summaryrefslogtreecommitdiffstats
path: root/ipaplatform/base
Commit message (Collapse)AuthorAgeFilesLines
* Configure Anonymous PKINIT on server installkdc-pkinitSimo Sorce2016-12-081-1/+2
| | | | | | | | | | Allow anonymous pkinit to be used so that unenrolled hosts can perform FAST authentication (necessary for 2FA for example) using an anonymous krbtgt obtained via Pkinit. https://fedorahosted.org/freeipa/ticket/5678 Signed-off-by: Simo Sorce <simo@redhat.com>
* Remove BIN_FALSE and BIN_TRUEChristian Heimes2016-12-021-2/+0
| | | | | | | https://fedorahosted.org/freeipa/ticket/6474 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipaclient: remove hard dependency on ipaplatformJan Cholasta2016-11-291-15/+0
| | | | | | | | Hard-code the user cache directory path in ipaclient.remote_plugins.schema. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipapython: remove hard dependency on ipaplatformJan Cholasta2016-11-291-1/+0
| | | | | | | | | | | | | | Use hard-coded paths to certutil, pk12util and openssl in certdb if ipaplatform is not available. Hard-coded the path to setpasswd in ipautil.run() doc string. Remove ipaplatform dependency from ipapython's setup.py and add ipapython dependency to ipaplatform's setup.py. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: move is_fips_enabled() to ipaplatform.tasksJan Cholasta2016-11-291-0/+3
| | | | | | | | The FIPS setting is platform-specific. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: remove SHARE_DIR and PLUGIN_SHARE_DIRJan Cholasta2016-11-291-1/+0
| | | | | | | | | | | SHARE_DIR and PLUGIN_SHARE_DIR depend on ipaplatform. Replace all uses of SHARE_DIR with paths.USR_SHARE_IPA_DIR and remove both SHARE_DIR and PLUGIN_SHARE_DIR. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* certdb: use a temporary file to pass password to pk12utilJan Cholasta2016-11-291-1/+0
| | | | | | | | | | | Currently the PKCS#12 file password is passed via stdin and pk12util reads it from /dev/stdin, which is platform-specific. Use a temporary file instead. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* paths: remove DEV_NULLJan Cholasta2016-11-291-1/+0
| | | | | | | | | | | The platform-specific path to /dev/null is provided by the Python standard library in os.devnull. Replace all uses of paths.DEV_NULL with os.devnull and remove DEV_NULL. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Break ipaplatform / ipalib import cycle of hellChristian Heimes2016-11-241-7/+15
| | | | | | | | | | | Here is an attempt to break the import cycle of hell between ipaplatform and ipalib. All services now pass an ipalib.api object to services.service(). RedHatServices.__init__() still needs to do a local import because it initializes its wellknown service dict with service instances. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove references to ds_newinst.plFraser Tweedale2016-11-211-1/+0
| | | | | | | | ds_newinst.pl was removed from 389 DS over 9 years ago. Remove references to it. Fixes: https://fedorahosted.org/freeipa/ticket/6496 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Build: replace ipaplatform magic with symlinks generated by configurePetr Spacek2016-10-241-4/+1
| | | | | | | | | | | | | | | The original approach with __path__ implemented by 8f98fa1bd5f1da207fab6f89b75e0cdc19d00797 broke Pylint: We decided to resort back to symlinks as it is easiest solution which does not break pylint in weird ways. This commit introduces configure --with-ipaplatform option. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Replace ipaplatform's symlinks with a meta importerChristian Heimes2016-10-201-1/+4
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Purge obsolete firefox extensionTimo Aaltonen2016-10-131-4/+0
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* pylint: fix simplifiable-if-statement warningsJan Barta2016-09-221-8/+4
| | | | | | | fix inefficient if statements, enable pylint check Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* client: remove hard dependency on pam_krb5Jan Cholasta2016-09-191-0/+2
| | | | | | | | | If ipa-client-install is executed with --no-sssd, check if pam_krb5 is available before proceeding with the install. https://fedorahosted.org/freeipa/ticket/5557 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* support schema files from third-party pluginsAlexander Bokovoy2016-08-191-0/+1
| | | | | | | | | | | | | Allow upgrade process to include schema files from third-party plugins installed in /usr/share/ipa/schema.d/*.schema. The directory /usr/shar/eipa/schema.d is owned by the server-common subpackage and therefore third-party plugins should depend on freeipa-server-common (ipa-server-common) package in their package dependencies. Resolves: https://fedorahosted.org/freeipa/ticket/5864 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: Call hostnamectl set-hostname only if --hostname option is usedPetr Spacek2016-08-101-5/+2
| | | | | | | | | | This commit also splits hostname backup and configuration into two separate functions. This allows us to backup hostname without setting it at the same time. https://fedorahosted.org/freeipa/ticket/6071 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-backup: backup /etc/tmpfiles.d/dirsrv-<instance>.confMartin Basti2016-08-091-0/+1
| | | | | | | | | | This file allows daemon tmpfiles.d to re-create the dirs in volatile directories like /var/run or /var/lock. Without this file Dirsrv will not start. https://fedorahosted.org/freeipa/ticket/6165 Reviewed-By: Petr Spacek <pspacek@redhat.com>
* compat: Save server's API version in for pre-schema serversDavid Kupka2016-08-031-0/+15
| | | | | | | | | | | | When client comunicates with server that doesn't support 'schema' command it needs to determine its api version to be able to use the right compat code. Storing information about server version reduces the need to call 'env' or 'ping' command only to first time the server is contacted. https://fedorahosted.org/freeipa/ticket/6069 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Correct path to HTTPD's systemd service directoryChristian Heimes2016-08-021-2/+2
| | | | | | | | | | | | | Ticket #5681 and commit 586fee293f42388510fa5436af19460bbe1fdec5 changed the location of the ipa.conf for Apache HTTPD. The variables SYSTEMD_SYSTEM_HTTPD_D_DIR and SYSTEMD_SYSTEM_HTTPD_IPA_CONF point to the wrong directory /etc/systemd/system/httpd.d/. The path is corrected to /etc/systemd/system/httpd.service.d/. https://fedorahosted.org/freeipa/ticket/6158 https://bugzilla.redhat.com/show_bug.cgi?id=1362537 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Abhijeet Kasurde <akasurde@redhat.com>
* CI tests: improve log collectingMartin Basti2016-07-261-0/+1
| | | | | | | | We should collect as much as possible relevant logs to be able do better investigation from test automation Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* unite log file name of ipa-ca-installPetr Vobornik2016-07-211-1/+0
| | | | | | | | | | | | | | | | | | | ipa-ca-install said that it used /var/log/ipareplica-ca-install.log but in fact it used /var/log/ipaserver-ca-install.log This patch unites it to ipareplica-ca-install.log It was chosen because of backwards compatibility - ipareplica-ca-install was more commonly used. ipaserver-ca-install.log was used only in rare CA less -> CA installation. https://fedorahosted.org/freeipa/ticket/6086 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Do not allow installation in FIPS modeFlorence Blanc-Renaud2016-06-291-0/+1
| | | | | | | https://fedorahosted.org/freeipa/ticket/5761 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Fixes CA always being presented as runningStanislav Laznicka2016-06-151-2/+2
| | | | | | | | | | Even after manually stopping the pki-tomcatd service instance the service's is_running() method would still return True. https://fedorahosted.org/freeipa/ticket/5898 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add custodia store for lightweight CA key replicationFraser Tweedale2016-06-091-0/+1
| | | | | | | | | | | | | | | Due to limitations in Dogtag's use of NSSDB, importing private keys must be done by the Dogtag Java process itself. This requires a PKIArchiveOptions format (signing key wrapped with host CA key) - PKCS #12 cannot be used because that would require decrypting the key in Dogtag's memory, albeit temporarily. Add a new custodia store that executes a 'pki' command to acquire the wrapped key. Part of: https://fedorahosted.org/freeipa/ticket/4559 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Added krb5.conf.d/ to included dirs in krb5.confStanislav Laznicka2016-06-051-0/+1
| | | | | | | | | The include of /etc/krb5.conf.d/ is required for crypto-policies to work properly https://fedorahosted.org/freeipa/ticket/5912 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Tasks: raise NotImplementedError for not implemented methodsMartin Basti2016-04-261-15/+15
| | | | | | | | | | | | Is safer to raise error than trying to find what is wrong with method that is not correctly overriden The new method set_hostname has been added which should be overriden on other platforms. https://fedorahosted.org/freeipa/ticket/5794 Reviewed-By: David Kupka <dkupka@redhat.com>
* Remove deprecated hostname restoration from Fedora18Martin Basti2016-04-261-2/+0
| | | | | | | | This is not needed on new Fedora, because restore will not be effective. https://fedorahosted.org/freeipa/ticket/5794 Reviewed-By: David Kupka <dkupka@redhat.com>
* Always set hostnameMartin Basti2016-04-262-3/+11
| | | | | | | | | | | This prevents cases when hostname on system is set inconsistently (transient and static hostname differs) and may cause IPA errors. This commit ensures that all hostnames are set properly. https://fedorahosted.org/freeipa/ticket/5794 Reviewed-By: David Kupka <dkupka@redhat.com>
* Configure httpd service from installer instead of directly from RPMMartin Basti2016-04-222-0/+11
| | | | | | | | | | | | | | File httpd.service was created by RPM, what causes that httpd service may fail due IPA specific configuration even if IPA wasn't installed or was uninstalled (without erasing RPMs). With this patch httpd service is configured by httpd.d/ipa.conf during IPA installation and this config is removed by uninstaller, so no residual http configuration related to IPA should stay there. https://fedorahosted.org/freeipa/ticket/5681 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Use netifaces module instead of 'ip' commandMartin Basti2016-04-141-1/+0
| | | | | | | | | Netifaces allows to get addresses from local interfaces of the host in safer way than parsing output of the ip command. https://fedorahosted.org/freeipa/ticket/5591 Reviewed-By: David Kupka <dkupka@redhat.com>
* Fix kdc.conf.template to use ipaplatform.paths.Timo Aaltonen2016-03-231-0/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: David Kupka <dkupka@redhat.com>
* ipaplatform: Move remaining user/group constants to ipaplatform.constants.Timo Aaltonen2016-03-232-12/+5
| | | | | | | | | Use ipaplatform.constants in every corner instead of importing other bits or calling some platform specific things, and remove most of the remaining hardcoded uid's. https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: David Kupka <dkupka@redhat.com>
* Move user/group constants for PKI and DS into ipaplatformChristian Heimes2016-03-221-0/+4
| | | | | | | https://fedorahosted.org/freeipa/ticket/5619 Reviewed-By: David Kupka <dkupka@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* pylint: remove bare exceptMartin Basti2016-03-221-2/+2
| | | | | | | Bare except should not be used. Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Lukas Slebodnik <lslebodn@redhat.com>
* Use platform path constant for SSSD log dirMartin Basti2016-03-161-0/+1
| | | | | | | The path to SSSD log directory is platform specific and should be in ipaplatform module. Reviewed-By: David Kupka <dkupka@redhat.com>
* Move freeipa certmonger helpers to libexecdir.Timo Aaltonen2016-02-261-1/+1
| | | | | | | | | | | The scripts in this directory are simple python scripts, nothing arch-specific in them. Having them under libexec would simplify the code a bit too, since there would be no need to worry about lib vs lib64 (which also cause trouble on Debian). https://fedorahosted.org/freeipa/ticket/5586 Reviewed-By: David Kupka <dkupka@redhat.com>
* Upgrade: Fix upgrade of NIS Server configurationMartin Basti2016-01-111-0/+1
| | | | | | | | | | | | | Former upgrade file always created the NIS Server container, that caused the ipa-nis-manage did not set all required NIS maps. Default creation of container has been removed. Updating of NIS Server configuration and NIS maps is done only if the NIS Server container exists. https://fedorahosted.org/freeipa/ticket/5507 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix: replace mkdir with chmodMartin Basti2015-12-221-1/+1
| | | | | | | | In original patches, extra mkdir has been added instead of chmod. https://fedorahosted.org/freeipa/ticket/5520 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Explicitly call chmod on newly created directoriesMartin Basti2015-12-141-0/+1
| | | | | | | | | Without calling os.chmod(), umask is effective and may cause that directory is created with permission that causes failure. This can be related to https://fedorahosted.org/freeipa/ticket/5520 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* dogtaginstance: remove unused function 'check_inst'Fraser Tweedale2015-12-141-1/+0
| | | | Reviewed-By: Tomas Babej <tbabej@redhat.com>
* Refactor ipautil.runPetr Viktorin2015-12-141-21/+20
| | | | | | | | | | | | | | | | | | | | | The ipautil.run function now returns an object with returncode and output are accessible as attributes. The stdout and stderr of all commands are logged (unless skip_output is given). The stdout/stderr contents must be explicitly requested with a keyword argument, otherwise they are None. This is because in Python 3, the output needs to be decoded, and that can fail if it's not decodable (human-readable) text. The raw (bytes) output is always available from the result object, as is "leniently" decoded output suitable for logging. All calls are changed to reflect this. A use of Popen in cainstance is changed to ipautil.run. Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Migrate wget references and usage to curlGabe2015-12-111-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5458 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: drop support for Dogtag 9Jan Cholasta2015-11-252-28/+10
| | | | | | | | | | | Dogtag 9 CA and CA DS install and uninstall code was removed. Existing Dogtag 9 CA and CA DS instances are disabled on upgrade. Creating a replica of a Dogtag 9 IPA master is still supported. https://fedorahosted.org/freeipa/ticket/5197 Reviewed-By: David Kupka <dkupka@redhat.com>
* Drop configure.jarMartin Basti2015-11-131-2/+0
| | | | | | | | | Configure.jar used to be used with firefox version < 10 which is not supported anymore, thus this can be removed. https://fedorahosted.org/freeipa/ticket/5144 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
* ipaplatform: Add NTPD_OPTS_VAR and NTPD_OPTS_QUOTE to constantsTimo Aaltonen2015-11-041-0/+4
| | | | | | https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipaplatform: Add SECURE_NFS_VAR to constantsTimo Aaltonen2015-11-041-0/+2
| | | | | | https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipaplatform: Add NAMED_USER to constantsTimo Aaltonen2015-11-041-0/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* ipaplatform: Add HTTPD_USER to constants, and use it.Timo Aaltonen2015-11-041-0/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: Tomas Babej <tbabej@redhat.com>
* topology: manage ca replication agreementsPetr Vobornik2015-10-151-0/+1
| | | | | | | | | | | | | Configure IPA so that topology plugin will manage also CA replication agreements. upgrades if CA is congigured: - ipaca suffix is added to cn=topology,cn=ipa,cn=etc,$SUFFIX - ipaReplTopoManagedSuffix: o=ipaca is added to master entry - binddngroup is added to o=ipaca replica entry Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2026-04-05 04:25:40 +0000