summaryrefslogtreecommitdiffstats
path: root/ipaserver/install
Commit message (Collapse)AuthorAgeFilesLines
...
* Change the service name to reflect changes in pki-ca (now pki-cad).Rob Crittenden2010-01-071-3/+3
| | | | | | Also properly use the instance name where appropriate. There were a couple of places where the service name was used and this worked because they were the same.
* Added Fuzzy docstrings; make-test now runs doctests in tests/*; fixed ↵Jason Gerard DeRose2009-12-181-1/+1
| | | | 'existant' mispelling
* Make hosts more like real services so we can issue certs for host principalsRob Crittenden2009-12-161-1/+2
| | | | | This patch should make joining a client to the domain and using certmonger to get an initial certificate work.
* Make the IPA server host and its services "real" IPA entriesRob Crittenden2009-12-118-20/+134
| | | | | | | | | | | We use kadmin.local to bootstrap the creation of the kerberos principals for the IPA server machine: host, HTTP and ldap. This works fine and has the side-effect of protecting the services from modification by an admin (which would likely break the server). Unfortunately this also means that the services can't be managed by useful utilities such as certmonger. So we have to create them as "real" services instead.
* Bump the installation version number to V2.0Rob Crittenden2009-12-031-1/+1
|
* Ask the user before overwriting /etc/named.confMartin Nagy2009-12-021-1/+9
|
* Add option to have ipautil.run() not raise an exceptionRob Crittenden2009-11-305-14/+14
| | | | | | | There are times where a caller will want to determine the course of action based on the returncode instead of relying on it != 0. This also lets the caller get the contents of stdout and stderr.
* Add SELinux policy for CRL file publishing.Rob Crittenden2009-11-261-0/+26
| | | | | | | | | | This policy should really be provided by dogtag. We don't want to grant read/write access to everything dogtag can handle so we change the context to cert_t instead. But we have to let dogtag read/write that too hence this policy. To top it off we can't load this policy unless dogtag is also loaded so we insert it in the IPA installer
* Point to correct location of self-signed CA and set pw on 389-DS cert dbRob Crittenden2009-11-251-1/+1
| | | | | | | | The CA was moved from residing in the DS NSS database into the Apache database to support a self-signed CA certificate plugin. This was not updated in the installer boilerplate. The DS db wasn't getting a password set on it. Go ahead and set one.
* Add code to handle stash files using keytab formatNalin Dahyabhai2009-11-241-3/+59
| | | | | | | | | | | | | In krb5 1.7 and later, the stash file (/var/kerberos/krb5kdc/.k5.$REALM on Fedora) is created in the regular keytab format instead of the older less-portable one. Based from comments and code in kt_file.c, here's a change to try to recognize that case (the file starts with a magic number) and read the master key from Python. The KDC will still read either format, so I left the bits that set things up on replicas alone (advice appreciated). The patch works as expected on my 64-bit box, both on RHEL5 (krb5 1.6.1 with a traditional stash file) and on Raw Hide (krb5 1.7 with a keytab).
* Cache installer questions for the 2-step process of an externally-signed CARob Crittenden2009-11-181-1/+2
| | | | | | | | Installing a CA that is signed by another CA is a 2-step process. The first step is to generate a CSR for the CA and the second step is to install the certificate issued by the external CA. To avoid asking questions over and over (and potentially getting different answers) the answers are cached.
* Fix SASL mappingsSimo Sorce2009-11-181-2/+2
|
* Add a sleep() prior to calling tasks to ensure postop writes are doneRob Crittenden2009-10-161-0/+3
| | | | | | We were seeing a rare deadlock of DS when creating the memberOf task because one thread was adding memberOf in a postop while another was trying to create an index and this was causing a PRLock deadlock.
* Be more forgiving when trying to replace older DS schema.Rob Crittenden2009-10-161-4/+8
| | | | | | | We have to replace 05rfc2247.ldif because it contains some conflicting attributes with DNS in some older versions of 389-DS/RHDS. This fails on some newer versions of 389-DS/RHDS so this lets it continue installing if the new file is not needed.
* Loosen the ACI for the KDC to allow adds/deletesRob Crittenden2009-10-051-3/+1
| | | | | | | | Password policy entries must be a child of the entry protected by this ACI. Also change the format of this because in DS it was stored as: \n(target)\n so was base64-encoded when it was retrieved.
* Robustness fix for updater, in case updates['updates'] is not set yet.Rob Crittenden2009-10-051-1/+1
|
* Let the updater delete entries and add small test harnessRob Crittenden2009-10-051-6/+49
| | | | | | | | In order to run the tests you must put your DM password into ~/.ipa/.dmpw Some tests are expected to generate errors. Don't let any ERROR messages from the updater fool you, watch the pass/fail of the nosetests.
* Enrollment for a host in an IPA domainRob Crittenden2009-09-241-0/+4
| | | | | | | | | | | | This will create a host service principal and may create a host entry (for admins). A keytab will be generated, by default in /etc/krb5.keytab If no kerberos credentails are available then enrollment over LDAPS is used if a password is provided. This change requires that openldap be used as our C LDAP client. It is much easier to do SSL using openldap than mozldap (no certdb required). Otherwise we'd have to write a slew of extra code to create a temporary cert database, import the CA cert, ...
* Add external CA signing and abstract out the RA backendRob Crittenden2009-09-154-156/+399
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | External CA signing is a 2-step process. You first have to run the IPA installer which will generate a CSR. You pass this CSR to your external CA and get back a cert. You then pass this cert and the CA cert and re-run the installer. The CSR is always written to /root/ipa.csr. A run would look like: # ipa-server-install --ca --external-ca -p password -a password -r EXAMPLE.COM -u dirsrv -n example.com --hostname=ipa.example.com -U [ sign cert request ] # ipa-server-install --ca --external-ca -p password -a password --external_cert_file=/tmp/rob.crt --external_ca_file=/tmp/cacert.crt -U -p password -a password -r EXAMPLE.COM -u dirsrv -n example.com --hostname=ipa.example.com This also abstracts out the RA backend plugin so the self-signed CA we create can be used in a running server. This means that the cert plugin can request certs (and nothing else). This should let us do online replica creation. To handle the self-signed CA the simple ca_serialno file now contains additional data so we don't have overlapping serial numbers in replicas. This isn't used yet. Currently the cert plugin will not work on self-signed replicas. One very important change for self-signed CAs is that the CA is no longer held in the DS database. It is now in the Apache database. Lots of general fixes were also made in ipaserver.install.certs including: - better handling when multiple CA certificates are in a single file - A temporary directory for request certs is not always created when the class is instantiated (you have to call setup_cert_request())
* Add A and PTR records of ourselves during installationMartin Nagy2009-09-021-3/+16
| | | | | | | If the DNS zones already exist but don't contain our own records, add them. This patch introduces the ipalib.api into the installers. For now, the code is still little messy. Later patches will abandon the way we create zones now and use ipalib.api exclusively.
* Use DNS forwarders in /etc/named.confMartin Nagy2009-09-021-1/+12
| | | | | | | | | This patch adds options --forwarder and --no-forwarders. At least one of them must be used if you are doing a setup with DNS server. They are also mutually exclusive. The --forwarder option can be used more than once to specify more servers. If the installer runs in interactive mode, it will prompt the user if none of these option was given at the command line.
* Add the CA constraint to the self-signed CA we generateRob Crittenden2009-08-271-8/+19
| | | | 514027
* Add option to the installer for uid/gid starting numbers.Rob Crittenden2009-08-271-2/+5
| | | | | | | | | | | | This also adds a new option to the template system. If you include eval(string) in a file that goes through the templater then the string in the eval will be evaluated by the Python interpreter. This is used so one can do $UIDSTART+1. If any errors occur during the evaluation the original string is is returned, eval() and all so it is up to the developer to make sure the evaluation passes. The default value for uid and gid is now a random value between 1,000,000 and (2^31 - 1,000,000)
* Enable ldapi connections in the management framework.Rob Crittenden2009-08-271-0/+4
| | | | | | If you don't want to use ldapi then you can remove the ldap_uri setting in /etc/ipa/default.conf. The default for the framework is to use ldap://localhost:389/
* Generate CRLs and make them available from the IPA web serverRob Crittenden2009-08-261-0/+46
|
* Clean up additional issues discovered with pylint and pycheckerRob Crittenden2009-08-201-1/+1
|
* Clean up some problems discovered with pylint and pycheckerRob Crittenden2009-08-128-43/+26
| | | | | Much of this is formatting to make pylint happy but it also fixes some real bugs.
* Fixed whitespace indentation error in certs.pyJason Gerard DeRose2009-07-271-34/+34
|
* Identify CAs to trust from an imported PKCS#12 fileRob Crittenden2009-07-272-14/+45
| | | | | | | | | | We used to use certutil -O to determine the cert chain to trust. This behavior changed in F-11 such that untrusted CAs are not displayed. This is only used when we import PKCS#12 files so use pk12util -l to display the list of certs and keys in the file to determine the nickname(s) of the CAs to trust. 509111
* Fix deprecation warning for the sha library on Python 2.6Rob Crittenden2009-07-231-2/+8
| | | | | | | | | | sha has been replaced by hashlib. We need to support Python 2.4 - 2.6 so this will use hashlib if available but fall back onto sha if not. Fortunately they use the same API for the function we need. 509042 Signed-off-by: Jason Gerard DeRose <jderose@redhat.com>
* No need to trust NSS built-in CA's, more specific regex for finding CA nicknameRob Crittenden2009-07-231-4/+16
| | | | | | | | | | - Add some logging so we have a better idea of what happened if things fail - Default to self-signed CA to trust if one is not found. This will fix the self-signed CA case where certutil doesn't return untrusted CA's in -O output. - Remove unused httplib import Signed-off-by: Jason Gerard DeRose <jderose@redhat.com>
* Make --setup-dns work on replica installationMartin Nagy2009-07-221-4/+34
| | | | | | | The ipa-replica-install script will setup the DNS if user specifies the --setup-dns option. It will only add the zone into LDAP if the cn=dns,$SUFFIX container doesn't exist. For now, however, we do not add the records.
* Add a reverse zone with server's PTR recordMartin Nagy2009-07-221-5/+17
| | | | Also, small cosmetic change in dns.ldif.
* Allow replicas of an IPA server using an internal dogtag server as the CARob Crittenden2009-07-154-93/+201
| | | | | | | | This involves creating a new CA instance on the replica and using pkisilent to create a clone of the master CA. Also generally fixes IPA to work with the latest dogtag SVN tip. A lot of changes to ports and configuration have been done recently.
* Basic changes to get a default principal for DNSSimo Sorce2009-07-102-1/+61
| | | | | | | | Also moves delagation layout installation in dsinstance. This is needed to allow us to set default membership in other modules like bindinstance. Signed-off-by: Martin Nagy <mnagy@redhat.com>
* Use LDAP instead of flat file for zone storageMartin Nagy2009-06-024-19/+16
|
* Move the __ldap_mod function to the Service classMartin Nagy2009-06-023-65/+47
| | | | | | We were duplicating it for KrbInstance and DsInstance. Since we will also need it for BindInstance as well, it will be better if it is in the Service class instead.
* Use the csv module instead of my own hackish lexer.Rob Crittenden2009-05-191-34/+30
| | | | | | | | The first character in a line is used to determine how the line will be quoted. If it begins with no quote we use '. If it begins with either ' or " we use that character. So if you have a quoted string and you don't want it to be considered a comma-separated value put the other quote string around the whole block.
* Drop the binary subtype. This usage is deprecated according to Rich M.Rob Crittenden2009-05-131-1/+1
|
* Utilize the new dogtag library for retrieving the CA cert chainRob Crittenden2009-05-041-15/+4
|
* Add signing profile to CA installation so we can sign the firefox jar file.Rob Crittenden2009-05-044-57/+170
| | | | | | | Use the requestId we get back from the CA when requesting the RA agent cert and use that to issue the certificate rather than hardcoding 7. This also adds some clean-up of file permissions and leaking fds
* Rename errors2.py to errors.py. Modify all affected files.Pavel Zuna2009-04-233-14/+14
|
* Issue DS and Apache server certs during CA installation.Rob Crittenden2009-04-204-102/+355
| | | | | | | Notes: - will create a CA instance (pki-ca) if it doesn't exist - maintains support for a self-signed CA - A signing cert is still not created so Firefox autoconfig still won't work
* Finish work replacing the errors module with errors2Rob Crittenden2009-04-201-6/+6
| | | | | | Once this is committed we can start the process of renaming errors2 as errors. I thought that combinig this into one commit would be more difficult to review.
* Implement an installer for the Dogtag certificate system.Rob Crittenden2009-04-034-16/+760
| | | | | | | | | | | | | | | The CA is currently not automatically installed. You have to pass in the --ca flag to install it. What works: - installation - unistallation - cert/ra plugins can issue and retrieve server certs What doesn't work: - self-signed CA is still created and issues Apache and DS certs - dogtag and python-nss not in rpm requires - requires that CS be in the "pre" install state from pkicreate
* Translate variables on all lines and sort files to be updatedRob Crittenden2009-03-251-3/+5
| | | | | | | | Only the dn and the first line of any entry that was spread across multiple lines were getting passed through the template engine. If we are given a directory to process, sort the files in that directory so the order can be predicted. Some updates rely on others.
* DNA is now configured using an update fileRob Crittenden2009-03-251-4/+0
|
* Install policy schemaJakub Hrozek2009-02-131-0/+2
|
* Remove references to detail. This was used by the v1 exception systemRob Crittenden2009-02-111-20/+3
|
* Incorporate new schema for IPAv2Rob Crittenden2009-02-111-0/+6
| | | | | | | | Loading this via LDIF is a temporary measure until we can load it online. This requires removing the dNSRecord declarations from 05rfc2247.ldif so a replacement copy is included for now. Also add the netgroups container.
generated by cgit (git 2.34.1) at 2025-09-03 00:37:28 +0000