summaryrefslogtreecommitdiffstats
path: root/ipaserver/install
Commit message (Collapse)AuthorAgeFilesLines
* Drop our own PKCS#10 ASN.1 decoder and use the one from python-nssRob Crittenden2010-07-291-1/+1
| | | | | | | | | | | | | | | This patch: - bumps up the minimum version of python-nss - will initialize NSS with nodb if a CSR is loaded and it isn't already init'd - will shutdown NSS if initialized in the RPC subsystem so we use right db - updated and added a few more tests Relying more on NSS introduces a bit of a problem. For NSS to work you need to have initialized a database (either a real one or no_db). But once you've initialized one and want to use another you have to close down the first one. I've added some code to nsslib.py to do just that. This could potentially have some bad side-effects at some point, it works ok now.
* Add support for User-Private GroupsRob Crittenden2010-07-061-2/+32
| | | | | | | | | | | | | | | This uses a new 389-ds plugin, Managed Entries, to automatically create a group entry when a user is created. The DNA plugin ensures that the group has a gidNumber that matches the users uidNumber. When the user is removed the group is automatically removed as well. If the managed entries plugin is not available or if a specific, separate range for gidNumber is passed in at install time then User-Private Groups will not be configured. The code checking for the Managed Entries plugin may be removed at some point. This is there because this plugin is only available in a 389-ds alpha release currently (1.2.6-a4).
* Fix indentation problem causing build breakageRob Crittenden2010-06-241-2/+2
|
* Replication version checking.Rob Crittenden2010-06-241-0/+4
| | | | | | | | Whenever we upgrade IPA such that any data incompatibilities might occur then we need to bump the DATA_VERSION value so that data will not replicate to other servers. The idea is that you can do an in-place upgrade of each IPA server and the different versions own't pollute each other with bad data.
* use NSS for SSL operationsJohn Dennis2010-06-152-48/+0
|
* Catch the condition where dogtag is already configured (no preop.pin)Rob Crittenden2010-06-011-0/+3
| | | | | | | | This causes the installation to blow up badly otherwise. To remove an existing instance run: # pkiremove -pki_instance_root=/var/lib -pki_instance_name=pki-ca
* Add LDAP upgrade over ldapi support.Rob Crittenden2010-06-013-14/+155
| | | | | | | | | This disables all but the ldapi listener in DS so it will be quiet when we perform our upgrades. It is expected that any other clients that also use ldapi will be shut down by other already (krb5 and dns). Add ldapi as an option in ipaldap and add the beginning of pure offline support (e.g. direct editing of LDIF files).
* Re-number some attributes to compress our usage to be contiguousRob Crittenden2010-05-271-2/+0
| | | | | | | No longer install the policy or key escrow schemas and remove their OIDs for now. 594149
* Move the dogtag SELinux rules loading into the spec fileRob Crittenden2010-05-271-24/+0
| | | | | | I couldn't put the dogtag rules into the spec file until we required dogtag as a component. If it wasn't pre-loaded them the rules loading would fail because types would be missing.
* Include -clone_uri argument to pkisilent setting the clone URI.Rob Crittenden2010-05-271-0/+2
| | | | This makes creating a clone from a clone work as expected.
* Create default HBAC rule allowing any user to access any host from any hostRob Crittenden2010-05-051-2/+9
| | | | | | | | | This is to make initial installation and testing easier. Use the --no_hbac_allow option on the command-line to disable this when doing an install. To remove it from a running server do: ipa hbac-del allow_all
* Handle CSRs whether they have NEW in the header or notRob Crittenden2010-05-032-15/+5
| | | | Also consolidate some duplicate code
* Make the installer/uninstaller more aware of its stateRob Crittenden2010-05-037-3/+45
| | | | | | | | | | | | | | We have had a state file for quite some time that is used to return the system to its pre-install state. We can use that to determine what has been configured. This patch: - uses the state file to determine if dogtag was installed - prevents someone from trying to re-install an installed server - displays some output when uninstalling - re-arranges the ipa_kpasswd installation so the state is properly saved - removes pkiuser if it was added by the installer - fetches and installs the CA on both masters and clients
* Set SO_REUSEADDR when determining socket availabilityRob Crittenden2010-05-031-0/+2
| | | | | | The old perl DS code for detection didn't set this so was often confused about port availability. We had to match their behavior so the installation didn't blow up. They fixed this a while ago, this catches us up.
* Some more changes for DNS forwarders promptMartin Nagy2010-04-231-3/+3
|
* Add forgotten trailing dots in DNS recordsMartin Nagy2010-04-231-3/+3
| | | | 583023
* Delete old SRV records during uninstallationMartin Nagy2010-04-231-11/+68
|
* Fix installing IPA with an external CARob Crittenden2010-04-231-1/+1
| | | | | | | | - cache all interactive answers - set non-interactive to True for the second run so nothing is asked - convert boolean values that are read in - require absolute paths for the external CA and signed cert files - fix the invocation message for the second ipa-server-install run
* Use escapes in DNs instead of quoting.Rob Crittenden2010-04-192-1/+7
| | | | Based on initial patch from Pavel Zuna.
* Remove older MITM fixes to make compatible with dogtag 1.3.3Rob Crittenden2010-04-192-14/+4
| | | | | | | We set a new port to be used with dogtag but IPA doesn't utilize it. This also changes the way we determine which security database to use. Rather than using whether api.env.home is set use api.env.in_tree.
* Fix ipa-dns-install. It was failing when DNS was reinstalling.Pavel Zuna2010-04-191-1/+10
|
* Configure the CRL URI in dogtag.Rob Crittenden2010-04-161-1/+4
| | | | | | Also print out a restart message after applying the custom subject. It takes a while to restart dogtag and this lets the user know things are moving forward.
* Don't let failure to trust the CA abort the server installation.Rob Crittenden2010-04-071-2/+5
| | | | | | This error could result in things not working properly but it should be relatively easy to fix from the command-line. There is no point in not installing at all due to this.
* Use GSSAPI auth for the ipa-replica-manage list and del commands.Rob Crittenden2010-03-192-1/+21
| | | | | | | | | | | | This creates a new role, replicaadmin, so a non-DM user can do limited management of replication agreements. Note that with cn=config if an unauthorized user performs a search an error is not returned, no entries are returned. This makes it difficult to determine if there are simply no replication agreements or we aren't allowed to see them. Once the ipaldap.py module gets replaced by ldap2 we can use Get Effective Rights to easily tell the difference.
* Provide mechanism in ipautil.run() to not log all arguments.Rob Crittenden2010-03-191-1/+10
| | | | | | | This is primarily designed to not log passwords but it could have other uses. 567867
* Make CA PKCS#12 location arg for ipa-replica-prepare, default /root/cacert.p12Rob Crittenden2010-03-191-0/+5
| | | | | pki-silent puts a copy of the root CA into /root/tmp-ca.p12. Rename this to /root/cacert.p12.
* Handle the case where the DS group exists but the user does notRob Crittenden2010-03-161-0/+9
| | | | | | | | If the group exists but the user doesn't then useradd blows up trying to create the user and group. So test to see if the group exists and if it does pass along the -g argument to useradd. Resolves #502960
* Don't assume local directory is valid or writable.Rob Crittenden2010-02-191-1/+6
| | | | | | | | certutil writes to the local directory when issuing a certificate. Change to the security database directory when issuing the self-signed CA. Also handle the case where a user is in a non-existent directory when doing the install.
* Make the DNS forwarders interactive input less confusingMartin Nagy2010-02-161-13/+17
| | | | Fixes #558984
* Get rid of ipapython.config in ipa-replica-prepareMartin Nagy2010-02-091-25/+27
| | | | | | | | | | Also get rid of functions get_host_name(), get_realm_name() and get_domain_name(). They used the old ipapython.config. Instead, use the variables from api.env. We also change them to bootstrap() and finalize() correctly. Additionally, we add the dns_container_exists() function that will be used in ipa-replica-prepare (next patch).
* Move the HTTP/S request code to a common libraryRob Crittenden2010-02-091-31/+16
| | | | | | | | This moves code that does HTTP and HTTPS requests into a common library that can be used by both the installer and the dogtag plugin. These functions are not generic HTTP/S clients, they are designed specifically to talk to dogtag, so use accordingly.
* Be more careful when base64-decoding certificatesRob Crittenden2010-02-022-9/+6
| | | | | Only decode certs that have a BEGIN/END block, otherwise assume it is in DER format.
* Update dogtag configuration to work after CVE-2009-3555 changesRob Crittenden2010-01-272-4/+16
| | | | | | | | NSS is going to disallow all SSL renegotiation by default. Because of this we need to always use the agent port of the dogtag server which always requires SSL client authentication. The end user port will prompt for a certificate if required but will attempt to re-do the handshake to make this happen which will fail with newer versions of NSS.
* Set BIND to use ldapi and use fake mnameMartin Nagy2010-01-211-0/+2
| | | | | | The fake_mname for now doesn't exists but is a feature that will be added in the near future. Since any unknown arguments to bind-dyndb-ldap are ignored, we are safe to use it now.
* Move some functions from ipa-server-install into installutilsMartin Nagy2010-01-211-0/+53
| | | | | We will need these functions in the new upcoming ipa-dns-install command.
* Allow a custom file mode when setting up debuggingMartin Nagy2010-01-211-2/+2
| | | | | | This will be handy in the future if we will want to install or uninstall only single IPA components and want to append to the installation logs. This will be used by the upcoming ipa-dns-install script.
* Only add an NTP SRV record if we really are setting up NTPMartin Nagy2010-01-211-3/+12
| | | | | | | The sample bind zone file that is generated if we don't use --setup-dns is also changed. Fixes #500238
* Use the dns plug-in for addition of records during installationMartin Nagy2010-01-211-33/+82
| | | | Fixes #528943
* User-defined certificate subjectsRob Crittenden2010-01-205-26/+55
| | | | | | | | | | | | | | | Let the user, upon installation, set the certificate subject base for the dogtag CA. Certificate requests will automatically be given this subject base, regardless of what is in the CSR. The selfsign plugin does not currently support this dynamic name re-assignment and will reject any incoming requests that don't conform to the subject base. The certificate subject base is stored in cn=ipaconfig but it does NOT dynamically update the configuration, for dogtag at least. The file /var/lib/pki-ca/profiles/ca/caIPAserviceCert.cfg would need to be updated and pki-cad restarted.
* Create pkiuser before calling pkicreate, pkicreate depends on the user existingJohn Dennis2010-01-201-1/+1
|
* Missed explicit reference to pki-ca, replace with self.service_nameRob Crittenden2010-01-111-2/+2
|
* Change the service name to reflect changes in pki-ca (now pki-cad).Rob Crittenden2010-01-071-3/+3
| | | | | | Also properly use the instance name where appropriate. There were a couple of places where the service name was used and this worked because they were the same.
* Added Fuzzy docstrings; make-test now runs doctests in tests/*; fixed ↵Jason Gerard DeRose2009-12-181-1/+1
| | | | 'existant' mispelling
* Make hosts more like real services so we can issue certs for host principalsRob Crittenden2009-12-161-1/+2
| | | | | This patch should make joining a client to the domain and using certmonger to get an initial certificate work.
* Make the IPA server host and its services "real" IPA entriesRob Crittenden2009-12-118-20/+134
| | | | | | | | | | | We use kadmin.local to bootstrap the creation of the kerberos principals for the IPA server machine: host, HTTP and ldap. This works fine and has the side-effect of protecting the services from modification by an admin (which would likely break the server). Unfortunately this also means that the services can't be managed by useful utilities such as certmonger. So we have to create them as "real" services instead.
* Bump the installation version number to V2.0Rob Crittenden2009-12-031-1/+1
|
* Ask the user before overwriting /etc/named.confMartin Nagy2009-12-021-1/+9
|
* Add option to have ipautil.run() not raise an exceptionRob Crittenden2009-11-305-14/+14
| | | | | | | There are times where a caller will want to determine the course of action based on the returncode instead of relying on it != 0. This also lets the caller get the contents of stdout and stderr.
* Add SELinux policy for CRL file publishing.Rob Crittenden2009-11-261-0/+26
| | | | | | | | | | This policy should really be provided by dogtag. We don't want to grant read/write access to everything dogtag can handle so we change the context to cert_t instead. But we have to let dogtag read/write that too hence this policy. To top it off we can't load this policy unless dogtag is also loaded so we insert it in the IPA installer
* Point to correct location of self-signed CA and set pw on 389-DS cert dbRob Crittenden2009-11-251-1/+1
| | | | | | | | The CA was moved from residing in the DS NSS database into the Apache database to support a self-signed CA certificate plugin. This was not updated in the installer boilerplate. The DS db wasn't getting a password set on it. Go ahead and set one.
generated by cgit (git 2.34.1) at 2025-09-01 12:56:04 +0000