summaryrefslogtreecommitdiffstats
path: root/ipaplatform
Commit message (Collapse)AuthorAgeFilesLines
* Move certauth configuration into a server krb5.conf templateRobbie Harwood2019-09-101-0/+1
| | | | | | | Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
* authconfig.py: restore user-nsswitch.conf at uninstall timeFrançois Cami2019-08-291-0/+4
| | | | | | | | | | | Calling authselect at uninstall time before restoring user-nsswitch.conf would result in a sudoers entry in nsswitch.conf which is not activated in the default sssd authselect profile. Make sure user-nsswitch.conf is restored before calling authselect. Fixes: https://pagure.io/freeipa/issue/8054 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* Use tasks to configure automount nsswitch settingsRob Critenden2019-08-283-0/+173
| | | | | | | | | | | | | | | | | | | | | authselect doesn't allow one to directly write to /etc/nsswitch.conf. It will complain bitterly if it detects it and will refuse to work until reset. Instead it wants the user to write to /etc/authselect/user-nsswitch.conf and then it will handle merging in any differences. To complicate matters some databases are not user configurable like passwd, group and of course, automount. There are some undocumented options to allow one to override these though so we utilize that. tasks are used so that authselect-based installations can still write directly to /etc/nsswitch.conf and operate as it used to. Reviewed-By: Francois Cami <fcami@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Restore SELinux context for p11-kit config overridesAlexander Bokovoy2019-08-091-0/+1
| | | | | | | | | | | | | | When 74e09087 started disabling softshm2 module in p11-kit-proxy, we missed to restore SELinux context on the configuration override creation. We don't need an explicit restore_context() when removing the override because restore_file() already calls restore_context(). Related: https://pagure.io/freeipa/issue/7810 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Fix `test_webui.test_selinuxusermap`Stanislav Levin2019-07-151-5/+5
| | | | | | | | | | | | | | | | | | | | | | A previous refactoring of SELinux tests has have a wrong assumption about the user field separator within ipaSELinuxUserMapOrder. That was '$$', but should be just '$'. Actually, '.ldif' and '.update' files are passed through Python template string substitution: > $$ is an escape; it is replaced with a single $. > $identifier names a substitution placeholder matching > a mapping key of "identifier" This means that the text to be substituted on should not be escaped. The wrong ipaSELinuxUserMapOrder previously set will be replaced on upgrade. Fixes: https://pagure.io/freeipa/issue/7996 Fixes: https://pagure.io/freeipa/issue/8005 Signed-off-by: Stanislav Levin <slev@altlinux.org> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
* Use nis-domainname.service on all RH platformsChristian Heimes2019-07-042-17/+1
| | | | | | | | | | RHEL 8 and Fedora >= 29 use "nis-domainname.service" as service name for domainname service. Remove special code in ipaplatform.rhel and for Fedora < 28. Only Fedora 29+ is supported by IPA 4.8. Fixes: https://pagure.io/freeipa/issue/8004 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Use system-wide crypto policy for TLS ciphersChristian Heimes2019-07-022-5/+5
| | | | | | | | | | IPA now uses the system-wide crypto policy for TLS ciphers on RHEL. It's also now possible to keep the default policy by setting TLS_HIGH_CIPHERS to None. Fixes: https://pagure.io/freeipa/issue/7998 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Use only TLS 1.2 by defaultChristian Heimes2019-07-012-3/+4
| | | | | | | | | | | | | | | | | TLS 1.3 is causing some trouble with client cert authentication. Conditional client cert authentication requires post-handshake authentication extension on TLS 1.3. The new feature is not fully implemented yet. TLS 1.0 and 1.1 are no longer state of the art and now disabled by default. TLS 1.2 works everywhere and supports PFS. Related: https://pagure.io/freeipa/issue/7667 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* For Fedora and RHEL use system-wide crypto policy for mod_sslRob Crittenden2019-07-013-0/+17
| | | | | | | | | | | | | | Drop the SSLProtocol directive for Fedora and RHEL systems. mod_ssl will use crypto policies for the set of protocols. For Debian systems configure a similar set of protocols for what was previously configured, but do it in a different way. Rather than iterating the allowed protocols just include the ones not allowed. Fixes: https://pagure.io/freeipa/issue/7667 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Make use of single configuration point for SELinuxStanislav Levin2019-07-011-0/+14
| | | | | | | | | | | | | | | | | | | | | For now, FreeIPA supports SELinux things as they are in RedHat/Fedora. But different distributions may have their own SELinux customizations. This moves SELinux configuration out to platform constants: - SELINUX_MCS_MAX - SELINUX_MCS_REGEX - SELINUX_MLS_MAX - SELINUX_MLS_REGEX - SELINUX_USER_REGEX - SELINUX_USERMAP_DEFAULT - SELINUX_USERMAP_ORDER and applies corresponding changes to the test code. Fixes: https://pagure.io/freeipa/issue/7996 Signed-off-by: Stanislav Levin <slev@altlinux.org> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-client-samba: a tool to configure Samba domain member on IPA clientAlexander Bokovoy2019-06-291-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduces new utility to configure Samba on an IPA domain member. The tool sets up Samba configuration and internal databases, creates cifs/... Kerberos service and makes sure that a keytab for this service contains the key with the same randomly generated password that is set in the internal Samba databases. Samba configuration is created by querying an IPA master about details of trust to Active Directory configuration. All known identity ranges added to the configuration to allow Samba to properly handle them (read-only) via idmap_sss. Resulting configuration allows connection with both NTLMSSP and Kerberos authentication for IPA users. Access controls for the shared content should be set by utilizing POSIX ACLs on the file system under a specific share. The utility is packaged as freeipa-client-samba package to allow pulling in all required dependencies for Samba and cifs.ko (smb3.ko) kernel module. This allows an IPA client to become both an SMB server and an SMB client. Fixes: https://pagure.io/freeipa/issue/3999 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* adtrust: update Samba domain controller keytab with host keysAlexander Bokovoy2019-06-291-0/+1
| | | | | | | | | | | | | | | | | | | | | | | When DCERPC clients use Kerberos authentication, they use a service ticket to host/domain.controller because in Active Directory any service on the host is an alias to the machine account object. In FreeIPA each Kerberos service has own keys so host/.. and cifs/.. do not share the same keys. It means Samba suite needs to have access to host/.. keytab entries to validate incoming DCERPC requests. Unfortunately, MIT Kerberos has no means to operate on multiple keytabs at the same time and Samba doesn't implement this either. We cannot use GSS-Proxy as well because Samba daemons are running under root. As a workaround, copy missing aes256 and aes128 keys from the host keytab. SMB protocol doesn't use other encryption types and we don't have rc4-hmac for the host either. Fixes: https://pagure.io/freeipa/issue/3999 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipaserver.install.installutils: move commonly used utils to ipapython.ipautilAlexander Bokovoy2019-06-292-0/+13
| | | | | | | | | | | | When creating ipa-client-samba tool, few common routines from the server installer code became useful for the client code as well. Move them to ipapython.ipautil and update references as well. Fixes: https://pagure.io/freeipa/issue/3999 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Make use of the single configuration point for the default shellsStanislav Levin2019-06-192-2/+2
| | | | | | | | | | | | | | For now all the default shells of users and admin are hardcoded in different parts of the project. This makes it impossible to run the test suite against the setup, which has the default shell differed from '/bin/sh'. The single configuration point for the shell of users and admin is added to overcome this limitation. Fixes: https://pagure.io/freeipa/issue/7978 Signed-off-by: Stanislav Levin <slev@altlinux.org> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Stop using 389-ds legacy backup and restoration utilitiesRob Crittenden2019-06-051-5/+0
| | | | | | | | | | Use dsctl instead, the modern replacement for ldif2db, db2ldif, bak2db and db2bak. https://pagure.io/freeipa/issue/7965 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Correct default fontawesome path (broken by da2cf1c5)Adam Williamson2019-05-021-1/+1
| | | | | | | | | On Fedora/RHEL, it does not have a dash in it. The changes in da2cf1c5 inadvertently added a dash to the path in the 'base' paths definition (used on Fedora/RHEL), so the font wasn't found. Signed-off-by: Adam Williamson <awilliam@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Correct path to systemd-detect-virtChristian Heimes2019-04-261-1/+1
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Add helper to look for missing binariesChristian Heimes2019-04-262-0/+31
| | | | | | | | | | | | Fedora has merged /usr/bin and /bin while Debian uses distinct directories for /usr/bin and /bin. Debian also uses different directory for libexec files. A new paths.check_paths() helper makes it easier to detect missing or wrong paths. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Move Custodia secrets handler to scriptsChristian Heimes2019-04-261-0/+1
| | | | | | | | | | | | | | | | | | Implement the import and export handlers for Custodia keys as external scripts. It's a prerequisite to drop DAC override permission and proper SELinux rules for ipa-custodia. Except for DMLDAP, handlers no longer run as root but as handler specific users with reduced privileges. The Dogtag-related handlers run as pkiuser, which also help with HSM support. The export and import handles are designed to be executed by sudo, too. In the future, ipa-custodia could be executed as an unprivileged process that runs the minimal helper scripts with higher privileges. Fixes: https://pagure.io/freeipa/issue/6888 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipaplatform: add more servicesFrançois Cami2019-04-261-6/+9
| | | | | | | | Healthcheck needs to check more services than currently defined in ipaplatform. Add these services. Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Refactor tasks to include is_selinux_enabled()Christian Heimes2019-04-262-24/+31
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Globally disable softhsm2 in p11-kit-proxyChristian Heimes2019-04-254-0/+84
| | | | | | | | | | | | | | The p11-kit configuration injects p11-kit-proxy into all NSS databases. Amongst other p11-kit loads SoftHSM2 PKCS#11 provider. This interferes with 389-DS, certmonger, Dogtag and other services. For example certmonger tries to open OpenDNSSEC's SoftHSM2 token, although it doesn't use it at all. It also breaks Dogtag HSM support testing with SoftHSM2. IPA server does neither need nor use SoftHSM2 proxied by p11-kit. Related: https://pagure.io/freeipa/issue/7810 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Debian: Use RedHatCAService for pki-tomcatdChristian Heimes2019-04-241-0/+2
| | | | | | | | | | | The RedHatCAService service class contains extra logic to wait for CA service to be up and running. Debian now correctly waits for Dogtag before proceeding with the installation process. Fixes: https://pagure.io/freeipa/issue/7916 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Debian: Fix replicatio of light weight sub CAsChristian Heimes2019-04-242-0/+2
| | | | | | | | | The path to ipa-pki-retrieve-key was hard-coded, which broke replication of light weight sub CA keys. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Add ODS manager abstraction to ipaplatformChristian Heimes2019-04-243-2/+36
| | | | | | | | | | | | | | OpenDNSSEC 1.4 and 2.x use different commands to initialize kasp.db and manage zones. ipaplatform.tasks abstracts the commands. Note: I added the logic to the base task instead of having different implementations for Red Hat and Debian platforms. Eventually Fedora is going to move to OpenDNSSEC 2.x, too. The design will make it easier to support OpenDNSSEC 2.x on Fedora. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Debian: Use different paths for KDC cert and keyChristian Heimes2019-04-241-3/+3
| | | | | | | Co-authored-by: Timo Aaltonen <tjaalton@debian.org> Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Debian: Add fixes for OpenDNSSEC 2.0Christian Heimes2019-04-242-0/+5
| | | | | | | | | | Debian/Ubuntu use OpenDNSSEC 2.0, which has different commands to manage zones and keys. Co-authored-by: Timo Aaltonen <tjaalton@debian.org> Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Debian: Add paths for open-sans and font-awesomeChristian Heimes2019-04-242-0/+4
| | | | | | | | | | Debian has different paths and path suffix for font-awesome. Let's have explicit paths for all our fonts. Co-authored-by: Timo Aaltonen <tjaalton@debian.org> Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Debian doesn't have authselectChristian Heimes2019-04-241-0/+4
| | | | | | | | | Skip authselect configuration and migration on Debian/Ubuntu. Co-authored-by: Timo Aaltonen <tjaalton@debian.org> Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Reduce startup_timeout to 120sec as documentedChristian Heimes2019-04-241-0/+1
| | | | | | | | | man(5) default.conf says that startup_timeout has a default value of 120 seconds. Even 120 seconds are not effective unless systemd is also reconfigured to have a larger DefaultTimeoutStartSec. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Add ExecStartPost hook to wait for Dogtag PKIChristian Heimes2019-04-242-12/+3
| | | | | | | | | | | | | | | | | Dogtag PKI typically takes around 10 seconds to start and respond to requests. Dogtag uses a simple systemd service, which means systemd is unable to detect when Dogtag is ready. Commands like ``systemctl start`` and ``systemctl restart`` don't block and wait until the CA is up. There have been various workarounds in Dogtag and IPA. Systemd has an ExecStartPost hook to run programs after the main service is started. The post hook blocks systemctl start and restart until all post hooks report ready, too. The new ipa-pki-wait-running script polls on port 8080 and waits until the CA subsystem returns ``running``. Related: https://pagure.io/freeipa/issue/7916 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix unnecessary usrmerge assumptionsRobbie Harwood2019-04-172-3/+2
| | | | | | | | | | | | On non-usrmerge systems (e.g., Debian), bash, mv, cp, cat, tail, keyctl, and gzip live in /bin, not /usr/bin. On usrmerge systems, /bin is a symlink to /usr/bin (or vice versa), so this has no effect. Signed-off-by: Robbie Harwood <rharwood@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Use Network Manager to configure resolv.confChristian Heimes2019-04-164-1/+100
| | | | | | | | | | | | | | | IPA used to write a custom /etc/resolv.conf. On Fedora and RHEL, NetworkManager is typically maintaining resolv.conf. On reboot or restart of the service, NM overwrites the custom settings. On systems with NM enabled, the DNS server installer now drops a config file into NM's global config directory and delegates resolv.conf to NM. On systems without NM, fall back to create /etc/resolv.conf directly. Fixes: https://pagure.io/freeipa/issue/7900 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* Move DS's Kerberos env vars to unit fileChristian Heimes2019-04-021-0/+2
| | | | | | | | | The IPA specific env vars KRB5_KTNAME and KRB5CCNAME are now defined in a instance specific ipa-env.conf unit file. Fixes: https://pagure.io/freeipa/issue/7860 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Add tasks.systemd_daemon_reload()Christian Heimes2019-04-023-6/+12
| | | | | | | | | systemd daemon must be reloaded after a config file is added, changed, or removed. Provide a common API endpoint in ipaplatform.tasks. Related: https://pagure.io/freeipa/issue/7860 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Show a notification that sssd needs restarting after idrange-modOleg Kozlov2019-03-291-1/+1
| | | | | | | | | | | | | | If the `ipa idrange-mod` command has been used show a notification that sssd.service needs restarting. It's needed for applying changes. E.g. after setup AD trust with a domain with more than 200000 objects (the highest RID > idm's default value, 200000) users with RIDs > 200000 are not able to login, the size needs to be increased via idrange-mod, but it makes an effect only after sssd restarting. Implementation: Notification was implemented via passing `ipalib.messages.ServiceRestartRequired` to `add_message` method in `ipaserver.plugins.idrange.idrange_mod.post_callback`. Tests: Added `messages` with sssd restart required (`ipalib.messages.ServiceRestartRequired`) to cases with idrange_mod where output is expected in `ipatests.test_xmlrpc.test_range_plugin.test_range'. Fixes: https://pagure.io/freeipa/issue/7708 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Completely drop /var/cache/ipa/sessionsStanislav Levin2019-03-251-1/+0
| | | | | | | | This directory has been already dropped in @6d66e826c, but not entirely. Signed-off-by: Stanislav Levin <slev@altlinux.org> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipatests: remove all occurrences of osinfo.version_idFrançois Cami2019-03-011-6/+0
| | | | | | | | | | | | The fix for https://pagure.io/freeipa/issue/7868 introduced a tuple-based OS version management method (osinfo.version_number) by Christian Heimes. Convert all occurrences of osinfo.version_id in ipatests to osinfo.version_number then remove osinfo.version_id. Related to: https://pagure.io/freeipa/issue/7873 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* ipa-client-automount: handle NFS configuration file changesFrançois Cami2019-02-276-3/+31
| | | | | | | | | | | | | | | | | | | | | | nfs-utils in Fedora 30 and later switched its configuration file from /etc/sysconfig/nfs to /etc/nfs.conf, providing a conversion service (nfs-convert.service) for upgrades. However, for new installs the original configuration file is missing. This change: * adds a tuple-based osinfo.version_number method to handle more kinds of OS versioning schemes * detects RHEL and Fedora versions with the the new nfs-utils behavior * avoids backing up the new NFS configuration file as we do not have to modify it. See: https://bugzilla.redhat.com/show_bug.cgi?id=1676981 Fixes: https://pagure.io/freeipa/issue/7868 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
* Don't configure KEYRING ccache in containersChristian Heimes2019-01-183-0/+30
| | | | | | | | | | | | | | Kernel keyrings are not namespaced yet. Keyrings can leak into other containers. Therefore keyrings should not be used in containerized environment. Don't configure Kerberos to use KEYRING ccache backen when a container environment is detected by systemd-detect-virt --container. Fixes: https://pagure.io/freeipa/issue/7807 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Tibor Dudlak <tdudlak@redhat.com>
* Remove stale kdc requests info files when upgrading IPA serverOleg Kozlov2018-12-211-0/+1
| | | | | | | Added removing of stale /var/lib/sss/pubconf/kdcinfo.* and /var/lib/sss/pubconf/kpasswdinfo.* files generated by SSSD during IPA server upgrade. Fixes: https://pagure.io/freeipa/issue/7578 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* ipa-client-automount: use nfs-utils unitFrançois Cami2018-12-141-1/+2
| | | | | | | | | | | | | | - remove nfs-idmapd from units we enable & start as: - it is not used on NFS clients anymore - it is a static unit - remove rpc-gssd as well as it is a static unit - restart nfs-utils and rpc-gssd - manage systemctl-related exceptions during uninstall Fixes: https://pagure.io/freeipa/issue/7780 Fixes: https://pagure.io/freeipa/issue/7781 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix NFS unit namesFrançois Cami2018-12-141-2/+2
| | | | | | | | | | | | NFS unit names were renamed. Compatibility was maintained with older unit names through symlinks. When these symlinks are removed only new unit names work, so changing to using non- symlink unit names is required. Fixes: https://pagure.io/freeipa/issue/7783 Signed-off-by: François Cami <fcami@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix authselect invocations to work with 1.0.2Adam Williamson2018-11-291-10/+20
| | | | | | | | | | | | | | | | | | | | Since authselect 1.0.2, invoking an authselect command sequence like this: ['authselect', 'sssd', '', '--force'] does not work: authselect barfs on the empty string arg and errors out. We must only pass a features arg if we actually have some text to go in it. This broke uninstallation. In all cases, features are now passed as separate arguments instead of one argument separated by space. Fixes: https://pagure.io/freeipa/issue/7776 Signed-off-by: Adam Williamson <awilliam@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* pylint 2.2: Fix unnecessary pass statementChristian Heimes2018-11-262-3/+0
| | | | | | | | | | pylint 2.2.0 has a new checker for unnecessary pass statements. There is no need to have a pass statement in functions or classes with a doc string. Fixes: https://pagure.io/freeipa/issue/7772 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Thomas Woerner <twoerner@redhat.com>
* Remove DS perl paths from debian platformChristian Heimes2018-11-131-2/+0
| | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Move lib389 imports to module scopeStanislav Laznicka2018-11-131-2/+0
| | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Support the 1.4.x python installer tools in 389-dsWilliam Brown2018-11-131-21/+27
| | | | Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Replace messagebus with modern name dbusChristian Heimes2018-11-082-3/+1
| | | | | | | | | | "messagebus" is an old, archaic name for dbus. Upstream dbus has started to move away from the old name. Let's use the modern term in FreeIPA, too. Fixes: https://pagure.io/freeipa/issue/7754 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Fix misleading errors during client install rollbackRob Crittenden2018-10-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Some incorrect errors are possible if a client installation fails and a configuration rollback is required. These include: 1. Unconfigured automount client failed: CalledProcessError(Command ['/usr/sbin/ipa-client-automount', '--uninstall', '--debug'] returned non-zero exit status 1: '') Caused by check_client_configuration() not returning the correct return value (2). 2. WARNING: Unable to revert to the pre-installation state ('authconfig' tool has been deprecated in favor of 'authselect'). The default sssd profile will be used instead. The authconfig arguments would have been: authconfig --disableldap --disablekrb5 --disablesssdauth --disablemkhomedir If installation fails before SSSD is configured there is no state to roll back to. Detect this condition. 3. An error occurred while removing SSSD's cache.Please remove the cache manually by executing sssctl cache-remove -o. Again, if SSSD is not configured yet then there is no cache to remove. Also correct the missing space after the period. https://pagure.io/freeipa/issue/7729 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
generated by cgit (git 2.34.1) at 2026-01-10 17:50:01 +0000