Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
ipa-client-install adds following lines in the sshd_config file, before the last "Match user" line:
KerberosAuthentication no
PubkeyAuthentication yes
UsePAM yes
AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
GSSAPIAuthentication yes
ChallengeResponseAuthentication yes
AuthorizedKeysCommandUser nobody
https://github.com/freeipa/freeipa/blob/master/ipaclient/install/client.py#L978
But... when configuring this file with ansible using blockinfile tasks, it adds some blocks like:
# BEGIN ANSIBLE MANAGED BLOCK
Match User backup
PasswordAuthentication yes
# END ANSIBLE MANAGED BLOCK
And here is the problem, ipa-client-install is adding the parameters before the Match line, but after the ansible comment:
# BEGIN ANSIBLE MANAGED BLOCK
KerberosAuthentication no
PubkeyAuthentication yes
UsePAM yes
AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys
GSSAPIAuthentication yes
ChallengeResponseAuthentication yes
AuthorizedKeysCommandUser nobody
Match User backup
PasswordAuthentication yes
# END ANSIBLE MANAGED BLOCK
Next ansible iteration will remove the lines configured by ipa-client-install, because they have been added inside the ansible managed block, and it will left only the ansible related lines:
# BEGIN ANSIBLE MANAGED BLOCK
Match User backup
PasswordAuthentication yes
# END ANSIBLE MANAGED BLOCK
Version-Release number of selected component (if applicable): RHEL 7.3
How reproducible:
Steps to Reproduce:
1. Modify sshd_config file with a blockinfile ansible task
2. Register server on IdM using ipa-client-install
3. Run ansible again
Actual results:
ipa-client-install modifications are removed from the sshd_file because they are added inside the ANSIBLE MANAGED BLOCK
Expected results:
Modification should be done searching for the parameters inside the file, and modifying the default value or adding a block checking if it is being added inside a block managed by a different automation system (ansible, or any other)
Additional info:
Comment 6Florence Blanc-Renaud
2018-10-17 16:26:36 UTC
We have a concern regarding this issue. It would not be reliable to adapt our code to detect the # BEGIN ANSIBLE MANAGED BLOCK and # END ANSIBLE MANAGED BLOCK markers because this type of marker is configurable (see https://docs.ansible.com/ansible/latest/modules/blockinfile_module.html#parameters) and could be completely different if added with a random playbook or a different automation system.
Comment 7Florence Blanc-Renaud
2019-06-19 07:41:10 UTC
RHEL-7.7 is already near the end of a Development Phase and development is being wrapped up. I am bulk-moving to RHEL 8 the Bugs which were already triaged, but to which we did not commit (without devel_ack) and we cannot keep them even as a stretch goal for RHEL-7.7.
If you believe this particular bug should be reconsidered for 7.7, please let us know.
Comment 18Alexander Bokovoy
2021-02-12 09:39:59 UTC
For the reference:
$ git log --oneline --grep={issue/8304,issue/8400,issue/8535}
fbd7d7718 rpmspec: ensure ipa snippet for sshd is always included
797a64b37 sshd template must be part of client package
511f5194d client install: fix broken sshd config
3cf9979ae ipa-client-install: use sshd drop-in configuration
These all ended up in the FreeIPA 4.9.0 and thus are part of RHEL 8.4.
However, RHEL 8.4 will not have OpenSSH that supports sshd_config includes.
Once future RHEL 8 version includes this feature, RHEL IdM will start automatically using it.