March 2016 - Pki-devel - Dogtag PKI List Archives

[pki-devel][PATCH]0061-Enhance-tkstool-for-capabilities-and-security.patch
by John Magne 12 May '16

12 May '16

Enhance tkstool for capabilities and security This simple ticket is to fix tkstool to allow it to create the master key with the proper flags to make the key data private such that it can't be easily viewed when using tools to print out sym keys on the token. Fix tested on the "internal" token by trying the various tkstool cmds to make sure having the key private does not cause issues. Also tried a simple key changeover operation with tpsclient to make sure that symkey can still do what it needs to do witht the master key. Further testing with a full hsm will be required. The goal was the create the key with the same flags that are used with the previous "PK11_GenKeyOnToken" (name approx) is used. This version had no flags and created a default set. This fix uses the version With flags and does what the old one did, but made sure the key is private and sensitive. Master key can be tested by using the tool: /usr/lib64/nss/unsupported-tools/symkeyutil -d ./ -L

2 2

[PATCH] 0084..0086 Lightweight CA replication support
by Fraser Tweedale 03 May '16

03 May '16

Hi all, The attached patches implement replication support for lightweight CAs. These patches do not implement key replication via Custodia (my next task) but they do implement the persistent search thread and appropriate** API behaviour when the signing keys are not yet available. ** In most cases, we respond 503 Service Unavailable; this is open for discussion. ca-authority-find and ca-authority-show include a boolean field indicating whether the CA is ready to sign. There might be (probably are) endpoints I've missed. Cheers, Fraser

3 22

[PATCH] 705 Fixed KRA install problem.
by Endi Sukma Dewata 30 Mar '16

30 Mar '16

Currently when installing an additional subsystem to an existing instance the install tool always generates a new random password in the pki_pin property which would not work with the existing NSS database. The code has been modified to load the existing NSS database password from the instance if the instance already exists. The PKIInstance class has been modified to allow loading partially created instance to help the installation. https://fedorahosted.org/pki/ticket/2247 -- Endi S. Dewata

1 1

[PATCH] 704 Install tools clean-up.
by Endi Sukma Dewata 30 Mar '16

30 Mar '16

Some variables in pkispawn and pkidestroy have been renamed for clarity. The unused PKI_CERT_DB_PASSWORD_SLOT variable has been removed. The constant pki_self_signed_token property has been moved into default.cfg. https://fedorahosted.org/pki/ticket/2247 -- Endi S. Dewata

1 1

Lightweight CAs key replication design
by Fraser Tweedale 29 Mar '16

29 Mar '16

Hi team, Lightweight CA key replication is taking shape. I have updated the design page with juicy details: http://pki.fedoraproject.org/wiki/Lightweight_sub-CAs#Key_replication Could interested parties and Simo please eyeball it. Simo, I particularly want your feedback on feasibility / implications of creating a Kerberos principal for each CA replica which will be authorised as a Custodia client to retrieve sub-CA signing keys. Alternatively, instead of adding another principal could we use the existing HTTP/<hostname>@<realm> principal as the Custodia client? I entertained implementing TLS certificate authentication for Custodia so that we could authenticate using e.g. CA subsystem cert but felt that GSS-API would be a smoother path, becaues we already have Python client code for IPA. The implementation is in-progress; most of the core Java bits are done, but not yet the IPA-specific KeyRetriever implementation nor the Python helper program. Cheers, Fraser P.S. I made a number of other updates to the design page - mostly updates to bring it in line with what's already been implemented.

2 1

[PATCH] 703 Fixed certificate chain import problem.
by Endi Sukma Dewata 29 Mar '16

29 Mar '16

In the external CA case if the externally-signed CA certificate is included in the certificate chain the CA certificate may get imported with an incorrect nickname. The code has been modified such that the certificate chain is imported after the CA certificate is imported with the proper nickname. https://fedorahosted.org/pki/ticket/2022 ACKed by mharmsen (thanks!). Pushed to master. -- Endi S. Dewata

1 0

[PATCH] pki-cfu-0116-Ticket-1006-Audit-logging-for-TPS-REST-operations.patch
by Christina Fu 28 Mar '16

28 Mar '16

Attached please find the patch for ticket 1006: https://fedorahosted.org/pki/ticket/1006 Audit logging for TPS REST operations Most of the work is on 1. finding the right places to place the audit calls 2. deciding on what should be audited: since all read operations are captured by AUTZ, the REST operations audited are only write operations 3. deciding on the audit events that should be provided for the operations 4. making needed information available at the places where auditing is happening thanks Christina

2 2

[PATCH] 701 Generating TEMP_LOST to UNINITIALIZED/ACTIVE transitions dynamically.
by Endi Sukma Dewata 28 Mar '16

28 Mar '16

The TPS subsystem has been modified to generate the token state transitions from TEMP_LOST to UNINITIALIZED or ACTIVE dynamically depending on whether the token has certificates. The TEMP_LOST to ACTIVE transition has been removed from the CS.cfg. Duplicate code that loads the allowed transitions list has been merged and moved into TPSSubsystem. https://fedorahosted.org/pki/ticket/1808 -- Endi S. Dewata

1 1

[PATCH] 699 Fixed exception handling in EnrollProfile.
by Endi Sukma Dewata 24 Mar '16

24 Mar '16

To help troubleshooting the EnrollProfile has been modified to log the stack trace and chain the exception. https://fedorahosted.org/pki/ticket/1654 -- Endi S. Dewata

2 2

Karma Request for new JSS and pki-core builds
by Matthew Harmsen 23 Mar '16

23 Mar '16

Everyone, New JSS builds have been created to address the following issues on Fedora 23, 24, and rawhide: * Bugzilla Bug #1289799 - JSS build failure on F23 and Rawhide <https://bugzilla.redhat.com/show_bug.cgi?id=1289799> * Bugzilla Bug #1307675 - jss: FTBFS in rawhide <https://bugzilla.redhat.com/show_bug.cgi?id=1307675> Please provide Karma for the following Fedora 23 and Fedora 24 builds: * jss-4.2.6-38.fc23 <https://bodhi.fedoraproject.org/updates/FEDORA-2016-3ff40d98cc> * jss-4.2.6-38.fc24 <https://bodhi.fedoraproject.org/updates/FEDORA-2016-477bda1dea> Additionally, a new pki-core build has been created on both Fedora 24 and rawhide to address the following tickets: * PKI TRAC Ticket #1625 - Allow multiple ACLs of same name (union of rules) [ftweedal] <https://fedorahosted.org/pki/ticket/1625> * PKI TRAC Ticket #2237 - Add CRL dist points extension to OIDMap unconditionally [ftweedal] <https://fedorahosted.org/pki/ticket/2237> * PKI TRAC Ticket #1803 - Removed unnecessary URL encoding for admin cert request. [edewata] <https://fedorahosted.org/pki/ticket/1803> * PKI TRAC Ticket #1742 - Added support for cloning 3rd-party CA certificates. [edewata] <https://fedorahosted.org/pki/ticket/1742> * PKI TRAC Ticket #1482 - Added TPS token filter dialog. [edewata] <https://fedorahosted.org/pki/ticket/1482> * PKI TRAC Ticket #1808 - Fixed illegal token state transition via TEMP_LOST. [edewata] <https://fedorahosted.org/pki/ticket/1808> Please provide Karma for the following Fedora 24 build: * pki-core-10.3.0.a1-2.fc24 <https://bodhi.fedoraproject.org/updates/FEDORA-2016-ab37b3732d> Thanks, -- Matt

1 0