FreeIPA doesn't expose Dogtag's port 8080 and 8443 directly. Instead it uses an Apache HTTPD proxy for remote access. For installation and management, FreeIPA also talks to Dogtag on localhost 8080 or 8443.
In order to harden a server and increase general security, it would be beneficial to have an option to bind Tomcat to localhost only. The task can be accomplished with a single attribute <Connector address="localhost" ... in each of the connectors in server.xml, https://tomcat.apache.org/tomcat-5.5-doc/config/http.html . There is one small catch. An empty value address="" also means localhost.
<Connector address="localhost" ...
server.xml
address=""
I would appreciate if the feature could land in 10.4 / Fedora 27.
As discussed on IRC this probably can be accomplished using the two-step installation: http://pki.fedoraproject.org/wiki/Two-Step_Installation
After executing the step 1 IPA can customize any of PKI's configuration files including server.xml. In step 2 PKI will resume the installation using the customized configuration files.
Metadata Update from @edewata: - Custom field component adjusted to General - Custom field feature adjusted to '' - Custom field origin adjusted to Community - Custom field proposedmilestone adjusted to '' - Custom field proposedpriority adjusted to '' - Custom field reviewer adjusted to '' - Custom field type adjusted to defect - Custom field version adjusted to ''
I think it's a Yes/No proposition: should we do this in a FreeIPA deployment or not?
I don't see why not.
If we go ahead, we should have a pkispawn config to control it.
This particular security hardening (i.e. limiting access to localhost) is an IPA-specific requirement. There are plenty other things that can be configured in Tomcat which IPA might want to do in the future for various purposes. Creating a pkispawn configuration parameter for every possible Tomcat configuration would be unmanageable. Also, the pkispawn parameters will not be usable if IPA needs to change Tomcat configuration post-installation.
I think it would be better for IPA to customize Tomcat configuration directly, which can be done using the two-step installation process above.
Metadata Update from @mharmsen: - Issue priority set to: --- - Issue set to the milestone: 0.0 NEEDS_TRIAGE
Per PKI Bug Council of April 20, 2017: 10.4 major
Metadata Update from @mharmsen: - Issue priority set to: major (was: ---) - Issue set to the milestone: 10.4 (was: 0.0 NEEDS_TRIAGE)
Per CS/DS Meeting of August 7, 2017, it was determined to move this issue from 10.4 ==> FUTURE.
Metadata Update from @mharmsen: - Issue set to the milestone: FUTURE (was: 10.4)
Dogtag PKI is moving from Pagure issues to GitHub issues. This means that existing or new issues will be reported and tracked through Dogtag PKI's GitHub Issue tracker.
This issue has been cloned to GitHub and is available here: https://github.com/dogtagpki/pki/issues/2748
If you want to receive further updates on the issue, please navigate to the GitHub issue and click on Subscribe button.
Subscribe
Thank you for understanding, and we apologize for any inconvenience.
Metadata Update from @dmoluguw: - Issue close_status updated to: migrated - Issue status updated to: Closed (was: Open)
Login to comment on this ticket.