diff options
author | Rob Crittenden <rcritten@redhat.com> | 2011-02-01 14:24:46 -0500 |
---|---|---|
committer | Rob Crittenden <rcritten@redhat.com> | 2011-02-02 10:00:38 -0500 |
commit | 275998f6bde90c253d935c2f2724538b64cbd618 (patch) | |
tree | bd2840606a906276d21e646eae47db49f7adb6c2 /install | |
parent | f3d04bfc405753b3c6a11a53ec6b2ccc99e8bf09 (diff) | |
download | freeipa-275998f6bde90c253d935c2f2724538b64cbd618.tar.gz freeipa-275998f6bde90c253d935c2f2724538b64cbd618.tar.xz freeipa-275998f6bde90c253d935c2f2724538b64cbd618.zip |
Add support for tracking and counting entitlements
Adds a plugin, entitle, to register to the entitlement server, consume
entitlements and to count and track them. It is also possible to
import an entitlement certificate (if for example the remote entitlement
server is unaviailable).
This uses the candlepin server from https://fedorahosted.org/candlepin/wiki
for entitlements.
Add a cron job to validate the entitlement status and syslog the results.
tickets 28, 79, 278
Diffstat (limited to 'install')
-rw-r--r-- | install/share/60basev2.ldif | 2 | ||||
-rw-r--r-- | install/share/default-aci.ldif | 2 | ||||
-rw-r--r-- | install/share/delegation.ldif | 61 | ||||
-rw-r--r-- | install/tools/Makefile.am | 1 | ||||
-rw-r--r-- | install/tools/ipa-compliance | 193 | ||||
-rw-r--r-- | install/tools/man/Makefile.am | 3 | ||||
-rw-r--r-- | install/tools/man/ipa-compliance.1 | 45 |
7 files changed, 287 insertions, 20 deletions
diff --git a/install/share/60basev2.ldif b/install/share/60basev2.ldif index f5f7a6563..6f86f3afd 100644 --- a/install/share/60basev2.ldif +++ b/install/share/60basev2.ldif @@ -11,8 +11,10 @@ attributeTypes: (2.16.840.1.113730.3.8.3.2 NAME 'ipaClientVersion' DESC 'Text st attributeTypes: (2.16.840.1.113730.3.8.3.3 NAME 'enrolledBy' DESC 'DN of administrator who performed manual enrollment of the host' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'IPA v2' ) attributeTypes: (2.16.840.1.113730.3.8.3.4 NAME 'fqdn' DESC 'FQDN' EQUALITY caseIgnoreMatch ORDERING caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'IPA v2' ) attributeTypes: (2.16.840.1.113730.3.8.3.18 NAME 'managedBy' DESC 'DNs of entries allowed to manage' SUP distinguishedName EQUALITY distinguishedNameMatch ORDERING distinguishedNameMatch SUBSTR distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'IPA v2') +attributeTypes: (2.16.840.1.113730.3.8.3.24 NAME 'ipaEntitlementId' DESC 'Entitlement Unique identifier' EQUALITY caseIgnoreMatch ORDERING caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'IPA v2' ) objectClasses: (2.16.840.1.113730.3.8.4.1 NAME 'ipaHost' AUXILIARY MUST ( fqdn ) MAY ( userPassword $ ipaClientVersion $ enrolledBy $ memberOf) X-ORIGIN 'IPA v2' ) objectClasses: (2.16.840.1.113730.3.8.4.12 NAME 'ipaObject' DESC 'IPA objectclass' AUXILIARY MUST ( ipaUniqueId ) X-ORIGIN 'IPA v2' ) +objectClasses: (2.16.840.1.113730.3.8.4.14 NAME 'ipaEntitlement' DESC 'IPA Entitlement object' AUXILIARY MUST ( ipaEntitlementId ) MAY ( userPKCS12 $ userCertificate ) X-ORIGIN 'IPA v2' ) objectClasses: (2.16.840.1.113730.3.8.4.15 NAME 'ipaPermission' DESC 'IPA Permission objectclass' AUXILIARY MAY ( ipaPermissionType ) X-ORIGIN 'IPA v2' ) objectClasses: (2.16.840.1.113730.3.8.4.2 NAME 'ipaService' DESC 'IPA service objectclass' AUXILIARY MAY ( memberOf $ managedBy ) X-ORIGIN 'IPA v2' ) objectClasses: (2.16.840.1.113730.3.8.4.3 NAME 'nestedGroup' DESC 'Group that supports nesting' SUP groupOfNames STRUCTURAL MAY memberOf X-ORIGIN 'IPA v2' ) diff --git a/install/share/default-aci.ldif b/install/share/default-aci.ldif index e4f767054..7c0ae8bd8 100644 --- a/install/share/default-aci.ldif +++ b/install/share/default-aci.ldif @@ -3,7 +3,7 @@ dn: $SUFFIX changetype: modify add: aci -aci: (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey")(version 3.0; acl "Enable Anonymous access"; allow (read, search, compare) userdn = "ldap:///anyone";) +aci: (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || userPKCS12")(version 3.0; acl "Enable Anonymous access"; allow (read, search, compare) userdn = "ldap:///anyone";) aci: (targetattr = "memberOf || memberHost || memberUser")(version 3.0; acl "No anonymous access to member information"; deny (read,search,compare) userdn != "ldap:///all";) aci: (targetattr != "userPassword || krbPrincipalKey || sambaLMPassword || sambaNTPassword || passwordHistory || krbMKey || krbPrincipalName || krbCanonicalName || krbUPEnabled || krbTicketPolicyReference || krbPrincipalExpiration || krbPasswordExpiration || krbPwdPolicyReference || krbPrincipalType || krbPwdHistory || krbLastPwdChange || krbPrincipalAliases || krbExtraData || krbLastSuccessfulAuth || krbLastFailedAuth || krbLoginFailedCount || krbTicketFlags || ipaUniqueId || memberOf || serverHostName || enrolledBy")(version 3.0; acl "Admin can manage any entry"; allow (all) groupdn = "ldap:///cn=admins,cn=groups,cn=accounts,$SUFFIX";) aci: (targetattr = "userpassword || krbprincipalkey || sambalmpassword || sambantpassword")(version 3.0; acl "selfservice:Self can write own password"; allow (write) userdn="ldap:///self";) diff --git a/install/share/delegation.ldif b/install/share/delegation.ldif index 18d045d8d..a15c9ec77 100644 --- a/install/share/delegation.ldif +++ b/install/share/delegation.ldif @@ -37,6 +37,23 @@ objectClass: nestedgroup cn: helpdesk description: Helpdesk +dn: cn=Entitlement Management,cn=roles,cn=accounts,$SUFFIX +changetype: add +objectClass: top +objectClass: groupofnames +objectClass: nestedgroup +cn: entitlements +description: Entitlements administrator + +dn: cn=Entitlement Compliance,cn=roles,cn=accounts,$SUFFIX +changetype: add +objectClass: top +objectClass: groupofnames +objectClass: nestedgroup +cn: Entitlement Compliance +description: Verify entitlement compliance +member: fqdn=$FQHN,cn=computers,cn=accounts,$SUFFIX + ############################################ # Add the default privileges ############################################ @@ -129,13 +146,23 @@ objectClass: nestedgroup cn: Host Enrollment description: Host Enrollment -dn: cn=entitlementadmin,cn=privileges,cn=pbac,$SUFFIX +dn: cn=Register and Write Entitlements,cn=privileges,cn=pbac,$SUFFIX changetype: add objectClass: top objectClass: groupofnames objectClass: nestedgroup -cn: entitlementadmin -description: Entitlement Administrators +cn: Register and Write Entitlements +member: cn=Entitlement Management,cn=roles,cn=accounts,$SUFFIX + +dn: cn=Read Entitlements,cn=privileges,cn=pbac,$SUFFIX +changetype: add +objectClass: top +objectClass: groupofnames +objectClass: nestedgroup +cn: Read Entitlements +member: cn=Entitlement Management,cn=roles,cn=accounts,$SUFFIX +member: cn=Entitlement Compliance,cn=roles,cn=accounts,$SUFFIX + ############################################ # Default permissions. @@ -486,30 +513,28 @@ member: cn=Replication Administrators,cn=privileges,cn=pbac,$SUFFIX # Entitlement management -dn: cn=addentitlements,cn=permissions,cn=pbac,$SUFFIX +dn: cn=Register Entitlements,cn=permissions,cn=pbac,$SUFFIX changetype: add objectClass: top objectClass: groupofnames objectClass: ipapermission -cn: addentitlements -description: Add Entitlements -member: cn=entitlementadmin,cn=privileges,cn=pbac,$SUFFIX +member: cn=Register and Write Entitlements,cn=privileges,cn=pbac,$SUFFIX -dn: cn=removeentitlements,cn=permissions,cn=pbac,$SUFFIX +dn: cn=Read Entitlements,cn=permissions,cn=pbac,$SUFFIX changetype: add objectClass: top objectClass: groupofnames -cn: removeentitlements -description: Remove Entitlements -member: cn=entitlementadmin,cn=privileges,cn=pbac,$SUFFIX +objectClass: ipapermission +cn: Read Entitlements +member: cn=Read Entitlements,cn=privileges,cn=pbac,$SUFFIX -dn: cn=modifyentitlements,cn=permissions,cn=pbac,$SUFFIX +dn: cn=Write Entitlements,cn=permissions,cn=pbac,$SUFFIX changetype: add objectClass: top objectClass: groupofnames -cn: modifyentitlements -description: Modify Entitlements -member: cn=entitlementadmin,cn=privileges,cn=pbac,$SUFFIX +objectClass: ipapermission +cn: Write Entitlements +member: cn=Register and Write Entitlements,cn=privileges,cn=pbac,$SUFFIX ############################################ # Default permissions (ACIs) @@ -631,17 +656,17 @@ aci: (targetattr = "enrolledby || objectclass")(target = "ldap:///fqdn=*,cn=comp dn: $SUFFIX changetype: modify add: aci -aci: (target = "ldap:///ipauniqueid=*,cn=entitlements,cn=etc,$SUFFIX")(version 3.0;acl "permission:addentitlements";allow (add) groupdn = "ldap:///cn=addentitlements,cn=permissions,cn=pbac,$SUFFIX";) +aci: (target = "ldap:///ipaentitlementid=*,cn=entitlements,cn=etc,$SUFFIX")(version 3.0;acl "Register Entitlements";allow (add) groupdn = "ldap:///cn=Register Entitlements,cn=permissions,cn=pbac,$SUFFIX";) dn: $SUFFIX changetype: modify add: aci -aci: (targetattr = "usercertificate")(target = "ldap:///ipauniqueid=*,cn=entitlements,cn=etc,$SUFFIX")(version 3.0;acl "permission:modifyentitlements";allow (write) groupdn = "ldap:///cn=modifyentitlements,cn=permissions,cn=pbac,$SUFFIX";) +aci: (targetattr = "usercertificate")(target = "ldap:///ipaentitlement=*,cn=entitlements,cn=etc,$SUFFIX")(version 3.0;acl "Write Entitlements";allow (write) groupdn = "ldap:///cn=Write entitlements,cn=permissions,cn=pbac,$SUFFIX";) dn: $SUFFIX changetype: modify add: aci -aci: (target = "ldap:///ipauniqueid=*,cn=entitlements,cn=etc,$SUFFIX")(version 3.0;acl "permission:removeentitlements";allow (delete) groupdn = "ldap:///cn=removeentitlements,cn=permissions,cn=pbac,$SUFFIX";) +aci: (targetattr = "userpkcs12")(target = "ldap:///ipaentitlementid=*,cn=entitlements,cn=etc,$SUFFIX")(version 3.0;acl "Read Entitlements";allow (read) groupdn = "ldap:///cn=Read Entitlements,cn=permissions,cn=pbac,$SUFFIX";) # Create virtual operations entry. This is used to control access to # operations that don't rely on LDAP directly. diff --git a/install/tools/Makefile.am b/install/tools/Makefile.am index 70e65ee73..055a32fca 100644 --- a/install/tools/Makefile.am +++ b/install/tools/Makefile.am @@ -17,6 +17,7 @@ sbin_SCRIPTS = \ ipa-host-net-manage \ ipa-ldap-updater \ ipa-upgradeconfig \ + ipa-compliance \ $(NULL) EXTRA_DIST = \ diff --git a/install/tools/ipa-compliance b/install/tools/ipa-compliance new file mode 100644 index 000000000..8b7ad776b --- /dev/null +++ b/install/tools/ipa-compliance @@ -0,0 +1,193 @@ +#!/usr/bin/env python +# +# Authors: +# Rob Crittenden <rcritten@redhat.com> +# +# Copyright (C) 2010 Red Hat +# see file 'COPYING' for use and warranty information +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. +# +# An LDAP client to count entitlements and log to syslog if the number is +# exceeded. + +try: + import sys + import os + import syslog + import tempfile + import krbV + import base64 + import shutil + + from rhsm.certificate import EntitlementCertificate + + from ipaserver.plugins.ldap2 import ldap2 + from ipalib import api, errors, backend +except ImportError, e: + # If python-rhsm isn't installed exit gracefully and quietly. + if e.args[0] == 'No module named rhsm.certificate': + sys.exit(0) + print >> sys.stderr, """\ +There was a problem importing one of the required Python modules. The +error was: + + %s +""" % sys.exc_value + sys.exit(1) + +# Each IPA server comes with this many entitlements +DEFAULT_ENTITLEMENTS = 25 + +class client(backend.Executioner): + """ + A simple-minded IPA client that can execute remote commands. + """ + + def run(self, method, **kw): + self.create_context() + result = self.execute(method, **kw) + return result + +def parse_options(): + from optparse import OptionParser + + parser = OptionParser() + parser.add_option("--debug", dest="debug", action="store_true", + default=False, help="enable debugging") + + options, args = parser.parse_args() + return options, args + +def check_compliance(tmpdir, debug=False): + cfg = dict( + context='cli', + in_server=False, + debug=debug, + verbose=0, + ) + + api.bootstrap(**cfg) + api.register(client) + api.finalize() + from ipalib.plugins.service import normalize_certificate, make_pem + + try: + # Create a new credentials cache for this tool. This executes + # using the systems host principal. + ccache_file = 'FILE:%s/ccache' % tmpdir + krbcontext = krbV.default_context() + principal = str('host/%s@%s' % (api.env.host, api.env.realm)) + keytab = krbV.Keytab(name='/etc/krb5.keytab', context=krbcontext) + principal = krbV.Principal(name=principal, context=krbcontext) + os.environ['KRB5CCNAME'] = ccache_file + ccache = krbV.CCache(name=ccache_file, context=krbcontext, primary_principal=principal) + ccache.init(principal) + ccache.init_creds_keytab(keytab=keytab, principal=principal) + except krbV.Krb5Error, e: + raise StandardError('Error initializing principal %s in %s: %s' % (principal.name, '/etc/krb5.keytab', str(e))) + + # entitle-sync doesn't return any information we want to see, it just + # needs to be done so the LDAP data is correct. + try: + result = api.Backend.client.run('entitle_sync') + except errors.NotRegisteredError: + # Even if not registered they have some default entitlements + pass + + ldapuri = 'ldap://%s' % api.env.host + conn = ldap2(shared_instance=False, ldap_uri=ldapuri) + + # Bind using GSSAPI + conn.connect(ccache=ccache_file) + + hostcount = 0 + # Get the hosts first + try: + (entries, truncated) = conn.find_entries('(krblastpwdchange=*)', ['dn'], + '%s,%s' % (api.env.container_host, api.env.basedn), + conn.SCOPE_ONELEVEL, + size_limit = -1) + except errors.NotFound: + # No hosts + pass + + if not truncated: + hostcount = len(entries) + else: + # This will not happen unless we bump into a server-side limit. + msg = 'The host count result was truncated, they will be underreported' + syslog.syslog(syslog.LOG_ERR, msg) + if sys.stdin.isatty(): + print msg + + available = 0 + try: + (entries, truncated) = conn.find_entries('(objectclass=ipaentitlement)', + ['dn', 'userCertificate'], + '%s,%s' % (api.env.container_entitlements, api.env.basedn), + conn.SCOPE_ONELEVEL, + size_limit = -1) + + for entry in entries: + (dn, attrs) = entry + if 'usercertificate' in attrs: + rawcert = attrs['usercertificate'][0] + rawcert = normalize_certificate(rawcert) + cert = make_pem(base64.b64encode(rawcert)) + cert = EntitlementCertificate(cert) + order = cert.getOrder() + available += int(order.getQuantityUsed()) + except errors.NotFound: + pass + + conn.disconnect() + + available += DEFAULT_ENTITLEMENTS + + if hostcount > available: + syslog.syslog(syslog.LOG_ERR, 'IPA is out of compliance: %d of %d entitlements used.' % (hostcount, available)) + if sys.stdin.isatty(): + print 'IPA is out of compliance: %d of %d entitlements used.' % (hostcount, available) + else: + if sys.stdin.isatty(): + # If run from the command-line display some info + print 'IPA is in compliance: %d of %d entitlements used.' % (hostcount, available) + +def main(): + if os.getegid() != 0: + sys.exit("Must be root to check compliance") + + if not os.path.exists('/etc/ipa/default.conf'): + return 0 + + options, args = parse_options() + + try: + tmpdir = tempfile.mkdtemp(prefix = "tmp-") + try: + check_compliance(tmpdir, options.debug) + finally: + shutil.rmtree(tmpdir) + except KeyboardInterrupt: + return 1 + except (StandardError, errors.PublicError), e: + syslog.syslog(syslog.LOG_ERR, 'IPA compliance checking failed: %s' % str(e)) + if sys.stdin.isatty(): + print 'IPA compliance checking failed: %s' % str(e) + return 1 + + return 0 + +sys.exit(main()) diff --git a/install/tools/man/Makefile.am b/install/tools/man/Makefile.am index 58959c1b9..3fac378c9 100644 --- a/install/tools/man/Makefile.am +++ b/install/tools/man/Makefile.am @@ -14,7 +14,8 @@ man1_MANS = \ ipa-ldap-updater.1 \ ipa-compat-manage.1 \ ipa-nis-manage.1 \ - ipa-host-net-manage.1 + ipa-host-net-manage.1 \ + ipa-compliance.1 man8_MANS = \ ipactl.8 \ diff --git a/install/tools/man/ipa-compliance.1 b/install/tools/man/ipa-compliance.1 new file mode 100644 index 000000000..09ce02df8 --- /dev/null +++ b/install/tools/man/ipa-compliance.1 @@ -0,0 +1,45 @@ +.\" A man page for ipa-compliance +.\" Copyright (C) 2010 Red Hat, Inc. +.\" +.\" This is free software; you can redistribute it and/or modify it under +.\" the terms of the GNU Library General Public License as published by +.\" the Free Software Foundation; version 2 only +.\" +.\" This program is distributed in the hope that it will be useful, but +.\" WITHOUT ANY WARRANTY; without even the implied warranty of +.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +.\" General Public License for more details. +.\" +.\" You should have received a copy of the GNU Library General Public +.\" License along with this program; if not, write to the Free Software +.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +.\" +.\" Author: Rob Crittenden <rcritten@redhat.com> +.\" +.TH "ipa-compliance" "1" "Dec 14 2010" "freeipa" "" +.SH "NAME" +ipa\-compliance \- Check entitlement compliance +.SH "SYNOPSIS" +ipa\-compliance [\fIOPTION\fR] +.SH "DESCRIPTION" +Verify that the IPA installation is in compliance with the number of client entitlements it has. + +Entitlements are managed using the ipa entitle command. + +An enrolled host is an machine that has a host keytab in the IPA system. + +The entitlements take the form of x509v3 certificates. The certificates are examined and the quantities summed. This is compared to the number of enrolled hosts to determine compliance. + +The command logs to syslog and if run from a tty will log to the terminal as well. + +The IPA server provides 25 entitlements of its own. +.SH "OPTIONS" +.TP +\fB\-\-\-debug\fR +Enable debugging output in the command +.SH "EXIT STATUS" +0 if the command was successful + +1 if an error occurred +.SH "NOTES" +Entitlements are not checked if the python\-rhsm package is not installed. |