diff options
Diffstat (limited to 'install/tools/ipa-ca-install')
| -rwxr-xr-x | install/tools/ipa-ca-install | 183 |
1 files changed, 183 insertions, 0 deletions
diff --git a/install/tools/ipa-ca-install b/install/tools/ipa-ca-install new file mode 100755 index 000000000..edd8f4cfd --- /dev/null +++ b/install/tools/ipa-ca-install @@ -0,0 +1,183 @@ +#! /usr/bin/python -E +# Authors: Rob Crittenden <rcritten@redhat.com> +# +# Copyright (C) 2011 Red Hat +# see file 'COPYING' for use and warranty information +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. +# + +import sys +import socket + +import os, traceback, logging, shutil + +from ipapython import ipautil + +from ipaserver.install import installutils, service +from ipaserver.install import certs +from ipaserver.install.installutils import HostnameLocalhost +from ipaserver.install.installutils import ReplicaConfig, expand_replica_info, read_replica_info +from ipaserver.install.installutils import get_host_name +from ipaserver.install import dsinstance, cainstance +from ipaserver.install.replication import replica_conn_check +from ipapython import version +from ipalib import api, util +from ipapython.config import IPAOptionParser +from ipapython import sysrestore + +CACERT="/etc/ipa/ca.crt" +REPLICA_INFO_TOP_DIR=None + +def parse_options(): + usage = "%prog [options] REPLICA_FILE" + parser = IPAOptionParser(usage=usage, version=version.VERSION) + parser.add_option("-d", "--debug", dest="debug", action="store_true", + default=False, help="gather extra debugging information") + parser.add_option("-p", "--password", dest="password", sensitive=True, + help="Directory Manager (existing master) password") + parser.add_option("-w", "--admin-password", dest="admin_password", sensitive=True, + help="Admin user Kerberos password used for connection check") + parser.add_option("--no-host-dns", dest="no_host_dns", action="store_true", + default=False, + help="Do not use DNS for hostname lookup during installation") + parser.add_option("--skip-conncheck", dest="skip_conncheck", action="store_true", + default=False, help="skip connection check to remote master") + parser.add_option("-U", "--unattended", dest="unattended", action="store_true", + default=False, help="unattended installation never prompts the user") + + options, args = parser.parse_args() + safe_options = parser.get_safe_opts(options) + + if len(args) != 1: + parser.error("you must provide a file generated by ipa-replica-prepare") + + return safe_options, options, args[0] + +def get_dirman_password(): + return installutils.read_password("Directory Manager (existing master)", confirm=False, validate=False) + +def main(): + safe_options, options, filename = parse_options() + installutils.standard_logging_setup("/var/log/ipareplica-ca-install.log", options.debug) + logging.debug('%s was invoked with argument "%s" and options: %s' % (sys.argv[0], filename, safe_options)) + + if not ipautil.file_exists(filename): + sys.exit("Replica file %s does not exist" % filename) + + global sstore + sstore = sysrestore.StateFile('/var/lib/ipa/sysrestore') + + if not dsinstance.DsInstance().is_configured(): + sys.exit("IPA server is not configured on this system.\n") + + # get the directory manager password + dirman_password = options.password + if not dirman_password: + if options.unattended: + sys.exit('Directory Manager password required') + try: + dirman_password = get_dirman_password() + except KeyboardInterrupt: + sys.exit(0) + + if not options.admin_password and not options.skip_conncheck and \ + options.unattended: + sys.exit('admin password required') + + try: + top_dir, dir = expand_replica_info(filename, dirman_password) + global REPLICA_INFO_TOP_DIR + REPLICA_INFO_TOP_DIR = top_dir + except Exception, e: + print "ERROR: Failed to decrypt or open the replica file." + print "Verify you entered the correct Directory Manager password." + sys.exit(1) + + config = ReplicaConfig() + read_replica_info(dir, config) + config.dirman_password = dirman_password + try: + host = get_host_name(options.no_host_dns) + except RuntimeError, e: + logging.error(str(e)) + sys.exit(1) + if config.host_name != host: + try: + print "This replica was created for '%s' but this machine is named '%s'" % (config.host_name, host) + if not ipautil.user_input("This may cause problems. Continue?", True): + sys.exit(0) + config.host_name = host + print "" + except KeyboardInterrupt: + sys.exit(0) + config.dir = dir + config.setup_ca = True + + if not options.skip_conncheck: + replica_conn_check(config.master_host_name, config.host_name, config.realm_name, True, options.admin_password) + + api.bootstrap(in_server=True) + api.finalize() + + # Configure the CA if necessary + (CA, cs) = cainstance.install_replica_ca(config, postinstall=True) + + # We need to ldap_enable the CA now that DS is up and running + CA.ldap_enable('CA', config.host_name, config.dirman_password, + util.realm_to_suffix(config.realm_name)) + cs.add_simple_service('dogtagldap/%s@%s' % (config.host_name, config.realm_name)) + cs.add_cert_to_service() + + service.print_msg("Setting the certificate subject base") + CA.set_subject_in_config(util.realm_to_suffix(config.realm_name)) + +try: + if not os.geteuid()==0: + sys.exit("\nYou must be root to run this script.\n") + + main() + sys.exit(0) +except SystemExit, e: + sys.exit(e) +except socket.error, (errno, errstr): + print errstr +except HostnameLocalhost: + print "The hostname resolves to the localhost address (127.0.0.1/::1)" + print "Please change your /etc/hosts file so that the hostname" + print "resolves to the ip address of your network interface." + print "" + print "Please fix your /etc/hosts file and restart the setup program" +except Exception, e: + print "creation of replica failed: %s" % str(e) + message = str(e) + for str in traceback.format_tb(sys.exc_info()[2]): + message = message + "\n" + str + logging.debug(message) +except KeyboardInterrupt: + print "Installation cancelled." +finally: + # always try to remove decrypted replica file + try: + if REPLICA_INFO_TOP_DIR: + shutil.rmtree(REPLICA_INFO_TOP_DIR) + except OSError: + pass + +print "" +print "Your system may be partly configured." +print "Run /usr/sbin/ipa-server-install --uninstall to clean up." + +# the only way to get here is on error or ^C +sys.exit(1) |