FreeIPA-devel November 2019

freeipa-devel@lists.fedorahosted.org

8 participants
169 discussions

[freeipa PR#3958][opened] [Backport][ipa-4-8] Covscan fixes
by tiran 29 Nov '19

29 Nov '19

URL: https://github.com/freeipa/freeipa/pull/3958 Author: tiran Title: #3958: [Backport][ipa-4-8] Covscan fixes Action: opened PR body: """ This PR was opened automatically because PR #3956 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3958/head:pr3958 git checkout pr3958

1 1

[freeipa PR#3954][opened] [Backport][ipa-4-8] Integration tests for OTP token
by tiran 29 Nov '19

29 Nov '19

URL: https://github.com/freeipa/freeipa/pull/3954 Author: tiran Title: #3954: [Backport][ipa-4-8] Integration tests for OTP token Action: opened PR body: """ Manual backport of PR #3951 Add integration tests to verify HOTP, TOTP, service with OTP auth indicator, and OTP token sync. Fix otptoken_sync plugin The plugin had two bugs: For one it did not work under Python 3 because urlencode() returns a string but HTTPSHandler expects bytes as data argument. The primary key field name is not available in client plugins. Just pass the token name and let server code convert the name to DN. Fixes: https://pagure.io/freeipa/issue/7804 """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3954/head:pr3954 git checkout pr3954

1 1

[freeipa PR#3943][opened] ipatests: generic uninstall should call ipa server-del
by flo-renaud 29 Nov '19

29 Nov '19

URL: https://github.com/freeipa/freeipa/pull/3943 Author: flo-renaud Title: #3943: ipatests: generic uninstall should call ipa server-del Action: opened PR body: """ ### ipatests: generic uninstall should call ipa server-del At the end of any integration test, the method uninstall is called and uninstalls master, replicas and clients. Usually the master is the CA renewal master and DNSSec master, and uninstallation may fail. This commits modifies the uninstall method in order to: - call 'ipa server-del replica' before running uninstall on a replica - uninstall the replicas before uninstalling the master Fixes: https://pagure.io/freeipa/issue/7985 ### ipatests: fix teardown The uninstall method of some tests can be skipped as the cleanup is already done before. ### ipatests: fix test_crlgen_manage The goal of the last test in test_crlgen_manage is to ensure that ipa-server-install --uninstall can proceed if the server is the last one in the topology, even if it is the CRL generation master. The current code is wrong because it tries to uninstall the master (which has already been uninstalled in the prev test), It should rather uninstall replicas[0]. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3943/head:pr3943 git checkout pr3943

2 1

[freeipa PR#3956][opened] Covscan fixes
by abbra 29 Nov '19

29 Nov '19

URL: https://github.com/freeipa/freeipa/pull/3956 Author: abbra Title: #3956: Covscan fixes Action: opened PR body: """ Memory leaks found by latest covscan runs. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3956/head:pr3956 git checkout pr3956

2 1

[freeipa PR#3951][opened] Integration tests for OTP token
by tiran 28 Nov '19

28 Nov '19

URL: https://github.com/freeipa/freeipa/pull/3951 Author: tiran Title: #3951: Integration tests for OTP token Action: opened PR body: """ """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3951/head:pr3951 git checkout pr3951

1 1

[freeipa PR#3942][opened] [testing_master_latest] Nightly PR
by freeipa-pr-ci 27 Nov '19

27 Nov '19

URL: https://github.com/freeipa/freeipa/pull/3942 Author: freeipa-pr-ci Title: #3942: [testing_master_latest] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3942/head:pr3942 git checkout pr3942

1 1

[freeipa PR#3950][opened] [testing_master_previous] Nightly PR
by freeipa-pr-ci 26 Nov '19

26 Nov '19

URL: https://github.com/freeipa/freeipa/pull/3950 Author: freeipa-pr-ci Title: #3950: [testing_master_previous] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3950/head:pr3950 git checkout pr3950

1 0

[freeipa PR#3928][opened] [testing_master_previous] Nightly PR
by freeipa-pr-ci 26 Nov '19

26 Nov '19

URL: https://github.com/freeipa/freeipa/pull/3928 Author: freeipa-pr-ci Title: #3928: [testing_master_previous] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3928/head:pr3928 git checkout pr3928

1 1

PR-CI Dashboard deployed at ci.freeipa.org
by Petr Vobornik 26 Nov '19

26 Nov '19

Hello, following a migration of freeipa.org wiki and planet, PR-CI dashboard was migrated to a new OpenShift instance. It is now available at https://ci.freeipa.org Together with the migration, I took the opportunity to do a few minor enhancements: * stock "example" PatternFly branding was removed and replaced by PR-CI specific branding * Login page now contains information why a token is needed, an explanation of how it is used and has a link to GitHub page where a token can be generated - to make it more friendly to start with * a default page was changed to "Nightly runs" as I believe the dashboard is mainly used for that purpose. * it is now possible to use direct links to various views (not just the default) * build process now uses source-to-image (s2i) approach [1] which makes deployment of master branch almost 1 click event (webhook not yet used to be 0 clicks) Upstream project: https://github.com/pvoborni/pr-ci-dashboard [1] https://docs.okd.io/latest/architecture/core_concepts/builds_and_image_stre… May it serve you well -- Petr Vobornik

1 0

[Announce] Security releases: FreeIPA 4.8.3, 4.7.4, and 4.6.7 released
by Alexander Bokovoy 26 Nov '19

26 Nov '19

Hello! The FreeIPA team would like to announce FreeIPA security releases for three release series: 4.8.3, 4.7.4, and 4.6.7 release! Each series includes a security update release that contains fixes for two issues: * CVE-2019-10195: Don't log passwords embedded in commands in calls using batch A flaw was found in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party components. An attacker having access to system logs on FreeIPA masters could use this flaw to produce log file content with passwords exposed. The issue was reported by Jamison Bennett from Cloudera * CVE-2019-14867: Make sure to have storage space for tag A flaw was found in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb principal key could cause the IPA server to crash or in some conditions, cause arbitrary code to be executed on the server hosting the IPA server. The issue was reported by Todd Lipcon from Cloudera == Upgrading == Upgrade instructions are available on [[Upgrade]] page. == Feedback == Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahos…) or #freeipa channel on Freenode. == Detailed changelog since 4.6.6 == === Alexander Bokovoy (1) === * Become FreeIPA 4.6.7 === Rob Crittenden (1) === * CVE-2019-10195: Don't log passwords embedded in commands in calls using batch === Simo Sorce (1) === * CVE-2019-14867: Make sure to have storage space for tag == Detailed changelog since 4.7.3 == === Alexander Bokovoy (1) === * Become FreeIPA 4.7.4 === Rob Crittenden (1) === * CVE-2019-10195: Don't log passwords embedded in commands in calls using batch === Simo Sorce (1) === * CVE-2019-14867: Make sure to have storage space for tag == Detailed changelog since 4.8.2 == === Alexander Bokovoy (1) === * Become FreeIPA 4.8.3 === Rob Crittenden (1) === * CVE-2019-10195: Don't log passwords embedded in commands in calls using batch === Simo Sorce (1) === * CVE-2019-14867: Make sure to have storage space for tag -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 1

← Newer
1
2
3
4
5
6
7
8
...
17
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel November 2019