Project

General

Profile

Bug #34613

foreman-proxy does not log permissions errors when trying to read ssl_ca.pem

Added by Adam Ruzicka 4 months ago. Updated 4 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
SSL
Target version:
-
Difficulty:
Triaged:
No
Bugzilla link:
Fixed in Releases:
Found in Releases:

Description

Description of problem:
If somehow the permissions of the file /etc/foreman-proxy/ssl_ca.pem are wrong in a way that the user foreman-proxy can't read it, multiple services will stop working due to the impossibility for the foreman-proxy daemon to validate client certificates sent by foreman when trying to communicate with it.

However, the error that will be returned is completely misleading only saying that it's unable to get local issuer certificate when in fact it simply can't read a file.

Version-Release number of selected component (if applicable):

I check on Satellite 6.10 (foreman-proxy-2.5.2-1.el7sat.noarch) and Satellite 6.9 (foreman-proxy-2.3.1-1.el7sat.noarch)

How reproducible:

Always

Steps to Reproduce:
1. Change the permissions of the file /etc/foreman-proxy/ssl_ca.pem:

~~
chmod 600 /etc/foreman-proxy/ssl_ca.pem
~
~

2. Restart foreman-proxy service:

~~
systemctl restart foreman-proxy
~
~

3. Try making a request that needs certificate validation:

~~~
  1. curl --cacert /etc/foreman/proxy_ca.pem --cert /etc/foreman/client_cert.pem --key /etc/foreman/client_key.pem https://$(hostname -f):9090/logs
    curl: (35) Peer does not recognize and trust the CA that issued your certificate.
    ~~~

Actual results:
Returns an SSL error to the user and to the logs.

Expected results:
Return an generic SSL error to the user, but on the logs it should be clear that the file couldn't be read.

Additional info:

Associated revisions

Revision f7553f7d (diff)
Added by Adam Ruzicka 4 months ago

Fixes #34613 - Verify SSL CA file is readable on startup

History

#1 Updated by Adam Ruzicka 4 months ago

  • Bugzilla link set to 2052076

#2 Updated by The Foreman Bot 4 months ago

  • Status changed from New to Ready For Testing
  • Pull request https://github.com/theforeman/smart-proxy/pull/827 added

#3 Updated by The Foreman Bot 4 months ago

  • Fixed in Releases 3.3.0 added

#4 Updated by Anonymous 4 months ago

  • Status changed from Ready For Testing to Closed

Also available in: Atom PDF