Bug 973766

Summary:	The --ssh-trust-dns prevents GlobalKnownHostsFile and ProxyCommand from being configured
Product:	Red Hat Enterprise Linux 7	Reporter:	Martin Kosek <mkosek>
Component:	ipa	Assignee:	Martin Kosek <mkosek>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Namita Soman <nsoman>
Severity:	unspecified	Docs Contact:
Priority:	medium
Version:	7.0	CC:	mkosek, spoore
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ipa-3.2.2-1.el7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-06-13 10:56:43 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Martin Kosek 2013-06-12 16:21:26 UTC

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/3705

When running

{{{
ipa-client-install --ssh-trust-dns
}}}

it effectively prevents the

{{{
GlobalKnownHostsFile /var/lib/sss/pubconf/known_hosts
ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h
}}}

from being configured in {{{/etc/ssh/ssh_config}}}. The ipa-client-install man page could be amended to be clear about it, or the behaviour could be changed to always configure both (unless {{{--no-ssh}}} is used).

Comment 1 Namita Soman 2013-06-17 16:55:26 UTC

Will this be a man page change or a configuration update in /etc/ssh/ssh_config ? Please provide steps to verify

Comment 2 Martin Kosek 2013-06-18 08:59:01 UTC

There will be a configuration change in /etc/ssh/ssh_config. When ipa-client-install is run with --ssh-trust-dns, then /etc/ssh/ssh_config will contain both standard

GlobalKnownHostsFile /var/lib/sss/pubconf/known_hosts
ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h

but also

VerifyHostKeyDNS yes

Comment 3 Martin Kosek 2013-06-27 06:49:46 UTC

Fixed upstream:
master: https://fedorahosted.org/freeipa/changeset/736dd0fcd6d35abbea28481dc544502c132f78f8
ipa-3-2: https://fedorahosted.org/freeipa/changeset/9e5ce4f501ed3706808c484e21ae0e322391b783

Comment 5 Scott Poore 2013-12-18 20:57:21 UTC

Verified.

Version ::

ipa-client-3.3.3-5.el7.x86_64

Test Results ::

[root@ipaqa64vmc install-client-cli]#         rlRun "ipa-client-install --domain=$DOMAIN --principal=$ADMINID --server=$MASTER --password=$ADMINPW --unattended --realm=$RELM --force-ntpd --ssh-trust-dns"
Hostname: ipaqa64vmc.testrelm.com
Realm: TESTRELM.COM
DNS Domain: testrelm.com
IPA Server: cloud-qe-19.testrelm.com
BaseDN: dc=testrelm,dc=com

Synchronizing time with KDC...
Successfully retrieved CA cert
    Subject:     CN=Certificate Authority,O=TESTRELM.COM
    Issuer:      CN=Certificate Authority,O=TESTRELM.COM
    Valid From:  Tue Dec 17 23:42:14 2013 UTC
    Valid Until: Sat Dec 17 23:42:14 2033 UTC

Enrolled in IPA realm TESTRELM.COM
Created /etc/ipa/default.conf
New SSSD config will be created
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm TESTRELM.COM
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
SSSD enabled
Configured /etc/openldap/ldap.conf
NTP enabled
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Client configuration complete.
:: [   PASS   ] :: Running 'ipa-client-install --domain=testrelm.com --principal=admin --server=cloud-qe-19.testrelm.com --password=Secret123 --unattended --realm=TESTRELM.COM --force-ntpd --ssh-trust-dns' (Expected 0, got 0)
[root@ipaqa64vmc install-client-cli]# ipa_bugcheck_bz973766

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: ipa_bugcheck_bz973766:  The --ssh-trust-dns prevents GlobalKnownHostsFile and ProxyCommand from being configured
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

2013-12-18T20:46:58Z DEBUG /usr/sbin/ipa-client-install was invoked with options: {'domain': 'testrelm.com', 'force': False, 'krb5_offline_passwords': True, 'primary': False, 'realm_name': 'TESTRELM.COM', 'force_ntpd': True, 'create_sshfp': True, 'conf_sshd': True, 'conf_ntp': True, 'on_master': False, 'ntp_server': None, 'ca_cert_file': None, 'principal': 'admin', 'keytab': None, 'hostname': None, 'no_ac': False, 'unattended': True, 'sssd': True, 'trust_sshfp': True, 'dns_updates': False, 'mkhomedir': False, 'conf_ssh': True, 'force_join': False, 'server': ['cloud-qe-19.testrelm.com'], 'prompt_password': False, 'permit': False, 'debug': False, 'preserve_sssd': False, 'uninstall': False}
:: [   PASS   ] :: File '/etc/ssh/ssh_config' should contain 'GlobalKnownHostsFile.*sss/pubconf/known_hosts' 
:: [   PASS   ] :: File '/etc/ssh/ssh_config' should contain 'ProxyCommand.*knownhostsproxy' 
:: [   PASS   ] :: BZ 973766 not found

Comment 6 Ludek Smid 2014-06-13 10:56:43 UTC

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.