summaryrefslogtreecommitdiffstats
path: root/install/tools/ipa-server-install
Commit message (Collapse)AuthorAgeFilesLines
...
* Log interactive options in install scriptsJakub Hrozek2010-11-191-0/+7
|
* Add support for configuring KDC certs for PKINITSimo Sorce2010-11-181-1/+35
| | | | | This patch adds support only for the selfsign case. Replica support is also still missing at this stage.
* Use Realm as certs subject base nameSimo Sorce2010-11-181-6/+8
| | | | Also use the realm name as nickname for the CA certificate
* Use a different user for dogtag DS instanceRob Crittenden2010-11-121-1/+8
| | | | | | Also shut down all services before starting uninstall. ticket 349
* Log script options to logfileJakub Hrozek2010-11-091-9/+14
| | | | | | | | Uses a new subclass IPAOptionParser in scripts instead of OptionParser from the standard python library. IPAOptionParser uses its own IPAOption class to store options, which adds a new 'sensitive' attribute. https://fedorahosted.org/freeipa/ticket/393
* install-script: Do not ask to remove DNS dataSimo Sorce2010-10-071-19/+3
| | | | | | | | When we uninstall we wipe out the entire LDAP database, so it doesn't really make mush sense to try to also remove single entries from it. This avoids the --uninstall procedure to fail because the DM password is not available or the LDAP server is down, and we are just trying to cleanup everything.
* Remove spurious error in server uninstaller about client uninstall failure.Rob Crittenden2010-09-241-1/+2
| | | | | | This was meant to catch the case where the client wasn't configured and it missed the most obvious one: the client was installed and is now uninstalled.
* Add new DNS install argument for setting the zone mgr e-mail addr.Rob Crittenden2010-09-231-1/+3
| | | | ticket 125
* Fix certmonger errors when doing a client or server uninstall.Rob Crittenden2010-09-091-2/+3
| | | | | | | | | | | | | | | | This started with the client uninstaller returning a 1 when not installed. There was no way to tell whether the uninstall failed or the client simply wasn't installed which caused no end of grief with the installer. This led to a lot of certmonger failures too, either trying to stop tracking a non-existent cert or not handling an existing tracked certificate. I moved the certmonger code out of the installer and put it into the client/server shared ipapython lib. It now tries a lot harder and smarter to untrack a certificate. ticket 142
* This patch removes the existing UI functionality, as a prep for adding the ↵Adam Young2010-07-291-14/+0
| | | | Javascript based ui.
* Create default HBAC rule allowing any user to access any host from any hostRob Crittenden2010-05-051-2/+5
| | | | | | | | | This is to make initial installation and testing easier. Use the --no_hbac_allow option on the command-line to disable this when doing an install. To remove it from a running server do: ipa hbac-del allow_all
* Make the installer/uninstaller more aware of its stateRob Crittenden2010-05-031-8/+6
| | | | | | | | | | | | | | We have had a state file for quite some time that is used to return the system to its pre-install state. We can use that to determine what has been configured. This patch: - uses the state file to determine if dogtag was installed - prevents someone from trying to re-install an installed server - displays some output when uninstalling - re-arranges the ipa_kpasswd installation so the state is properly saved - removes pkiuser if it was added by the installer - fetches and installs the CA on both masters and clients
* Fix a couple of syntax errors in the installer.Rob Crittenden2010-04-271-2/+5
| | | | I meant to push these along with the original patch but pushed the wrong one.
* Replace a new instance of IPAdmin use in ipa-server-install.Pavel Zuna2010-04-271-8/+11
|
* Connect to the ldap during the uninstallationMartin Nagy2010-04-231-8/+28
| | | | | | We need to ask the user for a password and connect to the ldap so the bind uninstallation procedure can remove old records. This is of course only helpful if one has more than one IPA server configured.
* Fix installing IPA with an external CARob Crittenden2010-04-231-4/+18
| | | | | | | | - cache all interactive answers - set non-interactive to True for the second run so nothing is asked - convert boolean values that are read in - require absolute paths for the external CA and signed cert files - fix the invocation message for the second ipa-server-install run
* Use ldap2 instead of legacy LDAP code from v1 in installer scripts.Pavel Zuna2010-04-191-13/+11
|
* Better customize the message regarding the CA based on the install options.Rob Crittenden2010-03-191-5/+10
| | | | | | | | | | There are now 3 cases: - Install a dogtag CA and issue server certs using that - Install a selfsign CA and issue server certs using that - Install using either dogtag or selfsign and use the provided PKCS#12 files for the server certs. The installed CA will still be used by the cert plugin to issue any server certs.
* Retrieve the LDAP schema using kerberos credentials.Rob Crittenden2010-03-171-0/+1
| | | | This is required so we can disable anonymous access in 389-ds.
* Proper use of set up vs setup (verb vs noun)Rob Crittenden2010-03-161-3/+3
| | | | Resolves #529787
* Make the CA a required component and configured by default.Rob Crittenden2010-03-021-26/+11
| | | | | | | | To install IPA without dogtag use the --selfsign option. The --ca option is now deprecated. 552995
* Fix sample IPA command example at end of installationRob Crittenden2010-02-031-1/+1
| | | | Resolves #531455
* Remove some configuration files we create upon un-installationRob Crittenden2010-01-281-1/+6
| | | | | This is particularly important for Apache since we'd leave the web server handling unconfigured locations.
* Move some functions from ipa-server-install into installutilsMartin Nagy2010-01-211-54/+1
| | | | | We will need these functions in the new upcoming ipa-dns-install command.
* Only add an NTP SRV record if we really are setting up NTPMartin Nagy2010-01-211-1/+1
| | | | | | | The sample bind zone file that is generated if we don't use --setup-dns is also changed. Fixes #500238
* Move api finalization in ipa-server-install after writing default.confMartin Nagy2010-01-211-23/+22
| | | | | We will need to have ipalib correctly configured before we start installing DNS entries with api.Command.dns.
* User-defined certificate subjectsRob Crittenden2010-01-201-8/+31
| | | | | | | | | | | | | | | Let the user, upon installation, set the certificate subject base for the dogtag CA. Certificate requests will automatically be given this subject base, regardless of what is in the CSR. The selfsign plugin does not currently support this dynamic name re-assignment and will reject any incoming requests that don't conform to the subject base. The certificate subject base is stored in cn=ipaconfig but it does NOT dynamically update the configuration, for dogtag at least. The file /var/lib/pki-ca/profiles/ca/caIPAserviceCert.cfg would need to be updated and pki-cad restarted.
* Make the IPA server host and its services "real" IPA entriesRob Crittenden2009-12-111-2/+6
| | | | | | | | | | | We use kadmin.local to bootstrap the creation of the kerberos principals for the IPA server machine: host, HTTP and ldap. This works fine and has the side-effect of protecting the services from modification by an admin (which would likely break the server). Unfortunately this also means that the services can't be managed by useful utilities such as certmonger. So we have to create them as "real" services instead.
* Ask the user before overwriting /etc/named.confMartin Nagy2009-12-021-4/+2
|
* Remove unnecessary "error: " prefixesMartin Nagy2009-12-021-5/+5
| | | | | The parser.error() method prepends the "error: " prefix itself. Adding it to the error string is not necessary and doesn't look good.
* Replace /etc/ipa/ipa.conf with /etc/ipa/default.confRob Crittenden2009-12-011-9/+0
| | | | | | | The new framework uses default.conf instead of ipa.conf. This is useful also because Apache uses a configuration file named ipa.conf. This wipes out the last vestiges of the old ipa.conf from v1.
* Use pyasn1-based PKCS#10 and X509v3 parsers instead of pyOpenSSL.Rob Crittenden2009-11-301-0/+4
| | | | | | | | | The pyOpenSSL PKCS#10 parser doesn't support attributes so we can't identify requests with subject alt names. Subject alt names are only allowed if: - the host for the alt name exists in IPA - if binding as host principal, the host is in the services managedBy attr
* Point to correct location of self-signed CA and set pw on 389-DS cert dbRob Crittenden2009-11-251-2/+2
| | | | | | | | The CA was moved from residing in the DS NSS database into the Apache database to support a self-signed CA certificate plugin. This was not updated in the installer boilerplate. The DS db wasn't getting a password set on it. Go ahead and set one.
* respect debug arg during server installJohn Dennis2009-11-191-0/+1
| | | | | The debug flag (e.g. -d) was not being respected during server install. This patch corrects that.
* Cache installer questions for the 2-step process of an externally-signed CARob Crittenden2009-11-181-6/+62
| | | | | | | | Installing a CA that is signed by another CA is a 2-step process. The first step is to generate a CSR for the CA and the second step is to install the certificate issued by the external CA. To avoid asking questions over and over (and potentially getting different answers) the answers are cached.
* Add SELinux policy for UI assetsRob Crittenden2009-11-041-1/+3
| | | | | | | | This also removes the Index option of /ipa-assets as well as the deprecated IPADebug option. No need to build or install ipa_webgui anymore. Leaving in the code for reference purposes for now.
* ipa-server-install now renders UI assetsJason Gerard DeRose2009-11-041-8/+26
|
* Auto-detect whether dogtag needs to be uninstalledRob Crittenden2009-10-211-5/+8
|
* Only initialize the API once in the installerRob Crittenden2009-09-281-12/+8
| | | | | | Make the ldap2 plugin schema loader ignore SERVER_DOWN errors 525303
* Add external CA signing and abstract out the RA backendRob Crittenden2009-09-151-10/+74
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | External CA signing is a 2-step process. You first have to run the IPA installer which will generate a CSR. You pass this CSR to your external CA and get back a cert. You then pass this cert and the CA cert and re-run the installer. The CSR is always written to /root/ipa.csr. A run would look like: # ipa-server-install --ca --external-ca -p password -a password -r EXAMPLE.COM -u dirsrv -n example.com --hostname=ipa.example.com -U [ sign cert request ] # ipa-server-install --ca --external-ca -p password -a password --external_cert_file=/tmp/rob.crt --external_ca_file=/tmp/cacert.crt -U -p password -a password -r EXAMPLE.COM -u dirsrv -n example.com --hostname=ipa.example.com This also abstracts out the RA backend plugin so the self-signed CA we create can be used in a running server. This means that the cert plugin can request certs (and nothing else). This should let us do online replica creation. To handle the self-signed CA the simple ca_serialno file now contains additional data so we don't have overlapping serial numbers in replicas. This isn't used yet. Currently the cert plugin will not work on self-signed replicas. One very important change for self-signed CAs is that the CA is no longer held in the DS database. It is now in the Apache database. Lots of general fixes were also made in ipaserver.install.certs including: - better handling when multiple CA certificates are in a single file - A temporary directory for request certs is not always created when the class is instantiated (you have to call setup_cert_request())
* Fixed dns_forwarders not being defined when options.setup_dns is FalseJason Gerard DeRose2009-09-081-0/+2
|
* Add A and PTR records of ourselves during installationMartin Nagy2009-09-021-1/+6
| | | | | | | If the DNS zones already exist but don't contain our own records, add them. This patch introduces the ipalib.api into the installers. For now, the code is still little messy. Later patches will abandon the way we create zones now and use ipalib.api exclusively.
* Remove old --setup-bind optionMartin Nagy2009-09-021-3/+0
| | | | | Since we are changing the behaviour of the --setup-dns option substantially, we might as well remove the old --setup-bind option.
* Setup bind only after restarting kdc and dirsrvMartin Nagy2009-09-021-8/+8
| | | | | | | BIND starting before we apply LDAP updates and restart kdc and directory server causes trouble. We resolve this for now by postponing BIND setup to the end of installation. Another reason is that we will be using xml-rpc during the setup in the future.
* Use DNS forwarders in /etc/named.confMartin Nagy2009-09-021-1/+45
| | | | | | | | | This patch adds options --forwarder and --no-forwarders. At least one of them must be used if you are doing a setup with DNS server. They are also mutually exclusive. The --forwarder option can be used more than once to specify more servers. If the installer runs in interactive mode, it will prompt the user if none of these option was given at the command line.
* Add option to the installer for uid/gid starting numbers.Rob Crittenden2009-08-271-1/+10
| | | | | | | | | | | | This also adds a new option to the template system. If you include eval(string) in a file that goes through the templater then the string in the eval will be evaluated by the Python interpreter. This is used so one can do $UIDSTART+1. If any errors occur during the evaluation the original string is is returned, eval() and all so it is up to the developer to make sure the evaluation passes. The default value for uid and gid is now a random value between 1,000,000 and (2^31 - 1,000,000)
* Enable ldapi connections in the management framework.Rob Crittenden2009-08-271-0/+1
| | | | | | If you don't want to use ldapi then you can remove the ldap_uri setting in /etc/ipa/default.conf. The default for the framework is to use ldap://localhost:389/
* Add --setup-dns option. It will replace --setup-bindMartin Nagy2009-07-221-8/+11
|
* Allow replicas of an IPA server using an internal dogtag server as the CARob Crittenden2009-07-151-1/+1
| | | | | | | | This involves creating a new CA instance on the replica and using pkisilent to create a clone of the master CA. Also generally fixes IPA to work with the latest dogtag SVN tip. A lot of changes to ports and configuration have been done recently.
* Use LDAP instead of flat file for zone storageMartin Nagy2009-06-021-4/+6
|
generated by cgit (git 2.34.1) at 2026-03-06 20:38:32 +0000