| Summary: | Accessing protected repos on pulp via yum fails with a 403 | ||
|---|---|---|---|
| Product: | [Retired] Pulp | Reporter: | Pradeep Kilambi <pkilambi> |
| Component: | user-experience | Assignee: | James Slagle <jslagle> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Preethi Thomas <pthomas> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 1.0.0 | CC: | jmatthew, tsanders |
| Target Milestone: | --- | Keywords: | Triaged |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Pradeep Kilambi
2012-02-13 19:39:57 UTC
Something seems weird with the cert outputted in the log. Based on the output from comment #0 1) the CA should have a CN of: Pulp Server CA 2) the ent cert should have a CN of: Pulp Entitlement Certificate Yet the Pulp log shows the ent cert to verify and the CA both have a CN=x86-008.build.bos.redhat.com Next step would be to run something like: openssl x509 -in /etc/pki/pulp/content/myRepo/myRepo.ca -text openssl x509 -in /etc/pki/pulp/content/myRepo/myRepo.crt -text Also, it's worth noting that a separate cert/key were used and this isn't a combined cert/key in a single PEM, that may also be a factor of this bz. We tried this twice, the first time my CN was x86-008.build.bos.redhat.com and my result was still a 403. The log probably is showing the cert info from first run, but in both cases the result was the same. Regarding the cert/key being separate, I already verified that when the bind happens, the cert that gets put down on the consumer is a pem file. SO even though we're passing in cert/key as sparate it gets combined on the server when it gets saved. I already spoke to james about this on irc. He said he will validate it. There is a chance this is a non issue and i missed a step, but i tried it twice in a clean env and still got a 403. I was able to reproduce the error with sslverify=1 needing to be turned off, but once I did that, I got access to the repo. As to why sslverify=0 is needed, it's because we are sending down the wrong CA cert to the client during the bind operation to use for the sslcacert value. The CA we send down is the one that signed the client entitlement certificate, not the one that signed the server's apache ssl certificate. The code that does this is in pulp/server/consumer_utils.py at line 83. That code reads the consumer_ca attribute on the repo object and sends that down as cacert in the bind data, which gets saved as sslcacert in the yum config on the client. The consumer_ca file on the repo object is the CA that's used server side to verify the client certificate. This needs to be fixed. Fixing this is going to be tricky. Mainly because we don't have know the path to the CA that signed the apache SSL certificate anywhere in pulp. This information isn't required for anything server side, and in fact you don't even have to have the CA available anywhere. Furthermore, it's possible that the server's SSL certificate is self signed in which case, there is no CA, we'd need to pass down the certificate itself. I think what we need to do is add a new config to /etc/pulp/pulp.conf to add the path to the CA that signed the server's SSL certificate. If that certificate is self signed, this can be the path to the certificate itself. We can default the value to /etc/pki/tls/certs/localhost.crt, which is the default path to the server's SSL certificate in /etc/httpd/conf.d/ssl.conf. We can then read this config and pass this certificate down to the client as cacert in the bind data. Ok, I was able to verify the repo auth error as well even with sslverify=0 set, so now I'm looking into that. The 403 repo auth failure is due to an error in the blog post example at http://blog.pulpproject.org/2011/05/18/pulp-protected-repositories/. The OID extension should not start with /repos. We actually strip out /pulp/repos from the beginning of the requested url, not just /pulp. As far as I can tell the repo auth code has always done this, so I'm not sure why that blog post shows what it does. I seem to have a vague recollection that the repo path on the pulp server changed, didn't it used to be under 2 repo dirs, like /pulp/repos/repos? If I generate a client certificate without the initial /repos in the extension I can get the repo auth to work (minus the sslverify issue of course). fix from comment #3 committed to pulp master 9d2f3265ddbe9384c8060c48f9eac40333122d64 user guide changes updated at https://fedorahosted.org/pulp/wiki/UGRepoAuth build: 0.267 verified [root@preethi chain_example]# rpm -q pulp pulp-0.0.267-1.fc15.noarch [root@preethi-el6-pulp ~]# yum repolist Loaded plugins: product-id, pulp-profile-update, security, subscription-manager Updating certificate-based repositories. pulp_f15_x86_64 | 2.9 kB 00:00 pulp_f15_x86_64/primary_db | 11 kB 00:00 rhel6 | 4.0 kB 00:00 rhel6/primary_db | 3.1 MB 00:02 rhel6_2 | 3.7 kB 00:00 rhel6_2/primary_db | 11 MB 00:03 repo id repo name status epel Extra Packages for Enterprise Linux 6 - x86_64 6,991 pulp-v1-testing Pulp v1 Testing 20 pulp_f15_x86_64 pulp_f15_x86_64 20 rhel6 Red Hat Enterprise Linux 6Server - x86_64 - RHEL6 3,529 rhel6_2 rhel6_2 6,862 repolist: 17,422 [root@preethi-el6-pulp ~]# cat /etc/yum.repos.d/ epel.repo pulp.repo rhel-pulp.repo rhel-source.repo epel-testing.repo redhat.repo rhel-pulp.repo.1 [root@preethi-el6-pulp ~]# cat /etc/yum.repos.d/pulp.repo # # Pulp Repositories # Managed by Pulp client # [rhel6_2] name = rhel6_2 enabled = 1 sslverify = 0 gpgcheck = 0 baseurl = https://preethi.usersys.redhat.com/pulp/repos/content/dist/rhel/rhui/server/6/6Server/x86_64/os [pulp_f15_x86_64] name = pulp_f15_x86_64 enabled = 1 sslverify = 1 gpgcheck = 0 sslcacert = /etc/pki/pulp/client/repo/pulp_f15_x86_64/ca.crt sslclientcert = /etc/pki/pulp/client/repo/pulp_f15_x86_64/client.crt baseurl = https://preethi.usersys.redhat.com/pulp/repos/repos/pulp/pulp/v1/testing/fedora-15/x86_64[root@preethi-el6-pulp ~]# Pulp v1.0 is released Closed Current Release. Pulp v1.0 is released. |