Bug 914892

Summary:	[RFE] Configure SSH when enrolling with IPA
Product:	[Fedora] Fedora	Reporter:	Dmitri Pal <dpal>
Component:	realmd	Assignee:	Stef Walter <stefw>
Status:	CLOSED NEXTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	19	CC:	jhrozek, pkis, stefw, yaneti
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-05-13 15:13:44 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	917662, 918092

Description Dmitri Pal 2013-02-23 08:49:16 UTC

When realmd calls ipa-client-install it should take advantage of the automatic SSH configuration.
For more information on this feature of IPA client see following ticket:
https://fedorahosted.org/freeipa/ticket/3452

Comment 1 Stef Walter 2013-03-06 20:21:10 UTC

Related (probably prerequisite bug) upstream: https://bugs.freedesktop.org/show_bug.cgi?id=61858

Comment 2 Stef Walter 2013-04-12 17:02:38 UTC

Dmitri, it's hard to understand from the linked freeipa tickets what exactly we need realmd to do here.

In realmd we don't specify --nossh or -nosshd by default, so as I understand it SSH should be configured as expected.

Comment 3 Dmitri Pal 2013-04-16 01:55:21 UTC

Just making sure that SSH works properly out of box with realmd enrollment would probably be sufficient.

Comment 4 Patrik Kis 2013-04-19 12:32:49 UTC

ssh is working to ipa-users, what causes problems is public-key authentication. E.g. if ssh to ipa-user that knows the public-key of user who is doing the ssh, the sshd server still asks for password.
 
This is known bug of ipa-client. It should be tested with realmd too once it is fixed (freeipa bug 953617)
openssh-6.2p1-3.fc19
freeipa-client-3.2.0-0.2.beta1.fc19

W/A:
add to /etc/ssh/sshd_config:

AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
AuthorizedKeysCommandUser nobody

and restart the ssh server.

Comment 5 Fedora Update System 2013-04-29 18:03:31 UTC

realmd-0.13.90-1.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/realmd-0.13.90-1.fc19

Comment 6 Fedora Update System 2013-04-30 20:12:54 UTC

Package realmd-0.13.90-1.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing realmd-0.13.90-1.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-7111/realmd-0.13.90-1.fc19
then log in and leave karma (feedback).

Comment 7 Fedora Update System 2013-05-02 14:13:53 UTC

realmd-0.13.91-1.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/realmd-0.13.91-1.fc19

Comment 8 Stef Walter 2013-05-13 15:13:44 UTC

Fixed in Fedora 19 after this release: https://admin.fedoraproject.org/updates/FEDORA-2013-7787/realmd-0.14.0-1.fc19