[autobackport: sssd-2-12] Ad stig 1

src/tests/multihost/ad/conftest.py

@@ -109,6 +109,56 @@ def delete_adgrp():
     request.addfinalizer(delete_adgrp)
 
 
+@pytest.fixture(scope="function")
+def enable_sshd_password_auth(session_multihost, request):
+    """ Temporarily enable PasswordAuthentication in sshd for tests
+    that need SSH password login on STIG-hardened systems """
+    client = session_multihost.client[0]
+    # Check both main config and drop-in files under sshd_config.d/
+    # RHEL 9 STIG sets PasswordAuthentication in drop-in files
+    check = client.run_command(
+        'grep -rq "^PasswordAuthentication no"'
+        ' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/ 2>/dev/null',
+        raiseonerr=False
+    )
+    if check.returncode != 0:
+        return
+    client.run_command(
+        'cp -f /etc/ssh/sshd_config /etc/ssh/sshd_config.orig_stig',
+        raiseonerr=False
+    )
+    client.run_command(
+        'sed -i "s/^PasswordAuthentication no/PasswordAuthentication yes/g"'
+        ' /etc/ssh/sshd_config',
+        raiseonerr=False
+    )
+    # Also fix drop-in files where STIG sets the directive
+    client.run_command(
+        'cp -a /etc/ssh/sshd_config.d /etc/ssh/sshd_config.d.orig_stig',
+        raiseonerr=False
+    )
+    client.run_command(
+        'sed -i "s/^PasswordAuthentication no/PasswordAuthentication yes/g"'
+        ' /etc/ssh/sshd_config.d/*.conf 2>/dev/null',
+        raiseonerr=False
+    )
+    client.run_command('systemctl restart sshd', raiseonerr=False)
+
+    def restore_sshd():
+        """ Restore sshd config """
+        client.run_command(
+            'cp -f /etc/ssh/sshd_config.orig_stig /etc/ssh/sshd_config',
+            raiseonerr=False
+        )
+        client.run_command(
+            'rm -rf /etc/ssh/sshd_config.d &&'
+            ' mv /etc/ssh/sshd_config.d.orig_stig /etc/ssh/sshd_config.d',
+            raiseonerr=False
+        )
+        client.run_command('systemctl restart sshd', raiseonerr=False)
+    request.addfinalizer(restore_sshd)
+
+
 @pytest.fixture(autouse=True)
 def capture_sssd_logs(session_multihost, request):
     """This will print sssd logs in case of test failure"""
@@ -334,7 +384,8 @@ def _join(membersw=None):
     def adleave():
         """ Disjoin AD """
         session_multihost.client[0].run_command(
-            f"cp -af /etc/sssd/sssd.conf.adjoin {SSSD_DEFAULT_CONF}")
+            f"cp -af /etc/sssd/sssd.conf.adjoin {SSSD_DEFAULT_CONF}",
+            raiseonerr=False)
         _adleave(client_ad)
 
     request.addfinalizer(adleave)
@@ -831,6 +882,35 @@ def delete_share_directory():
 # ################### Session scoped fixtures #########################
 
 
+@pytest.fixture(scope='session', autouse=True)
+def enable_aes_encryption_on_ad(session_multihost, request):
+    """ Enable AES Kerberos encryption on AD for FIPS/STIG compatibility.
+    FIPS:STIG crypto policy on RHEL 9.x only permits AES encryption types
+    but the AD server may not have AES enabled by default. Without this,
+    realm join fails with 'The encryption types desired are not available
+    in active directory' as adcli finds all encryption types are
+    not permitted by the crypto policy. This configures msDS-SupportedEncryptionTypes
+    on domain controllers and sets the registry-level Kerberos encryption
+    policy to enable AES-128 and AES-256 (value 24 = 0x08 + 0x10). """
+    powershell_cmd = (
+        'powershell.exe -inputformat none -noprofile '
+        '"Import-Module ActiveDirectory; '
+        'Get-ADComputer -Filter {PrimaryGroupID -eq 516} '
+        '-Properties msDS-SupportedEncryptionTypes | '
+        "Set-ADComputer -Replace @{'msDS-SupportedEncryptionTypes' = 24}; "
+        'New-Item -Path '
+        "'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion"
+        "\\Policies\\System\\Kerberos\\Parameters' -Force; "
+        'Set-ItemProperty -Path '
+        "'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion"
+        "\\Policies\\System\\Kerberos\\Parameters' "
+        "-Name 'SupportedEncryptionTypes' -Value 24 "
+        '-Type DWord -Force; '
+        'gpupdate /force"'
+    )
+    session_multihost.ad[0].run_command(powershell_cmd, raiseonerr=False)
+
+
 @pytest.fixture(scope='session', autouse=True)
 def fips_ad_support_policy(session_multihost, request):
     """ Enable FIPS:AD-SUPPORT crypto policy added in bz2056676"""

src/tests/multihost/ad/test_ad_misc.py

@@ -228,7 +228,8 @@ def test_0002_improved_use_negative_sid_for_sid_lookup(
         assert patt.search(log_str)
 
     @pytest.mark.tier1_3
-    def test_0003_gssapi_ssh(self, multihost, adjoin, create_aduser_group):
+    def test_0003_gssapi_ssh(self, multihost, adjoin, create_aduser_group,
+                                enable_sshd_password_auth):
         """
         :title: gssapi ssh log in with 'krb5_confd_path'
         :description: User should log in with GSSAPI after setting

src/tests/multihost/ad/test_adparameters.py

@@ -396,8 +396,8 @@ def test_0010_bz1527662(self, multihost, adjoin):
         result = True
         for user in user_list:
             ad_user = '%s@%s' % (user, ad_realm)
-            res = client.auth_from_client(ad_user, 'Secret123')
-            result = result and (res == 3)
+            # Use su instead of SSH: STIG disables PasswordAuthentication
+            result = result and client.su_success(ad_user, 'Secret123')
 
         for user in user_list:
             group = '%s_group' % (user)

src/tests/multihost/ad/test_adparameters_ported.py

@@ -1615,7 +1615,8 @@ def test_0019_ad_parameters_ldap_id_mapping_false(
     @staticmethod
     @pytest.mark.tier1_2
     def test_0020_ad_parameters_ssh_change_password(
-            multihost, adjoin, create_aduser_group
+            multihost, adjoin, create_aduser_group,
+            enable_sshd_password_auth
     ):
         """
         :title: IDM-SSSD-TC: ad_provider: ad_parameters: Change user password
@@ -1684,7 +1685,8 @@ def test_0020_ad_parameters_ssh_change_password(
     @staticmethod
     @pytest.mark.tier1_2
     def test_0021_ad_parameters_ssh_change_password_logon(
-            multihost, adjoin, create_aduser_group
+            multihost, adjoin, create_aduser_group,
+            enable_sshd_password_auth
     ):
         """
         :title: IDM-SSSD-TC: ad_provider: ad_parameters: User must change
@@ -1758,7 +1760,8 @@ def test_0021_ad_parameters_ssh_change_password_logon(
     @staticmethod
     @pytest.mark.tier1_2
     def test_0022_ad_parameters_account_disabled(
-            multihost, adjoin, create_aduser_group):
+            multihost, adjoin, create_aduser_group,
+            enable_sshd_password_auth):
         """
         :title: IDM-SSSD-TC: ad_provider: ad_parameters: User account disabled
         :id: e577001f-11f7-43a6-abc9-75bd5c98dd4c
@@ -1838,7 +1841,8 @@ def test_0022_ad_parameters_account_disabled(
     @staticmethod
     @pytest.mark.tier1_2
     def test_0023_ad_parameters_account_expired(
-            multihost, adjoin, create_aduser_group):
+            multihost, adjoin, create_aduser_group,
+            enable_sshd_password_auth):
         """
         :title: IDM-SSSD-TC: ad_provider: ad_parameters: User account is
          expired bz1081046
@@ -3269,7 +3273,8 @@ def test_0040_ad_parameters_newline_ssh_key(
     @staticmethod
     @pytest.mark.tier1_2
     def test_0041_ad_parameters_sss_ssh_knownhostsproxy(
-            multihost, adjoin, create_aduser_group):
+            multihost, adjoin, create_aduser_group,
+            enable_sshd_password_auth):
         """
         :title: IDM-SSSD-TC: ad_provider: ad_parameters: segfault when
          HostID back end target is not configured bz1071823

src/tests/multihost/ad/test_login_attr.py

@@ -45,7 +45,8 @@ class TestADLoginAttributes:
     """Automated Test Cases for AD Login Attributes ported from bash"""
 
     @staticmethod
-    def test_0001_login_by_samaccountname(multihost, create_aduser_group):
+    def test_0001_login_by_samaccountname(multihost, create_aduser_group,
+                                              enable_sshd_password_auth):
         """test_0001_login_by_samaccountname
 
         :title: IDM-SSSD-TC: ad_provider: ad_login_attr: Default behaviour
@@ -105,7 +106,8 @@ def test_0001_login_by_samaccountname(multihost, create_aduser_group):
         assert ssh_result, "The ssh login failed!"
 
     @staticmethod
-    def test_0002_login_by_userprincipalname(multihost, create_aduser_group):
+    def test_0002_login_by_userprincipalname(multihost, create_aduser_group,
+                                                 enable_sshd_password_auth):
         """test_0002_login_by_userprincipalname
 
         :title: IDM-SSSD-TC: ad_provider: ad_login_attr: Verify user login
@@ -158,7 +160,8 @@ def test_0002_login_by_userprincipalname(multihost, create_aduser_group):
 
     @staticmethod
     @pytest.mark.usefixtures("sssd_domain")
-    def test_0003_login_sssd_domain(multihost, create_aduser_group):
+    def test_0003_login_sssd_domain(multihost, create_aduser_group,
+                                        enable_sshd_password_auth):
         """test_0003_login_sssd_domain
 
         :title: IDM-SSSD-TC: ad_provider: ad_login_attr: Verify user login
@@ -206,7 +209,8 @@ def test_0003_login_sssd_domain(multihost, create_aduser_group):
 
     @staticmethod
     @pytest.mark.usefixtures("sssd_domain")
-    def test_0004_login_sssd_domain_fqn(multihost, create_aduser_group):
+    def test_0004_login_sssd_domain_fqn(multihost, create_aduser_group,
+                                            enable_sshd_password_auth):
         """test_0004_login_sssd_domain_fqn
 
         :title: IDM-SSSD-TC: ad_provider: ad_login_attr: Verify login
@@ -269,7 +273,8 @@ def test_0004_login_sssd_domain_fqn(multihost, create_aduser_group):
 
     @staticmethod
     def test_0005_login_sssd_domain_uppercase(
-            multihost, create_aduser_group):
+            multihost, create_aduser_group,
+            enable_sshd_password_auth):
         """test_0005_login_sssd_domain_uppercase
 
         :title: IDM-SSSD-TC: ad_provider: ad_login_attr: Verify login

src/tests/multihost/ad/test_range_retrieval.py

@@ -26,7 +26,8 @@ class TestADRangeRetrieval:
      6. On AD-server, create a ADgroup and add 200 ADusers members to it.
     """
     @staticmethod
-    def test_0001_grouplookup_large_members(multihost, adjoin):
+    def test_0001_grouplookup_large_members(multihost, adjoin,
+                                              enable_sshd_password_auth):
         """
         :title: with ldap provider lookup group with large number of users
         :id: 74ecb720-e2d3-4c72-b43a-12cf5e6166d6
@@ -81,7 +82,8 @@ def test_0001_grouplookup_large_members(multihost, adjoin):
         assert login, 'user log in failed'
 
     @staticmethod
-    def test_0002_ad_provider_search_base_with_filter(multihost, adjoin):
+    def test_0002_ad_provider_search_base_with_filter(multihost, adjoin,
+                                                        enable_sshd_password_auth):
         """
         :title: ad provider search base with filter bz848031
         :id: 928b2f4e-dd1e-416d-abdd-4345be386f5d
@@ -133,7 +135,8 @@ def test_0002_ad_provider_search_base_with_filter(multihost, adjoin):
         assert login, 'user login failed'
 
     @staticmethod
-    def test_0003_ad_provider_userlookup_large_numberof_groups(multihost, adjoin):
+    def test_0003_ad_provider_userlookup_large_numberof_groups(multihost, adjoin,
+                                                                enable_sshd_password_auth):
         """
         :title: ad provider lookup user belonging to large number of groups
         :id: 87843cff-cf70-4537-adb7-d05bd3d0b3c4
@@ -179,7 +182,8 @@ def test_0003_ad_provider_userlookup_large_numberof_groups(multihost, adjoin):
         assert patt1.search(log_str), 'Parsed range values: member] log is missing'
 
     @staticmethod
-    def test_0004_ad_provider_ldap_user_searchbase_with_filter(multihost, adjoin):
+    def test_0004_ad_provider_ldap_user_searchbase_with_filter(multihost, adjoin,
+                                                                enable_sshd_password_auth):
         """
         :title: ad provider ldap user search base with filter
         :id: 27100011-c8c6-46ee-b135-8df50537c0fc