August 2020 - FreeIPA-devel - Fedora mailing-lists

[freeipa PR#5029][opened] [WIP] Add new krbtpolicy for lifetime jitter
by rebeccc 21 Aug '20

21 Aug '20

URL: https://github.com/freeipa/freeipa/pull/5029 Author: rebeccc Title: #5029: [WIP] Add new krbtpolicy for lifetime jitter Action: opened PR body: """ I'm having difficulty setting up my test environment and want to check if my tests work against the PR tests. I'll update and clean up this PR when I confirm my tests work. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5029/head:pr5029 git checkout pr5029

1 1

FreeIPA 4.8.9 released
by Alexander Bokovoy 20 Aug '20

20 Aug '20

The FreeIPA team would like to announce FreeIPA 4.8.9 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. == Highlights in 4.8.9 * 5011: [RFE] Forward CA requests to dogtag or helper by GSSAPI * 7137: [RFE]: Able to browse different links from IPA web gui in new tabs * 8129: Tests: Replace paramiko with OpenSSH Paramiko is not compatible with FIPS mode, therefore convert most tests to using ssh directly. The only non-converted test is the 2-prompt OTP test because sshpass does not support 2-prompt password authentication ( https://pagure.io/freeipa/issue/8431 ). * 8151: test_commands timing-out Re-enable test_sss_ssh_authorizedkeys ; add -v to ssh in order to get debug information if this test fails or stalls again. The test was run 16 times without a failure before re-enabling it. * 8189: NIghtly test failure in test_integration/test_nfs.py::TestIpaClientAutomountFileRestore::test_nsswitch_backup_restore_sssd Previously, ipa-client-installation saved the pre-install state using "authselect current" command and the uninstallation reverted to the same authselect state. In cases where the system was installed using authconfig instead of authselect, the uninstallation was unable to revert to the same state and picked "sssd"'s authselect profile instead. Now, the client installation relies on the backup functionality of authselect and is able to revert to the exact pre-install state * 8304: [fed32] client-install does not properly set ChallengeResponseAuthentication yes in sshd conf ipa-client-installation now writes the sshd configuration to the drop-in directory /etc/ssh/sshd_config.d/, in the 04-ipa.conf snippet, thus ensuring that the setting "ChallengeResponseAuthentication yes" take precedence. * 8335: [WebUI] manage IPA resources as a user from a trusted Active Directory domain When users from trusted Active Directory domains have permissions to manage IPA resources, they can do so through a Web UI management console. * 8374: EPN does not ship its default configuration ( /etc/ipa/epn.conf) in freeipa-client-epn EPN did not ship any configuration file. This was an oversight, but the tool itself would work fine as it had sane defaults ; moreover, the man page for the configuration file was present. * 8391: Remove dnf workaround from test_epn.y The new PR-CI images are cleaner and do not need the *epn* packages to be uninstalled/reinstalled. * 8401: Create platform definitions for freeipa-container ipaplatform now provides container platform flavors for freeipa/freeipa-container * 8432: test failure in test_commands.py::TestIPACommand::test_login_wrong_password: AssertionError Sometimes test_login_wrong_password fails because the log window the string message is searched in is too narrow. Broaden the window by looking at the past 10 seconds. * 8444: EPN: enhance input validation Various input validation checks were added to EPN. * 8445: EPN: '[Errno 111] Connection refused' when the SMTP is down EPN now displays a proper message if the configured SMTP server cannot be contacted. * 8449: EPN: enhance CLI option tests EPN: enhance existing tests for --dry-run, --from-nbdays and --to-nbdays. === Enhancements === Known Issues === Bug fixes FreeIPA 4.8.9 is a stabilization release for the features delivered as a part of 4.8 version series. There are more than 50 bug-fixes details of which can be seen in the list of resolved tickets below. == Upgrading Upgrade instructions are available on Upgrade page. == Feedback Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on Freenode. == Resolved tickets * https://pagure.io/freeipa/issue/5011[#5011] (https://bugzilla.redhat.com/show_bug.cgi?id=1527185[rhbz#1527185]) [RFE] Forward CA requests to dogtag or helper by GSSAPI * https://pagure.io/freeipa/issue/5628[#5628] webui: Unclear(UX) purpose of OTP field in password reset form on login * https://pagure.io/freeipa/issue/7137[#7137] (https://bugzilla.redhat.com/show_bug.cgi?id=1484088[rhbz#1484088]) [RFE]: Able to browse different links from IPA web gui in new tabs * https://pagure.io/freeipa/issue/8129[#8129] Tests: Replace paramiko with OpenSSH * https://pagure.io/freeipa/issue/8151[#8151] test_commands timing-out * https://pagure.io/freeipa/issue/8189[#8189] (https://bugzilla.redhat.com/show_bug.cgi?id=1810179[rhbz#1810179]) Nightly test failure in test_integration/test_nfs.py::TestIpaClientAutomountFileRestore::test_nsswitch_backup_restore_sssd * https://pagure.io/freeipa/issue/8300[#8300] Replace uglify-js with python3-rjsmin * https://pagure.io/freeipa/issue/8304[#8304] [fed32] client-install does not properly set ChallengeResponseAuthentication yes in sshd conf * https://pagure.io/freeipa/issue/8326[#8326] CVE-2020-10747 * https://pagure.io/freeipa/issue/8335[#8335] [WebUI] manage IPA resources as a user from a trusted Active Directory domain * https://pagure.io/freeipa/issue/8336[#8336] [WebUI] "User attributes for SMB services" section always shown * https://pagure.io/freeipa/issue/8364[#8364] Nightly test failure while establishing trust: Cannot find specified domain or server name * https://pagure.io/freeipa/issue/8366[#8366] CA-less replica deployment fails with --setup-ca * https://pagure.io/freeipa/issue/8367[#8367] IPA-EPN fails to build in ONLY_CLIENT mode * https://pagure.io/freeipa/issue/8368[#8368] (https://bugzilla.redhat.com/show_bug.cgi?id=1846349[rhbz#1846349]) cannot issue certs with multiple IP addresses corresponding to different hosts * https://pagure.io/freeipa/issue/8369[#8369] cert_find returns "CA not configured" in CA-less install * https://pagure.io/freeipa/issue/8370[#8370] ipa-join does not set nshardwareplatform and nsosversion * https://pagure.io/freeipa/issue/8371[#8371] Nightly test failure [testing_master_testing] in test_integration/test_idviews.py::TestCertsInIDOverrides * https://pagure.io/freeipa/issue/8372[#8372] (https://bugzilla.redhat.com/show_bug.cgi?id=1849914[rhbz#1849914]) FreeIPA - Utilize 256-bit AJP connector passwords * https://pagure.io/freeipa/issue/8374[#8374] (https://bugzilla.redhat.com/show_bug.cgi?id=1847999[rhbz#1847999]) EPN does not ship its default configuration ( /etc/ipa/epn.conf ) in freeipa-client-epn * https://pagure.io/freeipa/issue/8377[#8377] Nightly test failure (timeout) in test_caless_TestReplicaInstall * https://pagure.io/freeipa/issue/8379[#8379] Nightly test failure [testing_master_pki] while installing CA replica * https://pagure.io/freeipa/issue/8381[#8381] Nightly test failure in test_webui/test_loginscreen.py::TestLoginScreen::test_login_view * https://pagure.io/freeipa/issue/8384[#8384] Provide reliable way to know if a server installation is complete * https://pagure.io/freeipa/issue/8388[#8388] Make help() on plugins more useful * https://pagure.io/freeipa/issue/8391[#8391] Remove dnf workaround from test_epn.py * https://pagure.io/freeipa/issue/8395[#8395] selinux don't audit rules deny fetching trust topology * https://pagure.io/freeipa/issue/8396[#8396] [WebUI] Font type of "Enabled" column in user search facet wrong * https://pagure.io/freeipa/issue/8399[#8399] certmonger attempts to add LWCA tracking requests on non-CA server. * https://pagure.io/freeipa/issue/8400[#8400] sshd template file is installed in a wrong (server) location while used by the client side * https://pagure.io/freeipa/issue/8401[#8401] Create platform definitions for freeipa-container * https://pagure.io/freeipa/issue/8403[#8403] Add option to add ipaapi user as an allowed uid for ifp in /etc/sssd/sssd.conf when running ipa-replica-install * https://pagure.io/freeipa/issue/8407[#8407] Support changelog integrated into main database * https://pagure.io/freeipa/issue/8412[#8412] (https://bugzilla.redhat.com/show_bug.cgi?id=1857157[rhbz#1857157]) AVC: httpd cannot connect to ipa-custodia.sock * https://pagure.io/freeipa/issue/8413[#8413] Nightly test failure in test_integration/test_replica_promotion.py::TestUnprivilegedUserPermissions::test_sssd_config_allows_ipaapi_access_to_ifp * https://pagure.io/freeipa/issue/8414[#8414] Nightly test failure in test_integration/test_replica_promotion.py::TestReplicaPromotionLevel1::test_sssd_config_allows_ipaapi_access_to_ifp * https://pagure.io/freeipa/issue/8416[#8416] [WebUI] Error while adding user ID overrides to group * https://pagure.io/freeipa/issue/8419[#8419] Azure is reporting a slew of new no-member lint errors * https://pagure.io/freeipa/issue/8425[#8425] Nightly test failure in test_cert.test_cert.TestInstallMasterClient (certmonger timeout) * https://pagure.io/freeipa/issue/8428[#8428] [ipatests] fails due to new python-cryptography 3.0 * https://pagure.io/freeipa/issue/8429[#8429] Add fips-mode-setup to ipaplatform.paths * https://pagure.io/freeipa/issue/8432[#8432] test failure in test_commands.py::TestIPACommand::test_login_wrong_password: AssertionError * https://pagure.io/freeipa/issue/8435[#8435] [ipatests] failures due to new Pytest6.0 (pypi part) * https://pagure.io/freeipa/issue/8437[#8437] unit tests for ipa-extdom-extop are failing in Fedora 33 * https://pagure.io/freeipa/issue/8439[#8439] Nightly test failure in test_integration/test_ipahealthcheck.py::TestIpaHealthCheck::test_ipa_healthcheck_expiring * https://pagure.io/freeipa/issue/8440[#8440] (https://bugzilla.redhat.com/show_bug.cgi?id=1863616[rhbz#1863616]) CA-less install does not set required permissions on KDC certificate * https://pagure.io/freeipa/issue/8441[#8441] (https://bugzilla.redhat.com/show_bug.cgi?id=1870202[rhbz#1870202]) File permissions of /etc/ipa/ca.crt differ between CA-ful and CA-less * https://pagure.io/freeipa/issue/8442[#8442] [pylint] warnings/errors against pylint 2.5.3 * https://pagure.io/freeipa/issue/8444[#8444] (https://bugzilla.redhat.com/show_bug.cgi?id=1866291[rhbz#1866291]) EPN: enhance input validation * https://pagure.io/freeipa/issue/8445[#8445] (https://bugzilla.redhat.com/show_bug.cgi?id=1863079[rhbz#1863079]) EPN: '[Errno 111] Connection refused' when the SMTP is down * https://pagure.io/freeipa/issue/8447[#8447] Nightly test failure in test_integration/test_ipahealthcheck/TestIpaHealthCheckWithoutDNS * https://pagure.io/freeipa/issue/8449[#8449] (https://bugzilla.redhat.com/show_bug.cgi?id=1866291[rhbz#1866291]) EPN: enhance CLI option tests * https://pagure.io/freeipa/issue/8456[#8456] Need new aci's for the new replication changelog entries * https://pagure.io/freeipa/issue/8459[#8459] [upgrade] handle missing openssh-clients * https://pagure.io/freeipa/issue/8461[#8461] [ALTLinux] server uninstall error on missing /var/lib/samba * https://pagure.io/freeipa/issue/8463[#8463] Nightly test failure in test_ipahealthcheck.py::TestIpaHealthCheck::test_ipa_healthcheck_expiring * https://pagure.io/freeipa/issue/8464[#8464] Increase replication changelog trimming interval == Detailed changelog since 4.8.8 Detailed changelog is available at https://www.freeipa.org/page/Releases/4.8.9#Detailed_changelog_since_4.8.8 -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 0

[freeipa PR#5051][opened] [Backport][ipa-4-8] ipatests: Test certmonger rekey command works fine
by rcritten 20 Aug '20

20 Aug '20

URL: https://github.com/freeipa/freeipa/pull/5051 Author: rcritten Title: #5051: [Backport][ipa-4-8] ipatests: Test certmonger rekey command works fine Action: opened PR body: """ This PR was opened automatically because PR #5002 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5051/head:pr5051 git checkout pr5051

2 1

[freeipa PR#5050][opened] [Backport][ipa-4-8] Increase replication changelog trimming to 30 days
by rcritten 20 Aug '20

20 Aug '20

URL: https://github.com/freeipa/freeipa/pull/5050 Author: rcritten Title: #5050: [Backport][ipa-4-8] Increase replication changelog trimming to 30 days Action: opened PR body: """ This PR was opened automatically because PR #5038 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5050/head:pr5050 git checkout pr5050

2 1

[freeipa PR#5049][opened] [Backport][ipa-4-8] ipatests: stop the CA during healthcheck expiration test
by rcritten 20 Aug '20

20 Aug '20

URL: https://github.com/freeipa/freeipa/pull/5049 Author: rcritten Title: #5049: [Backport][ipa-4-8] ipatests: stop the CA during healthcheck expiration test Action: opened PR body: """ This PR was opened automatically because PR #5040 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5049/head:pr5049 git checkout pr5049

2 1

[freeipa PR#5048][opened] [Backport][ipa-4-8] Improve performance of ipa-server-guard
by rcritten 20 Aug '20

20 Aug '20

URL: https://github.com/freeipa/freeipa/pull/5048 Author: rcritten Title: #5048: [Backport][ipa-4-8] Improve performance of ipa-server-guard Action: opened PR body: """ This PR was opened automatically because PR #5045 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5048/head:pr5048 git checkout pr5048

2 1

[freeipa PR#5043][opened] [Backport][ipa-4-8] uninstall: Don't fail on missing /var/lib/samba
by stanislavlevin 20 Aug '20

20 Aug '20

URL: https://github.com/freeipa/freeipa/pull/5043 Author: stanislavlevin Title: #5043: [Backport][ipa-4-8] uninstall: Don't fail on missing /var/lib/samba Action: opened PR body: """ This PR was opened manually because PR #5032 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5043/head:pr5043 git checkout pr5043

2 1

[freeipa PR#5002][opened] ipatests: Test certmonger rekey command works fine
by mrizwan93 19 Aug '20

19 Aug '20

URL: https://github.com/freeipa/freeipa/pull/5002 Author: mrizwan93 Title: #5002: ipatests: Test certmonger rekey command works fine Action: opened PR body: """ Certmonger's rekey command was throwing an error as unrecognized command. Test is to check if it is working fine. related: https://bugzilla.redhat.com/show_bug.cgi?id=1249165 Signed-off-by: Mohammad Rizwan <myusuf(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5002/head:pr5002 git checkout pr5002

2 1

[freeipa PR#5038][opened] Increase replication changelog trimming to 30 days
by marcus2376 19 Aug '20

19 Aug '20

URL: https://github.com/freeipa/freeipa/pull/5038 Author: marcus2376 Title: #5038: Increase replication changelog trimming to 30 days Action: opened PR body: """ A long time ago the DS team recommended that the changelog trimming interval be set to 7 days. However, more recently we tend to see more time skews on certain platforms, and issues where it appears changes were trimmed too early (which can break replication). It would be better to set the trimming interval to 30 days. This still prevents the changelog from getting too large, and it should help with some of the other issues we are now seeing. Fixes: https://pagure.io/freeipa/issue/8464 Signed-off-by: Mark Reynolds <mreynolds(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5038/head:pr5038 git checkout pr5038

2 1

[freeipa PR#5040][opened] ipatests: stop certmonger during healthcheck expiration test
by rcritten 19 Aug '20

19 Aug '20

URL: https://github.com/freeipa/freeipa/pull/5040 Author: rcritten Title: #5040: ipatests: stop certmonger during healthcheck expiration test Action: opened PR body: """ ipatests: stop certmonger during healthcheck expiration test Time is moved during the test to ensure that ipa-healthcheck finds expired certificates. It's possible that certmonger will also wake up and renew the certificates before ipa-healthcheck can execute so shut down certmonger during the test. https://pagure.io/freeipa/issue/8463 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/5040/head:pr5040 git checkout pr5040

1 1

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel August 2020