Updating cases in man pages which had incorrect groff syntax
Signed-off-by: Erik Belko <ebelko@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
When establishing trust with an unreachable AD domain controller,
the error code and message have changed with samba 4.22.
Update the test to be compatible with any version of samba.
Fixes: https://pagure.io/freeipa/issue/9751
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
The tooltip for IPA Server > Configuration > Search size limit
is using the doc from ipasearchtimelimit instead of
ipasearchrecordslimit.
Use the right tooltip to properly display:
Maximum number of records to search (-1 or 0 is unlimited)
Fixes: https://pagure.io/freeipa/issue/9758
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
The KDC logs when a user who is locked out with
Client's credentials have been revoked
The LDAP server did not. This adds a message so administrators
can tell when a user is locked out.
ALERT - ipalockout_postop - User uid=tuser,cn=users,cn=accounts,dc=example,dc=test is locked out. Too many failed authentication attempts.
Fixes: https://pagure.io/freeipa/issue/9742
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
The patch is not yet live, therefore we should expect an failure.
Once the patched version goes out, the test should work properly.
Signed-off-by: David Hanina <dhanina@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Originally the RA certificate was stored in the Apache NSS
database so it was available natively to the framework. It
was subsequently moved into PEM files even prior to the
switch from mod_nss to mod_ssl.
This code was introduced with 4.5.0 and was last seen in Fedora
in 27 in 2017. We don't support direct in-place upgrades from
such an old version so we should be safe from bricking a user's
installation.
Fixes: https://pagure.io/freeipa/issue/9739
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
mod_nss was the original crypto engine used in Apache with IPA.
Support was dropped in IPA release 4.7.0 in 4596674 and looks
like it was introduced into Fedora in F28.
It's time to remove this upgrade code.
This retains the HTTPD_NSS_CONF definition so that
contrib/copy-schema-to-ca-RHEL6.py can still work.
Fixes: https://pagure.io/freeipa/issue/9739
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Replication related entries should not be migrated. The main reason is
that we do not allow entries to be added that have an RDN of nsuniqueid
(only the server can internally add them).
Most midair collisions are transient issues and can be ignored for
migration purposes. In migration tests this only happens when an
attribute does not exist in the local server. This happens frequently
with COS attributes.
We should also ignore 'krbpwdpolicyreference' as it's an attribute that is
set by COS and does not need to be migrated.
Fixes: https://pagure.io/freeipa/issue/9737
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Ensure unbound is only stopped and disabled when DNS over TLS was
enabled during installation.
Signed-off-by: Antonio Torres <antorres@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Add DNS over TLS support using Unbound as a local resolver. This
includes new options on both server and client side.
* `--dns-over-tls`: enable DNS over TLS support. This option is present
on both client and server. It deploys Unbound and configures BIND on
the server to receive DoT requests.
* `--dot-forwarder`: the upstream DNS server with DoT support. It must
be specified in the format `1.2.3.4#dns.server.test`
* `--dns-over-tls-key` and `--dns-over-tls-cert`: in case user prefers
to have the DoT certificate in BIND generated by themselves. If these
are empty, IPA CA is used instead to request a new certificate.
Signed-off-by: Antonio Torres <antorres@redhat.com>
Reviewed-By: Francisco Trivino <ftrivino@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Varun Mylaraiah <mvarun@redhat.com>
Reviewed-By: Pavel Brezina <pbrezina@redhat.com>
We had it set to 120 seconds while the systemd default is 90.
They should be the same because the first one that times out "wins".
Move where during the installation we create the systemd override
file so that the timeout will be applied across all subsequent
server starts during and post installation.
Fixes: https://pagure.io/freeipa/issue/9743
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
IPA defines a startup timeout that is primarily used
during installation to extend service start-up timeouts
on slower systems.
This tends to work ok when runing pki-spawn but can fail when
systemd is starting the tomcat service.
Use the value of startup_timeout to set TimeoutStartSec in
the pki-tomcat systemd override file ipa.conf. This will
preserve the necessary startup_timeout for all future restarts.
This was seen with a very slow HSM where installation was successful
(pki-spawn) but pki-tomcatd startup timed out at the end of the
installation.
To increase the value in installation one needs to create the file
/etc/ipa/installer.conf with contents:
[global]
startup_timeout = 300 (or whatever)
Fixes: https://pagure.io/freeipa/issue/9743
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
The procedure allowing to simulate FIPS mode is now working
(fixed since fedora 38).
The installation of a PKI clone in FIPS mode works with PKI 11.6 but
fails below. Adjust the test to skip if pki < 11.6.
Fixes: https://pagure.io/freeipa/issue/9002
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
We fork out to pki-server to uninstall the ACME service and
the results are very coarse, currently just a pass/fail. This
can lead to displaying very long tracebacks as an error
message.
So check for the existence of the acme path and only invoke
the uninstaller if it exists.
Fixes: https://pagure.io/freeipa/issue/9740
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
There is a noticeable near the end of an IPA server installation
after the client installation is complete and before the
"Setup complete" message is displayed.
A few minor things are done here but the big time sink is
enabling ipa.service and restarting it because the CA takes
so long to start. In my testing it was between 40 and 60 seconds.
So add a little message so folks don't think the client installer
hung up at the end.
Fixes: https://pagure.io/freeipa/issue/9741
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
It was being written out in base-64 only. The PKI team gave
us a heads-up that that may not always be supported. So use
a standard PEM file instead.
Fixes: https://pagure.io/freeipa/issue/9735
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Previously, it waited 0.5 seconds before checking if the record was present,
but this delay was often insufficient, causing intermittent failures.
Fixes: https://pagure.io/freeipa/issue/9721
Signed-off-by: Francisco Trivino <ftrivino@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
We've seen that with some slow HSMs the default DBus timeout
the HSM doesn't respond quickly enough to certmonger start
tracking requests which fails the entire installation.
A first attempt was made to bump up the default to 30 seconds
which turned out to not be long enough.
There is already a certmonger timeout defined in the API but it
is 300 seconds so I was hesitant to use it. It could delay the
actual failure of a blown install by 5 minutes. But it also gives
the end user the flexibility to be able to control success over
an installation so we'll go ahead and use it.
Fixes: https://pagure.io/freeipa/issue/9725
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Mohammad Rizwan Yusuf <myusuf@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
If there is no client secret specified for the OIDC client, don't push
it to oidc_child via stdin. oidc_child does only expect client secret if
--client-secret-stdin option was specified and we already specify it
only if client secret is not empty.
In addition, if client secret is empty (it is a public OIDC client),
then strlen(NULL) would crash in glibc internals. Avoid that!
Fixes: https://pagure.io/freeipa/issue/9734
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
The test for ipa-healthcheck is moving the date in the future.
Restart the dirsrv instance because the LDAP server is
sensitive to large time jumps.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
389-ds removed the parameter nsslapd-logging-hr-timestamps-enabled
in 2.5.3 and above. Skip the test that exercises the corresponding
healthcheck.
Fixes: https://pagure.io/freeipa/issue/9730
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Add the test to the list of nightlies run against 389ds.
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
The backup-restore tests ensure that ipa-restore complains if
a required package is missing. The test scenario removes the
ipa-server-dns package, tries a restore (expecting a failure),
then reinstall the ipa-server-dns pkg and retry the restore
(expecting a success).
The issue is that reinstallation sometimes pulls a more recent
version and ipa-restore fails because of the version mismatch.
Ensure the reinstallation pulls the same version.
Fixes: https://pagure.io/freeipa/issue/9723
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This file should not import ipa modules
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rafael Guterres Jeffman <rjeffman@redhat.com>
To remove the client secret from the command line where it would be
visible e.g. when calling ps it is now passed via stdin to oidc_child.
Fixes: CVE-2024-11029
Signed-off-by: Sumit Bose <sbose@redhat.com>
When command line tools accept passwords, remove them from the command
line so that they don't get visible in '/proc/pid/commandline'.
There is no common method to access the original ARGV vector and modify
it from Python. Since this mostly affects Linux systems where IPA
services run, we expect use of GNU libc and thus can rely on internal
glibc symbols. If they aren't available, the code will skip removing
passwords.
Fixes: CVE-2024-11029
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
certmonger needs to validate that the PIN/password and/or token
are valid and available. In the case of a very slow HSM this can
take longer than the 5-second default timeout.
We saw an HSM that took 18 seconds to start tracking the CA signing
certificate so default to 30 to be safe.
Fixes: https://pagure.io/freeipa/issue/9725
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
The certbot CLI has deprecated the parameter --manual-public-ip-logging-ok
and finally removed it from certbot 3.0.
The test test_acme.py is using this parameter and fails in rawhide.
Do not use this parameter any more.
Fixes: https://pagure.io/freeipa/issue/9724
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
When certmonger renews the auditSigningCert for the CA
or the KRA, it has to add the P trust flag to the NSS
database in /etc/pki/pki-tomcat/alias.
If IPA is installed in FIPS mode with an HSM, the
certutil commands must be provided a password file
containing both the internal token password and the
HSM password, and the cert name must be prefixed
with the tokenname (otherwise certutil -M succeeds
but does not update the trust flags).
Fixes: https://pagure.io/freeipa/issue/9705
Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Rob Crittenden
Frederik Himpe
Vasily Parfenov
Erik Belko
Florence Blanc-Renaud
David Hanina
Mark Reynolds
Antonio Torres
Andi Chandler
Francisco Trivino
Alexander Bokovoy
Sumit Bose
Ricky Tigg