[Freeipa-devel] [freeipa PR#531][opened] httpinstance: don't load system trust module in /etc/httpd/alias

[HonzaCholasta]

URL: https://github.com/freeipa/freeipa/pull/531
Author: HonzaCholasta
Title: #531: httpinstance: don't load system trust module in /etc/httpd/alias
Action: opened

PR body:
"""
Currently the NSS database in /etc/httpd/alias is installed with the system
trust module enabled via a /etc/httpd/alias/libnssckbi.so symlink. This is
problematic for a number of reasons:

* IPA has its own trust store, which is effectively bypassed when the
system trust module is enabled in the database. This may cause IPA
unrelated CAs to be trusted by httpd, or even IPA related CAs not to be
trusted by httpd.

* On client install, the IPA trust configuration is copied to the system
trust store for third parties. When this configuration is removed, it may
cause loss of trust information in /etc/httpd/alias
(https://bugzilla.redhat.com/show_bug.cgi?id=1427897).

* When a CA certificate provided by the user in CA-less install conflicts
with a CA certificate in the system trust store, the latter may be used
by httpd, leading to broken https
(https://www.redhat.com/archives/freeipa-users/2016-July/msg00360.html).

Rename the symlink on install and upgrade to prevent the system trust
module to be loaded in /etc/httpd/alias and fix all of the above issues.

https://pagure.io/freeipa/issue/6132
"""

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/531/head:pr531
git checkout pr531

[tiran]

URL: https://github.com/freeipa/freeipa/pull/531
Title: #531: httpinstance: don't load system trust module in /etc/httpd/alias

tiran commented:
"""
Your solution is just a temporary solution. The file is re-added every time mod_nss is updated. The mod_nss package needs to be changed, too.
"""

See the full comment at https://github.com/freeipa/freeipa/pull/531#issuecomment-283588206

[HonzaCholasta]

URL: https://github.com/freeipa/freeipa/pull/531
Title: #531: httpinstance: don't load system trust module in /etc/httpd/alias

HonzaCholasta commented:
"""
Sigh, did not notice that.
"""

See the full comment at https://github.com/freeipa/freeipa/pull/531#issuecomment-283588529

[tiran]

URL: https://github.com/freeipa/freeipa/pull/531
Title: #531: httpinstance: don't load system trust module in /etc/httpd/alias

tiran commented:
"""
```
$ rpm -qf /etc/httpd/alias/libnssckbi.so
mod_nss-1.0.14-1.fc25.x86_64
````

https://src.fedoraproject.org/cgit/rpms/mod_nss.git/tree/mod_nss.spec#n158

```
%files
...
%{_sysconfdir}/httpd/alias/libnssckbi.so
```

"""

See the full comment at https://github.com/freeipa/freeipa/pull/531#issuecomment-283589720

[HonzaCholasta]

URL: https://github.com/freeipa/freeipa/pull/531
Author: HonzaCholasta
Title: #531: httpinstance: don't load system trust module in /etc/httpd/alias
Action: synchronized

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/531/head:pr531
git checkout pr531

[HonzaCholasta]

URL: https://github.com/freeipa/freeipa/pull/531
Author: HonzaCholasta
Title: #531: httpinstance: disable system trust module in /etc/httpd/alias
Action: edited

Changed field: body
Original value:
"""
Currently the NSS database in /etc/httpd/alias is installed with the system
trust module enabled via a /etc/httpd/alias/libnssckbi.so symlink. This is
problematic for a number of reasons:

* IPA has its own trust store, which is effectively bypassed when the
system trust module is enabled in the database. This may cause IPA
unrelated CAs to be trusted by httpd, or even IPA related CAs not to be
trusted by httpd.

* On client install, the IPA trust configuration is copied to the system
trust store for third parties. When this configuration is removed, it may
cause loss of trust information in /etc/httpd/alias
(https://bugzilla.redhat.com/show_bug.cgi?id=1427897).

* When a CA certificate provided by the user in CA-less install conflicts
with a CA certificate in the system trust store, the latter may be used
by httpd, leading to broken https
(https://www.redhat.com/archives/freeipa-users/2016-July/msg00360.html).

Rename the symlink on install and upgrade to prevent the system trust
module to be loaded in /etc/httpd/alias and fix all of the above issues.

https://pagure.io/freeipa/issue/6132
"""

[HonzaCholasta]

URL: https://github.com/freeipa/freeipa/pull/531
Author: HonzaCholasta
Title: #531: httpinstance: don't load system trust module in /etc/httpd/alias
Action: edited

Changed field: title
Original value:
"""
httpinstance: don't load system trust module in /etc/httpd/alias
"""

[HonzaCholasta]

URL: https://github.com/freeipa/freeipa/pull/531
Author: HonzaCholasta
Title: #531: httpinstance: disable system trust module in /etc/httpd/alias
Action: synchronized

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/531/head:pr531
git checkout pr531

[HonzaCholasta]

URL: https://github.com/freeipa/freeipa/pull/531
Author: HonzaCholasta
Title: #531: httpinstance: disable system trust module in /etc/httpd/alias
Action: synchronized

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/531/head:pr531
git checkout pr531

[HonzaCholasta]

URL: https://github.com/freeipa/freeipa/pull/531
Author: HonzaCholasta
Title: #531: httpinstance: disable system trust module in /etc/httpd/alias
Action: synchronized

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/531/head:pr531
git checkout pr531

[HonzaCholasta]

URL: https://github.com/freeipa/freeipa/pull/531
Author: HonzaCholasta
Title: #531: httpinstance: disable system trust module in /etc/httpd/alias
Action: synchronized

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/531/head:pr531
git checkout pr531

[HonzaCholasta]

URL: https://github.com/freeipa/freeipa/pull/531
Title: #531: httpinstance: disable system trust module in /etc/httpd/alias

HonzaCholasta commented:
"""
Updated to use `modutil -disable` which works even on mod_nss reinstall.
"""

See the full comment at https://github.com/freeipa/freeipa/pull/531#issuecomment-284312430

[rcritten]

URL: https://github.com/freeipa/freeipa/pull/531
Title: #531: httpinstance: disable system trust module in /etc/httpd/alias

rcritten commented:
"""
IIRC on install all three existing db's get copied to <name>.orig, or something like that right? So uninstall would move those back into place effectively disabling this?
"""

See the full comment at https://github.com/freeipa/freeipa/pull/531#issuecomment-284403378

[HonzaCholasta]

URL: https://github.com/freeipa/freeipa/pull/531
Title: #531: httpinstance: disable system trust module in /etc/httpd/alias

HonzaCholasta commented:
"""
Yes. That is, once https://pagure.io/freeipa/issue/4639 is fixed.
"""

See the full comment at https://github.com/freeipa/freeipa/pull/531#issuecomment-284404665

[rcritten]

URL: https://github.com/freeipa/freeipa/pull/531
Title: #531: httpinstance: disable system trust module in /etc/httpd/alias

rcritten commented:
"""
Just FYI I'm opening an upstream discussion with the NSS team on this. It is very strange that there is a conflict like this, particularly between master and replica.
"""

See the full comment at https://github.com/freeipa/freeipa/pull/531#issuecomment-284414651

[HonzaCholasta]

URL: https://github.com/freeipa/freeipa/pull/531
Title: #531: httpinstance: disable system trust module in /etc/httpd/alias

HonzaCholasta commented:
"""
The conflict between master and replica exists because on the master, client install is executed last, but on (domain level 1+) replica it is executed first, so on the master `/etc/httpd/alias` is populated first and `/etc/pki/ca-trust/source/ipa.p11-kit` is created later, but on (domain level 1+) replica it is done the other way around.
"""

See the full comment at https://github.com/freeipa/freeipa/pull/531#issuecomment-284626499

[stlaz]

URL: https://github.com/freeipa/freeipa/pull/531
Title: #531: httpinstance: disable system trust module in /etc/httpd/alias

stlaz commented:
"""
It seems to work fine for "mod_nss" reinstalls but `ipa-server-upgrade` is currently failing so I can't confirm that's ok.
"""

See the full comment at https://github.com/freeipa/freeipa/pull/531#issuecomment-286446500

[stlaz]

URL: https://github.com/freeipa/freeipa/pull/531
Title: #531: httpinstance: disable system trust module in /etc/httpd/alias

stlaz commented:
"""
It seems to work fine for "mod_nss" reinstalls but `ipa-server-upgrade` is currently failing so I can't confirm that's ok.
"""

See the full comment at https://github.com/freeipa/freeipa/pull/531#issuecomment-286446500

[stlaz]

URL: https://github.com/freeipa/freeipa/pull/531
Title: #531: httpinstance: disable system trust module in /etc/httpd/alias

Label: +ack

[stlaz]

URL: https://github.com/freeipa/freeipa/pull/531
Title: #531: httpinstance: disable system trust module in /etc/httpd/alias

Label: -ack

[stlaz]

URL: https://github.com/freeipa/freeipa/pull/531
Title: #531: httpinstance: disable system trust module in /etc/httpd/alias

Label: +ack

[stlaz]

URL: https://github.com/freeipa/freeipa/pull/531
Title: #531: httpinstance: disable system trust module in /etc/httpd/alias

stlaz commented:
"""
I rebased your patchset on current master and put the uninstallation of `ipa_memcached` into a multipass block and all seems to work now.
"""

See the full comment at https://github.com/freeipa/freeipa/pull/531#issuecomment-286457931

[MartinBasti]

URL: https://github.com/freeipa/freeipa/pull/531
Title: #531: httpinstance: disable system trust module in /etc/httpd/alias

MartinBasti commented:
"""
master:

* f037bfa48356a5fb28eebdb76f9dbd5cb461c2d2 httpinstance: disable system trust module in /etc/httpd/alias
"""

See the full comment at https://github.com/freeipa/freeipa/pull/531#issuecomment-286472486

[MartinBasti]

URL: https://github.com/freeipa/freeipa/pull/531
Author: HonzaCholasta
Title: #531: httpinstance: disable system trust module in /etc/httpd/alias
Action: closed

To pull the PR as Git branch:
git remote add ghfreeipa https://github.com/freeipa/freeipa
git fetch ghfreeipa pull/531/head:pr531
git checkout pr531

[MartinBasti]

URL: https://github.com/freeipa/freeipa/pull/531
Title: #531: httpinstance: disable system trust module in /etc/httpd/alias

Label: +pushed