mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2026-11-03 12:48:53 -06:00
Rob Crittenden
f91b677ada
In the wild a public CA issued a new subordinate CA certificate with an identical subject to another, with a new private key. This was uninstallable using ipa-cacert-manage because it would fail with "subject public key info mismatch" during verification because a different certificate with the same subject but different public key was installed. I'm not sure of the reasoning to prevent this situation but I see it as giving users flexibility. This may be hurtful to them but they can always remove any affected certs. This is backwards compatible with older releases from the client perspective. Older servers will choke on the duplicates and won't be able to manage these. A new serial number option is added for displaying the list of certificates and for use when deleting one with a duplicate subject. ipa-cacert-manage delete on systems without this patch will successfully remove ALL of the requested certificates. There is no way to distinguish. At least it won't break anything and the deleted certificates can be re-added. Fixes: https://pagure.io/freeipa/issue/9652 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
IPA platform abstraction
The ipaplatform package provides an abstraction layer for
supported Linux distributions and flavors. The package contains
constants, paths to commands and config files, services, and tasks.
- base abstract base platform
- debian Debian- and Ubuntu-like
- redhat abstract base for Red Hat platforms
- fedora Fedora
- fedora_container freeipa-container on Fedora
- rhel RHEL and CentOS
- rhel_container freeipa-container on RHEL and CentOS
- suse OpenSUSE and SLES
[base]
├─ debian
├─[redhat]
│ ├─ fedora
│ │ └─ fedora_container
│ └─ rhel
│ └─ rhel_container
└─ suse
(Note: Debian and SUSE use some definitions from Red Hat namespace.)
freeipa-container platform
The fedora_container and rhel_container platforms are flavors
of the fedora and rhel platforms. These platform definitions
are specifically designed for
freeipa-container.
The FreeIPA server container implements a read-only container. Paths
like /etc, /usr, and /var are mounted read-only and cannot
be modified. The image uses symlinks to store all variable data like
config files and LDAP database in /data.
- Some commands don't write through dangling symlinks. The IPA
platforms for containers prefix some paths with
/data. ipa-server-upgradeverifies that the platform does not change between versions. To allow upgrades of old containers, sysupgrade maps$distro_containerto$distroplatform.- The container images come with authselect pre-configured with
sssd with-sudooption. The tasksmodify_nsswitch_pam_stackandmigrate_auth_configurationare no-ops.ipa-restoredoes not restore authselect settings.ipa-backupstill stores authselect settings in backup data. - The
--mkhomediroption is not supported.