dogtagpki

#1267 Parameter pki_client_database_purge not working as expected
Closed: Invalid Opened by mharmsen.

Closed: Invalid
Reopen Issue

The client database directory id the location where an NSS token database is
created in order to generate a key for the administrative user. Usually, the
data in this location is removed at the end of the installation, as the keys
and certificates are stored in a PKCS #12 file in pki_client_dir and the
parameter pki_client_database_purge is set to true to carry out the removal of this directory, but even after setting the parameter to true the database is not purged at the end of install and the caadmincert can still be seen in the db using certutil command.

Steps to Reproduce:

1. Install Root CA with the above mentioned parameter set to true
2. the client database directory exists, do a certutil on the client database
directory
3. the client admin cert can be seen in the directory

Actual results:

The database still exists at the end of install and we can see the caadmin cert
after doing a certutil on the nssdb

Expected results:

The db should be removed at the end of install

Per 10.2.3 Triage meeting of 02/26/2015: 10.2.3

Tested on 64-bit Fedora 21 machine with the following packages:

  • pki-symkey-10.2.3-2.fc21.x86_64
  • pki-server-10.2.3-2.fc21.noarch
  • pki-tks-10.2.3-2.fc21.noarch
  • pki-base-10.2.3-2.fc21.noarch
  • pki-javadoc-10.2.3-2.fc21.noarch
  • dogtag-pki-server-theme-10.2.3-2.fc21.noarch
  • pki-ca-10.2.3-2.fc21.noarch
  • pki-tps-10.2.3-2.fc21.x86_64
  • pki-tools-10.2.3-2.fc21.x86_64
  • pki-console-10.2.3-1.fc21.noarch
  • pki-ocsp-10.2.3-2.fc21.noarch
  • pki-kra-10.2.3-2.fc21.noarch

grep pki_client_dir /etc/pki/default.cfg

pki_client_dir=%(home_dir)s/.dogtag/%(pki_instance_name)s

grep pki_client_database_purge /etc/pki/default.cfg

pki_client_database_purge=True

ls -l /root/.dogtag

Total 0

cat /root/pki/ca.cfg

[DEFAULT]
pki_admin_password=
pki_client_pkcs12_password=
pki_ds_password=

pkispawn -s CA -f /root/pki/ca.cfg -vvv

ls -l /root/.dogtag/pki-tomcat

total 12
-rw-rw----. 1 root root 1362 Apr 29 19:36 ca_admin.cert
-rw-rw----. 1 root root 989 Apr 29 19:36 ca_admin.cert.der
-rw-------. 1 root root 2821 Apr 29 19:36 ca_admin_cert.p12

NOTE: The NSS client security databases were properly purged as advertised.

Bugzilla Bug #1165873 - Parameter pki_client_database_purge not working as expected was re-opened for this issue, as it was believed that relocation of the client database disallowed it from being purged.

The following explanation was given in comment #5 of the bug, and it was re-closed as NOT A BUG:

Okay, I replicated the issue, but do not consider it a bug.
Basically, I created the following CA override configuration file:
    [DEFAULT]
    pki_admin_password=Secret123
    pki_client_pkcs12_password=Secret123
    pki_ds_password=Secret123
    pki_client_dir=/opt/rhqa_pki
    pki_client_admin_cert_p12=/opt/rhqa_pki/caadmincert.p12
    pki_client_database_dir=/opt/rhqa_pki/certs_db
    pki_client_database_password=Secret123
    pki_client_database_purge=True
This replicates the issue described.
The 'default' values of interest that are being overridden are:
    pki_client_dir=%(home_dir)s/.dogtag/%(pki_instance_name)s
    pki_client_database_dir=%(pki_client_subsystem_dir)s/alias
with:
    pki_client_dir=/opt/rhqa_pki
    pki_client_database_dir=/opt/rhqa_pki/certs_db
Note that the following value is NOT being overridden:
    pki_client_subsystem_dir=%(pki_client_dir)s/%(pki_subsystem_type)s
which will be mapping to:
    pki_client_subsystem_dir=/opt/rhqa_pki/ca
Looking at the code in
'pki/base/server/python/pki/server/deployment/scriptlets/finalization.py':
        # Optionally, 'purge' the entire temporary client infrastructure
        # including the client NSS security databases and password files
        #
        #     WARNING:  If the PKCS #12 file containing the Admin Cert was
        #               placed under this infrastructure, it may accidentally
        #               be deleted!
        #
        if config.str2bool(deployer.mdict['pki_client_database_purge']):
            if deployer.directory.exists(
                    deployer.mdict['pki_client_subsystem_dir']):
                deployer.directory.delete(
                    deployer.mdict['pki_client_subsystem_dir'])
Since 'pki_client_database_purge' deletes the entire temporary client
infrastructure (as described), the top-level variable of this temporary
infrastructure is still getting deleted
(e. g. - pki_client_subsystem_dir=/opt/rhqa_pki/ca).
Since the primary purpose of this test was to relocate the client
infrastructure (e. g. - pki_client_dir), a simple correction to the
CA override configuration file to make this work as intended would be to
simply replace:
    pki_client_database_dir=/opt/rhqa_pki/certs_db
with the proper intended override variable:
    pki_client_database_dir=%(pki_client_subsystem_dir)s/certs_db
which will map to:
    pki_client_database_dir=/opt/rhqa_pki/ca/certs_db
and when the system is installed with this correction,
it behaves exactly as specified.

Metadata Update from @mharmsen:
- Issue assigned to mharmsen
- Issue set to the milestone: 10.2.4

Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new
issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.

This issue has been cloned to GitHub and is available here:
https://github.com/dogtagpki/pki/issues/1829

If you want to receive further updates on the issue, please navigate to the
GitHub issue and click on Subscribe button.

Thank you for understanding, and we apologize for any inconvenience.
Metadata
None
None
None
Low
CA
QE
defect
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.