summaryrefslogtreecommitdiffstats
path: root/client
Commit message (Collapse)AuthorAgeFilesLines
* Replace replication_wait_timeout with certmonger_wait_timeoutRob Crittenden2019-09-041-0/+9
| | | | | | | | | | | | The variable is intended to control the timeout for replication events. If someone had significantly reduced it via configuration then it could have caused certmogner requests to fail due to timeouts. Add replication_wait_timeout, certmonger_wait_timeout and http_timeout to the default.conf man page. Related: https://pagure.io/freeipa/issue/7971 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* ipa-client-samba: a tool to configure Samba domain member on IPA clientAlexander Bokovoy2019-06-294-0/+112
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduces new utility to configure Samba on an IPA domain member. The tool sets up Samba configuration and internal databases, creates cifs/... Kerberos service and makes sure that a keytab for this service contains the key with the same randomly generated password that is set in the internal Samba databases. Samba configuration is created by querying an IPA master about details of trust to Active Directory configuration. All known identity ranges added to the configuration to allow Samba to properly handle them (read-only) via idmap_sss. Resulting configuration allows connection with both NTLMSSP and Kerberos authentication for IPA users. Access controls for the shared content should be set by utilizing POSIX ACLs on the file system under a specific share. The utility is packaged as freeipa-client-samba package to allow pulling in all required dependencies for Samba and cifs.ko (smb3.ko) kernel module. This allows an IPA client to become both an SMB server and an SMB client. Fixes: https://pagure.io/freeipa/issue/3999 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Introduce minimal ipa-client-automount.in and ipactl.inFrançois Cami2019-06-281-0/+27
| | | | | | | | | | Now that ipa-client-automount and ipactl main logic has been moved into modules, introduce minimal executables. Fixes: https://pagure.io/freeipa/issue/7984 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Move ipa-client-automount.in and ipactl into modulesFrançois Cami2019-06-281-542/+0
| | | | | | | Fixes: https://pagure.io/freeipa/issue/7984 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipa-client-automount: fix '--idmap-domain DNS' logicFrançois Cami2019-06-261-1/+1
| | | | | | | | | | | | Previously '--idmap-domain DNS' would assume the Domain parameter of idmapd.conf was already absent. With this fix, the Domain parameter is always removed and the configuration file is always backuped. Related-to: https://pagure.io/freeipa/issue/7918 Fixes: https://pagure.io/freeipa/issue/7988 Signed-off-by: François Cami fcami@redhat.com Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Increase default debug level of certmongerChristian Heimes2019-06-243-0/+10
| | | | | | | | | | | By default certmonger does not log operations. With debug level 2, certmonger logs errors and operations to journald. An increased debug level makes it easier to investigate problems. Fixes: https://pagure.io/freeipa/issue/7986 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Replace PYTHONSHEBANG with valid shebangChristian Heimes2019-06-243-3/+3
| | | | | | | | | | | | | | Replace the @PYTHONSHEBANG@ substitution with a valid #!/usr/bin/python3 shebang. This turns Python .in files into valid Python files. The files can now be checked with pylint and IDEs recognize the files as Python files. The shebang is still replaced with "#!$(PYTHON) -E" to support platform-python. Related: https://pagure.io/freeipa/issue/7984 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Francois Cami <fcami@redhat.com>
* ipa-client-automount: add knob to configure NFSv4 Domain (idmapd.conf)François Cami2019-05-062-34/+55
| | | | | | | | | | | | | ipa-client-automount assumes the NFS domain to be the same as the IPA domain. This is not always the case. This commit adds a --idmap-domain knob with the following behavior: - if not present, default to IDM domain (current behavior) - if equal to DNS (magic value), set nothing and let idmapd autodetect domain - otherwise set Domain in idmap.conf to the value passed by this parameter Fixes: https://pagure.io/freeipa/issue/7918 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Deprecate ipa-client-install --request-certChristian Heimes2019-04-241-0/+7
| | | | | | | | | | | Mark the --request-cert option for ipa-client-install as deprecated. Users are encouraged to request a PEM certificate with certmonger instead. The option and /etc/ipa/nssdb will be removed in a future version. Related: https://pagure.io/freeipa/issue/7492 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* automount: rmtree temp directoryChristian Heimes2019-04-091-2/+2
| | | | | | | | | | | | | | ipa-client-automount uses the host keytab to acquire a TGT. The script sets up a temporary directory for its ccache. At the end of the script it removes the ccache and temp directory again. In case of a failed kinit, the ccache is not created and the removal of the ccache causes an exception. The automount installer now uses shutil.rmtree() to remove the temporary directory and all its content. Fixes: https://pagure.io/freeipa/issue/7862 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: François Cami <fcami@redhat.com>
* Add interactive prompt for the LDAP bind password to ipa-getkeytabRob Crittenden2019-04-082-14/+48
| | | | | | | | | | | | | This provides a mechanism to bind over LDAP without exposing the password on the command-line. https://pagure.io/freeipa/issue/631 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Fix assign instead of compareChristian Heimes2019-03-251-1/+1
| | | | | | | | | | | Commit 53e0b2255d92c9c21c19306cf37cc8de0476dc9c introduced a minor bug. Instead of comparing errno to ENOENT, the check assigned ENOENT to errno. Coverity: CID 337082 See: https://pagure.io/freeipa/issue/4607 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-client-automount: fix PEP8 issuesFrançois Cami2019-03-071-8/+6
| | | | | | | | Commit 6a56aa6d4987bc4856997351a413c014e14abdd6 introduced C0303, W1201 and R1710 errors in ipa-client-automount.in. Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipa-client-automount: handle NFS configuration file changesFrançois Cami2019-02-271-8/+10
| | | | | | | | | | | | | | | | | | | | | | nfs-utils in Fedora 30 and later switched its configuration file from /etc/sysconfig/nfs to /etc/nfs.conf, providing a conversion service (nfs-convert.service) for upgrades. However, for new installs the original configuration file is missing. This change: * adds a tuple-based osinfo.version_number method to handle more kinds of OS versioning schemes * detects RHEL and Fedora versions with the the new nfs-utils behavior * avoids backing up the new NFS configuration file as we do not have to modify it. See: https://bugzilla.redhat.com/show_bug.cgi?id=1676981 Fixes: https://pagure.io/freeipa/issue/7868 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* ipa-getkeytab: resolve symlinkChristian Heimes2019-01-301-5/+56
| | | | | | | | | | | Resolve one level of symbolic links to support a dangling symlink as keytab target. To prevent symlink attacks, only resolve symlink when the symlink is owned by the current effective user and group, or by root. Fixes: https://pagure.io/freeipa/issue/4607 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-client-automount: use nfs-utils unitFrançois Cami2018-12-141-37/+18
| | | | | | | | | | | | | | - remove nfs-idmapd from units we enable & start as: - it is not used on NFS clients anymore - it is a static unit - remove rpc-gssd as well as it is a static unit - restart nfs-utils and rpc-gssd - manage systemctl-related exceptions during uninstall Fixes: https://pagure.io/freeipa/issue/7780 Fixes: https://pagure.io/freeipa/issue/7781 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix ressource leak in client/config.c get_config_entryThomas Woerner2018-10-231-1/+2
| | | | | | | | | The leak happens due to using strndup to create a temporary string without freeing it afterwards. See: https://pagure.io/freeipa/issue/7738 Signed-off-by: Thomas Woerner <twoerner@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Enable LDAP debug output in client to display TLS errors in joinRob Crittenden2018-10-121-29/+35
| | | | | | | | | | | | | | | | | | If ipa-join fails due to a TLS connection error when doing an LDAP-based enroll then nothing is logged by default except an Invalid Password error which is misleading (because the failure occurs during the bind). The only way that debugging would have been sufficient is if the user passed --debug to ipa-client-install which is not great. This log level is otherwise very quiet and only logs one or two lines on errors which is perfect. https://pagure.io/freeipa/issue/7728 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Retrieve certificate subject base directly instead of ipa-joinRob Crittenden2018-08-291-88/+4
| | | | | | | | | | | | | | | | | | | | | The subject base is used as a fallback to find the available CA certificates during client enrollment if the LDAP connection fails (e.g. due to new client connecting to very old server) and for constructing the subject if a certificate is requested. raw=True is passed to config-show in order to avoid parsing the server roles which will fail because the services aren't marked as enabled until after the client installation is successful on a master. ipa-join providing the subject base via stderr was fragile and would cause client enrollment to fail if any other output was included in stderr. https://pagure.io/freeipa/issue/7674 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Generate scripts from templatesChristian Heimes2018-08-231-3/+10
| | | | | | | | | | Python scripts are now generated from templates. The scripts are marked as nodist (no distribution) but install targets. The templates for the scripts are extra distribution data, no installation (noinst). Fixes: https://pagure.io/freeipa/issue/7680 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Rename Python scripts and add dynamic shebangChristian Heimes2018-08-233-3/+3
| | | | | | | | | | | | | | | All Python scripts are now generated from a template with a dynamic shebang. ipatests/i18n.py is no longer an executable script with shebang. The module is not executed as script directly, but rather as $(PYTHON) ipatests/i18n.py Fixes: https://pagure.io/freeipa/issue/7680 All Python scripts are now template files with a dynamic shebang line. Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Move client templates to separate directoryChristian Heimes2018-06-053-0/+9
| | | | | | | | | | | | PR https://github.com/freeipa/freeipa/pull/1747 added the first template for FreeIPA client package. The template file was added to server templates, which broke client-only builds. The template is now part of a new subdirectory for client package shared data. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Apply sane LDAP settings to C codeChristian Heimes2018-05-293-94/+12
| | | | | | | | | Common LDAP code from ipa-getkeytab and ipa-join are moved to libutil.a. The common ipa_ldap_init() and ipa_tls_ssl_init() set the same options as ldap_initialize() Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Return unique error when automount is already or not configuredRob Crittenden2018-05-162-13/+36
| | | | | | | | | | | Use identical return codes as ipa-client-install when uninstalling ipa-client-automount and it is not configured, or when calling it again to return that is ias already configured. https://pagure.io/freeipa/issue/7396 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* Fix typo in ipa-getkeytab --helpStanislav Laznicka2018-04-261-1/+2
| | | | | | | Fix the typo in ipa-getkeytab -k option description by replacing the text with the one from man Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Remove unnecessary option --force-chronyTibor Dudlák2018-04-091-4/+1
| | | | | | | | | FreeIPA will always force chrony service and disable any other conflicting time synchronization daemon. Add --ntp-server option to server manpage and note to NTP pool option. Addresses: https://pagure.io/freeipa/issue/7024 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Remove NTP server role while upgradingTibor Dudlák2018-04-091-1/+1
| | | | | | | | | Remove NTP server role from config.py. Remove uneccesary variables and replaced untrack_file with restore_file. Update typo in manpages and messages printed while installing. Resolves: https://pagure.io/freeipa/issue/7024 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Removes NTP server role from servroles and descriptionTibor Dudlák2018-04-091-2/+1
| | | | | Resolves: https://pagure.io/freeipa/issue/7024 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Update man pages for FreeIPA client, replica and server installTibor Dudlák2018-04-091-10/+9
| | | | | Addresses: https://pagure.io/freeipa/issue/7024 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Fix some typos in man pageTakeshi MIZUTA2018-03-211-1/+1
| | | | Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Have all the scripts run in python 3 by defaultStanislav Laznicka2018-02-153-3/+3
| | | | | | | | | The Python 3 refactoring effort is finishing, it should be safe to turn all scripts to run in Python 3 by default. https://pagure.io/freeipa/issue/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Replace hard-coded paths with path constantsChristian Heimes2018-02-081-1/+1
| | | | | | | | | | | Several run() calls used hard-coded paths rather than pre-defined paths from ipaplatform.paths. The patch fixes all places that I was able to find with a simple search. The fix simplifies Darix's port of freeIPA on openSuSE. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Documenting kinit_lifetime in /etc/ipa/default.confamitkuma2018-01-121-6/+3
| | | | | | | Describing the parameter kinit_lifetime that allows to limit the lifetime of ticket obtained by users authenticating to the WebGUI using login/password. Removing session_auth_duration and session_duration_type since these parameters are not relevant anymore. Resolves: https://pagure.io/freeipa/issue/7333 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* ipa-getkeytab man page: add more details about the -r optionFlorence Blanc-Renaud2017-11-081-1/+34
| | | | | | | | | | | | The man page does not provide enough information about replicated environments and the use of the -r option. This fix adds an example how to use the same keytab on 2 different hosts, and points to ipa {service/host}-allow-retrieve-keytab. Fixes: https://pagure.io/freeipa/issue/7237 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Changing how commands handles error when it can't connect to IPA serverFelipe Volpone2017-08-111-2/+7
| | | | | | | | | Creating a method to check if ipa client is configured. Also, changing scripts to use it instead of duplicating the check. https://pagure.io/freeipa/issue/6261 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* logging: do not log into the root loggerJan Cholasta2017-07-141-25/+35
| | | | | | | Deprecate `ipa_log_manager.root_logger` and replace all calls to it with module-level logger calls. Reviewed-By: Martin Basti <mbasti@redhat.com>
* client install: fix client PKINIT configurationJan Cholasta2017-05-191-0/+1
| | | | | | | | | | | | | | | Set `pkinit_anchors` in `krb5.conf` to a CA certificate bundle of CAs trusted to issue KDC certificates rather than `/etc/ipa/ca.crt`. Set `pkinit_pool` in `krb5.conf` to a CA certificate bundle of all CAs known to IPA. Make sure both bundles are exported in all installation code paths. https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* fix minor spelling mistakesRené Genz2017-05-192-3/+3
| | | | Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* automount install: fix checking of SSSD functionality on uninstallPetr Vobornik2017-04-281-6/+10
| | | | | | | | | | | | | | | | | Change in 2d4d1a9dc0ef2bbe86751768d6e6b009a52c0dc9 no longer initializes api in `ipa-client-automount --uninstallation` Which caused error in wait_for_sssd which gets realm from initialized API. This patch initializes the API in a way that it doesn't download schema on uninstallation and on installation it uses host keytab for it so it no longer requires user's Kerberos credentials. Also fix call of xxx_service_class_factory which requires api as param. https://pagure.io/freeipa/issue/6861 Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Clarify meaning of --domain and --realm in installersStanislav Laznicka2017-01-051-19/+12
| | | | | | | | Man pages need bigger overhaul. Take this as hot-fix for FAQ. https://fedorahosted.org/freeipa/ticket/6574 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Use env var IPA_CONFDIR to get confdirChristian Heimes2016-12-021-0/+4
| | | | | | | | | | | | | The environment variable IPA_CONFDIR overrides the default confdir path. The value of the environment variable must be an absolute path to an existing directory. The new variable makes it much simpler to use the 'ipa' command and ipalib with a local configuration directory. Some scripts (e.g. servers, installers, and upgrades) set the confdir explicitly and do not support the env var. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Revert "Add 'ipa localenv' subcommand"Martin Babinsky2016-12-021-5/+1
| | | | | | | | | | This reverts commit 1166fbc4946596fcc2ed51a1ec6990fc7dae8964. The proper fix is to restore pre-thin client behavior of commands inheriting from LocalOrRemote class. https://fedorahosted.org/freeipa/ticket/6490 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Set explicit confdir option for global contextsChristian Heimes2016-12-021-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Some API contexts are used to modify global state (e.g. files in /etc and /var). These contexts do not support confdir overrides. Initialize the API with an explicit confdir argument to paths.ETC_IPA. The special contexts are: * backup * cli_installer * installer * ipctl * renew * restore * server * updates The patch also corrects the context of the ipa-httpd-kdcproxy script to 'server'. https://fedorahosted.org/freeipa/ticket/6389 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipaclient: move install modules to the install subpackageJan Cholasta2016-11-292-3/+3
| | | | | | | | | | | | The ipa_certupdate, ipachangeconf, ipadiscovery and ntpconf modules depend on ipaplatform. Move them to ipaclient.install as they are used only from the client installer. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: move kinit functions to ipalib.installJan Cholasta2016-11-291-1/+2
| | | | | | | | | | | kinit_password() depends on ipaplatform. Move kinit_password() as well as kinit_keytab() to a new ipalib.install.kinit module, as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipapython: move certmonger and sysrestore to ipalib.installJan Cholasta2016-11-291-1/+1
| | | | | | | | | | The certmonger and sysrestore modules depend on ipaplatform. Move them to ipalib.install as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Python3 pylint fixesChristian Heimes2016-11-251-1/+1
| | | | | | | | | | | Sprinkle 'pylint disable' comments over the code base to silence a bunch of pylint warnings on Python 3. All silenced warnings are harmless and not bugs. https://fedorahosted.org/freeipa/ticket/4985 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add 'ipa localenv' subcommandChristian Heimes2016-11-181-1/+5
| | | | | | | | | | | | ipa local-env simply dumps all values from api.env as sorted key="value" pairs. It's a convenient helper for debugging and to write tests for e.g. PR #182. https://fedorahosted.org/freeipa/ticket/6490 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Use xml.etree in ipa-client-automount scriptChristian Heimes2016-11-161-24/+23
| | | | | | | | The ipa-client-automount script used lxml.etree to modify /etc/autofs_ldap_auth.conf. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Build: remove incorrect use of MAINTAINERCLEANFILESPetr Spacek2016-11-162-29/+0
| | | | | | | | | | | | | Automake manual section 13 What Gets Cleaned says that make maintainer-clean should not remove files necessary for subsequent runs of ./configure. It practically means that all usage of MAINTAINERCLEANFILES were incorrect so I've removed them. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-02 20:31:00 +0000