Bug 1201454 - ipa breaks sshd config
Summary: ipa breaks sshd config
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: ipa
Version: 6.8
Hardware: Unspecified
OS: Unspecified
medium
unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: Namita Soman
URL:
Whiteboard:
Depends On: 1112691
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-03-12 17:48 UTC by Pavel Zhukov
Modified: 2015-07-22 07:39 UTC (History)
5 users (show)

Fixed In Version: ipa-3.0.0-44.el6
Doc Type: Bug Fix
Doc Text:
After running ipa-client-install, it was not possible to log in using SSH under certain circumstances. With this update, ipa-client-install no longer corrupts the sshd_config file. As a result, the sshd service can start as expected, and logging in using SSH works in the described situation.
Clone Of:
Environment:
Last Closed: 2015-07-22 07:39:49 UTC


Attachments (Terms of Use)
user added via UI (665.93 KB, image/png)
2015-05-15 16:28 UTC, Xiyang Dong
no flags Details


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:1462 normal SHIPPED_LIVE Moderate: ipa security and bug fix update 2015-07-21 14:14:52 UTC

Description Pavel Zhukov 2015-03-12 17:48:47 UTC
Description of problem:
after ipa installation and adding new user sshd is not able to start because of missed new line characted

Version-Release number of selected component (if applicable):
ipa-server-3.0.0-42.el6.x86_64

How reproducible:
100% (2 of 2 installation in my case)

Steps to Reproduce:
1. ipaserver-install --setup-dns
2. add new user via UI
3. try to login via ssh

Additional info:
Problematic string looks like:
PermitRootLogin without-passwordKerberosAuthentication no

Comment 2 Pavel Zhukov 2015-03-12 18:03:16 UTC
Note: This is "cloud-inited" image (OpenStack instance).

Comment 3 Jan Cholasta 2015-03-13 08:29:12 UTC
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/4373

Comment 4 Martin Kosek 2015-03-23 16:25:02 UTC
Fixed upstream:

master:
3e0245f28fe3f294f21b8d0cc298b1901119921d Do not corrupt sshd_config in client install when trailing newline is missing.

Comment 6 Xiyang Dong 2015-05-15 16:28:55 UTC
Created attachment 1025940 [details]
user added via UI

Comment 7 Xiyang Dong 2015-05-15 16:30:25 UTC
Verified on ipa-server-3.0.0-46.el6.x86_64:
Steps to verify:
1. ipaserver-install --setup-dns
2. add new user via UI
3. login via ssh went successfully
[root@cloud-qe-19 ~]# ssh bz1201454@cloud-qe-19.testrelm.test">bz1201454@cloud-qe-19.testrelm.test
bz1201454@cloud-qe-19.testrelm.test">bz1201454@cloud-qe-19.testrelm.test's password: 
Password expired. Change your password now.
**  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **
                 This System is reserved by nsoman@redhat.com.

 To return this system early. You can run the command: return2beaker.sh
  Ensure you have your logs off the system before returning to Beaker

 To extend your reservation time. You can run the command:
  extendtesttime.sh
 This is an interactive script. You will be prompted for how many
  hours you would like to extend the reservation.

 You should verify the watchdog was updated succesfully after
  you extend your reservation.
  https://beaker.engineering.redhat.com/recipes/1907738

 For ssh, kvm, serial and power control operations please look here:
  https://beaker.engineering.redhat.com/view/cloud-qe-19.testrelm.test

 For the default root password, see:
  https://beaker.engineering.redhat.com/prefs/

      Beaker Test information:
                         HOSTNAME=cloud-qe-19.testrelm.test
                            JOBID=925092
                         RECIPEID=1907738
                    RESULT_SERVER=127.0.0.1:7085
                           DISTRO=RHEL-6.7-20150408.n.0
                     ARCHITECTURE=x86_64

      Job Whiteboard: IPA :: RHEL 6.7 :: x86_64 :: UI

      Recipe Whiteboard: IPA MASTER
**  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **
WARNING: Your password has expired.
You must change your password now and login again!
Changing password for user bz1201454.
Current Password: 
New password: 
Retype new password: 
passwd: all authentication tokens updated successfully.
Connection to cloud-qe-19.testrelm.test closed.
[root@cloud-qe-19 ~]# ssh bz1201454@cloud-qe-19.testrelm.test">bz1201454@cloud-qe-19.testrelm.test
bz1201454@cloud-qe-19.testrelm.test">bz1201454@cloud-qe-19.testrelm.test's password: 
Last login: Fri May 15 12:19:13 2015 from cloud-qe-19.testrelm.test
**  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **
                 This System is reserved by nsoman@redhat.com.

 To return this system early. You can run the command: return2beaker.sh
  Ensure you have your logs off the system before returning to Beaker

 To extend your reservation time. You can run the command:
  extendtesttime.sh
 This is an interactive script. You will be prompted for how many
  hours you would like to extend the reservation.

 You should verify the watchdog was updated succesfully after
  you extend your reservation.
  https://beaker.engineering.redhat.com/recipes/1907738

 For ssh, kvm, serial and power control operations please look here:
  https://beaker.engineering.redhat.com/view/cloud-qe-19.testrelm.test

 For the default root password, see:
  https://beaker.engineering.redhat.com/prefs/

      Beaker Test information:
                         HOSTNAME=cloud-qe-19.testrelm.test
                            JOBID=925092
                         RECIPEID=1907738
                    RESULT_SERVER=127.0.0.1:7085
                           DISTRO=RHEL-6.7-20150408.n.0
                     ARCHITECTURE=x86_64

      Job Whiteboard: IPA :: RHEL 6.7 :: x86_64 :: UI

      Recipe Whiteboard: IPA MASTER
**  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **
Could not chdir to home directory /home/bz1201454: No such file or directory
-sh-4.1$

Comment 9 errata-xmlrpc 2015-07-22 07:39:49 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-1462.html


Note You need to log in before you can comment on or make changes to this bug.