Bug 852229 - anaconda needs to work with signed and unsigned SSL Certs
Summary: anaconda needs to work with signed and unsigned SSL Certs
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: anaconda
Version: 18
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Brian Lane
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-08-27 23:20 UTC by joshua
Modified: 2012-11-23 01:10 UTC (History)
7 users (show)

Fixed In Version: anaconda-18.15-1
Clone Of:
Environment:
Last Closed: 2012-11-23 01:10:11 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
dracut patch (914 bytes, patch)
2012-10-08 22:02 UTC, Brian Lane
no flags Details | Diff
anaconda patch (1020 bytes, patch)
2012-10-08 22:03 UTC, Brian Lane
no flags Details | Diff

Description joshua 2012-08-27 23:20:48 UTC
Description of problem:

kernel command-line args that anaconda parses don't seem to be happy with
https from a server with a self-signed cert

specifically, these kernel command-line directives:

repo=
url=
ks=

Version-Release number of selected component (if applicable):

F17

Comment 1 joshua 2012-08-27 23:25:58 UTC
From inside the ks.cfg file, "--noverifyssl" no longer works in F17 either for these directives:

url
repo


According to http://fedoraproject.org/wiki/Anaconda/Kickstart it should, but F17 doesn't.


Can we get this fixed in F18?

Comment 2 Chris Lumens 2012-08-28 22:36:09 UTC
Please attach the log files from /tmp to this bug report as individual, uncompressed attachments.

Comment 3 joshua 2012-09-12 22:58:31 UTC
Let me retract comment #1... when the kernel command line has no https in it, the url and repo kickstart directives in ks.cfg *do* work just fine with an self-signed SSL cert, so long as --noverifyssl is provided as an option.


That said, when ks= and repo= on the kernel command line use https, with the same self-signed SSL cert on the webserver side, dracut dies with the following message:

curl:  (77) Problem with the SSL CA cert (path? access rights?)
[dracut Warning: failed to fetch <file>]


This is repeated for <file> of ks.cfg file, .treeinfo, and squashfs.img.  As such, anaconda never really gets started... and I'm left at a dracut:/# prompt.

Seems like dracut's use of curl is too strict when fetching from https locations?

Comment 4 joshua 2012-09-12 23:22:51 UTC
Another note:  the same issue exists for ks= and repo= on the kernel command line when the SSL cert *is* signed by a CA that most all browsers accept.

So this really does seem to be a CA issue, where curl literally doesn't know who or what to trust... which completely breaks dracut/anaconda.

Should curl be made to use its --insecure option by default?

Comment 5 Jesse Keating 2012-09-13 17:16:03 UTC
Putting this back on anaconda for now, it could be the way we're calling curl to get the kickstart file, that could be anaconda code.

Comment 6 Brian Lane 2012-09-14 00:26:08 UTC
noverifyssl should work for this, but currently we aren't handling that in any of the anaconda-dracut code (kickstart or not).

Comment 7 joshua 2012-09-14 14:21:25 UTC
How does one specify noverifyssl for the kernel command line bits?  Is "noverifyssl" itself legal on the kernel command line?

Comment 8 Brian Lane 2012-09-14 16:15:02 UTC
yes.

Comment 9 joshua 2012-09-17 20:33:59 UTC
I can verify that with a properly signed cert, and ks=http and repo=https and noverifyssl on the kernel command line... we still get the following error:

curl:  (77) Problem with the SSL CA cert (path? access rights?)


So can we get this fixed in Fedora 18?   Perhaps use the same list of acceptible CAs that Firefox uses?  Or at least make noverifyssl work so as to be able to disregard CAs altogether?  Both would be great, but the later really is just plain broken and needs to be addressed.

Comment 10 Brian Lane 2012-10-08 22:02:51 UTC
Created attachment 623762 [details]
dracut patch

Comment 11 Brian Lane 2012-10-08 22:03:41 UTC
Created attachment 623763 [details]
anaconda patch

Comment 12 joshua 2012-10-11 00:55:03 UTC
How does it fix things?  Does anaconda now trust select CAs, or disregard CAs from an identity perspective altogether?

Comment 13 Fedora Update System 2012-10-11 01:04:45 UTC
anaconda-18.15-1.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/anaconda-18.15-1.fc18

Comment 14 Brian Lane 2012-10-11 01:11:58 UTC
https://fedoraproject.org/wiki/Anaconda_Boot_Options?rd=Anaconda/Options#noverifyssl

Note that this depends on a new dracut being built with an associated change.

Comment 15 Fedora Update System 2012-10-11 02:58:17 UTC
Package anaconda-18.15-1.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing anaconda-18.15-1.fc18'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-15903/anaconda-18.15-1.fc18
then log in and leave karma (feedback).

Comment 16 Fedora Update System 2012-10-12 01:06:33 UTC
anaconda-18.16-1.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/anaconda-18.16-1.fc18

Comment 17 Fedora Update System 2012-10-17 03:09:36 UTC
anaconda-18.17-1.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/anaconda-18.17-1.fc18

Comment 18 joshua 2012-10-17 03:27:51 UTC
Are the requisite changes in dracut happening too?

Comment 20 Fedora Update System 2012-10-18 02:38:26 UTC
anaconda-18.18-1.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/anaconda-18.18-1.fc18

Comment 21 Fedora Update System 2012-10-20 01:34:13 UTC
anaconda-18.19-1.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/anaconda-18.19-1.fc18

Comment 22 Adam Williamson 2012-11-23 01:10:11 UTC
This bug looks to have been fixed for many anaconda builds now but missed being closed. If you find you are still experiencing it with Fedora 18 Beta (RC1) or later, please re-open the bug.


Note You need to log in before you can comment on or make changes to this bug.