Bug 868290 - Thumbslug needs to verify more certificates.
Summary: Thumbslug needs to verify more certificates.
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Subscription Asset Manager
Classification: Retired
Component: thumbslug
Version: 1.2
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Bryan Kearney
QA Contact: Tazim Kolhar
URL:
Whiteboard:
Depends On:
Blocks: sam12-tracker
TreeView+ depends on / blocked
 
Reported: 2012-10-19 12:32 UTC by James Bowes
Modified: 2016-04-26 00:54 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2013-02-21 19:18:22 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:0544 0 normal SHIPPED_LIVE Important: Subscription Asset Manager 1.2 update 2013-02-26 04:08:04 UTC

Description James Bowes 2012-10-19 12:32:44 UTC
Thumbslug doesn't verify the cdn's ssl certificate. This is ok, because the RPMs are all signed and verified by the client, but it is not correct.

Comment 1 James Bowes 2012-10-19 12:55:21 UTC
Verifying the ssl certificate of candlepin isn't needed at all. since we use oauth communication, the shared secret provides us with that identity verification (in both directions).

Comment 2 James Bowes 2012-11-05 17:12:09 UTC
Fixed in thumbslug master, b2f0fc7dc. Will be in thumbslug-0.0.26

I've introduced two new config values:

ssl.ca.keystore: typically candlepin's public pem cert
cdn.ssl.ca.keystore: pem to verify the CDN's cert. this is installed by default to be the one to verify our hosted CDN.

Comment 4 James Bowes 2012-11-15 13:29:21 UTC
To test:
  Happy path:
    - set up a SAM. (make sure it can talk to the cdn; you'll also need
      the new config values)
    - register a client to the sam, and entitle it
    - yum install something. it should work
  Unverifiable client certificate:
    - register a second client against a different sam
    - change that second client's baseurl to point to the first sam
    - try and install something. it should fail.

  Unverifiable CDN certificate:
     - set the value of cdn.host in /etc/thumbslug/thumbslug.conf to some other
       ssl capable host
     - try to install something on the client. you should see an http 502 error.

Comment 9 errata-xmlrpc 2013-02-21 19:18:22 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-0544.html


Note You need to log in before you can comment on or make changes to this bug.