freeipa

#8535 RPM spec moves ssh server config to a snippet but does not ensure sshd_config includes the snippet
Closed: fixed by frenaud. Opened by adamwill.

Closed: fixed
Reopen Issue

Commit 511f5194dcf12a64fc8a6c2791edc9c6cda2d926 added a %triggerin to the RPM spec that moves the relevant ssh server config entries from /etc/ssh/sshd_config to /etc/ssh/sshd_config.d/04-ipa.conf when updating from openssh-server < 8.2. However, it missed a bit: it doesn't make sure /etc/ssh/sshd_config actually includes the snippet file - it doesn't make sure it has this line:

Include /etc/ssh/sshd_config.d/*.conf

this is a problem, because exactly the kind of older installs this trigger is attempting to 'fix' are very unlikely to have that line - because it was only added to the packaged /etc/ssh/sshd_config (in Fedora) relatively recently, and exactly because FreeIPA used to edit /etc/ssh/sshd_config, when the update to openssh that added that line was installed, it most likely got created as /etc/ssh/sshd_config.rpmnew, the existing file was not replaced (because it was modified).

Here, you can see that this is the case on one of my systems:

[root@adam freeipa (master)]# grep Include /etc/ssh/sshd_config
[root@adam freeipa (master)]# grep Include /etc/ssh/sshd_config.rpmnew 
Include /etc/ssh/sshd_config.d/*.conf

Most or all of the others I have are the same.

@abbra @frenaud

Hi @adamwill
Is this the sequence where the problem occurs?
- openssh < 8.2 installed
- "ipa-client install" modifies /etc/ssh/sshd_config
- update of openssh to 8.2 and of ipa-client, some directives are moved from /etc/ssh/sshd_config to the snippet but /etc/ssh/sshd_config does not contain the "Include /etc/ssh/sshd_config.d/*.conf" directive

I'm not sure what we should do in this case: as the upgrade of sshd creates the /etc/ssh/sshd_config.rpmnew file, the admin is made aware that "something" happened and requires his attention.

We could:
- move the directives to ipa snippet only if the "Include .conf" directive is already present
- or always move the directives and add "include .conf" if not already present
- or always move the directives and add "include 04-ipa.conf" if "include *.conf" is not present
- or always move the directives and let the sysadmin handle the resolution because of the .rpmnew file (=as it is done today).
I see cons to each solution. @abbra, @rcritten do you have other suggestions or preferences?

I would probably choose an option that provides minimal disruption to already configured system. Which one of those it would be is not that important.

@frenaud something like that, yes. I didn't check exactly when the Include line was added to the openssh-server package, it might not be exactly 8.2, but that's more or less it.

I'm not sure what we should do in this case: as the upgrade of sshd creates the /etc/ssh/sshd_config.rpmnew file, the admin is made aware that "something" happened and requires his attention.

I think this is kind of naive. rpmnew files happen a lot, and I don't think most admins are in the habit of checking for them and carefully comparing them all the time. If FreeIPA is going to choose to do major surgery like this in the spec file, FreeIPA should be responsible for making sure it works without the admin having to figure out this problem. The user experience right now for anyone upgrading slightly older FreeIPA domain members is "I upgraded my domain to FreeIPA 4.9 and suddenly no-one can ssh anywhere". This is not a good experience. Heck, depending on how the systems are set up, even accessing them to fix this could be awkward. I had to get into mine via libvirt and type in the backup root passwords manually to login on a VT, and other admins could have even more inconvenience.

Of those choices option 2 would probably be the one I would pick, but the more interesting problem is what do you do to fix systems that have already hit this bug, like mine have?
Edited by adamwill

Metadata Update from @abbra:
- Issue set to the milestone: FreeIPA 4.8.10

Metadata Update from @abbra:
- Issue set to the milestone: FreeIPA 4.8.11 (was: FreeIPA 4.8.10)

Metadata Update from @abbra:
- Issue priority set to: critical

Metadata Update from @frenaud:
- Issue assigned to frenaud

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/5190

PR in review https://github.com/freeipa/freeipa/pull/5190 proposes to fix the current issue and adds "Include /etc/ssh/sshd_config.d/04-ipa.conf" if the snippet is present but not included.

master:

  • fbd7d7718948245e1b47ca921136eca03b3f52c2 rpmspec: ensure ipa snippet for sshd is always included

ipa-4-8:

  • 74b29c1e4fa35aacc80eb7f57440299ba973e779 rpmspec: ensure ipa snippet for sshd is always included

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @rcritten:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1887928
Metadata
None
None
None
Lowest
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.