Bug 1339677

Summary:	[RFE] Lock 'root' account and disable password authentication for Azure appliance
Product:	Red Hat CloudForms Management Engine	Reporter:	Satoe Imaishi <simaishi>
Component:	Build	Assignee:	Satoe Imaishi <simaishi>
Status:	CLOSED ERRATA	QA Contact:	Jeff Teehan <jteehan>
Severity:	high	Docs Contact:
Priority:	high
Version:	5.6.0	CC:	cpelland, jhardy, jteehan, mfeifer, obarenbo
Target Milestone:	GA	Keywords:	FutureFeature
Target Release:	5.6.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	5.6.0.10	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-06-29 16:05:40 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1350329

Description Satoe Imaishi 2016-05-25 14:55:26 UTC

Description of problem:

Currently, the Azure appliance allows users to login with root/smartvm credentials unless password authentication is explicitly disabled at the time of VM creation.

The root account should be disabled and only allow login with ssh key by default.

Version-Release number of selected component (if applicable):
cfme-azure-5.6.0.7-1.x86_64.vhd


Actual results:


Expected results:


Additional info:

Comment 2 CFME Bot 2016-05-26 21:31:15 UTC

https://github.com/ManageIQ/manageiq-appliance-build/pull/134

Comment 3 Oleg Barenboim 2016-05-26 21:33:47 UTC

https://github.com/ManageIQ/manageiq-appliance-build/pull/134 has been merged and backported to Darga.

Comment 4 CFME Bot 2016-05-26 21:45:40 UTC

New commit detected on ManageIQ/manageiq-appliance-build/master:
https://github.com/ManageIQ/manageiq-appliance-build/commit/b7176c51aa415fe1973c1fcc125de08593a1aacf

commit b7176c51aa415fe1973c1fcc125de08593a1aacf
Author:     Satoe Imaishi <simaishi>
AuthorDate: Tue May 24 18:10:01 2016 -0400
Commit:     Satoe Imaishi <simaishi>
CommitDate: Thu May 26 18:09:28 2016 -0400

    Disable password authentication and lock root account for Azure
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1339677

 kickstarts/partials/post/azure.ks.erb | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

Comment 6 Jeff Teehan 2016-06-08 18:53:22 UTC

jteehan@localhost openvpn]$ ssh root.119.41
The authenticity of host '23.96.119.41 (23.96.119.41)' can't be established.
ECDSA key fingerprint is SHA256:hr8fiYCkRign6oXbTFqMalEsmQJniJoD+efM20Zaa5s.
ECDSA key fingerprint is MD5:9a:50:a2:a0:f6:7e:5f:5e:7e:27:b6:14:48:e4:fc:19.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '23.96.119.41' (ECDSA) to the list of known hosts.
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
[jteehan@localhost openvpn]$ 

Moving to Verified for 5.6.0.10

Comment 8 errata-xmlrpc 2016-06-29 16:05:40 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2016:1348