ipa-client-install: add support for sss_ssh_knownhosts

[f-trivino]

sss_ssh_knownhostsproxy will be deprecated in favor of sss_ssh_knownhosts. With this update, if the file /usr/bin/sss_ssh_knownhosts is present, it will be used instead of /usr/bin/sss_ssh_knownhostsproxy. This commit also implements a mechanism to apply the change when upgrading from older versions.

Fixes: https://pagure.io/freeipa/issue/9536

[flo-renaud]

@f-trivino the failure of test_commands is related to feb 29, please see 9548. Re-run the test tomorrow and it should succeed.

[f-trivino]

@flo-renaud thank you for the pointer! Yeah, I noticed that the error wasn't related to the PR. I'll rerun it tomorrow so I can test this code "Without" sss_ssh_knownhosts feature (sssd-2-10), then will wait till sss_ssh_knownhosts is in place and re-run again so I test the "With".

[rcritten]

Looks like there is a usage error in test_integration/test_commands.py::TestIPACommand::test_sss_ssh_authorizedkeys and est_integration/test_sssd.py::TestNestedMembers::test_nested_group_members

Usage: sss_ssh_knownhosts [-?] [-?|--help] [--usage] [-d|--domain=STRING]
HOST

I wonder if the credentials revoked failure in test_integration/test_commands.py::TestIPACommand::test_reset_password_unlock is related to too many failed authentications.

[f-trivino]

Looks like there is a usage error in test_integration/test_commands.py::TestIPACommand::test_sss_ssh_authorizedkeys and est_integration/test_sssd.py::TestNestedMembers::test_nested_group_members

Usage: sss_ssh_knownhosts [-?] [-?|--help] [--usage] [-d|--domain=STRING] HOST

I wonder if the credentials revoked failure in test_integration/test_commands.py::TestIPACommand::test_reset_password_unlock is related to too many failed authentications.

thanks @rcritten , thanks to @aplopez I found out that the new arg for KnownHostsCommand is: "%H" instead of "-p %p %h". Fixed now.

[aplopez]

LGTM from the SSSD side.

[f-trivino]

Tests from temp_commit are passing. I'm adding links here just for reference:

sssd-fedora/build — (^_^)/
Details
@freeipa-pr-ci
sssd-fedora/test_commands —
Details
@freeipa-pr-ci
sssd-fedora/test_sssd —
Details

[f-trivino]

I have a worry about upgrades. What if ipa-client gets upgraded before the sssd-common package. In that case, the old ssh_ipa.conf will persist in the system even after sssd is updated, and the new sss_ssh_knownhosts file is present.

[flo-renaud]

I have a worry about upgrades. What if ipa-client gets upgraded before the sssd-common package. In that case, the old ssh_ipa.conf will persist in the system even after sssd is updated, and the new sss_ssh_knownhosts file is present.

The spec file can use %triggerin client -- sssd-common >= 2.10 as defined in https://rpm-software-management.github.io/rpm/manual/triggers.html

[aplopez]

For this particular case, I think it could be better to user file triggers (%filetriggerin).

https://rpm-software-management.github.io/rpm/manual/file_triggers.html

%filetriggerin -n %{name}-common -- /usr/bin
echo "TRIGGERING freeipa-common script"
if [ -x /usr/bin/sss_ssh_knownhosts ]; then
    echo "File installed"
fi

This example script is executed every time freeipa-client is installed and there is a file in /usr/bin (always), but it is also executed when another RPM installs a file in /usr/bin. It is not possible to know which file was installed and it can be invoked more than once.

Documentation always mentions file prefixes as condition. I tried with the full file path and it worked for RPM removal (%filetriggerpostun) but not for installation. I don' t know if this is a bug or a feature.

[flo-renaud]

Hi @f-trivino,
Please find inline comments.

[flo-renaud]

Hi @f-trivino
thanks for the PR. I have 2 minor nitpicks (line length) but otherwise the fix looks good to me. I tested upgrade of ipa-client then sssd-client or sssd-client then ipa-client, as well as downgrade of sssd-client, we have the expected output.
New installation also properly handles the sssd version.

[flo-renaud]

Please add a line break instead of ignoring the linter error

[f-trivino]

fixed

[flo-renaud]

Please add a line break instead of ignoring the linter error

[f-trivino]

fixed

[f-trivino]

Hi @f-trivino thanks for the PR. I have 2 minor nitpicks (line length) but otherwise the fix looks good to me. I tested upgrade of ipa-client then sssd-client or sssd-client then ipa-client, as well as downgrade of sssd-client, we have the expected output. New installation also properly handles the sssd version.

thanks for testing all use cases. I do agree that lines can be broken while maintaining readability, fixed.

[f-trivino]

For this particular case, I think it could be better to user file triggers (%filetriggerin).

https://rpm-software-management.github.io/rpm/manual/file_triggers.html

%filetriggerin -n %{name}-common -- /usr/bin
echo "TRIGGERING freeipa-common script"
if [ -x /usr/bin/sss_ssh_knownhosts ]; then
    echo "File installed"
fi

This example script is executed every time freeipa-client is installed and there is a file in /usr/bin (always), but it is also executed when another RPM installs a file in /usr/bin. It is not possible to know which file was installed and it can be invoked more than once.

Documentation always mentions file prefixes as condition. I tried with the full file path and it worked for RPM removal (%filetriggerpostun) but not for installation. I don' t know if this is a bug or a feature.

thanks @aplopez , I finally opted for

triggerin client -- sssd-common < 2.10
...
triggerin client -- sssd-common >= 2.10
...

as filetriggerin would react for all file changes in /usr/bin

[flo-renaud]

master:

• 7d54a6d ipa-client-install: add support for sss_ssh_knownhosts
• b34525c Spec file: add support for sss_ssh_knownhosts