Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ansible: make ovirt-vmconsole host certificate readable #561

Merged
merged 1 commit into from
Jul 28, 2022
Merged

ansible: make ovirt-vmconsole host certificate readable #561

merged 1 commit into from
Jul 28, 2022

Conversation

michalskrivanek
Copy link
Member

ovirt-vmconsole is running under its own user and need access to
certificates. This only worked till now since the certificates were
mistakenly opened to others, but now it prevents sshd to acess its host
key

mz-pdm
mz-pdm suggested changes Jul 28, 2022
View reviewed changes
Copy link
Member

@mz-pdm mz-pdm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This only worked till now since the certificates were mistakenly opened to others

I don't understand this sentence -- making the public certificate readable to everybody is what this patch does... Do you mean "all certificates"? Please make the text in the commit message clear, this is delicate stuff and is important to avoid any confusion.

...unner-service-project/project/roles/ovirt-host-deploy-vm-console-certificates/tasks/main.yml Outdated Show resolved Hide resolved
@michalskrivanek
ansible: make ovirt-vmconsole host certificate readable
1cf55c8 
ovirt-vmconsole is running under its own user and need access to
certificates. With umask 077 on engine these files are not readable by
group or others, and they are owned by root, so let's be explicit about
the desired target file mode.
@michalskrivanek
Copy link
Member Author

[root@ost-basic-suite-master-host-0 ~]# ls -l /etc/pki/ovirt-vmconsole/
total 12
-rw-r--r--. 1 root root 380 Jul 28 09:09 ca.pub
-r--------. 1 ovirt-vmconsole ovirt-vmconsole 1704 Jul 28 09:09 host-ssh_host_rsa
-rw-r--r--. 1 root root 1444 Jul 28 09:10 host-ssh_host_rsa-cert.pub

@michalskrivanek michalskrivanek changed the title ansible: set ovirt-vmconsole ownership on certificate files ansible: make ovirt-vmconsole host certificate readable Jul 28, 2022
@michalskrivanek
Copy link
Member Author

/ost

mwperina
mwperina approved these changes Jul 28, 2022
View reviewed changes
Copy link
Member

@mwperina mwperina left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1

@michalskrivanek
Copy link
Member Author

verified vmconsole on disa stig-enabled setup manually

@michalskrivanek
Copy link
Member Author

ost failed on a flaky test, i was able to resume and finish that run manually

@michalskrivanek michalskrivanek merged commit 5f6c866 into oVirt:master Jul 28, 2022
@michalskrivanek michalskrivanek deleted the fix-vmconsole branch July 28, 2022 11:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mz-pdm mz-pdm mz-pdm approved these changes

@mwperina mwperina mwperina approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@michalskrivanek @mz-pdm @mwperina