diff options
Diffstat (limited to 'install')
| -rw-r--r-- | install/share/Makefile.am | 2 | ||||
| -rw-r--r-- | install/share/kdc.conf.template | 2 | ||||
| -rw-r--r-- | install/share/kdc_extensions.template | 32 | ||||
| -rw-r--r-- | install/share/kdc_req.conf.template | 14 | ||||
| -rwxr-xr-x | install/tools/ipa-server-install | 36 |
5 files changed, 85 insertions, 1 deletions
diff --git a/install/share/Makefile.am b/install/share/Makefile.am index e4b6ca385..3423ce287 100644 --- a/install/share/Makefile.am +++ b/install/share/Makefile.am @@ -24,6 +24,8 @@ app_DATA = \ bind.zone.db.template \ certmap.conf.template \ kdc.conf.template \ + kdc_extensions.template \ + kdc_req.conf.template \ krb5.conf.template \ krb5.ini.template \ krb.con.template \ diff --git a/install/share/kdc.conf.template b/install/share/kdc.conf.template index 4a2cca412..f8e07c77b 100644 --- a/install/share/kdc.conf.template +++ b/install/share/kdc.conf.template @@ -12,4 +12,6 @@ dict_file = /usr/share/dict/words default_principal_flags = +preauth ; admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab + pkinit_identity = FILE:/var/kerberos/krb5kdc/kdc.pem + pkinit_anchors = FILE:/var/kerberos/krb5kdc/cacert.pem } diff --git a/install/share/kdc_extensions.template b/install/share/kdc_extensions.template new file mode 100644 index 000000000..df992babd --- /dev/null +++ b/install/share/kdc_extensions.template @@ -0,0 +1,32 @@ +[ kdc_cert ] +basicConstraints=CA:FALSE + +# Here are some examples of the usage of nsCertType. If it is omitted +keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyAgreement + +#Pkinit EKU +extendedKeyUsage = 1.3.6.1.5.2.3.5 + +subjectKeyIdentifier=hash +authorityKeyIdentifier=keyid,issuer + +# Copy subject details + +issuerAltName=issuer:copy + +# Add id-pkinit-san (pkinit subjectAlternativeName) +# Also add the KDC fqdn, for good measure. +subjectAltName=otherName:1.3.6.1.5.2.2;SEQUENCE:kdc_princ_name,DNS:${ENV::HOST_FQDN} + +[kdc_princ_name] +realm = EXP:0, GeneralString:${ENV::REALM} +principal_name = EXP:1, SEQUENCE:kdc_principal_seq + +[kdc_principal_seq] +name_type = EXP:0, INTEGER:1 +name_string = EXP:1, SEQUENCE:kdc_principals + +[kdc_principals] +princ1 = GeneralString:krbtgt +princ2 = GeneralString:${ENV::REALM} + diff --git a/install/share/kdc_req.conf.template b/install/share/kdc_req.conf.template new file mode 100644 index 000000000..872852079 --- /dev/null +++ b/install/share/kdc_req.conf.template @@ -0,0 +1,14 @@ +[ req ] +default_bits = 2048 +distinguished_name = req_distinguished_name +attributes = req_attributes +prompt = no +output_password = $PASSWORD + +[ req_distinguished_name ] +$SUBJBASE +$CERTNAME + +[ req_attributes ] +challengePassword = A challenge password + diff --git a/install/tools/ipa-server-install b/install/tools/ipa-server-install index 569079d5a..0584c1118 100755 --- a/install/tools/ipa-server-install +++ b/install/tools/ipa-server-install @@ -106,14 +106,20 @@ def parse_options(): default=False, help="uninstall an existing installation") parser.add_option("-N", "--no-ntp", dest="conf_ntp", action="store_false", help="do not configure ntp", default=True) + parser.add_option("--no-pkinit", dest="setup_pkinit", action="store_false", + default=True, help="disables pkinit setup steps") parser.add_option("--dirsrv_pkcs12", dest="dirsrv_pkcs12", help="PKCS#12 file containing the Directory Server SSL certificate") parser.add_option("--http_pkcs12", dest="http_pkcs12", help="PKCS#12 file containing the Apache Server SSL certificate") + parser.add_option("--pkinit_pkcs12", dest="pkinit_pkcs12", + help="PKCS#12 file containing the Kerberos KDC SSL certificate") parser.add_option("--dirsrv_pin", dest="dirsrv_pin", sensitive=True, help="The password of the Directory Server PKCS#12 file") parser.add_option("--http_pin", dest="http_pin", sensitive=True, help="The password of the Apache Server PKCS#12 file") + parser.add_option("--pkinit_pin", dest="pkinit_pin", + help="The password of the Kerberos KDC PKCS#12 file") parser.add_option("--no-host-dns", dest="no_host_dns", action="store_true", default=False, help="Do not use DNS for hostname lookup during installation") @@ -503,6 +509,8 @@ def main(): print " * Configure Apache (httpd)" if options.setup_dns: print " * Configure DNS (bind)" + if options.setup_pkinit: + print " * Configure the KDC to enable PKINIT" if not options.conf_ntp: print "" print "Excluded by options:" @@ -529,6 +537,12 @@ def main(): print "Aborting installation" return 1 + # check the pkinit plugin is installed + if options.setup_pkinit: + if not krbinstance.check_pkinit_plugin(): + print "Aborting installation" + return 1 + # check the hostname is correctly configured, it must be as the kldap # utilities just use the hostname as returned by gethostbyname to set # up some of the standard entries @@ -722,9 +736,29 @@ def main(): else: ds.create_instance(ds_user, realm_name, host_name, domain_name, dm_password, self_signed_ca=options.selfsign, uidstart=options.uidstart, gidstart=options.gidstart, subject_base=options.subject, hbac_allow=not options.hbac_allow) + if options.pkinit_pin: + [pw_fd, pw_name] = tempfile.mkstemp() + os.write(pw_fd, options.dirsrv_pin) + os.close(pw_fd) + # Create a kerberos instance krb = krbinstance.KrbInstance(fstore) - krb.create_instance(ds_user, realm_name, host_name, domain_name, dm_password, master_password) + if options.pkinit_pkcs12: + pkcs12_info = (options.pkinit_pkcs12, pw_name) + krb.create_instance(ds_user, realm_name, host_name, domain_name, + dm_password, master_password, + setup_pkinit=options.setup_pkinit, + pkcs12_info=pkcs12_info, + subject_base=options.subject) + else: + krb.create_instance(ds_user, realm_name, host_name, domain_name, + dm_password, master_password, + setup_pkinit=options.setup_pkinit, + self_signed_ca=options.selfsign, + subject_base=options.subject) + + if options.pkinit_pin: + os.remove(pw_name) # The DS instance is created before the keytab, add the SSL cert we # generated |