diff options
author | Simo Sorce <ssorce@redhat.com> | 2011-01-28 15:45:19 -0500 |
---|---|---|
committer | Simo Sorce <ssorce@redhat.com> | 2011-01-31 16:35:53 -0500 |
commit | cc9abf5d38c0030bb4dad0e204c16c9c9bae27c0 (patch) | |
tree | 820bafdf43ca8f6de5066bae8090b8b64327455d /install/tools | |
parent | a629f3f4c7ea05973ae755e70d650f964131fae3 (diff) | |
download | freeipa-cc9abf5d38c0030bb4dad0e204c16c9c9bae27c0.tar.gz freeipa-cc9abf5d38c0030bb4dad0e204c16c9c9bae27c0.tar.xz freeipa-cc9abf5d38c0030bb4dad0e204c16c9c9bae27c0.zip |
Use a common group for all DS instances
Also remove the option to choose a user.
It is silly to keep it, when you can't choose the group nor the CA
directory user.
Fixes: https://fedorahosted.org/freeipa/ticket/851
Diffstat (limited to 'install/tools')
-rwxr-xr-x | install/tools/ipa-replica-install | 36 | ||||
-rwxr-xr-x | install/tools/ipa-replica-prepare | 17 | ||||
-rwxr-xr-x | install/tools/ipa-server-install | 102 |
3 files changed, 83 insertions, 72 deletions
diff --git a/install/tools/ipa-replica-install b/install/tools/ipa-replica-install index 3eb41daae..590fd645b 100755 --- a/install/tools/ipa-replica-install +++ b/install/tools/ipa-replica-install @@ -22,6 +22,7 @@ import sys import socket import tempfile, os, pwd, traceback, logging, shutil +import grp from ConfigParser import SafeConfigParser from ipapython import ipautil @@ -33,6 +34,7 @@ from ipaserver.plugins.ldap2 import ldap2 from ipapython import version from ipalib import api, errors, util from ipapython.config import IPAOptionParser +from ipapython import sysrestore CACERT="/etc/ipa/ca.crt" @@ -45,7 +47,6 @@ class ReplicaConfig: self.domain_name = "" self.master_host_name = "" self.dirman_password = "" - self.ds_user = "" self.host_name = "" self.dir = "" self.subject_base = "" @@ -116,7 +117,6 @@ def read_info(dir, rconfig): rconfig.realm_name = config.get("realm", "realm_name") rconfig.master_host_name = config.get("realm", "master_host_name") - rconfig.ds_user = config.get("realm", "ds_user") rconfig.domain_name = config.get("realm", "domain_name") rconfig.host_name = config.get("realm", "destination_host") rconfig.subject_base = config.get("realm", "subject_base") @@ -145,7 +145,7 @@ def resolve_host(host_name): return None def set_owner(config, dir): - pw = pwd.getpwnam(config.ds_user) + pw = pwd.getpwnam(dsinstance.DS_USER) os.chown(dir, pw.pw_uid, pw.pw_gid) def install_ca(config): @@ -168,9 +168,13 @@ def install_ca(config): sys.exit(1) cs = cainstance.CADSInstance() - cs.create_instance(config.ds_user, config.realm_name, config.host_name, config.domain_name, config.dirman_password) + cs.create_instance(config.realm_name, config.host_name, + config.domain_name, config.dirman_password) ca = cainstance.CAInstance(config.realm_name, certs.NSS_DIR) - ca.configure_instance("pkiuser", config.host_name, config.dirman_password, config.dirman_password, pkcs12_info=(cafile,), master_host=config.master_host_name, subject_base=config.subject_base) + ca.configure_instance(config.host_name, config.dirman_password, + config.dirman_password, pkcs12_info=(cafile,), + master_host=config.master_host_name, + subject_base=config.subject_base) return ca @@ -187,7 +191,7 @@ def install_replica_ds(config): config.dir + "/dirsrv_pin.txt") ds = dsinstance.DsInstance() - ds.create_replica(config.ds_user, config.realm_name, + ds.create_replica(config.realm_name, config.master_host_name, config.host_name, config.domain_name, config.dirman_password, pkcs12_info) @@ -205,7 +209,7 @@ def install_krb(config, setup_pkinit=False): pkcs12_info = (config.dir + "/pkinitcert.p12", config.dir + "/pkinit_pin.txt") - krb.create_replica(config.ds_user, config.realm_name, + krb.create_replica(config.realm_name, config.master_host_name, config.host_name, config.domain_name, config.dirman_password, ldappwd_filename, kpasswd_filename, @@ -339,6 +343,9 @@ def main(): if not ipautil.file_exists(filename): sys.exit("Replica file %s does not exist" % filename) + global sstore + sstore = sysrestore.StateFile('/var/lib/ipa/sysrestore') + # check the bind is installed if options.setup_dns: check_bind() @@ -393,6 +400,21 @@ def main(): api.bootstrap(in_server=True) api.finalize() + # Create DS group if it doesn't exist yet + try: + grp.getgrnam(dsinstance.DS_GROUP) + logging.debug("ds group %s exists" % dsinstance.DS_GROUP) + group_exists = True + except KeyError: + group_exists = False + args = ["/usr/sbin/groupadd", "-r", dsinstance.DS_GROUP] + try: + ipautil.run(args) + logging.debug("done adding DS group") + except ipautil.CalledProcessError, e: + logging.critical("failed to add DS group: %s" % e) + sstore.backup_state("install", "group_exists", group_exists) + #Automatically disable pkinit w/ dogtag until that is supported #[certs.ipa_self_signed() must be called only after api.finalize()] if not ipautil.file_exists(config.dir + "/pkinitcert.p12") and not certs.ipa_self_signed(): diff --git a/install/tools/ipa-replica-prepare b/install/tools/ipa-replica-prepare index 908c50a13..38d31aa60 100755 --- a/install/tools/ipa-replica-prepare +++ b/install/tools/ipa-replica-prepare @@ -183,19 +183,13 @@ def export_ra_pkcs12(dir, dm_password): finally: os.remove(agent_name) -def get_ds_user(ds_dir): - uid = os.stat(ds_dir).st_uid - user = pwd.getpwuid(uid)[0] - - return user - -def save_config(dir, realm_name, host_name, ds_user, domain_name, dest_host, +def save_config(dir, realm_name, host_name, + domain_name, dest_host, subject_base): config = SafeConfigParser() config.add_section("realm") config.set("realm", "realm_name", realm_name) config.set("realm", "master_host_name", host_name) - config.set("realm", "ds_user", ds_user) config.set("realm", "domain_name", domain_name) config.set("realm", "destination_host", dest_host) config.set("realm", "subject_base", subject_base) @@ -213,8 +207,8 @@ def copy_files(realm_name, dir): config_dir = dsinstance.config_dirname(dsinstance.realm_to_serverid(realm_name)) try: - shutil.copy("/var/kerberos/krb5kdc/ldappwd", dir + "/ldappwd") - shutil.copy("/var/kerberos/krb5kdc/kpasswd.keytab", dir + "/kpasswd.keytab") + shutil.copy("/var/kerberos/krb5kdc/ldappwd", dir + "/ldappwd") + shutil.copy("/var/kerberos/krb5kdc/kpasswd.keytab", dir + "/kpasswd.keytab") shutil.copy("/usr/share/ipa/html/ca.crt", dir + "/ca.crt") if ipautil.file_exists("/usr/share/ipa/html/preferences.html"): shutil.copy("/usr/share/ipa/html/preferences.html", dir + "/preferences.html") @@ -281,7 +275,6 @@ def main(): print "You can't create a replica on itself" sys.exit(1) ds_dir = dsinstance.config_dirname(dsinstance.realm_to_serverid(api.env.realm)) - ds_user = get_ds_user(ds_dir) # get the directory manager password dirman_password = options.password @@ -404,7 +397,7 @@ def main(): print "Copying additional files" copy_files(api.env.realm, dir) print "Finalizing configuration" - save_config(dir, api.env.realm, api.env.host, ds_user, api.env.domain, replica_fqdn, subject_base) + save_config(dir, api.env.realm, api.env.host, api.env.domain, replica_fqdn, subject_base) replicafile = "/var/lib/ipa/replica-info-" + replica_fqdn encfile = replicafile+".gpg" diff --git a/install/tools/ipa-server-install b/install/tools/ipa-server-install index c07f6fc3e..4a40c13a2 100755 --- a/install/tools/ipa-server-install +++ b/install/tools/ipa-server-install @@ -31,7 +31,7 @@ import os import socket import errno import logging -import pwd +import grp import subprocess import signal import shutil @@ -58,8 +58,6 @@ from ipapython.ipautil import * from ipalib import api, errors, util from ipapython.config import IPAOptionParser -DEF_DS_USER = 'dirsrv' - pw_name = None uninstalling = False @@ -68,8 +66,6 @@ def parse_options(): # Guaranteed to give a random 200k range below the 2G mark (uint32_t limit) namespace = random.randint(1, 10000) * 200000 parser = IPAOptionParser(version=version.VERSION) - parser.add_option("-u", "--user", dest="ds_user", - help="ds user") parser.add_option("-r", "--realm", dest="realm_name", help="realm name") parser.add_option("-n", "--domain", dest="domain_name", @@ -151,12 +147,10 @@ def parse_options(): parser.error("You cannot specify a --forwarder option together with --no-forwarders") if options.uninstall: - if (options.ds_user or options.realm_name or + if (options.realm_name or options.admin_password or options.master_password): - parser.error("In uninstall mode, -u, r and -P options are not allowed") + parser.error("In uninstall mode, -a, -r and -P options are not allowed") elif options.unattended: - if not options.ds_user: - options.ds_user = DEF_DS_USER if (not options.realm_name or not options.dm_password or not options.admin_password): parser.error("In unattended mode you need to provide at least -r, -p and -a options") @@ -306,32 +300,6 @@ def resolve_host(host_name): print "Unable to lookup the IP address of the provided host" return ip -def read_ds_user(): - print "The server must run as a specific user in a specific group." - print "It is strongly recommended that this user should have no privileges" - print "on the computer (i.e. a non-root user). The set up procedure" - print "will give this user/group some permissions in specific paths/files" - print "to perform server-specific operations." - print "" - - ds_user = "" - try: - pwd.getpwnam(DEF_DS_USER) - - print "A user account named %s already exists." % DEF_DS_USER - print "This is the user id that the Directory Server will run as." - print "" - if user_input("Do you want to use the existing %s account?" % DEF_DS_USER, True): - ds_user = DEF_DS_USER - else: - print "" - ds_user = user_input_plain("Which account name do you want to use for the DS instance?", allow_empty = False, allow_spaces = False) - print "" - except KeyError: - ds_user = DEF_DS_USER - - return ds_user - def read_domain_name(domain_name, unattended): print "The domain name has been calculated based on the host name." print "" @@ -447,6 +415,18 @@ def uninstall(): os.remove("/etc/httpd/conf.d/ipa.conf") except: pass + + group_exists = sstore.restore_state("install", "group_exists") + if group_exists == False: + try: + grp.getgrnam(dsinstance.DS_GROUP) + try: + ipautil.run(["/usr/sbin/groupdel", dsinstance.DS_GROUP]) + except ipautil.CalledProcessError, e: + logging.critical("failed to delete group %s" % e) + except KeyError: + logging.info("Group %s already removed", dsinstance.DS_GROUP) + return 0 @@ -492,6 +472,8 @@ def main(): global fstore fstore = sysrestore.FileStore('/var/lib/ipa/sysrestore') + global sstore + sstore = sysrestore.StateFile('/var/lib/ipa/sysrestore') # Configuration for ipalib, we will bootstrap and finalize later, after # we are sure we have the configuration file ready. @@ -544,7 +526,6 @@ def main(): if not options.external_ca: check_dirsrv(options.unattended) - ds_user = "" realm_name = "" host_name = "" domain_name = "" @@ -629,14 +610,6 @@ def main(): print "Domain name: " + domain_name print "" - if not options.ds_user: - ds_user = read_ds_user() - if ds_user == "": - sys.exit(1) - logging.debug("read ds_user: %s\n" % ds_user) - else: - ds_user = options.ds_user - if not options.realm_name: realm_name = read_realm_name(domain_name, options.unattended) logging.debug("read realm_name: %s\n" % realm_name) @@ -695,6 +668,21 @@ def main(): print "Please wait until the prompt is returned." print "" + # Create DS group if it doesn't exist yet + try: + grp.getgrnam(dsinstance.DS_GROUP) + logging.debug("ds group %s exists" % dsinstance.DS_GROUP) + group_exists = True + except KeyError: + group_exists = False + args = ["/usr/sbin/groupadd", "-r", dsinstance.DS_GROUP] + try: + ipautil.run(args) + logging.debug("done adding DS group") + except ipautil.CalledProcessError, e: + logging.critical("failed to add DS group: %s" % e) + sstore.backup_state("install", "group_exists", group_exists) + # Configure ntpd if options.conf_ntp: ntp = ntpinstance.NTPInstance(fstore) @@ -730,21 +718,26 @@ def main(): if options.external_cert_file is None: cs = cainstance.CADSInstance() - cs.create_instance("pkisrv", realm_name, host_name, domain_name, dm_password) + cs.create_instance(realm_name, host_name, domain_name, dm_password) ca = cainstance.CAInstance(realm_name, certs.NSS_DIR) if external == 0: - ca.configure_instance("pkiuser", host_name, dm_password, dm_password, subject_base=options.subject) + ca.configure_instance(host_name, dm_password, dm_password, + subject_base=options.subject) elif external == 1: options.realm_name = realm_name options.domain_name = domain_name - options.ds_user = ds_user options.master_password = master_password options.host_name = host_default options.unattended = True write_cache(options) - ca.configure_instance("pkiuser", host_name, dm_password, dm_password, csr_file="/root/ipa.csr", subject_base=options.subject) + ca.configure_instance(host_name, dm_password, dm_password, + csr_file="/root/ipa.csr", + subject_base=options.subject) else: - ca.configure_instance("pkiuser", host_name, dm_password, dm_password, cert_file=options.external_cert_file, cert_chain_file=options.external_ca_file, subject_base=options.subject) + ca.configure_instance(host_name, dm_password, dm_password, + cert_file=options.external_cert_file, + cert_chain_file=options.external_ca_file, + subject_base=options.subject) # Now put the CA cert where other instances exepct it ca.publish_ca_cert("/etc/ipa/ca.crt") @@ -762,11 +755,14 @@ def main(): if options.dirsrv_pkcs12: pkcs12_info = (options.dirsrv_pkcs12, pw_name) try: - ds.create_instance(ds_user, realm_name, host_name, domain_name, dm_password, pkcs12_info, subject_base=options.subject, hbac_allow=not options.hbac_allow) + ds.create_instance(realm_name, host_name, domain_name, + dm_password, pkcs12_info, + subject_base=options.subject, + hbac_allow=not options.hbac_allow) finally: os.remove(pw_name) else: - ds.create_instance(ds_user, realm_name, host_name, domain_name, + ds.create_instance(realm_name, host_name, domain_name, dm_password, self_signed_ca=options.selfsign, idstart=options.idstart, idmax=options.idmax, subject_base=options.subject, @@ -786,13 +782,13 @@ def main(): krb = krbinstance.KrbInstance(fstore) if options.pkinit_pkcs12: pkcs12_info = (options.pkinit_pkcs12, pw_name) - krb.create_instance(ds_user, realm_name, host_name, domain_name, + krb.create_instance(realm_name, host_name, domain_name, dm_password, master_password, setup_pkinit=options.setup_pkinit, pkcs12_info=pkcs12_info, subject_base=options.subject) else: - krb.create_instance(ds_user, realm_name, host_name, domain_name, + krb.create_instance(realm_name, host_name, domain_name, dm_password, master_password, setup_pkinit=options.setup_pkinit, self_signed_ca=options.selfsign, |