Add FIPS-token password of HTTPD NSS database #450
Conversation
stlaz
force-pushed
the
httpd_nsspassword
branch
from
57e65fe
to
289934c
Compare
ipaserver/install/certs.py
Outdated
| @@ -504,7 +504,10 @@ def create_password_conf(self): | |||
| f = open(self.pwd_conf, "w") | |||
| f.write("internal:") | |||
| pwdfile = open(self.passwd_fname) | |||
| f.write(pwdfile.read()) | |||
There was a problem hiding this comment.
If you are touching this, you can change thsi code to use with statement
stlaz
force-pushed
the
httpd_nsspassword
branch
from
289934c
to
984d80e
Compare
ipaserver/install/certs.py
Outdated
| f.write(password) | ||
| # make sure other processes can access the file contents ASAP | ||
| f.flush() | ||
| if os.path.exists(self.pwd_conf): |
There was a problem hiding this comment.
Why do you need to check presence of file that is actually created a few lines above?
There was a problem hiding this comment.
Sorry, I was doing something else and left some mess there.
stlaz
force-pushed
the
httpd_nsspassword
branch
from
984d80e
to
b88ef3f
Compare
|
I guess this is one approach to fix the problem. Would it be cleaner to pass in, or detect, FIPS mode, and only write out the token that will actually be used? |
|
That was my original approach to it but we had offline talk with @HonzaCholasta and got to the point that it might be better to do it this way. |
ipaserver/install/certs.py
Outdated
| f.write("internal:") | ||
| f.write(password) | ||
| f.write("\nNSS FIPS 140-2 Certificate DB:") | ||
| f.write(password) |
There was a problem hiding this comment.
I did not run into any issues with it not being there. It was not there when there was only the internal token so I assume there's no need for it here as well.
|
LGTM. I guess we don't have to bother with upgrade, given that you can turn on FIPS post-install, right? |
|
You shouldn't turn FIPS on post-install (is what I think you mean), correct. |
stlaz
force-pushed
the
httpd_nsspassword
branch
from
b88ef3f
to
9819e57
Compare
This change is required for httpd to function properly in FIPS https://fedorahosted.org/freeipa/ticket/5695
stlaz
force-pushed
the
httpd_nsspassword
branch
from
9819e57
to
618747e
Compare
|
Fixed upstream |
This change is required for httpd to function properly in FIPS
https://fedorahosted.org/freeipa/ticket/5695