freeipa.git/ipaclient/install, branch replica_kdc

Moving ipaCert from HTTPD_ALIAS_DIR

2017-03-01T09:43:41+00:00

The "ipaCert" nicknamed certificate is not required to be
in /var/lib/ipa/radb NSSDB anymore as we were keeping a copy
of this file in a separate file anyway. Remove it from there
and track only the file. Remove the IPA_RADB_DIR as well as
it is not required anymore.

https://fedorahosted.org/freeipa/ticket/5695
https://fedorahosted.org/freeipa/ticket/6680

Reviewed-By: Jan Cholasta

Fix error in ca_cert_files validator

2017-02-21T14:31:54+00:00

ClientInstall expects a single ca_cert_file as a string but the
framework gives it a list.

https://fedorahosted.org/freeipa/ticket/6694

Reviewed-By: Christian Heimes

client install: create /etc/ipa/nssdb with correct mode

2017-02-20T13:00:50+00:00

The NSS database directory is created with mode 640, which causes the IPA
client to fail to connect to any IPA server, because it is unable to read
trusted CA certificates from the NSS database.

Create the directory with mode 644 to fix the issue.

https://fedorahosted.org/freeipa/ticket/5959

Reviewed-By: Stanislav Laznicka

Add password to certutil calls in NSSDatabase

2017-02-17T09:14:23+00:00

NSSDatabases should call certutil with a password. Also, removed
`password_filename` argument from `.create_db()`.

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Tomas Krizek 
Reviewed-By: Jan Cholasta

Separate RA cert store from the HTTP cert store

2017-02-15T06:13:37+00:00

This is in preparation for separating out the user under which the
ipa api framework runs as.

This commit also removes certs.NSS_DIR to avoid confusion and replaces
it where appropriate with the correct NSS DB directory, either the old
HTTPD_ALIAS_DIR ot the RA DB IPA_RADB_DIR. In some cases its use is
removed altogether as it was simply not necessary.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Remove is_fips_enabled checks in installers and ipactl

2017-02-13T17:10:55+00:00

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Tomas Krizek

client install: correctly report all failures

2017-01-20T16:34:07+00:00

In commit 5249eb817efbb5708d097173a8d5f1e322fb201e, the client install code
was converted to use exception handling instead of return codes. However,
some return statements were not converted to raise statements and as a
result, ipa-client-install will report success in some error conditions.

Convert the return statements to raise statements to fix the issue.

https://fedorahosted.org/freeipa/ticket/6392

Reviewed-By: Stanislav Laznicka

disable hostname canonicalization by Kerberos library

2017-01-11T15:18:24+00:00

By default, Kerberos client library attempts to canonicalize service
hostname in TGS requests. This can fail e.g. if hosts file on the client
machine references short names before FQDNs. In this case the short name
is used in TGS_REQ which KDC fails to resolve.

Since we do not (yet) support referencing hosts by their short names it
is safe to just disable this behavior in krb5.conf and use supplied
FQDNs.

https://fedorahosted.org/freeipa/ticket/6584

Reviewed-By: Tomas Krizek 
Reviewed-By: Simo Sorce

ipa_generate_password algorithm change

2017-01-06T08:26:56+00:00

A change to the algorithm that generates random passwords
for multiple purposes throught IPA. This spells out the need
to assess password strength by the entropy it contains rather
than its length.

This new password generation should also be compatible with the
NSS implementation of password requirements in FIPS environment
so that newly created databases won't fail with wrong authentication.

https://fedorahosted.org/freeipa/ticket/5695

Reviewed-By: Martin Basti 
Reviewed-By: Petr Spacek

client, platform: Use paths.SSH* instead of get_config_dir().

2017-01-05T16:50:03+00:00

Reviewed-By: Martin Basti