April 2013 - Pki-devel - Dogtag Pki List Archives

by Endi Sukma Dewata

The /etc/pki/pki.conf has been restored. The upgrade tracker now will be appended to pki.conf on fresh installation. -- Endi S. Dewata

11 years, 6 months

1
2
0 / 0

AVCs for Dogtag 10.0.2 RA and TPS . . .

by Matthew Harmsen

Ade, I successfully installed a CA, KRA, OCSP, and TKS using command-line pkispawn with a configuration file. Thus far, I have provided a Karma point for TPS and for RA; currently having trouble with pki-console (due to my X Display not working, not the package itself). Once you re-spin pki-core, I can perform a GUI install of these subsystems and provide a karma point for both pki-coreand dogtag-pki-theme (once I confirm that console is working). After this, in order to confirm that dogtag-pki is working, I will need to remove all of the packages from my system and configure it to point to the appropriate test repo to make certain that it will grab the correct versions of Dogtag. Per your request, here are the TPS and RA AVC's showing up in the audit.log (I installed the TPS prior to the RA without cleaning the audit log):* * *TPS:* *# getenforce* Permissive *# cat /var/log/audit/audit.log | audit2allow -R* require { type httpd_suexec_exec_t; type pki_tps_t; class file { read getattr execute }; } #============= pki_tps_t ============== allow pki_tps_t httpd_suexec_exec_t:file { read getattr execute }; files_manage_generic_tmp_dirs(pki_tps_t) files_manage_generic_tmp_files(pki_tps_t) *RA:* *# getenforce* Permissive *# cat /var/log/audit/audit.log | audit2allow -R* require { type pki_tps_t; type pki_ra_t; type httpd_suexec_exec_t; class file { getattr read execute }; } #============= pki_ra_t ============== allow pki_ra_t httpd_suexec_exec_t:file { read getattr execute }; files_manage_generic_tmp_dirs(pki_ra_t) files_manage_generic_tmp_files(pki_ra_t) #============= pki_tps_t ============== allow pki_tps_t httpd_suexec_exec_t:file { read getattr execute }; files_manage_generic_tmp_dirs(pki_tps_t) files_manage_generic_tmp_files(pki_tps_t) -- Matt

11 years, 6 months

1
0
0 / 0

[PATCH] 247 Fixed undefined PKIException.

by Endi Sukma Dewata

The pki.server module has been fixed to include the module name of the PKIException. -- Endi S. Dewata

11 years, 6 months

1
1
0 / 0

[PATCH] 246 Fixed undefined BASE_DIR.

by Endi Sukma Dewata

The pki.server module has been fixed to include the module name of the BASE_DIR. -- Endi S. Dewata

11 years, 6 months

1
1
0 / 0

[PATCH] 245 Added upgrade scriptlet to add JNI_JAR_DIR.

by Endi Sukma Dewata

A new upgrade scriptlet has been added to add JNI_JAR_DIR into pki.conf. The code to manipulate property files has been refactored from PKIUpgradeTracker into a separate PropertyFile class to allow reuse. The pki-base package has been modified to deliver a default pki.conf in /usr/share/pki/etc and copy it into /etc/pki if it doesn't exist. -- Endi S. Dewata

11 years, 6 months

1
1
0 / 0

[PATCH] 244 Fixed server upgrade problem on new installation.

by Endi Sukma Dewata

The PKIServerUpgrader.get_current_version() incorrectly returns None if there is no instance on the system. It has been modified to return the target version so that no upgrade operation will occur. Bugzilla #957690 -- Endi S. Dewata

11 years, 6 months

1
1
0 / 0

[PATCH] 243 Reverting to old CLI behavior on client database initialization.

by Endi Sukma Dewata

Recently the CLI was changed to initialize the default client database automatically which will create it if it did not exist before. This was causing a problem since the database was not created with a password. To create the database properly a separate command is needed. For now the CLI is reverted to the old behavior where it initializes the database only if it requires for SSL connection and/or client authentication. -- Endi S. Dewata

11 years, 6 months

2
1
0 / 0

[PATCH] 242 Added separate CLI option for client database password.

by Endi Sukma Dewata

Previously the -w option is used to specify the password for either the username/password authentication or client database password to do client certificate authentication. Since the passwords now may be used at the same time, a new -c option has been added for the client database password. -- Endi S. Dewata

11 years, 6 months

2
1
0 / 0

[PATCH] 241 Ignoring warnings/errors during installation.

by Endi Sukma Dewata

The code used by pkispawn and pkidestroy has been modified to ignore certificate validity warnings/errors that happens during installation. The instanceCreationMode is now redundant and has been removed from ClientConfig. -- Endi S. Dewata

11 years, 6 months

2
1
0 / 0

[PATCH] 240 Replaced ~/.pki with ~/.dogtag.

by Endi Sukma Dewata

The default folder for to store user files in the home directory has been changed from .pki to .dogtag. -- Endi S. Dewata

11 years, 6 months

1
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

Pki-devel April 2013