summaryrefslogtreecommitdiffstats
path: root/install/tools
Commit message (Collapse)AuthorAgeFilesLines
* Let the framework be able to override the hostname.Rob Crittenden2011-06-233-2/+4
| | | | | | | | | | | | | | | | | | The hostname is passed in during the server installation. We should use this hostname for the resulting server as well. It was being discarded and we always used the system hostname value. Important changes: - configure ipa_hostname in sssd on masters - set PKI_HOSTNAME so the hostname is passed to dogtag installer - set the hostname when doing ldapi binds This also reorders some things in the dogtag installer to eliminate an unnecessary restart. We were restarting the service twice in a row with very little time in between and this could result in a slew of reported errors, though the server installed ok. ticket 1052
* Fix IPA install for secure umaskMartin Kosek2011-06-213-25/+37
| | | | | | | | Make sure that IPA can be installed with root umask set to secure value 077. ipa-server-install was failing in DS configuration phase when dirsrv tried to read boot.ldif created during installation. https://fedorahosted.org/freeipa/ticket/1282
* Make data type of certificates more obvious/predictable internally.Rob Crittenden2011-06-211-1/+1
| | | | | | | | | | | | | | | | | | | For the most part certificates will be treated as being in DER format. When we load a certificate we will generally accept it in any format but will convert it to DER before proceeding in normalize_certificate(). This also re-arranges a bit of code to pull some certificate-specific functions out of ipalib/plugins/service.py into ipalib/x509.py. This also tries to use variable names to indicate what format the certificate is in at any given point: dercert: DER cert: PEM nsscert: a python-nss Certificate object rawcert: unknown format ticket 32
* The IP address provided to ipa-server-install must be localRob Crittenden2011-06-201-1/+1
| | | | | | | Compare the configured interfaces with the supplied IP address and optional netmask to determine if the interface is available. https://fedorahosted.org/freeipa/ticket/1175
* Improve IP address handling in IPA option parserMartin Kosek2011-06-194-6/+8
| | | | | | | | | | | Implements a way to pass match_local and parse_netmask parameters to IP option checker. Now, there is just one common option type "ip" with new optional attributes "ip_local" and "ip_netmask" which can be used to pass IP address validation parameters. https://fedorahosted.org/freeipa/ticket/1333
* Add port 9443 to replica port checkingMartin Kosek2011-06-151-6/+7
| | | | | | | Port 9443 (Agent secure port on PKI-CA) was missing. Additionaly, checked port descriptions case consistency fixed. https://fedorahosted.org/freeipa/ticket/1321
* Improve DNS zone creationMartin Kosek2011-06-151-5/+3
| | | | | | | | | | | | | | | When a new DNS zone is being created a local hostname is set as a nameserver of the new zone. However, when the zone is created during ipa-replica-prepare, the the current master/replica doesn't have to be an IPA server with DNS support. This would lead to DNS zones with incorrect NS records as they wouldn't point to a valid name server. Now, a list of all master servers with DNS support is retrieved during DNS zone creation and added as NS records for a new DNS zone. https://fedorahosted.org/freeipa/ticket/1261
* Do better detection on status of CA DS instance when installing.Rob Crittenden2011-06-131-4/+4
| | | | | | | | | The conditional used to determine if thd CA 389-ds instance was already configured was rather poor so it was possible to pass command-line arguments in to confuse it. This would cause it to not be installed at all causing the dogtag installation to fail in a strange way. https://fedorahosted.org/freeipa/ticket/1244
* Fix directory manager password validation in ipa-nis-manage.Jan Cholasta2011-06-131-2/+8
| | | | ticket 1283, 1284
* Remove root autobind search restriction, fix upgrade logging & error handling.Rob Crittenden2011-06-131-7/+14
| | | | | | | | | | | | | | | There was no point in limiting autobind root to just search cn=config since it could always just modify its way out of the box, so remove the restriction. The upgrade log wasn't being created. Clearing all other loggers before we calling logging.basicConfig() fixes this. Add a global exception when performing updates so we can gracefully catch and log problems without leaving the server in a bad state. https://fedorahosted.org/freeipa/ticket/1243 https://fedorahosted.org/freeipa/ticket/1254
* IPA installation with --no-host-dns failsMartin Kosek2011-06-103-12/+23
| | | | | | | | | | | | --no-host-dns option should allow installing IPA server on a host without a DNS resolvable name. Update parse_ip_address and verify_ip_address functions has been changed not to return None and print error messages in case of an error, but rather let the Exception be handled by the calling routine. https://fedorahosted.org/freeipa/ticket/1246
* Fix external CA installationRob Crittenden2011-06-091-2/+2
| | | | | | | | When re-creating the CADS instance it needs to be more fully-populated so we have enough information to create an SSL certificate and move the principal to a real entry. https://fedorahosted.org/freeipa/ticket/1245
* Skip know_host check for ipa-replica-conncheckMartin Kosek2011-06-081-1/+3
| | | | | | | | | | | | When IPA replica is installed and the master machine record is not in ~/.ssh/known_hosts, ipa-replica-install will prompt user to answer a question about adding a host to this file. This has, however, a potential to break automatic tests. ipa-replica-conncheck should not require any further user interaction when all mandatory options are filled. https://fedorahosted.org/freeipa/ticket/1305
* Connection check program for replica installationMartin Kosek2011-06-086-0/+507
| | | | | | | | | | | | | | | | | | | | | | | | | | When connection between a master machine and future replica is not sane, the replica installation may fail unexpectedly with inconvenient error messages. One common problem is misconfigured firewall. This patch adds a program ipa-replica-conncheck which tests the connection using the following procedure: 1) Execute the on-replica check testing the connection to master 2) Open required ports on local machine 3) Ask user to run the on-master part of the check OR run it automatically: a) kinit to master as default admin user with given password b) run the on-master part using ssh 4) When master part is executed, it checks connection back to the replica and prints the check result This program is run by ipa-replica-install as mandatory part. It can, however, be skipped using --skip-conncheck option. ipa-replica-install now requires password for admin user to run the command on remote master. https://fedorahosted.org/freeipa/ticket/1107
* Fix forward zone creation in ipa-replica-prepareMartin Kosek2011-06-081-2/+3
| | | | | | | When a new forward zone is created in ipa-replica-prepare the master DNS address gets corrupted by invalid A/AAAA record. https://fedorahosted.org/freeipa/ticket/1260
* Honor netmask in DNS reverse zone setup.Jan Cholasta2011-05-304-10/+36
| | | | ticket 910
* Parse netmasks in IP addresses passed to server install.Jan Cholasta2011-05-304-31/+37
| | | | ticket 1212
* Fix reverse zone creation in ipa-replica-prepareMartin Kosek2011-05-274-64/+18
| | | | | | | | | When a new reverse zone was created in ipa-replica-prepare (this may happen when a new replica is from different subnet), the master DNS address was corrupted by invalid A/AAAA record. This caused problems for example in installing replica. https://fedorahosted.org/freeipa/ticket/1223
* Document that deleting and re-adding a replica requires a dirsrv restart.Rob Crittenden2011-05-261-10/+16
| | | | | | | | If you install a replica, delete the replica, then re-add it and then try to re-initialize the agreement it will fail because the remote master has the old service principals cached. It needs to be restarted to work. ticket 1077
* Running ipa-replica-manage as non-root cause errorsMartin Kosek2011-05-131-1/+8
| | | | | | | | Logging errors are printed out when ipa-replica-manage is run as a non-root user. Log has been disabled in such case to prevent such messages. https://fedorahosted.org/freeipa/ticket/1046
* Consolidate man pages and IPA tools helpMartin Kosek2011-05-125-29/+74
| | | | | | | | IPA tools options are not consistent with information in man pages. https://fedorahosted.org/freeipa/ticket/1163 https://fedorahosted.org/freeipa/ticket/1178
* Properly handle --no-reverse being passed on the CLI in interactive modeRob Crittenden2011-05-122-6/+14
| | | | | | | If installing in interactive mode and --no-reverse is passed then the reverse zone was still being created. ticket 1152
* Forbid reinstallation in ipa-client-installMartin Kosek2011-04-291-1/+2
| | | | | | | | | | | | The --force option may be misused to reinstall an existing IPA client. This is not supported and may lead to unexpected errors. When required, the cleanest way to re-install IPA client is to run uninstall and then install again. This patch also includes few cosmetic changes in messages to user to provide more consistent user experience with the script. https://fedorahosted.org/freeipa/ticket/1117
* IPA replica is not started after the rebootMartin Kosek2011-04-281-0/+3
| | | | https://fedorahosted.org/freeipa/ticket/1191
* Ensure that the zonemgr passed to the installer conforms to IA5String.Rob Crittenden2011-04-261-1/+12
| | | | ticket 1164
* Delete the sudoers entry when disabling Schema CompatJr Aquino2011-04-251-0/+1
| | | | https://fedorahosted.org/freeipa/ticket/1160
* Fix some minor issues uncovered by pylint.Jan Cholasta2011-04-201-0/+1
| | | | | Disable pylint error _ undefined in i18n tests Fix missing os import in ipa-nis-manage
* The default groups we create should have ipaUniqueId setRob Crittenden2011-04-151-1/+2
| | | | | | | | This adds a new directive to ipa-ldap-updater: addifnew. This will add a new attribute only if it doesn't exist in the current entry. We can't compare values because the value we are adding is automatically generated. ticket 1177
* Fix lint false positives.Jan Cholasta2011-04-131-1/+1
|
* Fix traceback in ipa-nis-manage.Rob Crittenden2011-04-113-3/+10
| | | | | | | | | | | | | | | | | The root user cannot use ldapi because of the autobind configuration. Fall back to a standard GSSAPI sasl bind if the external bind fails. With --ldapi a regular user may be trying this as well, catch that and report a reasonable error message. This also gives priority to the DM password if it is passed in. Also require the user be root to run the ipa-nis-manage command. We enable/disable and start/stop services which need to be done as root. Add a new option to ipa-ldap-updater to prompt for the DM password. Remove restriction to be run as root except when doing an upgrade. Ticket 1157
* Fix typo in ipa-server-install.Jan Cholasta2011-04-081-1/+1
|
* Add note about ipa-dns-install to ipa-server-install man page.Jan Cholasta2011-03-311-0/+7
| | | | ticket 1082
* Replica installation fails for self-signed serverMartin Kosek2011-03-301-1/+2
| | | | | | | When IPA server was configured as self-signed (--selfsign option) the replica always failed to install. https://fedorahosted.org/freeipa/ticket/1122
* Automatically update IPA LDAP on rpm upgradesRob Crittenden2011-03-212-19/+43
| | | | | | | | | | | | | | | Re-enable ldapi code in ipa-ldap-updater and remove the searchbase restriction when run in --upgrade mode. This allows us to autobind giving root Directory Manager powers. This also: * corrects the ipa-ldap-updater man page * remove automatic --realm, --server, --domain options * handle upgrade errors properly * saves a copy of dse.ldif before we change it so it can be recovered * fixes an error discovered by pylint ticket 1087
* Fix SELinux errors caused by enabling TLS on dogtag 389-ds instance.Rob Crittenden2011-03-153-28/+20
| | | | | | | | | | | | | | | | This fixes 2 AVCS: * One because we are enabling port 7390 because an SSL port must be defined to use TLS On 7389. * We were symlinking to the main IPA 389-ds NSS certificate databsae. Instead generate a separate NSS database and certificate and have certmonger track it separately I also noticed some variable inconsistency in cainstance.py. Everywhere else we use self.fqdn and that was using self.host_name. I found it confusing so I fixed it. ticket 1085
* Use TLS for dogtag replication agreements.Rob Crittenden2011-03-102-3/+39
| | | | | | | | Configure the dogtag 389-ds instance with SSL so we can enable TLS for the dogtag replication agreements. The NSS database we use is a symbolic link to the IPA 389-ds instance. ticket 1060
* chkconfig the ipa service off when it is uninstalled.Rob Crittenden2011-03-081-0/+2
| | | | ticket 1056
* Improve error handling and return status codes in ipactlMartin Kosek2011-03-071-30/+89
| | | | | | | | | | | | | | | | | | | | | | | | | | There are cases when ipactl returns success even when it fails. Plus, when the error really is detected the status codes are not LSB compliant. This may result in consequent issues. This patch improves error handling in ipactl and adds LSB compliant status codes. Namely: 0 program is running or service is OK 3 program is not running 4 program or service status is unknown for "status" action. Status code 4 is issued when IPA is not configured to distinguish this state from not running IPA. For other actions, the following non-zero status codes are implemented: 1 generic or unspecified error 2 invalid or excess argument(s) 4 user had insufficient privilege 6 program is not configured https://fedorahosted.org/freeipa/ticket/1055
* Skip DNS validation checks if we're setting up DNS in ipa-server-install.Rob Crittenden2011-03-041-0/+4
| | | | | | | If we're going to be authoritative ourselves don't bother with what other DNS servers think. ticket 1036
* Use ldapi: instead of unsecured ldap: in ipa core tools.Pavel Zuna2011-03-037-33/+28
| | | | | | The patch also corrects exception handling in some of the tools. Fix #874
* Need to restart the dogtag 388-ds instance before using it.Rob Crittenden2011-03-031-0/+17
| | | | | | | | | | | Restart the 389-ds instance to ensure all schema is loaded that dogtag may have installed as files. According to bug https://bugzilla.redhat.com/show_bug.cgi?id=680984 this it is only needed on clones. ticket 1024
* Inconsistent sysrestore file handling by IPA server installerMartin Kosek2011-03-031-2/+2
| | | | | | | | | | | | IPA server/replica uninstallation may fail when it tries to restore a Directory server configuration file in sysrestore directory, which was already restored before. The problem is in Directory Server uninstaller which uses and modifies its own image of sysrestore directory state instead of using the common uninstaller image. https://fedorahosted.org/freeipa/ticket/1026
* IPA replica/server install does not check for a clientMartin Kosek2011-03-032-0/+10
| | | | | | | | | | | When IPA replica or server is configured it does not check for possibly installed client. This will cause the installation to fail in the very end. This patch adds a check for already configured client and suggests removing it before server/replica installation. https://fedorahosted.org/freeipa/ticket/1002
* Store list of non-master replicas in DIT and provide way to list themSimo Sorce2011-03-021-30/+80
| | | | Fixes: https://fedorahosted.org/freeipa/ticket/1007
* Use wrapper for sasl gssapi binds so it behaves like other bindsSimo Sorce2011-03-011-1/+1
| | | | | | | | | | By calling directly sasl_interactive_bind_s() we were not calling __lateinit() This in turn resulted in some variables like dbdir not to be set on the IPAadmin object. Keep all bind types in the same place so the same common sbind steps can be performed in each case. Related to: https://fedorahosted.org/freeipa/ticket/1022
* Fixed in ipa-server-install help and man pageJan Zeleny2011-02-182-2/+5
| | | | https://fedorahosted.org/freeipa/ticket/831
* Note --ip-address parameter of ipa-replica-prepare in man pageJakub Hrozek2011-02-151-0/+2
| | | | https://fedorahosted.org/freeipa/ticket/615
* Require ipactl be run as root to avoid a lot of misleading error msgs.Rob Crittenden2011-02-151-0/+3
| | | | | | | | Trying to run ipactl as non-root results in a slew of bogus error messages, some of which come because dirsrv can't read certain files as the wrong user, some based on our handling of that fact. ticket 936
* Fix two problems with ipa-replica-prepareRob Crittenden2011-02-141-1/+1
| | | | | | | | | | | 1. Fix a unicode() problem creating the DNS entries 2. Fix a strange NSS error when generating the certificates against a dogtag server. The NSS errors are quite strange. When generating the first certificate nss_shutdown() fails because the database isn't initialized yet but nss_is_initialized() returned True. The second pass fails because something is in use.
* Handle bad DM password in ipa-host-net-manage & ipa-copmat-manage.Rob Crittenden2011-02-142-2/+6
| | | | | | | This was resulting in a traceback because while conn was not None it wasn't connected either. ticket 920
generated by cgit (git 2.34.1) at 2024-05-24 10:26:12 +0000