Bug 2209445
| Summary: | /etc/krb5.conf.d/kcm_default_ccache is included in the install image when the KCM is not. | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Chance Callahan <ccallaha> |
| Component: | lorax | Assignee: | Brian Lane <bcl> |
| Status: | CLOSED MIGRATED | QA Contact: | Release Test Team <release-test-team-automation> |
| Severity: | low | Docs Contact: | |
| Priority: | medium | ||
| Version: | 8.7 | CC: | dchen, jkonecny, sbarcomb |
| Target Milestone: | rc | Keywords: | MigratedToJIRA |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-09-18 13:50:47 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Chance Callahan
2023-05-23 22:55:22 UTC
A thumb of gold is always: do not install the function you don't need. Thus remove sssd-kcm or don't install it at all will be better. The consequence of removing the includedir /etc/krb5.conf.d is: 1. Some customers explicit use /etc/krb5.conf.d to organize their realm setting. They will complain about why those settings do not work 2. Kerberos crypto-policies won't apply, thus potential security risk. Yeah, that's a better idea now that you mention it. This needs to be done during the ISO build. Switching to Lorax component which is responsible for this. It's not clear to me what the problem is. On the boot.iso created by lorax /etc/krb5.conf file and the contents of /etc/krb5.conf.d/ are the defaults. Looking at a RHEL 8.8 iso the crypto-policies file has: [libdefaults] permitted_enctypes = aes256-cts-hmac-sha1-96 aes256-cts-hmac-sha384-192 camellia256-cts-cmac aes128-cts-hmac-sha256-128 aes128-cts-hmac-sha1-96 camellia128-cts-cmac in it. That doesn't look to me like it is enabling 'Kerberos Credential Manager' and I do not see `/etc/krb5.conf.d/kcm_default_ccache` on the iso. I'm actually not sure how someone would even use kerberos during installation, kickstart doesn't have any commands to set it up, nor does dracut as far as I can tell. So I have to ask some questions: What install image are you talking about? Where did you get it from? Can you point me to it so I can examine it? Are you sure it is a boot.iso created by Lorax? Thanks, Brian Issue migration from Bugzilla to Jira is in process at this time. This will be the last message in Jira copied from the Bugzilla bug. This BZ has been automatically migrated to the issues.redhat.com Red Hat Issue Tracker. All future work related to this report will be managed there. Due to differences in account names between systems, some fields were not replicated. Be sure to add yourself to Jira issue's "Watchers" field to continue receiving updates and add others to the "Need Info From" field to continue requesting information. To find the migrated issue, look in the "Links" section for a direct link to the new issue location. The issue key will have an icon of 2 footprints next to it, and begin with "RHEL-" followed by an integer. You can also find this issue by visiting https://issues.redhat.com/issues/?jql= and searching the "Bugzilla Bug" field for this BZ's number, e.g. a search like: "Bugzilla Bug" = 1234567 In the event you have trouble locating or viewing this issue, you can file an issue by sending mail to rh-issues. You can also visit https://access.redhat.com/articles/7032570 for general account information. The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days |