summaryrefslogtreecommitdiffstats
path: root/ipaserver/install/cainstance.py
Commit message (Collapse)AuthorAgeFilesLines
* Convert server install code to platform-independent access to system servicesAlexander Bokovoy2011-09-131-18/+8
| | | | https://fedorahosted.org/freeipa/ticket/1605
* enable proxy for dogtagAdam Young2011-08-291-2/+11
| | | | | | | | | | | | | | | | | | | Dogtag is going to be proxied through httpd. To make this work, it has to support renegotiation of the SSL connection. This patch enables renegotiate in the nss configuration file during during apache configuration, as well as modifies libnss to set the appropriate optins on the ssl connection in order to renegotiate. The IPA install uses the internal ports instead of proxying through httpd since httpd is not set up yet. IPA needs to Request the certificate through a port that uses authentication. On the Dogtag side, they provide an additional mapping for this: /ca/eeca/ca as opposed tp /ca/ee/ca just for this purpose. https://fedorahosted.org/freeipa/ticket/1334 add flag to pkicreate in order to enable using proxy. add the proxy file in /etc/http/conf.d/ Signed-off-by: Simo Sorce <ssorce@redhat.com>
* Re-arrange CA configuration code to reduce the number of restarts.Rob Crittenden2011-08-031-34/+14
| | | | | | | | Ade Lee from the dogtag team looked at the configuration code and determined that a number of restarts were not needed and recommended re-arranging other code to reduce the number of restarts to one. https://fedorahosted.org/freeipa/ticket/1555
* Clean up existing DN object usageJohn Dennis2011-07-291-4/+4
|
* Set nickname of the RA to 'IPA RA' to avoid confusion with dogtag RARob Crittenden2011-07-171-2/+2
| | | | | | | | | | The old nickname was 'RA Subsystem' and this may confuse some users with the dogtag RA subsystem which we do not use. This will only affect new installs. Existing installations will continue to work fine. https://fedorahosted.org/freeipa/ticket/1236
* Use information from the certificate subject when setting the NSS nickname.Rob Crittenden2011-07-171-7/+10
| | | | | | | | | | | There were a few places in the code where certs were loaded from a PKCS#7 file or a chain in a PEM file. The certificates got very generic nicknames. We can instead pull the subject from the certificate and use that as the nickname. https://fedorahosted.org/freeipa/ticket/1141
* Fix self-signed replica installationMartin Kosek2011-07-141-2/+2
| | | | | | | | | When a replica for self-signed server is being installed, the installer crashes with "Not a dogtag CA installation". Make sure that installation is handled correctly for both dogtag and self-signed replicas. https://fedorahosted.org/freeipa/ticket/1479
* Make dogtag an optional (and default un-) installed component in a replica.Rob Crittenden2011-06-231-1/+77
| | | | | | | | | | | | | | A dogtag replica file is created as usual. When the replica is installed dogtag is optional and not installed by default. Adding the --setup-ca option will configure it when the replica is installed. A new tool ipa-ca-install will configure dogtag if it wasn't configured when the replica was initially installed. This moves a fair bit of code out of ipa-replica-install into installutils and cainstance to avoid duplication. https://fedorahosted.org/freeipa/ticket/1251
* Let the framework be able to override the hostname.Rob Crittenden2011-06-231-15/+14
| | | | | | | | | | | | | | | | | | The hostname is passed in during the server installation. We should use this hostname for the resulting server as well. It was being discarded and we always used the system hostname value. Important changes: - configure ipa_hostname in sssd on masters - set PKI_HOSTNAME so the hostname is passed to dogtag installer - set the hostname when doing ldapi binds This also reorders some things in the dogtag installer to eliminate an unnecessary restart. We were restarting the service twice in a row with very little time in between and this could result in a slew of reported errors, though the server installed ok. ticket 1052
* Make data type of certificates more obvious/predictable internally.Rob Crittenden2011-06-211-11/+3
| | | | | | | | | | | | | | | | | | | For the most part certificates will be treated as being in DER format. When we load a certificate we will generally accept it in any format but will convert it to DER before proceeding in normalize_certificate(). This also re-arranges a bit of code to pull some certificate-specific functions out of ipalib/plugins/service.py into ipalib/x509.py. This also tries to use variable names to indicate what format the certificate is in at any given point: dercert: DER cert: PEM nsscert: a python-nss Certificate object rawcert: unknown format ticket 32
* Fix external CA installationRob Crittenden2011-06-091-4/+5
| | | | | | | | When re-creating the CADS instance it needs to be more fully-populated so we have enough information to create an SSL certificate and move the principal to a real entry. https://fedorahosted.org/freeipa/ticket/1245
* Let selinux-policy handle port 7390Martin Kosek2011-05-111-18/+0
| | | | | | | | Since selinux-policy-3.9.16-5.fc15 is out, the dogtag port 7390 is handled via selinux-policy and there is no need to manage it in FreeIPA installer. https://fedorahosted.org/freeipa/ticket/1205
* Wait for Directory Server ports to openMartin Kosek2011-03-211-12/+1
| | | | | | | | | | | When Directory Server operation is run right after the server restart the listening ports may not be opened yet. This makes the installation fail. This patch fixes this issue by waiting for both secure and insecure Directory Server ports to open after every restart. https://fedorahosted.org/freeipa/ticket/1076
* Fix SELinux errors caused by enabling TLS on dogtag 389-ds instance.Rob Crittenden2011-03-151-15/+58
| | | | | | | | | | | | | | | | This fixes 2 AVCS: * One because we are enabling port 7390 because an SSL port must be defined to use TLS On 7389. * We were symlinking to the main IPA 389-ds NSS certificate databsae. Instead generate a separate NSS database and certificate and have certmonger track it separately I also noticed some variable inconsistency in cainstance.py. Everywhere else we use self.fqdn and that was using self.host_name. I found it confusing so I fixed it. ticket 1085
* Use TLS for dogtag replication agreements.Rob Crittenden2011-03-101-4/+52
| | | | | | | | Configure the dogtag 389-ds instance with SSL so we can enable TLS for the dogtag replication agreements. The NSS database we use is a symbolic link to the IPA 389-ds instance. ticket 1060
* Set SuiteSpotGroup when setting up our 389-ds instances.Rob Crittenden2011-02-241-1/+3
| | | | | | | | The group is now required because 389-ds has tightened the permissions on /var/run/dirsrv. We use the same group for both our LDAP instances and /var/run/dirsrv ends up as root:dirsrv mode 0770. ticket 1010
* Fix installing with an external CA and wait for dogtag to come upRob Crittenden2011-02-011-0/+23
| | | | | | | | | | | | | | | | | | | | | There wasn't an exception in the "is the server already installed" check for a two-stage CA installation. Made the installer slightly more robust. We create a cache file of answers so the next run won't ask all the questions again. This cache is removed when the installation is complete. Previously nothing would work if the installer was run more than once, this should be fixed now. The cache is encrypted using the DM password. The second problem is that the tomcat6 init script returns control before the web apps are up. Add a small loop in our restart method to wait for the 9180 port to be available. This also adds an additional restart to ensure that nonces are disabled. ticket 835 revise
* Use a common group for all DS instancesSimo Sorce2011-01-311-30/+32
| | | | | | | | Also remove the option to choose a user. It is silly to keep it, when you can't choose the group nor the CA directory user. Fixes: https://fedorahosted.org/freeipa/ticket/851
* fixes CA install problem in trac ticket 682John Dennis2011-01-051-18/+24
| | | | | | Do not call status after pkisilent, it will return non-zero. Instead restart server after pkisilent so configuration changes take effect, the check the status.
* Change FreeIPA license to GPLv3+Jakub Hrozek2010-12-201-5/+5
| | | | | | | | | | The changes include: * Change license blobs in source files to mention GPLv3+ not GPLv2 only * Add GPLv3+ license text * Package COPYING not LICENSE as the license blobs (even the old ones) mention COPYING specifically, it is also more common, I think https://fedorahosted.org/freeipa/ticket/239
* Properly quote passwords sent to pkisilent so special characters work.Rob Crittenden2010-12-171-7/+7
| | | | | | Also check for url-encoded passwords before logging them. ticket 324
* Fix Install using dogtag.Simo Sorce2010-12-101-2/+10
| | | | | | | The CA is installed before DS so we need to wait until DS is actually installed to be able to ldap_enable the CA instance. Fixes: https://fedorahosted.org/freeipa/ticket/612
* Move Selfsigned CA creation out of dsinstanceSimo Sorce2010-12-101-5/+5
| | | | | | | | This allows us to have the CA ready to serve out certs for any operation even before the dsinstance is created. The CA is independent of the dsinstance anyway. Also fixes: https://fedorahosted.org/freeipa/ticket/544
* Introduce ipa control script that reads configuration off ldapSimo Sorce2010-12-101-9/+5
| | | | | | | | | | | This replace the former ipactl script, as well as replace the current way ipa components are started. Instead of enabling each service in the system init scripts, enable only the ipa script, and then let it start all components based on the configuration read from the LDAP tree. resolves: https://fedorahosted.org/freeipa/ticket/294
* Use Realm as certs subject base nameSimo Sorce2010-11-181-6/+10
| | | | Also use the realm name as nickname for the CA certificate
* Include time duration hints when configuring services in ipa-server-install.Rob Crittenden2010-10-081-2/+2
| | | | | | | Give a better heads-up on how long the installation will take. Particularly important when configuring dogtag. ticket 139
* Quote passwords when calling pkisilentRob Crittenden2010-10-011-6/+7
| | | | ticket 243
* Use consistent, specific nickname for the IPA CA certificate.Rob Crittenden2010-10-011-1/+2
| | | | | | Also fix some imports for sha. We have a compat module for it, use it. ticket 181
* Remove passwords when running commands including stdout and stderrRob Crittenden2010-08-311-12/+3
| | | | | | | | | | | This replaces the old no logging mechanism that only handled not logging passwords passed on the command-line. The dogtag installer was including passwords in the output. This also adds no password logging to the sslget invocations and removes a couple of extraneous log commands. ticket 156
* Break out install into more steps, add -key_algorithm to pkisilentRob Crittenden2010-08-191-20/+9
| | | | | | | | | | | | | Installing dogtag is quite slow and it isn't always clear that things are working. This breaks out some restart calls into separate steps to show some amount of progress. There are still some steps that take more than a minute (pkicreate and pkisilent). Add new argument to pkisilent, -key_algorithm Update a bunch of minimum required versions in the spec file. tickets 139 (time) and 144 (key_algorithm)
* use NSS for SSL operationsJohn Dennis2010-06-151-24/+0
|
* Catch the condition where dogtag is already configured (no preop.pin)Rob Crittenden2010-06-011-0/+3
| | | | | | | | This causes the installation to blow up badly otherwise. To remove an existing instance run: # pkiremove -pki_instance_root=/var/lib -pki_instance_name=pki-ca
* Move the dogtag SELinux rules loading into the spec fileRob Crittenden2010-05-271-24/+0
| | | | | | I couldn't put the dogtag rules into the spec file until we required dogtag as a component. If it wasn't pre-loaded them the rules loading would fail because types would be missing.
* Include -clone_uri argument to pkisilent setting the clone URI.Rob Crittenden2010-05-271-0/+2
| | | | This makes creating a clone from a clone work as expected.
* Handle CSRs whether they have NEW in the header or notRob Crittenden2010-05-031-3/+2
| | | | Also consolidate some duplicate code
* Make the installer/uninstaller more aware of its stateRob Crittenden2010-05-031-0/+19
| | | | | | | | | | | | | | We have had a state file for quite some time that is used to return the system to its pre-install state. We can use that to determine what has been configured. This patch: - uses the state file to determine if dogtag was installed - prevents someone from trying to re-install an installed server - displays some output when uninstalling - re-arranges the ipa_kpasswd installation so the state is properly saved - removes pkiuser if it was added by the installer - fetches and installs the CA on both masters and clients
* Fix installing IPA with an external CARob Crittenden2010-04-231-1/+1
| | | | | | | | - cache all interactive answers - set non-interactive to True for the second run so nothing is asked - convert boolean values that are read in - require absolute paths for the external CA and signed cert files - fix the invocation message for the second ipa-server-install run
* Remove older MITM fixes to make compatible with dogtag 1.3.3Rob Crittenden2010-04-191-12/+2
| | | | | | | We set a new port to be used with dogtag but IPA doesn't utilize it. This also changes the way we determine which security database to use. Rather than using whether api.env.home is set use api.env.in_tree.
* Configure the CRL URI in dogtag.Rob Crittenden2010-04-161-1/+4
| | | | | | Also print out a restart message after applying the custom subject. It takes a while to restart dogtag and this lets the user know things are moving forward.
* Provide mechanism in ipautil.run() to not log all arguments.Rob Crittenden2010-03-191-1/+10
| | | | | | | This is primarily designed to not log passwords but it could have other uses. 567867
* Make CA PKCS#12 location arg for ipa-replica-prepare, default /root/cacert.p12Rob Crittenden2010-03-191-0/+5
| | | | | pki-silent puts a copy of the root CA into /root/tmp-ca.p12. Rename this to /root/cacert.p12.
* Update dogtag configuration to work after CVE-2009-3555 changesRob Crittenden2010-01-271-0/+12
| | | | | | | | NSS is going to disallow all SSL renegotiation by default. Because of this we need to always use the agent port of the dogtag server which always requires SSL client authentication. The end user port will prompt for a certificate if required but will attempt to re-do the handshake to make this happen which will fail with newer versions of NSS.
* User-defined certificate subjectsRob Crittenden2010-01-201-10/+18
| | | | | | | | | | | | | | | Let the user, upon installation, set the certificate subject base for the dogtag CA. Certificate requests will automatically be given this subject base, regardless of what is in the CSR. The selfsign plugin does not currently support this dynamic name re-assignment and will reject any incoming requests that don't conform to the subject base. The certificate subject base is stored in cn=ipaconfig but it does NOT dynamically update the configuration, for dogtag at least. The file /var/lib/pki-ca/profiles/ca/caIPAserviceCert.cfg would need to be updated and pki-cad restarted.
* Create pkiuser before calling pkicreate, pkicreate depends on the user existingJohn Dennis2010-01-201-1/+1
|
* Missed explicit reference to pki-ca, replace with self.service_nameRob Crittenden2010-01-111-2/+2
|
* Change the service name to reflect changes in pki-ca (now pki-cad).Rob Crittenden2010-01-071-3/+3
| | | | | | Also properly use the instance name where appropriate. There were a couple of places where the service name was used and this worked because they were the same.
* Make the IPA server host and its services "real" IPA entriesRob Crittenden2009-12-111-2/+2
| | | | | | | | | | | We use kadmin.local to bootstrap the creation of the kerberos principals for the IPA server machine: host, HTTP and ldap. This works fine and has the side-effect of protecting the services from modification by an admin (which would likely break the server). Unfortunately this also means that the services can't be managed by useful utilities such as certmonger. So we have to create them as "real" services instead.
* Add option to have ipautil.run() not raise an exceptionRob Crittenden2009-11-301-6/+6
| | | | | | | There are times where a caller will want to determine the course of action based on the returncode instead of relying on it != 0. This also lets the caller get the contents of stdout and stderr.
* Add SELinux policy for CRL file publishing.Rob Crittenden2009-11-261-0/+26
| | | | | | | | | | This policy should really be provided by dogtag. We don't want to grant read/write access to everything dogtag can handle so we change the context to cert_t instead. But we have to let dogtag read/write that too hence this policy. To top it off we can't load this policy unless dogtag is also loaded so we insert it in the IPA installer
* Cache installer questions for the 2-step process of an externally-signed CARob Crittenden2009-11-181-1/+2
| | | | | | | | Installing a CA that is signed by another CA is a 2-step process. The first step is to generate a CSR for the CA and the second step is to install the certificate issued by the external CA. To avoid asking questions over and over (and potentially getting different answers) the answers are cached.
generated by cgit (git 2.34.1) at 2024-04-27 20:34:16 +0000