summaryrefslogtreecommitdiffstats
path: root/install/tools
Commit message (Collapse)AuthorAgeFilesLines
* scripts, tests: explicitly set confdir in the rest of server codeJan Cholasta2017-02-223-3/+11
| | | | | | | | | | | Commit 1e6a204b4372bbbfb722a00370a5ce4e34406b9f added explicit confdir setting to api.bootstrap() calls of a randomly selected portion of server-side scripts and tests. This commit adds it to the rest of server-side code for consistency. https://fedorahosted.org/freeipa/ticket/6389 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Move AD trust installation code to a separate moduleMartin Babinsky2017-02-171-342/+7
| | | | | | | | | | | | This facilitates calling the necessary checks and configuration code as a module from e.g. a composite installer. The code that checks for the admin credentials stays in the standalone installer as the code inside the adtrust module is expected to operate also without admin credentials. https://fedorahosted.org/freeipa/ticket/6629 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add password to certutil calls in NSSDatabaseStanislav Laznicka2017-02-171-8/+1
| | | | | | | | | | NSSDatabases should call certutil with a password. Also, removed `password_filename` argument from `.create_db()`. https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Update man page of ipa-server-installAbhijeet Kasurde2017-02-171-2/+5
| | | | | | | | | | This fix adds information about --ignore-last-of-role in ipa-server-install man page Fixes https://fedorahosted.org/freeipa/ticket/6634 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Separate RA cert store from the HTTP cert storeSimo Sorce2017-02-152-5/+5
| | | | | | | | | | | | | | | This is in preparation for separating out the user under which the ipa api framework runs as. This commit also removes certs.NSS_DIR to avoid confusion and replaces it where appropriate with the correct NSS DB directory, either the old HTTPD_ALIAS_DIR ot the RA DB IPA_RADB_DIR. In some cases its use is removed altogether as it was simply not necessary. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove is_fips_enabled checks in installers and ipactlStanislav Laznicka2017-02-131-3/+0
| | | | | | https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Replace exit() calls with exceptionsMartin Babinsky2017-02-091-13/+17
| | | | | | | | | | | In order to enable correct handling of hard errors from within the composite installer code, all calls to `sys.exit` have to be replaced with raising ScriptError. https://fedorahosted.org/freeipa/ticket/6629 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove unused variables in exception handlingMartin Babinsky2017-02-091-2/+2
| | | | | | | https://fedorahosted.org/freeipa/ticket/6629 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-adtrust-install: format the code for PEP-8 complianceMartin Babinsky2017-02-091-81/+144
| | | | | | | https://fedorahosted.org/freeipa/ticket/6629 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-ca-install: do not fail without --subject-base and --ca-subjectJan Cholasta2017-01-311-3/+4
| | | | | | | | | | | | | | When --subject-base and --ca-subject are not specified in ipa-ca-install, default values are used. DN objects are used as the default values in ipa-ca-install, but the CA installer expects the values to be strings. This causes ipa-ca-install to fail unless both --subject-base and --ca-subject are specified. Convert the DN objects to strings to fix the issue. https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Remove deprecated ipa-upgradeconfig commandAbhijeet Kasurde2017-01-244-70/+0
| | | | | | | Fixes https://fedorahosted.org/freeipa/ticket/6620 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add sanity checks for use of --ca-subject and --subject-baseFraser Tweedale2017-01-111-0/+5
| | | | | | | | | | Print an error and terminate if --ca-subject or --subject-base are used when installing a CA-less master or when performing standalone installation of a CA replica. Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Indicate that ca subject / subject base uses LDAP RDN orderFraser Tweedale2017-01-113-6/+8
| | | | | | | | Update man pages and help output to indicate that --subject-base and --ca-subject options interpret their arguments in LDAP order. Fixes: https://fedorahosted.org/freeipa/ticket/6455 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Allow full customisability of IPA CA subject DNFraser Tweedale2017-01-113-1/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | Currently only the "subject base" of the IPA CA subject DN can be customised, via the installer's --subject-base option. The RDN "CN=Certificate Authority" is appended to form the subject DN, and this composition is widely assumed. Some administrators need more control over the CA subject DN, especially to satisfy expectations of external CAs when the IPA CA is to be externally signed. This patch adds full customisability of the CA subject DN. Specifically: - Add the --ca-subject option for specifying the full IPA CA subject DN. Defaults to "CN=Certificate Authority, O=$SUBJECT_BASE". - ipa-ca-install, when installing a CA in a previous CA-less topology, updates DS certmap.conf with the new new CA subject DN. - DsInstance.find_subject_base no longer looks in certmap.conf, because the CA subject DN can be unrelated to the subject base. Fixes: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-ca-install: add missing --subject-base optionFraser Tweedale2017-01-111-4/+8
| | | | | | Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* installer: rename --subject to --subject-baseFraser Tweedale2017-01-112-4/+4
| | | | | | | | | | | | The --subject option is actually used to provide the "subject base". We are also going to add an option for fully specifying the IPA CA subject DN in a subsequent commit. So to avoid confusion, rename --subject to --subject-base, retaining --subject as a deprecated alias. Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Clarify meaning of --domain and --realm in installersStanislav Laznicka2017-01-053-58/+48
| | | | | | | | Man pages need bigger overhaul. Take this as hot-fix for FAQ. https://fedorahosted.org/freeipa/ticket/6574 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Enumerate available options in IPA installerAbhijeet Kasurde2017-01-031-3/+6
| | | | | | | | | | Fix adds enumerated list of available options in IPA server installer and IPA CA installer help options Fixes https://fedorahosted.org/freeipa/ticket/5435 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipactl: pass api as argument to servicesMartin Basti2016-12-121-7/+7
| | | | | | | Commit 6409abf1 removes hard dependency of ipalib in ipalatform to avoid cyclic dependenies, this commit updates ipactl accordingly Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: check for open ports on all resolved IPsTomas Krizek2016-12-071-2/+3
| | | | | | | | | | When a hostname is provided to host_port_open, it should check if ports are open for ALL IPs that are resolved from the hostname, instead of checking whether the port is reachable on at least one of the IPs. https://fedorahosted.org/freeipa/ticket/6522 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* replica-conncheck: improve message loggingTomas Krizek2016-12-061-47/+51
| | | | | | | | | | Make sure all messages displayed on screen to the user can be found in the log as well. The messages are also logged if the script is ran in quiet mode. https://fedorahosted.org/freeipa/ticket/6497 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipa-replica-conncheck: fix race conditionTomas Krizek2016-12-061-6/+11
| | | | | | | | | | When the thread that opens ports would execute notify() before the original thread could call wait(), the original thread would wait indefinitely for a notify() call. https://fedorahosted.org/freeipa/ticket/6487 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Set explicit confdir option for global contextsChristian Heimes2016-12-029-17/+30
| | | | | | | | | | | | | | | | | | | | | | | | | Some API contexts are used to modify global state (e.g. files in /etc and /var). These contexts do not support confdir overrides. Initialize the API with an explicit confdir argument to paths.ETC_IPA. The special contexts are: * backup * cli_installer * installer * ipctl * renew * restore * server * updates The patch also corrects the context of the ipa-httpd-kdcproxy script to 'server'. https://fedorahosted.org/freeipa/ticket/6389 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-replica-conncheck: do not close listening ports until requiredTomas Krizek2016-12-011-38/+113
| | | | | | | | | | | | | | | | | | | Previously, a separate thread would be created for each socket used for conncheck. It would also time out after one second, after which it would be closed and reopened again. This caused random failures of conncheck. Now all sockets are handled in a single thread and once the server starts to listen on a port, it does not close that connection until the script finishes. Only IPv6 socket is used for simplicity, since it can handle both IPv6 and IPv4 connections. This requires IPv6 kernel support, which is required by other parts of IPA anyway. https://fedorahosted.org/freeipa/ticket/6487 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* ipaclient: move install modules to the install subpackageJan Cholasta2016-11-292-3/+3
| | | | | | | | | | | | The ipa_certupdate, ipachangeconf, ipadiscovery and ntpconf modules depend on ipaplatform. Move them to ipaclient.install as they are used only from the client installer. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* constants: remove CACERTJan Cholasta2016-11-292-12/+11
| | | | | | | | | | CACERT depends on ipaplatform. Replace all uses of CACERT with paths.IPA_CA_CRT and remove CACERT. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: move kinit functions to ipalib.installJan Cholasta2016-11-291-1/+3
| | | | | | | | | | | kinit_password() depends on ipaplatform. Move kinit_password() as well as kinit_keytab() to a new ipalib.install.kinit module, as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: move is_fips_enabled() to ipaplatform.tasksJan Cholasta2016-11-291-3/+2
| | | | | | | | The FIPS setting is platform-specific. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: remove get_domain_name()Jan Cholasta2016-11-292-4/+0
| | | | | | | | | | | get_domain_name() and related code depends on ipaplatform. Replace all uses of get_domain_name() with api.env.domain and remove get_domain_name() and all of the related code. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipapython: move certmonger and sysrestore to ipalib.installJan Cholasta2016-11-291-1/+2
| | | | | | | | | | The certmonger and sysrestore modules depend on ipaplatform. Move them to ipalib.install as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipapython: move dnssec, p11helper and secrets to ipaserverJan Cholasta2016-11-291-1/+1
| | | | | | | | | | | The dnssec and secrets subpackages and the p11helper module depend on ipaplatform. Move them to ipaserver as they are used only on the server. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Python3 pylint fixesChristian Heimes2016-11-257-6/+8
| | | | | | | | | | | Sprinkle 'pylint disable' comments over the code base to silence a bunch of pylint warnings on Python 3. All silenced warnings are harmless and not bugs. https://fedorahosted.org/freeipa/ticket/4985 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* services: replace admin_conn with api.Backend.ldap2Tomas Krizek2016-11-221-3/+3
| | | | | | | | | Since service.admin_conn is only an alias to api.Backend.ldap2, replace it everywhere with the explicit api.Backend.ldap2 instead. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Build: remove incorrect use of MAINTAINERCLEANFILESPetr Spacek2016-11-162-8/+0
| | | | | | | | | | | | | Automake manual section 13 What Gets Cleaned says that make maintainer-clean should not remove files necessary for subsequent runs of ./configure. It practically means that all usage of MAINTAINERCLEANFILES were incorrect so I've removed them. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Update man page for ipa-adtrust-install by removing --no-msdcs optionPetr Spacek2016-11-141-27/+0
| | | | | | | https://fedorahosted.org/freeipa/ticket/6480 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* dns: check if container exists using ldapiTomas Krizek2016-11-112-4/+2
| | | | | | | | | | | Previously an adhoc connection was established for checking if dns(sec) container exists. A simple or external bind was used. Instead, always connect with ldapi through api.Backend.ldap2. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: migrate server installers to the new class hierarchyJan Cholasta2016-11-112-27/+4
| | | | | | | | | Migrate ipa-server-install and ipa-replica-install from the old installer classes to the new installer class hierarchy classes. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: improve CLI positional argument handlingJan Cholasta2016-11-111-2/+0
| | | | | | | | | | | | | Instead of specifying which knobs should be positional arguments in cli.install_tool(), do it using a flag in knob definition, where the rest of CLI configuration is. As a side effect, the usage string for CLI tools can now be generated automatically. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Move httpd restart to DNS installationStanislav Laznicka2016-11-111-10/+1
| | | | | | | | | | | | Web service needs restarting after bindinstance is created to pick up changes done to /etc/resolv.conf. This change should be included anytime DNS is installed therefore it makes sense to move it to the common code. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* install: merge all CA install code paths into oneJan Cholasta2016-11-111-23/+3
| | | | | | | | | Merge CA install code paths use in ipa-server-install, ipa-replica-install in either domain level and ipa-ca-install into one. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* replica install: use one remote CA host name everywhereJan Cholasta2016-11-111-5/+3
| | | | | | | | | Remote master and CA host names may differ. Always use the remote CA host name and never the remote master host name in CA replica install. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipaldap: remove do_bind from LDAPClientTomas Krizek2016-11-101-1/+1
| | | | | | | | | Remove do_bind() method that was a relict used in IPAdmin. Replace its uses with simple / external binds. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com>
* x509: use python-cryptography to process certsFraser Tweedale2016-11-101-9/+6
| | | | | | | | | | | | | | | | | Update x509.load_certificate and related functions to return python-cryptography ``Certificate`` objects. Update the call sites accordingly, including removal of NSS initialisation code. Also update GeneralName parsing code to return python-cryptography GeneralName values, for consistency with other code that processes GeneralNames. The new function, `get_san_general_names`, and associated helper functions, can be removed when python-cryptography provides a way to deal with unrecognised critical extensions. Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Build: do not compress manual pages at install timePetr Spacek2016-11-091-4/+0
| | | | | | | | | | | | | | | | | | | At the time of this writting https://fedoraproject.org/wiki/Packaging:Guidelines#Manpages says this: When installing man pages, note that they should be installed uncompressed as the build system will compress them as needed. The compression method may change, so it is important to reference the pages in the %files section with a pattern that takes this into account: %{_mandir}/man1/foo.1* Removing the compression also allows to remove several install-data-hook targets from Makefile.am files. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix distribution of libexec scriptsPetr Spacek2016-11-091-6/+2
| | | | | | | | | | Scripts ipa-httpd-kdcproxy and ipa-pki-retrieve-key were missing from tarball. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: fix man page distributionPetr Spacek2016-11-091-2/+2
| | | | | | | | | | By default automake does not distribute man pages. This marks then with dist_ prefix to force their distribution in tarball. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: remove non-existing README files from Makefile.amPetr Spacek2016-11-091-1/+0
| | | | | | | | | | | Some Makefile.am files were apparently created by copy-pasting other files. As a result, some Makefiles require non-existing README files. Remove this to fix dist target. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* install tools: ldap conn managementTomas Krizek2016-11-077-219/+159
| | | | | | | | | | | | | | | | | | | | | | | | | | | * ipca-ca-install: Use a single ldap connection for the entire script. Connecting with ccache in promote is not needed. * ipa-cacert-manage: Always connect to ldap, since renew and install are the only options and renew seems to need ldap connection even for self signed certificates. * ipa-compat-manage: Use one ldap connection for the entire script. Replaced try-finally with proper disconnect, code block reindented. * ipa-csreplica-manage: Properly establish and close the ldap connection. * ipa-dns-install: Proper connect, disconnect to ldap. * ipa-kra-install: Proper connect/disconnect for install and uninstall. * ipa-ldap-update: Proper connect and disconnect to ldap. * ipa-nis-manage: Proper connect/disconnect for ldap. Try-finally removed and code block reindented. * ipa-replica-manage: Proper connect/disconnect to ldap. * ipa-replica-prepare: Connect added to validate_options(), where api is initialized and disconnected added at the end of run. Reconnect in ask_for_options() to validate directory manager password. * ipa-server-certinstall: Use api.Backend.ldap2 for ldap connections. * ipa-server-upgrade: Connect to and disconnect from api.Backend.ldap2. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-adtrust-install: ldap conn managementTomas Krizek2016-11-071-0/+2
| | | | | | | | | Properly close ldap connection. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* cainstall: add dm_password to CA installationTomas Krizek2016-11-071-0/+1
| | | | | | | | | | | Installation of Certificate Server replica requires directory manager password. Specify it explicitly in function call and pass it in through an argument. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-29 05:55:35 +0000