|
 |
3f51ca |
From be18d6c15a2557e8f45e41efc81f1c005958c690 Mon Sep 17 00:00:00 2001
|
|
|
3f51ca |
From: Stanislav Laznicka <slaznick@redhat.com>
|
|
|
3f51ca |
Date: Tue, 7 Nov 2017 14:42:12 +0100
|
|
|
3f51ca |
Subject: [PATCH] Don't allow OTP or RADIUS in FIPS mode
|
|
|
3f51ca |
|
|
|
3f51ca |
RADIUS, which is also internally used in the process of OTP
|
|
|
3f51ca |
authentication by ipa-otpd, requires MD5 checksums which
|
|
|
3f51ca |
makes it impossible to be used in FIPS mode. Don't allow users
|
|
|
3f51ca |
setting OTP or RADIUS authentication if in FIPS mode.
|
|
|
3f51ca |
|
|
|
3f51ca |
https://pagure.io/freeipa/issue/7168
|
|
|
3f51ca |
|
|
|
3f51ca |
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
3f51ca |
---
|
|
|
3f51ca |
ipaserver/plugins/baseuser.py | 3 +++
|
|
|
3f51ca |
ipaserver/plugins/config.py | 16 ++++++++++++++++
|
|
|
3f51ca |
2 files changed, 19 insertions(+)
|
|
|
3f51ca |
|
|
|
3f51ca |
diff --git a/ipaserver/plugins/baseuser.py b/ipaserver/plugins/baseuser.py
|
|
|
3f51ca |
index bf24dbf542d3b481671dfe4e8cee14a2edcc26e0..bb8a73ded0fed135d5829ec0b0829a936f2196fb 100644
|
|
|
3f51ca |
--- a/ipaserver/plugins/baseuser.py
|
|
|
3f51ca |
+++ b/ipaserver/plugins/baseuser.py
|
|
|
3f51ca |
@@ -32,6 +32,7 @@ from .baseldap import (
|
|
|
3f51ca |
add_missing_object_class)
|
|
|
3f51ca |
from ipaserver.plugins.service import (
|
|
|
3f51ca |
validate_certificate, validate_realm, normalize_principal)
|
|
|
3f51ca |
+from ipaserver.plugins.config import check_fips_auth_opts
|
|
|
3f51ca |
from ipalib.request import context
|
|
|
3f51ca |
from ipalib import _
|
|
|
3f51ca |
from ipalib.constants import PATTERN_GROUPUSER_NAME
|
|
|
3f51ca |
@@ -477,6 +478,7 @@ class baseuser_add(LDAPCreate):
|
|
|
3f51ca |
**options):
|
|
|
3f51ca |
assert isinstance(dn, DN)
|
|
|
3f51ca |
set_krbcanonicalname(entry_attrs)
|
|
|
3f51ca |
+ check_fips_auth_opts(fips_mode=self.api.env.fips_mode, **options)
|
|
|
3f51ca |
self.obj.convert_usercertificate_pre(entry_attrs)
|
|
|
3f51ca |
|
|
|
3f51ca |
def post_common_callback(self, ldap, dn, entry_attrs, *keys, **options):
|
|
|
3f51ca |
@@ -600,6 +602,7 @@ class baseuser_mod(LDAPUpdate):
|
|
|
3f51ca |
assert isinstance(dn, DN)
|
|
|
3f51ca |
add_sshpubkey_to_attrs_pre(self.context, attrs_list)
|
|
|
3f51ca |
|
|
|
3f51ca |
+ check_fips_auth_opts(fips_mode=self.api.env.fips_mode, **options)
|
|
|
3f51ca |
self.check_namelength(ldap, **options)
|
|
|
3f51ca |
|
|
|
3f51ca |
self.check_mail(entry_attrs)
|
|
|
3f51ca |
diff --git a/ipaserver/plugins/config.py b/ipaserver/plugins/config.py
|
|
|
3f51ca |
index ce15e6096f5b84dc45ee21d5aecc73ecf86eba07..c9033fa8e7a2a0bfe77464fa4f9c62278bd814f6 100644
|
|
|
3f51ca |
--- a/ipaserver/plugins/config.py
|
|
|
3f51ca |
+++ b/ipaserver/plugins/config.py
|
|
|
3f51ca |
@@ -85,6 +85,20 @@ EXAMPLES:
|
|
|
3f51ca |
|
|
|
3f51ca |
register = Registry()
|
|
|
3f51ca |
|
|
|
3f51ca |
+
|
|
|
3f51ca |
+def check_fips_auth_opts(fips_mode, **options):
|
|
|
3f51ca |
+ """
|
|
|
3f51ca |
+ OTP and RADIUS are not allowed in FIPS mode since they use MD5
|
|
|
3f51ca |
+ checksums (OTP uses our RADIUS responder daemon ipa-otpd).
|
|
|
3f51ca |
+ """
|
|
|
3f51ca |
+ if 'ipauserauthtype' in options and fips_mode:
|
|
|
3f51ca |
+ if ('otp' in options['ipauserauthtype'] or
|
|
|
3f51ca |
+ 'radius' in options['ipauserauthtype']):
|
|
|
3f51ca |
+ raise errors.InvocationError(
|
|
|
3f51ca |
+ 'OTP and RADIUS authentication in FIPS is '
|
|
|
3f51ca |
+ 'not yet supported')
|
|
|
3f51ca |
+
|
|
|
3f51ca |
+
|
|
|
3f51ca |
@register()
|
|
|
3f51ca |
class config(LDAPObject):
|
|
|
3f51ca |
"""
|
|
|
3f51ca |
@@ -398,6 +412,8 @@ class config_mod(LDAPUpdate):
|
|
|
3f51ca |
|
|
|
3f51ca |
def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options):
|
|
|
3f51ca |
assert isinstance(dn, DN)
|
|
|
3f51ca |
+ check_fips_auth_opts(fips_mode=self.api.env.fips_mode, **options)
|
|
|
3f51ca |
+
|
|
|
3f51ca |
if 'ipadefaultprimarygroup' in entry_attrs:
|
|
|
3f51ca |
group=entry_attrs['ipadefaultprimarygroup']
|
|
|
3f51ca |
try:
|
|
|
3f51ca |
--
|
|
|
3f51ca |
2.13.6
|
|
|
3f51ca |
|