[freeipa PR#3943][opened] ipatests: generic uninstall should call ipa server-del
by flo-renaud
URL: https://github.com/freeipa/freeipa/pull/3943
Author: flo-renaud
Title: #3943: ipatests: generic uninstall should call ipa server-del
Action: opened
PR body:
"""
### ipatests: generic uninstall should call ipa server-del
At the end of any integration test, the method uninstall is called and
uninstalls master, replicas and clients.
Usually the master is the CA renewal master and DNSSec master, and
uninstallation may fail.
This commits modifies the uninstall method in order to:
- call 'ipa server-del replica' before running uninstall on a replica
- uninstall the replicas before uninstalling the master
Fixes: https://pagure.io/freeipa/issue/7985
### ipatests: fix teardown
The uninstall method of some tests can be skipped as the cleanup is
already done before.
### ipatests: fix test_crlgen_manage
The goal of the last test in test_crlgen_manage is to ensure that
ipa-server-install --uninstall can proceed if the server is the last one
in the topology, even if it is the CRL generation master.
The current code is wrong because it tries to uninstall the master
(which has already been uninstalled in the prev test), It should rather
uninstall replicas[0].
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/3943/head:pr3943
git checkout pr3943
4 years, 5 months
PR-CI Dashboard deployed at ci.freeipa.org
by Petr Vobornik
Hello,
following a migration of freeipa.org wiki and planet, PR-CI dashboard
was migrated to a new OpenShift instance.
It is now available at https://ci.freeipa.org
Together with the migration, I took the opportunity to do a few minor
enhancements:
* stock "example" PatternFly branding was removed and replaced by
PR-CI specific branding
* Login page now contains information why a token is needed, an
explanation of how it is used and has a link to GitHub page where a
token can be generated - to make it more friendly to start with
* a default page was changed to "Nightly runs" as I believe the
dashboard is mainly used for that purpose.
* it is now possible to use direct links to various views (not just the default)
* build process now uses source-to-image (s2i) approach [1] which
makes deployment of master branch almost 1 click event (webhook not
yet used to be 0 clicks)
Upstream project: https://github.com/pvoborni/pr-ci-dashboard
[1] https://docs.okd.io/latest/architecture/core_concepts/builds_and_image_st...
May it serve you well
--
Petr Vobornik
4 years, 5 months
[Announce] Security releases: FreeIPA 4.8.3, 4.7.4, and 4.6.7 released
by Alexander Bokovoy
Hello!
The FreeIPA team would like to announce FreeIPA security releases for
three release series: 4.8.3, 4.7.4, and 4.6.7 release!
Each series includes a security update release that contains fixes for two issues:
* CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
A flaw was found in the way that FreeIPA's batch processing API logged
operations. This included passing user passwords in clear text on FreeIPA
masters. Batch processing of commands with passwords as arguments or options is
not performed by default in FreeIPA but is possible by third-party components.
An attacker having access to system logs on FreeIPA masters could use this flaw
to produce log file content with passwords exposed.
The issue was reported by Jamison Bennett from Cloudera
* CVE-2019-14867: Make sure to have storage space for tag
A flaw was found in the way the internal function ber_scanf() was used in some
components of the IPA server, which parsed kerberos key data. An
unauthenticated attacker who could trigger parsing of the krb principal key
could cause the IPA server to crash or in some conditions, cause arbitrary code
to be executed on the server hosting the IPA server.
The issue was reported by Todd Lipcon from Cloudera
== Upgrading ==
Upgrade instructions are available on [[Upgrade]] page.
== Feedback ==
Please provide comments, bugs and other feedback via the freeipa-users mailing
list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorah...)
or #freeipa channel on Freenode.
== Detailed changelog since 4.6.6 ==
=== Alexander Bokovoy (1) ===
* Become FreeIPA 4.6.7
=== Rob Crittenden (1) ===
* CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
=== Simo Sorce (1) ===
* CVE-2019-14867: Make sure to have storage space for tag
== Detailed changelog since 4.7.3 ==
=== Alexander Bokovoy (1) ===
* Become FreeIPA 4.7.4
=== Rob Crittenden (1) ===
* CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
=== Simo Sorce (1) ===
* CVE-2019-14867: Make sure to have storage space for tag
== Detailed changelog since 4.8.2 ==
=== Alexander Bokovoy (1) ===
* Become FreeIPA 4.8.3
=== Rob Crittenden (1) ===
* CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
=== Simo Sorce (1) ===
* CVE-2019-14867: Make sure to have storage space for tag
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
4 years, 5 months