Bug 1502533 - Changing cert-find to go through the proxy instead of using the port 8080
Summary: Changing cert-find to go through the proxy instead of using the port 8080
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.4
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: ipa-qe
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-10-16 07:51 UTC by Thorsten Scherf
Modified: 2018-04-10 16:49 UTC (History)
7 users (show)

Fixed In Version: ipa-4.5.4-1.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-04-10 16:48:21 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:0918 None None None 2018-04-10 16:49:12 UTC

Description Thorsten Scherf 2017-10-16 07:51:08 UTC
This bug is created as a clone of upstream ticket:
https://pagure.io/freeipa/issue/6966

The cert-find backend is hardcoded to use port 8080 in dogtag.py. If the CA is on another master then port 8080 needs to be open in order to make a connection. This needs to be documented, perhaps on the ipa-server-install output.

This seems to also affect displaying a user (timing out) but I didn't investigate that part.

Comment 7 Nikhil Dehadrai 2018-01-17 08:00:20 UTC
ipa-server version: ipa-server-4.5.4-8.el7.x86_64

VERIFIED the bug on the basis of following observations:

A) VERIFIED that, on RHEL 7.4.z IPA MASTER and CLIENT when the ports 8080 are blocked then 'ipa cert-find' command fails 

(ipa-server-4.5.0-22.el7_4.x86_64) (Reproducer)

IPA-Master:
-----------
# iptables -A OUTPUT -p tcp -o lo --dport 8080 -j DROP
# iptables -A OUTPUT -p tcp -i lo --dport 8080 -j DROP
# iptables -A OUTPUT -p tcp -o enp4s0 --dport 8080 -j DROP
# iptables -A INPUT -p tcp -i enp4s0 --dport 8080 -j DROP

[root@qe-blade-09 ~]# iptables -L --line-numbers
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    DROP       tcp  --  anywhere             anywhere             tcp dpt:webcache
2    DROP       tcp  --  anywhere             anywhere             tcp dpt:webcache

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    DROP       tcp  --  anywhere             anywhere             tcp dpt:webcache
2    DROP       tcp  --  anywhere             anywhere             tcp dpt:webcache


IPA-CLIENT:
--------------
[root@ipaqavmc ~]# kdestroy
[root@ipaqavmc ~]# kinit admin
Password for admin@TESTRELM.TEST: 
[root@ipaqavmc ~]# ipa cert-find
ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS ([Errno 110] Connection timed out)

B) VERIFIED that, on RHEL 7.5 IPA MASTER and CLIENT (ipa-server-4.5.4-8.el7.x86_64) (Fix) when the ports 8080 are blocked then 'ipa cert-find' command is successful. The 'ipa cert-find' command eventually fails when both '8080' and '80' ports are blocked.

Thus on the basis of above observations and comment#5 and comment#6, marking the status of bug to 'VERIFIED'.

Comment 10 errata-xmlrpc 2018-04-10 16:48:21 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0918


Note You need to log in before you can comment on or make changes to this bug.