#! /usr/bin/python2 -E # Authors: Rob Crittenden # # Copyright (C) 2011 Red Hat # see file 'COPYING' for use and warranty information # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # import sys import os import shutil from ipapython import ipautil from ipaserver.install import installutils from ipaserver.install import certs from ipaserver.install.installutils import create_replica_config from ipaserver.install import dsinstance, ca from ipapython import version from ipalib import api from ipapython.dn import DN from ipapython.config import IPAOptionParser from ipapython.ipa_log_manager import * from ipaplatform.paths import paths log_file_name = paths.IPAREPLICA_CA_INSTALL_LOG REPLICA_INFO_TOP_DIR = None def parse_options(): usage = "%prog [options] REPLICA_FILE" parser = IPAOptionParser(usage=usage, version=version.VERSION) parser.add_option("-d", "--debug", dest="debug", action="store_true", default=False, help="gather extra debugging information") parser.add_option("-p", "--password", dest="password", sensitive=True, help="Directory Manager (existing master) password") parser.add_option("-w", "--admin-password", dest="admin_password", sensitive=True, help="Admin user Kerberos password used for connection check") parser.add_option("--no-host-dns", dest="no_host_dns", action="store_true", default=False, help="Do not use DNS for hostname lookup during installation") parser.add_option("--skip-conncheck", dest="skip_conncheck", action="store_true", default=False, help="skip connection check to remote master") parser.add_option("--skip-schema-check", dest="skip_schema_check", action="store_true", default=False, help="skip check for updated CA DS schema on the remote master") parser.add_option("-U", "--unattended", dest="unattended", action="store_true", default=False, help="unattended installation never prompts the user") parser.add_option("--external-ca", dest="external_ca", action="store_true", default=False, help="Generate a CSR to be signed by an external CA") parser.add_option("--external-ca-type", dest="external_ca_type", type="choice", choices=("generic", "ms-cs"), help="Type of the external CA") parser.add_option("--external-cert-file", dest="external_cert_files", action="append", metavar="FILE", help="File containing the IPA CA certificate and the external CA certificate chain") parser.add_option("--ca-signing-algorithm", dest="ca_signing_algorithm", type="choice", choices=('SHA1withRSA', 'SHA256withRSA', 'SHA512withRSA'), help="Signing algorithm of the IPA CA certificate") options, args = parser.parse_args() safe_options = parser.get_safe_opts(options) if args: filename = args[0] if len(args) != 1: parser.error("you must provide a file generated by " "ipa-replica-prepare") options.external_ca = None options.external_cert_files = None else: filename = None if options.external_ca: if options.external_cert_files: parser.error("You cannot specify --external-cert-file " "together with --external-ca") if options.external_ca_type and not options.external_ca: parser.error( "You cannot specify --external-ca-type without --external-ca") return safe_options, options, filename def get_dirman_password(): return installutils.read_password( "Directory Manager (existing master)", confirm=False, validate=False) def install_replica(safe_options, options, filename): standard_logging_setup(log_file_name, debug=options.debug) root_logger.debug('%s was invoked with argument "%s" and options: %s', sys.argv[0], filename, safe_options) root_logger.debug('IPA version %s', version.VENDOR_VERSION) if not ipautil.file_exists(filename): sys.exit("Replica file %s does not exist" % filename) if not dsinstance.DsInstance().is_configured(): sys.exit("IPA server is not configured on this system.\n") api.bootstrap(in_server=True) api.finalize() # get the directory manager password dirman_password = options.password if not dirman_password: if options.unattended: sys.exit('Directory Manager password required') try: dirman_password = get_dirman_password() except KeyboardInterrupt: sys.exit(0) if dirman_password is None: sys.exit("Directory Manager password required") if not options.admin_password and not options.skip_conncheck and \ options.unattended: sys.exit('admin password required') config = create_replica_config(dirman_password, filename, options) global REPLICA_INFO_TOP_DIR REPLICA_INFO_TOP_DIR = config.top_dir config.setup_ca = True api.Backend.ldap2.connect(bind_dn=DN(('cn', 'Directory Manager')), bind_pw=dirman_password) options.realm_name = config.realm_name options.domain_name = config.domain_name options.dm_password = config.dirman_password options.host_name = config.host_name options.subject = config.subject_base ca.install_check(True, config, options) ca.install(True, config, options) def install_master(safe_options, options): standard_logging_setup(paths.IPASERVER_CA_INSTALL_LOG, debug=options.debug) root_logger.debug( "%s was invoked with options: %s", sys.argv[0], safe_options) root_logger.debug("IPA version %s", version.VENDOR_VERSION) if not dsinstance.DsInstance().is_configured(): sys.exit("IPA server is not configured on this system.\n") api.bootstrap(in_server=True) api.finalize() dm_password = options.password if not dm_password: if options.unattended: sys.exit('Directory Manager password required') try: dm_password = get_dirman_password() except KeyboardInterrupt: sys.exit(0) if dm_password is None: sys.exit("Directory Manager password required") api.Backend.ldap2.connect(bind_dn=DN(('cn', 'Directory Manager')), bind_pw=dm_password) config = api.Command['config_show']()['result'] subject_base = config['ipacertificatesubjectbase'][0] options.realm_name = api.env.realm options.domain_name = api.env.domain options.dm_password = dm_password options.host_name = api.env.host options.subject = subject_base ca.install_check(True, None, options) ca.install(True, None, options) def main(): safe_options, options, filename = parse_options() if os.geteuid() != 0: sys.exit("\nYou must be root to run this script.\n") if filename is not None: install_replica(safe_options, options, filename) else: install_master(safe_options, options) fail_message = ''' Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ''' if __name__ == '__main__': try: with ipautil.private_ccache(): installutils.run_script(main, log_file_name=log_file_name, operation_name='ipa-ca-install', fail_message=fail_message) finally: # always try to remove decrypted replica file try: if REPLICA_INFO_TOP_DIR: shutil.rmtree(REPLICA_INFO_TOP_DIR) except OSError: pass