1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
|
#! /usr/bin/python -E
# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
#
# Copyright (C) 2007 Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License as
# published by the Free Software Foundation; version 2 only
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
# requires the following packages:
# fedora-ds-base
# openldap-clients
# nss-tools
VERSION = "%prog .1"
import sys
sys.path.append("/usr/share/ipa")
import socket
import logging
import pwd
from optparse import OptionParser
import ipaserver.dsinstance
import ipaserver.krbinstance
from ipa.ipautil import run
def parse_options():
parser = OptionParser(version=VERSION)
parser.add_option("-u", "--user", dest="ds_user",
help="ds user")
parser.add_option("-r", "--realm", dest="realm_name",
help="realm name")
parser.add_option("-p", "--ds-password", dest="dm_password",
help="admin password")
parser.add_option("-P", "--master-password", dest="master_password",
help="kerberos master password")
parser.add_option("-a", "--admin-password", dest="admin_password",
help="admin user kerberos password")
parser.add_option("-d", "--debug", dest="debug", action="store_true",
dest="debug", default=False, help="print debugging information")
parser.add_option("--hostname", dest="host_name", help="fully qualified name of server")
parser.add_option("-U", "--unattended", dest="unattended",
help="unattended installation never prompts the user")
options, args = parser.parse_args()
if options.unattended and (not options.ds_user or
not options.realm_name or
not options.dm_password or
not options.admin_password or
not options.master_password):
parser.error("error: In unattended mode you need to provide -u, -r, -p and -P options")
return options
def logging_setup(options):
# Always log everything (i.e., DEBUG) to the log
# file.
logging.basicConfig(level=logging.DEBUG,
format='%(asctime)s %(levelname)s %(message)s',
filename='ipaserver-install.log',
filemode='w')
console = logging.StreamHandler()
# If the debug option is set, also log debug messages to the console
if options.debug:
console.setLevel(logging.DEBUG)
else:
# Otherwise, log critical and error messages
console.setLevel(logging.ERROR)
formatter = logging.Formatter('%(name)-12s: %(levelname)-8s %(message)s')
console.setFormatter(formatter)
logging.getLogger('').addHandler(console)
def setup_hosts(host, ip):
print ""
print "TODO"
print ""
print ""
def main():
options = parse_options()
logging_setup(options)
ds_user = ""
realm_name = ""
host_name = ""
master_password = ""
dm_password = ""
admin_password = ""
# check the hostname is correctly configured, it must be as the kldap
# utilities just use the hostname as returned by gethostbyname to set
# up some of the standard entries
if options.host_name:
host_name = options.host_name
else:
host_name = socket.gethostname()
if len(host_name.split(".")) < 2:
print "Invalid hostname <"+host_name+">"
print "Check the /etc/hosts file and make sure to have a valid FQDN"
return "-Fatal Error-"
ip = socket.gethostbyname(host_name)
if ip == "127.0.0.1":
print "The hostname resolves to the localhost address (127.0.0.1)"
print "Please change your /etc/hosts file or your DNS so that the"
print "hostname resolves to the ip address of your network interface."
print "The KDC service does not listen on 127.0.0.1"
print ""
if not options.unattended:
change_hosts = raw_input("Do you want to change the /etc/hosts file ? [y/N] ")
print ""
if change_hosts.lower() == "y":
ip = raw_input("What is the netowrk IP address used by this server ? ")
print ""
if (ip.find(".") == -1):
print "["+ip+"] is an invalid IP address"
return "-Fatal Error-"
setup_hosts(host_name, ip)
else:
print "Please fix your /etc/hosts file and restart the setup program"
print "-Aborted-"
else:
return "-Fatal Error-"
print "The Final KDC Host Name will be: " + host_name + ". With IP address: " + ip
print ""
if not options.ds_user:
try:
pwd.getpwnam('dirsrv')
print "To securely run Directory Server we need a user account to be set up."
print "This will allow DS to run as a user and not as root."
print "The user account will have access to some security material so it should not be shared with any other application."
print "A user account named 'dirsrv' already exist. You should not share the account with any other service."
print ""
yesno = raw_input("Do you want to use the existing 'dirsrv' account ? (y/N)")
print ""
if yesno.lower() == "y":
ds_user = "dirsrv"
else:
ds_user = raw_input("Which account name do you want to use for the DS instance ? ")
print ""
except KeyError:
ds_user = "dirsrv"
if ds_user == "":
return "-Aborted-"
else:
ds_user = options.ds_user
if not options.realm_name:
print "The kerberos protocol requires a Realm name to be defined."
print "Usually the domain name all in uppercase is used as realm name."
print ""
upper_dom = (host_name[host_name.find(".")+1:]).upper()
dom_realm = raw_input("Do you want to use ["+upper_dom+"] as the realm name ? [y/N] ")
print ""
if dom_realm.lower() == "y":
realm_name = upper_dom
else:
realm_name = raw_input("Please provide a realm name: ")
print ""
if realm_name == "":
return "-Aborted-"
upper_dom = realm_name.upper()
if upper_dom != realm_name:
print "It is strongly adviced to use a completely uppercased name for the realm."
dom_realm = raw_input("Do you want to use "+upper_dom+" as realm name ? [Y/n] ")
print ""
if dom_realm.lower() != "y":
print "WARNING: Using a non upper-cased realm name may cause unexpected problems."
else:
realm_name = upper_dom
if realm_name == "":
print "-Aborted-"
else:
realm_name = options.realm_name
if not options.dm_password:
print "The Directory Manager user is the equivalent of 'root' for Diretcory Server."
print "This account has full access to the Directory and is used for system management tasks."
print ""
#TODO: provide the option of generating a random password
dm_password = raw_input("Please provide a password for the Directory Manager: ")
print ""
else:
dm_password = options.dm_password
if not options.master_password:
print "The Kerberos database is usually encrypted using a master password."
print "Please store this password offline in a secure place."
print "It may be necessary in a recovery situation or to install a replica."
print "Without the master password the encrypted material can't be used by the KDC."
print "If the master password gets lost all kerberos related secrets will be lost."
print ""
#TODO: provide the option of generating a random password
master_password = raw_input("Please provide a master password: ")
print ""
else:
master_password = options.master_password
if not options.admin_password:
print "The 'admin' user is the administrative user used to administare an IPA server."
print "This account is the one that will be used for normal administration and is also a regular unix user"
print ""
#TODO: provide the option of generating a random password
admin_password = raw_input("Please provide a kerberos password for the 'admin' user: ")
print ""
else:
admin_password = options.admin_password
# Create a directory server instance
ds = ipaserver.dsinstance.DsInstance()
ds.create_instance(ds_user, realm_name, host_name, dm_password)
# Create a kerberos instance
krb = ipaserver.krbinstance.KrbInstance()
krb.create_instance(ds_user, realm_name, host_name, dm_password, master_password)
# Restart ds after the krb instance has changed ds configurations
ds.restart()
# Restart apache
run(["/sbin/service", "httpd", "restart"])
# Set apache to start on boot
run(["/sbin/chkconfig", "httpd", "on"])
# Set fedora-ds to start on boot
run(["/sbin/chkconfig", "dirsrv", "on"])
# Set the KDC to start on boot
run(["/sbin/chkconfig", "krb5kdc", "on"])
# Set the Kpasswd to start on boot
run(["/sbin/chkconfig", "ipa-kpasswd", "on"])
# Start Kpasswd
run(["/sbin/service", "ipa-kpasswd", "start"])
# Set the admin user kerberos password
ds.change_admin_password(admin_password)
# Create the config file
fd = open("/etc/ipa/ipa.conf", "w")
fd.write("[defaults]\n")
fd.write("server=" + host_name + "\n")
fd.write("realm=" + realm_name + "\n")
fd.close()
return 0
main()
|
