summaryrefslogtreecommitdiffstats
path: root/ipaserver/install/dsinstance.py
Commit message (Collapse)AuthorAgeFilesLines
* DS install: don't fail if SSL already configuredStanislav Laznicka2018-11-131-8/+20
| | | | | | | | | | | DS now comes with certain SSL capabilities turned on after installation. Previously, we did not expect this and were blindly forcing everything on without checking, whether it needs turning on. This would result in failures if the config entries are already set the way we want. Relax this configuration. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* DS install: fix DS asking for NSS pin during installStanislav Laznicka2018-11-131-2/+4
| | | | | | | | | DS now comes with nsslapd-security turned on and its own CA cert in its NSS database. We're re-setting the NSS database and setting our own CA cert to it, the DS pin file therefore needs to be updated with the new password after this reset. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* DS uninstall: fix serverid missing in state restoreStanislav Laznicka2018-11-131-1/+4
| | | | | | | | During uninstallation, we're using serverid which we get from sysrestore.state. This was not set in the newer install, return it back. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Move lib389 imports to module scopeStanislav Laznicka2018-11-131-17/+17
| | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Don't try legacy installsStanislav Laznicka2018-11-131-85/+2
| | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Remove some basic pystyle and pylint errorsStanislav Laznicka2018-11-131-36/+39
| | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Support the 1.4.x python installer tools in 389-dsWilliam Brown2018-11-131-5/+108
| | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Remove DL0 specific code from dsinstance ipaserver/installThomas Woerner2018-09-121-2/+2
| | | | | | | | | Promote is now hard set to True in create_replica for later use in _get_replication_manager. See: https://pagure.io/freeipa/issue/7689 Signed-off-by: Thomas Woerner <twoerner@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Auto-retry failed certmonger requestsChristian Heimes2018-07-091-1/+2
| | | | | | | | | | | | | | | During parallel replica installation, a request sometimes fails with CA_REJECTED or CA_UNREACHABLE. The error occur when the master is either busy or some information haven't been replicated yet. Even a stuck request can be recovered, e.g. when permission and group information have been replicated. A new function request_and_retry_cert() automatically resubmits failing requests until it times out. Fixes: https://pagure.io/freeipa/issue/7623 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Tune DS replication settingsChristian Heimes2018-07-091-18/+30
| | | | | | | | | | | | Tune 389-DS replication settings to improve performance and avoid timeouts. During installation of a replica, the value of nsDS5ReplicaBindDnGroupCheckInterval is reduced to 2 seconds. At the end of the installation, the value is increased sensible production settings. This avoids long delays during replication. See: https://pagure.io/freeipa/issue/7617 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* Add absolute_import future importsStanislav Laznicka2018-04-201-1/+1
| | | | | | | | | Add absolute_import from __future__ so that pylint does not fail and to achieve python3 behavior in python2. Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Cleanup and remove more files on uninstallChristian Heimes2018-03-281-2/+8
| | | | | | | | | | | | * /etc/nsswitch.conf.ipabkp * /etc/openldap/ldap.conf.ipabkp * /var/lib/ipa/sysrestore/* * /var/named/dyndb-ldap/ipa/ * /var/lib/dirsrv/scripts-%s/ See: https://pagure.io/freeipa/issue/2694 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* certmonger: Use explicit storage formatChristian Heimes2018-02-231-1/+3
| | | | | | | | Add storage='NSSDB' to various places. It makes it a bit easier to track down NSSDB usage. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* service: rename import_ca_certs_* to export_*Stanislav Laznicka2018-02-211-1/+1
| | | | | | | | | | | The import_ca_certs_{file,nssdb} methods were actually exporting CA certificates from LDAP to different formats. The new names should better reflect what these methods are actually doing. Related: https://pagure.io/freeipa/issue/3757 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Use mod_ssl instead of mod_nss for Apache TLS for new installsRob Crittenden2018-02-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | Change some built-in assumptions that Apache has an NSS certificate database. Configure mod_ssl instead of mod_nss. This is mostly just changing the directives used with some slight syntactical differences. Drop mod_nss-specific methods and functions. There is some mention of upgrades here but this is mostly a side-effect of removing things necessary for the initial install. TODO: - backup and restore - use user-provided PKCS#12 file for the certificate and key Related: https://pagure.io/freeipa/issue/3757 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Update existing 389-DS cn=RSA,cn=encryption configChristian Heimes2018-02-081-1/+5
| | | | | | | | | | | 389-DS >= 1.4.0 on Fedora 28 has a default entry for cn=RSA,cn=encryption,cn=config. The installer now updates the entry in case it already exists. This ensures that token and personality are correct for freeIPA Fixes: https://pagure.io/freeipa/issue/7393 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Sort external schema filesChristian Heimes2018-01-101-1/+1
| | | | | | | | | get_all_external_schema_files() now returns schema files sorted. Fixes: https://pagure.io/freeipa/issue/7338 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* LGTM: Silence unmatchable dollarChristian Heimes2018-01-091-1/+5
| | | | | | | | | Silence false positive "unmatchable dollar in regular expression". https://pagure.io/freeipa/issue/7344 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Checks if replica-s4u2proxy.ldif should be appliedFelipe Barreto2017-10-251-1/+18
| | | | | | | | | | | | Before applying replica-s3u2proxy.ldif, we check if the values are already there. The values can be there if a replica installation was done in the past and some info was left behind. Also, the code checks the values independently. https://pagure.io/freeipa/issue/7174 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Use os.path.isfile() and isdir()Christian Heimes2017-10-201-1/+1
| | | | | | | | | | | Replace custom file_exists() and dir_exists() functions with proper functions from Python's stdlib. The change also gets rid of pylint's invalid bad-python3-import error, https://github.com/PyCQA/pylint/issues/1565 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ds: ignore time skew during initial replication stepAlexander Bokovoy2017-10-191-0/+24
| | | | | | | | | Initial replica creation can go with ignoring time skew checks. We should, however, force time skew checks during normal operation. Fixes https://pagure.io/freeipa/issue/7211 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Use 389-ds provided method for file limits tuningRob Crittenden2017-10-171-25/+0
| | | | | | | | | | | | | | | | | | | | Previously IPA would set the LimitNOFILE value to 8192 to increase the number of concurrent clients. 389-ds-base does this by default as of 1.3.7.0. Remove the IPA-specific tuning and rely on the out-of-the-box 389-ds-base tuning. Bump the required version of 389-ds-base to 1.3.7.0. Any other tuning added by 389-ds-base will result in a dirsrv.systemd.rpmsave file which admins will need to merge in manually, like typical .rpmsave config changes. https://pagure.io/freeipa/issue/6994 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Fix ipa-server-upgrade with server cert trackingFlorence Blanc-Renaud2017-09-191-4/+41
| | | | | | | | | | | | | | | | | ipa-server-upgrade fails with Server-Cert not found, when trying to track httpd/ldap server certificates. There are 2 issues in the upgrade: - the certificates should be tracked only if they were issued by IPA CA (it is possible to have CA configured but 3rd part certs) - the certificate nickname can be different from Server-Cert The fix provides methods to find the server crt nickname for http and ldap, and a method to check if the server certs are issued by IPA and need to be tracked by certmonger. https://pagure.io/freeipa/issue/7141 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* dsinstance: Restore context after changing dse.ldifAlexander Bokovoy2017-09-131-0/+1
| | | | | | | Fixes https://pagure.io/freeipa/issue/7150 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* x509: Make certificates represented as objectsStanislav Laznicka2017-07-271-5/+5
| | | | | | | | https://pagure.io/freeipa/issue/4985 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* logging: do not log into the root loggerJan Cholasta2017-07-141-43/+46
| | | | | | | Deprecate `ipa_log_manager.root_logger` and replace all calls to it with module-level logger calls. Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: trust IPA CA for PKINITJan Cholasta2017-05-191-7/+24
| | | | | | | | | | Trust IPA CA to issue PKINIT KDC and client authentication certificates in the IPA certificate store. https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* certdb, certs: make trust flags argument mandatoryJan Cholasta2017-05-191-1/+1
| | | | | | | | | | Make the trust flags argument mandatory in all functions in `certdb` and `certs`. https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* certdb: add named trust flag constantsJan Cholasta2017-05-191-2/+3
| | | | | | | | | | | Add named constants for common trust flag combinations. Use the named constants instead of trust flags strings in the code. https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Move the compat plugin setup at the end of installStanislav Laznicka2017-04-241-9/+0
| | | | | | | | | | The compat plugin was causing deadlocks with the topology plugin. Move its setup at the end of the installation and remove the cn=topology,cn=ipa,cn=etc subtree from its scope. https://pagure.io/freeipa/issue/6821 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Create system users for FreeIPA services during package installationDavid Kupka2017-04-111-11/+0
| | | | | | | | | | | | | | | | | | | | Previously system users needed by FreeIPA server services was created during ipa-server-install. This led to problem when DBus policy was configured during package installation but the user specified in the policy didn't exist yet (and potentionally similar ones). Now the users will be created in package %pre section so all users freeipa-server package needs exist before any installation or configuration begins. Another possibility would be using systemd-sysusers(8) for this purpose but given that systemd is not available during container build the traditional approach is superior. Also dirsrv and pkiuser users are no longer created by FreeIPA instead it depends on 389ds and dogtag to create those users. https://pagure.io/freeipa/issue/6743 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* install: request service certs after host keytab is set upJan Cholasta2017-04-071-10/+7
| | | | | | | | | | | | | The certmonger renew agent and restart scripts use host keytab for authentication. When they are executed during a certmonger request before the host keytab is set up, the authentication will fail. Make sure all certmonger requests in the installer are done after the host keytab is set up. https://pagure.io/freeipa/issue/6757 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* dsinstance, httpinstance: consolidate certificate request codeJan Cholasta2017-04-071-55/+21
| | | | | | | | | | | | A different code path is used for DS and httpd certificate requests in replica promotion. This is rather unnecessary and makes the certificate request code not easy to follow. Consolidate the non-promotion and promotion code paths into one. https://pagure.io/freeipa/issue/6757 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* dsinstance: reconnect ldap2 after DS is restarted by certmongerJan Cholasta2017-04-071-0/+4
| | | | | | | | | | | | | | DS is restarted by certmonger in the restart_dirsrv script after the DS certificate is saved. This breaks the ldap2 backend and makes any operation fail with NetworkError until it is reconnected. Reconnect ldap2 after the DS certificate request is finished to fix the issue. Make sure restart_dirsrv waits for the ldapi socket so that the reconnect does not fail. https://pagure.io/freeipa/issue/6757 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* certs: do not implicitly create DS pin.txtJan Cholasta2017-03-221-1/+2
| | | | | | | | | | | | Do not implicitly create DS pin.txt in `CertDB.init_from_pkcs12()`, create it explicitly in `DSInstance.__enable_ssl()`. This stops the file from being created in /etc/httpd/alias during classic replica install. https://pagure.io/freeipa/issue/4639 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* installer: update time estimatesTomas Krizek2017-03-101-3/+3
| | | | | | | | | | Time estimates have been updated to be more accurate. Only tasks that are estimated to take longer than 10 seconds have the estimate displayed. https://pagure.io/freeipa/issue/6596 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Support for Certificate Identity MappingFlorence Blanc-Renaud2017-03-021-0/+1
| | | | | | | | | | See design http://www.freeipa.org/page/V4/Certificate_Identity_Mapping https://fedorahosted.org/freeipa/ticket/6542 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Moving ipaCert from HTTPD_ALIAS_DIRStanislav Laznicka2017-03-011-7/+8
| | | | | | | | | | | | | The "ipaCert" nicknamed certificate is not required to be in /var/lib/ipa/radb NSSDB anymore as we were keeping a copy of this file in a separate file anyway. Remove it from there and track only the file. Remove the IPA_RADB_DIR as well as it is not required anymore. https://fedorahosted.org/freeipa/ticket/5695 https://fedorahosted.org/freeipa/ticket/6680 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Make request_service_keytab into a public methodMartin Babinsky2017-02-221-3/+3
| | | | | | | | | | a cosmetic change: we had private method comprising of calls to public ones, which did not make much sense in our case https://fedorahosted.org/freeipa/ticket/6638 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Always use /etc/ipa/ca.crt as CA cert fileSimo Sorce2017-02-151-5/+1
| | | | | | | | | | | | | It seem like ALIAS_CACERT_ASC was just a redundant location for the CA cert file which is always available in /etc/ipa/ca.crt Just use the canonical CA cert location in /etc/ipa for all cases and stop creating a separate cacert file. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Separate RA cert store from the HTTP cert storeSimo Sorce2017-02-151-3/+4
| | | | | | | | | | | | | | | This is in preparation for separating out the user under which the ipa api framework runs as. This commit also removes certs.NSS_DIR to avoid confusion and replaces it where appropriate with the correct NSS DB directory, either the old HTTPD_ALIAS_DIR ot the RA DB IPA_RADB_DIR. In some cases its use is removed altogether as it was simply not necessary. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: change_admin_password: use textual modeMartin Basti2017-02-101-16/+8
| | | | | | | | | | Convert function to NamedTemporaryFile with textual mode, because passwords are text. Using `with` and NamedTemporaryFile gives more security agains leaking password from tempfiles. https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: open temporary ldif file in text modeMartin Basti2017-01-241-2/+3
| | | | | | | | | | | | ldif parser uses file in text mode, so we have to open it in text mode in py3 Also values passed to parser should be bytes https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove duplicated step from DS installMartin Basti2017-01-121-2/+0
| | | | | | | "Adding SASL mappings.." is duplicated step in __common_setup in DS instance and should be removed. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Allow full customisability of IPA CA subject DNFraser Tweedale2017-01-111-35/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | Currently only the "subject base" of the IPA CA subject DN can be customised, via the installer's --subject-base option. The RDN "CN=Certificate Authority" is appended to form the subject DN, and this composition is widely assumed. Some administrators need more control over the CA subject DN, especially to satisfy expectations of external CAs when the IPA CA is to be externally signed. This patch adds full customisability of the CA subject DN. Specifically: - Add the --ca-subject option for specifying the full IPA CA subject DN. Defaults to "CN=Certificate Authority, O=$SUBJECT_BASE". - ipa-ca-install, when installing a CA in a previous CA-less topology, updates DS certmap.conf with the new new CA subject DN. - DsInstance.find_subject_base no longer looks in certmap.conf, because the CA subject DN can be unrelated to the subject base. Fixes: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* dsinstance: extract function for writing certmap.confFraser Tweedale2017-01-111-5/+13
| | | | | | | | | | | | | | | | For full customisability of the IPA CA subject DN, we will need the ability to update DS `certmap.conf' when upgrading a deployment from CA-less to CA-ful. Extract the existing behaviour, which is private to DsInstance, to the `write_certmap_conf' top-level function. Also update `certmap.conf.template' for substition of the whole CA subject DN (not just the subject base). Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Extract function for computing default subject baseFraser Tweedale2017-01-111-1/+2
| | | | | | Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Unify password generation across FreeIPAStanislav Laznicka2017-01-061-4/+1
| | | | | | | | | | | | Also had to recalculate entropy of the passwords as originally, probability of generating each character was 1/256, however the default probability of each character in the ipa_generate_password is 1/95 (1/94 for first and last character). https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* dsinstance: minor string fixesFraser Tweedale2017-01-051-6/+7
| | | | | Fixes: https://fedorahosted.org/freeipa/ticket/6586 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Set up DS TLS on replica in CA-less topologyFraser Tweedale2017-01-051-1/+3
| | | | | Fixes: https://fedorahosted.org/freeipa/ticket/6226 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-04 21:16:09 +0000