Univention Bugzilla – Bug 37509
01_base.96rename_domain_admins: access-ssh.conf on Memberserver fails
Last modified: 2017-02-02 15:13:09 CET
The UCRVs auth/sshd/ are only set on DCs by univention-pam, not for member servers. As such "auth/sshd/group/Domain Admins=yes" is NOT set and the check fails: Checking whether new admin group name (lqxncaos) is set to /etc/security/access-sshd.conf: failed > ************** /etc/security/access-sshd.conf *************** > # /etc/univention/templates/files/etc/security/access-sshd.conf > +::ALL > -:ALL:ALL > **************************************** $ euca-run-instances -g sg-4170962e -k ph-test -z eu-west-1b --region eu-west-1 -t m3.medium -s subnet-f452539c ami-7e69da09 # UCS-3.2-4 $ ssh -i ph-test.pem -l root 10.210.189.16 "ucr search --brief --non-empty '^auth/sshd/|^version/'" auth/sshd/group/Administrators: yes auth/sshd/group/Computers: yes auth/sshd/group/DC Backup Hosts: yes auth/sshd/group/DC Slave Hosts: yes auth/sshd/group/Domain Admins: yes auth/sshd/restrict: yes auth/sshd/user/root: yes version/erratalevel: 241 version/patchlevel: 4 version/releasename: Borgfeld version/version: 3.2 $ euca-run-instances -g sg-4170962e -k ph-test -z eu-west-1b --region eu-west-1 -t m3.medium -s subnet-f452539c ami-08df6e7f # UCS-4.0-0 $ ssh -i ph-test.pem -l root 10.210.152.84 "ucr search --brief --non-empty '^auth/sshd/|^version/'" version/erratalevel: 0 version/patchlevel: 0 version/releasename: Walle version/version: 4.0 With UCS-3.2 the EC2 instance was previously always setup as a DC Master, before provisioning changes the to the target system role. With UCS-4.0 the EC2 instance is un-configured until provisioned. Therefore there univention-pam does NOT set the auth/sshd/ UCRVs.
r57228 | Bug #37509 test: 01/96admins: Skip sshd on non-DCs Package: ucs-test Version: 5.0.82-5.922.201501091652 Branch: ucs_4.0-0 Scope: errata4.0-0 No YAML file needed.
Still broken: <http://jenkins.knut.univention.de:8080/job/UCS-4.0/job/UCS-4.0-1/job/Autotest MultiEnv/SambaVersion=s3,Systemrolle=slave/32/testReport/01_base/96rename_domain_admins/test/> <http://jenkins.knut.univention.de:8080/job/UCS-4.0/job/UCS-4.0-1/job/Autotest%20MultiEnv/SambaVersion=s4,Systemrolle=backup/32/testReport/junit/01_base/96rename_domain_admins/test/> <http://jenkins.knut.univention.de:8080/job/UCS-4.0/job/UCS-4.0-1/job/Autotest%20MultiEnv/SambaVersion=s4,Systemrolle=slave/32/testReport/junit/01_base/96rename_domain_admins/test/> > error 2015-03-08 19:19:43 failed /etc/security/access-sshd.conf This is again caused by univention-pam being installed during system-setup, where the system in not DC yet. Afterwards the postinst is never executed again, so the UCRV auth/sshd/ are never set. I've created Bug #37971 to get univention-pam fixed.
For this bug is no separate QA needed.