summaryrefslogtreecommitdiffstats
path: root/ipaserver/install/server
Commit message (Collapse)AuthorAgeFilesLines
...
* Refactor and relocate set_subject_base_in_configFraser Tweedale2017-01-111-23/+1
| | | | | | | | | | | | | Refactor set_subject_base_in_config to use api.Backend.ldap2 instead of a manually created LDAP connection. Also rename the function to have a more accurate name, and move it to 'ipaserver.install.ca' to avoid cyclic import (we will eventually need to use it from within that module). Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Unify password generation across FreeIPAStanislav Laznicka2017-01-061-2/+1
| | | | | | | | | | | | Also had to recalculate entropy of the passwords as originally, probability of generating each character was 1/256, however the default probability of each character in the ipa_generate_password is 1/95 (1/94 for first and last character). https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* server install: fix KRA agent PEM file not being createdJan Cholasta2016-12-201-0/+2
| | | | | | | | | | | | In commit 822e1bc82af3a6c1556546c4fbe96eeafad45762 the call to create the KRA agent PEM file was accidentally removed from the server installer. Call into the KRA installer from the server installer to create the file again. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Fix DL1 replica installation in CA-less topologyFraser Tweedale2016-12-201-1/+1
| | | | | | | | | | | | | | | | Commit dbb98765d73519289ee22f3de1a5ccde140f6f5d changed certmonger requests for DS and HTTP certificates during installation to raise on error (https://fedorahosted.org/freeipa/ticket/6514). This introduced a regression in DL1 replica installation in CA-less topology. A certificate was requested, but prior to the aforementioned commit this would fail silently and installation continued, whereas now installation fails. Guard the certificate request with a check that the topology is CA-ful. Fixes: https://fedorahosted.org/freeipa/ticket/6573 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* adtrust: remove FILE: prefix from 'dedicated keytab file' in smb.confAlexander Bokovoy2016-12-121-0/+22
| | | | | | | | | | | | | | | | | | Samba 4.5 does not allow to specify access mode for the keytab (FILE: or WRFILE:) from external sources. Thus, change the defaults to a path (implies FILE: prefix) while Samba Team fixes the code to allow the access mode prefix for keytabs. On upgrade we need to replace 'dedicated keytab file' value with the path to the Samba keytab that FreeIPA maintains. Since the configuration is stored in the Samba registry, we use net utility to manipulate the configuration: net conf setparm global 'dedicated keytab file' /etc/samba/samba.keytab Fixes https://fedorahosted.org/freeipa/ticket/6551 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Configure Anonymous PKINIT on server installSimo Sorce2016-12-124-14/+50
| | | | | | | | | | | | Allow anonymous pkinit to be used so that unenrolled hosts can perform FAST authentication (necessary for 2FA for example) using an anonymous krbtgt obtained via Pkinit. https://fedorahosted.org/freeipa/ticket/5678 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* replicainstall: give correct error message on DL mismatchStanislav Laznicka2016-12-091-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/6510 Reviewed-By: Martin Basti <mbasti@redhat.com>
* server install: fix external CA installJan Cholasta2016-12-082-57/+46
| | | | | | | | | | | | | Replace the dual definitions of domain_name, dm_password and admin_password knobs in server install with single definitions using the original names without the 'new_' prefix. This fixes the options read from the installer option cache in step 2 of external CA install to use the correct knob names. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
* Set explicit confdir option for global contextsChristian Heimes2016-12-022-6/+15
| | | | | | | | | | | | | | | | | | | | | | | | | Some API contexts are used to modify global state (e.g. files in /etc and /var). These contexts do not support confdir overrides. Initialize the API with an explicit confdir argument to paths.ETC_IPA. The special contexts are: * backup * cli_installer * installer * ipctl * renew * restore * server * updates The patch also corrects the context of the ipa-httpd-kdcproxy script to 'server'. https://fedorahosted.org/freeipa/ticket/6389 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipaclient: move install modules to the install subpackageJan Cholasta2016-11-292-12/+12
| | | | | | | | | | | | The ipa_certupdate, ipachangeconf, ipadiscovery and ntpconf modules depend on ipaplatform. Move them to ipaclient.install as they are used only from the client installer. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* constants: remove CACERTJan Cholasta2016-11-291-6/+5
| | | | | | | | | | CACERT depends on ipaplatform. Replace all uses of CACERT with paths.IPA_CA_CRT and remove CACERT. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipalib: move certstore to the install subpackageJan Cholasta2016-11-291-2/+2
| | | | | | | | | | The certstore module depends on ipaplatform. Move it to ipalib.install, as it is used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: move file encryption functions to installutilsJan Cholasta2016-11-291-4/+9
| | | | | | | | | | | The encrypt_file() and decrypt_file() functions depend on ipaplatform. Move them to ipaserver.install.installutils, as they are only used for the server installer. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: move kinit functions to ipalib.installJan Cholasta2016-11-291-6/+7
| | | | | | | | | | | kinit_password() depends on ipaplatform. Move kinit_password() as well as kinit_keytab() to a new ipalib.install.kinit module, as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: move is_fips_enabled() to ipaplatform.tasksJan Cholasta2016-11-292-4/+3
| | | | | | | | The FIPS setting is platform-specific. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipautil: remove SHARE_DIR and PLUGIN_SHARE_DIRJan Cholasta2016-11-291-6/+9
| | | | | | | | | | | SHARE_DIR and PLUGIN_SHARE_DIR depend on ipaplatform. Replace all uses of SHARE_DIR with paths.USR_SHARE_IPA_DIR and remove both SHARE_DIR and PLUGIN_SHARE_DIR. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* ipapython: move certmonger and sysrestore to ipalib.installJan Cholasta2016-11-293-4/+6
| | | | | | | | | | The certmonger and sysrestore modules depend on ipaplatform. Move them to ipalib.install as they are used only from installers. https://fedorahosted.org/freeipa/ticket/6474 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Fix ipa-replica-install when upgrade from ca-less to ca-fullFlorence Blanc-Renaud2016-11-251-4/+4
| | | | | | | | | | | | | | | | | When ipa-replica-prepare is run on a master upgraded from CA-less to CA-full, it creates the replica file with a copy of the local /etc/ipa/ca.crt. This causes issues if this file hasn't been updated with ipa-certupdate, as it contains the external CA that signed http/ldap certs, but not the newly installed IPA CA. As a consequence, ipa-replica-install fails with "Could not find a CA cert". The fix consists in retrieving the CA certificates from LDAP instead of the local /etc/ipa/ca.crt. https://fedorahosted.org/freeipa/ticket/6375 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Break ipaplatform / ipalib import cycle of hellChristian Heimes2016-11-242-6/+6
| | | | | | | | | | | Here is an attempt to break the import cycle of hell between ipaplatform and ipalib. All services now pass an ipalib.api object to services.service(). RedHatServices.__init__() still needs to do a local import because it initializes its wellknown service dict with service instances. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* Replace LooseVersionChristian Heimes2016-11-241-5/+5
| | | | | | | | | | | | | | | | | | | | pylint is having a hard time with distutils.version in tox's virtual envs. virtualenv uses some tricks to provide a virtual distutils package, pylint can't cope with. https://github.com/PyCQA/pylint/issues/73 suggests to use pkg_resources instead. pkg_resources' version parser has some more benefits, e.g. PEP 440 conformity. But pkg_resources.parse_version() is a heavy weight solution with reduced functionality, e.g. no access to major version. For API_VERSION and plugin version we can use a much simpler and faster approach. https://fedorahosted.org/freeipa/ticket/6468 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* upgrade: ldap conn managementTomas Krizek2016-11-221-18/+1
| | | | | | | | | | Clean up unnecessary starts/stops of DS and unnescessary attributes. If the DS is running, establish an LDAP connection and properly close it. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Basti <mbasti@redhat.com>
* upgrade: do not explicitly set principal for servicesTomas Krizek2016-11-211-2/+0
| | | | | | | | After installer refactoring, principal is a property of service. https://fedorahosted.org/freeipa/ticket/6500 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fix renewal lock issues on installationFlorence Blanc-Renaud2016-11-161-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | - Make sure that the file /var/run/ipa/renewal.lock is deleted upon uninstallation, in order to avoid subsequent installation issues. - Modify certmonger renewal script: restart the http/dirsrv services only if they were already running - Cleanup certmonger ra renewal script: no need to restart httpd - Reorder during http install: request the SSL cert before adding ipa-service-guard Rationale: when a CA helper is modified, certmonger launches the helper with various operations (FETCH_ROOTS, ...) If the CA helper is once again modified, the on-going helper is killed. This can lead to ipa-service-guard being killed and not releasing the renew lock. If the SSL cert is requested with IPA helper before ipa-service-guard is added, we avoid this locking issue. Part of the refactoring effort, certificates sub-effort. https://fedorahosted.org/freeipa/ticket/6433 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* dns: check if container exists using ldapiTomas Krizek2016-11-111-3/+1
| | | | | | | | | | | Previously an adhoc connection was established for checking if dns(sec) container exists. A simple or external bind was used. Instead, always connect with ldapi through api.Backend.ldap2. https://fedorahosted.org/freeipa/ticket/6461 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: migrate server installers to the new class hierarchyJan Cholasta2016-11-114-883/+110
| | | | | | | | | Migrate ipa-server-install and ipa-replica-install from the old installer classes to the new installer class hierarchy classes. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: introduce installer class hierarchyJan Cholasta2016-11-111-0/+532
| | | | | | | | | Add class hierarchy which allows inherting knob definitions between the various client and server install scripts. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: fix subclassing of knob groupsJan Cholasta2016-11-112-13/+5
| | | | | | | | | | Add new @group decorator to declare an installer class as a knob group instead of subclassing Group, so that subclassing the installer does not create duplicates of the original group. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: use standard Python classes to declare knob typesJan Cholasta2016-11-111-1/+11
| | | | | | | | | | | | | | | | | | | Use type(None) rather than bool to define knobs which are represented as command line flags. This allows declaring both "--option" and "--option={0,1}"-style command line options. Use enum.Enum subclasses instead of set literals to declare enumerations. Use typing.List[T] instead of (list, T) to declare lists. (Note that a minimal reimplementation of typing.List is used instead of the Python 2 backport of the typing module due to non-technical reasons.) Use CheckedIPAddress instead of 'ip' and 'ip-local' to declare IP addresses. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* install: improve CLI positional argument handlingJan Cholasta2016-11-111-0/+2
| | | | | | | | | | | | | Instead of specifying which knobs should be positional arguments in cli.install_tool(), do it using a flag in knob definition, where the rest of CLI configuration is. As a side effect, the usage string for CLI tools can now be generated automatically. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix CA replica install on DL1Stanislav Laznicka2016-11-111-1/+1
| | | | | | | | | | | | Dogtag requires Directory Manager password for its installation. On Domain Level 1 a special password for Directory Manager is created and used during the installation. However, by importing the real DM password from remote LDAP, we can no longer use the temporary password from the replica installation. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* domain-level agnostic keytab retrieval in httpinstanceMartin Babinsky2016-11-111-18/+0
| | | | | | | | | | | | | apache keytab is now retrieved using the same method in both domain levels. The difference lies in the authentication scheme used to retrieve service keytab: * in DL0 passed in DM credentials are used * in DL1 GSSAPI is used https://fedorahosted.org/freeipa/ticket/6405 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* installers: restart DS after KDC is configuredMartin Babinsky2016-11-112-0/+8
| | | | | | | | | This is required to enable password extension plugin right away so that services configured later can use it to request keytabs via ipa-getkeytab. https://fedorahosted.org/freeipa/ticket/6405 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Offer more general way to check domain level in replicainstallStanislav Laznicka2016-11-111-59/+49
| | | | | | | | | | | | Domain levels 0 and 1 use the same mechanism of checking domain level correctness. Group them together and make it more general should there be more domain levels in the future (although lets hope there won't be). https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use same means of checking replication agreements on both DLsStanislav Laznicka2016-11-111-14/+7
| | | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* replicainstall: move common checks to common_check()Stanislav Laznicka2016-11-111-53/+34
| | | | | | | | | | install_check() and promote_check() have some common checks that can be safely moved to common grounds. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Take advantage of the ca/kra code cleanup in replica installationStanislav Laznicka2016-11-111-27/+11
| | | | | | | | | | | | | | The recent cleanup of ca/kra installation code can be used to greatly reduce the number of differences between DL0 and DL1 in replica installation. This change also allows to move Custodia instance creation after Kerberos and httpd instances installation. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use updated CA certs in replica installationStanislav Laznicka2016-11-111-25/+21
| | | | | | | | | | | | DL0 updated its CA certificate file prior to installing a DS but would not use it for the installation. Update the file on both domain levels and use it to setup DS and HTTP replica instances. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use os.path.join instead of concatenationStanislav Laznicka2016-11-111-2/+2
| | | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove redundant CA cert file existance checkStanislav Laznicka2016-11-111-3/+0
| | | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use host keytab to connect to remote server on DL0Stanislav Laznicka2016-11-111-11/+15
| | | | | | | | | | | | Since host enrollment was implemented in DL0, use the host keytab to connect to remote api and perform certain actions to merge DL1 and DL0 replica install workflows. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Split install_http_certs() into two functionsStanislav Laznicka2016-11-111-5/+12
| | | | | | | | | | | | install_http_certs() was actually installing http service keytab and actually installing certificates after that. Split it into two so that the names of the new functions better reflect what's actually happening. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* First step of merging replica installation of both DLsStanislav Laznicka2016-11-111-177/+120
| | | | | | | | | | | | The installation steps of replica installation on DL0 and DL1 don't differ too much and should be merged. When host enrollment on DL0 is finished, most of the code will be the same. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Properly bootstrap replica promotion apiStanislav Laznicka2016-11-111-10/+6
| | | | | | | | | | Properly bootstrap api in replica promote_check() so that it can be used later in the installation for setting up dns. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move the pki-tomcat restart to cainstance creationStanislav Laznicka2016-11-112-6/+0
| | | | | | | | | | | pki-tomcat would have been restarted in install and replicainstall for backward compatibility reasons. As Dogtag 9 is not supported anymore, we can move this restart only for DL0 replica installation. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Move httpd restart to DNS installationStanislav Laznicka2016-11-112-8/+0
| | | | | | | | | | | | Web service needs restarting after bindinstance is created to pick up changes done to /etc/resolv.conf. This change should be included anytime DNS is installed therefore it makes sense to move it to the common code. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* replica install: fix DS restart failure during replica promotionJan Cholasta2016-11-111-2/+6
| | | | | | | | | | | | | | Since commit 0914a3aeb778986dea4020ddf8ca550ebef02bad, ipa config file is created before DS certificate is requested, which makes certmonger request the certificate from the local system rather than the remote master. This causes the request to fail, as local httpd is not yet configured at the time of the request. Move ipa config file creation to its original place to fix the issue. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Import just IPAChangeConf instead of the whole moduleStanislav Laznicka2016-11-111-4/+3
| | | | | | https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Added file permissions option to IPAChangeConf.newConf()Stanislav Laznicka2016-11-111-1/+3
| | | | | | | | | Also added information about why os.chmod is called sometimes after newConf() calls. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* replicainstall: Unify default.conf file creationStanislav Laznicka2016-11-111-72/+53
| | | | | | | | | | | | In domain level 0, the default.conf file was created using just file operations. Unified this with domain level 1 where IPAChangeConf is used. Also moved the creation of the file to promote_check in DL1. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Basti <mbasti@redhat.com>
* fix incorrect invocation of ipa-getkeytab during DL0 host enrollmentMartin Babinsky2016-11-111-1/+1
| | | | | | https://fedorahosted.org/freeipa/ticket/6434 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
generated by cgit (git 2.34.1) at 2026-01-06 04:45:26 +0000