Red Hat Bugzilla – Bug 1376630
IDM admin password gets written to /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
Last modified: 2017-08-01 05:39:54 EDT
Description of problem: IDM admin password gets written to /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf during installation. This file contains the passphrase for a backup of the Dogtag CA Agent certificate and key in /root/ca-agent.p12. The file is well protected by file system permissions but if it is compromised we do not want the actor to get full control over IDM. Version-Release number of selected component (if applicable): How reproducible: always Steps to Reproduce: 1. install IPA Actual results: The admin user's password appears in file /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf Expected results: The admin user's password should not appear in the file. If an actor gets access to the file, we do not want that actor to pivot to having full control over IDM. Additional info: Proposed fix: randomly generate the password for this backup file.
Fixed upstream master: https://fedorahosted.org/freeipa/changeset/728a6bd4229ba170b2e94f216127b19d5d94e2ba https://fedorahosted.org/freeipa/changeset/a39effed7603d66acd238e3142f4df8081ff7bc8
Verified using IPA server version:: ipa-server-4.5.0-13.el7.x86_64 After successful installation no pkcs12_password.conf file found on system. [root@ipaserver01 ~]# locate pkcs12_password.conf [root@ipaserver01 ~]# ls /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf ls: cannot access /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf: No such file or directory Marking BZ as verified.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2304