Hide Forgot
Description of problem: Replication is encrypting credentials of replication bind user password using DES plugin. This is considered as insecure as for: https://fedorahosted.org/389/ticket/47462 The fix for this bug is only in RHEL7. This bz is just to document this security issue in RHEL6 version of 389-ds-base Version-Release number of selected component (if applicable): 389-ds-base-1.2.11.15*
Fixed upstream in 1.2.11
*** Bug 1376558 has been marked as a duplicate of this bug. ***
1). Checking the default encryption type for replica passwords, with older version of 389-ds-base. [root@auto-hv-02-guest09 MMR_WINSYNC]# rpm -qa |grep -i 389-ds 389-ds-base-libs-1.2.11.15-74.el6.x86_64 389-ds-base-1.2.11.15-74.el6.x86_64 [root@auto-hv-02-guest09 MMR_WINSYNC]# ldapsearch -LLL -x -p 1189 -h localhost -D "cn=Directory Manager" -w Secret123 -b "cn=1189_to_2616_on_auto-hv-02-guest09.idmqe.lab.eng.bos.redhat.com,cn=replica,cn=\"dc=passsync,dc=com\",cn=mapping tree,cn=config" | grep -i nsDS5ReplicaCredentials nsDS5ReplicaCredentials: {DES}2mO8LgMr/w5ognn2BRK+gQ== 2). Upgrade to the latest RHEL-6.9 389-ds-base-1.2.11.15-85 [root@auto-hv-02-guest09 MMR_WINSYNC]# yum -y update 389-ds-base 389-ds-base-libs [root@auto-hv-02-guest09 MMR_WINSYNC]# rpm -qa |grep -i 389-ds 389-ds-base-1.2.11.15-85.el6.x86_64 389-ds-base-libs-1.2.11.15-85.el6.x86_64 3). Running setup-ds.pl [root@auto-hv-02-guest09 MMR_WINSYNC]# setup-ds.pl -u [root@auto-hv-02-guest09 MMR_WINSYNC]# service dirsrv restart 4). Running ldapsearch to check if AES encryption is used. [root@auto-hv-02-guest09 MMR_WINSYNC]# ldapsearch -LLL -x -p 1189 -h localhost -D "cn=Directory Manager" -w Secret123 -b "cn=1189_to_2616_on_auto-hv-02-guest09.idmqe.lab.eng.bos.redhat.com,cn=replica,cn=\"dc=passsync,dc=com\",cn=mapping tree,cn=config" |grep -i nsDS5ReplicaCredentials nsDS5ReplicaCredentials: {AES-TUhNR0NTcUdTSWIzRFFFRkRUQm1NRVVHQ1NxR1NJYjNEUUVG After upgrade, the default password storage scheme changed to AES. No issues with the restart of Directory servers. Hence, marking the bug as Verified.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2017-0667.html