freeipa

#6350 IDM admin password gets written to /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
Closed: Duplicate Opened by ftweedal.

Closed: Duplicate
Reopen Issue

IDM admin password gets written to /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf during installation. This file contains the passphrase for a backup of the Dogtag CA Agent certificate and key in
/root/ca-agent.p12.

The file is well protected by file system permissions but if it is
compromised we do not want the actor to get full control over IDM.

Version-Release number of selected component (if applicable):

How reproducible: always

Steps to Reproduce:
1. install IPA

Actual results:

The admin user's password appears in file /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf

Expected results:

The admin user's password should not appear in the file. If an actor gets access to the file, we do not want that actor to pivot to having full
control over IDM.

Additional info:

Proposed fix: randomly generate the password for this backup file.

According to Standa, this is handled in PR https://github.com/freeipa/freeipa/pull/484 - ticket #5695.

master:

  • 728a6bd4229ba170b2e94f216127b19d5d94e2ba Remove ra_db argument from CAInstance init
  • a39effed7603d66acd238e3142f4df8081ff7bc8 Remove DM password files after successfull pkispawn run

Metadata Update from @ftweedal:
- Issue assigned to ftweedal
- Issue set to the milestone: FreeIPA 4.5
Metadata
None
None
None
Normal
defect
IPA
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.