IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

smart card advise: use password when changing trust flags on HTTP cert

Browse Source 
This is to prevent NSS asking for database password when operating in
FIPS 140 mode.

https://pagure.io/freeipa/issue/7036

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
This commit is contained in:
Martin Babinsky 2017-06-23 15:47:48 +02:00 committed by Martin Basti
parent 4d57aef7a5
commit e0cf7090f3
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ipaserver/advise/plugins/smart_card_auth.py
View File

@ -2,6 +2,8 @@
# Copyright (C) 2017 FreeIPA Contributors see COPYING for license # Copyright (C) 2017 FreeIPA Contributors see COPYING for license
# #
import os
from ipalib.plugable import Registry from ipalib.plugable import Registry
from ipaplatform import services from ipaplatform import services
from ipaplatform.paths import paths from ipaplatform.paths import paths
@ -172,6 +174,8 @@ class config_server_for_smart_card_auth(common_smart_card_auth_config):
return fmt_line.format(directive=directive, filename=filename) return fmt_line.format(directive=directive, filename=filename)
def mark_httpd_cert_as_trusted(self): def mark_httpd_cert_as_trusted(self):
httpd_nss_database_pwd_file = os.path.join(
paths.HTTPD_ALIAS_DIR, 'pwdfile.txt')
self.log.comment( self.log.comment(
'mark the HTTP certificate as trusted peer to avoid ' 'mark the HTTP certificate as trusted peer to avoid '
'chicken-egg startup issue') 'chicken-egg startup issue')
@ -181,8 +185,9 @@ class config_server_for_smart_card_auth(common_smart_card_auth_config):
" cut -f 2 -d ' ')")) " cut -f 2 -d ' ')"))
self.log.exit_on_failed_command( self.log.exit_on_failed_command(
'certutil -M -n $http_cert_nick -d "{}" -t "Pu,u,u"'.format( 'certutil -M -n $http_cert_nick -d "{}" -f {} -t "Pu,u,u"'.format(
paths.HTTPD_ALIAS_DIR), paths.HTTPD_ALIAS_DIR,
httpd_nss_database_pwd_file),
['Can not set trust flags on HTTP certificate']) ['Can not set trust flags on HTTP certificate'])
def _interpolate_nssnickname_directive_file_into_command(self, fmt_line): def _interpolate_nssnickname_directive_file_into_command(self, fmt_line):