Bug 37509
| Summary: | 01_base.96rename_domain_admins: access-ssh.conf on Memberserver fails | ||
|---|---|---|---|
| Product: | UCS Test | Reporter: | Philipp Hahn <hahn> |
| Component: | General | Assignee: | Philipp Hahn <hahn> |
| Status: | CLOSED FIXED | QA Contact: | |
| Severity: | normal | ||
| Priority: | P5 | CC: | walkenhorst |
| Version: | unspecified | ||
| Target Milestone: | UCS 3.2-2-errata | ||
| Hardware: | Other | ||
| OS: | Linux | ||
| What kind of report is it?: | Development Internal | What type of bug is this?: | --- |
| Who will be affected by this bug?: | --- | How will those affected feel about the bug?: | --- |
| User Pain: | Enterprise Customer affected?: | ||
| School Customer affected?: | ISV affected?: | ||
| Waiting Support: | Flags outvoted (downgraded) after PO Review: | ||
| Ticket number: | Bug group (optional): | ||
| Max CVSS v3 score: | |||
| Bug Depends on: | 37971 | ||
| Bug Blocks: | |||
r57228 | Bug #37509 test: 01/96admins: Skip sshd on non-DCs Package: ucs-test Version: 5.0.82-5.922.201501091652 Branch: ucs_4.0-0 Scope: errata4.0-0 No YAML file needed. Still broken: <http://jenkins.knut.univention.de:8080/job/UCS-4.0/job/UCS-4.0-1/job/Autotest MultiEnv/SambaVersion=s3,Systemrolle=slave/32/testReport/01_base/96rename_domain_admins/test/> <http://jenkins.knut.univention.de:8080/job/UCS-4.0/job/UCS-4.0-1/job/Autotest%20MultiEnv/SambaVersion=s4,Systemrolle=backup/32/testReport/junit/01_base/96rename_domain_admins/test/> <http://jenkins.knut.univention.de:8080/job/UCS-4.0/job/UCS-4.0-1/job/Autotest%20MultiEnv/SambaVersion=s4,Systemrolle=slave/32/testReport/junit/01_base/96rename_domain_admins/test/> > error 2015-03-08 19:19:43 failed /etc/security/access-sshd.conf This is again caused by univention-pam being installed during system-setup, where the system in not DC yet. Afterwards the postinst is never executed again, so the UCRV auth/sshd/ are never set. I've created Bug #37971 to get univention-pam fixed. For this bug is no separate QA needed. |
The UCRVs auth/sshd/ are only set on DCs by univention-pam, not for member servers. As such "auth/sshd/group/Domain Admins=yes" is NOT set and the check fails: Checking whether new admin group name (lqxncaos) is set to /etc/security/access-sshd.conf: failed > ************** /etc/security/access-sshd.conf *************** > # /etc/univention/templates/files/etc/security/access-sshd.conf > +::ALL > -:ALL:ALL > **************************************** $ euca-run-instances -g sg-4170962e -k ph-test -z eu-west-1b --region eu-west-1 -t m3.medium -s subnet-f452539c ami-7e69da09 # UCS-3.2-4 $ ssh -i ph-test.pem -l root 10.210.189.16 "ucr search --brief --non-empty '^auth/sshd/|^version/'" auth/sshd/group/Administrators: yes auth/sshd/group/Computers: yes auth/sshd/group/DC Backup Hosts: yes auth/sshd/group/DC Slave Hosts: yes auth/sshd/group/Domain Admins: yes auth/sshd/restrict: yes auth/sshd/user/root: yes version/erratalevel: 241 version/patchlevel: 4 version/releasename: Borgfeld version/version: 3.2 $ euca-run-instances -g sg-4170962e -k ph-test -z eu-west-1b --region eu-west-1 -t m3.medium -s subnet-f452539c ami-08df6e7f # UCS-4.0-0 $ ssh -i ph-test.pem -l root 10.210.152.84 "ucr search --brief --non-empty '^auth/sshd/|^version/'" version/erratalevel: 0 version/patchlevel: 0 version/releasename: Walle version/version: 4.0 With UCS-3.2 the EC2 instance was previously always setup as a DC Master, before provisioning changes the to the target system role. With UCS-4.0 the EC2 instance is un-configured until provisioned. Therefore there univention-pam does NOT set the auth/sshd/ UCRVs.