-
Story
-
Resolution: Obsolete
-
Minor
-
RH342 - RHEL 7.2 1 20160321
-
en-US (English)
URL:
Reporter RHNID:
Section: -
Language: en-US (English)
Workaround:
Description: In the Paris lab, it says to wget the cacert and use the cacertdir_rehash command. This is very obscure, and no student had heard of this command.
I would suggest to use the standard authconfig command, which is familiar to students. It can download and update the hashes in one go.
# authconfig --ldaploadcacert=ftp://workstation/pub/example-ca.crt --update
[PTL-6989] RH342-59: Ch 11 - Lab Paris - updating cacert hashes
Wander Boessenkool (Inactive)
added a comment - While I can understand your preference for using authconfig over cacertdir_rehash, the latter is not obscure, in fact, we used to teach it in RHS333 curriculum. It is also mentioned, albeit briefly, in the Resolving Kerberos and LDAP Issues section, in chapter 9, under the TLS certificate mismatches header.
The benefit of using cacertdir_rehash is that it works for every dir you point it to, not just the directory that authconfig has blessed. In setups where authconfig was not used to configure LDAP, cacertdir_rehash still works, and authconfig has a high chance of failure.
I'm keeping this bug open for consideration during the next refresh.
Wander Boessenkool (Inactive)
added a comment - While I can understand your preference for using authconfig over cacertdir_rehash , the latter is not obscure, in fact, we used to teach it in RHS333 curriculum. It is also mentioned, albeit briefly, in the Resolving Kerberos and LDAP Issues section, in chapter 9, under the TLS certificate mismatches header.
The benefit of using cacertdir_rehash is that it works for every dir you point it to, not just the directory that authconfig has blessed. In setups where authconfig was not used to configure LDAP, cacertdir_rehash still works, and authconfig has a high chance of failure.
I'm keeping this bug open for consideration during the next refresh. 
Michael Stonebank (Inactive)
added a comment - I believe it just does the cacert. I tested it on paris lab and it works. Too late now, but next time I can use AIDE to see if it hits other files.
From the man page of authconfig...
If --update action is specified (...) only the files affected by the configuration changes are overwritten.
If --updateall action is specified (...) all configuration files are written.
Michael Stonebank (Inactive)
added a comment - I believe it just does the cacert. I tested it on paris lab and it works. Too late now, but next time I can use AIDE to see if it hits other files.
From the man page of authconfig...
If --update action is specified (...) only the files affected by the configuration changes are overwritten.
If --updateall action is specified (...) all configuration files are written. Michael, are there any side-effects of using authconfig in this case? (For example, does it attempt to do anything beyond what cacertdir_rehash does?)
The reported bug was for RHEL 7.2 and the current version of the course is based on RHEL 8.4 and found no content for which the bug was reported.