summaryrefslogtreecommitdiffstats
path: root/ipaserver/install/installutils.py
Commit message (Collapse)AuthorAgeFilesLines
* Add a new user to run the framework codeSimo Sorce2017-02-151-0/+13
| | | | | | | | | | | | | | | | | Add the apache user the ipawebui group. Make the ccaches directory owned by the ipawebui group and make mod_auth_gssapi write the ccache files as r/w by the apache user and the ipawebui group. Fix tmpfiles creation ownership and permissions to allow the user to access ccaches files. The webui framework now works as a separate user than apache, so the certs used to access the dogtag instance need to be usable by this new user as well. Both apache and the webui user are in the ipawebui group, so use that. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Simplify NSSDatabase password file handlingSimo Sorce2017-02-151-11/+6
| | | | | | | https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Change session handlingSimo Sorce2017-02-151-1/+1
| | | | | | | | | | | | | | | | Stop using memcache, use mod_auth_gssapi filesystem based ccaches. Remove custom session handling, use mod_auth_gssapi and mod_session to establish and keep a session cookie. Add loopback to mod_auth_gssapi to do form absed auth and pass back a valid session cookie. And now that we do not remove ccaches files to move them to the memcache, we can avoid the risk of pollutting the filesystem by keeping a common ccache file for all instances of the same user. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Delegate directive value quoting/unquoting to separate functionsMartin Babinsky2017-01-251-27/+43
| | | | | | | | | | | | | | | | | Separate functions were added to installutils module to quote/unquote a string in arbitrary characters. `installutils.get/set_directive` functions will use them to enclose the directive values in double quotes/strip the double quotes from retrieved values to maintain the original behavior. These functions can be used also for custom quoting/unquoting of retrieved values when desired. https://fedorahosted.org/freeipa/ticket/6460 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* installutils: improve directive value parsing in `get_directive`Martin Babinsky2017-01-251-2/+17
| | | | | | | | | | | | | `get_directive` value parsing was improved in order to bring its logic more in-line to changes in `set_directive`: a specified quoting character is now unquoted and stripped from the retrieved value. The function will now also error out when malformed directive is encountered. https://fedorahosted.org/freeipa/ticket/6460 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix the installutils.set_directive docstringMartin Babinsky2017-01-251-5/+8
| | | | | | | | | Add missing parameter descriptions and fix incorrect indentation https://fedorahosted.org/freeipa/ticket/6460 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Allow full customisability of IPA CA subject DNFraser Tweedale2017-01-111-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | Currently only the "subject base" of the IPA CA subject DN can be customised, via the installer's --subject-base option. The RDN "CN=Certificate Authority" is appended to form the subject DN, and this composition is widely assumed. Some administrators need more control over the CA subject DN, especially to satisfy expectations of external CAs when the IPA CA is to be externally signed. This patch adds full customisability of the CA subject DN. Specifically: - Add the --ca-subject option for specifying the full IPA CA subject DN. Defaults to "CN=Certificate Authority, O=$SUBJECT_BASE". - ipa-ca-install, when installing a CA in a previous CA-less topology, updates DS certmap.conf with the new new CA subject DN. - DsInstance.find_subject_base no longer looks in certmap.conf, because the CA subject DN can be unrelated to the subject base. Fixes: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Extract function for computing default subject baseFraser Tweedale2017-01-111-0/+4
| | | | | | Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* installutils: remove hardcoded subject DN assumptionFraser Tweedale2017-01-111-3/+4
| | | | | | | | | | | | `installutils.load_external_cert` assumes that the IPA CA subject DN is `CN=Certificate Authority, {subject_base}`. In preparation for full customisability of IPA CA subject DN, push this assumption out of this function to call sites (which will be updated in a subsequent commit). Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Make `kadmin` family of functions return the result of ipautil.runMartin Babinsky2016-12-161-5/+8
| | | | | | | | | | This allows for diagnose the output and error code of these operations. Otherwise there is no way to infer their success or failure apart from inspecting logs post-mortem. https://fedorahosted.org/freeipa/ticket/6561 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* Accept server host names resolvable only using /etc/hostsPetr Spacek2016-11-291-4/+3
| | | | | | | | | | | | | | | | | | | | | | | | | Apparently "files" implementation of hosts NSS database cannot deal with trailing period in host names. Previously name server.example.com which is was resolvable neither using dns nor myhostname NSS modules were rejected by installer (despite having matching line in /etc/hosts). These names which are resolvable purely using "files" database are now accepted. The problem is that I had to remove trailing period from names passed to getaddrinfo() function. This effectivelly enables search list processing. This means that items from the search list might be silently appended to the query and we might get an IP address for totally different names than we asked for. Unfortunatelly I see no way around this while keeping ability to use names from NSS hosts database. https://fedorahosted.org/freeipa/ticket/6518 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipautil: move file encryption functions to installutilsJan Cholasta2016-11-291-1/+79
| | | | | | | | | | | The encrypt_file() and decrypt_file() functions depend on ipaplatform. Move them to ipaserver.install.installutils, as they are only used for the server installer. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: move kinit functions to ipalib.installJan Cholasta2016-11-291-1/+2
| | | | | | | | | | | kinit_password() depends on ipaplatform. Move kinit_password() as well as kinit_keytab() to a new ipalib.install.kinit module, as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: remove get_domain_name()Jan Cholasta2016-11-291-5/+0
| | | | | | | | | | | get_domain_name() and related code depends on ipaplatform. Replace all uses of get_domain_name() with api.env.domain and remove get_domain_name() and all of the related code. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipapython: move certmonger and sysrestore to ipalib.installJan Cholasta2016-11-291-2/+2
| | | | | | | | | | The certmonger and sysrestore modules depend on ipaplatform. Move them to ipalib.install as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Break ipaplatform / ipalib import cycle of hellChristian Heimes2016-11-241-1/+1
| | | | | | | | | | | Here is an attempt to break the import cycle of hell between ipaplatform and ipalib. All services now pass an ipalib.api object to services.service(). RedHatServices.__init__() still needs to do a local import because it initializes its wellknown service dict with service instances. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Provide user hint about IP address in IPA installAbhijeet Kasurde2016-11-111-2/+4
| | | | | | | | | | | With this fix, user will be notified about pressing enter to proceed with IPA installation procedure, if user has provided valid IP address previously. Fixes https://fedorahosted.org/freeipa/ticket/5949 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* installutils: remove 'install_service_keytab' functionMartin Babinsky2016-11-111-11/+0
| | | | | | | | | This functionality was merged to Service class and is not longer used anywhere. https://fedorahosted.org/freeipa/ticket/6405 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* x509: use python-cryptography to process certsFraser Tweedale2016-11-101-8/+6
| | | | | | | | | | | | | | | | | Update x509.load_certificate and related functions to return python-cryptography ``Certificate`` objects. Update the call sites accordingly, including removal of NSS initialisation code. Also update GeneralName parsing code to return python-cryptography GeneralName values, for consistency with other code that processes GeneralNames. The new function, `get_san_general_names`, and associated helper functions, can be removed when python-cryptography provides a way to deal with unrecognised critical extensions. Part of: https://fedorahosted.org/freeipa/ticket/6398 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* install: add restart_dirsrv for directory server restartsTomas Krizek2016-11-071-1/+12
| | | | | | | | | | | | * Create a utility function to restart a directory server and reconnect the api.Backend.ldap2 connection. * Use restart_dirsrv instead of knownservices.dirsrv.restart to ensure api.Backend.ldap2 is reconnected. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* pylint: enable the import-error checkJan Cholasta2016-10-241-0/+2
| | | | | | | | | | Check for import errors with pylint to make sure new python package dependencies are not overlooked. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* mod_nss: use more robust quoting of NSSNickname directiveMartin Babinsky2016-10-031-11/+31
| | | | | | | | | | The code which handles configuration of mod_nss module must be more robust when handling NSS nicknames generated from subject names containing quoted RDN values. https://fedorahosted.org/freeipa/ticket/5809 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Remove unused variables in the codeMartin Basti2016-09-271-1/+1
| | | | | | | | | | | This commit removes unused variables or rename variables as "expected to be unused" by using "_" prefix. This covers only cases where fix was easy or only one unused variable was in a module Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* pylint: fix old-style-classJan Barta2016-09-221-1/+1
| | | | | Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Remove sys.exit from install modules and scriptsStanislav Laznicka2016-08-161-10/+10
| | | | | | | | | sys.exit() calls sometimes make it hard to find bugs and mask code that does not always work properly. https://fedorahosted.org/freeipa/ticket/5750 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: fix external CA cert validationJan Cholasta2016-08-041-1/+1
| | | | | | | | | The code which loads the external CA cert chain was never executed because of an incorrect usage of an iterator (iterating over it twice). https://fedorahosted.org/freeipa/ticket/6166 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix internal errors in host-add and other commands caused by DNS resolutionPetr Spacek2016-07-011-10/+3
| | | | | | | | | | | | | | | | | | Previously resolver was returning CheckedIPAddress objects. This internal server error in cases where DNS actually returned reserved IP addresses. Now the resolver is returning UnsafeIPAddress objects which do syntactic checks but do not filter IP addresses. From now on we can decide if some IP address should be accepted as-is or if it needs to be contrained to some subset of IP addresses using CheckedIPAddress class. This regression was caused by changes for https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use NSS for name->resolution in IPA installerPetr Spacek2016-06-291-2/+41
| | | | | | | | | | | | This fixes scenarios where IPA server is not able to resolve own name and option --ip-address was not specified by the user. This partially reverts changes from commit dc405005f537cf278fd6ddfe6b87060bd13d9a67 https://fedorahosted.org/freeipa/ticket/5962 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Report missing certificate in external trust chainFlorence Blanc-Renaud2016-06-231-2/+3
| | | | | | | | | | | | | When ipa-server-install is called with an external CA, but the cert chain is incomplete, the command exits with the following error: ERROR CA certificate chain in <list of --external-cert-file> is incomplete The fix adds in the log the name of the missing certificate: ERROR CA certificate chain in <list of --external-cert-file> is incomplete: missing certificate with subject '<dn of the missing certificate>' https://fedorahosted.org/freeipa/ticket/5792 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* replica install: use remote server API to create service entriesJan Cholasta2016-06-091-19/+4
| | | | | | | | | | | Use the existing remote server API to create service entries instead of a client API. This fixes a crash during replica promotion due to unavailable schema. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* Move IP address resolution from ipaserver.install.installutils to ↵Petr Spacek2016-05-301-21/+5
| | | | | | | | | | | ipapython.dnsutil This is to make it reusable from other modules and to avoid future code duplication. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* pylint: remove bare exceptMartin Basti2016-03-221-2/+2
| | | | | | | Bare except should not be used. Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* pylint: supress false positive no-member errorsMartin Basti2016-03-021-2/+7
| | | | | | | | | pylint 1.5 prints many false positive no-member errors which are supressed by this commit. https://fedorahosted.org/freeipa/ticket/5615 Reviewed-By: David Kupka <dkupka@redhat.com>
* Make PTR records check optional for IPA installationMartin Basti2016-02-291-8/+9
| | | | | | | | | PTR records are not mandratory for IPA, result fo checks should be only warning not hard error. https://fedorahosted.org/freeipa/ticket/5686 Reviewed-By: Oleg Fayans <ofayans@redhat.com>
* Remove unused importsMartin Basti2015-12-231-4/+1
| | | | | | | This patch removes unused imports, alse pylint has been configured to check unused imports. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* replica install: add remote connection check over APIJan Cholasta2015-12-111-12/+0
| | | | | | | | | | Add server_conncheck command which calls ipa-replica-conncheck --replica over oddjob. https://fedorahosted.org/freeipa/ticket/5497 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-dns-install offer IP addresses from resolv.conf as default forwardersPetr Spacek2015-12-011-0/+7
| | | | | | | | | In non-interactive more option --auto-forwarders can be used to do the same. --forward option can be used to supply additional IP addresses. https://fedorahosted.org/freeipa/ticket/5438 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* install: drop support for Dogtag 9Jan Cholasta2015-11-251-4/+4
| | | | | | | | | | | Dogtag 9 CA and CA DS install and uninstall code was removed. Existing Dogtag 9 CA and CA DS instances are disabled on upgrade. Creating a replica of a Dogtag 9 IPA master is still supported. https://fedorahosted.org/freeipa/ticket/5197 Reviewed-By: David Kupka <dkupka@redhat.com>
* Install: Force service add during replica promotionMartin Basti2015-11-241-1/+2
| | | | | | | | | Replica does not need to have A/AAAA records during install, so we cannot enforce it and service must be added with --force option. https://fedorahosted.org/freeipa/ticket/5420 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* remove Kerberos authenticators when installing/uninstalling service instanceMartin Babinsky2015-11-111-0/+37
| | | | | | | | | | each service possessing Kerberos keytab/ccache will now perform their removal before service principal creation and during service uninstall https://fedorahosted.org/freeipa/ticket/5243 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Remove dead code in ipaserver/install/installutils: read_ip_address()Petr Spacek2015-11-101-14/+0
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Add method to read changes from LDIFMartin Basti2015-10-151-0/+40
| | | | | | | | | | | | | | | | modifications_from_ldif will read LDIF file and changes in LDIF will be cached until parse() is called. After calling parse() method changes will be applied into destination LDIF. Only changetype modify is supported, the default operation is add. https://fedorahosted.org/freeipa/ticket/4949 Also fixes: https://fedorahosted.org/freeipa/ticket/4048 https://fedorahosted.org/freeipa/ticket/1930 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Make offline LDIF modify more robustMartin Basti2015-10-151-0/+98
| | | | | | | | | | | | | | * move code to installutils * add replace_value method * use lists instead of single values for add_value, remove_value methods https://fedorahosted.org/freeipa/ticket/4949 Also fixes: https://fedorahosted.org/freeipa/ticket/4048 https://fedorahosted.org/freeipa/ticket/1930 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Make checks for existing credentials reusableSimo Sorce2015-10-151-0/+73
| | | | | | | move the in installutils so they can be reused by multiple scripts Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Implement replica promotion functionalitySimo Sorce2015-10-151-1/+28
| | | | | | | | | | | | | | | | | | This patch implements a new flag --promote for the ipa-replica-install command that allows an administrative user to 'promote' an already joined client to become a full ipa server. The only credentials used are that of an administrator. This code relies on ipa-custodia being available on the peer master as well as a number of other patches to allow a computer account to request certificates for its services. Therefore this feature is marked to work only with domain level 1 and above servers. Ticket: https://fedorahosted.org/freeipa/ticket/2888 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add ipa-custodia serviceSimo Sorce2015-10-151-0/+8
| | | | | | | | | | Add a customized Custodia daemon and enable it after installation. Generates server keys and loads them in LDAP autonomously on install or update. Provides client code classes too. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use six.moves.configparser instead of ConfigParserPetr Viktorin2015-10-071-1/+1
| | | | | | | | The module name was lowercased in Python 3. Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Alias "unicode" to "str" under Python 3Jan Cholasta2015-09-171-0/+4
| | | | | | | | | The six way of doing this is to replace all occurences of "unicode" with "six.text_type". However, "unicode" is non-ambiguous and (arguably) easier to read. Also, using it makes the patches smaller, which should help with backporting. Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Installer: do not modify /etc/hosts before user agreementMartin Basti2015-09-031-13/+23
| | | | | | | | | https://fedorahosted.org/freeipa/ticket/4561 As side effect this also fixes: https://fedorahosted.org/freeipa/ticket/5266 Reviewed-By: David Kupka <dkupka@redhat.com>
* Use the print functionPetr Viktorin2015-09-011-39/+40
| | | | | | | | | In Python 3, `print` is no longer a statement. Call it as a function everywhere, and include the future import to remove the statement in Python 2 code as well. Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-28 20:38:48 +0000