[freeipa PR#5418][opened] Support trust in FIPS mode
by abbra
URL: https://github.com/freeipa/freeipa/pull/5418
Author: abbra
Title: #5418: Support trust in FIPS mode
Action: opened
PR body:
"""
## ipaserver/dcerpc.py: enforce SMB encryption on LSA pipe if available
We want to always use SMB encryption if it is possible on LSA pipe as we are going to pass what accounts to a plain-text content within CreateTrustedDomainEx2 call.
The catch is that older Samba version might not have a way to enforce this and we need fall back to work with existing connection then.
## ipaserver/dcerpc.py: use Kerberos authentication for discovery
In FIPS mode we cannot rely on NTLMSSP at all, so we have ensure Kerberos is used by Samba Python libraries. This is achieved by requiring credentials objects to always use Kerberos authentication.
Additionally, we have to normalize the principal used to authenticate. In case it was passed without realm, add forest root domain as a realm. In case it was passed with NetBIOS domain name, remove it and replace with a realm. Since we only know about the forest root domain as a realm, require that for other domains' users a real Kerberos principal is specified.
## ipaserver/dcerpc: use Samba-provided trust helper to establish trust
When establishing trust to Active Directory forest, RC4 is used to encrypt trusted domain object credentials as an application-specific material in a secure channel based on AES session key.
In FIPS mode it is not possible to use RC4 directly.
Samba 4.14 and backports to 4.13 in Fedora 33+ and RHEL 8.4+ now provide a helper that wraps LSA RPC call CreateTrustedDomainEx2. This helper ensures that in FIPS mode we first check that LSA session key is AES before allowing RC4 use internally in Samba bindings. Thus, it becomes possible to establish trust to Active Directory forest in
FIPS mode.
Adopt FreeIPA code to use the helper provided by Samba when it is available. If neither the helper nor unprotected arcfour_encrypt utility is available from Samba bindings, fail import of the ipaserver.dcerpc module.
Fixes: https://pagure.io/freeipa/issue/8655
Signed-off-by: Alexander Bokovoy <abokovoy(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5418/head:pr5418
git checkout pr5418
3 years, 3 months
[freeipa PR#5401][opened] ipatests: See if nologin supports -c before asserting message
by rcritten
URL: https://github.com/freeipa/freeipa/pull/5401
Author: rcritten
Title: #5401: ipatests: See if nologin supports -c before asserting message
Action: opened
PR body:
"""
Per the ssh_config(5) man page under ProxyCommand:
"The command string extends to the end of the line, and is
executed using the user's shell ‘exec’ directive to avoid a
lingering shell process."
<shell> -c <proxy command>
Some older versions of nologin (RHEL/CentOS) do not support
the -c option so will still fail but since nologin doesn't
actually execute properly it doesn't include the output
'This account is currently not available' so don't assert
in that case. The returncode of 1 is sufficient to know
that the login is denied.
https://pagure.io/freeipa/issue/7676
Signed-off-by: Rob Crittenden <rcritten(a)redhat.com>
"""
To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/5401/head:pr5401
git checkout pr5401
3 years, 3 months