freeipa

#9509 ipa-client-install failing on Amazon Linux 2 (python-ldap package)
Closed: invalid by ftrivino. Opened by matt-james-fed.

Closed: invalid
Reopen Issue

Issue

ipa-client-install fails on latest Amazon Linux 2 due to python-ldap package update (2.4.15-2.amzn2.0.3)

Steps to Reproduce

  1. On any amazon linux 2 machine attempt to run ipa-client-install when it has the (python-ldap-2.4.15-2.amzn2.0.3 package present

Actual behavior

IPA client install fails due to the following error

024-01-12T01:59:54Z DEBUG stderr=
2024-01-12T01:59:54Z DEBUG trying to retrieve CA cert via LDAP from ipa-00.xxxxxx.io
2024-01-12T01:59:54Z DEBUG retrieving schema for SchemaCache url=ldap://ipa-00.xxxxxx.io:389 conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f88db7eab40>
2024-01-12T01:59:55Z DEBUG get_ca_certs_from_ldap() error: split_tokens() takes exactly 1 argument (2 given)
2024-01-12T01:59:55Z DEBUG split_tokens() takes exactly 1 argument (2 given)
2024-01-12T01:59:55Z ERROR In unattended mode without a One Time Password (OTP) or without --ca-cert-file
You must specify --force to retrieve the CA cert using HTTP
2024-01-12T01:59:55Z ERROR Cannot obtain CA certificate

From my research it appears that this is to blame https://alas.aws.amazon.com/AL2/ALAS-2024-2406.html (python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition. (CVE-2021-46823))

Expected behavior

ipa-client-install should install correctly like it does with the previous version of the python package (2.4.15-2.amzn2.0.2)

Version/Release/Distribution

Client Machine:
ipa-client-4.6.8-5.amzn2.4.2.x86_64

IPA server
package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.6.8-5.el7.centos.15.x86_64
ipa-client-4.6.8-5.el7.centos.15.x86_64
389-ds-base-1.3.11.1-3.el7_9.x86_64
pki-ca-10.5.18-27.el7_9.noarch
krb5-server-1.15.1-55.el7_9.x86_64

Additional info:

Apologies in advance if this isn't so much a freeipa issue as it is an AL2 one, but i wanted to get this published somewhere in case someone else ran into this issue. Essentially ipa-client-install is broken on the latest set of security updates by AL2 due to this python-ldap package update - given amazon is back-porting python2 fixes i'm unsure who's really the best person to fix this.. If the IPA team want to point me in the right dr'n i'd be happy to file this somewhere else.

In the meantime downgrading / pinning the python-ldap package fixes the problem

Log file locations: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/config-files-logs.html
Troubleshooting guide: https://www.freeipa.org/page/Troubleshooting

This is affecting us as well. I've filed an issue with AWS support.

It's hard to tell what exactly went wrong the with AL security update. The ALAS page has no link to the source RPM or patch set. I guess the update is missing the first have of commit https://github.com/python-ldap/python-ldap/commit/22528752893a090adbc8f00a48cb04e2cc97df10 . Could you please post the Python traceback from the ipaclient-install.log file?

I also raised this with our AWS rep who said they were gonna pass it along to the AL2 team...

Also if you're currently using AWS and IPA (like we are) please leave a comment on the upcoming AL2023 project about IPA support https://github.com/amazonlinux/amazon-linux-2023/issues/36

Be good to get some more voices behind making sure it gets picked up when we're forced to move when AL2 goes EOL.

AWS Support came back:

At this moment, I can confirm that the internal team is already aware of this issue and working on the resolution which would be released tentatively within next 2 weeks with the latest package update.

Thanks for the suggestion @matt-james-fed . I'm very hesitant to move to AL2023 and that would be a dealbreaker for me. I'll have to follow that issue.

Thank you, @matt-james-fed , for filing a ticket as a reference. I'm closing it since there isn't much to do in the FreeIPA project. Even though the ticket is closed, it still serves its original purpose: to be used as a reference.

Metadata Update from @ftrivino:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.