search

theforeman / foreman-documentation

Documentation for the Foreman Project and its ecosystem
https://docs.theforeman.org
Creative Commons Attribution Share Alike 4.0 International
22 stars 95 forks source link

Update security key generation command for DHCP config #3303

Closed Lennonka closed 2 months ago

Lennonka commented 2 months ago

What changes are you introducing?

Replacing dnssec-keygen with tsig-keygen. The HMAC-MD5 algorithm is not supported by dnssec-keygen on EL 9, but the algorithm is required for Foreman.

The tsig-keygen command also works on EL 8.

Why are you introducing these changes? (Explanation, links to references, issues, etc.)

Because of EL 9 support. The tsig-keygen command should be preferred on EL 8 as well.

https://issues.redhat.com/browse/SAT-27986

Anything else to add? (Considerations, potential downsides, alternative solutions you have explored, etc.)

I have tested that the tsig-keygen command is available on both RHEL 9 and 8, and gives the required output.

Unlike dnssec-keygen, which generates files, tsig-keygen only outputs text on the console and doesn't create any files. Therefore, no files have to be deleted afterwards.

Checklists

Please cherry-pick my commits into:

github-actions[bot] commented 2 months ago

The PR preview for 4bbc64a3fe1f8bc5add3b6b5615b1be553ebbfab is available at theforeman-foreman-documentation-preview-pr-3303.surge.sh

The following output files are affected by this PR:

show diff

show diff as HTML

Lennonka commented 2 months ago

@evgeni Technical ack, please? Is the verification sufficient as mentioned in the description?

evgeni commented 2 months ago

The diff matches what we discussed, yes.

I'd prefer if someone could actually setup an external DHCP using this procedure and verify it works, because I did not.

Lennonka commented 2 months ago

I've requested QE testing on my team.

shubhamsg199 commented 2 months ago

Hello, tsig-keygen works. Tested configuring the external DHCP server with it, I didn't see any issues with RHEL8/9

Lennonka commented 2 months ago

@asteflova Can you please give me a formal ack on the style so that I can merge it?

Lennonka commented 2 months ago

After careful consideration, I've decided not to make further changes regarding the key name. I don't think we have to document every option. Providing just the key name that works out of the box seems sufficient.

Lennonka commented 2 months ago

Cherry-picked: