summaryrefslogtreecommitdiffstats
path: root/ipaserver
diff options
context:
space:
mode:
authorMartin Babinsky <mbabinsk@redhat.com>2015-03-12 16:14:22 +0100
committerTomas Babej <tbabej@redhat.com>2015-03-18 12:31:23 +0100
commit7b6bee030dac08807f254fdf58ba867c36cab23d (patch)
tree2dabcb943cbe957fbf7d950b76fc4ec70af4ba30 /ipaserver
parenta58b77ca9cd3620201306258dd6bd05ea1c73c73 (diff)
downloadfreeipa-7b6bee030dac08807f254fdf58ba867c36cab23d.tar.gz
freeipa-7b6bee030dac08807f254fdf58ba867c36cab23d.tar.xz
freeipa-7b6bee030dac08807f254fdf58ba867c36cab23d.zip
ipa-dns-install: use STARTTLS to connect to DS
BindInstance et al. now use STARTTLS to set up secure connection to DS during ipa-dns-install. This fixes https://fedorahosted.org/freeipa/ticket/4933 Reviewed-By: Martin Basti <mbasti@redhat.com>
Diffstat (limited to 'ipaserver')
-rw-r--r--ipaserver/install/bindinstance.py11
-rw-r--r--ipaserver/install/dnskeysyncinstance.py7
-rw-r--r--ipaserver/install/odsexporterinstance.py5
-rw-r--r--ipaserver/install/opendnssecinstance.py5
-rw-r--r--ipaserver/install/service.py10
5 files changed, 25 insertions, 13 deletions
diff --git a/ipaserver/install/bindinstance.py b/ipaserver/install/bindinstance.py
index 52aea74cd..679dc5b95 100644
--- a/ipaserver/install/bindinstance.py
+++ b/ipaserver/install/bindinstance.py
@@ -533,13 +533,16 @@ class DnsBackup(object):
class BindInstance(service.Service):
- def __init__(self, fstore=None, dm_password=None, api=api):
- service.Service.__init__(self, "named",
+ def __init__(self, fstore=None, dm_password=None, api=api,
+ start_tls=False):
+ service.Service.__init__(
+ self, "named",
service_desc="DNS",
dm_password=dm_password,
ldapi=False,
- autobind=ipaldap.AUTOBIND_DISABLED
- )
+ autobind=ipaldap.AUTOBIND_DISABLED,
+ start_tls=start_tls
+ )
self.dns_backup = DnsBackup(self)
self.named_user = None
self.domain = None
diff --git a/ipaserver/install/dnskeysyncinstance.py b/ipaserver/install/dnskeysyncinstance.py
index 090c87505..eb6d07f01 100644
--- a/ipaserver/install/dnskeysyncinstance.py
+++ b/ipaserver/install/dnskeysyncinstance.py
@@ -62,13 +62,14 @@ def dnssec_container_exists(fqdn, suffix, dm_password=None, ldapi=False,
class DNSKeySyncInstance(service.Service):
def __init__(self, fstore=None, dm_password=None, logger=root_logger,
- ldapi=False):
+ ldapi=False, start_tls=False):
service.Service.__init__(
self, "ipa-dnskeysyncd",
service_desc="DNS key synchronization service",
dm_password=dm_password,
- ldapi=ldapi
- )
+ ldapi=ldapi,
+ start_tls=start_tls
+ )
self.dm_password = dm_password
self.logger = logger
self.extra_config = [u'dnssecVersion 1', ] # DNSSEC enabled
diff --git a/ipaserver/install/odsexporterinstance.py b/ipaserver/install/odsexporterinstance.py
index e01550446..463e9a675 100644
--- a/ipaserver/install/odsexporterinstance.py
+++ b/ipaserver/install/odsexporterinstance.py
@@ -19,13 +19,14 @@ from ipalib import errors
class ODSExporterInstance(service.Service):
- def __init__(self, fstore=None, dm_password=None):
+ def __init__(self, fstore=None, dm_password=None, start_tls=False):
service.Service.__init__(
self, "ipa-ods-exporter",
service_desc="IPA OpenDNSSEC exporter daemon",
dm_password=dm_password,
ldapi=False,
- autobind=ipaldap.AUTOBIND_DISABLED
+ autobind=ipaldap.AUTOBIND_DISABLED,
+ start_tls=start_tls
)
self.dm_password = dm_password
self.ods_uid = None
diff --git a/ipaserver/install/opendnssecinstance.py b/ipaserver/install/opendnssecinstance.py
index 869cf8ffe..2a2c3126f 100644
--- a/ipaserver/install/opendnssecinstance.py
+++ b/ipaserver/install/opendnssecinstance.py
@@ -61,13 +61,14 @@ def check_inst():
class OpenDNSSECInstance(service.Service):
- def __init__(self, fstore=None, dm_password=None):
+ def __init__(self, fstore=None, dm_password=None, start_tls=False):
service.Service.__init__(
self, "ods-enforcerd",
service_desc="OpenDNSSEC enforcer daemon",
dm_password=dm_password,
ldapi=False,
- autobind=ipaldap.AUTOBIND_DISABLED
+ autobind=ipaldap.AUTOBIND_DISABLED,
+ start_tls=start_tls
)
self.dm_password = dm_password
self.ods_uid = None
diff --git a/ipaserver/install/service.py b/ipaserver/install/service.py
index 75285cd90..5a04ef323 100644
--- a/ipaserver/install/service.py
+++ b/ipaserver/install/service.py
@@ -72,8 +72,9 @@ def format_seconds(seconds):
class Service(object):
- def __init__(self, service_name, service_desc=None, sstore=None, dm_password=None, ldapi=True,
- autobind=ipaldap.AUTOBIND_AUTO):
+ def __init__(self, service_name, service_desc=None, sstore=None,
+ dm_password=None, ldapi=True, autobind=ipaldap.AUTOBIND_AUTO,
+ start_tls=False):
self.service_name = service_name
self.service_desc = service_desc
self.service = services.service(service_name)
@@ -82,6 +83,7 @@ class Service(object):
self.dm_password = dm_password
self.ldapi = ldapi
self.autobind = autobind
+ self.start_tls = start_tls
self.fqdn = socket.gethostname()
self.admin_conn = None
@@ -107,6 +109,10 @@ class Service(object):
if not self.realm:
raise errors.NotFound(reason="realm is missing for %s" % (self))
conn = ipaldap.IPAdmin(ldapi=self.ldapi, realm=self.realm)
+ elif self.start_tls:
+ conn = ipaldap.IPAdmin(self.fqdn, port=389, protocol='ldap',
+ cacert=paths.IPA_CA_CRT,
+ start_tls=self.start_tls)
else:
conn = ipaldap.IPAdmin(self.fqdn, port=389)