freeipa

#6880 Store GSSAPI session key in /var/run/httpd directory instead of /etc/httpd/alias
Closed: wontfix Opened by mbasti.

Closed: wontfix
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1443557

GSSAPI session key is not static configuration but dynamic data, thus it should be stored in /var/run/httpd to avoid SElinux issues.

Metadata Update from @mbasti:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1443557
- Issue set to the milestone: FreeIPA 4.5.1

Metadata Update from @mbasti:
- Issue assigned to mbasti

Does /var/run/httpd survive a reboot?

No

At worst, it would affect those sessions which were created before last reboot. I think we can afford that. Session max age is 1800 seconds right now so we are talking about 30 minutes difference.

Please don't.
At most you may want to store it in /var/lib/ipa/somewhere, but we do not want to break sessions (there are people using APIs from non-interactive scripts) just because you needed to restart a service/server quickly.
These keys are considered long term keys, and should not be thrown away at each reboot.

Restarting apache wouldn't be a problem. Rebooting server would only affect existing sessions of 1800 seconds long. Non-interactive scripts have to acquire session anyway, their inability to do so in a window of 30 minutes points to actual issues with the script.

master:

  • 2bab2d4963daa99742875f3633a99966bc56f5a3 Store GSSAPI session key in /var/run/ipa

ipa-4-5:

  • b2aa3ed0bc9f5385ab6e8b1720d9f1d33136e5dc Store GSSAPI session key in /var/run/ipa

Additional info from @simo:

Let me also add that:

the directory needs to be writable by the apache user as the key is created the first time the server is started
only the apache user must be able to read this key
Edited by mbabinsk

Metadata Update from @mbabinsk:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @mbabinsk:
- Issue status updated to: Open (was: Closed)

The fix was shown to be incorrect so I am reverting the patches and reopening issue:

ipa-4-5:

  • a4e1ab6c893182b8b3610c0b45120194be4a0376 Revert "Store GSSAPI session key in /var/run/ipa"

master:

  • 50f6883662e258b0335c8b3cb69946d6dcbf206c Revert "Store GSSAPI session key in /var/run/ipa"

Metadata Update from @pvoborni:
- Issue priority set to: blocker
- Issue tagged with: regression, testblocker

This was fixed on SElinux side.

Metadata Update from @mbasti:
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)
Metadata

regression testblocker

None
None
Lowest
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.