summaryrefslogtreecommitdiffstats
path: root/ipaserver/install/ipa_restore.py
Commit message (Collapse)AuthorAgeFilesLines
* backup: use in-server API in ipa-backup and ipa-restoreJan Cholasta2016-06-301-1/+1
| | | | | | | | | Use in-server API so that the commands don't try to fetch API schema and fail. https://fedorahosted.org/freeipa/ticket/5995 Reviewed-By: Milan Kubik <mkubik@redhat.com>
* ipa_restore: Import only FQDN from ipalib.constantsTimo Aaltonen2016-03-231-4/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/5619 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Move user/group constants for PKI and DS into ipaplatformChristian Heimes2016-03-221-7/+9
| | | | | | | https://fedorahosted.org/freeipa/ticket/5619 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* client: stop using /etc/pki/nssdbJan Cholasta2016-02-241-17/+4
| | | | | | | | | | Don't put any IPA certificates to /etc/pki/nssdb - IPA itself uses /etc/ipa/nssdb and IPA CA certificates are provided to the system using p11-kit. Remove leftovers on upgrade. https://fedorahosted.org/freeipa/ticket/5592 Reviewed-By: David Kupka <dkupka@redhat.com>
* logger: Use warning instead of warnTomas Babej2016-01-181-1/+1
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove unused importsMartin Basti2015-12-231-3/+0
| | | | | | | This patch removes unused imports, alse pylint has been configured to check unused imports. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Explicitly call chmod on newly created directoriesMartin Basti2015-12-141-4/+6
| | | | | | | | | Without calling os.chmod(), umask is effective and may cause that directory is created with permission that causes failure. This can be related to https://fedorahosted.org/freeipa/ticket/5520 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Refactor ipautil.runPetr Viktorin2015-12-141-18/+20
| | | | | | | | | | | | | | | | | | | | | The ipautil.run function now returns an object with returncode and output are accessible as attributes. The stdout and stderr of all commands are logged (unless skip_output is given). The stdout/stderr contents must be explicitly requested with a keyword argument, otherwise they are None. This is because in Python 3, the output needs to be decoded, and that can fail if it's not decodable (human-readable) text. The raw (bytes) output is always available from the result object, as is "leniently" decoded output suitable for logging. All calls are changed to reflect this. A use of Popen in cainstance is changed to ipautil.run. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* install: drop support for Dogtag 9Jan Cholasta2015-11-251-28/+3
| | | | | | | | | | | Dogtag 9 CA and CA DS install and uninstall code was removed. Existing Dogtag 9 CA and CA DS instances are disabled on upgrade. Creating a replica of a Dogtag 9 IPA master is still supported. https://fedorahosted.org/freeipa/ticket/5197 Reviewed-By: David Kupka <dkupka@redhat.com>
* Use six.moves.configparser instead of ConfigParserPetr Viktorin2015-10-071-1/+2
| | | | | | | | The module name was lowercased in Python 3. Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: create kdcproxy user during server installJan Cholasta2015-09-221-1/+3
| | | | | | | | | | This change makes kdcproxy user creation consistent with DS and CA user creation. Before, the user was created in the spec file, in %pre scriptlet of freeipa-server. https://fedorahosted.org/freeipa/ticket/5314 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* IPA Restore: allows to specify files that should be removedMartin Basti2015-09-111-0/+28
| | | | | | | | | | | | | Some files/directories should be removed before backup files are copied to filesystem. In case of DNSSEC, the /var/lib/ipa/dnssec/tokens directory has to be removed, otherwise tokens that are backed up and existing tokens will be mixed and SOFTHSM log in will not work https://fedorahosted.org/freeipa/ticket/5293 Reviewed-By: David Kupka <dkupka@redhat.com>
* Use Python3-compatible dict method namesPetr Viktorin2015-09-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | Python 2 has keys()/values()/items(), which return lists, iterkeys()/itervalues()/iteritems(), which return iterators, and viewkeys()/viewvalues()/viewitems() which return views. Python 3 has only keys()/values()/items(), which return views. To get iterators, one can use iter() or a for loop/comprehension; for lists there's the list() constructor. When iterating through the entire dict, without modifying the dict, the difference between Python 2's items() and iteritems() is negligible, especially on small dicts (the main overhead is extra memory, not CPU time). In the interest of simpler code, this patch changes many instances of iteritems() to items(), iterkeys() to keys() etc. In other cases, helpers like six.itervalues are used. Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Backup/resore authentication control configurationDavid Kupka2015-08-191-0/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/5071 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipa-restore: check whether DS is running before attempting connectionMartin Babinsky2015-08-181-0/+7
| | | | | | https://fedorahosted.org/freeipa/ticket/4838 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Modernize 'except' clausesPetr Viktorin2015-08-121-9/+9
| | | | | | | The 'as' syntax works from Python 2 on, and Python 3 will drop the "comma" syntax. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Modernize number literalsPetr Viktorin2015-07-311-7/+7
| | | | | | | | | | | | | | Use Python-3 compatible syntax, without breaking compatibility with py 2.7 - Octals literals start with 0o to prevent confusion - The "L" at the end of large int literals is not required as they use long on Python 2 automatically. - Using 'int' instead of 'long' for small numbers is OK in all cases except strict type checking checking, e.g. type(0). https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use 389-ds centralized scripts.David Kupka2015-06-111-2/+9
| | | | | | | | | Directory server is deprecating use of tools in instance specific paths. Instead tools in bin/sbin path should be used. https://fedorahosted.org/freeipa/ticket/4051 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix stop_tracking_certificates call in ipa-restoreJan Cholasta2015-05-071-3/+2
| | | | | | | | | CAInstance.stop_tracking_certificates() no longer has dogtag_constants argument. https://fedorahosted.org/freeipa/ticket/4775 Reviewed-By: David Kupka <dkupka@redhat.com>
* move realm_to_serverid to installutils moduleMartin Basti2015-05-051-4/+5
| | | | | | | | | To avoid cyclic imports realm_to_serverid function had to be moved to installutils from dsinstance. Required for: https://fedorahosted.org/freeipa/ticket/4925 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Restore default.conf and use it to build API.David Kupka2015-03-051-16/+48
| | | | | | | | | When restoring ipa after uninstallation we need to extract and load configuration of the restored environment. https://fedorahosted.org/freeipa/ticket/4896 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Do not crash when replica is unreachable in ipa-restoreJan Cholasta2015-01-271-0/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/4857 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Create correct log directories during full restore in ipa-restoreJan Cholasta2015-01-271-15/+14
| | | | | | https://fedorahosted.org/freeipa/ticket/4865 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Put LDIF files to their original location in ipa-restoreJan Cholasta2015-01-211-1/+8
| | | | | | | | This prevents SELinux failures during online data restore. https://fedorahosted.org/freeipa/ticket/4822 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Fix IPA_BACKUP_DIR path nameMartin Kosek2015-01-141-2/+2
| | | | | | Path name was not updated during patch rebase. https://fedorahosted.org/freeipa/ticket/4797
* Fix validation of ipa-restore optionsJan Cholasta2015-01-141-72/+103
| | | | | | | | | | | | | | | Fix restore mode checks. Do some of the existing checks earlier to make them effective. Check if --instance and --backend exist both in the filesystem and in the backup. Log backup type and restore mode before performing restore. Update ipa-restore man page. https://fedorahosted.org/freeipa/ticket/4797 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Remove RUV from LDIF files before using them in ipa-restoreJan Cholasta2015-01-131-1/+35
| | | | | | https://fedorahosted.org/freeipa/ticket/4822 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Fix ipa-restore on systems without IPA installedJan Cholasta2015-01-131-2/+6
| | | | | | https://fedorahosted.org/freeipa/ticket/4824 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Abort backup restoration on not matching host.David Kupka2015-01-131-4/+2
| | | | | | | | | When restoring backup on master other than it was created there is high risk of unexpected and hard-to-debug behavior. Refuse such restore. https://fedorahosted.org/freeipa/ticket/4823 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Improve validation of --instance and --backend options in ipa-restoreJan Cholasta2014-12-091-29/+44
| | | | | | https://fedorahosted.org/freeipa/ticket/4744 Reviewed-By: David Kupka <dkupka@redhat.com>
* Stop tracking certificates before restoring them in ipa-restoreJan Cholasta2014-11-211-2/+10
| | | | | | https://fedorahosted.org/freeipa/ticket/4727 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* ipa-restore: Check if directory is provided + better errors.David Kupka2014-11-211-4/+10
| | | | | | https://fedorahosted.org/freeipa/ticket/4683 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* restore: clear httpd ccache after restorePetr Vobornik2014-11-201-0/+2
| | | | | | | | | | so that httpd ccache won't contain old credentials which would make ipa CLI fail with error: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Decrypt integrity check failed) https://fedorahosted.org/freeipa/ticket/4726 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Restore file extended attributes and SELinux context in ipa-restoreJan Cholasta2014-11-201-0/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4712 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Fix CA certificate backup and restoreJan Cholasta2014-11-111-1/+34
| | | | | | | | | | Backup and restore /etc/pki/ca-trust/source/ipa.p11-kit. Create /etc/ipa/nssdb after restore if necessary. https://fedorahosted.org/freeipa/ticket/4711 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipa-restore: Don't crash if AD trust is not installedPetr Viktorin2014-11-111-2/+11
| | | | | | https://fedorahosted.org/freeipa/ticket/4668 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove trivial path constants from modulesGabe2014-11-041-2/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/4399 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipa-restore: Set SELinux booleans when restoringPetr Viktorin2014-09-261-0/+14
| | | | | | https://fedorahosted.org/freeipa/ticket/4157 Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
* backup,restore: Don't overwrite /etc/{passwd,group}Petr Viktorin2014-09-231-1/+3
| | | | | | | | | | The /etc/passwd and /etc/group files are not saved and restored. The DS user is always created on restore, and the PKI user is created if a CA is being restored. https://fedorahosted.org/freeipa/ticket/3866 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa_restore: Split the services listPetr Viktorin2014-09-231-1/+1
| | | | | | | | | | | Make a proper list from the comma-separated string found in the config. The only current use of backup_services is in run: if 'CA' in self.backup_services: Without this change, this picked up the 'CA' from 'MEMCACHE'. Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipaserver.install: Consolidate system user creationPetr Viktorin2014-09-231-2/+1
| | | | | | | | | | | | | | Sytem users and their groups are always created together. Also, users & groups should never be removed once they exist on the system (see comit a5a55ce). Use a single function for generic user creation, and specific funtions in dsinstance and cainstance. Remove code left over from when we used to delete the DS user. Preparation for: https://fedorahosted.org/freeipa/ticket/3866 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipaplatform: Move all filesystem paths to ipaplatform.paths moduleTomas Babej2014-06-161-13/+14
| | | | | | https://fedorahosted.org/freeipa/ticket/4052 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipaplatform: Remove redundant imports of ipaservicesTomas Babej2014-06-161-2/+1
| | | | | | | | Also fixes few incorrect imports. https://fedorahosted.org/freeipa/ticket/4052 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipaplatform: Change service code in freeipa to use ipaplatform servicesTomas Babej2014-06-161-4/+5
| | | | | | https://fedorahosted.org/freeipa/ticket/4052 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipaplatform: Change platform dependant code in freeipa to use ipaplatform tasksTomas Babej2014-06-161-1/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/4052 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* Turn LDAPEntry.single_value into a dictionary-like property.Jan Cholasta2013-11-051-4/+4
| | | | | | This change makes single_value consistent with the raw property. https://fedorahosted.org/freeipa/ticket/3521
* Create DS user and group during ipa-restoreAna Krivokapic2013-09-021-7/+5
| | | | | | | ipa-restore would fail if DS user did not exist. Check for presence of DS user and group and create them if needed. https://fedorahosted.org/freeipa/ticket/3856
* Remove redundant shebangsTomas Babej2013-08-261-2/+1
| | | | | | Remove redundant shebangs from files that are not used as scripts. https://fedorahosted.org/freeipa/ticket/3853
* Prevent *.pyo and *.pyc multilib problemsMartin Kosek2013-08-131-1/+1
| | | | | | | | | | | | | Differences in the python byte code fails in a build validation (rpmdiff) done on difference architecture of the same package. This patch: 1) Ensures that timestamps of generated *.pyo and *.pyc files match 2) Python integer literals greater or equal 2^32 and lower than 2^64 are converted to long right away to prevent different type of the integer on architectures with different size of int https://fedorahosted.org/freeipa/ticket/3858
* Update only selected attributes for winsync agreementTomas Babej2013-04-161-2/+7
| | | | | | | | | | | | Trying to insert nsDS5ReplicatedAttributeListTotal and nsds5ReplicaStripAttrs to winsync agreements caused upgrade errors. With this patch, these attributes are skipped for winsync agreements. Made find_ipa_replication_agreements() in replication.py more corresponding to find_replication_agreements. It returns list of entries instead of unicode strings now. https://fedorahosted.org/freeipa/ticket/3522
generated by cgit (git 2.34.1) at 2024-06-24 18:51:44 +0000