Renew samba fixture expired test certificates by jkakavas · Pull Request #68985 · elastic/elasticsearch

jkakavas · 2021-02-15T12:28:44Z

Add a README file for how these certificates can be renewed in the
future, when the need arises again.

Add a README file for how these certificates can be renewed in the future, when the need arises again.

elasticmachine · 2021-02-15T12:28:47Z

Pinging @elastic/es-security (Team:Security)

hendrikmuhs · 2021-02-15T12:35:44Z

Due to the cryptic failure, it took time to find the root cause, this was the error message:

13:02:22 + ldapmodify -D Administrator@ad.test.elasticsearch.com -w Passw0rd -H ldaps://127.0.0.1:636 -f /tmp/entrymods -v
13:02:22 ldap_initialize( ldaps://127.0.0.1:636/??base )
13:02:22 ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)

It would therefore be nice to e.g. add something like:

if ! openssl x509 -noout -checkend 86400  -in /fixture/src/main/resources/certs/ca.pem; then echo "Certificate has expired, please check the readme for instructions."; fi

to src/main/resources/provision/installsmb.sh and potentially other places.

update: requires adding the installation of openssl in Dockerfile

jkakavas · 2021-02-15T13:26:22Z

to src/main/resources/provision/installsmb.sh and potentially other places.

Agreed, but I think we can do a better job with the fixture and I don't want us to block intake for more than necessary while we think/iterate on solutions. If you don't mind @hendrikmuhs , I'll merge this with just the certificate changes and open an issue to properly address the fixture's resilience

hendrikmuhs · 2021-02-15T13:31:05Z

to src/main/resources/provision/installsmb.sh and potentially other places.

Agreed, but I think we can do a better job with the fixture and I don't want us to block intake for more than necessary while we think/iterate on solutions. If you don't mind @hendrikmuhs , I'll merge this with just the certificate changes and open an issue to properly address the fixture's resilience

👍, improvements can be done in a follow-up

albertzaharovits · 2021-02-15T13:22:46Z

x-pack/test/smb-fixture/src/main/resources/certs/README.asciidoc

+[source,shell]
+-----------------------------------------------------------------------------------------------------------
+elasticsearch-certutil cert  --pem --ca-cert ${PWD}/ca.pem --ca-key ${PWD}/ca.key \
+   --dns localhost --ip 127.0.0.1,0:0:0:0:0:0:0:1 --name samba4


Suggested change

--dns localhost --ip 127.0.0.1,0:0:0:0:0:0:0:1 --name samba4

--dns localhost --ip 127.0.0.1,0:0:0:0:0:0:0:1 --name samba4 --out ${PWD}/samba4.zip

Thanks, it's good to be explicit

albertzaharovits · 2021-02-15T13:29:23Z

x-pack/test/smb-fixture/src/main/resources/certs/README.asciidoc

+
+=== Generate certificates for the Samba server
+
+These keys and certificates are copied by installsmb.sh for the Samba server to use for TLS. See `../resources/installsmb.sh`


Suggested change

These keys and certificates are copied by installsmb.sh for the Samba server to use for TLS. See `../resources/installsmb.sh`

These keys and certificates are copied by installsmb.sh for the Samba server to use for TLS. See `../provision/installsmb.sh`

albertzaharovits · 2021-02-15T13:42:18Z

x-pack/test/smb-fixture/src/main/resources/certs/README.asciidoc

+keytool -keystore ../../../../../../../x-pack/plugin/security/src/test/resources/org/elasticsearch/xpack/security/authc/ldap/support/ADtrust.jks -storepass changeit -delete -noprompt -alias smb_cert
+keytool -keystore ../../../../../../../x-pack/plugin/security/src/test/resources/org/elasticsearch/xpack/security/authc/ldap/support/ADtrust.jks -storepass changeit -importcert -file cert.pem -alias smb_cert -noprompt
+keytool -keystore ../../../../../../../x-pack/plugin/security/src/test/resources/org/elasticsearch/xpack/security/authc/ldap/support/ADtrust.jks -storepass changeit -delete -noprompt -alias mykey
+keytool -keystore ../../../../../../../x-pack/plugin/security/src/test/resources/org/elasticsearch/xpack/security/authc/ldap/support/ADtrust.jks -storepass changeit -importcert -file cert.pem -alias mykey -noprompt


I've tested UserAttributeGroupsResolverTests and ActiveDirectoryGroupsResolverTests (the only users of ADtrust.jks) with only the smb_ca entry in the truststore (no smb_cert and no mykey entries) and they pass.

Might be worth adjusting the truststore while we're at it.

Can do since I'll respin this eitherway, but we definitely need to clean our key/cert resources up soon. I think we have an open issue about this somewhere too

hendrikmuhs

LGTM

Renew our smb-fixture expired test certificates that are in use in the fixture and in various tests for LDAP and AD. Add a README file for how these certificates can be renewed in the future, when the need arises again.

Renew samba fixture expired test certificates

b4abceb

Add a README file for how these certificates can be renewed in the future, when the need arises again.

jkakavas added >test-failure Triaged test failures from CI :Security/TLS SSL/TLS, Certificates labels Feb 15, 2021

jkakavas requested review from albertzaharovits and hendrikmuhs February 15, 2021 12:28

elasticmachine added the Team:Security Meta label for security team label Feb 15, 2021

Change samba certificate in another place

f960721

albertzaharovits approved these changes Feb 15, 2021

View reviewed changes

review feedback

7ca609d

hendrikmuhs approved these changes Feb 15, 2021

View reviewed changes

jkakavas merged commit a4986b3 into elastic:master Feb 15, 2021

jkakavas mentioned this pull request Feb 15, 2021

[7.x] Renew samba fixture expired test certificates (#68985) #68989

Merged

jkakavas mentioned this pull request Feb 15, 2021

[7.11] Renew samba fixture expired test certificates (#68985) #68990

Merged

This was referenced Feb 15, 2021

[6.8] Renew samba fixture expired test certificates (#68985) #68991

Merged

LdapSessionFactoryTests#testSslTrustIsReloaded failures #68995

Closed

brianseeders mentioned this pull request Feb 15, 2024

Renew samba fixture expired test certificates #105561

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Renew samba fixture expired test certificates#68985

Renew samba fixture expired test certificates#68985
jkakavas merged 3 commits intoelastic:masterfrom
jkakavas:smb-new-certs

jkakavas commented Feb 15, 2021

Uh oh!

elasticmachine commented Feb 15, 2021

Uh oh!

hendrikmuhs commented Feb 15, 2021 •

edited

Loading

Uh oh!

jkakavas commented Feb 15, 2021

Uh oh!

hendrikmuhs commented Feb 15, 2021

Uh oh!

albertzaharovits Feb 15, 2021

Uh oh!

jkakavas Feb 15, 2021

Uh oh!

albertzaharovits Feb 15, 2021

Uh oh!

albertzaharovits Feb 15, 2021

Uh oh!

jkakavas Feb 15, 2021

Uh oh!

hendrikmuhs left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	--dns localhost --ip 127.0.0.1,0:0:0:0:0:0:0:1 --name samba4
	--dns localhost --ip 127.0.0.1,0:0:0:0:0:0:0:1 --name samba4 --out ${PWD}/samba4.zip


		=== Generate certificates for the Samba server

		These keys and certificates are copied by installsmb.sh for the Samba server to use for TLS. See `../resources/installsmb.sh`

Conversation

jkakavas commented Feb 15, 2021

Uh oh!

elasticmachine commented Feb 15, 2021

Uh oh!

hendrikmuhs commented Feb 15, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jkakavas commented Feb 15, 2021

Uh oh!

hendrikmuhs commented Feb 15, 2021

Uh oh!

albertzaharovits Feb 15, 2021

Choose a reason for hiding this comment

Uh oh!

jkakavas Feb 15, 2021

Choose a reason for hiding this comment

Uh oh!

albertzaharovits Feb 15, 2021

Choose a reason for hiding this comment

Uh oh!

albertzaharovits Feb 15, 2021

Choose a reason for hiding this comment

Uh oh!

jkakavas Feb 15, 2021

Choose a reason for hiding this comment

Uh oh!

hendrikmuhs left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

hendrikmuhs commented Feb 15, 2021 •

edited

Loading