summaryrefslogtreecommitdiffstats
path: root/ipa-client
Commit message (Collapse)AuthorAgeFilesLines
* Fix permissions in installersMartin Kosek2011-09-071-3/+6
| | | | | | | | Fix permissions for (configuration) files produced by ipa-server-install or ipa-client-install. This patch is needed when root has a umask preventing files from being world readable. https://fedorahosted.org/freeipa/ticket/1644
* Improve ipa-join man pageMartin Kosek2011-09-071-1/+12
| | | | | | Make it clear in man pages that ipa-join -u does not remove keytab. https://fedorahosted.org/freeipa/ticket/1317
* Improve man pages structureMartin Kosek2011-09-076-63/+87
| | | | | | | | | | | | | | | | There are too many options in ipa-*-install scripts which makes it difficult to read. This patch adds subsections to install script online help and man pages to improve readability. No option has been changed. To further improve man pages: 1) All man pages were changed to have the same header and top-center title to provide united look. 2) Few typos in man pages have been fixed https://fedorahosted.org/freeipa/ticket/1687
* Roll back changes if client installation fails.Rob Crittenden2011-08-291-80/+115
| | | | | | | | | | | | If the client installer fails for some reason and --force was not used then roll back the configuration. This is needed because we touch /etc/sysconfig/network early in the configuration and if it fails due to any number of issues (mostly related to authentication) it will not be reset. We may as well run through the entire uninstall process to be sure the system has been reset. https://fedorahosted.org/freeipa/ticket/1704
* ipa-client-install breaks network configurationMartin Kosek2011-08-291-5/+5
| | | | | | | | | Do not forget to add new line in updated /etc/sysconfig/network configuration. Move the actual change of the hostname after the user confirmation about proceeding with installation. It confused users when the hostname change occurred before this prompt. https://fedorahosted.org/freeipa/ticket/1724
* Disable reverse lookups in ipa-join and ipa-getkeytabRob Crittenden2011-08-252-0/+14
| | | | | | This prevents broken DNS from causing enrollment problems. https://fedorahosted.org/freeipa/ticket/1693
* Fix build warningsSimo Sorce2011-08-261-1/+1
| | | | Some are actual bugs.
* Make sure messagebus is running prior to starting certmonger.Jan Cholasta2011-08-181-0/+10
| | | | ticket 1580
* Fix client enrollmentMartin Kosek2011-08-111-1/+3
| | | | | | | | Enable GSSAPI credentials delegation in xmlrpc-c/curl to fix client enrollment. The unconditional GSSAPI was previously dropped from curl because of CVE-2011-2192. https://fedorahosted.org/freeipa/ticket/1452
* Ensure network configuration file has proper permissionsgssapi-delegateAlexander Bokovoy2011-08-101-0/+10
| | | | | | | | | | As network configuration file is created as temporary file, it has stricter permissions than we need for the target system configuration file. Ensure permissions are properly reset before installing file. If permissions are not re-set, system may have no networking enabled after reboot. https://fedorahosted.org/freeipa/ticket/1606
* Make proper LDAP configuration reporting for ipa-client-installAlexander Bokovoy2011-07-281-18/+29
| | | | Ticket https://fedorahosted.org/freeipa/ticket/1369
* Modify /etc/sysconfig/network on a client when IPA manages hostnameAlexander Bokovoy2011-07-292-5/+62
| | | | https://fedorahosted.org/freeipa/ticket/1368
* Make sure that hostname specified by user is not an IP address.Jan Cholasta2011-07-251-1/+4
| | | | ticket 1375
* Make ipa-client-install error messages more understandable and relevant.Rob Crittenden2011-07-193-36/+53
| | | | | | | | | | | * Check remote LDAP server to see if it is a V2 server * Replace numeric return values with alphanumeric constants * Display the error message from the ipa-enrollment extended op * Remove generic join failed error message when XML-RPC fails * Don't display Certificate subject base when enrollment fails * Return proper error message when LDAP bind fails https://fedorahosted.org/freeipa/ticket/1417
* Fix sssd.conf to always have IPA certificate for the domain.Alexander Bokovoy2011-07-181-0/+6
| | | | | | | | | Fixes https://fedorahosted.org/freeipa/ticket/1476 SSSD will need TLS for checking if ipaMigrationEnabled attribute is set Note that SSSD will force StartTLS because the channel is later used for authentication as well if password migration is enabled. Thus set the option unconditionally.
* Change client enrollment principal prompt to hopefully be clearer.Rob Crittenden2011-07-191-1/+1
| | | | ticket https://fedorahosted.org/freeipa/ticket/1449
* Rearrange logging for NSCD daemon.Alexander Bokovoy2011-07-181-1/+4
| | | | | | | https://fedorahosted.org/freeipa/ticket/1373 When SSSD is in use, we actually trying to disable NSCD daemon. Telling that we failed to configure automatic _startup_ of the NSCD is wrong then.
* Configure SSSD to store user password if offline.Jan Cholasta2011-07-142-0/+7
| | | | ticket 1359
* Remove redundant configuration values from krb5.conf.Jan Cholasta2011-06-281-3/+0
| | | | ticket 1358
* On a master configure sssd to only talk to the local master.Rob Crittenden2011-06-211-1/+5
| | | | | | | | Otherwise it is possible for sssd to pick a different master to communicate with via the DNS SRV records and if the remote master goes down the local one will have problems as well. ticket https://fedorahosted.org/freeipa/ticket/1187
* Fix support for nss-pam-ldapdMartin Kosek2011-06-081-14/+45
| | | | | | | | | | | | | Client installation with --no-sssd option was broken if the client was based on a nss-pam-ldap instead of nss_ldap. The main issue is with authconfig rewriting the nslcd.conf after it has been configured by ipa-client-install. This has been fixed by changing an order of installation steps. Additionally, nslcd daemon needed for nss-pam-ldap function is correctly started. https://fedorahosted.org/freeipa/ticket/1235
* Properly configure nsswitch.conf when using the --no-sssd option.Rob Crittenden2011-05-181-3/+4
| | | | | | | | | | | Even with --no-sssd authconfig was setting nsswitch.conf to use sssd for users, groups, shadow and netgroups. We need to pass in the --enableforcelegacy option hwen configuring nss_ldap. Also always back up and restore sssd.conf. It still gets configured for kerberos. ticket 1142
* KDC autodiscovery may fail when domain is not realmMartin Kosek2011-05-172-15/+26
| | | | | | | | | | | | | When ipa-client-install autodiscovers IPA server values it doesn't fill the fixed KDC address to Kerberos configuration file. However, when realm != domain or the autodiscovered values are overridden, installation may fail because it cannot find the KDC. This patch adds a failover to use static KDC address in case when such an issue occurs. https://fedorahosted.org/freeipa/ticket/1100
* Improve service manipulation in client installMartin Kosek2011-05-131-93/+64
| | | | | | | | Remove redundant ipa-client-install error message when optional nscd daemon was not installed. Additionally, use standard IPA functions for service manipulation and improve logging. https://fedorahosted.org/freeipa/ticket/1207
* Consolidate man pages and IPA tools helpMartin Kosek2011-05-121-7/+7
| | | | | | | | IPA tools options are not consistent with information in man pages. https://fedorahosted.org/freeipa/ticket/1163 https://fedorahosted.org/freeipa/ticket/1178
* Fix issues found by Coverity.Jan Cholasta2011-05-092-1/+9
| | | | tickets 1166, 1167, 1168, 1169
* install-scripts: avoid using --list with chkconfigSimo Sorce2011-05-061-6/+0
| | | | | | | | | | | | | This option does not behave properly in F15 as chkconfig does not list services moved to use systemd service files. Plus there are more direct ways than parsing its output, which are more reliable. Also just testing for the availability of the service calling 'chkconfig name' is enough. https://fedorahosted.org/freeipa/ticket/1206
* Bad return values for ipa-rmkeytab commandMartin Kosek2011-05-032-1/+9
| | | | | | | | | ipa-rmkeytab returns success even when the realm passed to the program is not found in a keytab. This patch adds an explanatory error message and returns error code 5 - Principal or realm not found. https://fedorahosted.org/freeipa/ticket/694
* ipa-client-install uninstall does not work on IPA serverMartin Kosek2011-04-291-1/+1
| | | | | | | When IPA server is being uninstalled, IPA client on-master uninstallation which is called by the script fails. https://fedorahosted.org/freeipa/ticket/1197
* Forbid reinstallation in ipa-client-installMartin Kosek2011-04-291-7/+8
| | | | | | | | | | | | The --force option may be misused to reinstall an existing IPA client. This is not supported and may lead to unexpected errors. When required, the cleanest way to re-install IPA client is to run uninstall and then install again. This patch also includes few cosmetic changes in messages to user to provide more consistent user experience with the script. https://fedorahosted.org/freeipa/ticket/1117
* Prevent uninstalling client on the IPA serverMartin Kosek2011-04-291-0/+6
| | | | | | | | This patch prevents uninstalling IPA client when it is configured as a part of IPA server. ipa-server-installation script is advised for this situation. https://fedorahosted.org/freeipa/ticket/1049
* Log temporary files in ipa-client-installMartin Kosek2011-04-281-1/+8
| | | | | | | | This patch adds logging of temporary files (Kerberos configuration, nsupdate commands) that may be very useful for debugging purposes. https://fedorahosted.org/freeipa/ticket/1093 https://fedorahosted.org/freeipa/ticket/1094
* Fix lint false positives.Jan Cholasta2011-04-131-1/+1
|
* Suppress --on-master from ipa-client-install command-line and man page.Rob Crittenden2011-04-122-4/+4
| | | | | | | | This option is only used when configuring an IPA client on an IPA server. Describing it on the command-line will only confuse people so don't list it as an option. Ticket 1050
* Make retrieval of the CA during DNS discovery non-fatal.Rob Crittenden2011-03-301-1/+2
| | | | ticket 1135
* Ensure that the system hostname is lower-case.Rob Crittenden2011-03-181-5/+8
| | | | ticket 1080
* Always consider domain and server when doing DNS discovery in client.Rob Crittenden2011-03-151-8/+4
| | | | | | | | | When not on master we weren't passing in the user-supplied domain and server. Because of changes made that require TLS on the LDAP calls we always need the server name early in the process to retrieve the IPA CA certificate. ticket 1090
* If --hostname is provided for ipa-client-install use it everywhere.Rob Crittenden2011-03-081-11/+56
| | | | | | | | | | | | | | | | | | | If a hostname was provided it wasn't used to configure either certmonger or sssd. This resulted in a non-working configuration. Additionally on un-enrollment the wrong hostname was unenrolled, it used the value of gethostname() rather than the one that was passed into the installer. We have to modify the CA configuration of certmonger to make it use the right principal when requesting certificates. The filename is unpredicable but it will be in /var/lib/certmonger/cas. We need to hunt for ipa_submit and add -k <principal> to it, then undo that on uninstall. These files are created the first time the certmonger service starts, so start and stop it before messing with them. ticket 1029
* Always try to stop tracking the server cert when uninstalling client.Rob Crittenden2011-03-081-10/+13
| | | | | | | | | | | stop_tracking() is robust enough to do the right thing if no certificate exists so go ahead and always call it. If the certificate failed to be issued for some reason the request will still in certmonger after uninstalling. This would cause problems when trying to reinstall the client. This will go ahead and always tell certmonger to stop tracking it. ticket 1028
* Fix kinit invocation in ipa-client-installSimo Sorce2011-03-011-1/+2
|
* Add man page for the IPA configuration fileRob Crittenden2011-02-232-2/+187
| | | | ticket 969
* Set krb5_realm in sssd.conf in the ipa provider.Rob Crittenden2011-02-221-2/+4
| | | | ticket 925
* 18 Use TLS for ipadiscovery during ipa-client-install ↵Jr Aquino2011-02-211-0/+24
| | | | https://fedorahosted.org/freeipa/ticket/974
* Document --enable-dns-updates in ipa-client-install man pageJakub Hrozek2011-02-211-0/+3
| | | | https://fedorahosted.org/freeipa/ticket/991
* Fixes in ipa-join man pageJan Zeleny2011-02-182-11/+11
| | | | | | https://fedorahosted.org/freeipa/ticket/784 https://fedorahosted.org/freeipa/ticket/786 https://fedorahosted.org/freeipa/ticket/787
* Try to register DNS name through a DNS Update on install.Simo Sorce2011-02-171-0/+111
| | | | Fixes: https://fedorahosted.org/freeipa/ticket/935
* Configure SSSD to use DNS to find the IPA server by default.Rob Crittenden2011-02-171-1/+1
| | | | | | Add the server we registered with as a fallback. ticket 980
* Fix duplicate OIDsSimo Sorce2011-02-172-3/+3
| | | | | | | | | | | | | | | Apparently we forgot to check OID consistency between the schema and the extensions, and we got duplicates. Technically the schema was done later but it is easier to change the extensions OIDs than to change the schema of current beta2/rc1 installations. The only side effect is that older ipa-getkeytab and ipa-join binaries will fail. So all the admin/client tools must be upgraded at the same time as well as all the masters (otherwise some will show/accept the new OID while others won't). Fixes: https://fedorahosted.org/freeipa/ticket/976
* Fix a typo in ipa-client-install man pageJan Zeleny2011-02-151-1/+0
| | | | https://fedorahosted.org/freeipa/ticket/782
* Bugfix for ipa-client-install echo's password in cleartext to stdout ↵Jr Aquino2011-02-141-2/+4
| | | | https://fedorahosted.org/freeipa/ticket/959
generated by cgit (git 2.34.1) at 2024-11-12 22:17:03 +0000