1201454 – ipa breaks sshd config

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1201454 - ipa breaks sshd config

Summary: ipa breaks sshd config

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 6
Classification:	Red Hat
Component:	ipa
Sub Component:
Version:	6.8
Hardware:	Unspecified
OS:	Unspecified
Priority:	medium
Severity:	unspecified
Target Milestone:	rc
Target Release:	---
Assignee:	IPA Maintainers
QA Contact:	Namita Soman
Docs Contact:
URL:
Whiteboard:
Depends On:	1112691
Blocks:
TreeView+	depends on / blocked

Reported:	2015-03-12 17:48 UTC by Pavel Zhukov
Modified:	2015-07-22 07:39 UTC (History)
CC List:	5 users (show)
Fixed In Version:	ipa-3.0.0-44.el6
Doc Type:	Bug Fix
Doc Text:	After running ipa-client-install, it was not possible to log in using SSH under certain circumstances. With this update, ipa-client-install no longer corrupts the sshd_config file. As a result, the sshd service can start as expected, and logging in using SSH works in the described situation.
Clone Of:
Environment:
Last Closed:	2015-07-22 07:39:49 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)
user added via UI (665.93 KB, image/png) 2015-05-15 16:28 UTC, Xiyang Dong	no flags	Details
View All

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2015:1462	0	normal	SHIPPED_LIVE	Moderate: ipa security and bug fix update	2015-07-21 14:14:52 UTC

Description Pavel Zhukov 2015-03-12 17:48:47 UTC

Description of problem:
after ipa installation and adding new user sshd is not able to start because of missed new line characted

Version-Release number of selected component (if applicable):
ipa-server-3.0.0-42.el6.x86_64

How reproducible:
100% (2 of 2 installation in my case)

Steps to Reproduce:
1. ipaserver-install --setup-dns
2. add new user via UI
3. try to login via ssh

Additional info:
Problematic string looks like:
PermitRootLogin without-passwordKerberosAuthentication no

Comment 2 Pavel Zhukov 2015-03-12 18:03:16 UTC

Note: This is "cloud-inited" image (OpenStack instance).

Comment 3 Jan Cholasta 2015-03-13 08:29:12 UTC

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/4373

Comment 4 Martin Kosek 2015-03-23 16:25:02 UTC

Fixed upstream:

master:
3e0245f28fe3f294f21b8d0cc298b1901119921d Do not corrupt sshd_config in client install when trailing newline is missing.

Comment 6 Xiyang Dong 2015-05-15 16:28:55 UTC

Created attachment 1025940 [details]
user added via UI

Comment 7 Xiyang Dong 2015-05-15 16:30:25 UTC

Verified on ipa-server-3.0.0-46.el6.x86_64:
Steps to verify:
1. ipaserver-install --setup-dns
2. add new user via UI
3. login via ssh went successfully
[root@cloud-qe-19 ~]# ssh bz1201454.test
bz1201454.test's password: 
Password expired. Change your password now.
**  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **
                 This System is reserved by nsoman.

 To return this system early. You can run the command: return2beaker.sh
  Ensure you have your logs off the system before returning to Beaker

 To extend your reservation time. You can run the command:
  extendtesttime.sh
 This is an interactive script. You will be prompted for how many
  hours you would like to extend the reservation.

 You should verify the watchdog was updated succesfully after
  you extend your reservation.
  https://beaker.engineering.redhat.com/recipes/1907738

 For ssh, kvm, serial and power control operations please look here:
  https://beaker.engineering.redhat.com/view/cloud-qe-19.testrelm.test

 For the default root password, see:
  https://beaker.engineering.redhat.com/prefs/

      Beaker Test information:
                         HOSTNAME=cloud-qe-19.testrelm.test
                            JOBID=925092
                         RECIPEID=1907738
                    RESULT_SERVER=127.0.0.1:7085
                           DISTRO=RHEL-6.7-20150408.n.0
                     ARCHITECTURE=x86_64

      Job Whiteboard: IPA :: RHEL 6.7 :: x86_64 :: UI

      Recipe Whiteboard: IPA MASTER
**  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **
WARNING: Your password has expired.
You must change your password now and login again!
Changing password for user bz1201454.
Current Password: 
New password: 
Retype new password: 
passwd: all authentication tokens updated successfully.
Connection to cloud-qe-19.testrelm.test closed.
[root@cloud-qe-19 ~]# ssh bz1201454.test
bz1201454.test's password: 
Last login: Fri May 15 12:19:13 2015 from cloud-qe-19.testrelm.test
**  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **
                 This System is reserved by nsoman.

 To return this system early. You can run the command: return2beaker.sh
  Ensure you have your logs off the system before returning to Beaker

 To extend your reservation time. You can run the command:
  extendtesttime.sh
 This is an interactive script. You will be prompted for how many
  hours you would like to extend the reservation.

 You should verify the watchdog was updated succesfully after
  you extend your reservation.
  https://beaker.engineering.redhat.com/recipes/1907738

 For ssh, kvm, serial and power control operations please look here:
  https://beaker.engineering.redhat.com/view/cloud-qe-19.testrelm.test

 For the default root password, see:
  https://beaker.engineering.redhat.com/prefs/

      Beaker Test information:
                         HOSTNAME=cloud-qe-19.testrelm.test
                            JOBID=925092
                         RECIPEID=1907738
                    RESULT_SERVER=127.0.0.1:7085
                           DISTRO=RHEL-6.7-20150408.n.0
                     ARCHITECTURE=x86_64

      Job Whiteboard: IPA :: RHEL 6.7 :: x86_64 :: UI

      Recipe Whiteboard: IPA MASTER
**  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **  **
Could not chdir to home directory /home/bz1201454: No such file or directory
-sh-4.1$

Comment 9 errata-xmlrpc 2015-07-22 07:39:49 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-1462.html

Note You need to log in before you can comment on or make changes to this bug.