freeipa

#8129 Tests: Replace paramiko with OpenSSH
Closed: fixed by frenaud. Opened by cheimes.

Closed: fixed
Reopen Issue

Issue

Paramiko is not compatible with FIPS mode or system with strict crypto policies. Therefore we should not use Paramiko in tests. All tests should be rewritten to use OpenSSH client.

Affected Tests

  • test_ssh_key_connection in test_integration.test_commands
  • test_selinux_user_optimized in test_integration.test_user_permissions
  • ssh_2f users in test_integration.test_otp
  • keytab tests in test_webui

Suggested Solution

Since multiple tests use SSH it makes sense to create a simple API for the problem. The interface should support private key and password based logins. For password based logins we can use sshpass helper. To isolate from the testing environment, the API should use its own config file and directory for pubkey, privkey, known hosts file, and settings.

Metadata Update from @cheimes:
- Issue tagged with: fips, testblocker

master:

  • 20ef79c02cf321f3d35c0408b9bf5887c04b11fe Remove FIPS noise from SSHd
  • d153957990b7456d53af5903a0e62b2716f61183 FIPS: server key has different name in FIPS mode
  • 6a17a916728cef30f8f245ed77cc9e849b227fc8 Skip paramiko tests in FIPS mode

ipa-4-8:

  • 6ce6b53de376ff6338df318d37330d531725e1be Remove FIPS noise from SSHd
  • 9091290a3e813f491f99626db3d07cbfe99a1d99 FIPS: server key has different name in FIPS mode
  • 82a4faefd2c719a1e269733280f4141241d89b68 Skip paramiko tests in FIPS mode

Metadata Update from @fcami:
- Issue assigned to fcami

Metadata Update from @fcami:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/4938
- Issue set to the milestone: None (was: FreeIPA 4.8.3)

Metadata Update from @fcami:
- Custom field changelog adjusted to Paramiko is not compatible with FIPS mode, therefore convert most tests to using ssh directly. The only non-converted test is the 2-prompt OTP test because sshpass does not support 2-prompt password authentication.

Filed https://pagure.io/freeipa/issue/8431

master:

  • d5148c65412d92a7d586cefec66cbabb099fc22f tasks: add run_ssh_cmd
  • 73ae4c77f38a7453fa166a01a683c6cd638f2746 ipatests: test_commands: test_ssh_key_connection: Paramiko=>OpenSSH
  • 5cc7a2b703b1514112da1d93ee2e3edf24cfb1f7 ipatests: test_user_permissions: test_selinux_user_optimized Paramiko=>OpenSSH
  • 27ed8260ba6307fdc22beb10d6f25d13b336ded8 ipatests: test_commands: test_ssh_from_controller: refactor
  • 112386f76a4e3bfec9962013ac8ebaadf950ff6f ipatests: test_commands: test_ssh_from_controller: Paramiko=>OpenSSH
  • 326e13347c89f2a3287209e95e2b7cd00aa3d80c ipatests: test_commands: test_login_wrong_password: Paramiko=>OpenSSH
  • a9f055787ac389e4164f3de5369bade1d4b218b0 ipatests: ui_driver: convert run_cmd_on_ui_host to tasks.py::run_ssh_cmd
  • 763d3b059bccc37744764985b57d97554a2a6947 ipatests: test_otp: convert test_2fa_enable_single_prompt to run_ssh_cmd

ipa-4-8:

  • 034526a4bd6a9547cd394d19e5275d24f7f00362 tasks: add run_ssh_cmd
  • 326ddff25e8c45da5ae708e036bfa6315d449672 ipatests: test_commands: test_ssh_key_connection: Paramiko=>OpenSSH
  • 26e58031d1f0c63f6e62a59c52d1da80a85ce9bd ipatests: test_user_permissions: test_selinux_user_optimized Paramiko=>OpenSSH
  • 262a7121046132fbb7bb101ecf7d595814757819 ipatests: test_commands: test_ssh_from_controller: refactor
  • ee57dd230191be40a39ef9677b308dee35fa183e ipatests: test_commands: test_ssh_from_controller: Paramiko=>OpenSSH
  • 17759ec76aeac450ce9c85704b68100df75c8af5 ipatests: test_commands: test_login_wrong_password: Paramiko=>OpenSSH
  • 027d0bbe1c0bafc326815b6ecc224a8f8fc5bd55 ipatests: ui_driver: convert run_cmd_on_ui_host to tasks.py::run_ssh_cmd
  • b0d4db548cfa14fbc596a40e742db96cd9ec00bb ipatests: test_otp: convert test_2fa_enable_single_prompt to run_ssh_cmd

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @fcami:
- Custom field changelog adjusted to Paramiko is not compatible with FIPS mode, therefore convert most tests to using ssh directly. The only non-converted test is the 2-prompt OTP test because sshpass does not support 2-prompt password authentication ( https://pagure.io/freeipa/issue/8431 ). (was: Paramiko is not compatible with FIPS mode, therefore convert most tests to using ssh directly. The only non-converted test is the 2-prompt OTP test because sshpass does not support 2-prompt password authentication.)
Metadata

fips testblocker

None
None
Low
https://github.com/freeipa/freeipa/pull/4938
Paramiko is not compatible with FIPS mode, therefore convert most tests to using ssh directly. The only non-converted test is the 2-prompt OTP test because sshpass does not support 2-prompt password authentication ( https://pagure.io/freeipa/issue/8431 ).
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.