summaryrefslogtreecommitdiffstats
path: root/ipaserver/install/server
Commit message (Collapse)AuthorAgeFilesLines
* replica install: don't allow install against a newer serverJan Cholasta2016-06-301-2/+26
| | | | | | | | | If the version of the remote server is higher than the local version, don't allow installing a replica of it. https://fedorahosted.org/freeipa/ticket/5983 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Do not allow installation in FIPS modeFlorence Blanc-Renaud2016-06-292-1/+10
| | | | | | | https://fedorahosted.org/freeipa/ticket/5761 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Set default OCSP URI on install and upgradeFraser Tweedale2016-06-281-0/+23
| | | | | | | | | | | | | | Dogtag has been updated to support a default OCSP URI when the profile includes AuthInfoAccess with URI method but does not specify the URI (instead of constructing one based on Dogtag's hostname and port). Add the pkispawn config to ensure that the OCSP URI is set before issuing CA and system certificates, and add the config to existing CA instances on upgrade. Fixes: https://fedorahosted.org/freeipa/ticket/5956 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNS Locations: cleanup of bininstanceMartin Basti2016-06-282-7/+5
| | | | | | | | | | | | | | | | We don't need anymore: * sample of zone file - list of all records required by IPa will be provided * NTP related params - DNS records will be updated automatically, based on LDAP values * CA related params - DNS records will be updated automatically based * on LDAP values https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Replica promotion: use the correct IPA domain for replicaMartin Basti2016-06-211-0/+29
| | | | | | | | | | | | | | | | | | IPA domain is detected from LDAP for replica promote installation. If local domain and IPA domain does not match, installer refuses to install replica. IPA versions 4.3.0 and 4.3.1 allow to specify different domain for replica. Only one IPA domain is allowed (domain used with master) and different domain may cause issues. This commit prevents to install new replica if multiple domains was used in past. User action is required to fix this issue and remove incorrect IPA domains from LDAP. https://fedorahosted.org/freeipa/ticket/5976 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* replica install: fix thin client regressionJan Cholasta2016-06-201-22/+28
| | | | | | | | | | | Fix a regression introduced by commit 3157eec28ff35e3c407a9552d6b59bef9891b555. https://fedorahosted.org/freeipa/ticket/4739 https://fedorahosted.org/freeipa/ticket/5985 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* remove the master from managed topology during uninstallationMartin Babinsky2016-06-171-155/+27
| | | | | | | | | | In managed topology, calling `ipa-server-install --uninstall` will cause the master to remove itself from the topology by calling `server_del` behind the scenes. https://fedorahosted.org/freeipa/ticket/5588 Reviewed-By: Martin Basti <mbasti@redhat.com>
* DNS Locations: dnsserver: put server_id option into named.confMartin Basti2016-06-171-0/+23
| | | | | | | | | | The option server_id is required for DNS location feature, otherwise it will not work. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* DNS Locations: use dns_update_service_records in installersMartin Basti2016-06-172-7/+8
| | | | | | | | | use the dns_update_system_records command to set proper DNS records https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* upgrade: do not try to start CA if not configuredFraser Tweedale2016-06-151-6/+8
| | | | | | | | The upgrade script always attempts to start the CA, even on instances where the CA is not configured. Add guards. Fixes: https://fedorahosted.org/freeipa/ticket/5958 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Add NTP to the list of services stored in IPA masters LDAP subtreeMartin Babinsky2016-06-153-0/+11
| | | | | | | | | | | | | | | | IPA masters can be configured as NTP servers but the status of this service can not be determined centrally from querying relevant LDAP subtree. This patch makes IPA master and replica publish the newly configured NTP service in their service container during installation. If the master was configured as NTP server, the NTP service entry will be created upon upgrade. https://fedorahosted.org/freeipa/ticket/5815 https://fedorahosted.org/freeipa/ticket/5826 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add IPA CA entry on install / upgradeFraser Tweedale2016-06-151-0/+1
| | | | | | | | | | | In addition to user-created lightweight CAs, CA ACLs need to be able to refer to the "main" CA. Add an entry for the IPA CA on installation and upgrade. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Add 'ca' pluginFraser Tweedale2016-06-151-1/+15
| | | | | | | | | | | | | | | | | | | | This commit adds the 'ca' plugin for creating and managing lightweight CAs. The initial implementation supports a single level of sub-CAs underneath the IPA CA. This commit also: - adds the container for FreeIPA CA objects - adds schema for the FreeIPA CA objects - updates ipa-pki-proxy.conf to allow access to the Dogtag lightweight CAs REST API. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* replica install: use remote server API to create service entriesJan Cholasta2016-06-091-51/+39
| | | | | | | | | | | Use the existing remote server API to create service entries instead of a client API. This fixes a crash during replica promotion due to unavailable schema. https://fedorahosted.org/freeipa/ticket/4739 Reviewed-By: David Kupka <dkupka@redhat.com>
* Authorise CA Agent to manage lightweight CAsFraser Tweedale2016-06-091-0/+11
| | | | | | | | | Add Dogtag ACLs that authorise the CA Agent certificate to manage lightweight CAs. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Setup lightweight CA key retrieval on install/upgradeFraser Tweedale2016-06-092-4/+6
| | | | | | | | | | | | | | | | | | Add the ipa-pki-retrieve-key helper program and configure lightweight CA key replication on installation and upgrade. The specific configuration steps are: - Add the 'dogtag/$HOSTNAME' service principal - Create the pricipal's Custodia keys - Retrieve the principal's keytab - Configure Dogtag's CS.cfg to use ExternalProcessKeyRetriever to invoke ipa-pki-retrieve-key for key retrieval Also bump the minimum version of Dogtag to 10.3.2. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Deprecated the domain-level option in ipa-server-installStanislav Laznicka2016-06-021-0/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5907 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Performance: Find commands: do not process members by defaultMartin Basti2016-05-311-1/+2
| | | | | | | | | | | | | | | | In all *-find commands, member attributes shouldn't be processed due high amount fo ldpaserches cause serious performance issues. For this reason --no-members option is set by default in CLI and API. To get members in *-find command option --all in CLI is rquired or 'no_members=False' or 'all=True' must be set in API call. For other commands processing of members stays unchanged. WebUI is not affected by this change. https://fedorahosted.org/freeipa/ticket/4995 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* DNS upgrade: change global forwarding policy in named.conf to "only" if ↵Petr Spacek2016-05-301-0/+46
| | | | | | | | | | | | | private IPs are used This change is necessary to override automatic empty zone configuration in latest BIND and bind-dyndb-ldap 9.0+. This upgrade has to be done on each IPA DNS server independently. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Move check_zone_overlap() from ipapython.ipautil to ipapython.dnsutilPetr Spacek2016-05-301-1/+1
| | | | | | | | | This is preparatory work to avoid (future) cyclic import between ipapython.dnsutil and ipapython.ipautil. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Upgrade: always start CAMartin Basti2016-05-251-0/+11
| | | | | | | | | | | Some CA upgrade steps in upgrader requires running CA. We have to always start CA and wait for running status using http, because systemd may return false positive result that CA is running even if CA is just starting and unable to serve. https://fedorahosted.org/freeipa/ticket/5868 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Detect and repair incorrect caIPAserviceCert configFraser Tweedale2016-05-191-0/+3
| | | | | | | | | | | A regression caused replica installation to replace the FreeIPA version of caIPAserviceCert with the version shipped by Dogtag. During upgrade, detect and repair occurrences of this problem. Part of: https://fedorahosted.org/freeipa/ticket/5881 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Replaced find_hostname with api.env.hostAbhijeet Kasurde2016-05-101-21/+1
| | | | | | | Fixes: https://fedorahosted.org/freeipa/ticket/5841 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Auto-detect default value for --forward-policy option in installersPetr Spacek2016-04-281-1/+1
| | | | | | | | | | | | | Forward policy defaults to 'first' if no IP address belonging to a private or reserved ranges is detected on local interfaces (RFC 6303). Defaults to only if a private IP address is detected. This prevents problems with BIND automatic empty zones because conflicting zones cannot be disabled unless forwarding policy == only. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Extend installers with --forward-policy optionPetr Spacek2016-04-282-2/+12
| | | | | | | | | This option specified forward policy for global forwarders. The value is put inside /etc/named.conf. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove unused hostname variablesMartin Basti2016-04-261-3/+0
| | | | | | https://fedorahosted.org/freeipa/ticket/5794 Reviewed-By: David Kupka <dkupka@redhat.com>
* Always set hostnameMartin Basti2016-04-261-17/+6
| | | | | | | | | | | This prevents cases when hostname on system is set inconsistently (transient and static hostname differs) and may cause IPA errors. This commit ensures that all hostnames are set properly. https://fedorahosted.org/freeipa/ticket/5794 Reviewed-By: David Kupka <dkupka@redhat.com>
* Configure httpd service from installer instead of directly from RPMMartin Basti2016-04-221-0/+5
| | | | | | | | | | | | | | File httpd.service was created by RPM, what causes that httpd service may fail due IPA specific configuration even if IPA wasn't installed or was uninstalled (without erasing RPMs). With this patch httpd service is configured by httpd.d/ipa.conf during IPA installation and this config is removed by uninstaller, so no residual http configuration related to IPA should stay there. https://fedorahosted.org/freeipa/ticket/5681 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Move user/group constants for PKI and DS into ipaplatformChristian Heimes2016-03-221-1/+2
| | | | | | | https://fedorahosted.org/freeipa/ticket/5619 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* pylint: remove bare exceptMartin Basti2016-03-221-1/+1
| | | | | | | Bare except should not be used. Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* configure DNA plugin shared config entries to allow connection with GSSAPIThierry Bordaz2016-03-023-0/+13
| | | | | | | | | | | | | | | https://fedorahosted.org/freeipa/ticket/4026 When a replica needs to extend its DNA range, it selects the remote replica with the larger available range. If there is no replica agreement to that remote replica, the shared config entry needs to contain the connection method/protocol. This fix requires 389-ds * https://fedorahosted.org/389/ticket/47779 * https://fedorahosted.org/389/ticket/48362 That are both fixed in 1.3.4.6 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* pylint: supress false positive no-member errorsMartin Basti2016-03-021-1/+2
| | | | | | | | | pylint 1.5 prints many false positive no-member errors which are supressed by this commit. https://fedorahosted.org/freeipa/ticket/5615 Reviewed-By: David Kupka <dkupka@redhat.com>
* Move freeipa certmonger helpers to libexecdir.Timo Aaltonen2016-02-261-6/+2
| | | | | | | | | | | The scripts in this directory are simple python scripts, nothing arch-specific in them. Having them under libexec would simplify the code a bit too, since there would be no need to worry about lib vs lib64 (which also cause trouble on Debian). https://fedorahosted.org/freeipa/ticket/5586 Reviewed-By: David Kupka <dkupka@redhat.com>
* httpinstance: add start_tracking_certificates methodDavid Kupka2016-02-261-4/+15
| | | | | | | | Configure certmonger to start tracking certificate for httpd. https://fedorahosted.org/freeipa/ticket/5586 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* dsinstance: add start_tracking_certificates methodDavid Kupka2016-02-261-2/+17
| | | | | | | | Configure certmonger to start tracing certificate for DS. https://fedorahosted.org/freeipa/ticket/5586 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* upgrade: Match whole pre/post command not just basename.David Kupka2016-02-261-26/+20
| | | | Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* upgrade: fix config of sidgen and extdom pluginsMartin Basti2016-02-231-2/+2
| | | | | | | | | | | | | | | During upgrade to IPA 4.2, literally "$SUFFIX" value was added to configuration of sidgen and extdom plugins. This cause that SID are not properly configured. Upgrade must fix "$SUFFIX" to reals suffix DN, and run sidgen task against IPA domain (if exists). All trusts added when plugins configuration was broken must be re-added. https://fedorahosted.org/freeipa/ticket/5665 Reviewed-By: Tomas Babej <tbabej@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* upgrade: unconditional import of certificate profiles into LDAPMartin Babinsky2016-02-231-1/+3
| | | | | | | | | | | | | | During IPA server upgrade, the migration of Dogtag profiles into LDAP backend was bound to the update of CS.cfg which enabled the LDAP profile subsystem. If the subsequent profile migration failed, the subsequent upgrades were not executing the migration code leaving CA subsystem in broken state. Therefore the migration code path should be executed regardless of the status of the main Dogtag config file. https://fedorahosted.org/freeipa/ticket/5682 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Upgrade: log to ipaupgrade.log when IPA server is not installedMartin Basti2016-02-111-1/+1
| | | | | | | | | | Message was printed only to stdout and leaves ipaupgrade.log without any record that ipa-server-upgrade failed because ipa server is not installed. Now error is passed to logger which prints meassage to stderr and ipaupgrade.log. Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Modernize mod_nss's cipher suitesChristian Heimes2016-02-111-0/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The list of supported TLS cipher suites in /etc/httpd/conf.d/nss.conf has been modernized. Insecure or less secure algorithms such as RC4, DES and 3DES are removed. Perfect forward secrecy suites with ephemeral ECDH key exchange have been added. IE 8 on Windows XP is no longer supported. The list of enabled cipher suites has been generated with the script contrib/nssciphersuite/nssciphersuite.py. TLS_RSA_WITH_AES_128_CBC_SHA256 TLS_RSA_WITH_AES_256_CBC_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_AES_256_CBC_SHA https://fedorahosted.org/freeipa/ticket/5589 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* always start certmonger during IPA server configuration upgradeMartin Babinsky2016-02-021-28/+5
| | | | | | | | | | | | This patch fixes a regression introduced by commit bef0f4c5c38e7ff6415e8f8c96dc306ef7f0ce56. Instead of checking whether there is CA installed in the topology, we should always start certmonger service during upgrade regardless when CA was configured. https://fedorahosted.org/freeipa/ticket/5655 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* reset ldap.conf to point to newly installer replica after promotionMartin Babinsky2016-02-011-0/+44
| | | | | | | | | | | | When promoting a client to replica reset openldap client config so that it no longer uses remote master as default LDAP hosts but uses local connection to replica. Also make sure that the behavior regarding editing of user-customized config is consistent with the client installer. https://fedorahosted.org/freeipa/ticket/5488 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* replica install: validate DS and HTTP server certificatesJan Cholasta2016-02-011-1/+30
| | | | | | | | | Validate the DS and HTTP certificates from the replica info file early in ipa-replica-install to prevent crashes later. https://fedorahosted.org/freeipa/ticket/5598 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* disable RA plugins when promoting a replica from CA-less masterMartin Babinsky2016-01-271-7/+17
| | | | | | | | | | There is no point in setting 'enable_ra' to True in IPA config when the replica is promoted from CA-less master. The installer should set 'enable_ra' to False and unset 'ra_plugin' directive in this case. https://fedorahosted.org/freeipa/ticket/5626 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* uninstallation: more robust check for master removal from topologyMartin Babinsky2016-01-211-4/+36
| | | | | | | | | | | | When uninstalling IPA master in domain level 1 topology, the code that checks for correct removal from topology will now consider failures to lookup host entry in local LDAP and to obtain host TGT as a sign that the master entry was already removed. https://fedorahosted.org/freeipa/ticket/5584 Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Alias "unicode" to "str" under Python 3Petr Viktorin2016-01-202-0/+10
| | | | | | | | | | | | | | Follow-up to commit 23507e6124041ed17f39db211e802495e37520e7 The six way of doing this is to replace all occurences of "unicode" with "six.text_type". However, "unicode" is non-ambiguous and (arguably) easier to read. Also, using it makes the patches smaller, which should help with backporting. https://fedorahosted.org/freeipa/ticket/5623 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use print_function future definition wherever print() is usedPetr Viktorin2016-01-201-0/+2
| | | | | | | | | | | | Pylint considers `print` a statement if the __future__ import is not present, even if it's used like a function with one argument. Add the __future__ import to files `pylint --py3k` complains about. https://fedorahosted.org/freeipa/ticket/5623 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Warn about potential loss of CA, KRA, DNSSEC during uninstallMartin Basti2016-01-141-1/+11
| | | | | | | | | | If connection do LDAP failed (or LDAP server is down) we cannot verify if there is any additonal instance of CA, KRA, DNSSEC master. In this case a user is warned and promted to confirm uninstallation. https://fedorahosted.org/freeipa/ticket/5544 Reviewed-By: David Kupka <dkupka@redhat.com>
* py3: Remove py3 incompatible exception handlingTomas Babej2016-01-131-2/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5585 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* fix Py3 incompatible exception instantiation in replica install codeMartin Babinsky2016-01-131-4/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/5585 Reviewed-By: Tomas Babej <tbabej@redhat.com>
generated by cgit (git 2.34.1) at 2024-09-28 12:08:42 +0000