Bug 1201454

Summary: ipa breaks sshd config
Product: Red Hat Enterprise Linux 6 Reporter: Pavel Zhukov <pzhukov>
Component: ipaAssignee: IPA Maintainers <ipa-maint>
Status: CLOSED ERRATA QA Contact: Namita Soman <nsoman>
Severity: unspecified Docs Contact:
Priority: medium    
Version: 6.8CC: duncanmcnaught, mkosek, pvoborni, rcritten, xdong
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: ipa-3.0.0-44.el6 Doc Type: Bug Fix
Doc Text:
After running ipa-client-install, it was not possible to log in using SSH under certain circumstances. With this update, ipa-client-install no longer corrupts the sshd_config file. As a result, the sshd service can start as expected, and logging in using SSH works in the described situation.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2015-07-22 07:39:49 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1112691    
Bug Blocks:    
Attachments:
Description Flags
user added via UI none

Description Pavel Zhukov 2015-03-12 17:48:47 UTC 
Description of problem:
after ipa installation and adding new user sshd is not able to start because of missed new line characted

Version-Release number of selected component (if applicable):
ipa-server-3.0.0-42.el6.x86_64

How reproducible:
100% (2 of 2 installation in my case)

Steps to Reproduce:
1. ipaserver-install --setup-dns
2. add new user via UI
3. try to login via ssh

Additional info:
Problematic string looks like:
PermitRootLogin without-passwordKerberosAuthentication no
Comment 2 Pavel Zhukov 2015-03-12 18:03:16 UTC 
Note: This is "cloud-inited" image (OpenStack instance).
Comment 3 Jan Cholasta 2015-03-13 08:29:12 UTC 
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/4373
Comment 4 Martin Kosek 2015-03-23 16:25:02 UTC 
Fixed upstream:

master:
3e0245f28fe3f294f21b8d0cc298b1901119921d Do not corrupt sshd_config in client install when trailing newline is missing.
Comment 6 Xiyang Dong 2015-05-15 16:28:55 UTC 
Created attachment 1025940 [details]
user added via UI
Comment 7 Xiyang Dong 2015-05-15 16:30:25 UTC 
Verified on ipa-server-3.0.0-46.el6.x86_64:
Steps to verify:
1. ipaserver-install --setup-dns
2. add new user via UI
3. login via ssh went successfully
[root@cloud-qe-19 ~]# ssh bz1201454.test
bz1201454.test's password: 
Password expired. Change your password now.
**  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **
                 This System is reserved by nsoman.

 To return this system early. You can run the command: return2beaker.sh
  Ensure you have your logs off the system before returning to Beaker

 To extend your reservation time. You can run the command:
  extendtesttime.sh
 This is an interactive script. You will be prompted for how many
  hours you would like to extend the reservation.

 You should verify the watchdog was updated succesfully after
  you extend your reservation.
  https://beaker.engineering.redhat.com/recipes/1907738

 For ssh, kvm, serial and power control operations please look here:
  https://beaker.engineering.redhat.com/view/cloud-qe-19.testrelm.test

 For the default root password, see:
  https://beaker.engineering.redhat.com/prefs/

      Beaker Test information:
                         HOSTNAME=cloud-qe-19.testrelm.test
                            JOBID=925092
                         RECIPEID=1907738
                    RESULT_SERVER=127.0.0.1:7085
                           DISTRO=RHEL-6.7-20150408.n.0
                     ARCHITECTURE=x86_64

      Job Whiteboard: IPA :: RHEL 6.7 :: x86_64 :: UI

      Recipe Whiteboard: IPA MASTER
**  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **
WARNING: Your password has expired.
You must change your password now and login again!
Changing password for user bz1201454.
Current Password: 
New password: 
Retype new password: 
passwd: all authentication tokens updated successfully.
Connection to cloud-qe-19.testrelm.test closed.
[root@cloud-qe-19 ~]# ssh bz1201454.test
bz1201454.test's password: 
Last login: Fri May 15 12:19:13 2015 from cloud-qe-19.testrelm.test
**  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **
                 This System is reserved by nsoman.

 To return this system early. You can run the command: return2beaker.sh
  Ensure you have your logs off the system before returning to Beaker

 To extend your reservation time. You can run the command:
  extendtesttime.sh
 This is an interactive script. You will be prompted for how many
  hours you would like to extend the reservation.

 You should verify the watchdog was updated succesfully after
  you extend your reservation.
  https://beaker.engineering.redhat.com/recipes/1907738

 For ssh, kvm, serial and power control operations please look here:
  https://beaker.engineering.redhat.com/view/cloud-qe-19.testrelm.test

 For the default root password, see:
  https://beaker.engineering.redhat.com/prefs/

      Beaker Test information:
                         HOSTNAME=cloud-qe-19.testrelm.test
                            JOBID=925092
                         RECIPEID=1907738
                    RESULT_SERVER=127.0.0.1:7085
                           DISTRO=RHEL-6.7-20150408.n.0
                     ARCHITECTURE=x86_64

      Job Whiteboard: IPA :: RHEL 6.7 :: x86_64 :: UI

      Recipe Whiteboard: IPA MASTER
**  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **
Could not chdir to home directory /home/bz1201454: No such file or directory
-sh-4.1$
Comment 9 errata-xmlrpc 2015-07-22 07:39:49 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-1462.html