[Bug 690585] New: dhcpd: Copy certificates to chroot when using ldaps/start_tls
https://bugzilla.novell.com/show_bug.cgi?id=690585 https://bugzilla.novell.com/show_bug.cgi?id=690585#c0 Summary: dhcpd: Copy certificates to chroot when using ldaps/start_tls Classification: openSUSE Product: openSUSE 11.4 Version: Final Platform: Other OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: joschibrauchle@gmx.de QAContact: qa@suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.205 Safari/534.16 When running a DHCPD in chroot, which is configured to connect to a LDAP server that is secured with TLS or LDAPS, the DHCPD does not start because it is missing the required certificates for the SSL/TLS operation. My /etc/dhcpd.conf contains: ------------ .. ldap-ssl ldaps; ldap-tls-ca-file "/etc/ssl/myCA.pem"; #ldap-ssl start_tls; ldap-tls-reqcert hard; #ldap-tls-ca-dir "/etc/ssl"; #ldap-tls-cert #ldap-tls-key #ldap-tls-crlcheck #ldap-tls-ciphers #ldap-tls-randfile .. ------------ So I am using LDAPS, and the DHCPD needs access to "/etc/ssl/myCA.pem" in order to check the LDAP certificate. Thus, all files specified in the directives: - ldap-tls-ca-file - ldap-tls-ca-dir - ldap-tls-cert - ldap-tls-key - ldap-tls-randfile should be copied to the chroot in case they are not empty. The files can be force to be copied to the chroot with the "DHCPD_CONF_INCLUDE_FILES" variable in "/etc/sysconfig/dhcpd", thus in my case: -------- DHCPD_CONF_INCLUDE_FILES="/etc/ssl/myCA.pem" -------- I just think the init script COULD take care of this automatically, sparing the user a LOT of headaches... :-) Reproducible: Always Steps to Reproduce: 1. Configure DHCP to use CHROOT 2. Configure DHCP to use LDAPS with path to CA cert in dhcpd.conf 3. Start DHCPD Actual Results: Start fails with connection error, as LDAP cert cannot be checked due to missing CA cert. Expected Results: Init script should copy the needed certs and DHCP should start normally. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=690585 https://bugzilla.novell.com/show_bug.cgi?id=690585#c1 --- Comment #1 from Joschi Brauchle <joschibrauchle@gmx.de> 2011-04-28 14:33:56 UTC --- BTW: The DHCP server can be configured this way via YAST to exhibit this behavior (i.e. failing at start). Thus it's not only a "convenience" bug... Either YaST should set the DHCPD_CONF_INCLUDE_FILES variable correctly or the init script should copy the files automatically. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=690585 https://bugzilla.novell.com/show_bug.cgi?id=690585#c zj jia <zjjia@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |zjjia@novell.com AssignedTo|bnc-team-screening@forge.pr |varkoly@novell.com |ovo.novell.com | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=690585 https://bugzilla.novell.com/show_bug.cgi?id=690585#c2 --- Comment #2 from Bernhard Wiedemann <bwiedemann@suse.com> 2011-09-06 17:00:14 CEST --- This is an autogenerated message for OBS integration: This bug (690585) was mentioned in https://build.opensuse.org/request/show/81102 Factory / dhcp -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=690585 https://bugzilla.novell.com/show_bug.cgi?id=690585#c3 Peter Varkoly <varkoly@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution| |FIXED --- Comment #3 from Peter Varkoly <varkoly@suse.com> 2011-09-08 11:29:58 UTC --- This is a manual change in the configuration. If you do so, you have to modify DHCPD_CONF_INCLUDE_FILES also. In the newest version of dhcp-server there is /etc/dhcpd.d as default in DHCPD_CONF_INCLUDE_FILES. I.e. if you copy the certificat file there it will be copied automatically. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠novell.com