Bug 1599721
| Summary: | ipa-server-install fails when FIPS mode is enabled | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Mohammad Rizwan <myusuf> |
| Component: | krb5 | Assignee: | Robbie Harwood <rharwood> |
| Status: | CLOSED ERRATA | QA Contact: | Patrik Kis <pkis> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.6 | CC: | dpal, frenaud, pkis, pvoborni, rcritten, rharwood, tscherf |
| Target Milestone: | rc | Keywords: | Regression, TestBlocker |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | krb5-1.15.1-33.el7 | Doc Type: | No Doc Update |
| Doc Text: |
undefined
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-10-30 08:08:13 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1570600 | ||
|
Description
Mohammad Rizwan
2018-07-10 12:32:20 UTC
ipa-client-install is performing an operation equivalent to
kinit -kt /etc/krb5.keytab -c /etc/ipa/.dns_ccache
and this call fails.
The corresponding log in /var/log/krb5kdc.log is the following:
Jul 10 17:52:33 master.testrelm.test krb5kdc[26466](info): AS_REQ (8 etypes {18 17 16 23 25 26 20 19}) 10.65.206.153: NEEDED_PREAUTH: host/master.testrelm.test for krbtgt/TESTRELM.TEST, Additional pre-authentication required
Jul 10 17:52:33 master.testrelm.test krb5kdc[26466](info): closing down fd 13
Jul 10 17:52:33 master.testrelm.test krb5kdc[26466](info): AS_REQ (8 etypes {18 17 16 23 25 26 20 19}) 10.65.206.153: GENERATE_TICKET_ID: host/master.testrelm.test for krbtgt/TESTRELM.TEST, Cannot allocate memory
Jul 10 17:52:33 master.testrelm.test krb5kdc[26466](info): closing down fd 13
Robbie, could you have a look at the issue? It is possible that some configuration is missing for FIPS. The conf is the following:
# cat /etc/krb5.conf
includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = TESTRELM.TEST
dns_lookup_realm = false
dns_lookup_kdc = true
rdns = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
TESTRELM.TEST = {
kdc = master.testrelm.test:88
master_kdc = master.testrelm.test:88
admin_server = master.testrelm.test:749
default_domain = testrelm.test
pkinit_anchors = FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem
pkinit_pool = FILE:/var/lib/ipa-client/pki/ca-bundle.pem
}
[domain_realm]
.testrelm.test = TESTRELM.TEST
testrelm.test = TESTRELM.TEST
master.testrelm.test = TESTRELM.TEST
[dbmodules]
TESTRELM.TEST = {
db_library = ipadb.so
}
[plugins]
certauth = {
module = ipakdb:kdb/ipadb.so
enable_only = ipakdb
}
This means that kau_make_tkt_id() failed. I believe this is because it attempted to use CKSUMTYPE_RSA_MD5 as a checksum and got back ENOMEM (?) somehow. I will investigate further. Reproduced locally. This happens because of an MD5 usage exposed by https://bugzilla.redhat.com/show_bug.cgi?id=1570600 . Taking bug. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2018:3071 |