summaryrefslogtreecommitdiffstats
path: root/ipaserver/install
Commit message (Collapse)AuthorAgeFilesLines
* Make sure remote hosts have our keyscakeysfixSimo Sorce2017-05-031-1/+27
| | | | | | | | | | | | | In complex replication setups a replica may try to obtain CA keys from a host that is not the master we initially create the keys against. In this case race conditions may happen due to replication. So we need to make sure the server we are contacting to get the CA keys has our keys in LDAP. We do this by waiting to positively fetch our encryption public key (the last one we create) from the target host LDAP server. Fixes: https://pagure.io/freeipa/issue/6838 Signed-off-by: Simo Sorce <simo@redhat.com>
* Refresh Dogtag RestClient.ca_host propertyStanislav Laznicka2017-05-021-3/+2
| | | | | | | | | | | | | | | | Refresh the ca_host property of the Dogtag's RestClient class when it's requested as a context manager. This solves the problem which would occur on DL0 when installing CA which needs to perform a set of steps against itself accessing 8443 port. This port should however only be available locally so trying to connect to remote master would fail. We need to make sure the right CA host is accessed. https://pagure.io/freeipa/issue/6878 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* restore: restart/reload gssproxy after restorePetr Vobornik2017-04-281-0/+3
| | | | | | | | | So that gssproxy picks up new configuration and therefore related usages like authentication of CLI against server works https://pagure.io/freeipa/issue/6902 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Do not test anonymous PKINIT after install/upgradeMartin Babinsky2017-04-282-10/+0
| | | | | | | | | | | | | Local FAST armoring will now work regardless of PKINIT status so there is no need to explicitly test for working PKINIT. If there is, there should be a test case for that. https://pagure.io/freeipa/issue/6830 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Upgrade: configure local/full PKINIT depending on the master statusMartin Babinsky2017-04-281-6/+9
| | | | | | | | | | | | | | The upgrader has been modified to configure either local or full PKINIT depending on the CA status. Additionally, the new PKINIT configuration will be written to the master's KDC entry. https://pagure.io/freeipa/issue/6830 http://www.freeipa.org/page/V4/Kerberos_PKINIT Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Stop requesting anonymous keytab and purge all references of itMartin Babinsky2017-04-283-19/+0
| | | | | | | | | | | | anonymous kinit using keytab never worked so we may safely remove all code that requests/uses it. https://pagure.io/freeipa/issue/6830 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* API for retrieval of master's PKINIT status and publishing it in LDAPMartin Babinsky2017-04-281-0/+41
| | | | | | | | | | | | | | | | An API was provided to report whether PKINIT is enabled for clients or not. If yes, the pkinitEnabled value will be added to the ipaConfigString attribute of master's KDC entry. See http://www.freeipa.org/page/V4/Kerberos_PKINIT#Configuration for more details. https://pagure.io/freeipa/issue/6830 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Allow for configuration of all three PKINIT variants when deploying KDCMartin Babinsky2017-04-281-52/+93
| | | | | | | | | | | | | | | The PKINIT setup code now can configure PKINIT using IPA CA signed certificate, 3rd party certificate and local PKINIT with self-signed keypair. The local PKINIT is also selected as a fallback mechanism if the CSR is rejected by CA master or `--no-pkinit` is used. http://www.freeipa.org/page/V4/Kerberos_PKINIT https://pagure.io/freeipa/issue/6830 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* separate function to set ipaConfigString values on service entryMartin Babinsky2017-04-282-84/+94
| | | | | | | | | | | | | | | | | There is some code duplication regarding setting ipaConfigString values when: * LDAP-enabling a service entry * advertising enabled KDCProxy in LDAP We can delegate the common work to a single re-usable function and thus expose it to future use-cases (like PKINIT advertising). https://pagure.io/freeipa/issue/6830 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
* Move the compat plugin setup at the end of installStanislav Laznicka2017-04-241-9/+0
| | | | | | | | | | The compat plugin was causing deadlocks with the topology plugin. Move its setup at the end of the installation and remove the cn=topology,cn=ipa,cn=etc subtree from its scope. https://pagure.io/freeipa/issue/6821 Reviewed-By: Martin Basti <mbasti@redhat.com>
* upgrade: adtrust update_tdo_gidnumber plugin must check if adtrust is installedFlorence Blanc-Renaud2017-04-241-0/+5
| | | | | | | | | | | During upgrade, the plugin update_tdo_gidnumber is launched in order to add a gidnumber to the Trusted Domain Object. This plugin should not be run when ad trust is not installed, otherwise an error message is displayed. https://pagure.io/freeipa/issue/6881 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Fix CAInstance.import_ra_cert for empty passwordsStanislav Laznicka2017-04-201-1/+1
| | | | | | | | OpenSSL can't cope with empty files, add a newline after each password https://pagure.io/freeipa/issue/6878 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix RA cert import during DL0 replicationStanislav Laznicka2017-04-192-25/+35
| | | | | | | | | | Previous versions of FreeIPA add password to the ra.p12 file contained in the password-protected tarball. This was forgotten about in the recent changes and fixed now. https://pagure.io/freeipa/issue/6878 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ext. CA: correctly write the cert chainStanislav Laznicka2017-04-191-2/+3
| | | | | | | | | The cert file would have been rewritten all over again with any of the cert in the CA cert chain without this patch. https://pagure.io/freeipa/issue/6872 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* server-install: No double Kerberos installStanislav Laznicka2017-04-191-5/+6
| | | | | | | | | | | When we're installing server with an external CA, the installation would have failed in the second step where it's passed the required CA cert file because it would have tried to perform the Kerberos installation for the second time. https://pagure.io/freeipa/issue/6757 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Fix CA-less to CA-full upgradeStanislav Laznicka2017-04-123-11/+31
| | | | | | | | | | CertDB would have always created a directory on initialization. This behavior changes here by replacing the truncate argument with create which will only create the database when really required. https://pagure.io/freeipa/issue/6853 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* replicainstall: better client install exception handlingStanislav Laznicka2017-04-121-42/+41
| | | | | | | | | | | | | The exception handling of client install inside replica installation was rather promiscuous, hungrily eating any possible exception thrown at it. Scoped down the try-except block and reduced its promiscuity. This change should improve the future development experience debugging this part of the code. https://pagure.io/freeipa/issue/6183 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add the force-join option to replica installStanislav Laznicka2017-04-122-1/+3
| | | | | | | | | | | | When installing client from inside replica installation on DL1, it's possible that the client installation would fail and recommend using --force-join option which is not available in replica installer. Add the option there. https://pagure.io/freeipa/issue/6183 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* server-install: remove broken no-pkinit checkStanislav Laznicka2017-04-121-5/+0
| | | | | | | | | | | Don't check for no-pkinit option in case pkinit cert file was provided. Setting no-pkinit is prohibited in this case, so without this fix we have an impossible option-check if we want to provide an own pkinit certificate and private key. https://pagure.io/freeipa/issue/6807 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix PKCS11 helperMartin Basti2017-04-122-9/+9
| | | | | | | | | | | | | | | | | | | | | | | Slots in HSM are not assigned statically, we have to chose proper slot from token label. Softhsm i2.2.0 changed this behavior and now slots can change over time (it is allowed by pkcs11 standard). Changelog: * created method get_slot() that returns slot number from used label * replaces usage of slot in __init__ method of P11_Helper with label * slot is dynamically detected from token label before session is opened * pkcs11-util --init-token now uses '--free' instead '--slot' which uses first free slot (we don't care about slot numbers anymore) https://pagure.io/freeipa/issue/6692 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Create system users for FreeIPA services during package installationDavid Kupka2017-04-118-68/+2
| | | | | | | | | | | | | | | | | | | | Previously system users needed by FreeIPA server services was created during ipa-server-install. This led to problem when DBus policy was configured during package installation but the user specified in the policy didn't exist yet (and potentionally similar ones). Now the users will be created in package %pre section so all users freeipa-server package needs exist before any installation or configuration begins. Another possibility would be using systemd-sysusers(8) for this purpose but given that systemd is not available during container build the traditional approach is superior. Also dirsrv and pkiuser users are no longer created by FreeIPA instead it depends on 389ds and dogtag to create those users. https://pagure.io/freeipa/issue/6743 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Remove surplus 'the' in output of ipa-adtrust-installMartin Basti2017-04-111-1/+1
| | | | | | | | Fixing the typo https://pagure.io/freeipa/issue/6864 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* install: request service certs after host keytab is set upJan Cholasta2017-04-073-24/+16
| | | | | | | | | | | | | The certmonger renew agent and restart scripts use host keytab for authentication. When they are executed during a certmonger request before the host keytab is set up, the authentication will fail. Make sure all certmonger requests in the installer are done after the host keytab is set up. https://pagure.io/freeipa/issue/6757 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* dsinstance, httpinstance: consolidate certificate request codeJan Cholasta2017-04-074-99/+43
| | | | | | | | | | | | A different code path is used for DS and httpd certificate requests in replica promotion. This is rather unnecessary and makes the certificate request code not easy to follow. Consolidate the non-promotion and promotion code paths into one. https://pagure.io/freeipa/issue/6757 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* httpinstance: avoid httpd restart during certificate requestJan Cholasta2017-04-071-3/+4
| | | | | | | | | | | | httpd is restarted by certmonger in the restart_httpd script after the httpd certificate is saved if it was previously running. The restart will fail because httpd is not properly configured at this point. Stop httpd at the beginning of httpd install to avoid the restart. https://pagure.io/freeipa/issue/6757 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* dsinstance: reconnect ldap2 after DS is restarted by certmongerJan Cholasta2017-04-071-0/+4
| | | | | | | | | | | | | | DS is restarted by certmonger in the restart_dirsrv script after the DS certificate is saved. This breaks the ldap2 backend and makes any operation fail with NetworkError until it is reconnected. Reconnect ldap2 after the DS certificate request is finished to fix the issue. Make sure restart_dirsrv waits for the ldapi socket so that the reconnect does not fail. https://pagure.io/freeipa/issue/6757 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Upgrade: add gidnumber to trusted domain entryFlorence Blanc-Renaud2017-04-071-0/+56
| | | | | | | | | | | The trusted domain entries created in earlier versions are missing gidnumber. During upgrade, a new plugin will read the gidnumber of the fallback group cn=Default SMB Group and add this value to trusted domain entries which do not have a gidNumber. https://pagure.io/freeipa/issue/6827 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Add pki_pin only when neededStanislav Laznicka2017-04-052-6/+14
| | | | | | | | | | If both the pki-tomcat NSS database and its password.conf have been created, don't try to override the password.conf file. https://pagure.io/freeipa/issue/6839 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* httpinstance: make sure NSS database is backed upJan Cholasta2017-04-041-1/+2
| | | | | | | | | | | | | The NSS database at /etc/httpd/alias is not properly initialized and backed up in CA-less replica promotion. This might cause the install to fail after previous install and uninstall. Make sure the NSS database is initialized and backed up even in CA-less replica promotion to fix the issue. https://pagure.io/freeipa/issue/4639 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Remove publish_ca_cert() method from NSSDatabaseStanislav Laznicka2017-04-031-3/+0
| | | | | | | | NSSDatabase.publish_ca_cert() is not used anymore, remove it. https://pagure.io/freeipa/issue/6806 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Get correct CA cert nickname in CA-lessStanislav Laznicka2017-04-031-1/+6
| | | | | | | | | | | | During CA-less installation, we initialize the HTTPD alias database from a pkcs12 file. This means there's going to be different nicknames to the added certificates. Store the CA certificate nickname in HTTPInstance__setup_ssl() to be able to correctly export it later. https://pagure.io/freeipa/issue/6806 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Remove redundant option check for cert filesStanislav Laznicka2017-03-301-9/+1
| | | | | | | | | | There was a redundant check for CA-less install certificate files for replicas but the same check is done for all installers before that. https://pagure.io/freeipa/issue/6801 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Don't allow setting pkinit-related options on DL0Stanislav Laznicka2017-03-301-0/+21
| | | | | | | | | pkinit is not supported on DL0, remove options that allow to set it from ipa-{server,replica}-install. https://pagure.io/freeipa/issue/6801 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Fix the order of cert-files checkStanislav Laznicka2017-03-301-5/+5
| | | | | | | | | | | | Without this patch, if either of dirsrv_cert_files, http_cert_files or pkinit_cert_files is set along with no-pkinit, the user is first requested to add the remaining options and when they do that, they are told that they are using 'no-pkinit' along with 'pkinit-cert-file'. https://pagure.io/freeipa/issue/6801 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove duplicate functionality in upgradeMartin Babinsky2017-03-301-15/+1
| | | | | | | | | | Since krbinstance code can now handle all operations of the `enabled_anonymous_principal` function from upgrade we can remove extraneous function altogether. https://pagure.io/freeipa/issue/6799 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Always check and create anonymous principal during KDC installMartin Babinsky2017-03-301-4/+13
| | | | | | | | | | | The anonymous principal will now be checked for presence and created on both server and replica install. This fixes errors caused during replica installation against older master that do not have anonymous principal present. https://pagure.io/freeipa/issue/6799 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Hide PKI Client database password in log fileAbhijeet Kasurde2017-03-302-4/+10
| | | | | Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* adtrust: make sure that runtime hostname result is consistent with the ↵Alexander Bokovoy2017-03-301-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | configuration FreeIPA's `ipasam` module to Samba uses gethostname() call to identify own server's host name. This value is then used in multiple places, including construction of cifs/host.name principal. `ipasam` module always uses GSSAPI authentication when talking to LDAP, so Kerberos keys must be available in the /etc/samba/samba.keytab. However, if the principal was created using non-FQDN name but system reports FQDN name, `ipasam` will fail to acquire Kerberos credentials. Same with FQDN principal and non-FQDN hostname. Also host name and principal name must have the same case. Report an error when configuring ADTrust instance with inconsistent runtime hostname and configuration. This prevents errors like this: [20/21]: starting CIFS services ipa : CRITICAL CIFS services failed to start where samba logs have this: [2017/03/20 06:34:27.385307, 0] ipa_sam.c:4193(bind_callback_cleanup) kerberos error: code=-1765328203, message=Keytab contains no suitable keys for cifs/ipatrust@EXAMPLE.COM [2017/03/20 06:34:27.385476, 1] ../source3/lib/smbldap.c:1206(get_cached_ldap_connect) Connection to LDAP server failed for the 16 try! Fixes https://pagure.io/freeipa/issue/6786 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Ensure KDC is propery configured after upgradeMartin Babinsky2017-03-301-5/+5
| | | | | | https://pagure.io/freeipa/issue/6792 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Split out anonymous PKINIT test to a separate methodMartin Babinsky2017-03-301-0/+2
| | | | | | | | This allows for more flexibility in the whole PKINIT setup process. https://pagure.io/freeipa/issue/6792 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Remove unused variable from failed anonymous PKINIT handlingMartin Babinsky2017-03-301-1/+1
| | | | | | https://pagure.io/freeipa/issue/6792 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Upgrade: configure PKINIT after adding anonymous principalMartin Babinsky2017-03-301-1/+1
| | | | | | | | | | In order to set up PKINIT, the anonymous principal must already be created, otherwise the upgrade with fail when trying out anonymous PKINIT. Switch the order of steps so that this issue does not occur. https://pagure.io/freeipa/issue/6792 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* httpinstance.disable_system_trust: Don't fail if module 'Root Certs' is not ↵David Kupka2017-03-281-3/+11
| | | | | | | | | | | | | | available Server installation failed when attmpting to disable module 'Root Certs' and the module was not available in HTTP_ALIAS_DIR. When the module is not available there's no need to disable it and the error may be treated as success. https://pagure.io/freeipa/issue/6803 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Generate PIN for PKI to help Dogtag in FIPSStanislav Laznicka2017-03-282-2/+10
| | | | | | | | | | Dogtag is currently unable to generate a PIN it could use for an NSS database creation in FIPS. Generate it for them so that we don't fail. https://pagure.io/freeipa/issue/6824 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Backup CA cert from kerberos folderStanislav Laznicka2017-03-281-0/+1
| | | | | | https://pagure.io/freeipa/issue/6748 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Create temporaty directories at the begining of uninstallDavid Kupka2017-03-281-0/+4
| | | | | | | | | | | | Since commit 38c6689 temporary directories are no longer created at package install time. Instead they're created at server install time. Some steps in uninstall also assume that temporary direcories exist. Creating the directories in the begining of server uninstall ensure that the uninstall will go through. https://pagure.io/freeipa/issue/6715 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Backup ipa-specific httpd unit-fileStanislav Laznicka2017-03-232-0/+3
| | | | | | | | | | | | On backup-restore, the ipa unit file for httpd was not backed up. This file however contains setting for httpd to communicate with gssproxy so not backing it up will result in httpd not knowing how to get credentials. https://pagure.io/freeipa/issue/6748 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
* replica prepare: fix wrong IPA CA nickname in replica fileHEADmasterJan Cholasta2017-03-221-3/+4
| | | | | | | | | | | | | Lookup IPA CA subject and pass it to CertDB when creating dscert.p12 and httpcert.p12, otherwise a generic nickname will be used for the IPA CA certificate instead of "$REALM IPA CA". This fixes replica install on domain level 0 from a replica file created using ipa-replica-install on IPA 4.5. https://pagure.io/freeipa/issue/6777 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Fixing replica install: fix ldap connection in domlvl 0felipe2017-03-221-1/+10
| | | | | | | | | | | | Now, at the domain level 0, the replica install always uses Directory Manager credentials to create the LDAP connection. Since ACIs permitting hosts to manage their own services were added in 4.2 release, the old master denies this operations. https://pagure.io/freeipa/issue/6549 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* httpinstance: clean up /etc/httpd/alias on uninstallJan Cholasta2017-03-222-0/+6
| | | | | | | | | | | Restore cert8.db, key3.db, pwdfile.txt and secmod.db in /etc/httpd/alias from backup on uninstall. Files modified by IPA are kept with .ipasave suffix. https://pagure.io/freeipa/issue/4639 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
generated by cgit (git 2.34.1) at 2025-09-01 03:35:50 +0000