summaryrefslogtreecommitdiffstats
path: root/install
Commit message (Collapse)AuthorAgeFilesLines
...
* Clarify meaning of --domain and --realm in installersStanislav Laznicka2017-01-053-58/+48
| | | | | | | | Man pages need bigger overhaul. Take this as hot-fix for FAQ. https://fedorahosted.org/freeipa/ticket/6574 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Enumerate available options in IPA installerAbhijeet Kasurde2017-01-031-3/+6
| | | | | | | | | | Fix adds enumerated list of available options in IPA server installer and IPA CA installer help options Fixes https://fedorahosted.org/freeipa/ticket/5435 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove "Request Certificate with SubjectAltName" permissionFraser Tweedale2016-12-211-15/+0
| | | | | | | | | | | | | | | | | | subjectAltName is required or relevant in most certificate use cases (esp. TLS, where carrying DNS name in Subject DN CN attribute is deprecated). Therefore it does not really make sense to have a special permission for this, over and above "request certificate" permission. Furthermore, we already do rigorously validate SAN contents again the subject principal, and the permission is waived for self-service requests or if the operator is a host principal. So remove the permission, the associated virtual operation, and the associated code in cert_request. Fixes: https://fedorahosted.org/freeipa/ticket/6526 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* password policy: Add explicit default password policy for hosts and servicesDavid Kupka2016-12-142-0/+134
| | | | | | | | | | | | | | | | Set explicitly krbPwdPolicyReference attribute to all hosts (entries in cn=computers,cn=accounts), services (entries in cn=services,cn=accounts) and Kerberos services (entries in cn=$REALM,cn=kerberos). This is done using DS's CoS so no attributes are really added. The default policies effectively disable any enforcement or lockout for hosts and services. Since hosts and services use keytabs passwords enforcements doesn't make much sense. Also the lockout policy could be used for easy and cheap DoS. https://fedorahosted.org/freeipa/ticket/6561 Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
* WebUI: Hide incorrectly shown buttons on hosts tab in ID ViewsPavel Vomacka2016-12-121-0/+1
| | | | | | | | | | | | | There was missing default value for evaluator adapter. In that case the adapter variable could be undefined and it crashes on building adapter. Therefore it did not evaluate all evaluators. That is the reason why 'Delete' and 'Add' buttons were incorrectly shown. Default value is now set to empty object. https://fedorahosted.org/freeipa/ticket/6546 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* adtrust: remove FILE: prefix from 'dedicated keytab file' in smb.confAlexander Bokovoy2016-12-121-1/+1
| | | | | | | | | | | | | | | | | | Samba 4.5 does not allow to specify access mode for the keytab (FILE: or WRFILE:) from external sources. Thus, change the defaults to a path (implies FILE: prefix) while Samba Team fixes the code to allow the access mode prefix for keytabs. On upgrade we need to replace 'dedicated keytab file' value with the path to the Samba keytab that FreeIPA maintains. Since the configuration is stored in the Samba registry, we use net utility to manipulate the configuration: net conf setparm global 'dedicated keytab file' /etc/samba/samba.keytab Fixes https://fedorahosted.org/freeipa/ticket/6551 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* ipactl: pass api as argument to servicesMartin Basti2016-12-121-7/+7
| | | | | | | Commit 6409abf1 removes hard dependency of ipalib in ipalatform to avoid cyclic dependenies, this commit updates ipactl accordingly Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Configure Anonymous PKINIT on server installSimo Sorce2016-12-123-1/+111
| | | | | | | | | | | | Allow anonymous pkinit to be used so that unenrolled hosts can perform FAST authentication (necessary for 2FA for example) using an anonymous krbtgt obtained via Pkinit. https://fedorahosted.org/freeipa/ticket/5678 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Revert "upgrade: add replica bind DN group check interval to CA topology config"Martin Babinsky2016-12-091-1/+0
| | | | | | | | | This reverts commit 8c6a10ceddb4fce9a3dd4a334e6804800b5c89f9 since it leads to errors in upgrade of first master. https://fedorahosted.org/freeipa/ticket/6508 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipautil: check for open ports on all resolved IPsTomas Krizek2016-12-071-2/+3
| | | | | | | | | | When a hostname is provided to host_port_open, it should check if ports are open for ALL IPs that are resolved from the hostname, instead of checking whether the port is reachable on at least one of the IPs. https://fedorahosted.org/freeipa/ticket/6522 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* replica-conncheck: improve message loggingTomas Krizek2016-12-061-47/+51
| | | | | | | | | | Make sure all messages displayed on screen to the user can be found in the log as well. The messages are also logged if the script is ran in quiet mode. https://fedorahosted.org/freeipa/ticket/6497 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipa-replica-conncheck: fix race conditionTomas Krizek2016-12-061-6/+11
| | | | | | | | | | When the thread that opens ports would execute notify() before the original thread could call wait(), the original thread would wait indefinitely for a notify() call. https://fedorahosted.org/freeipa/ticket/6487 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Set explicit confdir option for global contextsChristian Heimes2016-12-0218-27/+47
| | | | | | | | | | | | | | | | | | | | | | | | | Some API contexts are used to modify global state (e.g. files in /etc and /var). These contexts do not support confdir overrides. Initialize the API with an explicit confdir argument to paths.ETC_IPA. The special contexts are: * backup * cli_installer * installer * ipctl * renew * restore * server * updates The patch also corrects the context of the ipa-httpd-kdcproxy script to 'server'. https://fedorahosted.org/freeipa/ticket/6389 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-replica-conncheck: do not close listening ports until requiredTomas Krizek2016-12-011-38/+113
| | | | | | | | | | | | | | | | | | | Previously, a separate thread would be created for each socket used for conncheck. It would also time out after one second, after which it would be closed and reopened again. This caused random failures of conncheck. Now all sockets are handled in a single thread and once the server starts to listen on a port, it does not close that connection until the script finishes. Only IPv6 socket is used for simplicity, since it can handle both IPv6 and IPv4 connections. This requires IPv6 kernel support, which is required by other parts of IPA anyway. https://fedorahosted.org/freeipa/ticket/6487 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* upgrade: add replica bind DN group check interval to CA topology configMartin Babinsky2016-11-291-0/+1
| | | | | | | | | | Without this attribute explicitly set the replication plugin won't recognize updates from members of 'replication managers' sysaccount group, leading to stuck replica CA installation. https://fedorahosted.org/freeipa/ticket/6508 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Build: properly integrate loader.js into build systemPetr Spacek2016-11-291-0/+9
| | | | | | | | | | AC_CONFIG_FILES in configure.ac works well only with Makefiles. Other files have to be handled by Makefile.am so depedencies are tracked properly. https://fedorahosted.org/freeipa/ticket/6498 Reviewed-By: Martin Basti <mbasti@redhat.com>
* ipaclient: move install modules to the install subpackageJan Cholasta2016-11-292-3/+3
| | | | | | | | | | | | The ipa_certupdate, ipachangeconf, ipadiscovery and ntpconf modules depend on ipaplatform. Move them to ipaclient.install as they are used only from the client installer. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* constants: remove CACERTJan Cholasta2016-11-292-12/+11
| | | | | | | | | | CACERT depends on ipaplatform. Replace all uses of CACERT with paths.IPA_CA_CRT and remove CACERT. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipalib: move certstore to the install subpackageJan Cholasta2016-11-291-1/+2
| | | | | | | | | | The certstore module depends on ipaplatform. Move it to ipalib.install, as it is used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: move kinit functions to ipalib.installJan Cholasta2016-11-294-6/+9
| | | | | | | | | | | kinit_password() depends on ipaplatform. Move kinit_password() as well as kinit_keytab() to a new ipalib.install.kinit module, as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: move is_fips_enabled() to ipaplatform.tasksJan Cholasta2016-11-291-3/+2
| | | | | | | | The FIPS setting is platform-specific. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: remove get_domain_name()Jan Cholasta2016-11-292-4/+0
| | | | | | | | | | | get_domain_name() and related code depends on ipaplatform. Replace all uses of get_domain_name() with api.env.domain and remove get_domain_name() and all of the related code. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: remove SHARE_DIR and PLUGIN_SHARE_DIRJan Cholasta2016-11-291-1/+2
| | | | | | | | | | | SHARE_DIR and PLUGIN_SHARE_DIR depend on ipaplatform. Replace all uses of SHARE_DIR with paths.USR_SHARE_IPA_DIR and remove both SHARE_DIR and PLUGIN_SHARE_DIR. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipapython: move certmonger and sysrestore to ipalib.installJan Cholasta2016-11-291-1/+2
| | | | | | | | | | The certmonger and sysrestore modules depend on ipaplatform. Move them to ipalib.install as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipapython: move dnssec, p11helper and secrets to ipaserverJan Cholasta2016-11-292-3/+3
| | | | | | | | | | | The dnssec and secrets subpackages and the p11helper module depend on ipaplatform. Move them to ipaserver as they are used only on the server. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* custodiainstance: automatic restart on config file updateJan Cholasta2016-11-291-1/+1
| | | | | | | | | | | Automatically restart Custodia during IPA server upgrade if custodia.conf was updated. Use the new store class name in custodia.conf.template. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Python3 pylint fixesChristian Heimes2016-11-257-6/+8
| | | | | | | | | | | Sprinkle 'pylint disable' comments over the code base to silence a bunch of pylint warnings on Python 3. All silenced warnings are harmless and not bugs. https://fedorahosted.org/freeipa/ticket/4985 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Add main guards to a couple of Python scriptsChristian Heimes2016-11-241-1/+2
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* services: replace admin_conn with api.Backend.ldap2Tomas Krizek2016-11-221-3/+3
| | | | | | | | | Since service.admin_conn is only an alias to api.Backend.ldap2, replace it everywhere with the explicit api.Backend.ldap2 instead. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Build: fix file dependencies for make-css.shPetr Spacek2016-11-161-1/+5
| | | | | | | | | | Some of .less files included by ipa.less were not listed in the Makefile.am so some changes might not trigger rebuild. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: remove incorrect use of MAINTAINERCLEANFILESPetr Spacek2016-11-1624-120/+0
| | | | | | | | | | | | | Automake manual section 13 What Gets Cleaned says that make maintainer-clean should not remove files necessary for subsequent runs of ./configure. It practically means that all usage of MAINTAINERCLEANFILES were incorrect so I've removed them. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Fix renewal lock issues on installationFlorence Blanc-Renaud2016-11-163-12/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | - Make sure that the file /var/run/ipa/renewal.lock is deleted upon uninstallation, in order to avoid subsequent installation issues. - Modify certmonger renewal script: restart the http/dirsrv services only if they were already running - Cleanup certmonger ra renewal script: no need to restart httpd - Reorder during http install: request the SSL cert before adding ipa-service-guard Rationale: when a CA helper is modified, certmonger launches the helper with various operations (FETCH_ROOTS, ...) If the CA helper is once again modified, the on-going helper is killed. This can lead to ipa-service-guard being killed and not releasing the renew lock. If the SSL cert is requested with IPA helper before ipa-service-guard is added, we avoid this locking issue. Part of the refactoring effort, certificates sub-effort. https://fedorahosted.org/freeipa/ticket/6433 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* Build: move web UI file installation from SPEC to Makefile.amPetr Spacek2016-11-152-0/+17
| | | | | | | | This is next step towards fully functional make install. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: move server directory handling from SPEC to Makefile.amPetr Spacek2016-11-151-6/+5
| | | | | | | | This is next step towards fully functional make install. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Update man page for ipa-adtrust-install by removing --no-msdcs optionPetr Spacek2016-11-141-27/+0
| | | | | | | https://fedorahosted.org/freeipa/ticket/6480 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* dns: check if container exists using ldapiTomas Krizek2016-11-112-4/+2
| | | | | | | | | | | Previously an adhoc connection was established for checking if dns(sec) container exists. A simple or external bind was used. Instead, always connect with ldapi through api.Backend.ldap2. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: migrate server installers to the new class hierarchyJan Cholasta2016-11-112-27/+4
| | | | | | | | | Migrate ipa-server-install and ipa-replica-install from the old installer classes to the new installer class hierarchy classes. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: improve CLI positional argument handlingJan Cholasta2016-11-111-2/+0
| | | | | | | | | | | | | Instead of specifying which knobs should be positional arguments in cli.install_tool(), do it using a flag in knob definition, where the rest of CLI configuration is. As a side effect, the usage string for CLI tools can now be generated automatically. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Move httpd restart to DNS installationStanislav Laznicka2016-11-111-10/+1
| | | | | | | | | | | | Web service needs restarting after bindinstance is created to pick up changes done to /etc/resolv.conf. This change should be included anytime DNS is installed therefore it makes sense to move it to the common code. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* install: merge all CA install code paths into oneJan Cholasta2016-11-111-23/+3
| | | | | | | | | Merge CA install code paths use in ipa-server-install, ipa-replica-install in either domain level and ipa-ca-install into one. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* replica install: use one remote CA host name everywhereJan Cholasta2016-11-111-5/+3
| | | | | | | | | Remote master and CA host names may differ. Always use the remote CA host name and never the remote master host name in CA replica install. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Moved update of DNA plugin among update pluginsStanislav Laznicka2016-11-113-9/+9
| | | | | | | | | | | | | | | | | To make the code more general, moved the update_dna_shared_config among other update plugins. Bugfix: DNA shared config connection protocol was compared to a method string which would result in a try to always update it even if there was no need to. https://fedorahosted.org/389/ticket/48373 causes that two shared DNA config entries are created instead of one. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move ds.replica_populate to an update pluginStanislav Laznicka2016-11-111-0/+1
| | | | | | | | | Replica populate can be applied with other update plugins. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Coverity - null pointer dereferencePavel Vomacka2016-11-101-1/+1
| | | | | | Add check which protect from calling method of null. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Coverity - accessing attribute of variable which can point to nullPavel Vomacka2016-11-101-2/+2
| | | | | | Added check whether variable is pointing to null or not. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Coverity - opens dialog which might not be createdPavel Vomacka2016-11-101-1/+5
| | | | | | Check whether dialog object is created before opening it. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Coverity - iterating over variable which could be nullPavel Vomacka2016-11-101-4/+4
| | | | | | Change condition to check also variable which could be null. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Coverity - null pointer dereferencePavel Vomacka2016-11-101-3/+3
| | | | | | | The 'obj' variable could be null, so there could be error when it is used. A new check that 'obj' is not false is added. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Coverity - true branch can't be executedPavel Vomacka2016-11-101-1/+2
| | | | | | | The 'result' variable is always false because of previous condition. Therefore there is direct assignment. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* Coverity - true branch can't be executedPavel Vomacka2016-11-101-1/+2
| | | | | | | The 'data' variable is always false because of previous condition. Therefore there is direct assignment. Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
generated by cgit (git 2.34.1) at 2025-08-31 09:36:27 +0000