diff options
Diffstat (limited to 'install/tools/ipa-fix-CVE-2008-3274')
| -rw-r--r-- | install/tools/ipa-fix-CVE-2008-3274 | 50 |
1 files changed, 25 insertions, 25 deletions
diff --git a/install/tools/ipa-fix-CVE-2008-3274 b/install/tools/ipa-fix-CVE-2008-3274 index 41d3abc9..79ff904d 100644 --- a/install/tools/ipa-fix-CVE-2008-3274 +++ b/install/tools/ipa-fix-CVE-2008-3274 @@ -21,8 +21,8 @@ try: import getpass import ipa - import ipa.config - import ipa.ipautil + import ipapython.config + import ipapython.ipautil import krbV import ldap @@ -57,14 +57,14 @@ def parse_options(): parser.add_option("--fix-replica", dest="fix_replica", action="store_true", help="Fix a replica after the tool has been tun with --fix on another master") - ipa.config.add_standard_options(parser) + ipapython.config.add_standard_options(parser) options, args = parser.parse_args() - ipa.config.verify_args(parser, args) + ipapython.config.verify_args(parser, args) if not options.fix and not options.fix_replica and not options.check: parser.error("please specify at least one option") - ipa.config.init_config(options) + ipapython.config.init_config(options) return options, args @@ -148,8 +148,8 @@ def change_mkey_cleanup(password): tarfile = libdir+"/ipa-change-mkey-"+curtime+".tar" gpgfile = tarfile+".gpg" args = ['/bin/tar', '-C', libdir, '-cf', tarfile, 'mkey'] - ipa.ipautil.run(args) - ipa.ipautil.encrypt_file(tarfile, gpgfile, password, cachedir) + ipapython.ipautil.run(args) + ipapython.ipautil.encrypt_file(tarfile, gpgfile, password, cachedir) os.remove(tarfile) shutil.rmtree(basedir, ignore_errors=True) @@ -160,7 +160,7 @@ def change_mkey(password = None, quiet = False): krbctx = krbV.default_context() realm = krbctx.default_realm - suffix = ipa.ipautil.realm_to_suffix(realm) + suffix = ipapython.ipautil.realm_to_suffix(realm) backupfile = basedir+"/backup.dump" convertfile = basedir+"/convert.dump" @@ -176,7 +176,7 @@ def change_mkey(password = None, quiet = False): print "This command will restart your Directory and KDC Servers." #TODO: ask for confirmation - if not ipa.ipautil.user_input("Do you want to proceed and change the Kerberos Master key?", False): + if not ipapython.ipautil.user_input("Do you want to proceed and change the Kerberos Master key?", False): print "" print "Aborting..." return 1 @@ -186,10 +186,10 @@ def change_mkey(password = None, quiet = False): # get a connection to the DS try: - conn = ipaldap.IPAdmin(ipa.config.config.default_server[0]) + conn = ipaldap.IPAdmin(ipapython.config.config.default_server[0]) conn.do_simple_bind(bindpw=password) except Exception, e: - print "ERROR: Could not connect to the Directory Server on "+ipa.config.config.default_server[0]+" ("+str(e)+")" + print "ERROR: Could not connect to the Directory Server on "+ipapython.config.config.default_server[0]+" ("+str(e)+")" return 1 # Wipe basedir and recreate it @@ -239,8 +239,8 @@ def change_mkey(password = None, quiet = False): args = ["/usr/kerberos/sbin/kdb5_util", "dump", "-verbose", backupfile] print "Performing safety backup of the key material" try: - output = ipa.ipautil.run(args) - except ipa.ipautil.CalledProcessError, e: + output = ipapython.ipautil.run(args) + except ipapython.ipautil.CalledProcessError, e: print "Failed to backup key material ("+str(e)+"), aborting ..." return 1 @@ -255,8 +255,8 @@ def change_mkey(password = None, quiet = False): args = ["/usr/kerberos/sbin/kdb5_util", "dump", "-verbose", "-new_mkey_file", newstashfile, convertfile] print "Converting key material to new master key" try: - output = ipa.ipautil.run(args) - except ipa.ipautil.CalledProcessError, e: + output = ipapython.ipautil.run(args) + except ipapython.ipautil.CalledProcessError, e: print "Failed to convert key material, aborting ..." return 1 @@ -272,12 +272,12 @@ def change_mkey(password = None, quiet = False): #Stop the KDC args = ["/etc/init.d/krb5kdc", "stop"] try: - output = ipa.ipautil.run(args) + output = ipapython.ipautil.run(args) if output[0]: print output[0] if output[1]: print output[1] - except ipa.ipautil.CalledProcessError, e: + except ipapython.ipautil.CalledProcessError, e: print "WARNING: Failed to restart the KDC ("+str(e)+")" print "You will have to manually restart the KDC when the operation is completed" @@ -318,8 +318,8 @@ def change_mkey(password = None, quiet = False): args = ["/usr/kerberos/sbin/kdb5_util", "load", "-verbose", "-update", convertfile] print "Uploading converted key material" try: - output = ipa.ipautil.run(args) - except ipa.ipautil.CalledProcessError, e: + output = ipapython.ipautil.run(args) + except ipapython.ipautil.CalledProcessError, e: print "Failed to upload key material ("+e+"), aborting ..." return 1 @@ -349,24 +349,24 @@ def change_mkey(password = None, quiet = False): #Restart Directory Server (the pwd plugin need to read the new mkey) args = ["/etc/init.d/dirsrv", "restart"] try: - output = ipa.ipautil.run(args) + output = ipapython.ipautil.run(args) if output[0]: print output[0] if output[1]: print output[1] - except ipa.ipautil.CalledProcessError, e: + except ipapython.ipautil.CalledProcessError, e: print "WARNING: Failed to restart the Directory Server ("+str(e)+")" print "Please manually restart the DS with 'service dirsrv restart'" #Restart the KDC args = ["/etc/init.d/krb5kdc", "start"] try: - output = ipa.ipautil.run(args) + output = ipapython.ipautil.run(args) if output[0]: print output[0] if output[1]: print output[1] - except ipa.ipautil.CalledProcessError, e: + except ipapython.ipautil.CalledProcessError, e: print "WARNING: Failed to restart the KDC ("+str(e)+")" print "Please manually restart the kdc with 'service krb5kdc start'" @@ -462,7 +462,7 @@ def fix_main(password, realm, suffix): dn = "cn=%s,cn=kerberos,%s" % (realm, suffix) sub_dict = dict(REALM=realm, SUFFIX=suffix) #protect the master key by adding an appropriate deny rule along with the key - mod = [(ldap.MOD_ADD, 'aci', ipa.ipautil.template_str(KRBMKEY_DENY_ACI, sub_dict)), + mod = [(ldap.MOD_ADD, 'aci', ipapython.ipautil.template_str(KRBMKEY_DENY_ACI, sub_dict)), (ldap.MOD_REPLACE, 'krbMKey', str(asn1key))] conn = ldapobject.SimpleLDAPObject("ldap://127.0.0.1/") @@ -484,7 +484,7 @@ def main(): krbctx = krbV.default_context() realm = krbctx.default_realm - suffix = ipa.ipautil.realm_to_suffix(realm) + suffix = ipapython.ipautil.realm_to_suffix(realm) try: ret = check_vuln(realm, suffix) |