Bug 2095301
| Summary: | RFE: For dnf operations against Red Hat CDN, enable OCSP stapling verification [rhel-9.0.0.z] | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | RHEL Program Management Team <pgm-rhel-tools> |
| Component: | subscription-manager | Assignee: | Pino Toscano <ptoscano> |
| Status: | CLOSED ERRATA | QA Contact: | Red Hat subscription-manager QE Team <rhsm-qe> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 9.0 | CC: | arpandey, candlepin-bugs, cdonnell, jpazdziora, jsefler, kanderso, redakkan, zpetrace |
| Target Milestone: | rc | Keywords: | FutureFeature, Triaged, ZStream |
| Target Release: | 9.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | subscription-manager-1.29.26.1-1.el9_0 | Doc Type: | Enhancement |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 2075455 | Environment: | |
| Last Closed: | 2022-08-09 10:30:43 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2075455 | ||
| Bug Blocks: | |||
|
Comment 1
Zdenek Petracek
2022-06-21 13:01:30 UTC
Final verification on subscription-manager-1.29.26.1-1.el9_0.x86_64
Beaker Test information:
HOSTNAME=sweetpig-19.4a2m.lab.eng.bos.redhat.com
JOBID=6839502
RECIPEID=12324957
RESULT_SERVER=
DISTRO=RHEL-9.0.0
ARCHITECTURE=x86_64
>> verifying presence of flag 'sslverifystatus = 1' in repo file when server supports the ssl_verify_status capability -
[arpandey@ovpn-9-48 ~]$ curl --stderr /dev/null --insecure --user admin:admin --request GET 'https://archana-candlepin.usersys.redhat.com:8443/candlepin/status' | python -m json.tool
{
"mode": "NORMAL",
"modeReason": null,
"modeChangeTime": null,
"result": true,
"version": "4.2.4",
"release": "1",
"standalone": false,
"timeUTC": "2022-07-25T07:15:31-0400",
"rulesSource": "default",
"rulesVersion": "5.43",
"managerCapabilities": [
"instance_multiplier",
"derived_product",
"vcpu",
"cert_v3",
"hypervisors_heartbeat",
"remove_by_pool_id",
"syspurpose",
"storage_band",
"cores",
"ssl_verify_status",
"multi_environment",
"hypervisors_async",
"org_level_content_access",
"guest_limit",
"ram",
"batch_bind"
],
"keycloakRealm": null,
"keycloakAuthUrl": null,
"keycloakResource": null
}
[arpandey@ovpn-9-48 ~]$
[root@sweetpig-19 ~]#
[root@sweetpig-19 ~]# subscription-manager version
server type: This system is currently not registered.
subscription management server: 4.2.4-1
subscription management rules: 5.43
subscription-manager: 1.29.26.1-1.el9_0
[root@sweetpig-19 ~]#
[root@sweetpig-19 ~]# subscription-manager register --username ***** --password *****
Registering to: archana-candlepin.usersys.redhat.com:8443/candlepin
Hint: User "*****" is member of following organizations: snowwhite, admin
Organization: snowwhite
The system has been registered with ID: 7c873c51-e360-4a60-9b85-a671577d3b4f
The registered system name is: sweetpig-19.4a2m.lab.eng.bos.redhat.com
[root@sweetpig-19 ~]#
[root@sweetpig-19 ~]#
[root@sweetpig-19 ~]# subscription-manager status
+-------------------------------------------+
System Status Details
+-------------------------------------------+
Overall Status: Disabled
Content Access Mode is set to Simple Content Access. This host has access to content, regardless of subscription status.
System Purpose Status: Disabled
[root@sweetpig-19 ~]# grep '^baseurl = https://cdn\.redhat\.com/' /etc/yum.repos.d/redhat.repo | wc -l
89
[root@sweetpig-19 ~]# grep '^sslverifystatus = 1' /etc/yum.repos.d/redhat.repo | wc -l
89 << sslverifystatus flag is present in repo file
[root@sweetpig-19 ~]#
----------------------------------------------------------------------------------------------------------------------
>> removing ssl_verify_status capability from server and then verifying removal of 'sslverifystatus = 1' flag from repo file
steps to verify-
[arpandey@ovpn-9-48 ~]$ curl --stderr /dev/null --insecure --user admin:admin --request GET 'https://archana-candlepin.usersys.redhat.com:8443/candlepin/status' | python -m json.tool
{
"mode": "NORMAL",
"modeReason": null,
"modeChangeTime": null,
"result": true,
"version": "4.2.4",
"release": "1",
"standalone": false,
"timeUTC": "2022-07-25T07:51:00-0400",
"rulesSource": "default",
"rulesVersion": "5.43",
"managerCapabilities": [
"instance_multiplier",
"derived_product",
"vcpu",
"cert_v3",
"hypervisors_heartbeat",
"remove_by_pool_id",
"syspurpose",
"storage_band",
"cores",
"multi_environment",
"hypervisors_async",
"org_level_content_access",
"guest_limit",
"ram",
"batch_bind"
],
"keycloakRealm": null,
"keycloakAuthUrl": null,
"keycloakResource": null
}
[root@sweetpig-19 ~]#
[root@sweetpig-19 ~]# subscription-manager register --username ****** --password ***** --org *****
Registering to: archana-candlepin.usersys.redhat.com:8443/candlepin
The system has been registered with ID: b0834227-3f7d-4661-9de7-a4c2d4b1d564
The registered system name is: sweetpig-19.4a2m.lab.eng.bos.redhat.com
[root@sweetpig-19 ~]#
[root@sweetpig-19 ~]# subscription-manager status
+-------------------------------------------+
System Status Details
+-------------------------------------------+
Overall Status: Disabled
Content Access Mode is set to Simple Content Access. This host has access to content, regardless of subscription status.
System Purpose Status: Unknown
>> Now verify that ‘sslverifystatus =1’ flag is not present in repo file
[root@sweetpig-19 ~]# grep '^baseurl = https://cdn\.redhat\.com/' /etc/yum.repos.d/redhat.repo | wc -l
89
[root@sweetpig-19 ~]# grep '^sslverifystatus = 1' /etc/yum.repos.d/redhat.repo | wc -l
0 <<< sslverifystatus flag removed
[root@sweetpig-19 ~]#
Based on above evidences, verified that 'sslverifystatus = 1' flag is getting added and removed in repo file as per the capability supported in server.
Verification : PASSED
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (subscription-manager bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:5944 |