RHBA-2015:2562 - Bug Fix Advisory

Topic

Updated ipa packages that fix multiple bugs are now available for Red Hat Enterprise Linux 7.

Description

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Bugs fixed:

• During the renewal of the IdM RA agent certificate, the renewed certificate was already available for use, but the related configuration was not updated yet. As a consequence, if the renewal of another certificate was triggered during the renewal of the IdM RA agent certificate, the renewal could fail with the "Invalid credential" error. Now, the IdM RA agent certificate is properly locked for the whole duration of the renewal. (BZ#1283882)
• The IdM KRA agent PEM file was not exported when using ipa-kra-install. Consequently, if KRA was installed after an upgrade from an earlier version of IdM, IdM vault commands failed with an internal error. To fix this bug, the IPA KRA agent PEM file is now exported in ipa-kra-install, and IdM vault commands work in the described situation. (BZ#1283883)
• The code path in the KRA installer that created the vault container in LDAP raised an error if this container already existed, for example when installing KRA on a replica. As a consequence, the following untrue error message was returned during ipa-kra-install on a replica:

"Failed to load vault.ldif: Command ''/usr/bin/ldapmodify' '-v' '-f' '/tmp/tmpcuO7cy' '-H' 'ldapi://%2fvar%2frun%2fslapd-IPA-TEST.socket' '-x' '-D' 'cn=Directory Manager' '-y' '/tmp/tmp74Y4AY'' returned non-zero exit status 68"

The error message was harmless, as an entry in LDAP already existed. Now, no error message is displayed. (BZ#1283884)

• Due to a bug, ipa-server-install and ipa-replica-install did not validate their options. A patch has been applied to add the code that calls the validators in installers. Now, ipa-server-install and ipa-replica-install validate their options as expected. (BZ#1283890)
• An internal error in the method that cached ipaconfig settings caused the results not to be cached. Consequently, a search for limits stored in LDAP was unintentionally together with every LDAP search operation, and the search operations were thus duplicated. This update fixes the comparison of LDAP connections, and limits are downloaded from LDAP only once for each connection. (BZ#1283915)
• Previously, ipa-client-install did not handle Match and other sections in OpenSSH configuration files correctly. As a consequence, OpenSSH configuration files containing Match and other sections were corrupted by ipa-client-install. This bug has been fixed. (BZ#1284025)
• An internal error during an upgrade prevented the upgrade process from upgrading forward zones properly. Consequently, original forward zones have been removed, but no new (new-style) forward zones were added. Effectively, all forward zones disappeared. This update fixes internal calls of API, and old-style forward zones are now migrated properly. (BZ#1284052)
• Included certificate profiles and CA ACLs were not added during replica installation. As a consequence, certificate issuance failed on Red Hat Enterprise Linux 7.2 IdM replicas created from IdM masters prior to 7.2. Now, certificate profiles and CA ACLs are in place. Additionally, the default CA ACL cannot be deleted. As a result, certificate profiles and CA ACLs are now added if missing when installing a replica regardless of the version of the IdM master. The default CA ACL, hosts_services_caIPAserviceCert, can no longer be deleted, only disabled. (BZ#1284803)
• Connection to LDAP was held in a singleton object and creating it locally made it available in the back end. When this behavior was changed, it was not reflected in ipa-cacert-manage and ipa-otptoken-import. Consequently, ipa-cacert-manage and ipa-otptoken-import were unusable because they crashed on every run. This bug has been fixed by connecting to LDAP in back end. (BZ#1284811, BZ#1284813)

Solution

Users of ipa are advised to upgrade to these updated packages, which fix these bugs.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.2 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.2 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.2 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.2 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.3 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.2 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - TUS 7.2 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.2 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.3 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.2 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1283882 - IPA certificate auto renewal fail with "Invalid Credential"
• BZ - 1283883 - ipa upgrade causes vault internal error
• BZ - 1283884 - ipa-kra-install: fails to apply updates
• BZ - 1283890 - installer options are not validated at the beginning of installation
• BZ - 1283915 - Caching of ipaconfig does not work in framework
• BZ - 1284025 - sshd_config change on ipa-client-install can prevent sshd from starting up
• BZ - 1284052 - IPA DNS Zone/DNS Forward Zone details missing after upgrade from RHEL 7.0 to RHEL 7.2
• BZ - 1284803 - Default CA ACL rule is not created during ipa-replica-install
• BZ - 1284811 - ipa-cacert-manage renew fails on nonexistent ldap connection
• BZ - 1284813 - ipa-otptoken-import fails on nonexistent ldap connection

CVEs

(none)

References

• http://www.redhat.com/security/updates/classification/#normal