Bug 1282845 - sshd_config change on ipa-client-install can prevent sshd from starting up
Summary: sshd_config change on ipa-client-install can prevent sshd from starting up
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.1
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: rc
: ---
Assignee: Pavel Picka
QA Contact: Namita Soman
URL:
Whiteboard:
Keywords: Regression, ZStream
Depends On:
Blocks: 1284025
TreeView+ depends on / blocked
 
Reported: 2015-11-17 15:41 UTC by Luc de Louw
Modified: 2016-11-04 05:40 UTC (History)
8 users (show)

(edit)
Clone Of:
: 1284025 (view as bug list)
(edit)
Last Closed: 2016-11-04 05:40:09 UTC


Attachments (Terms of Use)
evidence (3.40 KB, text/plain)
2016-08-17 20:34 UTC, Pavel Picka
no flags Details


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:2404 normal SHIPPED_LIVE ipa bug fix and enhancement update 2016-11-03 13:56:18 UTC

Description Luc de Louw 2015-11-17 15:41:27 UTC
Description of problem:
ipa-client-install reconfigures sshd to use GSSAPI etc.the installer appends the entries at the bottom of the file.

If the existing sshd_config contains a "Match" field, the configuration will result in a sshd_config which prevents sshd from starting.

Excerpt from man 5 sshd_config
"Match Introduces a conditional block. If all of the criteria on the Match line are satisfied, the keywords on the following lines override those set in the global section of the config file, until either another Match line or the end of the file". 

This means that global parameters can not be added at the end of the config file when a Match block comes in place.

Version-Release number of selected component (if applicable):
4.1

How reproducible:
Always


Steps to Reproduce:
1. Enter a Match filed in sshd_config. I.e.
Match Address 10.10.10.10
PermitRootLogin without-password

2. run ipa-client-installer
3. Find the following error message in /var/log/messages
sshd: /etc/ssh/sshd_config line 146: Directive 'UsePAM' is not allowed within a Match block

Actual results:
Match Address 10.10.10.10
KerberosAuthentication no
PubkeyAuthentication yes
UsePAM yes
AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
GSSAPIAuthentication yes
AuthorizedKeysCommandUser nobody
PermitRootLogin without-password


Expected results:
KerberosAuthentication no
PubkeyAuthentication yes
UsePAM yes
AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
GSSAPIAuthentication yes
AuthorizedKeysCommandUser nobody

Match Address 10.10.10.10
PermitRootLogin without-password

Additional info:
Workaround is to use ipa-client-install --no-sshd and distribute a sshd_config which fulfills IPA client requirements.

Comment 2 Petr Vobornik 2015-11-18 14:12:59 UTC
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/5461

Comment 3 Jan Cholasta 2015-11-20 08:43:21 UTC
This is regression introduced by the fix for bug 1112691 and bug 1201454.

Comment 10 Pavel Picka 2016-08-17 20:34 UTC
Created attachment 1191740 [details]
evidence

Verified on 4.4.0-8.el7.x86_64

Comment 12 errata-xmlrpc 2016-11-04 05:40:09 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2404.html


Note You need to log in before you can comment on or make changes to this bug.