September 2019 - FreeIPA-devel - Fedora Mailing-Lists

[freeipa PR#3483][opened] Support AES wrapping in LWCA key replication

by frasertweedale

URL: https://github.com/freeipa/freeipa/pull/3483 Author: frasertweedale Title: #3483: Support AES wrapping in LWCA key replication Action: opened PR body: """ The PR enhances the NSSWrappedCertDB custodia store to accept an optional symmetric encryption algorithm OID to use for encrypting the key. Also update the ipa-pki-retrieve-key program to request AES wrapping. For backwards compatibility when older servers request a key, default to 3DES (which is what the older server supports). For backwards compatibility when retrieving a key from an older server, try AES first, and on HTTP 404 retry without the algorithm OID. This change depends on Dogtag PR https://github.com/dogtagpki/pki/pull/232, and new Dogtag release containing the change (so that we can bump the dep min bound in FreeIPA). Changes: ``` 4afb3c3fa (Fraser Tweedale, 21 hours ago) ipa-pki-retrieve-key: request AES encryption (with fallback) Update the ipa-pki-retrieve-key client to issue a request that specifies that AES encryption should be used. Fall back to a simple request (which will use default export algorithm) if the server returns 404. The 404 indicates that either: - It is an old server that does not support extra key arguments - It is a new server but the key does not exist, in which case the fallback request will also fail with 404. Fixes: https://pagure.io/freeipa/issue/8020 c5d150a39 (Fraser Tweedale, 8 days ago) NSSWrappedCertDB: accept optional symmetric algorithm Add support for specifying the desired symmetric encryption algorithm for exporting wrapped key (for LWCA key replication). If not specified, defaults to DES-EDE3-CBC for backwards compatibility. Client-side changes will occur in a subsequent commit. Part of: https://pagure.io/freeipa/issue/8020 86ba401cc (Fraser Tweedale, 8 days ago) IPASecStore: support extra key arguments To support lightweight CA key replication using AES, while retaining backwards compatibility with old servers, it is necessary to signal support for AES. Whereas we currently request a key with the path: /keys/ca_wrapped/<nickname> and whereas paths with > 3 components are unsupported, add support for handlers to signal that they support extra arguments (defaulting to False), those arguments being conveyed as additional path components, e.g.: # 2.16.840.1.101.3.4.1.2 = aes128-cbc /keys/ca_wrapped/<nickname>/2.16.840.1.101.3.4.1.2 This commit only adds the Custodia support for extra handler arguments. Work to support LWCA key replication with AES wrapping will continue in subsequent commits. Part of: https://pagure.io/freeipa/issue/8020 ``` """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3483/head:pr3483 git checkout pr3483

4 years, 7 months

1
1
0 / 0

[freeipa PR#3694][opened] [testing_f29] Nightly PR

by freeipa-pr-ci

URL: https://github.com/freeipa/freeipa/pull/3694 Author: freeipa-pr-ci Title: #3694: [testing_f29] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3694/head:pr3694 git checkout pr3694

4 years, 7 months

1
1
0 / 0

[freeipa PR#3721][opened] Don't create log files from help scripts

by tiran

URL: https://github.com/freeipa/freeipa/pull/3721 Author: tiran Title: #3721: Don't create log files from help scripts Action: opened PR body: """ Helper scripts now use api.bootstrap(log=None) to avoid the creation of log files. Helper scripts are typically executed from daemons which perform their own logging. The helpers still log to stderr/stdout. This also gets rid of some SELinux AVCs when the script tries to write to /root/.ipa/. Fixes: https://pagure.io/freeipa/issue/8075 Signed-off-by: Christian Heimes <cheimes(a)redhat.com> """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3721/head:pr3721 git checkout pr3721

4 years, 7 months

1
1
0 / 0

[freeipa PR#3720][opened] [Backport][ipa-4-6] Fix two error paths around ipadb_get_global_config()

by flo-renaud

URL: https://github.com/freeipa/freeipa/pull/3720 Author: flo-renaud Title: #3720: [Backport][ipa-4-6] Fix two error paths around ipadb_get_global_config() Action: opened PR body: """ Manual backport of PR #3622 to ipa-4-6 branch. Cherry-pick without any conflict. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3720/head:pr3720 git checkout pr3720

4 years, 7 months

1
1
0 / 0

[freeipa PR#3704][opened] [testing_master] Nightly PR

by freeipa-pr-ci

URL: https://github.com/freeipa/freeipa/pull/3704 Author: freeipa-pr-ci Title: #3704: [testing_master] Nightly PR Action: opened PR body: """ None """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3704/head:pr3704 git checkout pr3704

4 years, 7 months

1
1
0 / 0

[freeipa PR#3719][opened] [Backport][ipa-4-6] replica install: enforce --server arg

by flo-renaud

URL: https://github.com/freeipa/freeipa/pull/3719 Author: flo-renaud Title: #3719: [Backport][ipa-4-6] replica install: enforce --server arg Action: opened PR body: """ This a manual backport of PR #3664 to ipa-4-6 branch. Cherry-pick without any conflict. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3719/head:pr3719 git checkout pr3719

4 years, 7 months

2
1
0 / 0

[freeipa PR#3715][opened] [Backport][ipa-4-7] replica install: enforce --server arg

by flo-renaud

URL: https://github.com/freeipa/freeipa/pull/3715 Author: flo-renaud Title: #3715: [Backport][ipa-4-7] replica install: enforce --server arg Action: opened PR body: """ This PR was opened automatically because PR #3664 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3715/head:pr3715 git checkout pr3715

4 years, 7 months

2
1
0 / 0

[freeipa PR#3714][opened] [Backport][ipa-4-8] replica install: enforce --server arg

by flo-renaud

URL: https://github.com/freeipa/freeipa/pull/3714 Author: flo-renaud Title: #3714: [Backport][ipa-4-8] replica install: enforce --server arg Action: opened PR body: """ This PR was opened automatically because PR #3664 was pushed to master and backport to ipa-4-8 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3714/head:pr3714 git checkout pr3714

4 years, 7 months

2
1
0 / 0

[freeipa PR#3718][opened] [Backport][ipa-4-6] ipa-restore: Restore ownership and perms on 389-ds log directory

by rcritten

URL: https://github.com/freeipa/freeipa/pull/3718 Author: rcritten Title: #3718: [Backport][ipa-4-6] ipa-restore: Restore ownership and perms on 389-ds log directory Action: opened PR body: """ Manual backport """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3718/head:pr3718 git checkout pr3718

4 years, 7 months

1
1
0 / 0

[freeipa PR#3716][opened] [Backport][ipa-4-7] ipa-restore: Restore ownership and perms on 389-ds log directory

by rcritten

URL: https://github.com/freeipa/freeipa/pull/3716 Author: rcritten Title: #3716: [Backport][ipa-4-7] ipa-restore: Restore ownership and perms on 389-ds log directory Action: opened PR body: """ This PR was opened automatically because PR #3703 was pushed to master and backport to ipa-4-7 is required. """ To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/3716/head:pr3716 git checkout pr3716

4 years, 7 months

1
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-devel September 2019