summaryrefslogtreecommitdiffstats
path: root/base/server/python/pki/server/deployment/pkihelper.py
Commit message (Collapse)AuthorAgeFilesLines
* Refactored initialization scriptlets.Endi S. Dewata2016-05-031-0/+13
|
* Add validity check for the signing certificate in pkispawnAde Lee2016-05-021-0/+32
| | | | | | | | When either an existing CA or external CA installation is performed, use the pki-server cert validation tool to check the signing certiticate and chain. Ticket #2043
* Simplified deployment properties for existing CA case.Endi S. Dewata2016-04-151-1/+6
| | | | | | | | | | | | | | | A new pki_existing deployment property has been added to install CA with existing CA certificate and key in a single step. New certificate deployment properties have been added as aliases for some external CA properties to allow them to be used in more general cases: - pki_ca_signing_csr_path -> pki_external_csr_path - pki_ca_signing_cert_path -> pki_external_ca_cert_path - pki_cert_chain_path -> pki_external_ca_cert_chain_path - pki_cert_chain_nickname -> pki_external_ca_cert_chain_nickname https://fedorahosted.org/pki/ticket/1736
* Added mechanism to import system certs via PKCS #12 file.Endi S. Dewata2016-02-261-7/+29
| | | | | | | | | | | | | | | | | | | | | | The installation tool has been modified to provide an optional pki_server_pkcs12_path property to specify a PKCS #12 file containing certificate chain, system certificates, and third-party certificates needed by the subsystem being installed. If the pki_server_pkcs12_path is specified the installation tool will no longer download the certificate chain from the security domain directly, and it will no longer import the PKCS #12 containing the entire master NSS database specified in pki_clone_pkcs12_path. For backward compatibility, if the pki_server_pkcs12_path is not specified the installation tool will use the old mechanism to import the system certificates. The ConfigurationUtils.verifySystemCertificates() has been modified not to catch the exception to help troubleshooting. https://fedorahosted.org/pki/ticket/1742
* Fixed KRA installation.Endi S. Dewata2016-02-031-1/+0
| | | | | | | | | Due to a recent change the KRA installation failed because the installer was trying to read the pki_external_csr_path parameter which is not available for KRA installation. The installer has been fixed to read the parameter in external CA case only. https://fedorahosted.org/pki/ticket/456
* Fix flake8 / PEP 8 violationsChristian Heimes2016-01-251-15/+17
| | | | https://fedorahosted.org/pki/ticket/1738
* Fixed installation summary for existing CA.Endi S. Dewata2016-01-231-0/+1
| | | | | | | The pkispawn has been modified to display the proper summary for external CA and existing CA cases. https://fedorahosted.org/pki/ticket/456
* Don't use settings like HTTP proxy from env vars during installationChristian Heimes2016-01-201-3/+6
| | | | | | | | | | | | | | | | | | The PKIConnection class uses python-requests for HTTPS. The library picks up several settings from environment variables, e.g. HTTP proxy server, certificate bundle with trust anchors and authentication. A proxy can interfere with the Dogtag installer and cause some operations to fail. With session.trust_env = False python-requests no longer inspects the environment and Dogtag has full controll over its connection settings. For backward compatibility reasons trust_env is only disabled during installation and removal of Dogtag. https://requests.readthedocs.org/en/latest/api/?highlight=trust_env#requests.Session.trust_env https://fedorahosted.org/pki/ticket/1733 https://fedorahosted.org/freeipa/ticket/5555
* Remove #!python shebang from non-executablesChristian Heimes2016-01-191-2/+0
| | | | | | | | | A lot of Python files start with a #!/usr/bin/python shebang although the files are neither executables nor designed as scripts. Shebangs are only required for executable scripts. Without unnecessary shebangs it's a bit easier to track Python 3 porting.
* Fixed external CA case for IPA compatibility.Endi S. Dewata2016-01-081-2/+5
| | | | | | | | | | | | | The installation code for external CA case has been fixed such that IPA can detect step 1 completion properly. The code that handles certificate data conversion has been fixed to reformat base-64 data for PEM output properly. The installation summary for step 1 has been updated to provide more accurate information. https://fedorahosted.org/pki/ticket/456
* Added mechanism to import existing CA certificate.Endi S. Dewata2015-11-251-26/+44
| | | | | | | | | | | The deployment procedure for external CA has been modified such that it generates the CA CSR before starting the server. This allows the same procedure to be used to import CA certificate from an existing server. It also removes the requirement to keep the server running while waiting to get the CSR signed by an external CA. https://fedorahosted.org/pki/ticket/456
* Py3 compatibility: encode output of subprocess callChristian Heimes2015-08-171-3/+5
| | | | | | | | | In Python 3 subprocess.Popen() and check_out() return bytes. The rest of PKI expects text, so the output has to be decoded. - ascii for dnsdomainname - sys.getfilesystemencoding() for paths - utf-8 for the rest
* Py3 compatibility: write XML as encoded bytesChristian Heimes2015-08-171-2/+3
| | | | | Python 3 treats serialized XML as encoded bytes. etree must encode XML to UTF-8 and write it to a file opened in binary mode.
* Py3 modernization: misc manual fixesChristian Heimes2015-08-171-6/+10
| | | | | | | | | | | | | | | | | | | | | | Python 3's exception class has no message attribute. e.message can either be replaced with string representation of e or e.args[0]. Use print(line, end='') instead of sys.stdout.write(). With end='' no new line is appended. Use six.reraise() to reraise an exception. Remove sys.exc_clear() as it is no longer available in Python 3. Conditionally import shutil.WindowsError. Use six.move to import correct modules / function like quote, urlparse and configparser. Silence some pylint warnings. pylint doesn't understand six.moves magic and emits a import-error warning. Add additional tox envs to check for Python 3 compatibility.
* policycoreutils-python3 lacks sepolgen on Fedora 22Christian Heimes2015-08-171-2/+10
| | | | | | | | | Fedora 22's Python bindings for SELinux lacks sepolgen. The seobject package is available for Python 3 but can't be imported because it depends on sepolgen. The workaround makes it possible to test the Python 3 port on Fedora 22. It can be removed later once Fedora 23 is out.
* Py3 modernization: libmodernize.fixes.fix_dict_sixChristian Heimes2015-08-171-1/+1
| | | | | | | | | In Python 3 dict methods like values(), items() and keys() return views rather than lists. The iter equivalents are gone. Use six to use iterators on Python 2 and 3. In some places like setup.py a list is required. Use list(somedict.values()) to get a list on all Python versions.
* Py3 modernization: libmodernize.fixes.fix_printChristian Heimes2015-08-171-1/+2
| | | | | | | | | Replace print statement with Python 3's print() function. For Python 2 'from __future__ import print_function' turns the print statement into Python 3 compatible print function. See https://www.python.org/dev/peps/pep-3105/
* Py3 modernization: libmodernize.fixes.fix_importChristian Heimes2015-08-171-0/+1
| | | | | | | | | | | | | | Enforce absolute imports or explicit relative imports. Python 3 no longer supports implicit relative imports, that is unqualified imports from a module's directory. In order to load a module from the same directory inside a package, use from . import module The future feature 'from __future__ import absolute_import' ensures that pki uses absolute imports on Python 2, too. See https://www.python.org/dev/peps/pep-0328/
* Make pki PEP 8 compatibleChristian Heimes2015-08-141-45/+77
| | | | | | | | | | | | | | | | | | | Large portions of the patch was automatically created with autopep8: find base/ -name '*.py' | xargs autopep8 --in-place --ignore E309 \ --aggressive find base/common/upgrade base/server/upgrade -type f -and \ -not -name .gitignore | autopep8 --in-place --ignore E309 --aggressive autopep8 --in-place --ignore E309 --aggressive \ base/common/sbin/pki-upgrade \ base/server/sbin/pkispawn \ base/server/sbin/pkidestroy \ base/server/sbin/pki-server \ base/server/sbin/pki-server-upgrade About two dozent violations were fixed manually. https://fedorahosted.org/pki/ticket/708
* Simplify exception handling in pkihelperChristian Heimes2015-08-101-32/+24
| | | | | | | | | Several methods except OSError before they except shutil.Error. In Python 3 the second except clause will be ignored because in Python 3 shutil.Error is a subclass of OSError. The body of the except clauses only differs in the logging message. A single except clause with an isinstance() check has the same effect.
* Add code to reindex data during cloning without replicationAde Lee2015-07-311-0/+1
| | | | | | | | | | | | | When setting up a clone, indexes are added before the replication agreements are set up and the consumer is initialized. Thus, as data is replicated and added to the clone db, the data is indexed. When cloning is done with the replication agreements already set up and the data replicated, the existing data is not indexed and cannot be accessed in searches. The data needs to be reindexed. Related to ticket 1414
* Add certutil options for ECCMatthew Harmsen2015-07-281-2/+28
| | | | | - PKI TRAC Ticket #1524 - pkispawn: certutil options incorrect for creating ecc admin certificate
* Remove noise file generation codeAde Lee2015-07-281-61/+10
| | | | | | | | Noise file does not actually need to have random data because NSS does not actually use this data. Certutil still needs the file though, so we will put dummy data in there. This solves potential problems with the random() method used and also issues like BZ 1244382
* Fixed Modutil.is_security_module_registered().Endi S. Dewata2015-06-291-45/+45
| | | | | | | | Due to issues with HSM the Modutil.is_security_module_registered() has been modified to the get the list of all registered modules and then use it to check if a module is registered. https://fedorahosted.org/pki/ticket/1444
* Check security module registrationMatthew Harmsen2015-06-181-0/+54
| | | | | | - PKI TRAC Ticket #1426 - pkispawn of KRA on HSM fails (shared instances) - PKI TRAC Ticket #1427 - pkispawn of OCSP on HSM fails (shared instances) - PKI TRAC Ticket #1429 - pkispawn of TKS on HSM fails (shared instances)
* fix pylint issueChristina Fu2015-06-171-2/+2
|
* add pkiuser to nfast groupMatthew Harmsen2015-06-161-0/+87
| | | | - PKI TRAC Ticket #1415 - nCipher HSM: Add 'pkiuser' to 'nfast' group
* disable backup keys and share master keys when using an HSMMatthew Harmsen2015-05-221-6/+30
| | | | | - PKI TRAC Ticket #1371 - pkispawn: need to disable backup_keys when using an HSM (and provide recommendation); allow clones to share keys
* Added deployment parameters to construct pki_clone_uri.Endi S. Dewata2015-05-221-1/+0
| | | | | | | | New parameters have been added into the default.cfg to specify the master hostname and port for pki_clone_uri. By default they point to the security domain. The man page has been updated as well. https://fedorahosted.org/pki/ticket/1385
* Fixed pylint warning in pkihelper.py.Endi S. Dewata2015-05-141-1/+1
|
* modify contents of serverCertNick.confMatthew Harmsen2015-05-131-0/+44
| | | | | - PKI TRAC Ticket #1370 - pkispawn: installation with HSM from external CA should hold off prepending token name in serverCertNick.conf till phase 2
* Added options for internal token and replication passwords.Endi S. Dewata2015-05-111-0/+2
| | | | | | | | The installation code has been modified such that the admin can optionally specify passwords for internal token and replication. Otherwise the code will generate random passwords like before. https://fedorahosted.org/pki/ticket/1354
* Fixed installation logs.Endi S. Dewata2015-05-081-6/+13
| | | | | | | | | To help troubleshooting installation failures the pkihelper.py has been modified to display the error code returned by the server before parsing the error message. If there is a parsing error, the unparsed message will now be displayed. The redundant 'raise' and 'return' statements have been removed.
* Simple fix for this is not requiring the pki_client_database_password to be ↵Jack Magne2015-05-071-1/+3
| | | | | | set when performing a clone operation. Tested with a cloned CA and a couple of other subysstems, such as OCSP.
* Fix #1351 pki securitydomain-get-install-token fails when run with caadmin user.Jack Magne2015-05-071-61/+0
| | | | | | | | | | The short term solution to this problem was to remove the man page information and all references to the command line module reponsible for this issue. The installer already has an alternative method to remove a subsystem from the security domain list. We now assume the alternate method and don't even try to find the token at this point. A user at the command line of the pki command will no longer be able to attempt this as well. Tested this to verify that the man page for the "securtydomain" command no longer mentions or documents the "get-install-token" variant. Tested to verify that this command can't be manually called from the command line using "pki". This attempt results in an "unknown module". Tested by installing and uninstalling a subsytem. The security domain was kept up to date as expected for each install over remove attempted.
* Code cleanup - simplify pkispawn codeAde Lee2015-04-291-227/+221
| | | | | All subsystems are now tomcat instances. Conditionals based on whether the subsystem is a tomcat instance or not are no longer required.
* Ticket 1316 Allow adding SAN to server cert during the install processChristina Fu2015-04-211-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Usage: * under /usr/share/pki/ca/conf, you will find a new file called serverCert.profile.exampleWithSANpattern * copy existing serverCert.profile away and replace with serverCert.profile.exampleWithSANpattern * edit serverCert.profile.exampleWithSANpattern - follow the instruction right above 8.default. - save and quit * cd /usr/share/pki/ca/profiles/ca , edit caInternalAuthServerCert.cfg - follow the instruction right above policyset.serverCertSet.9 - save and quit * save away and edit the ca config file for pkispawn: (note: you can add multiple SAN's delimited by ',' for pki_san_server_cert - add the following lines, e.g. pki_san_inject=True pki_san_server_cert=host1.Example.com - do the same pkispawn cfg changes for kra or any other instances that you plan on creating * create your instance(s) check the sl sever cert, it should contain something like the following: Identifier: Subject Alternative Name - 2.5.29.17 Critical: no Value: DNSName: host1.Example.com
* Add HSM passwords to pkispawnMatthew Harmsen2015-04-211-0/+44
| | | | - PKI TRAC Ticket #1200 - make sure pkispawn works with hsm (passwords)
* Add HSM options to pkispawnMatthew Harmsen2015-04-141-0/+63
| | | | - PKI TRAC Ticket #1346 - pkispawn should have an HSM library option
* pki-tomcatd fails to start on system bootMatthew Harmsen2015-04-131-0/+102
| | | | | - PKI TRAC Ticket #1315 - pki-tomcatd fails to start on system boot - PKI TRAC Ticket #1340 - pkidestroy should not remove /var/lib/pki
* Allow use of secure LDAPS connectionMatthew Harmsen2015-03-131-5/+18
| | | | - PKI TRAC Ticket #1144 - pkispawn needs option to specify ca cert for ldap
* Fixed pylint report.Endi S. Dewata2015-02-051-12/+12
| | | | | | | | | | | | | | | Previously pylint report was saved it into a file which may not be accessible on a build system. The pylint-build-scan.sh has been changed to display the report so it will appear in the build log. The pylint configuration has also been modified to disable C and R messages by default. This way when other errors or warnings occur the build will fail without having to check for specific codes. Some Python codes have been modified to reduce the number of pylint warnings. https://fedorahosted.org/pki/ticket/703
* Moved web application deployment locations.Endi S. Dewata2015-01-281-0/+35
| | | | | | | | | | | | | Currently web applications are deployed into Host's appBase (i.e. <instance>/webapps). To allow better control of individual subsystem deployments, the web applications have to be moved out of the appBase so that the autoDeploy can work properly later. This patch moves the common web applications to <instance>/ common/webapps and subsystem web applications to <instance>/ <subsystem>/webapps. An upgrade script has been added to update existing deployments. https://fedorahosted.org/pki/ticket/1183
* Fix-for-Bug-1170867-TPS-Installation-FailedJack Magne2014-12-161-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix now includes last review comments where we decided to consolidate 3 of the ldif files: schema.ldif,database.ldif, and manager.ldif. Each one of these 3 files contains the data needed for any subsystem for that file. The subsystem specific files for these 3 go away in the source tree. The first iteration of this fix was copying these 3 files into an undesirable directory. This is no longer the case. Extra code in the python installer allows one to establish a "file exclusion" callback to keep a set of desired files from being copied when the installer does a directory copy. All subsystems have been tested, including TPS with a brand new DS (which was the original reason for this fix), and they appear to work fine. Addressed further review comments: 1. Removed trailing whitespace instances from schema.ldif which had some. 2. Used pycharm to remove the few PEP violations I had previously added to the Python code. 3. Changed the format of the schema.ldif file to make all the entries use the same style. Previously the TPS entries was using an all in one syntax. No more since now each entry is separate. 4. Changed the name of an argument in one of the new Python methods to get rid of a camelCase instance. 5. Tested everything to work as before, including basic TPS operations such as Format. Fixed a method comment string and fixed some typos.
* Fix sub-CA installation with own security domainAde Lee2014-10-011-6/+15
| | | | | | | | | Installation code failed to anticipate installation of a subordinate CA that would host its own security domain. This patch includes changes to python installation code, java configuration servlet and changes to man pages. Ticket 1132
* ticket #1110 pkispawn (configuration) does not provide CA extensions in ↵Christina Fu2014-09-251-0/+25
| | | | subordinate certificate signing requests (CSR)
* Remove Apache info from pkispawn and pkidestroyMatthew Harmsen2014-09-021-84/+4
| | | | - PKI TRAC Ticket #1077 - Consider removing [Apache] section from 'default.cfg'
* Fix kra-connector-removeAde Lee2014-09-021-19/+66
| | | | | | | | | | | | | | | | | | | | The code to remove the connector from the pki CLI was found to be broken because of invalid message type (partly due to void returns). On uninstall, we need to remove the kra-connector from all relevant CA's in the security domain. The best way to do this is to keep kra-connector info in LDAP, so that only one call is needed. Until that change has been made, we are adding a hack to remove the connector from all CA's in the secutrity domain (if it exists). Due to issues with proxy configurations, we will continue to use sslget and a url-encoded-form version of the servlet. In addition, it was found that when removing a KRA from a shared subsystem, the updateDomainXML servlet was erroneously returning failure when it was unsuccessful in removing a non-existent user from a group. Ticket 1113
* Disable PKI GUI ConfigurationMatthew Harmsen2014-08-281-19/+0
| | | | - PKI TRAC Ticket #1120 - Remove Firefox PKI GUI Configuration Panel Interface
* Fix issues found by pycharmAde Lee2014-08-061-12/+15
| | | | Some formatting, uninitialized variables.
generated by cgit (git 2.34.1) at 2024-05-08 23:08:05 +0000