diff options
Diffstat (limited to 'smartproxy')
| -rw-r--r-- | smartproxy/Makefile.am | 43 | ||||
| -rw-r--r-- | smartproxy/configure.ac | 75 | ||||
| -rwxr-xr-x | smartproxy/ipa-smartproxy | 336 | ||||
| -rw-r--r-- | smartproxy/ipa-smartproxy.conf | 15 | ||||
| -rw-r--r-- | smartproxy/ipa-smartproxy.logrotate | 11 | ||||
| -rw-r--r-- | smartproxy/ipa-smartproxy.service | 12 | ||||
| -rw-r--r-- | smartproxy/man/Makefile.am | 19 | ||||
| -rw-r--r-- | smartproxy/man/ipa-smartproxy.1 | 78 | ||||
| -rw-r--r-- | smartproxy/man/ipa-smartproxy.conf.5 | 72 |
9 files changed, 661 insertions, 0 deletions
diff --git a/smartproxy/Makefile.am b/smartproxy/Makefile.am new file mode 100644 index 00000000..8d680625 --- /dev/null +++ b/smartproxy/Makefile.am @@ -0,0 +1,43 @@ +# This file will be processed with automake-1.7 to create Makefile.in + +AUTOMAKE_OPTIONS = 1.7 + +NULL = + +etcdir = $(IPA_SYSCONF_DIR) +etc_DATA = \ + ipa-smartproxy.conf \ + $(NULL) + +sbin_SCRIPTS = \ + ipa-smartproxy \ + $(NULL) + +rotatedir = $(LOGROTATE_DIR) +rotate_DATA = \ + ipa-smartproxy.logrotate \ + $(NULL) + +SUBDIRS = \ + man \ + $(NULL) + +EXTRA_DIST = \ + $(etc_DATA) \ + $(rotate_DATA) \ + $(NULL) + +DISTCLEANFILES = \ + $(NULL) + +MAINTAINERCLEANFILES = \ + *~ \ + aclocal.m4 \ + configure \ + install-sh \ + missing \ + Makefile.in \ + $(NULL) + +install-data-hook: + mv $(DESTDIR)/$(LOGROTATE_DIR)/ipa-smartproxy.logrotate $(DESTDIR)/$(LOGROTATE_DIR)/ipa-smartproxy diff --git a/smartproxy/configure.ac b/smartproxy/configure.ac new file mode 100644 index 00000000..5908a7f1 --- /dev/null +++ b/smartproxy/configure.ac @@ -0,0 +1,75 @@ +AC_PREREQ(2.59) +m4_include(../version.m4) +AC_INIT([ipa-server], + IPA_VERSION, + [https://hosted.fedoraproject.org/projects/freeipa/newticket]) + +AM_INIT_AUTOMAKE([foreign]) + +AM_MAINTAINER_MODE + +AC_SUBST(VERSION) +AC_SUBST([INSTALL_DATA], ['$(INSTALL) -m 644 -p']) + +AC_PROG_MKDIR_P +AC_PROG_AWK +AC_PROG_SED + +AC_PATH_PROG(XGETTEXT, xgettext, [no]) +if test "x$XGETTEXT" = "xno"; then + AC_MSG_ERROR([xgettext not found, install gettext]) +fi + +AC_PATH_PROG(MSGFMT, msgfmt, [no]) +if test "x$MSGFMT" = "xno"; then + AC_MSG_ERROR([msgfmt not found, install gettext]) +fi + +AC_PATH_PROG(MSGINIT, msginit, [no]) +if test "x$MSGINIT" = "xno"; then + AC_MSG_ERROR([msginit not found, install gettext]) +fi + +AC_PATH_PROG(MSGMERGE, msgmerge, [no]) +if test "x$MSGMERGE" = "xno"; then + AC_MSG_ERROR([msgmerge not found, install gettext]) +fi + +AC_PATH_PROG(MSGCMP, msgcmp, [no]) +if test "x$MSGCMP" = "xno"; then + AC_MSG_ERROR([msgcmp not found, install gettext]) +fi + +AC_PATH_PROG(MSGATTRIB, msgattrib, [no]) +if test "x$MSGATTRIB" = "xno"; then + AC_MSG_ERROR([msgattrib not found, install gettext]) +fi + +AC_PATH_PROG(TX, tx, [/usr/bin/tx]) + +AC_ARG_WITH([gettext_domain], + [AS_HELP_STRING([--with-gettext-domain=name], + [set the name of the i18n message catalog])], + [], + [with_gettext_domain=ipa]) +AC_SUBST(GETTEXT_DOMAIN, $with_gettext_domain) + +dnl --------------------------------------------------------------------------- +dnl - Set the data install directory since we don't use pkgdatadir +dnl --------------------------------------------------------------------------- + +IPA_DATA_DIR="$datadir/ipa" +IPA_SYSCONF_DIR="$sysconfdir/ipa" +LOGROTATE_DIR="$sysconfdir/logrotate.d" +AC_SUBST(IPA_DATA_DIR) +AC_SUBST(IPA_SYSCONF_DIR) +AC_SUBST(LOGROTATE_DIR) + +# Files + +AC_CONFIG_FILES([ + Makefile + man/Makefile +]) + +AC_OUTPUT diff --git a/smartproxy/ipa-smartproxy b/smartproxy/ipa-smartproxy new file mode 100755 index 00000000..d5e8f227 --- /dev/null +++ b/smartproxy/ipa-smartproxy @@ -0,0 +1,336 @@ +#!/usr/bin/python2 -E +# +# Authors: +# Rob Crittenden <rcritten@redhat.com> +# +# Copyright (C) 2014 Red Hat +# see file 'COPYING' for use and warranty information +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. + +import sys +import os +import cherrypy +import json +import syslog +import pwd +from optparse import OptionParser +from functools import wraps +from cherrypy import response +from cherrypy.process import plugins +from ipalib import api +from ipalib import errors +from ipalib import util +from ipaserver.rpcserver import json_encode_binary +from ipapython.version import VERSION + + +def jsonout(func): + '''JSON output decorator''' + @wraps(func) + def wrapper(*args, **kw): + value = func(*args, **kw) + response.headers["Content-Type"] = "application/json;charset=utf-8" + data = json_encode_binary(value) + return json.dumps(data, sort_keys=True, indent=2) + + return wrapper + + +def handle_error(status, message, traceback, version): + """ + Return basic messages to user and log backtrace in case of 500 + error. + """ + if status.startswith('500'): + cherrypy.log(msg=message + '\n', context='IPA', traceback=True) + + resp = cherrypy.response + resp.headers['Content-Type'] = 'application/json' + return json.dumps({'status': status, 'message': message}) + + +def convert_unicode(value): + """ + IPA requires all incoming values to be unicode. Recursively + convert the values. + """ + if not isinstance(value, basestring): + return value + + if value is not None: + return unicode(value) + else: + return None + + +def Command(command, *args, **options): + if (cherrypy.request.config.get('local_only', False) and + cherrypy.request.remote.ip not in ['::1', '127.0.0.1']): + raise IPAError( + status=401, + message="Not a local request" + ) + + if not api.Backend.rpcclient.isconnected(): + api.Backend.rpcclient.connect() + try: + if not api.Backend.rpcclient.isconnected(): + api.Backend.rpcclient.connect() + except errors.CCacheError, e: + raise IPAError( + status=401, + message=e + ) + + # IPA wants all its strings as unicode + args = map(lambda v: convert_unicode(v), args) + options = dict(zip(options, map(convert_unicode, options.values()))) + + params = api.Command[command].args_options_2_params(*args, **options) + cherrypy.log(context='IPA', msg='%s(%s)' % + (command, ', '.join(api.Command[command]._repr_iter(**params)))) + try: + return api.Command[command](*args, **options)['result'] + except (errors.DuplicateEntry, errors.DNSNotARecordError, + errors.ValidationError, errors.ConversionError,) as e: + raise IPAError( + status=400, + message=e + ) + except errors.ACIError, e: + raise IPAError( + status=401, + message=e + ) + except errors.NotFound, e: + raise IPAError( + status=404, + message=e + ) + except Exception, e: + raise IPAError( + status=500, + message=e + ) + + +@jsonout +def GET(command, *args, **options): + return Command(command, *args, **options) + + +@jsonout +def POST(command, *args, **options): + cherrypy.response.status = 201 + return Command(command, *args, **options) + + +@jsonout +def DELETE(command, *args, **options): + return Command(command, *args, **options) + + +class IPAError(cherrypy.HTTPError): + """ + Return errors in IPA-style json. + + Local errors are treated as strings so do not include the code and + name attributes within the error dict. + + This is not padded for IE. + """ + + def set_response(self): + response = cherrypy.serving.response + + cherrypy._cperror.clean_headers(self.code) + + # In all cases, finalize will be called after this method, + # so don't bother cleaning up response values here. + response.status = self.status + + if isinstance(self._message, Exception): + error = {'code': self._message.errno, + 'message': self._message.message, + 'name': self._message.__class__.__name__} + elif isinstance(self._message, basestring): + error = {'message': self._message} + else: + error = {'message': + 'Unable to handle error message type %s' % type(self._message)} + + response.body = json.dumps({'error': error, + 'id': 0, + 'principal': util.get_current_principal(), + 'result': None, + 'version': VERSION}, + sort_keys=True, indent=2) + + +class Host(object): + + exposed = True + + def GET(self, fqdn=None): + + if fqdn is None: + command = 'host_find' + else: + command = 'host_show' + + return GET(command, fqdn) + + def POST(self, hostname, description=None, random=False, + macaddress=None, userclass=None, ip_address=None, + password=None): + return POST('host_add', hostname, + description=description, random=random, + force=True, macaddress=macaddress, + userclass=userclass, ip_address=ip_address, + userpassword=password) + + def DELETE(self, fqdn): + return DELETE('host_del', fqdn) + + +class Hostgroup(object): + + exposed = True + + def GET(self, name=None): + + if name is None: + command = 'hostgroup_find' + else: + command = 'hostgroup_show' + + return GET(command, name) + + def POST(self, name=None, description=None): + cherrypy.response.status = 201 + return POST('hostgroup_add', name, + description=description,) + + def DELETE(self, name): + return DELETE('hostgroup_del', name) + +class Features(object): + exposed = True + + def GET(self): + return '["realm"]' + + +def start(config=None, daemonize=False, pidfile=None): + # Set the umask so only the owner can read the log files + old_umask = os.umask(077) + + cherrypy.tree.mount( + Features(), '/features', + {'/': + {'request.dispatch': cherrypy.dispatch.MethodDispatcher()} + } + ) + cherrypy.tree.mount( + Host(), '/ipa/smartproxy/host', + {'/': + {'request.dispatch': cherrypy.dispatch.MethodDispatcher()} + } + ) + cherrypy.tree.mount( + Hostgroup(), '/ipa/smartproxy/hostgroup', + {'/': + {'request.dispatch': cherrypy.dispatch.MethodDispatcher()} + } + ) + + api.bootstrap(context='ipasmartproxy') + api.finalize() + + # Register the domain for requests from Foreman + cherrypy.tree.mount( + Host(), '/realm/%s' % api.env.domain, + {'/': + {'request.dispatch': cherrypy.dispatch.MethodDispatcher()} + } + ) + + for c in config or []: + try: + cherrypy.config.update(c) + except (IOError, OSError), e: + cherrypy.log(msg="Exception trying to load %s: %s" % (c, e), + context='IPA', traceback=False) + return 1 + + # Log files are created, reset umask + os.umask(old_umask) + + user = cherrypy.config.get('user', None) + if user is None: + cherrypy.log(msg="User is required", context='IPA', traceback=False) + return 1 + pent = pwd.getpwnam(user) + + if daemonize: + cherrypy.config.update({'log.screen': False}) + plugins.Daemonizer(cherrypy.engine).subscribe() + + if pidfile: + plugins.PIDFile(cherrypy.engine, pidfile).subscribe() + + cherrypy.engine.signal_handler.subscribe() + + cherrypy.config.update({'error_page.500': handle_error}) + + # If you don't use GSS-Proxy you're on your own in ensuring that + # there is always a valid ticket for the smartproxy to use. + if cherrypy.config.get('use_gssproxy', False): + cherrypy.log(msg="Enabling GSS-Proxy", context='IPA') + os.environ['GSS_USE_PROXY'] = '1' + + if os.geteuid() == 0: + cherrypy.log(msg="Dropping root privileges to %s" % user, + context='IPA') + plugins.DropPrivileges(cherrypy.engine, + uid=pent.pw_uid, + gid=pent.pw_gid).subscribe() + + try: + cherrypy.engine.start() + except Exception: + return 1 + else: + cherrypy.engine.block() + + return 0 + +if __name__ == '__main__': + p = OptionParser() + p.add_option('-c', '--config', action="append", dest='config', + help="specify config file(s)") + p.add_option('-d', action="store_true", dest='daemonize', + help="run the server as a daemon") + p.add_option('-p', '--pidfile', dest='pidfile', default=None, + help="store the process id in the given file") + options, args = p.parse_args() + + try: + sys.exit(start(options.config, options.daemonize, options.pidfile)) + except Exception, e: + cherrypy.log(msg="Exception trying to start: %s" % e, + context='IPA', + traceback=True) + syslog.syslog(syslog.LOG_ERR, "Exception trying to start: %s" % e) diff --git a/smartproxy/ipa-smartproxy.conf b/smartproxy/ipa-smartproxy.conf new file mode 100644 index 00000000..a5f81433 --- /dev/null +++ b/smartproxy/ipa-smartproxy.conf @@ -0,0 +1,15 @@ +[global] +server.socket_port: 8090 +#server.socket_host: 'server.example.com' + +log.access_file: '/var/log/ipa-smartproxy.access' +log.error_file: '/var/log/ipa-smartproxy.errors' + +request.show_tracebacks: False + +# Only handle requests on 127.0.0.1 or ::1 +local_only: True + +use_gssproxy: True + +user: 'apache' diff --git a/smartproxy/ipa-smartproxy.logrotate b/smartproxy/ipa-smartproxy.logrotate new file mode 100644 index 00000000..12e25164 --- /dev/null +++ b/smartproxy/ipa-smartproxy.logrotate @@ -0,0 +1,11 @@ +/var/log/ipa-smartproxy.access /var/log/ipa-smartproxy.errors { + weekly + missingok + notifempty + sharedscripts + rotate 52 + compress + postrotate + /bin/systemctl reload ipa-smartproxy.service > /dev/null 2>/dev/null || true + endscript +} diff --git a/smartproxy/ipa-smartproxy.service b/smartproxy/ipa-smartproxy.service new file mode 100644 index 00000000..544f55b1 --- /dev/null +++ b/smartproxy/ipa-smartproxy.service @@ -0,0 +1,12 @@ +[Unit] +Description=IPA smartproxy for Foreman +After=ipa.target + +[Service] +ExecStart=/usr/sbin/ipa-smartproxy -c /etc/ipa/ipa-smartproxy.conf -d -p /var/run/ipa-smartproxy.pid +ExecReload=/bin/kill -USR1 $MAINPID +Type=forking +PIDFile=/var/run/ipa-smartproxy.pid + +[Install] +WantedBy=multi-user.target diff --git a/smartproxy/man/Makefile.am b/smartproxy/man/Makefile.am new file mode 100644 index 00000000..6626b3cb --- /dev/null +++ b/smartproxy/man/Makefile.am @@ -0,0 +1,19 @@ +# This file will be processed with automake-1.7 to create Makefile.in + +AUTOMAKE_OPTIONS = 1.7 + +NULL = + +man1_MANS = \ + ipa-smartproxy.1 + +man5_MANS = \ + ipa-smartproxy.conf.5 + +install-data-hook: + @for i in $(man1_MANS) ; do gzip -f $(DESTDIR)$(man1dir)/$$i ; done + @for i in $(man5_MANS) ; do gzip -f $(DESTDIR)$(man5dir)/$$i ; done + +MAINTAINERCLEANFILES = \ + Makefile.in \ + $(NULL) diff --git a/smartproxy/man/ipa-smartproxy.1 b/smartproxy/man/ipa-smartproxy.1 new file mode 100644 index 00000000..beebeb21 --- /dev/null +++ b/smartproxy/man/ipa-smartproxy.1 @@ -0,0 +1,78 @@ +.\" A man page for ipa-smartproxy +.\" Copyright (C) 2014 Red Hat, Inc. +.\" +.\" This program is free software; you can redistribute it and/or modify +.\" it under the terms of the GNU General Public License as published by +.\" the Free Software Foundation, either version 3 of the License, or +.\" (at your option) any later version. +.\" +.\" This program is distributed in the hope that it will be useful, but +.\" WITHOUT ANY WARRANTY; without even the implied warranty of +.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +.\" General Public License for more details. +.\" +.\" You should have received a copy of the GNU General Public License +.\" along with this program. If not, see <http://www.gnu.org/licenses/>. +.\" +.\" Author: Rob Crittenden <rcritten@redhat.com> +.TH "ipa-smartproxy" "1" "Jan 8 2014" "FreeIPA" "FreeIPA Manual Pages" +.SH "NAME" +ipa\-smartproxy \- IPA Foreman Smartproxy server +.SH "SYNOPSIS" +ipa\-smartproxy [\fIOPTION\fR]... +.SH "DESCRIPTION" +A CherryPy\-based server that provides a RESTful API for a use as a Foreman smart proxy. + +The RESTful interface is not authenticated so it is expected that the server is not generally accessible. By default it listens only on the localhost interface. + +The server needs access to an principal that is granted permission to perform host and hostgroup operations on an IPA master. + +Smartproxy server\-specific privileges and roles can be created with this: + +.na + $ ipa privilege\-add 'Smartproxy host management' \-\-desc='Smartproxy host management' + $ ipa privilege\-add\-permission 'Smartproxy host management' \-\-permission='add hosts' \-\-permission='remove hosts' + $ ipa role\-add 'Smartproxy management' \-\-desc='Smartproxy management' + $ ipa role\-add\-privilege 'Smartproxy management' \-\-privilege='Smartproxy host management' \-\-privilege='Host Group Administrators' + +Create a host or user whose credentials will be used by the server to make requests and add it to the role: + + $ ipa user\-add \-\-first=Smartproxy \-\-last=Serversmartproxy + $ ipa role\-add\-member \-\-users=smartproxy 'Smartproxy management' + +On the smartproxy server create a keytab for this user: + + # kinit admin + # ipa\-getkeytab \-s ipa.example.com \-p smartproxy@EXAMPLE.COM \-k /etc/ipa/ipa\-smartproxy.keytab + # chown root:root /etc/ipa/ipa\-smartproxy.keytab + # chmod 600 /etc/ipa/ipa\-smartproxy.keytab + +Configure the GSS\-Proxy to manage the credentials. Add this to the top of the gssproxy configuration file (by default /etc/gssproxy/gssproxy.conf), before any other services: + + [service/smartproxy] + mechs = krb5 + cred_store = client_keytab:/etc/ipa/ipa\-smartproxy.keytab + cred_store = ccache:/var/lib/gssproxy/clients/krb5cc_%U + cred_usage = initiate + euid = 48 (where 48 is the apache user uid) + +Some startup and operational errors may also be logged to the syslog. +.SH "OPTIONS" +.TP +\fB\-c\fR \fICONFIG\fR +The configuration file(s) to be loaded. This option may be passed multiple times to load more than one configuration file. +.TP +\fB\-d\fR +Run the server as a daemon. +.TP +\fB\-p\fR \fIPIDFILE\fR +The location to write the server PID file. +.TP +\fB\-h\fR +Show the help message. +.SH "EXIT STATUS" +0 if the server execution was successful + +1 if an error occurred +.SH "SEE ALSO" +.BR ipa\-smartproxy.conf(5) diff --git a/smartproxy/man/ipa-smartproxy.conf.5 b/smartproxy/man/ipa-smartproxy.conf.5 new file mode 100644 index 00000000..ad877523 --- /dev/null +++ b/smartproxy/man/ipa-smartproxy.conf.5 @@ -0,0 +1,72 @@ +.\" A man page for ipa-smartproxy.conf +.\" Copyright (C) 2014 Red Hat, Inc. +.\" +.\" This program is free software; you can redistribute it and/or modify +.\" it under the terms of the GNU General Public License as published by +.\" the Free Software Foundation, either version 3 of the License, or +.\" (at your option) any later version. +.\" +.\" This program is distributed in the hope that it will be useful, but +.\" WITHOUT ANY WARRANTY; without even the implied warranty of +.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +.\" General Public License for more details. +.\" +.\" You should have received a copy of the GNU General Public License +.\" along with this program. If not, see <http://www.gnu.org/licenses/>. +.\" +.\" Author: Rob Crittenden <rcritten@@redhat.com> +.\" +.TH "ipa-smartproxy.conf" "5" "Jan 8 2014" "FreeIPA" "FreeIPA Manual Pages" +.SH "NAME" +ipa\-smartproxy.conf \- IPA Smartproxy server configuration file +.SH "SYNOPSIS" +/etc/ipa/ipa\-smartproxy.conf +.SH "DESCRIPTION" +The \fIipa\-smartproxy.conf \fRconfiguration file is used to set system\-wide defaults to be applied when running the IPA Foreman Smartproxy server. +.SH "SYNTAX" +The configuration options are not case sensitive. The values may be case sensitive, depending on the option. + +Blank lines are ignored. + +Lines beginning with # are comments and are ignored. + +Valid lines consist of an option name, an equals sign and a value. Spaces surrounding equals sign are ignored. An option terminates at the end of a line. + +The value is a Python object so needs to adhere to Python rules. If the value should be an integer then it needs to be passed as an integer (like port). If the value is a string then it must be quoted. + +Options must appear in the section named [global]. There are no other sections defined or used currently. + +Options may be defined that are not used by the IPA Foreman Smartproxy server. Be careful of misspellings, they will not be rejected. +.SH "OPTIONS" +The server runs using the CherryPy so all the CherryPy configuration options are valid. Here are some common ones. + +.TP +.B server.socket_port\fR <port> +Port for the server to listen on. The default port is 8090. +.TP +.B server.socket_host\fR <host> +If not specified then the server will listen on localhost. This is the expected mode. Specifiy a hostname or IP address to listen on another address. See also the .B local_only\fR option if setting this to something other than a local address. +.TP +.B log.access_file\fR <path> +Path to the server access log +.TP +.B log.error_file\fR <path> +Path to the server error log +.TP +.B request.show_tracebacks\fR <boolean> +Display tracebacks to the client when errors occur. Errors will always log on the server side. The default is False. +.TP +.B local_only\fR <boolean> +If True then requires that all requests be local. It is not recommended that this be enabled because this server accepts unathenticated requests to manage IPA entries. +.TP +.B use_gssproxy\fR <boolean> +When True uses the gss\-proxy service to manage the Kerberos credentials needed to make IPA requests. If False then the user must ensure that the process has the right Kerberos credentials to make IPA requests. +.TP +.B user\fR <user> +The user to run the server as. Required. +.SH "FILES" +.TP +.I /etc/ipa/ipa\-smartproxy.conf +IPA Foreman Smartproxy server configuration file +.SH "SEE ALSO" +.BR ipa\-smartproxy (1) |