[freeipa PR#5107][opened] [Container] Unify access to FQDN
by tiran
URL: https://github.com/freeipa/freeipa/pull/5107
Author: tiran
Title: #5107: [Container] Unify access to FQDN
Action: opened
PR body:
"""
FreeIPA's Python and C code used different approaches to get the FQDN of
the host. Some places assumed that gethostname() returns a FQDN. Other
code paths used glibc's resolver to resolve the current node name to a
FQDN.
Python code now uses the ipalib.constants.FQDN where a fully qualified
domain name is expected. The variable is initialized only once and avoids
potential DNS lookups.
C code uses a new helper function ipa_gethostfqdn() in util package. The
function implements similar logic as gethostfqdn() except it uses more
modern getaddrinfo(). The result is cached as well.
Signed-off-by: Christian Heimes <cheimes(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5107/head:pr5107
git checkout pr5107
2 months, 3 weeks
[freeipa PR#5160][opened] Add libpwquality checking to IPA password policy
by rcritten
URL: https://github.com/freeipa/freeipa/pull/5160
Author: rcritten
Title: #5160: Add libpwquality checking to IPA password policy
Action: opened
PR body:
"""
This adds support for some of the libpwquality password checking features:
* palindromes (automatic)
* maximum number of repeats in a row
* maximum number of monotonic sequences (abcde, 1234, etc)
* check for username in the password
* dict check via cracklib
I attempted to retain backwards compatibility so didn't enable the character class evaluations. We could totally do this but it add six more knobs.
I didn't enable the gecos check to avoid an nss lookup which would pass through a lot of libraries only to end up back at IPA :-)
Note that pwquality has a minimum character limit of six which is different than IPA so a limit of six is enforced if any of the pwqualtiy values are set.
I suspect the SELinux policy I wrote isn't awesome.
TODO: finalize the IANA attributes and objectclasses values
TODO: merge the test into another class or determine frequency to execute
TODO: I'm open to ipa-next only
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5160/head:pr5160
git checkout pr5160
2 months, 3 weeks
[freeipa PR#5144][opened] Reduce runtime of server installer by nearly a minute
by tiran
URL: https://github.com/freeipa/freeipa/pull/5144
Author: tiran
Title: #5144: Reduce runtime of server installer by nearly a minute
Action: opened
PR body:
"""
This experimental patch speeds up installer by tightening poll/sleep loops, reducing timeouts for DNS and NTP to a sensible value, avoiding duplicate work.
## Add helper for poll/sleep loops with timeout
The Sleeper class is a helper that makes poll/sleep loops with timeout
easier to write. It takes care of edge cases and does not oversleep
timeout deadline.
## Faster certmonger wait_for_request()
wait_for_request() now waits 0.5 instead of 5 seconds. This shoves off
15 to 20 seconds from ipa-server-install while marginally increased
load on the system.
## Remove root-autobind configuration
The new lib389-based installer configured 389-DS with LDAPI support and
autobind for root.
cn=root-autobind,cn=config entry is no longer needed.
## Skip offline dse.ldif patching by default
The installer now stop and patches dse.ldif only when the option
--dirsrv-config-file is used. LDBM nsslapd-db-locks are increased in a
new step.
This speeds up installer by 4 or more seconds on a fast system.
## Retry chronyc waitsync only once
It's unlikely that a third chrony synchronization attempt is going to
succeed after the the first two attempts have failed. Only retry chronyc
waitsync once. Each retry adds a 10 second delay.
This speed up installer by 10 seconds on systems without fully
configured chronyd or no chronyd (e.g. containers).
## Reduce CA record DNS timeout to 10s
30 seconds is still a lot of time for a DNS query. Clients typically
do not wait that long. OpenSSH uses 10 seconds for reverse DNS lookup.
That's considered a long timeout already. It's unlikely that a DNS query
is going to succeed after 10 seconds of failed lookups.
At this point during the installer IPA's BIND DNS instance has been
running long enough to be fully available, too.
The changeset reduces installation time by 40 seconds when ipa-ca DNS
has not been created yet.
See: https://pagure.io/freeipa/issue/6176
## Skip duplicate import of cert profiles
All supported Dogtag versions import the cert profiles during pkispawn
when using the LDAP profile backend.
This reduces the installation time by 9 to 14 seconds
## Use single update LDIF for indices
Index definitions were split across four files. indices.ldif contained
the initial subset of indices. Three update files partly duplicated the
indices and partly added new indices.
All indices are now defined in a single update file that is sorted
alphanumerically.
The changeset avoids two additional index tasks and reduces installation
time by 5 to 10 seconds.
Fixes: https://pagure.io/freeipa/issue/8493
## Remove magic sleep from create_index_task
11 years ago 5ad91a0781 added a magic sleep to work around a rare deadlock
bug in memberOf plugin. Thierry is not aware of any outstanding issues
with memberOf plugin that could lead to a deadlock.
## Add timings to install logs
The logging manager now adds timings for installation steps to the
installer logs. The information can be extracted and dumped to a CSV
file with a simple grep command:
grep -Po 'TIMING: \K.*' /var/log/ipaserver.log > ipaserver.csv
## Use separate install logs for AD and DNS instance
ipa-dns-install and ipa-adtrust-install no longer overwrite
ipaserver-install.log. Instead they use a separate log file.
Add AD-Trust, DNS, KRA, and replica log files to backups.
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5144/head:pr5144
git checkout pr5144
2 months, 4 weeks
[freeipa PR#5167][opened] Speed up PKI installer steps
by tiran
URL: https://github.com/freeipa/freeipa/pull/5167
Author: tiran
Title: #5167: Speed up PKI installer steps
Action: opened
PR body:
"""
## Skip duplicate import of cert profiles
All supported Dogtag versions import the cert profiles during pkispawn
when using the LDAP profile backend.
This reduces the installation time by 9 to 14 seconds
## Dogtag: Remove set_audit_renewal step
The step set_audit_renewal modifies Dogtag's caSignedLogCert.cfg to bump
renewal to 2 years. The problem was fixed in Dogtag upstream in 2012 before
Dogtag 10.0 came out, see https://github.com/dogtagpki/pki/commit/f5b8ea5b087f642a0208c228dce6f700c...
The update step would also no longer work. Profiles have been migrated
to LDAP several FreeIPA releases ago. pkispawn populates LDAP with all
of Dogtag's default profiles. FreeIPA does not overwrite any existing
profiles.
Win: 11 to 50 seconds
## Spawn PKI: Execute more steps early
Move several steps to an earlier phase of CA spawn. RA and ACME agent
ACLs are now configured while the server is down. This avoids yet
another restart and saves between 11 and 50 seconds per installation.
Total: ~30s to ~90s
Related: https://pagure.io/freeipa/issue/8521
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5167/head:pr5167
git checkout pr5167
3 months, 1 week