summaryrefslogtreecommitdiffstats
path: root/ipaserver/install
Commit message (Collapse)AuthorAgeFilesLines
* Add FIPS-token password of HTTPD NSS databaseStanislav Laznicka2017-02-151-7/+12
| | | | | | | | | This change is required for httpd to function properly in FIPS https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* Fix uninstall stopping ipa.serviceSimo Sorce2017-02-151-2/+6
| | | | | | | | | | | | | When uninstalling systemd is told to disable the service, but it is not told to sopt it, so it believes it is still running. This can cause issues in some cases if a reinstall is performed right after an uninstall, as systemd may decide to stop the disabled service while we are reinstalling, causing the new install to fail. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Rationalize creation of RA and HTTPD NSS databasesSimo Sorce2017-02-154-37/+51
| | | | | | | | | | The RA database sould not be created by the HTTP instance, but in the code path that creates the CA instance. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Add a new user to run the framework codeSimo Sorce2017-02-157-12/+26
| | | | | | | | | | | | | | | | | Add the apache user the ipawebui group. Make the ccaches directory owned by the ipawebui group and make mod_auth_gssapi write the ccache files as r/w by the apache user and the ipawebui group. Fix tmpfiles creation ownership and permissions to allow the user to access ccaches files. The webui framework now works as a separate user than apache, so the certs used to access the dogtag instance need to be usable by this new user as well. Both apache and the webui user are in the ipawebui group, so use that. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Always use /etc/ipa/ca.crt as CA cert fileSimo Sorce2017-02-153-11/+7
| | | | | | | | | | | | | It seem like ALIAS_CACERT_ASC was just a redundant location for the CA cert file which is always available in /etc/ipa/ca.crt Just use the canonical CA cert location in /etc/ipa for all cases and stop creating a separate cacert file. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Simplify NSSDatabase password file handlingSimo Sorce2017-02-155-30/+21
| | | | | | | https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Separate RA cert store from the HTTP cert storeSimo Sorce2017-02-1517-143/+183
| | | | | | | | | | | | | | | This is in preparation for separating out the user under which the ipa api framework runs as. This commit also removes certs.NSS_DIR to avoid confusion and replaces it where appropriate with the correct NSS DB directory, either the old HTTPD_ALIAS_DIR ot the RA DB IPA_RADB_DIR. In some cases its use is removed altogether as it was simply not necessary. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Configure HTTPD to work via Gss-ProxySimo Sorce2017-02-155-12/+29
| | | | | | | | https://fedorahosted.org/freeipa/ticket/4189 https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Use Anonymous user to obtain FAST armor ccacheSimo Sorce2017-02-154-9/+26
| | | | | | | | | | | | The anonymous user allows the framework to obtain an armor ccache without relying on usable credentials, either via a keytab or a pkinit and public certificates. This will be needed once the HTTP keytab is moved away for privilege separation. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Generate tmpfiles config at install timeSimo Sorce2017-02-153-0/+13
| | | | | | | | | | | | | | We do not want to generate runtime directories just because the packages are installed, but only if the server is actually setup and run. Also this will be needed later because we will create a user at install time and some tmpfiles will need to be owned by this user. As we are changing this code also rationalize the directory structure and move it from the http rundir to the ipa specific rundir. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Change session handlingSimo Sorce2017-02-157-39/+22
| | | | | | | | | | | | | | | | Stop using memcache, use mod_auth_gssapi filesystem based ccaches. Remove custom session handling, use mod_auth_gssapi and mod_session to establish and keep a session cookie. Add loopback to mod_auth_gssapi to do form absed auth and pass back a valid session cookie. And now that we do not remove ccaches files to move them to the memcache, we can avoid the risk of pollutting the filesystem by keeping a common ccache file for all instances of the same user. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Backup /root/kracert.p12Christian Heimes2017-02-141-0/+1
| | | | | | | | | ipa-backup now backs up /root/kracert.p12. The file contains the certs and encrypted private keys for KRA transport, storage and audit. Closes: https://fedorahosted.org/freeipa/ticket/6659 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Remove is_fips_enabled checks in installers and ipactlStanislav Laznicka2017-02-132-10/+7
| | | | | | https://fedorahosted.org/freeipa/ticket/5695 Reviewed-By: Tomas Krizek <tkrizek@redhat.com>
* cryptography has deprecated serial in favor of serial_numberChristian Heimes2017-02-101-2/+2
| | | | | | Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* py3: change_admin_password: use textual modeMartin Basti2017-02-101-16/+8
| | | | | | | | | | Convert function to NamedTemporaryFile with textual mode, because passwords are text. Using `with` and NamedTemporaryFile gives more security agains leaking password from tempfiles. https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: create DNS zonefile: use textual modeMartin Basti2017-02-101-4/+7
| | | | | | | | Also code was rewritten to use NamedTemporaryFile with context https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: upgradeinstance: use bytes literals with LDIF operationsMartin Basti2017-02-101-3/+3
| | | | | | | | python ldif support only bytes as values, literals must be bytes https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: upgradeinstance: decode data before storing them as backup...Martin Basti2017-02-101-6/+8
| | | | | | | | | | ...and vice versa backup requires string not bytes, but ldap provide bytes thus data must be decoded and encoded from restore https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: upgradeinstance: open dse.ldif in textual modeMartin Basti2017-02-101-7/+7
| | | | | | | | ldap ldif parser requires to have input file opened in textual mode https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* bindinstance: fix named.conf parsing regexsTomas Krizek2017-02-101-7/+6
| | | | | | | | | Since named.conf API for bind-dyndb-ldap was updated, our parsing regexes have to change. https://fedorahosted.org/freeipa/ticket/6565 Reviewed-By: Martin Basti <mbasti@redhat.com>
* PEP8: fix line length for regexs in bindinstanceTomas Krizek2017-02-101-3/+6
| | | | Reviewed-By: Martin Basti <mbasti@redhat.com>
* named.conf template: update API for bind 9.11Tomas Krizek2017-02-091-0/+1
| | | | | | | | | | | | | Use the new API for bind 9.11. Removed deprecated "serial_autoincrement" and updated the rest of configuration to conform to the new format. This only fixes new IPA installations. For existing installations, named.conf will be transformed when the new version of bind-dyndb-ldap is installed. https://fedorahosted.org/freeipa/ticket/6565 Reviewed-By: Martin Basti <mbasti@redhat.com>
* Remove obsolete serial_autoincrement from named.conf parsingTomas Krizek2017-02-091-52/+4
| | | | | | | | | Option serial_autoincrement is no longer supported. Remove it from the named.conf parser and add it to deprecated options to be removed. https://fedorahosted.org/freeipa/ticket/6565 Reviewed-By: Martin Basti <mbasti@redhat.com>
* certdb: remove unused valid_months propertyTomas Krizek2017-02-091-1/+0
| | | | | | | | Property valid_months is no longer used anywhere in the code. It was removed when the selfsign funcionality was dropped. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* certdb: remove unused keysize propertyTomas Krizek2017-02-091-1/+0
| | | | | | | | | Keysize property is no longer used anywhere in the code. It was originally introduced for the request_cert function, which was later refactored to use a function argument instead. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
* replica install: relax domain level check for promotionFraser Tweedale2017-02-091-26/+30
| | | | | | | | | | | | | | | promote_check currently requires DL == 1. Relax the check to require DL >= 1, so that things will work for future DL increases. Also separate the concerns of retrieving the current domain level, validating whether the domain level is supported by the IPA version, and validating whether the current domain level supports the replica installation method attempted (i.e. replica file versus promotion). Part of: https://fedorahosted.org/freeipa/ticket/5011 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: ldapupdate: fix logging str(bytes) issueMartin Basti2017-02-081-3/+5
| | | | | | | | | | | | bytes as argument of str() gives unexpected result by adding prefix "b" there. Also add missing safe_option() call to logging (it will fix another str(bytes) issue) https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* replica install: do not log host OTPJan Cholasta2017-02-071-1/+3
| | | | | | | | | | Do not log the value of the --password option of ipa-client-install when it is run from ipa-replica-install before replica promotion. https://fedorahosted.org/freeipa/ticket/6633 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Abhijeet Kasurde <akasurde@redhat.com>
* ipa-kra-install must create directory if it does not existFlorence Blanc-Renaud2017-02-021-0/+4
| | | | | | | | | | | | | ipa-kra-install creates an admin cert file in /root/.dogtag/pki-tomcat/ca_admin.cert but does not check that the parent directory exists. This situation can happen when uninstall + restore has been run. The fix creates the directory if not present. https://fedorahosted.org/freeipa/ticket/6606 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Use proper logging for error messagesMartin Basti2017-01-311-4/+6
| | | | | | https://fedorahosted.org/freeipa/ticket/6588r Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* wait_for_entry: use only DN as parameterMartin Basti2017-01-312-5/+3
| | | | | | | | | Using the whole entry is not needed as parameter because only DN is used and it prevents easier usage of this function https://fedorahosted.org/freeipa/ticket/6588 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Explicitly handle quoting/unquoting of NSSNickname directiveMartin Babinsky2017-01-252-4/+14
| | | | | | | | | | | Improve the single/double quote handling during parsing/unparsing of nss.conf's NSSNickname directive. Single quotes are now added/stripped explicitly when handling the certificate nickname. https://fedorahosted.org/freeipa/ticket/6460 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Delegate directive value quoting/unquoting to separate functionsMartin Babinsky2017-01-251-27/+43
| | | | | | | | | | | | | | | | | Separate functions were added to installutils module to quote/unquote a string in arbitrary characters. `installutils.get/set_directive` functions will use them to enclose the directive values in double quotes/strip the double quotes from retrieved values to maintain the original behavior. These functions can be used also for custom quoting/unquoting of retrieved values when desired. https://fedorahosted.org/freeipa/ticket/6460 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* installutils: improve directive value parsing in `get_directive`Martin Babinsky2017-01-251-2/+17
| | | | | | | | | | | | | `get_directive` value parsing was improved in order to bring its logic more in-line to changes in `set_directive`: a specified quoting character is now unquoted and stripped from the retrieved value. The function will now also error out when malformed directive is encountered. https://fedorahosted.org/freeipa/ticket/6460 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* Fix the installutils.set_directive docstringMartin Babinsky2017-01-251-5/+8
| | | | | | | | | Add missing parameter descriptions and fix incorrect indentation https://fedorahosted.org/freeipa/ticket/6460 Reviewed-By: Tomas Krizek <tkrizek@redhat.com> Reviewed-By: Petr Spacek <pspacek@redhat.com>
* py3: __add_acl: use standard ipaldap methodsMartin Basti2017-01-241-8/+5
| | | | | | | | | | Using raw pyldap interface we have to keep vaules as bytes. Is easier to migrate to ipaldap and use strings without decoding and encoding. https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: cainstance: replace mkstemp with NamedTemporaryFileMartin Basti2017-01-241-24/+25
| | | | | | | | | | | With Python3 files must be opened in textual mode to write text, and best practise is to use fileobject instead fo os.write() and manual encodig https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: write CA/KRA config into file opened in text modeMartin Basti2017-01-242-2/+2
| | | | | | | | | | config parser writes data as text so CA/KRA should be opened in textual mode otherwise type errors are raised from installer https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: CA/KRA: config parser requires stringMartin Basti2017-01-242-2/+4
| | | | | | | | | | basedn is DN object it has to be converted to string before it can be used with config parser https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: open temporary ldif file in text modeMartin Basti2017-01-241-2/+3
| | | | | | | | | | | | ldif parser uses file in text mode, so we have to open it in text mode in py3 Also values passed to parser should be bytes https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: service.py: replace mkstemp by NamedTemporaryFileMartin Basti2017-01-241-3/+4
| | | | | | | | | | NamedTemporaryfile can be used in more pythonic way and file can be opened in textual mode that is required with PY3 https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* py3: create_cert_db: write to file in a compatible wayMartin Basti2017-01-241-3/+3
| | | | | | | | | | Py3 expect bytes to be writed using os.write. Instead of that using io module is more pythonic. https://fedorahosted.org/freeipa/ticket/4985 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* ipa-restore must stop tracking PKINIT cert in the preparation phaseFlorence Blanc-Renaud2017-01-201-1/+3
| | | | | | | | | | | | | ipa-restore calls certmonger to stop tracking the PKI certs, HTTP and DS certs. It must also stop tracking the newly introduced PKINIT cert (stored in /var/kerberos/krb5kdc/kdc.crt). Otherwise the restore operation ends up with PKINIT cert tracked twice and uninstallation fails. https://fedorahosted.org/freeipa/ticket/6570 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* Update warning message for ipa server uninstallAbhijeet Kasurde2017-01-181-1/+3
| | | | | | | | | | | Fix adds an additional recommendation message for taking backup of existing data and configuration before proceeding to ipa server uninstallation procedures. Fixes https://fedorahosted.org/freeipa/ticket/6548 Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
* cainstance: do not configure renewal guardJan Cholasta2017-01-162-39/+15
| | | | | | | | | | Do not configure renewal guard for dogtag-ipa-renew-agent, as it is not used in IPA anymore. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* dogtaginstance: track server certificate with our renew agentJan Cholasta2017-01-162-3/+3
| | | | | | | | | | Track Dogtag's server certificate with dogtag-ipa-ca-renew-agent instead of dogtag-ipa-renew-agent. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
* Remove duplicated step from DS installMartin Basti2017-01-121-2/+0
| | | | | | | "Adding SASL mappings.." is duplicated step in __common_setup in DS instance and should be removed. Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
* Add sanity checks for use of --ca-subject and --subject-baseFraser Tweedale2017-01-111-0/+7
| | | | | | | | | | Print an error and terminate if --ca-subject or --subject-base are used when installing a CA-less master or when performing standalone installation of a CA replica. Part of: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
* Indicate that ca subject / subject base uses LDAP RDN orderFraser Tweedale2017-01-111-2/+6
| | | | | | | | Update man pages and help output to indicate that --subject-base and --ca-subject options interpret their arguments in LDAP order. Fixes: https://fedorahosted.org/freeipa/ticket/6455 Reviewed-By: Christian Heimes <cheimes@redhat.com>
* Allow full customisability of IPA CA subject DNFraser Tweedale2017-01-1110-97/+172
| | | | | | | | | | | | | | | | | | | | | | | | | | Currently only the "subject base" of the IPA CA subject DN can be customised, via the installer's --subject-base option. The RDN "CN=Certificate Authority" is appended to form the subject DN, and this composition is widely assumed. Some administrators need more control over the CA subject DN, especially to satisfy expectations of external CAs when the IPA CA is to be externally signed. This patch adds full customisability of the CA subject DN. Specifically: - Add the --ca-subject option for specifying the full IPA CA subject DN. Defaults to "CN=Certificate Authority, O=$SUBJECT_BASE". - ipa-ca-install, when installing a CA in a previous CA-less topology, updates DS certmap.conf with the new new CA subject DN. - DsInstance.find_subject_base no longer looks in certmap.conf, because the CA subject DN can be unrelated to the subject base. Fixes: https://fedorahosted.org/freeipa/ticket/2614 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
generated by cgit (git 2.34.1) at 2024-07-04 18:37:40 +0000