koji

#2163 kerberos logins should always require SSL on the server
Opened by ktdreyer. Modified

Open
Close Issue

Our sample Apache configuration files recommend setting "GssapiSSLonly" to "Off" on the Koji Hub, and there is nothing in the koji-hub or koji-web settings that enforces the use of HTTPS for Kerberos authentication.

Steps to resolve this:
1) Remove the "GssapiSSLonly Off" setting from the koji-hub Apache configuration.
2) Add SSLRequireSSL to the koji-hub and koji-web Apache settings.

https://pagure.io/koji/pull-request/2162 removes "GssapiSSLonly Off".

What is the difference between GssapiSSLonly On and SSLRequireSSL?

AFAICT SSLRequireSSL will deny the connection sooner.

In fact we should probably set SSLRequireSSL on the entire hub URL and web app, not just the single /ssllogin location.

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/koji/koji/issues/2163

Please continue any further discussion there.
Metadata
None
None
None
None
Low
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.