diff options
Diffstat (limited to 'install/tools')
| -rw-r--r-- | install/tools/Makefile.am | 1 | ||||
| -rw-r--r-- | install/tools/ipa-compliance | 193 | ||||
| -rw-r--r-- | install/tools/man/Makefile.am | 3 | ||||
| -rw-r--r-- | install/tools/man/ipa-compliance.1 | 45 |
4 files changed, 241 insertions, 1 deletions
diff --git a/install/tools/Makefile.am b/install/tools/Makefile.am index 70e65ee7..055a32fc 100644 --- a/install/tools/Makefile.am +++ b/install/tools/Makefile.am @@ -17,6 +17,7 @@ sbin_SCRIPTS = \ ipa-host-net-manage \ ipa-ldap-updater \ ipa-upgradeconfig \ + ipa-compliance \ $(NULL) EXTRA_DIST = \ diff --git a/install/tools/ipa-compliance b/install/tools/ipa-compliance new file mode 100644 index 00000000..8b7ad776 --- /dev/null +++ b/install/tools/ipa-compliance @@ -0,0 +1,193 @@ +#!/usr/bin/env python +# +# Authors: +# Rob Crittenden <rcritten@redhat.com> +# +# Copyright (C) 2010 Red Hat +# see file 'COPYING' for use and warranty information +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. +# +# An LDAP client to count entitlements and log to syslog if the number is +# exceeded. + +try: + import sys + import os + import syslog + import tempfile + import krbV + import base64 + import shutil + + from rhsm.certificate import EntitlementCertificate + + from ipaserver.plugins.ldap2 import ldap2 + from ipalib import api, errors, backend +except ImportError, e: + # If python-rhsm isn't installed exit gracefully and quietly. + if e.args[0] == 'No module named rhsm.certificate': + sys.exit(0) + print >> sys.stderr, """\ +There was a problem importing one of the required Python modules. The +error was: + + %s +""" % sys.exc_value + sys.exit(1) + +# Each IPA server comes with this many entitlements +DEFAULT_ENTITLEMENTS = 25 + +class client(backend.Executioner): + """ + A simple-minded IPA client that can execute remote commands. + """ + + def run(self, method, **kw): + self.create_context() + result = self.execute(method, **kw) + return result + +def parse_options(): + from optparse import OptionParser + + parser = OptionParser() + parser.add_option("--debug", dest="debug", action="store_true", + default=False, help="enable debugging") + + options, args = parser.parse_args() + return options, args + +def check_compliance(tmpdir, debug=False): + cfg = dict( + context='cli', + in_server=False, + debug=debug, + verbose=0, + ) + + api.bootstrap(**cfg) + api.register(client) + api.finalize() + from ipalib.plugins.service import normalize_certificate, make_pem + + try: + # Create a new credentials cache for this tool. This executes + # using the systems host principal. + ccache_file = 'FILE:%s/ccache' % tmpdir + krbcontext = krbV.default_context() + principal = str('host/%s@%s' % (api.env.host, api.env.realm)) + keytab = krbV.Keytab(name='/etc/krb5.keytab', context=krbcontext) + principal = krbV.Principal(name=principal, context=krbcontext) + os.environ['KRB5CCNAME'] = ccache_file + ccache = krbV.CCache(name=ccache_file, context=krbcontext, primary_principal=principal) + ccache.init(principal) + ccache.init_creds_keytab(keytab=keytab, principal=principal) + except krbV.Krb5Error, e: + raise StandardError('Error initializing principal %s in %s: %s' % (principal.name, '/etc/krb5.keytab', str(e))) + + # entitle-sync doesn't return any information we want to see, it just + # needs to be done so the LDAP data is correct. + try: + result = api.Backend.client.run('entitle_sync') + except errors.NotRegisteredError: + # Even if not registered they have some default entitlements + pass + + ldapuri = 'ldap://%s' % api.env.host + conn = ldap2(shared_instance=False, ldap_uri=ldapuri) + + # Bind using GSSAPI + conn.connect(ccache=ccache_file) + + hostcount = 0 + # Get the hosts first + try: + (entries, truncated) = conn.find_entries('(krblastpwdchange=*)', ['dn'], + '%s,%s' % (api.env.container_host, api.env.basedn), + conn.SCOPE_ONELEVEL, + size_limit = -1) + except errors.NotFound: + # No hosts + pass + + if not truncated: + hostcount = len(entries) + else: + # This will not happen unless we bump into a server-side limit. + msg = 'The host count result was truncated, they will be underreported' + syslog.syslog(syslog.LOG_ERR, msg) + if sys.stdin.isatty(): + print msg + + available = 0 + try: + (entries, truncated) = conn.find_entries('(objectclass=ipaentitlement)', + ['dn', 'userCertificate'], + '%s,%s' % (api.env.container_entitlements, api.env.basedn), + conn.SCOPE_ONELEVEL, + size_limit = -1) + + for entry in entries: + (dn, attrs) = entry + if 'usercertificate' in attrs: + rawcert = attrs['usercertificate'][0] + rawcert = normalize_certificate(rawcert) + cert = make_pem(base64.b64encode(rawcert)) + cert = EntitlementCertificate(cert) + order = cert.getOrder() + available += int(order.getQuantityUsed()) + except errors.NotFound: + pass + + conn.disconnect() + + available += DEFAULT_ENTITLEMENTS + + if hostcount > available: + syslog.syslog(syslog.LOG_ERR, 'IPA is out of compliance: %d of %d entitlements used.' % (hostcount, available)) + if sys.stdin.isatty(): + print 'IPA is out of compliance: %d of %d entitlements used.' % (hostcount, available) + else: + if sys.stdin.isatty(): + # If run from the command-line display some info + print 'IPA is in compliance: %d of %d entitlements used.' % (hostcount, available) + +def main(): + if os.getegid() != 0: + sys.exit("Must be root to check compliance") + + if not os.path.exists('/etc/ipa/default.conf'): + return 0 + + options, args = parse_options() + + try: + tmpdir = tempfile.mkdtemp(prefix = "tmp-") + try: + check_compliance(tmpdir, options.debug) + finally: + shutil.rmtree(tmpdir) + except KeyboardInterrupt: + return 1 + except (StandardError, errors.PublicError), e: + syslog.syslog(syslog.LOG_ERR, 'IPA compliance checking failed: %s' % str(e)) + if sys.stdin.isatty(): + print 'IPA compliance checking failed: %s' % str(e) + return 1 + + return 0 + +sys.exit(main()) diff --git a/install/tools/man/Makefile.am b/install/tools/man/Makefile.am index 58959c1b..3fac378c 100644 --- a/install/tools/man/Makefile.am +++ b/install/tools/man/Makefile.am @@ -14,7 +14,8 @@ man1_MANS = \ ipa-ldap-updater.1 \ ipa-compat-manage.1 \ ipa-nis-manage.1 \ - ipa-host-net-manage.1 + ipa-host-net-manage.1 \ + ipa-compliance.1 man8_MANS = \ ipactl.8 \ diff --git a/install/tools/man/ipa-compliance.1 b/install/tools/man/ipa-compliance.1 new file mode 100644 index 00000000..09ce02df --- /dev/null +++ b/install/tools/man/ipa-compliance.1 @@ -0,0 +1,45 @@ +.\" A man page for ipa-compliance +.\" Copyright (C) 2010 Red Hat, Inc. +.\" +.\" This is free software; you can redistribute it and/or modify it under +.\" the terms of the GNU Library General Public License as published by +.\" the Free Software Foundation; version 2 only +.\" +.\" This program is distributed in the hope that it will be useful, but +.\" WITHOUT ANY WARRANTY; without even the implied warranty of +.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +.\" General Public License for more details. +.\" +.\" You should have received a copy of the GNU Library General Public +.\" License along with this program; if not, write to the Free Software +.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +.\" +.\" Author: Rob Crittenden <rcritten@redhat.com> +.\" +.TH "ipa-compliance" "1" "Dec 14 2010" "freeipa" "" +.SH "NAME" +ipa\-compliance \- Check entitlement compliance +.SH "SYNOPSIS" +ipa\-compliance [\fIOPTION\fR] +.SH "DESCRIPTION" +Verify that the IPA installation is in compliance with the number of client entitlements it has. + +Entitlements are managed using the ipa entitle command. + +An enrolled host is an machine that has a host keytab in the IPA system. + +The entitlements take the form of x509v3 certificates. The certificates are examined and the quantities summed. This is compared to the number of enrolled hosts to determine compliance. + +The command logs to syslog and if run from a tty will log to the terminal as well. + +The IPA server provides 25 entitlements of its own. +.SH "OPTIONS" +.TP +\fB\-\-\-debug\fR +Enable debugging output in the command +.SH "EXIT STATUS" +0 if the command was successful + +1 if an error occurred +.SH "NOTES" +Entitlements are not checked if the python\-rhsm package is not installed. |