{name}-libs = %{version}-%{release}
+Requires(post): chkconfig
+Requires(preun): chkconfig
+Requires(preun): initscripts
+Requires(postun): initscripts
+
+%description
+Zephyr is an institutional/enterprise-scale distributed real-time messaging and
+notification system.  Zephyr's design choices seem to imbue it with a specific
+culture.  It is impossible to explain what Zephyr is, you must experience it
+for yourself.
+
+
+%package        server
+Summary:        Server for the Zephyr real-time messaging system
+Group:          System Environment/Daemons
+
+Requires:       %{name}-libs = %{version}-%{release}
+
+%description    server
+The %{name}-server package contains the server daemon for the Zephyr
+messaging service.  It maintains a location and subscription database
+for all the receiving clients, and routes all zephyrgrams to the
+intended recipients.
+
+
+%package        libs
+Summary:        Shared libraries for Zephyr real-time messaging system
+Group:          System Environment/Libraries
+
+%description    libs
+The %{name}-libs package contains shared libraries for applications
+that use %{name}.
+
+
+%package        devel
+Summary:        Development files for Zephyr real-time messaging system
+Group:          Development/Libraries
+
+Requires:       %{name}-libs = %{version}-%{release}, libcom_err-devel
+
+%description    devel
+The %{name}-devel package contains libraries and header files for
+developing applications that use %{name}.
+
+
+%prep
+%setup -q
+cp -p %{SOURCE1} .
+
+
+%build
+# Mitch wants to make an awesome specfile which makes hesiod/krb5 and friends
+# all fully configurable.  This configure line will have to do for now.
+%configure --with-hesiod --with-krb5 --disable-static
+sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
+sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
+make %{?_smp_mflags}
+
+%install
+rm -rf $RPM_BUILD_ROOT
+make install DESTDIR=$RPM_BUILD_ROOT libdir=%{_libdir}
+find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
+
+mkdir -p $RPM_BUILD_ROOT%{_initddir}
+install -m755 zhm.init \
+        $RPM_BUILD_ROOT%{_initddir}/zhm
+# Make RPM's Provide: searcher actually search the .so files! A recent
+# change in how RPM detects Provides automatically means that only
+# files that are executable get searched. Without this hack, all of
+# the zephyr client tools are Requires: libzephyr.so.4 which is never
+# Provides:, leading to uninstallable RPMS. This can be removed when
+# zephyr starts installing the libraries with mode 755 rather than
+# 644. (Zephyr #79)
+chmod a+x $RPM_BUILD_ROOT%{_libdir}/libzephyr.so.*
+
+%post
+/sbin/chkconfig --add zhm
+
+
+%preun
+if [ $1 = 0 ] ; then
+    /sbin/service zhm stop >/dev/null 2>&1
+    /sbin/chkconfig --del zhm
+fi
+
+
+%postun
+if [ "$1" -ge "1" ] ; then
+    /sbin/service zhm condrestart >/dev/null 2>&1 || :
+fi
+
+
+%post           libs -p /sbin/ldconfig
+
+%postun         libs -p /sbin/ldconfig
+
+
+%clean
+rm -rf $RPM_BUILD_ROOT
+
+
+%files
+%defattr(-,root,root,-)
+%doc README USING
+%{_bindir}/*
+%{_sbindir}/zhm
+%{_sbindir}/zshutdown_notify
+%{_mandir}/man1/*
+%{_mandir}/man8/zhm.8*
+%{_mandir}/man8/zstat.8*
+%{_mandir}/man8/zshutdown_notify.8*
+%{_datadir}/zephyr
+%{_initddir}/zhm
+
+
+%files          server
+%doc OPERATING
+%{_sysconfdir}/zephyr
+%{_sbindir}/zephyrd
+%{_mandir}/man8/zephyrd.8*
+
+
+%files          libs
+%{_libdir}/*.so.*
+
+
+%files          devel
+%{_libdir}/*.so
+%{_includedir}/*
+
+
+%changelog
+* Sat Apr 16 2011 Alexander Chernyakhovsky <achernya@mit.edu> 3.0.1-0
+- Zephyr 3.0.1
+
+* Sun Sep 19 2010 Anders Kaseorg <andersk@mit.edu> - 3.0-0
+- Decrease version below a hypothetical Fedora package.
+- Split out -server, -libs, and -devel into subpackages.
+- Disable the static library and remove the libtool archive.
+
+* Thu Sep 09 2010 Edward Z. Yang <ezyang@mit.edu> 3.0-1
+- Initial packaging release, superseding mit-zephyr.
Index: tags/fc15-eol/server/fedora/specs/zhm.init
===================================================================
--- tags/fc15-eol/server/fedora/specs/zhm.init	(revision 2244)
+++ tags/fc15-eol/server/fedora/specs/zhm.init	(revision 2244)
@@ -0,0 +1,107 @@
+#!/bin/sh
+#
+# zhm          Startup script for Zephyr Host Manager
+#
+# chkconfig:   - 20 80
+# description: The Zephyr Host Manager coordinates all incoming
+#              and outgoing messages for a given host.  If it
+#              is not running, you will not be able to send or
+#              receive Zephyr messages.
+
+# XXX needs configuration file support
+
+# XXX this needs to be audited
+### BEGIN INIT INFO
+# Provides: zhm
+# Required-Start: $local_fs $remote_fs $network $named
+# Required-Stop: $local_fs $remote_fs $network
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: start and stop Zephyr Host Manager
+# Description: The Zephyr Host Manager coordinates all incoming
+#              and outgoing messages for a given host.
+### END INIT INFO
+
+# Source function library.
+. /etc/rc.d/init.d/functions
+
+exec="/usr/sbin/zhm"
+prog="zhm"
+
+[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog
+
+lockfile=/var/lock/subsys/$prog
+
+start() {
+    [ -x $exec ] || exit 5
+    echo -n $"Starting $prog: "
+    daemon $exec
+    retval=$?
+    echo
+    [ $retval -eq 0 ] && touch $lockfile
+    return $retval
+}
+
+stop() {
+    echo -n $"Stopping $prog: "
+    killproc $prog
+    retval=$?
+    echo
+    [ $retval -eq 0 ] && rm -f $lockfile
+    return $retval
+}
+
+restart() {
+    stop
+    start
+}
+
+reload() {
+    restart
+}
+
+force_reload() {
+    restart
+}
+
+rh_status() {
+    # run checks to determine if the service is running or use generic status
+    status $prog
+}
+
+rh_status_q() {
+    rh_status >/dev/null 2>&1
+}
+
+
+case "$1" in
+    start)
+        rh_status_q && exit 0
+        $1
+        ;;
+    stop)
+        rh_status_q || exit 0
+        $1
+        ;;
+    restart)
+        $1
+        ;;
+    reload)
+        rh_status_q || exit 7
+        $1
+        ;;
+    force-reload)
+        force_reload
+        ;;
+    status)
+        rh_status
+        ;;
+    condrestart|try-restart)
+        rh_status_q || exit 0
+        restart
+        ;;
+    *)
+        echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}"
+        exit 2
+esac
+exit $?
Index: tags/fc15-eol/server/fedora/support/deploy.py
===================================================================
--- tags/fc15-eol/server/fedora/support/deploy.py	(revision 2244)
+++ tags/fc15-eol/server/fedora/support/deploy.py	(revision 2244)
@@ -0,0 +1,33 @@
+#!/usr/bin/python
+"""scripts.mit.edu deployment sychronization support
+Copyright (C) 2006, Joe Presbrey <presbrey@mit.edu>
+"""
+
+import sys,os,os.path as path
+import string
+import getopt
+
+class Usage(Exception):
+	def __init__(self, msg):
+		self.msg = msg
+
+def main(argv=None):
+	if argv is None:
+		argv = sys.argv
+	try:
+		try:
+			opts, args = getopt.getopt(sys.argv[1:], "h", ["help"])
+		except getopt.error, msg:
+			raise Usage(msg)
+	except Usage, err:
+		print >>sys.stderr, err.msg
+		print >>sys.stderr, "for help use --help"
+		return 2
+
+	for o, a in opts:
+		if o in ("-h", "--help"):
+			print __doc__
+			return 0
+
+if __name__ == "__main__":
+	sys.exit(main())
Index: tags/fc15-eol/server/fedora/support/setup.sh
===================================================================
--- tags/fc15-eol/server/fedora/support/setup.sh	(revision 2244)
+++ tags/fc15-eol/server/fedora/support/setup.sh	(revision 2244)
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+yum -y install nagios-plugins nagios-plugins-disk nagios-plugins-users nagios-plugins-procs nagios-plugins-load net-snmp
+rpm -Uvh http://scripts.mit.edu/src/RPMS/x86_64/nagios-nrpe-2.5.1-1.rf.x86_64.rpm
