Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
Bug 973766 - The --ssh-trust-dns prevents GlobalKnownHostsFile and ProxyCommand from being configured
The --ssh-trust-dns prevents GlobalKnownHostsFile and ProxyCommand from being...
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa (Show other bugs)
Unspecified Unspecified
medium Severity unspecified
: rc
: ---
Assigned To: Martin Kosek
Namita Soman
Depends On:
  Show dependency treegraph
Reported: 2013-06-12 12:21 EDT by Martin Kosek
Modified: 2014-06-17 20:09 EDT (History)
2 users (show)

See Also:
Fixed In Version: ipa-3.2.2-1.el7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2014-06-13 06:56:43 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Martin Kosek 2013-06-12 12:21:26 EDT
This bug is created as a clone of upstream ticket:

When running

ipa-client-install --ssh-trust-dns

it effectively prevents the

GlobalKnownHostsFile /var/lib/sss/pubconf/known_hosts
ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h

from being configured in {{{/etc/ssh/ssh_config}}}. The ipa-client-install man page could be amended to be clear about it, or the behaviour could be changed to always configure both (unless {{{--no-ssh}}} is used).
Comment 1 Namita Soman 2013-06-17 12:55:26 EDT
Will this be a man page change or a configuration update in /etc/ssh/ssh_config ? Please provide steps to verify
Comment 2 Martin Kosek 2013-06-18 04:59:01 EDT
There will be a configuration change in /etc/ssh/ssh_config. When ipa-client-install is run with --ssh-trust-dns, then /etc/ssh/ssh_config will contain both standard

GlobalKnownHostsFile /var/lib/sss/pubconf/known_hosts
ProxyCommand /usr/bin/sss_ssh_knownhostsproxy -p %p %h

but also

VerifyHostKeyDNS yes
Comment 5 Scott Poore 2013-12-18 15:57:21 EST

Version ::


Test Results ::

[root@ipaqa64vmc install-client-cli]#         rlRun "ipa-client-install --domain=$DOMAIN --principal=$ADMINID --server=$MASTER --password=$ADMINPW --unattended --realm=$RELM --force-ntpd --ssh-trust-dns"
Hostname: ipaqa64vmc.testrelm.com
DNS Domain: testrelm.com
IPA Server: cloud-qe-19.testrelm.com
BaseDN: dc=testrelm,dc=com

Synchronizing time with KDC...
Successfully retrieved CA cert
    Subject:     CN=Certificate Authority,O=TESTRELM.COM
    Issuer:      CN=Certificate Authority,O=TESTRELM.COM
    Valid From:  Tue Dec 17 23:42:14 2013 UTC
    Valid Until: Sat Dec 17 23:42:14 2033 UTC

Enrolled in IPA realm TESTRELM.COM
Created /etc/ipa/default.conf
New SSSD config will be created
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm TESTRELM.COM
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
SSSD enabled
Configured /etc/openldap/ldap.conf
NTP enabled
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Client configuration complete.
:: [   PASS   ] :: Running 'ipa-client-install --domain=testrelm.com --principal=admin --server=cloud-qe-19.testrelm.com --password=Secret123 --unattended --realm=TESTRELM.COM --force-ntpd --ssh-trust-dns' (Expected 0, got 0)
[root@ipaqa64vmc install-client-cli]# ipa_bugcheck_bz973766

:: [   LOG    ] :: ipa_bugcheck_bz973766:  The --ssh-trust-dns prevents GlobalKnownHostsFile and ProxyCommand from being configured

2013-12-18T20:46:58Z DEBUG /usr/sbin/ipa-client-install was invoked with options: {'domain': 'testrelm.com', 'force': False, 'krb5_offline_passwords': True, 'primary': False, 'realm_name': 'TESTRELM.COM', 'force_ntpd': True, 'create_sshfp': True, 'conf_sshd': True, 'conf_ntp': True, 'on_master': False, 'ntp_server': None, 'ca_cert_file': None, 'principal': 'admin', 'keytab': None, 'hostname': None, 'no_ac': False, 'unattended': True, 'sssd': True, 'trust_sshfp': True, 'dns_updates': False, 'mkhomedir': False, 'conf_ssh': True, 'force_join': False, 'server': ['cloud-qe-19.testrelm.com'], 'prompt_password': False, 'permit': False, 'debug': False, 'preserve_sssd': False, 'uninstall': False}
:: [   PASS   ] :: File '/etc/ssh/ssh_config' should contain 'GlobalKnownHostsFile.*sss/pubconf/known_hosts' 
:: [   PASS   ] :: File '/etc/ssh/ssh_config' should contain 'ProxyCommand.*knownhostsproxy' 
:: [   PASS   ] :: BZ 973766 not found
Comment 6 Ludek Smid 2014-06-13 06:56:43 EDT
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.

Note You need to log in before you can comment on or make changes to this bug.