Bug 2187722
| Summary: | PKINIT module initialization fails if a well-known MODP group cannot be loaded [rhel-9] | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Filip Dvorak <fdvorak> | |
| Component: | krb5 | Assignee: | Julien Rische <jrische> | |
| Status: | CLOSED ERRATA | QA Contact: | Michal Polovka <mpolovka> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | 9.2 | CC: | abokovoy, cllang, dbelyavs, frenaud, ftrivino, hkario, jrische, mjurasek | |
| Target Milestone: | rc | Keywords: | Triaged, ZStream | |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
|
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | krb5-1.21.1-1.el9 | Doc Type: | No Doc Update | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 2209715 2214297 (view as bug list) | Environment: | ||
| Last Closed: | 2023-11-07 08:56:13 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 2144442, 2209715, 2214297 | |||
|
Description
Filip Dvorak
2023-04-18 14:26:40 UTC
Can you add a systemd snippet to krb5kdc.service that sets KRB5_TRACE for the krb5kdc process and then collect the trace there? If KDC does not respond with PKINIT pre-auth types, client will not see them, obviously, so we need to understand what happens to pkinit KDC plugin code. This downstream merge request is fixing the issue on the OpenSSL side by re-enabling DHX key type: https://gitlab.com/redhat/centos-stream/rpms/openssl/-/merge_requests/109 However, it will not be possible to load groups that are not considered well-known by OpenSSL. This is the case of group 2. I opened a krb5 upstream pull requests to allow the PKINIT plugin to be loaded if at least one of groups 2, 14, or 16 is available: https://github.com/krb5/krb5/pull/1303 Verified using automation from bash-sanity-pkinit-sanity and krb5-server-works-with-AD-server in FIPS mode with krb5-server-1.20.1-9.el9_2.x86_64 :: Duration: 314s :: Phases: 24 good, 0 bad :: OVERALL RESULT: PASS (/CoreOS/krb5/Sanity/pkinit-sanity) https://idm-artifacts.psi.redhat.com/idm-ci/idm-ci/trigger/prod/trigger/run/null/2885/ :: Duration: 137s :: Phases: 10 good, 0 bad :: OVERALL RESULT: PASS (/CoreOS/krb5/Sanity/krb5-server-works-with-AD-server) https://idm-artifacts.psi.redhat.com/idm-ci/idm-ci/trigger/prod/trigger/run/null/2883/ Marking as verified. Complete test log is an attachment of this BZ. Also marking as pre-verified tested, as this version has been preverified in 9.2z and 9.3 just inherited this build. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: krb5 security and bug fix update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2023:6699 |