#! /usr/bin/python -E # Authors: Rob Crittenden # # Copyright (C) 2011 Red Hat # see file 'COPYING' for use and warranty information # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . # import sys import socket import os, traceback, logging, shutil from ipapython import ipautil from ipaserver.install import installutils, service from ipaserver.install import certs from ipaserver.install.installutils import HostnameLocalhost from ipaserver.install.installutils import ReplicaConfig, expand_replica_info, read_replica_info from ipaserver.install.installutils import get_host_name from ipaserver.install import dsinstance, cainstance from ipaserver.install.replication import replica_conn_check from ipapython import version from ipalib import api, util from ipapython.config import IPAOptionParser from ipapython import sysrestore CACERT="/etc/ipa/ca.crt" REPLICA_INFO_TOP_DIR=None def parse_options(): usage = "%prog [options] REPLICA_FILE" parser = IPAOptionParser(usage=usage, version=version.VERSION) parser.add_option("-d", "--debug", dest="debug", action="store_true", default=False, help="gather extra debugging information") parser.add_option("-p", "--password", dest="password", sensitive=True, help="Directory Manager (existing master) password") parser.add_option("-w", "--admin-password", dest="admin_password", sensitive=True, help="Admin user Kerberos password used for connection check") parser.add_option("--no-host-dns", dest="no_host_dns", action="store_true", default=False, help="Do not use DNS for hostname lookup during installation") parser.add_option("--skip-conncheck", dest="skip_conncheck", action="store_true", default=False, help="skip connection check to remote master") parser.add_option("-U", "--unattended", dest="unattended", action="store_true", default=False, help="unattended installation never prompts the user") options, args = parser.parse_args() safe_options = parser.get_safe_opts(options) if len(args) != 1: parser.error("you must provide a file generated by ipa-replica-prepare") return safe_options, options, args[0] def get_dirman_password(): return installutils.read_password("Directory Manager (existing master)", confirm=False, validate=False) def main(): safe_options, options, filename = parse_options() installutils.standard_logging_setup("/var/log/ipareplica-ca-install.log", options.debug) logging.debug('%s was invoked with argument "%s" and options: %s' % (sys.argv[0], filename, safe_options)) if not ipautil.file_exists(filename): sys.exit("Replica file %s does not exist" % filename) global sstore sstore = sysrestore.StateFile('/var/lib/ipa/sysrestore') if not dsinstance.DsInstance().is_configured(): sys.exit("IPA server is not configured on this system.\n") # get the directory manager password dirman_password = options.password if not dirman_password: if options.unattended: sys.exit('Directory Manager password required') try: dirman_password = get_dirman_password() except KeyboardInterrupt: sys.exit(0) if not options.admin_password and not options.skip_conncheck and \ options.unattended: sys.exit('admin password required') try: top_dir, dir = expand_replica_info(filename, dirman_password) global REPLICA_INFO_TOP_DIR REPLICA_INFO_TOP_DIR = top_dir except Exception, e: print "ERROR: Failed to decrypt or open the replica file." print "Verify you entered the correct Directory Manager password." sys.exit(1) config = ReplicaConfig() read_replica_info(dir, config) config.dirman_password = dirman_password try: host = get_host_name(options.no_host_dns) except RuntimeError, e: logging.error(str(e)) sys.exit(1) if config.host_name != host: try: print "This replica was created for '%s' but this machine is named '%s'" % (config.host_name, host) if not ipautil.user_input("This may cause problems. Continue?", True): sys.exit(0) config.host_name = host print "" except KeyboardInterrupt: sys.exit(0) config.dir = dir config.setup_ca = True if not options.skip_conncheck: replica_conn_check(config.master_host_name, config.host_name, config.realm_name, True, options.admin_password) api.bootstrap(in_server=True) api.finalize() # Configure the CA if necessary (CA, cs) = cainstance.install_replica_ca(config, postinstall=True) # We need to ldap_enable the CA now that DS is up and running CA.ldap_enable('CA', config.host_name, config.dirman_password, util.realm_to_suffix(config.realm_name)) cs.add_simple_service('dogtagldap/%s@%s' % (config.host_name, config.realm_name)) cs.add_cert_to_service() service.print_msg("Setting the certificate subject base") CA.set_subject_in_config(util.realm_to_suffix(config.realm_name)) try: if not os.geteuid()==0: sys.exit("\nYou must be root to run this script.\n") main() sys.exit(0) except SystemExit, e: sys.exit(e) except socket.error, (errno, errstr): print errstr except HostnameLocalhost: print "The hostname resolves to the localhost address (127.0.0.1/::1)" print "Please change your /etc/hosts file so that the hostname" print "resolves to the ip address of your network interface." print "" print "Please fix your /etc/hosts file and restart the setup program" except Exception, e: print "creation of replica failed: %s" % str(e) message = str(e) for str in traceback.format_tb(sys.exc_info()[2]): message = message + "\n" + str logging.debug(message) except KeyboardInterrupt: print "Installation cancelled." finally: # always try to remove decrypted replica file try: if REPLICA_INFO_TOP_DIR: shutil.rmtree(REPLICA_INFO_TOP_DIR) except OSError: pass print "" print "Your system may be partly configured." print "Run /usr/sbin/ipa-server-install --uninstall to clean up." # the only way to get here is on error or ^C sys.exit(1)