RHBA-2012:0819 - Bug Fix Advisory

Topic

Updated ipa packages that fix several bugs and add various enhancements are now
available for Red Hat Enterprise Linux 6.

Description

Red Hat Identity Management is a centralized authentication, identity management
and authorization solution for both traditional and cloud-based enterprise
environments. It integrates components of the Red Hat Directory Server, MIT
Kerberos, Red Hat Certificate System, NTP, and DNS. It provides web browser and
command-line interfaces. Its administration tools allow an administrator to
quickly install, set up, and administer a group of domain controllers to meet
the authentication and identity management requirements of large-scale Linux and
UNIX deployments.

These updated ipa packages include numerous bug fixes and enhancements. Space
precludes documenting all of these changes in this advisory. Users are directed
to the Red Hat Enterprise Linux 6.3 Technical Notes for information on the most
significant of these changes:

https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.3_Technical_Notes/ipa.html#RHBA-2012-0819

Users are advised to upgrade to these updated ipa packages, which fix these bugs
and add these enhancements.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 688765 - [RFE] afsdb records to not seem to be resolvable.
• BZ - 701677 - Allow specifying query and transfer policy settings for a zone
• BZ - 718015 - ipa pwpolicy inconsistency in error messages
• BZ - 738049 - [ipa webui] Remove Rule type info from HBAC page
• BZ - 738788 - ipa dnsrecord-add allows invalid kx records
• BZ - 741604 - misleading error when adding duplicate external members to sudo rule
• BZ - 741746 - [ipa webui] long rule names are not displayed nicely
• BZ - 742361 - ping CLI has no help or documentation
• BZ - 742601 - ipa config-mod: update description for --emaildomain
• BZ - 742973 - ipa-managed-entries traceback
• BZ - 742978 - ipa-managed-entries: --password option invalid
• BZ - 744205 - [ipa webui] Config - User search fields - if blank, throws error - an internal error has occurred
• BZ - 745705 - --zonemgr option of ipa-dns-install accepts email addresses without "@".
• BZ - 745788 - Help for ipa user-find does not include information about CRITERIA
• BZ - 745801 - [ipa webui] When user logs in for self service, enroll buttons are enabled
• BZ - 745962 - [ipa webui] RFE: The tabs when editing objects should be coloured to indicate the grouped tabs clearly
• BZ - 745968 - [ipa webui] RFE: Add a link is DNS Record for a host to navigate to its reverse zone
• BZ - 745972 - [ipa webui] RFE: Dropdown to select password policy priority from
• BZ - 746044 - [RFE] Option to generate random password for a new user
• BZ - 746060 - RFE: Certificate Serial Number is normally in hex, but not so in ipa ui
• BZ - 746078 - ipa-server-install does not clean after itself
• BZ - 746589 - automember functionality not available for upgraded IPA server
• BZ - 746805 - RFE: Make deactivated items visible as deactivated
• BZ - 747693 - ipa selfservice-find --raw returns "internal error"
• BZ - 747720 - ipa selfservice-find --permission="" returns internal error
• BZ - 747722 - ipa selfservice-find --attrs="" returns internal error
• BZ - 747730 - command: ipa selfservice-mod "edit address" --permissions="" delete a selfservice permission
• BZ - 747741 - command: ipa selfservice-mod : provide wrong attr for --attrs delete a selfservice permission
• BZ - 748110 - At times setting password fails with "Confidentiality required: Operation requires a secure connection." errro.
• BZ - 749275 - ipa-csreplica-manage list is incorrect when setting agreement between 2 replicas
• BZ - 750524 - Better error message needed to indicate if there is no CS replication agreement with another server
• BZ - 750806 - dnszone-mod and dnszone-add does not format administrator's email properly
• BZ - 750828 - named configuration error when installed with --external-ca option.
• BZ - 750850 - ipa-client-install with --no-sssd option should check for nss_ldap package or config availability
• BZ - 750947 - Adding loc records to a ipa-dns server breaks name resolution for some other records.
• BZ - 750984 - Inconsistency in error message while adding a duplicate netgroup.
• BZ - 751018 - Default HBAC Administration Role - Permissions missing
• BZ - 751020 - Default Sudo Administration Role - Permissions missing
• BZ - 751028 - Default Password Policy Administrator Role - Permissions missing
• BZ - 751029 - Default Modify Group membership Role - Permissions missing
• BZ - 751046 - HTTP server ports displayed multiple times in ipa-replica-conncheck.
• BZ - 751063 - ipa-replica-conncheck --master shows "Kerberos Kpasswd: UDP" to be OK even though it is not.
• BZ - 751173 - Misleading error message when changing password
• BZ - 751529 - [ipa webui] Add Host: Unable to select dns zone when there exists only one.
• BZ - 751597 - ipa-server-install --hostname fails at step configuring certificate server instance
• BZ - 751769 - ipa-server-install --uninstall errors out even when the newly created 389-ds instance is successfully removed.
• BZ - 751968 - Warning messages related to entitlements are displayed during installation with --ip-address option.
• BZ - 752686 - Negative test case for defaultgroup in ipa config-mod causes internal error.
• BZ - 752874 - IPA needs a check to ensure hostnames 'underscore' is not allowed when installing a replica
• BZ - 753483 - [RFE] support bind forward zones, aka DNS conditional forwarding
• BZ - 753484 - [RFE] Kerberos sign in should fall back to landing page username + password login form
• BZ - 753526 - IPA allows clients named localhost.localdomain, they should be refused
• BZ - 753966 - unable to delete migrated groups containing spaces
• BZ - 754524 - ipa-replica-manage - better error reporting when doing a del
• BZ - 754539 - Connect after del using ipa-replica-manage fails
• BZ - 754635 - Traceback message displayed while replica install is terminated before entering admin password.
• BZ - 754973 - "force-sync, re-initialize and del" options for ipa-replica-manage fail against AD.
• BZ - 755094 - ipa-replica-manage list doesn't always match cn=mapping tree
• BZ - 755450 - Better message for error diagnosis while adding an existing winsync agreement.
• BZ - 757644 - --no-reverse option in ipa-replica-install is not honored.
• BZ - 757681 - ipa-replica-install fails when --no-host-dns option is provided.
• BZ - 759100 - Unable to install ipa-server on a specified interface in dual nic machines.
• BZ - 759501 - [RFE] Login failed attempts counter or locked out status are not displayed in WebUI or "ipa user-show" command
• BZ - 761080 - CLI : ipa migration help is incomplete
• BZ - 766070 - [RFE] Allow forms based kerberos authentication for the IPA UI
• BZ - 766073 - [RFE] DNS Enhancements :: Implement new API for DNS records
• BZ - 766075 - DNS zone dynamic update is changed to false if --allow-dynupdate not specified
• BZ - 766077 - Enhance ipa-replica-conncheck to report DNS failures
• BZ - 766096 - Handle schema upgrades from IPA v2 to v3 - Tracker bug for upgrade from 6.2
• BZ - 766181 - [RFE] Provide option to disable Automatic Private Group creation for users
• BZ - 767725 - GSS-TSIG DNS updates should update reverse entries as well
• BZ - 768164 - [RFE] Use Services4User to replace ticket forwarding/delegation
• BZ - 768257 - Man Page : Document client IP addressing / FQDN requirements
• BZ - 769491 - Unable to add certain sudo commands to groups
• BZ - 772043 - Adding a netgroup with a "+" in the name that overlaps hostgroup causes crash
• BZ - 772044 - [RFE] Add ethers (mac address) information to the host object
• BZ - 772106 - ipa selfservice-add --raw returns "internal error" message
• BZ - 772150 - ipa-replica-manage re-initialize causes ALL Severs to rerun memberof fixup
• BZ - 772301 - [RFE] Reverse DNS rec not created upon creation of fwd DNS rec
• BZ - 772359 - [RFE] Need tool to update exclusive list in replication agreements
• BZ - 772675 - ipa selfservice-mod --raw returns "internal error" message
• BZ - 772852 - "Unresolved rules in --rules" error message is displayed even if the hbacrule is specified using the --rules option.
• BZ - 773488 - Make ipausers a non-posix group on new installs
• BZ - 773759 - Administrative Roles given the permission to change a user password should not be able to change user's passwords that are in the Administrators Group
• BZ - 782460 - Typo in example description for automember-default-group-remove
• BZ - 782566 - Unable to unset permission memberof
• BZ - 782873 - [RFE] Add --delattr option to complement --setattr/--addattr
• BZ - 782885 - [RFE] allow setting password when adding user
• BZ - 782894 - [RFE] Create a managment plugin for HBAC testing and troubleshooting (UI portion)
• BZ - 782896 - [RFE] Confirmation when adding multiple entries
• BZ - 782918 - Provide man page for ipa-upgradeconfig
• BZ - 782921 - [RFE] Add central configuration for size and look through limits
• BZ - 782925 - ipa-client-install fails when not run as root
• BZ - 782927 - [RFE] Add --sizelimit option to hbactest.
• BZ - 782974 - Exception why removing all values in config plugin
• BZ - 782976 - [RFE] SUDO: --users and --groups should detect values such as "ALL" and error appropriately
• BZ - 782979 - Replication Failure: Allocation of a new value for range cn=posix ids
• BZ - 783270 - When migrating warn user if compat is enabled
• BZ - 783271 - single-component domain no longer allowed
• BZ - 783272 - Confusing error message when adding a record to non-existent zone
• BZ - 783276 - host-add does not accept IPv6 addresses
• BZ - 783285 - [RFE] Missing "managing hosts" options.
• BZ - 783286 - Setting HBAC/SUDO category to Anyone doesn't remove users/groups
• BZ - 783289 - Provide guidance generate Certificate request
• BZ - 783291 - [RFE] add kerberos policy data to the user details page.
• BZ - 783307 - ipa delegation-add is not failing when membergroup does not exist
• BZ - 783500 - [ipa webui] Permission has checkbox selected against no attribute
• BZ - 783502 - ipa permission-add does not fail if using invalid attribute
• BZ - 783536 - [ipa webui] permission with filter or subtree does not allow attr to be specified
• BZ - 784329 - ipa permission-add is not failing when memberof group does not exist
• BZ - 784468 - ipa help delegation example has group and membergroup backwards?
• BZ - 784696 - Don't set nsds5replicaupdateschedule in replication agreements
• BZ - 785756 - config-mod :: --homedirectory new value not being honored
• BZ - 785864 - Users Failed Login attempts are not iterating the counter
• BZ - 786185 - Allow basedn to be passed into migrate-ds
• BZ - 786223 - Make ipa-client depend on oddjob-mkhomedir (ipa-client-install --mkhomedir sets wrong selinux contexts on user home drives)
• BZ - 788625 - IPA nested netgroups not seen from ypcat
• BZ - 788656 - ^D on password input returns traceback
• BZ - 789413 - Need option for ipa-client-install to not call authconfig
• BZ - 789459 - Error not reported correctly when logging into WebUI
• BZ - 789919 - IP address with just 3 octets are accepted as valid addresses in --a-rec option.
• BZ - 789980 - Adding some of the RR type from the "allowed values" results in an error message.
• BZ - 789987 - Correction in error message while deleting a invalid record.
• BZ - 790017 - RFE: Resource Record type options should be more descriptive.
• BZ - 790295 - RFE: Prompt for the missing options if not provided in command line during record add.
• BZ - 790318 - dnsrecord-add does not validate the record names with space in between.
• BZ - 790931 - unable to remove ipa if another ds instance is setup
• BZ - 791373 - Invalid error message attempting to delete config attributes
• BZ - 794474 - Can not add new user objectclass to ipa configuration
• BZ - 794746 - Internal error : ipa config-mod addattr on user and group search fields
• BZ - 794750 - ipa config-mod allowed to add additional certificate subjects bases
• BZ - 796347 - man page for ipa-replica-manage has typos in examples.
• BZ - 796401 - ipa migrate-ds :: Internal Server Error
• BZ - 797237 - ipa netgroup-add and netgroup-mod --nisdomain should not allow commas
• BZ - 797256 - ipa netgroup-add-member --hosts should not allow invalid characters
• BZ - 797561 - Bool attributes used in setattr/addattr/delattr options are not encoded properly
• BZ - 797562 - Invalid host-add when hostname contains trailing dot
• BZ - 797563 - Don't allow host-del on active replicas
• BZ - 797564 - Remove Requires on krb5-server-ldap
• BZ - 797565 - escaping commas is not working
• BZ - 797566 - Don't remove dirsrv user on uninstall
• BZ - 797567 - ipa-client-install does not handle exception from certutil call
• BZ - 797569 - embedded carriage returns in a CSV not handled
• BZ - 798352 - winsync now does not fill gidnumber
• BZ - 798361 - Missing anonymous limits in IPA
• BZ - 798792 - ipa netgroup-find options set to space return internal errors
• BZ - 799335 - ipa host-add fails when DNS records already exist
• BZ - 800119 - Should not be allowed to run host-disable on an IPA Server or service-disable on an IPA Server service
• BZ - 800363 - Unchecked return value and resource leak in ipa.
• BZ - 800483 - Unable to delete records interactively.
• BZ - 800537 - Sudo commands with special characters cannot be removed from command groups
• BZ - 801376 - ipa-server-install --uninstall errors out when trying to start dirsrv.
• BZ - 801380 - Reverse zone is removed while deleting replica agreement.
• BZ - 802786 - FreeIPA WebUI displays "Insufficient access: invalid credentials" when a password doesn't meet policy requirements
• BZ - 802832 - IPA Server Install Failing : java.lang.NoClassDefFoundError: 'ConfigureCA'
• BZ - 802860 - Fix UDP port check during ipa-ca-install
• BZ - 802864 - Fill global DNS configuration during installation
• BZ - 802912 - Error submitting certificate signing request
• BZ - 803050 - Recreate facet content after error
• BZ - 803822 - Tech Preview: Add support for central management of the SSH keys
• BZ - 803836 - IPA needs to set the nsslapd-minssf-exclude-rootdse option by default
• BZ - 804096 - Password Policy Failure Interval Reset is not working.
• BZ - 804562 - --ns-hostname option does not check A/AAAA record of the provided hostname.
• BZ - 804572 - Irrelevant error message when per-part modification mode is used during dnsrecord-mod operation without specifying the record.
• BZ - 804609 - Issues with DS migrated Users
• BZ - 804807 - DS Migration :: Internal Server Error specifying invalid RDN for container
• BZ - 805427 - idnssoaserial does not honour the recommended syntax in rfc1912.
• BZ - 805478 - Unable to use permission-mod to rename permission object
• BZ - 805546 - when adding a user with --noprivate option gidNumber should be required
• BZ - 806330 - warning when installing ipaserver - at step - configuring SELinux for httpd
• BZ - 807230 - Unable to delete all sshfp records interactively.
• BZ - 807304 - ipa permission-add throws internal server error when name contains '<' or '>'
• BZ - 807361 - DNS records in LDAP are publicly accessible
• BZ - 807362 - Lack of dependency on freeipa-client rpm --> python-krbV
• BZ - 807366 - Can't specify netgroup host, user category to all in Web UI
• BZ - 807371 - migration: don't append basedn to container if it is included
• BZ - 807417 - user-mod --rename is successful for more than 32 characters
• BZ - 807755 - [ipa webui] When adding permissions for a type, attributes that are not allowed are listed
• BZ - 808042 - "host group not found" error message is displayed while removing a member host from the hostgroup with huge members.
• BZ - 808099 - Unhelpful error message is displayed when no value is given in --revocation-reason optional argument with "ipa cert-revoke"
• BZ - 808201 - IPA Master Upgrade failed with argument of type 'NoneType' is not iterable
• BZ - 809190 - ipa-server-install fails when domain name is not resolvable
• BZ - 809262 - IPA Upgrade Web UI failure with internal server error
• BZ - 809560 - Do not create private groups for migrated users
• BZ - 810350 - [ipa webui] Privilege page should not have choice to list permissions by "indirect membership"
• BZ - 810948 - Unable to disable or enable hbacrule with --setattr [regression]
• BZ - 811296 - Notify user that password needs to be reset in forms-based login
• BZ - 811748 - Incorrect error message when user-mod --rename with an empty string
• BZ - 812110 - [ipa webui] Delegation UI does not allow to specify permission
• BZ - 812391 - IPA uninstall after upgrade returns some sysrestore.state errors
• BZ - 813389 - Improve migration plugin error when 2 groups have identical GID
• BZ - 815799 - Internal server error when Web UI calls pwpolicy_find with pkey_only option
• BZ - 818868 - [Web UI] Host detail page is not filled with data
• BZ - 822429 - Failed login count is stuck at 1
• BZ - 825321 - SSH Tech Preview feature enabled by default in ipa-client

CVEs

(none)

References

• https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.3_Technical_Notes/ipa.html#RHBA-2012-0819