freeipa.git/ipaplatform/debian, branch fix_ber_scanf

Use only TLS 1.2 by default

2019-07-01T12:55:29+00:00

TLS 1.3 is causing some trouble with client cert authentication.
Conditional client cert authentication requires post-handshake
authentication extension on TLS 1.3. The new feature is not fully
implemented yet.

TLS 1.0 and 1.1 are no longer state of the art and now disabled by
default.

TLS 1.2 works everywhere and supports PFS.

Related: https://pagure.io/freeipa/issue/7667

Signed-off-by: Christian Heimes 
Reviewed-By: Rob Crittenden

For Fedora and RHEL use system-wide crypto policy for mod_ssl

2019-07-01T12:55:29+00:00

Drop the SSLProtocol directive for Fedora and RHEL systems. mod_ssl
will use crypto policies for the set of protocols.

For Debian systems configure a similar set of protocols for what
was previously configured, but do it in a different way. Rather than
iterating the allowed protocols just include the ones not allowed.

Fixes: https://pagure.io/freeipa/issue/7667

Signed-off-by: Rob Crittenden 
Reviewed-By: Rob Crittenden

Add helper to look for missing binaries

2019-04-26T10:47:51+00:00

Fedora has merged /usr/bin and /bin while Debian uses distinct
directories for /usr/bin and /bin. Debian also uses different directory
for libexec files.

A new paths.check_paths() helper makes it easier to detect missing or
wrong paths.

Signed-off-by: Christian Heimes 
Reviewed-By: Alexander Bokovoy

Globally disable softhsm2 in p11-kit-proxy

2019-04-25T10:53:08+00:00

The p11-kit configuration injects p11-kit-proxy into all NSS databases.
Amongst other p11-kit loads SoftHSM2 PKCS#11 provider. This interferes
with 389-DS, certmonger, Dogtag and other services. For example certmonger
tries to open OpenDNSSEC's SoftHSM2 token, although it doesn't use it at
all. It also breaks Dogtag HSM support testing with SoftHSM2.

IPA server does neither need nor use SoftHSM2 proxied by p11-kit.

Related: https://pagure.io/freeipa/issue/7810
Signed-off-by: Christian Heimes 
Reviewed-By: Alexander Bokovoy

Debian: Use RedHatCAService for pki-tomcatd

2019-04-24T12:08:20+00:00

The RedHatCAService service class contains extra logic to wait for CA
service to be up and running. Debian now correctly waits for Dogtag before
proceeding with the installation process.

Fixes: https://pagure.io/freeipa/issue/7916
Signed-off-by: Christian Heimes 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Rob Crittenden

Debian: Fix replicatio of light weight sub CAs

2019-04-24T12:08:20+00:00

The path to ipa-pki-retrieve-key was hard-coded, which broke replication
of light weight sub CA keys.

Signed-off-by: Christian Heimes 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Rob Crittenden

Add ODS manager abstraction to ipaplatform

2019-04-24T12:08:20+00:00

OpenDNSSEC 1.4 and 2.x use different commands to initialize kasp.db and
manage zones. ipaplatform.tasks abstracts the commands.

Note: I added the logic to the base task instead of having different
implementations for Red Hat and Debian platforms. Eventually Fedora is
going to move to OpenDNSSEC 2.x, too. The design will make it easier to
support OpenDNSSEC 2.x on Fedora.

Signed-off-by: Christian Heimes 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Rob Crittenden

Debian: Use different paths for KDC cert and key

2019-04-24T12:08:20+00:00

Co-authored-by: Timo Aaltonen 
Signed-off-by: Christian Heimes 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Rob Crittenden

Debian: Add fixes for OpenDNSSEC 2.0

2019-04-24T12:08:20+00:00

Debian/Ubuntu use OpenDNSSEC 2.0, which has different commands to manage
zones and keys.

Co-authored-by: Timo Aaltonen 
Signed-off-by: Christian Heimes 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Rob Crittenden

Debian: Add paths for open-sans and font-awesome

2019-04-24T12:08:20+00:00

Debian has different paths and path suffix for font-awesome. Let's have
explicit paths for all our fonts.

Co-authored-by: Timo Aaltonen 
Signed-off-by: Christian Heimes 
Reviewed-By: Alexander Bokovoy 
Reviewed-By: Rob Crittenden