summaryrefslogtreecommitdiffstats
path: root/base/server/python/pki/server/deployment/pkiparser.py
Commit message (Collapse)AuthorAgeFilesLines
* Simplified the code to generate/load one-time PIN.Endi S. Dewata2016-05-031-23/+32
| | | | | | | | Instead of checking various installation scenarios (e.g. external CA step 2, standalone step 2, configuration-only mode), the code to generate or load the one-time PIN has been simplified as follows: * if the PIN already exists (in CS.cfg), it will be reused * if the PIN does not exist, the code will generate a new one
* Fixed KRA install problem.Endi S. Dewata2016-03-301-3/+15
| | | | | | | | | | | | | Currently when installing an additional subsystem to an existing instance the install tool always generates a new random password in the pki_pin property which would not work with the existing NSS database. The code has been modified to load the existing NSS database password from the instance if the instance already exists. The PKIInstance class has been modified to allow loading partially created instance to help the installation. https://fedorahosted.org/pki/ticket/2247
* Install tools clean-up.Endi S. Dewata2016-03-301-3/+0
| | | | | | | | | | | | Some variables in pkispawn and pkidestroy have been renamed for clarity. The unused PKI_CERT_DB_PASSWORD_SLOT variable has been removed. The constant pki_self_signed_token property has been moved into default.cfg. https://fedorahosted.org/pki/ticket/2247
* Added mechanism to import system certs via PKCS #12 file.Endi S. Dewata2016-02-261-0/+1
| | | | | | | | | | | | | | | | | | | | | | The installation tool has been modified to provide an optional pki_server_pkcs12_path property to specify a PKCS #12 file containing certificate chain, system certificates, and third-party certificates needed by the subsystem being installed. If the pki_server_pkcs12_path is specified the installation tool will no longer download the certificate chain from the security domain directly, and it will no longer import the PKCS #12 containing the entire master NSS database specified in pki_clone_pkcs12_path. For backward compatibility, if the pki_server_pkcs12_path is not specified the installation tool will use the old mechanism to import the system certificates. The ConfigurationUtils.verifySystemCertificates() has been modified not to catch the exception to help troubleshooting. https://fedorahosted.org/pki/ticket/1742
* Don't use settings like HTTP proxy from env vars during installationChristian Heimes2016-01-201-2/+4
| | | | | | | | | | | | | | | | | | The PKIConnection class uses python-requests for HTTPS. The library picks up several settings from environment variables, e.g. HTTP proxy server, certificate bundle with trust anchors and authentication. A proxy can interfere with the Dogtag installer and cause some operations to fail. With session.trust_env = False python-requests no longer inspects the environment and Dogtag has full controll over its connection settings. For backward compatibility reasons trust_env is only disabled during installation and removal of Dogtag. https://requests.readthedocs.org/en/latest/api/?highlight=trust_env#requests.Session.trust_env https://fedorahosted.org/pki/ticket/1733 https://fedorahosted.org/freeipa/ticket/5555
* Remove #!python shebang from non-executablesChristian Heimes2016-01-191-1/+0
| | | | | | | | | A lot of Python files start with a #!/usr/bin/python shebang although the files are neither executables nor designed as scripts. Shebangs are only required for executable scripts. Without unnecessary shebangs it's a bit easier to track Python 3 porting.
* Fix escaping of password fields to prevent interpolationChristian Heimes2016-01-131-2/+6
| | | | | | | | | | Some password and pin fields are missing from the no_interpolation list. One entry is misspelled. A '%' in password field such as pki_clone_pkcs12_password causes an installation error. https://fedorahosted.org/pki/ticket/1703 Signed-off-by: Christian Heimes <cheimes@redhat.com>
* Ticket 1566 on HSM, non-CA subystem installations failing while trying to ↵Christina Fu2015-08-191-10/+10
| | | | join security domain Investigation shows that this issue occurs when the non-CA subsystem's SSL server and client keys are also on the HSM. While browsers (on soft token) have no issue connecting to any of the subsystems on HSM, subsystem to subsystem communication has issues when the TLS_ECDHE_RSA_* ciphers are turned on. We have decided to turn off the TLS_ECDHE_RSA_* ciphers by default (can be manually turned on if desired) based on the fact that: 1. The tested HSM seems to have issue with them (will still continue to investigate) 2. While the Perfect Forward Secrecy provides added security by the TLS_ECDHE_RSA_* ciphers, each SSL session takes 3 times longer to estabish. 3. The TLS_RSA_* ciphers are adequate at this time for the CS system operations
* Silence no-name-in-module errorChristian Heimes2015-08-191-1/+1
| | | | | | | | Some versions of pylint complain about six's moves magic: No name 'urllib' in module '_MovedItems' (no-name-in-module) Disable error E0611.
* Py3 compatibility: set default for verbosity to 0Christian Heimes2015-08-171-1/+1
| | | | | | | The default value for argparser's verbosity was None, but None can't be compared to 2 in Python 3. TypeError: unorderable types: NoneType() >= int()
* Py3 compatibility: encode output of subprocess callChristian Heimes2015-08-171-2/+5
| | | | | | | | | In Python 3 subprocess.Popen() and check_out() return bytes. The rest of PKI expects text, so the output has to be decoded. - ascii for dnsdomainname - sys.getfilesystemencoding() for paths - utf-8 for the rest
* Py3 modernization: misc manual fixesChristian Heimes2015-08-171-13/+17
| | | | | | | | | | | | | | | | | | | | | | Python 3's exception class has no message attribute. e.message can either be replaced with string representation of e or e.args[0]. Use print(line, end='') instead of sys.stdout.write(). With end='' no new line is appended. Use six.reraise() to reraise an exception. Remove sys.exc_clear() as it is no longer available in Python 3. Conditionally import shutil.WindowsError. Use six.move to import correct modules / function like quote, urlparse and configparser. Silence some pylint warnings. pylint doesn't understand six.moves magic and emits a import-error warning. Add additional tox envs to check for Python 3 compatibility.
* Py3 modernization: libmodernize.fixes.fix_xrange_sixChristian Heimes2015-08-171-1/+1
| | | | | In Python 3 range() returns an iterator and xrange() is gone. Use six.moves to use an iterable range() on Python 2.
* Py3 modernization: libmodernize.fixes.fix_input_sixChristian Heimes2015-08-171-1/+3
| | | | | | | In Python 3 raw_input() has been renamed to input() and the old, insecure input() builtin is gone. six.moves simplifies the transition. It provides the former raw_input() function under the same import name on Python 2 and 3.
* Py3 modernization: libmodernize.fixes.fix_printChristian Heimes2015-08-171-16/+17
| | | | | | | | | Replace print statement with Python 3's print() function. For Python 2 'from __future__ import print_function' turns the print statement into Python 3 compatible print function. See https://www.python.org/dev/peps/pep-3105/
* Py3 modernization: libmodernize.fixes.fix_importChristian Heimes2015-08-171-0/+1
| | | | | | | | | | | | | | Enforce absolute imports or explicit relative imports. Python 3 no longer supports implicit relative imports, that is unqualified imports from a module's directory. In order to load a module from the same directory inside a package, use from . import module The future feature 'from __future__ import absolute_import' ensures that pki uses absolute imports on Python 2, too. See https://www.python.org/dev/peps/pep-0328/
* Ticket #1556 Weak HTTPS TLS ciphersChristina Fu2015-08-171-34/+38
| | | | | | | | | | | | This patch fixes the RSA ciphers that were mistakenly turned on under ECC section, and off under RSA section. A few adjustments have also been made based on Bob Relyea's feedback. A new file, <instance>/conf/ciphers.info was also created to 1. provide info on the ciphers 2. provide default rsa and ecc ciphers for admins to incorporate into earlier instances (as migration script might not be ideal due to possible customization) (cherry picked from commit 67c895851781d69343979cbcff138184803880ea)
* Make pki PEP 8 compatibleChristian Heimes2015-08-141-32/+28
| | | | | | | | | | | | | | | | | | | Large portions of the patch was automatically created with autopep8: find base/ -name '*.py' | xargs autopep8 --in-place --ignore E309 \ --aggressive find base/common/upgrade base/server/upgrade -type f -and \ -not -name .gitignore | autopep8 --in-place --ignore E309 --aggressive autopep8 --in-place --ignore E309 --aggressive \ base/common/sbin/pki-upgrade \ base/server/sbin/pkispawn \ base/server/sbin/pkidestroy \ base/server/sbin/pki-server \ base/server/sbin/pki-server-upgrade About two dozent violations were fixed manually. https://fedorahosted.org/pki/ticket/708
* Updated man pages with TPS info.Endi S. Dewata2015-07-181-2/+2
| | | | | | | The man pages for pkispawn and pki_default.cfg have been updated to include TPS deployment parameters. https://fedorahosted.org/pki/ticket/1277
* Ticket 1438 pkispawn: SSL_ForceHandshake issue for non-CA on HSM on both ↵Christina Fu2015-07-011-35/+72
| | | | shared and nonshared tomcat instances
* Fixed overwritten deployment property.Endi S. Dewata2015-05-291-1/+1
| | | | | | | The pki_pin has been removed from the default.cfg to avoid overwriting the randomly generated default value. https://fedorahosted.org/pki/ticket/1393
* Added options for internal token and replication passwords.Endi S. Dewata2015-05-111-6/+16
| | | | | | | | The installation code has been modified such that the admin can optionally specify passwords for internal token and replication. Otherwise the code will generate random passwords like before. https://fedorahosted.org/pki/ticket/1354
* Fix interactive install to not reprompt for portsAde Lee2015-04-291-0/+20
| | | | | Ports are already set when deploying into an existing instance. Having a user re-enter these is repetitious and error prone.
* Code cleanup - simplify pkispawn codeAde Lee2015-04-291-378/+375
| | | | | All subsystems are now tomcat instances. Conditionals based on whether the subsystem is a tomcat instance or not are no longer required.
* Added direct deployment for all subsystems.Endi S. Dewata2015-04-221-11/+0
| | | | | | | | The deployment tool has been modified to deploy all subsystems directly from the /usr/share/pki. This will simplify updating the templates in the web applications. https://fedorahosted.org/pki/ticket/499
* Changes to config files to support nuxwdogAde Lee2015-04-221-0/+7
| | | | Specifically changes to CS.cfg, server.xml and tomcat.conf
* Only read pki_profiles_in_ldap when spawning CA instanceFraser Tweedale2015-04-221-5/+4
|
* Ticket 1316 Allow adding SAN to server cert during the install processChristina Fu2015-04-211-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Usage: * under /usr/share/pki/ca/conf, you will find a new file called serverCert.profile.exampleWithSANpattern * copy existing serverCert.profile away and replace with serverCert.profile.exampleWithSANpattern * edit serverCert.profile.exampleWithSANpattern - follow the instruction right above 8.default. - save and quit * cd /usr/share/pki/ca/profiles/ca , edit caInternalAuthServerCert.cfg - follow the instruction right above policyset.serverCertSet.9 - save and quit * save away and edit the ca config file for pkispawn: (note: you can add multiple SAN's delimited by ',' for pki_san_server_cert - add the following lines, e.g. pki_san_inject=True pki_san_server_cert=host1.Example.com - do the same pkispawn cfg changes for kra or any other instances that you plan on creating * create your instance(s) check the sl sever cert, it should contain something like the following: Identifier: Subject Alternative Name - 2.5.29.17 Critical: no Value: DNSName: host1.Example.com
* Add pkispawn config option for ldap profilesFraser Tweedale2015-04-131-0/+6
| | | | | | Add the `pki_profiles_in_ldap' pkispawn config to control whether profiles are stored on the filesystem (old behaviour) or LDAP (new behaviour). The default is file-based profiles.
* Allow use of secure LDAPS connectionMatthew Harmsen2015-03-131-0/+8
| | | | - PKI TRAC Ticket #1144 - pkispawn needs option to specify ca cert for ldap
* Fixed pylint report.Endi S. Dewata2015-02-051-3/+3
| | | | | | | | | | | | | | | Previously pylint report was saved it into a file which may not be accessible on a build system. The pylint-build-scan.sh has been changed to display the report so it will appear in the build log. The pylint configuration has also been modified to disable C and R messages by default. This way when other errors or warnings occur the build will fail without having to check for specific codes. Some Python codes have been modified to reduce the number of pylint warnings. https://fedorahosted.org/pki/ticket/703
* Remove legacy multilib JNI_JAR_DIR logicMatthew Harmsen2014-12-041-1/+2
| | | | | | | | | | | | | | | | * Bugzilla Bug #1165351 - Errata TPS test fails due to dependent packages not found (cherry picked from commit d7a0807b7493fc3d86900ee4aaf8199efd824907) Conflicts: base/java-tools/templates/pki_java_command_wrapper.in base/java-tools/templates/pretty_print_cert_command_wrapper.in base/java-tools/templates/pretty_print_crl_command_wrapper.in base/server/python/pki/server/deployment/pkiparser.py base/server/scripts/operations (cherry picked from commit c8d73ade2c651fd5ca01226c89d5d19828bfc9b7)
* Ticket 1198 Bugzilla 1158410 add TLS range support to server.xml by default ↵Christina Fu2014-11-241-2/+41
| | | | and upgrade
* Fix sub-CA installation with own security domainAde Lee2014-10-011-6/+5
| | | | | | | | | Installation code failed to anticipate installation of a subordinate CA that would host its own security domain. This patch includes changes to python installation code, java configuration servlet and changes to man pages. Ticket 1132
* ticket #1110 pkispawn (configuration) does not provide CA extensions in ↵Christina Fu2014-09-251-0/+3
| | | | subordinate certificate signing requests (CSR)
* Remove Apache info from pkispawn and pkidestroyMatthew Harmsen2014-09-021-53/+5
| | | | - PKI TRAC Ticket #1077 - Consider removing [Apache] section from 'default.cfg'
* Fix kra-connector-removeAde Lee2014-09-021-1/+1
| | | | | | | | | | | | | | | | | | | | The code to remove the connector from the pki CLI was found to be broken because of invalid message type (partly due to void returns). On uninstall, we need to remove the kra-connector from all relevant CA's in the security domain. The best way to do this is to keep kra-connector info in LDAP, so that only one call is needed. Until that change has been made, we are adding a hack to remove the connector from all CA's in the secutrity domain (if it exists). Due to issues with proxy configurations, we will continue to use sslget and a url-encoded-form version of the servlet. In addition, it was found that when removing a KRA from a shared subsystem, the updateDomainXML servlet was erroneously returning failure when it was unsuccessful in removing a non-existent user from a group. Ticket 1113
* Disable PKI GUI ConfigurationMatthew Harmsen2014-08-281-15/+0
| | | | - PKI TRAC Ticket #1120 - Remove Firefox PKI GUI Configuration Panel Interface
* Fix independent pkispawn installation and configurationMatthew Harmsen2014-08-041-1/+7
| | | | | * PKI TRAC Ticket #905 - 2 Step Configuration of CA instance using pkispawn fails
* Fix pycharm warnings for server python classesAde Lee2014-06-101-163/+166
| | | | | Mostly reformatting due to PEP8. Not all pycharm warnings are addressed, but the vast majority are.
* Modify master_dict to mdict to improve readabilityAde Lee2014-06-101-391/+391
| | | | | | Most of the install python scripts do not meet PEP8 including being less than 80 chars. Changing master_dict to mdict helps fix this and improves or at least does not degrade readability.
* TPS Token Profile Resolver Framework - part2Christina Fu2014-06-041-0/+4
|
* fix issues identified by pycharm for system.pyAde Lee2014-05-291-3/+3
|
* PhoneHome feature:Jack Magne2014-04-151-0/+6
| | | | | | 1. Provides an xml file served by TPS to allow the client(esc) to configure itself to contact TPS. 2. Edewata review fixes. Return application/xml instead of text/xml, and fix how the phone home file path is calculated.
* Added decorator to handle exceptionsAde Lee2014-02-191-3/+3
| | | | | | Decorator catches HttpErrorExceptions from Requests and extracts the relevant PKIException object, and rethrows it.
* Debian: add init script functionalityAde Lee2014-01-081-2/+2
| | | | | | | | | | | | | | | The addtions in this patch will add start/stop/restart/status functionality to operations, so that Debian systems can perform these operations by calling these functions from an init script. We also introduce a parameter in the configuration scripts that can be used to determine if the system is a debian system. This parameter is used to specify a system V init script instead of a systemd script on a debian system, when the configuration scriptlets start and stop a system. Also source apparently does not work by default in debian. Used dot (.) instead.
* Cannot connect to ds when anon. access is offAbhishek Koneru2014-01-081-13/+34
| | | | | | | | | | | | | The connection to ds is checked during installation. But the current method of checking the ds connection before binding with the ds throws an Inappropriate Authentication error when Anonymous access is off. This patch uses the following method to check the connection to a DS server. 1. Initialize the connection 2. Bind with the DS. 3. Perform the ldap search. Ticket #811
* Stand-alone DRMMatthew Harmsen2013-10-251-0/+13
| | | | * TRAC Ticket #762 - Stand-alone DRM (cleanup tasks)
* Stand-alone DRMMatthew Harmsen2013-10-151-8/+47
| | | | * TRAC Ticket #667 - provide option for ca-less drm install
* Ticket 757 - Allow unescaped '%' characters in deployment file password valuesNathan Kinder2013-10-091-0/+33
| | | | | | | | | | | | | This patch allows password values in pkispawn deployment files to contain unescaped '%' characters. Non password settings support interpolation, so they still require escaping. This patch has been tested with deployment file based installs as well as interactive installs. The way it works is that we escape the password settings internally immediately after reading the deployment config file. The interactive installation code already escapes password values as it receives them from the user. This approach allows the rest of the installation code to remain as-is.
generated by cgit (git 2.34.1) at 2024-05-09 11:24:55 +0000