summaryrefslogtreecommitdiffstats
path: root/install/tools/ipa-replica-prepare
diff options
context:
space:
mode:
authorSimo Sorce <ssorce@redhat.com>2011-10-06 08:37:17 +0200
committerMartin Kosek <mkosek@redhat.com>2011-10-06 08:41:27 +0200
commit652d315b3e486abb0b51e02437cd0f1243425a6e (patch)
tree513594f27dedebfb60ced25317b3bbf8055da2c5 /install/tools/ipa-replica-prepare
parent185ca8f6fc5e69e989e473c8b1d066aa2d8e5cb1 (diff)
downloadfreeipa-652d315b3e486abb0b51e02437cd0f1243425a6e.tar.gz
freeipa-652d315b3e486abb0b51e02437cd0f1243425a6e.tar.xz
freeipa-652d315b3e486abb0b51e02437cd0f1243425a6e.zip
replica-prepare: anonymous binds may be disallowed
Fixes: https://fedorahosted.org/freeipa/ticket/1900
Diffstat (limited to 'install/tools/ipa-replica-prepare')
-rwxr-xr-xinstall/tools/ipa-replica-prepare51
1 files changed, 27 insertions, 24 deletions
diff --git a/install/tools/ipa-replica-prepare b/install/tools/ipa-replica-prepare
index eb93bc851..6e98a2d0a 100755
--- a/install/tools/ipa-replica-prepare
+++ b/install/tools/ipa-replica-prepare
@@ -27,7 +27,7 @@ import krbV
from ipapython import ipautil
from ipaserver.install import bindinstance, dsinstance, installutils, certs
-from ipaserver.install.bindinstance import add_zone, add_reverse_zone, add_fwd_rr, add_ptr_rr
+from ipaserver.install.bindinstance import add_zone, add_reverse_zone, add_fwd_rr, add_ptr_rr, dns_container_exists
from ipaserver.install.replication import enable_replication_version_checking
from ipaserver.install.installutils import resolve_host
from ipaserver.plugins.ldap2 import ldap2
@@ -246,14 +246,35 @@ def main():
if certs.ipa_self_signed_master() == False:
sys.exit('A selfsign CA backend can only prepare on the original master')
+ # get the directory manager password
+ dirman_password = options.password
+ if not options.password:
+ try:
+ dirman_password = get_dirman_password()
+ except KeyboardInterrupt:
+ sys.exit(0)
+ if dirman_password is None:
+ sys.exit("\nDirectory Manager password required")
+
+ # Try out the password
+ try:
+ conn = ldap2(shared_instance=False)
+ conn.connect(bind_dn='cn=directory manager', bind_pw=dirman_password)
+ conn.disconnect()
+ except errors.ACIError:
+ sys.exit("\nThe password provided is incorrect for LDAP server %s" % api.env.host)
+ except errors.LDAPError:
+ sys.exit("\nUnable to connect to LDAP server %s" % api.env.host)
+
try:
installutils.verify_fqdn(replica_fqdn, system_name_check=False)
except RuntimeError, e:
msg = str(e)
if msg.startswith('Unable to resolve host name'):
if options.ip_address is None:
- if bindinstance.dns_container_exists(api.env.host,
- api.env.basedn):
+ if dns_container_exists(api.env.host, api.env.basedn,
+ dm_password=dirman_password,
+ ldapi=True, realm=api.env.realm):
msg += '\nAdd the --ip-address argument to create a DNS entry.'
sys.exit(msg)
else:
@@ -263,7 +284,9 @@ def main():
sys.exit(msg)
if options.ip_address:
- if not bindinstance.dns_container_exists(api.env.host, api.env.basedn):
+ if not dns_container_exists(api.env.host, api.env.basedn,
+ dm_password=dirman_password,
+ ldapi=True, realm=api.env.realm):
print "You can't add a DNS record because DNS is not set up."
sys.exit(1)
if options.reverse_zone and not bindinstance.verify_reverse_zone(options.reverse_zone, options.ip_address):
@@ -285,26 +308,6 @@ def main():
sys.exit(1)
ds_dir = dsinstance.config_dirname(dsinstance.realm_to_serverid(api.env.realm))
- # get the directory manager password
- dirman_password = options.password
- if not options.password:
- try:
- dirman_password = get_dirman_password()
- except KeyboardInterrupt:
- sys.exit(0)
- if dirman_password is None:
- sys.exit("\nDirectory Manager password required")
-
- # Try out the password
- try:
- conn = ldap2(shared_instance=False)
- conn.connect(bind_dn='cn=directory manager', bind_pw=dirman_password)
- conn.disconnect()
- except errors.ACIError:
- sys.exit("\nThe password provided is incorrect for LDAP server %s" % api.env.host)
- except errors.LDAPError:
- sys.exit("\nUnable to connect to LDAP server %s" % api.env.host)
-
print "Preparing replica for %s from %s" % (replica_fqdn, api.env.host)
enable_replication_version_checking(api.env.host, api.env.realm,
dirman_password)