Repository navigation
[autobackport: sssd-2-12] Ad stig 1 - #9122
Merged
jakub-vavra-cz merged 4 commits intoAug 24, 2026
Merged
jakub-vavra-cz merged 4 commits into
jakub-vavra-cz merged 4 commits into
Conversation
jakub-vavra-cz
approved these changes
Aug 24, 2026
jakub-vavra-cz
left a comment
jakub-vavra-cz
left a comment
Contributor
There was a problem hiding this comment.
Cleanly applied backport.
- Replace `auth_from_client` (SSH password auth) with `su_success` in `test_0010_bz1527662` to fix test failure on STIG-hardened RHEL systems where SSH password authentication is disabled. Signed-off-by: Madhuri Upadhye <mupadhye@redhat.com> Reviewed-by: Jakub Vávra <jvavra@redhat.com> (cherry picked from commit 6dd9bf2)
Add enable_sshd_password_auth fixture that temporarily enables PasswordAuthentication in sshd on STIG systems where it is disabled. No-op on non-STIG systems. Applied to 14 tests across test_adparameters_ported.py, test_range_retrieval.py, test_login_attr.py, and test_ad_misc.py that use SSH password auth. Signed-off-by: Madhuri Upadhye <mupadhye@redhat.com> Reviewed-by: Jakub Vávra <jvavra@redhat.com> (cherry picked from commit 5340857)
Fix enable_sshd_password_auth fixture to check and modify sshd drop-in files under /etc/ssh/sshd_config.d/ in addition to the main sshd_config. On RHEL 9.9 STIG-hardened systems, PasswordAuthentication no is set in a drop-in file, not the main config, causing the fixture to silently no-op and all 11 SSH-based tests to fail. - Add raiseonerr=False to the adleave teardown cp command to prevent 13 spurious errors when sssd.conf.adjoin was never created due to earlier test failures Signed-off-by: Madhuri Upadhye <mupadhye@redhat.com> Reviewed-by: Jakub Vávra <jvavra@redhat.com> (cherry picked from commit bf003fc)
On RHEL 9.x and some tests from 10.x with FIPS:STIG crypto policy, realm join fails because the AD server does not have AES encryption enabled by default. This adds a session fixture to configure AES-128/AES-256 on the AD server at test startup. Signed-off-by: Madhuri Upadhye <mupadhye@redhat.com> Reviewed-by: Jakub Vávra <jvavra@redhat.com> (cherry picked from commit cf38737)
Contributor
Author
|
The pull request was accepted by @jakub-vavra-cz with the following PR CI status: 🟢 rpm-build:centos-stream-10-x86_64:upstream (success) There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging. |
sssd-bot
force-pushed
the
SSSD-sssd-backport-pr9115-to-sssd-2-12
branch
from
August 24, 2026 12:10
4cc622c to
29ae6ef
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is an automatic backport of PR#9115 Ad stig 1 to branch sssd-2-12, created by @madhuriupadhye.
Please make sure this backport is correct.
Note
The commits were cherry-picked without conflicts.
You can push changes to this pull request
Original commits
6dd9bf2 - Tests: Fix AD work on STIG-hardened systems
5340857 - Tests: Fix AD tests on STIG-hardened systems
bf003fc - Fix STIG fixture to handle sshd drop-in config files
cf38737 - Enable AES Kerberos encryption on AD for FIPS:STIG compatibility
Backported commits
Original Pull Request Body