summaryrefslogtreecommitdiffstats
path: root/install/tools
Commit message (Collapse)AuthorAgeFilesLines
* ipa-replica-manage: adjust del to work with managed topologyPetr Vobornik2015-06-151-63/+166
| | | | | | | | | Introduces new method for deletion of replica. This method is used if managed topology is enabled. part of https://fedorahosted.org/freeipa/ticket/4302 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipa-replica-manage: Do not allow topology altering commands from DL 1Petr Vobornik2015-06-151-16/+37
| | | | | | | | | | | | | | | | | | With Domain Level 1 and above, the usage of ipa-replica-manage commands that alter the replica topology is deprecated. Following commands are prohibited: * connect * disconnect Upon executing any of these commands, users are pointed out to the ipa topologysegment-* replacements. Exception is creation/deletion of winsync agreement. Part of: https://fedorahosted.org/freeipa/ticket/4302 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* install: Migrate ipa-replica-install to the install frameworkJan Cholasta2015-06-101-140/+11
| | | | | | https://fedorahosted.org/freeipa/ticket/4468 Reviewed-By: David Kupka <dkupka@redhat.com>
* install: Migrate ipa-server-install to the install frameworkJan Cholasta2015-06-081-361/+10
| | | | | | https://fedorahosted.org/freeipa/ticket/4468 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: Move private_ccache from ipaserver to ipapythonJan Cholasta2015-06-081-3/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/4468 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Move CA installation code into single module.David Kupka2015-06-082-227/+27
| | | | | | https://fedorahosted.org/freeipa/ticket/4468 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Import included profiles during install or upgradeFraser Tweedale2015-06-041-1/+0
| | | | | | | | | | | | Add a default service profile template as part of FreeIPA and format and import it as part of installation or upgrade process. Also remove the code that modifies the old (file-based) `caIPAserviceCert' profile. Fixes https://fedorahosted.org/freeipa/ticket/4002 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: Move ipa-replica-install code into a moduleJan Cholasta2015-05-291-596/+10
| | | | | | https://fedorahosted.org/freeipa/ticket/4468 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: Move ipa-server-install code into a moduleJan Cholasta2015-05-291-1042/+27
| | | | | | https://fedorahosted.org/freeipa/ticket/4468 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add Domain Level featureTomas Babej2015-05-262-8/+46
| | | | | | | https://fedorahosted.org/freeipa/ticket/5018 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* replica-manage: Properly delete nested entriesTomas Babej2015-05-261-1/+1
| | | | | | | | | | | Bad ordering of LDAP entries during replica removal resulted in a failure to delete replica and its services from cn=masters,cn=ipa,cn=etc,$SUFFIX. This patch enforces the correct ordering of entries resulting in proper removal of services before the host entry itself. https://fedorahosted.org/freeipa/ticket/5019 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix typo in ipa-server-upgrade man pageMartin Kosek2015-05-261-1/+1
|
* Server Upgrade: Move code from ipa-upgradeconfig to separate moduleMartin Basti2015-05-251-1410/+2
| | | | | | | | | This also prevent the script ipa-upgradeconfig execute upgrading. Upgrade of services is called from ipa-server-upgrade https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* merge KRA installation machinery to a single moduleMartin Babinsky2015-05-252-30/+20
| | | | | | | | | This is a prerequisite to further refactoring of KRA install/uninstall functionality in all IPA install scripts. https://fedorahosted.org/freeipa/ticket/4468 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Pylint: fix false positive warning for domainMartin Basti2015-05-191-1/+1
| | | | Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* DNS install: extract DNS installer into one moduleMartin Basti2015-05-193-261/+50
| | | | | | | | | | | | This is required modification to be able move to new installers. DNS subsystem will be installed by functions in this module in each of ipa-server-install, ipa-dns-install, ipa-replica-install install scripts. https://fedorahosted.org/freeipa/ticket/4468 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Server Upgrade: ipa-ldap-updater will not do overall upgradeMartin Basti2015-05-191-8/+2
| | | | | | | | | | | | ipa-ldap-updater is now just util which applies changes specified in update files or schema files. ipa-ldap-updater will not do overall server upgrade anymore, use ipa-server-upgrade instead. https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: Allow base64 encoded valuesMartin Basti2015-05-111-1/+7
| | | | | | | | | | | | | | This patch allows to use base64 encoded values in update files. Double colon ('::') must be used as separator between attribute name and base64 encoded value. add:attr::<base64-value> replace:attr::<old-base64-value>::<new-base64-value> https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Server Upgrade: remove CSV from upgrade filesMartin Basti2015-05-111-4/+2
| | | | | | | | | | | | | | | | | CSV values are not supported in upgrade files anymore Instead of add:attribute: 'first, part', second please use add:attribute: firts, part add:attribute: second Required for ticket: https://fedorahosted.org/freeipa/ticket/4984 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* update 'api.env.ca_host' if a different hostname is used during server installMartin Babinsky2015-05-071-3/+6
| | | | | | https://fedorahosted.org/freeipa/ticket/4936 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* ipa-server-install: deprecate manual setting of master KDC passwordMartin Babinsky2015-05-072-4/+12
| | | | | | | | | | | Option '-P' was used in older version of FreeIPA to set up KDC master password during server install. This is no longer neccessary or desirable since the password of sufficient strength can be generated automatically during installation. https://fedorahosted.org/freeipa/ticket/4516 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* move realm_to_serverid to installutils moduleMartin Basti2015-05-055-10/+13
| | | | | | | | | To avoid cyclic imports realm_to_serverid function had to be moved to installutils from dsinstance. Required for: https://fedorahosted.org/freeipa/ticket/4925 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Remove unneeded ip-address option in ipa-adtrust-installGabe2015-05-052-38/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/4575 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Server Upgrade: Verify version and platformMartin Basti2015-05-043-11/+60
| | | | | | | | | | | | | | | | | | | | | | | | Verify version and platform before upgrade or ipactl start|restart Upgrade: * do not allow upgrade on different platforms * do not allow upgrade data with higher version than build has Start: * do not start services if platform mismatch * do not start services if upgrade is needed * do not start services if data with higher version than build has New ipactl options: --skip-version-check: do not validate IPA version --ignore-service-failures (was --force): ignore if a service start fail and continue with starting other services --force: combine --skip-version-check and --ignore-service-failures https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: ipa-server-upgrade commandMartin Basti2015-05-044-0/+54
| | | | | | | https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
* Removed recommendation from ipa-adtrust-installThorsten Scherf2015-04-211-9/+0
| | | | | | | | | | In the wiki we say it's not longer necessary to make the IPA LDAP server not reachable by any AD domain controller. To be consistence, the setup tool should reflext this statement. https://fedorahosted.org/freeipa/ticket/4977 Reviewed-By: Gabe Alford <redhatrises@gmail.com>
* Server Upgrade: specify order of plugins in update filesMartin Basti2015-04-141-5/+6
| | | | | | | | | | | | * add 'plugin' directive * specify plugins order in update files * remove 'run plugins' options * use ldapupdater API instance in plugins * add update files representing former PreUpdate and PostUpdate order of plugins https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: use only LDAPI connectionMartin Basti2015-04-141-9/+0
| | | | | | | | Use only ldapi connection to execute upgrade https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
* Server Upgrade: remove --test optionMartin Basti2015-03-191-5/+0
| | | | | | | | | As --test option is not used for developing, and it is not recommended to test if upgrade will pass, this path removes it copmletely. https://fedorahosted.org/freeipa/ticket/3448 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipa-dns-install: use LDAPI to connect to DSMartin Babinsky2015-03-182-39/+24
| | | | | | | | | | | | | ipa-dns-install now uses LDAPI/autobind to connect to DS during the setup of DNS/DNSSEC-related service and thus makes -p option obsolete. Futhermore, now it makes more sense to use LDAPI also for API Backend connections to DS and thus all forms of Kerberos auth were removed. This fixes https://fedorahosted.org/freeipa/ticket/4933 and brings us closer to fixing https://fedorahosted.org/freeipa/ticket/2957 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-dns-install: use STARTTLS to connect to DSMartin Babinsky2015-03-181-4/+8
| | | | | | | BindInstance et al. now use STARTTLS to set up secure connection to DS during ipa-dns-install. This fixes https://fedorahosted.org/freeipa/ticket/4933 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipa-replica-prepare can only be created on the first masterGabe2015-03-131-2/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/4944 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* replica-install: Use different API instance for the remote serverJan Cholasta2015-03-051-131/+106
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipa-replica-prepare should document ipv6 optionsGabe2015-02-261-2/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/4877 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Uninstall configured services onlyMartin Basti2015-02-181-2/+8
| | | | | | | | | | Fixes: dnskeysyncisntance - requires a stored state to be uninstalled bindinstance - uninstal service only if bind was configured by IPA Ticket:https://fedorahosted.org/freeipa/ticket/4869 Reviewed-By: David Kupka <dkupka@redhat.com>
* Use 'remove-ds.pl' to remove DS instanceMartin Babinsky2015-01-271-1/+5
| | | | | | | | | | | The patch adds a function which calls 'remove-ds.pl' during DS instance removal. This should allow for a more thorough removal of DS related data during server uninstallation (such as closing custom ports, cleaning up slapd-* entries etc.) This patch is related to https://fedorahosted.org/freeipa/ticket/4487. Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix validation of ipa-restore optionsJan Cholasta2015-01-141-4/+4
| | | | | | | | | | | | | | | Fix restore mode checks. Do some of the existing checks earlier to make them effective. Check if --instance and --backend exist both in the filesystem and in the backup. Log backup type and restore mode before performing restore. Update ipa-restore man page. https://fedorahosted.org/freeipa/ticket/4797 Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Make certificate renewal process synchronizedJan Cholasta2015-01-131-0/+3
| | | | | | | | Synchronization is achieved using a global renewal lock. https://fedorahosted.org/freeipa/ticket/4803 Reviewed-By: David Kupka <dkupka@redhat.com>
* Restart dogtag when its server certificate is renewedJan Cholasta2015-01-131-3/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/4803 Reviewed-By: David Kupka <dkupka@redhat.com>
* Remove the removal of the ccacheSimo Sorce2015-01-081-1/+0
| | | | | | | | | | | | | | It is not necessary to remove the ccache on upgrades on modern IPA servers, even if the ccache contains stale data either it is re-initialized by mod_auth_kerb or a new ccache collection is created (if completely unrelated credentials were present), at least when using DIR or keyring ccaches. This line causes wrong SELinux labels to be set in the kernel keyring on uprades, which the cause the apache server to fail to use th ccache. https://fedorahosted.org/freeipa/ticket/4815 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Using wget to get status of CAMartin Basti2014-12-101-4/+0
| | | | | | | This is just workaround Ticket: https://fedorahosted.org/freeipa/ticket/4676 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Upgrade fix: masking named should be executed only onceMartin Basti2014-12-091-14/+16
| | | | | | | | | There was error in code, masking was executed more times, even it was succesful https://fedorahosted.org/freeipa/ticket/4755 Reviewed-By: David Kupka <dkupka@redhat.com>
* Prefer TCP connections to UDP in krb5 clientsNathaniel McCallum2014-12-081-0/+1
| | | | | | | | | | | | | | In general, TCP is a better fit for FreeIPA due to large packet sizes. However, there is also a specific need for TCP when using OTP. If a UDP packet is delivered to the server and the server takes longer to process it than the client timeout (likely), the OTP value will be resent. Unfortunately, this will cause failures or even lockouts. Switching to TCP avoids this problem altogether. https://fedorahosted.org/freeipa/ticket/4725 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* fix indentation in ipa-restore pagePetr Vobornik2014-12-021-2/+3
| | | | Reviewed-By: Petr Viktorin <pviktori@redhat.com>
* ipa-managed-entries requires password with bad passwordGabe2014-11-261-1/+4
| | | | | | | | - Add try/except when trying -p option to catch bad password https://fedorahosted.org/freeipa/ticket/4089 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Use singular in help metavars + update man pages.David Kupka2014-11-267-13/+20
| | | | | | https://fedorahosted.org/freeipa/ticket/4695 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add TLS 1.2 to the protocol list in mod_nss configJan Cholasta2014-11-251-0/+13
| | | | | | https://fedorahosted.org/freeipa/ticket/4653 Reviewed-By: Martin Kosek <mkosek@redhat.com>
* Show warning instead of error if CA did not startMartin Basti2014-11-201-0/+4
| | | | | | | | This is just workaround, checking if CA is working raises false positive exception during upgrade Ticket: https://fedorahosted.org/freeipa/ticket/4676 Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Fix named working directory permissionsMartin Basti2014-11-181-0/+14
| | | | | | | | Just adding dir to specfile doesnt work, because is not guarantee the named is installed, during RPM installation. Ticket: https://fedorahosted.org/freeipa/ticket/4716 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add help string on how to configure multiple DNS forwards for various cli toolsThorsten Scherf2014-11-143-3/+3
| | | | | | | | | | | | | | The man pages for various FreeIPA setup tools are more descriptive on how to configure multiple DNS forwarders than the corresponding cli help. This patch makes the cli help more verbose now for the following tools: * ipa-dns-install * ipa-replica-install * ipa-server-install https://fedorahosted.org/freeipa/ticket/4465 Reviewed-By: Martin Basti <mbasti@redhat.com>
generated by cgit (git 2.34.1) at 2026-01-25 23:40:56 +0000