pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone

Blame SOURCES/0011-Don-t-allow-OTP-or-RADIUS-in-FIPS-mode.patch

3f51ca
From be18d6c15a2557e8f45e41efc81f1c005958c690 Mon Sep 17 00:00:00 2001
3f51ca
From: Stanislav Laznicka <slaznick@redhat.com>
3f51ca
Date: Tue, 7 Nov 2017 14:42:12 +0100
3f51ca
Subject: [PATCH] Don't allow OTP or RADIUS in FIPS mode
3f51ca
3f51ca
RADIUS, which is also internally used in the process of OTP
3f51ca
authentication by ipa-otpd, requires MD5 checksums which
3f51ca
makes it impossible to be used in FIPS mode. Don't allow users
3f51ca
setting OTP or RADIUS authentication if in FIPS mode.
3f51ca
3f51ca
https://pagure.io/freeipa/issue/7168
3f51ca
3f51ca
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
3f51ca
---
3f51ca
 ipaserver/plugins/baseuser.py |  3 +++
3f51ca
 ipaserver/plugins/config.py   | 16 ++++++++++++++++
3f51ca
 2 files changed, 19 insertions(+)
3f51ca
3f51ca
diff --git a/ipaserver/plugins/baseuser.py b/ipaserver/plugins/baseuser.py
3f51ca
index bf24dbf542d3b481671dfe4e8cee14a2edcc26e0..bb8a73ded0fed135d5829ec0b0829a936f2196fb 100644
3f51ca
--- a/ipaserver/plugins/baseuser.py
3f51ca
+++ b/ipaserver/plugins/baseuser.py
3f51ca
@@ -32,6 +32,7 @@ from .baseldap import (
3f51ca
     add_missing_object_class)
3f51ca
 from ipaserver.plugins.service import (
3f51ca
    validate_certificate, validate_realm, normalize_principal)
3f51ca
+from ipaserver.plugins.config import check_fips_auth_opts
3f51ca
 from ipalib.request import context
3f51ca
 from ipalib import _
3f51ca
 from ipalib.constants import PATTERN_GROUPUSER_NAME
3f51ca
@@ -477,6 +478,7 @@ class baseuser_add(LDAPCreate):
3f51ca
                             **options):
3f51ca
         assert isinstance(dn, DN)
3f51ca
         set_krbcanonicalname(entry_attrs)
3f51ca
+        check_fips_auth_opts(fips_mode=self.api.env.fips_mode, **options)
3f51ca
         self.obj.convert_usercertificate_pre(entry_attrs)
3f51ca
 
3f51ca
     def post_common_callback(self, ldap, dn, entry_attrs, *keys, **options):
3f51ca
@@ -600,6 +602,7 @@ class baseuser_mod(LDAPUpdate):
3f51ca
         assert isinstance(dn, DN)
3f51ca
         add_sshpubkey_to_attrs_pre(self.context, attrs_list)
3f51ca
 
3f51ca
+        check_fips_auth_opts(fips_mode=self.api.env.fips_mode, **options)
3f51ca
         self.check_namelength(ldap, **options)
3f51ca
 
3f51ca
         self.check_mail(entry_attrs)
3f51ca
diff --git a/ipaserver/plugins/config.py b/ipaserver/plugins/config.py
3f51ca
index ce15e6096f5b84dc45ee21d5aecc73ecf86eba07..c9033fa8e7a2a0bfe77464fa4f9c62278bd814f6 100644
3f51ca
--- a/ipaserver/plugins/config.py
3f51ca
+++ b/ipaserver/plugins/config.py
3f51ca
@@ -85,6 +85,20 @@ EXAMPLES:
3f51ca
 
3f51ca
 register = Registry()
3f51ca
 
3f51ca
+
3f51ca
+def check_fips_auth_opts(fips_mode, **options):
3f51ca
+    """
3f51ca
+    OTP and RADIUS are not allowed in FIPS mode since they use MD5
3f51ca
+    checksums (OTP uses our RADIUS responder daemon ipa-otpd).
3f51ca
+    """
3f51ca
+    if 'ipauserauthtype' in options and fips_mode:
3f51ca
+        if ('otp' in options['ipauserauthtype'] or
3f51ca
+                'radius' in options['ipauserauthtype']):
3f51ca
+            raise errors.InvocationError(
3f51ca
+                'OTP and RADIUS authentication in FIPS is '
3f51ca
+                'not yet supported')
3f51ca
+
3f51ca
+
3f51ca
 @register()
3f51ca
 class config(LDAPObject):
3f51ca
     """
3f51ca
@@ -398,6 +412,8 @@ class config_mod(LDAPUpdate):
3f51ca
 
3f51ca
     def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options):
3f51ca
         assert isinstance(dn, DN)
3f51ca
+        check_fips_auth_opts(fips_mode=self.api.env.fips_mode, **options)
3f51ca
+
3f51ca
         if 'ipadefaultprimarygroup' in entry_attrs:
3f51ca
             group=entry_attrs['ipadefaultprimarygroup']
3f51ca
             try:
3f51ca
-- 
3f51ca
2.13.6
3f51ca