|
 |
590d18 |
From bb60e6d76d0dfa8106e195cc830b3ce685e84f77 Mon Sep 17 00:00:00 2001
|
|
|
590d18 |
From: "Endi S. Dewata" <edewata@redhat.com>
|
|
|
590d18 |
Date: Sat, 22 Aug 2015 01:14:16 +0200
|
|
|
590d18 |
Subject: [PATCH] Removed clear text passwords from KRA install log.
|
|
|
590d18 |
|
|
|
590d18 |
The ipa-kra-install tool has been modified to use password files
|
|
|
590d18 |
instead of clear text passwords when invoking pki tool such that
|
|
|
590d18 |
the passwords are no longer visible in ipaserver-kra-install.log.
|
|
|
590d18 |
|
|
|
590d18 |
https://fedorahosted.org/freeipa/ticket/5246
|
|
|
590d18 |
|
|
|
590d18 |
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
590d18 |
---
|
|
|
590d18 |
ipaplatform/base/paths.py | 2 ++
|
|
|
590d18 |
ipaserver/install/krainstance.py | 16 ++++++++--------
|
|
|
590d18 |
2 files changed, 10 insertions(+), 8 deletions(-)
|
|
|
590d18 |
|
|
|
590d18 |
diff --git a/ipaplatform/base/paths.py b/ipaplatform/base/paths.py
|
|
|
590d18 |
index 0dd3c7fda3020264a1ace8f2d13557cfddf18c2d..5c8f25d6ef85fab2b9b30a660cd1c0360dbe9931 100644
|
|
|
590d18 |
--- a/ipaplatform/base/paths.py
|
|
|
590d18 |
+++ b/ipaplatform/base/paths.py
|
|
|
590d18 |
@@ -343,6 +343,8 @@ class BasePathNamespace(object):
|
|
|
590d18 |
SLAPD_INSTANCE_SOCKET_TEMPLATE = "/var/run/slapd-%s.socket"
|
|
|
590d18 |
ALL_SLAPD_INSTANCE_SOCKETS = "/var/run/slapd-*.socket"
|
|
|
590d18 |
ADMIN_CERT_PATH = '/root/.dogtag/pki-tomcat/ca_admin.cert'
|
|
|
590d18 |
+ KRA_NSSDB_PASSWORD_FILE = "/root/.dogtag/pki-tomcat/kra/password.conf"
|
|
|
590d18 |
+ KRA_PKCS12_PASSWORD_FILE = "/root/.dogtag/pki-tomcat/kra/pkcs12_password.conf"
|
|
|
590d18 |
ENTROPY_AVAIL = '/proc/sys/kernel/random/entropy_avail'
|
|
|
590d18 |
LDIF2DB = '/usr/sbin/ldif2db'
|
|
|
590d18 |
DB2LDIF = '/usr/sbin/db2ldif'
|
|
|
590d18 |
diff --git a/ipaserver/install/krainstance.py b/ipaserver/install/krainstance.py
|
|
|
590d18 |
index fa50c3dec897d63b9d3522d196054163f7b3369a..e5cdbf5e7714603041e3f0156e87311994175b18 100644
|
|
|
590d18 |
--- a/ipaserver/install/krainstance.py
|
|
|
590d18 |
+++ b/ipaserver/install/krainstance.py
|
|
|
590d18 |
@@ -275,16 +275,16 @@ class KRAInstance(DogtagInstance):
|
|
|
590d18 |
# import CA certificate into temporary security database
|
|
|
590d18 |
args = ["/usr/bin/pki",
|
|
|
590d18 |
"-d", self.agent_db,
|
|
|
590d18 |
- "-c", self.admin_password,
|
|
|
590d18 |
+ "-C", paths.KRA_NSSDB_PASSWORD_FILE,
|
|
|
590d18 |
"client-cert-import",
|
|
|
590d18 |
"--pkcs12", paths.KRACERT_P12,
|
|
|
590d18 |
- "--pkcs12-password", self.admin_password]
|
|
|
590d18 |
+ "--pkcs12-password-file", paths.KRA_PKCS12_PASSWORD_FILE]
|
|
|
590d18 |
ipautil.run(args)
|
|
|
590d18 |
|
|
|
590d18 |
# trust CA certificate
|
|
|
590d18 |
args = ["/usr/bin/pki",
|
|
|
590d18 |
"-d", self.agent_db,
|
|
|
590d18 |
- "-c", self.admin_password,
|
|
|
590d18 |
+ "-C", paths.KRA_NSSDB_PASSWORD_FILE,
|
|
|
590d18 |
"client-cert-mod", "Certificate Authority - %s" % api.env.realm,
|
|
|
590d18 |
"--trust", "CT,c,"]
|
|
|
590d18 |
ipautil.run(args)
|
|
|
590d18 |
@@ -292,16 +292,16 @@ class KRAInstance(DogtagInstance):
|
|
|
590d18 |
# import Dogtag admin certificate into temporary security database
|
|
|
590d18 |
args = ["/usr/bin/pki",
|
|
|
590d18 |
"-d", self.agent_db,
|
|
|
590d18 |
- "-c", self.admin_password,
|
|
|
590d18 |
+ "-C", paths.KRA_NSSDB_PASSWORD_FILE,
|
|
|
590d18 |
"client-cert-import",
|
|
|
590d18 |
"--pkcs12", paths.DOGTAG_ADMIN_P12,
|
|
|
590d18 |
- "--pkcs12-password", self.admin_password]
|
|
|
590d18 |
+ "--pkcs12-password-file", paths.KRA_PKCS12_PASSWORD_FILE]
|
|
|
590d18 |
ipautil.run(args)
|
|
|
590d18 |
|
|
|
590d18 |
# as Dogtag admin, create ipakra user in KRA
|
|
|
590d18 |
args = ["/usr/bin/pki",
|
|
|
590d18 |
"-d", self.agent_db,
|
|
|
590d18 |
- "-c", self.admin_password,
|
|
|
590d18 |
+ "-C", paths.KRA_NSSDB_PASSWORD_FILE,
|
|
|
590d18 |
"-n", "ipa-ca-agent",
|
|
|
590d18 |
"kra-user-add", "ipakra",
|
|
|
590d18 |
"--fullName", "IPA KRA User"]
|
|
|
590d18 |
@@ -310,7 +310,7 @@ class KRAInstance(DogtagInstance):
|
|
|
590d18 |
# as Dogtag admin, add ipakra into KRA agents group
|
|
|
590d18 |
args = ["/usr/bin/pki",
|
|
|
590d18 |
"-d", self.agent_db,
|
|
|
590d18 |
- "-c", self.admin_password,
|
|
|
590d18 |
+ "-C", paths.KRA_NSSDB_PASSWORD_FILE,
|
|
|
590d18 |
"-n", "ipa-ca-agent",
|
|
|
590d18 |
"kra-user-membership-add", "ipakra", "Data Recovery Manager Agents"]
|
|
|
590d18 |
ipautil.run(args)
|
|
|
590d18 |
@@ -330,7 +330,7 @@ class KRAInstance(DogtagInstance):
|
|
|
590d18 |
# as Dogtag admin, upload and assign ipaCert to ipakra
|
|
|
590d18 |
args = ["/usr/bin/pki",
|
|
|
590d18 |
"-d", self.agent_db,
|
|
|
590d18 |
- "-c", self.admin_password,
|
|
|
590d18 |
+ "-C", paths.KRA_NSSDB_PASSWORD_FILE,
|
|
|
590d18 |
"-n", "ipa-ca-agent",
|
|
|
590d18 |
"kra-user-cert-add", "ipakra",
|
|
|
590d18 |
"--input", filename]
|
|
|
590d18 |
--
|
|
|
590d18 |
2.4.3
|
|
|
590d18 |
|