From cf595511ff9e55b5f10a3273575980d6bb39d67a Mon Sep 17 00:00:00 2001 From: Karl MacMillan Date: Wed, 12 Dec 2007 18:06:39 -0500 Subject: Move radius server components into a separate package. --- ipa-radius-server/plugins/radiusinstance.py | 173 ++++++++++++++++++++++++++++ 1 file changed, 173 insertions(+) create mode 100644 ipa-radius-server/plugins/radiusinstance.py (limited to 'ipa-radius-server/plugins/radiusinstance.py') diff --git a/ipa-radius-server/plugins/radiusinstance.py b/ipa-radius-server/plugins/radiusinstance.py new file mode 100644 index 00000000..743a1d8a --- /dev/null +++ b/ipa-radius-server/plugins/radiusinstance.py @@ -0,0 +1,173 @@ +#! /usr/bin/python -E +# Authors: John Dennis +# +# Copyright (C) 2007 Red Hat +# see file 'COPYING' for use and warranty information +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation; version 2 or later +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# + +import sys +sys.path.append("/usr/share/ipa") + +import subprocess +import string +import tempfile +import shutil +import logging +import pwd +import time +import sys +from ipa.ipautil import * +from ipa import radius_util + +from ipaserver import service + +import os +import re + +IPA_RADIUS_VERSION = '0.0.0' + +# FIXME there should a utility to get the user base dn +from ipaserver.funcs import DefaultUserContainer, DefaultGroupContainer + +#------------------------------------------------------------------------------- + +def ldap_mod(fd, dn, pwd): + args = ["/usr/bin/ldapmodify", "-h", "127.0.0.1", "-xv", "-D", dn, "-w", pwd, "-f", fd.name] + run(args) + +def get_radius_version(): + version = None + try: + p = subprocess.Popen([radius_util.RADIUSD, '-v'], stdout=subprocess.PIPE, + stderr=subprocess.PIPE) + stdout, stderr = p.communicate() + status = p.returncode + + if status == 0: + match = re.search("radiusd: FreeRADIUS Version (.+), for host", stdout) + if match: + version = match.group(1) + except Exception, e: + pass + return version + + +#------------------------------------------------------------------------------- + +class RadiusInstance(service.Service): + def __init__(self): + service.Service.__init__(self, "radiusd") + self.fqdn = None + self.realm = None + self.principal = None + + def create_instance(self, realm_name, host_name, ldap_server): + self.realm = realm_name.upper() + self.suffix = realm_to_suffix(self.realm) + self.fqdn = host_name + self.ldap_server = ldap_server + self.principal = "%s/%s@%s" % (radius_util.RADIUS_SERVICE_NAME, self.fqdn, self.realm) + self.basedn = self.suffix + self.user_basedn = "%s,%s" % (DefaultUserContainer, self.basedn) # FIXME, should be utility to get this + self.radius_version = get_radius_version() + self.start_creation(4, "Configuring radiusd") + + try: + self.stop() + except: + # It could have been not running + pass + + self.__create_radius_keytab() + self.__radiusd_conf() + + try: + self.step("starting radiusd") + self.start() + except: + logging.error("radiusd service failed to start") + + self.step("configuring radiusd to start on boot") + self.chkconfig_on() + + + def __radiusd_conf(self): + self.step('configuring radiusd.conf for radius instance') + + version = 'IPA_RADIUS_VERSION=%s FREE_RADIUS_VERSION=%s' % (IPA_RADIUS_VERSION, self.radius_version) + sub_dict = {'CONFIG_FILE_VERSION_INFO' : version, + 'LDAP_SERVER' : self.ldap_server, + 'RADIUS_KEYTAB' : radius_util.RADIUS_IPA_KEYTAB_FILEPATH, + 'RADIUS_PRINCIPAL' : self.principal, + 'RADIUS_USER_BASE_DN' : self.user_basedn, + 'ACCESS_ATTRIBUTE' : '', + 'ACCESS_ATTRIBUTE_DEFAULT' : 'TRUE', + 'CLIENTS_BASEDN' : radius_util.radius_clients_basedn(None, self.suffix), + 'SUFFIX' : self.suffix, + } + try: + radiusd_conf = template_file(radius_util.RADIUSD_CONF_TEMPLATE_FILEPATH, sub_dict) + radiusd_fd = open(radius_util.RADIUSD_CONF_FILEPATH, 'w+') + radiusd_fd.write(radiusd_conf) + radiusd_fd.close() + except Exception, e: + logging.error("could not create %s: %s", radius_util.RADIUSD_CONF_FILEPATH, e) + + def __create_radius_keytab(self): + self.step("creating a keytab for radiusd") + try: + if file_exists(radius_util.RADIUS_IPA_KEYTAB_FILEPATH): + os.remove(radius_util.RADIUS_IPA_KEYTAB_FILEPATH) + except os.error: + logging.error("Failed to remove %s", radius_util.RADIUS_IPA_KEYTAB_FILEPATH) + + (kwrite, kread, kerr) = os.popen3("/usr/kerberos/sbin/kadmin.local") + kwrite.write("addprinc -randkey %s\n" % (self.principal)) + kwrite.flush() + kwrite.write("ktadd -k %s %s\n" % (radius_util.RADIUS_IPA_KEYTAB_FILEPATH, self.principal)) + kwrite.flush() + kwrite.close() + kread.close() + kerr.close() + + # give kadmin time to actually write the file before we go on + retry = 0 + while not file_exists(radius_util.RADIUS_IPA_KEYTAB_FILEPATH): + time.sleep(1) + retry += 1 + if retry > 15: + print "Error timed out waiting for kadmin to finish operations\n" + sys.exit(1) + try: + pent = pwd.getpwnam(radius_util.RADIUS_USER) + os.chown(radius_util.RADIUS_IPA_KEYTAB_FILEPATH, pent.pw_uid, pent.pw_gid) + except Exception, e: + logging.error("could not chown on %s to %s: %s", radius_util.RADIUS_IPA_KEYTAB_FILEPATH, radius_util.RADIUS_USER, e) + + #FIXME, should use IPAdmin method + def __set_ldap_encrypted_attributes(self): + ldif_file = 'encrypted_attribute.ldif' + self.step("setting ldap encrypted attributes") + ldif_txt = template_file(SHARE_DIR + ldif_file, {'ENCRYPTED_ATTRIBUTE':'radiusClientSecret'}) + ldif_fd = write_tmp_file(ldif_txt) + try: + ldap_mod(ldif_fd, "cn=Directory Manager", self.dm_password) + except subprocess.CalledProcessError, e: + logging.critical("Failed to load %s: %s" % (ldif_file, str(e))) + ldif_fd.close() + +#------------------------------------------------------------------------------- + -- cgit From 2a036abe7a601bbc8e65bbe4ab7c489b81db0eb5 Mon Sep 17 00:00:00 2001 From: Mark McLoughlin Date: Thu, 13 Dec 2007 09:31:28 +0000 Subject: More ipautil fixing Recently, dsinstance and krbinstance was fixed to not import * from ipautil; do the same for the rest of ipaserver. Signed-off-by: Mark McLoughlin --- ipa-radius-server/plugins/radiusinstance.py | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) (limited to 'ipa-radius-server/plugins/radiusinstance.py') diff --git a/ipa-radius-server/plugins/radiusinstance.py b/ipa-radius-server/plugins/radiusinstance.py index 743a1d8a..a330621d 100644 --- a/ipa-radius-server/plugins/radiusinstance.py +++ b/ipa-radius-server/plugins/radiusinstance.py @@ -29,7 +29,7 @@ import logging import pwd import time import sys -from ipa.ipautil import * +from ipa import ipautil from ipa import radius_util from ipaserver import service @@ -46,7 +46,7 @@ from ipaserver.funcs import DefaultUserContainer, DefaultGroupContainer def ldap_mod(fd, dn, pwd): args = ["/usr/bin/ldapmodify", "-h", "127.0.0.1", "-xv", "-D", dn, "-w", pwd, "-f", fd.name] - run(args) + ipautil.run(args) def get_radius_version(): version = None @@ -76,7 +76,7 @@ class RadiusInstance(service.Service): def create_instance(self, realm_name, host_name, ldap_server): self.realm = realm_name.upper() - self.suffix = realm_to_suffix(self.realm) + self.suffix = ipautil.realm_to_suffix(self.realm) self.fqdn = host_name self.ldap_server = ldap_server self.principal = "%s/%s@%s" % (radius_util.RADIUS_SERVICE_NAME, self.fqdn, self.realm) @@ -119,7 +119,7 @@ class RadiusInstance(service.Service): 'SUFFIX' : self.suffix, } try: - radiusd_conf = template_file(radius_util.RADIUSD_CONF_TEMPLATE_FILEPATH, sub_dict) + radiusd_conf = ipautil.template_file(radius_util.RADIUSD_CONF_TEMPLATE_FILEPATH, sub_dict) radiusd_fd = open(radius_util.RADIUSD_CONF_FILEPATH, 'w+') radiusd_fd.write(radiusd_conf) radiusd_fd.close() @@ -129,7 +129,7 @@ class RadiusInstance(service.Service): def __create_radius_keytab(self): self.step("creating a keytab for radiusd") try: - if file_exists(radius_util.RADIUS_IPA_KEYTAB_FILEPATH): + if ipautil.file_exists(radius_util.RADIUS_IPA_KEYTAB_FILEPATH): os.remove(radius_util.RADIUS_IPA_KEYTAB_FILEPATH) except os.error: logging.error("Failed to remove %s", radius_util.RADIUS_IPA_KEYTAB_FILEPATH) @@ -145,7 +145,7 @@ class RadiusInstance(service.Service): # give kadmin time to actually write the file before we go on retry = 0 - while not file_exists(radius_util.RADIUS_IPA_KEYTAB_FILEPATH): + while not ipautil.file_exists(radius_util.RADIUS_IPA_KEYTAB_FILEPATH): time.sleep(1) retry += 1 if retry > 15: @@ -161,11 +161,11 @@ class RadiusInstance(service.Service): def __set_ldap_encrypted_attributes(self): ldif_file = 'encrypted_attribute.ldif' self.step("setting ldap encrypted attributes") - ldif_txt = template_file(SHARE_DIR + ldif_file, {'ENCRYPTED_ATTRIBUTE':'radiusClientSecret'}) - ldif_fd = write_tmp_file(ldif_txt) + ldif_txt = ipautil.template_file(ipautil.SHARE_DIR + ldif_file, {'ENCRYPTED_ATTRIBUTE':'radiusClientSecret'}) + ldif_fd = ipautil.write_tmp_file(ldif_txt) try: ldap_mod(ldif_fd, "cn=Directory Manager", self.dm_password) - except subprocess.CalledProcessError, e: + except ipautil.CalledProcessError, e: logging.critical("Failed to load %s: %s" % (ldif_file, str(e))) ldif_fd.close() -- cgit From 065827d6e135686c81194280cba442ca696cba9d Mon Sep 17 00:00:00 2001 From: Mark McLoughlin Date: Thu, 13 Dec 2007 09:31:28 +0000 Subject: Refactor dsinstance ldap modify code Just a patch to refactor lots of similar code in dsinstance and krbinstance using a simple helper method. Note, there are some differences: - Some code used to call ldapmodify without -h 127.0.0.1 - Some of the code used to just print an error rather than using logging.critical() - Some code used to log some extra debug Signed-off-by: Mark McLoughlin --- ipa-radius-server/plugins/radiusinstance.py | 31 +++++++++++++++++------------ 1 file changed, 18 insertions(+), 13 deletions(-) (limited to 'ipa-radius-server/plugins/radiusinstance.py') diff --git a/ipa-radius-server/plugins/radiusinstance.py b/ipa-radius-server/plugins/radiusinstance.py index a330621d..2d68adf7 100644 --- a/ipa-radius-server/plugins/radiusinstance.py +++ b/ipa-radius-server/plugins/radiusinstance.py @@ -44,10 +44,6 @@ from ipaserver.funcs import DefaultUserContainer, DefaultGroupContainer #------------------------------------------------------------------------------- -def ldap_mod(fd, dn, pwd): - args = ["/usr/bin/ldapmodify", "-h", "127.0.0.1", "-xv", "-D", dn, "-w", pwd, "-f", fd.name] - ipautil.run(args) - def get_radius_version(): version = None try: @@ -157,17 +153,26 @@ class RadiusInstance(service.Service): except Exception, e: logging.error("could not chown on %s to %s: %s", radius_util.RADIUS_IPA_KEYTAB_FILEPATH, radius_util.RADIUS_USER, e) - #FIXME, should use IPAdmin method - def __set_ldap_encrypted_attributes(self): - ldif_file = 'encrypted_attribute.ldif' - self.step("setting ldap encrypted attributes") - ldif_txt = ipautil.template_file(ipautil.SHARE_DIR + ldif_file, {'ENCRYPTED_ATTRIBUTE':'radiusClientSecret'}) - ldif_fd = ipautil.write_tmp_file(ldif_txt) + def __ldap_mod(self, step, ldif): + self.step(step) + + txt = iputil.template_file(ipautil.SHARE_DIR + ldif, self.sub_dict) + fd = ipautil.write_tmp_file(txt) + + args = ["/usr/bin/ldapmodify", "-h", "127.0.0.1", "-xv", + "-D", "cn=Directory Manager", "-w", self.dm_password, "-f", fd.name] + try: - ldap_mod(ldif_fd, "cn=Directory Manager", self.dm_password) + ipautil.run(args) except ipautil.CalledProcessError, e: - logging.critical("Failed to load %s: %s" % (ldif_file, str(e))) - ldif_fd.close() + logging.critical("Failed to load %s: %s" % (ldif, str(e))) + + fd.close() + + #FIXME, should use IPAdmin method + def __set_ldap_encrypted_attributes(self): + self.__ldap_mod("setting ldap encrypted attributes", + "encrypted_attribute.ldif", {"ENCRYPTED_ATTRIBUTE" : "radiusClientSecret"}) #------------------------------------------------------------------------------- -- cgit From 6976f92862c1dba3f7a25baa1893c41a67590b23 Mon Sep 17 00:00:00 2001 From: Mark McLoughlin Date: Thu, 13 Dec 2007 09:31:28 +0000 Subject: Refactor krbinstance and dsinstance creation steps Creation steps are currently done with: self.start_creation(2, "Create foo") self.step("do foo") self.foo() self.step("do bar") self.bar() self.done_creation() This patch refactors that into the much more straightforward: self.step("do foo", self.foo) self.step("do bar", self.bar) self.start_creation("Create foo") Signed-off-by: Mark McLoughlin --- ipa-radius-server/plugins/radiusinstance.py | 28 ++++++++++++---------------- 1 file changed, 12 insertions(+), 16 deletions(-) (limited to 'ipa-radius-server/plugins/radiusinstance.py') diff --git a/ipa-radius-server/plugins/radiusinstance.py b/ipa-radius-server/plugins/radiusinstance.py index 2d68adf7..731cd65a 100644 --- a/ipa-radius-server/plugins/radiusinstance.py +++ b/ipa-radius-server/plugins/radiusinstance.py @@ -79,7 +79,6 @@ class RadiusInstance(service.Service): self.basedn = self.suffix self.user_basedn = "%s,%s" % (DefaultUserContainer, self.basedn) # FIXME, should be utility to get this self.radius_version = get_radius_version() - self.start_creation(4, "Configuring radiusd") try: self.stop() @@ -87,22 +86,23 @@ class RadiusInstance(service.Service): # It could have been not running pass - self.__create_radius_keytab() - self.__radiusd_conf() + self.step("create radiusd keytab", self.__create_radius_keytab) + self.step("configuring radiusd.conf for radius instance", self.__radiusd_conf) + self.step("starting radiusd", self.__start_instance) + self.step("configuring radiusd to start on boot", self.chkconfig_on) + # FIXME: + # self.step("setting ldap encrypted attributes", self.__set_ldap_encrypted_attributes) + + self.start_creation("Configuring radiusd") + + def __start_instance(self): try: - self.step("starting radiusd") self.start() except: logging.error("radiusd service failed to start") - self.step("configuring radiusd to start on boot") - self.chkconfig_on() - - def __radiusd_conf(self): - self.step('configuring radiusd.conf for radius instance') - version = 'IPA_RADIUS_VERSION=%s FREE_RADIUS_VERSION=%s' % (IPA_RADIUS_VERSION, self.radius_version) sub_dict = {'CONFIG_FILE_VERSION_INFO' : version, 'LDAP_SERVER' : self.ldap_server, @@ -123,7 +123,6 @@ class RadiusInstance(service.Service): logging.error("could not create %s: %s", radius_util.RADIUSD_CONF_FILEPATH, e) def __create_radius_keytab(self): - self.step("creating a keytab for radiusd") try: if ipautil.file_exists(radius_util.RADIUS_IPA_KEYTAB_FILEPATH): os.remove(radius_util.RADIUS_IPA_KEYTAB_FILEPATH) @@ -153,9 +152,7 @@ class RadiusInstance(service.Service): except Exception, e: logging.error("could not chown on %s to %s: %s", radius_util.RADIUS_IPA_KEYTAB_FILEPATH, radius_util.RADIUS_USER, e) - def __ldap_mod(self, step, ldif): - self.step(step) - + def __ldap_mod(self, ldif): txt = iputil.template_file(ipautil.SHARE_DIR + ldif, self.sub_dict) fd = ipautil.write_tmp_file(txt) @@ -171,8 +168,7 @@ class RadiusInstance(service.Service): #FIXME, should use IPAdmin method def __set_ldap_encrypted_attributes(self): - self.__ldap_mod("setting ldap encrypted attributes", - "encrypted_attribute.ldif", {"ENCRYPTED_ATTRIBUTE" : "radiusClientSecret"}) + self.__ldap_mod("encrypted_attribute.ldif", {"ENCRYPTED_ATTRIBUTE" : "radiusClientSecret"}) #------------------------------------------------------------------------------- -- cgit