Bug 707001 - Illegal CL input results in NULL csr when requesting external ca.
Summary: Illegal CL input results in NULL csr when requesting external ca.
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: ipa
Version: 6.1
Hardware: x86_64
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Rob Crittenden
QA Contact: Chandrasekar Kannan
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-05-23 17:38 UTC by Erinn Looney-Triggs
Modified: 2015-01-04 23:48 UTC (History)
4 users (show)

Fixed In Version: ipa-2.1.0-1.el6
Doc Type: Bug Fix
Doc Text:
Cause: When installing IPA to be signed by an external CA the command-line options were not validated properly. Consequence: The resulting CSR would contain only the string "null". Fix: Add better detection of whether the CA 389-ds instance has been installed to identify which stage of the installation we are in. Result: Passing incorrect installation options will not result in an invalid CSR.
Clone Of:
Environment:
Last Closed: 2011-12-06 18:22:31 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:1533 normal SHIPPED_LIVE Moderate: ipa security and bug fix update 2011-12-06 01:23:31 UTC

Description Erinn Looney-Triggs 2011-05-23 17:38:12 UTC
Description of problem:
Illegal CL input results in NULL csr when requesting external ca.

[root@ipa ~]# ipa-server-install --external-ca --external_cert_file=/root/ipa.crt --external_ca_file=/etc/pki/tls/certs/Foo-CA.crt 

The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will set up the FreeIPA Server.

This includes:
  * Configure the Network Time Daemon (ntpd)
  * Create and configure an instance of Directory Server
  * Create and configure a Kerberos Key Distribution Center (KDC)
  * Configure Apache (httpd)

To accept the default shown in brackets, press the Enter key.

Enter the fully qualified domain name of the computer
on which you're setting up server software. Using the form
<hostname>.<domainname>
Example: master.example.com.


Server host name [ipa.foo.com]: 

The domain name has been calculated based on the host name.

Please confirm the domain name [foo.com]: 

The IPA Master Server will be configured with
Hostname:    ipa.foo.com
IP address:  192.168.0.1
Domain name: foo.com

The kerberos protocol requires a Realm name to be defined.
This is typically the domain name converted to uppercase.

Please provide a realm name [FOO.COM]: 
Certain directory server operations require an administrative user.
This user is referred to as the Directory Manager and has full access
to the Directory for system management tasks and will be added to the
instance of directory server created for IPA.
The password must be at least 8 characters long.

Directory Manager password: 
Password (confirm): 

The IPA server requires an administrative user, named 'admin'.
This user is a regular system account used for IPA server administration.

IPA admin password: 
Password (confirm): 
Password mismatch!

IPA admin password: 
Password (confirm): 


The following operations may take some minutes to complete.
Please wait until the prompt is returned.

Configuring certificate server: Estimated time 6 minutes
  [1/4]: creating certificate server user
  [2/4]: creating pki-ca instance
  [3/4]: restarting certificate server
  [4/4]: configuring certificate server instance
The next step is to get /root/ipa.csr signed by your CA and re-run ipa-server-install as:
ipa-server-install --external_cert_file=/path/to/signed_certificate --external_ca_file=/path/to/external_ca_certificate
[root@ipa ~]# cat ipa.csr
null


Version-Release number of selected component (if applicable):
ipa-server-2.0.0-23.el6.x86_64



Additional info:
I know it is an illegal construction using the command line, but it either ought ot be prevented or well it probably ought to be prevented.

Comment 2 Dmitri Pal 2011-05-24 00:23:36 UTC
https://fedorahosted.org/freeipa/ticket/1244

Comment 4 Rob Crittenden 2011-06-13 19:17:05 UTC
master: 9f72637b13c2001d1c7e8842f75347f9af74190e

ipa-2-0: e66aa074de3209f3c5dd4fdf2738bab893012dd5

Comment 8 Rob Crittenden 2011-10-31 18:45:38 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Cause: When installing IPA to be signed by an external CA the command-line options were not validated properly.
Consequence: The resulting CSR would contain only the string "null".
Fix: Add better detection of whether the CA 389-ds instance has been installed to identify which stage of the installation we are in.
Result: Passing incorrect installation options will not result in an invalid CSR.

Comment 9 Gowrishankar Rajaiyan 2011-11-05 08:18:25 UTC
[root@sideswipe ~]# ipa-server-install --external-ca --external_cert_file=/root/ipa.crt --external_ca_file=/etc/pki/tls/certs/Foo-CA.crt 
Usage: ipa-server-install [options]

ipa-server-install: error: You cannot specify --external_cert_file together with --external-ca
[root@sideswipe ~]# 


[root@sideswipe ~]# ipa-server-install --external-ca  --external_ca_file=/etc/pki/tls/certs/Foo-CA.crt 
Usage: ipa-server-install [options]

ipa-server-install: error: You cannot specify --external_ca_file together with --external-ca
[root@sideswipe ~]# 



[root@sideswipe ~]# rpm -qi ipa-server | head
Name        : ipa-server                   Relocations: (not relocatable)
Version     : 2.1.3                             Vendor: Red Hat, Inc.
Release     : 8.el6                         Build Date: Wed 02 Nov 2011 03:21:27 AM IST
Install Date: Thu 03 Nov 2011 04:36:14 PM IST      Build Host: x86-012.build.bos.redhat.com
Group       : System Environment/Base       Source RPM: ipa-2.1.3-8.el6.src.rpm
Size        : 3381421                          License: GPLv3+
Signature   : (none)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL         : http://www.freeipa.org/
Summary     : The IPA authentication server
[root@sideswipe ~]#

Comment 10 errata-xmlrpc 2011-12-06 18:22:31 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2011-1533.html


Note You need to log in before you can comment on or make changes to this bug.