websms/freeipa
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Imported Upstream version 4.3.1

Browse Source
This commit is contained in:
Mario Fetka
2021-08-10 02:37:58 +02:00
parent a791de49a2
commit 2f177da8f2
2056 changed files with 421730 additions and 1668138 deletions
Download Patch File Download Diff File Expand all files Collapse all files

60
install/tools/Makefile.am
View File

@@ -4,37 +4,7 @@ SUBDIRS = \
man \
$(NULL)
dist_noinst_DATA = \
ipa-ca-install.in \
ipa-dns-install.in \
ipa-kra-install.in \
ipa-server-install.in \
ipa-adtrust-install.in \
ipa-replica-conncheck.in \
ipa-replica-install.in \
ipa-replica-manage.in \
ipa-csreplica-manage.in \
ipa-server-certinstall.in \
ipa-server-upgrade.in \
ipactl.in \
ipa-compat-manage.in \
ipa-nis-manage.in \
ipa-managed-entries.in \
ipa-ldap-updater.in \
ipa-otptoken-import.in \
ipa-backup.in \
ipa-restore.in \
ipa-advise.in \
ipa-cacert-manage.in \
ipa-winsync-migrate.in \
ipa-pkinit-manage.in \
ipa-custodia.in \
ipa-custodia-check.in \
ipa-httpd-kdcproxy.in \
ipa-pki-retrieve-key.in \
$(NULL)
nodist_sbin_SCRIPTS = \
sbin_SCRIPTS = \
ipa-ca-install \
ipa-dns-install \
ipa-kra-install \
@@ -42,6 +12,7 @@ nodist_sbin_SCRIPTS = \
ipa-adtrust-install \
ipa-replica-conncheck \
ipa-replica-install \
ipa-replica-prepare \
ipa-replica-manage \
ipa-csreplica-manage \
ipa-server-certinstall \
@@ -52,31 +23,24 @@ nodist_sbin_SCRIPTS = \
ipa-managed-entries \
ipa-ldap-updater \
ipa-otptoken-import \
ipa-upgradeconfig \
ipa-backup \
ipa-restore \
ipa-advise \
ipa-cacert-manage \
ipa-winsync-migrate \
ipa-pkinit-manage \
$(NULL)
EXTRA_DIST = \
README \
$(sbin_SCRIPTS) \
$(NULL)
appdir = $(libexecdir)/ipa/
nodist_app_SCRIPTS = \
ipa-custodia \
ipa-custodia-check \
app_SCRIPTS = \
ipa-httpd-kdcproxy \
ipa-pki-retrieve-key \
$(NULL)
dist_app_SCRIPTS = \
ipa-httpd-pwdreader \
$(NULL)
PYTHON_SHEBANG = \
$(nodist_sbin_SCRIPTS) \
$(nodist_app_SCRIPTS) \
$(NULL)
CLEANFILES = $(PYTHON_SHEBANG)
include $(top_srcdir)/Makefile.pythonscripts.am
MAINTAINERCLEANFILES = \
*~ \
Makefile.in

363
install/tools/Makefile.in
View File

@@ -1,7 +1,7 @@
# Makefile.in generated by automake 1.16.1 from Makefile.am.
# Makefile.in generated by automake 1.15 from Makefile.am.
# @configure_input@
# Copyright (C) 1994-2018 Free Software Foundation, Inc.
# Copyright (C) 1994-2014 Free Software Foundation, Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
@@ -14,7 +14,6 @@
@SET_MAKE@
VPATH = @srcdir@
am__is_gnu_make = { \
if test -z '$(MAKELEVEL)'; then \
@@ -87,23 +86,13 @@ POST_INSTALL = :
NORMAL_UNINSTALL = :
PRE_UNINSTALL = :
POST_UNINSTALL = :
build_triplet = @build@
host_triplet = @host@
subdir = install/tools
subdir = tools
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/VERSION.m4 \
$(top_srcdir)/server.m4 $(top_srcdir)/configure.ac
am__aclocal_m4_deps = $(top_srcdir)/../version.m4 \
$(top_srcdir)/configure.ac
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
DIST_COMMON = $(srcdir)/Makefile.am $(dist_app_SCRIPTS) \
$(dist_noinst_DATA) $(am__DIST_COMMON)
DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
mkinstalldirs = $(install_sh) -d
CONFIG_HEADER = $(top_builddir)/config.h
CONFIG_CLEAN_FILES =
@@ -135,10 +124,8 @@ am__uninstall_files_from_dir = { \
|| { echo " ( cd '$$dir' && rm -f" $$files ")"; \
$(am__cd) "$$dir" && rm -f $$files; }; \
}
am__installdirs = "$(DESTDIR)$(appdir)" "$(DESTDIR)$(appdir)" \
"$(DESTDIR)$(sbindir)"
SCRIPTS = $(dist_app_SCRIPTS) $(nodist_app_SCRIPTS) \
$(nodist_sbin_SCRIPTS)
am__installdirs = "$(DESTDIR)$(appdir)" "$(DESTDIR)$(sbindir)"
SCRIPTS = $(app_SCRIPTS) $(sbin_SCRIPTS)
AM_V_P = $(am__v_P_@AM_V@)
am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
am__v_P_0 = false
@@ -166,7 +153,6 @@ am__can_run_installinfo = \
n|no|NO) false;; \
*) (install-info --version) >/dev/null 2>&1;; \
esac
DATA = $(dist_noinst_DATA)
RECURSIVE_CLEAN_TARGETS = mostlyclean-recursive clean-recursive \
distclean-recursive maintainer-clean-recursive
am__recursive_targets = \
@@ -174,7 +160,7 @@ am__recursive_targets = \
$(RECURSIVE_CLEAN_TARGETS) \
$(am__extra_recursive_targets)
AM_RECURSIVE_TARGETS = $(am__recursive_targets:-recursive=) TAGS CTAGS \
distdir distdir-am
distdir
am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
# Read a list of newline-separated strings from the standard input,
# and print each of them once, without duplicates. Input order is
@@ -195,8 +181,7 @@ am__define_uniq_tagged_files = \
ETAGS = etags
CTAGS = ctags
DIST_SUBDIRS = $(SUBDIRS)
am__DIST_COMMON = $(srcdir)/Makefile.in \
$(top_srcdir)/Makefile.pythonscripts.am
am__DIST_COMMON = $(srcdir)/Makefile.in
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
am__relativize = \
dir0=`pwd`; \
@@ -226,110 +211,34 @@ am__relativize = \
ACLOCAL = @ACLOCAL@
AMTAR = @AMTAR@
AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
API_VERSION = @API_VERSION@
AR = @AR@
AUTOCONF = @AUTOCONF@
AUTOHEADER = @AUTOHEADER@
AUTOMAKE = @AUTOMAKE@
AWK = @AWK@
CC = @CC@
CCDEPMODE = @CCDEPMODE@
CFLAGS = @CFLAGS@
CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
CMOCKA_LIBS = @CMOCKA_LIBS@
CONFIG_STATUS = @CONFIG_STATUS@
CPP = @CPP@
CPPFLAGS = @CPPFLAGS@
CRYPTO_CFLAGS = @CRYPTO_CFLAGS@
CRYPTO_LIBS = @CRYPTO_LIBS@
CYGPATH_W = @CYGPATH_W@
DATA_VERSION = @DATA_VERSION@
DEFS = @DEFS@
DEPDIR = @DEPDIR@
DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
DIRSRV_LIBS = @DIRSRV_LIBS@
DLLTOOL = @DLLTOOL@
DSYMUTIL = @DSYMUTIL@
DUMPBIN = @DUMPBIN@
ECHO_C = @ECHO_C@
ECHO_N = @ECHO_N@
ECHO_T = @ECHO_T@
EGREP = @EGREP@
EXEEXT = @EXEEXT@
FGREP = @FGREP@
GETTEXT_DOMAIN = @GETTEXT_DOMAIN@
GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
GIT_BRANCH = @GIT_BRANCH@
GIT_VERSION = @GIT_VERSION@
GMSGFMT = @GMSGFMT@
GMSGFMT_015 = @GMSGFMT_015@
GREP = @GREP@
INI_CFLAGS = @INI_CFLAGS@
INI_LIBS = @INI_LIBS@
INSTALL = @INSTALL@
INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
INTLLIBS = @INTLLIBS@
INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
IPAPLATFORM = @IPAPLATFORM@
IPA_DATA_DIR = @IPA_DATA_DIR@
IPA_SYSCONF_DIR = @IPA_SYSCONF_DIR@
JSLINT = @JSLINT@
KRAD_LIBS = @KRAD_LIBS@
KRB5KDC_SERVICE = @KRB5KDC_SERVICE@
KRB5_CFLAGS = @KRB5_CFLAGS@
KRB5_LIBS = @KRB5_LIBS@
LD = @LD@
LDAP_CFLAGS = @LDAP_CFLAGS@
LDAP_LIBS = @LDAP_LIBS@
LDFLAGS = @LDFLAGS@
LIBICONV = @LIBICONV@
LIBINTL = @LIBINTL@
LIBINTL_LIBS = @LIBINTL_LIBS@
LIBOBJS = @LIBOBJS@
LIBPDB_NAME = @LIBPDB_NAME@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
LIBVERTO_LIBS = @LIBVERTO_LIBS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBICONV = @LTLIBICONV@
LTLIBINTL = @LTLIBINTL@
LTLIBOBJS = @LTLIBOBJS@
LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
MAINT = @MAINT@
MAKEINFO = @MAKEINFO@
MANIFEST_TOOL = @MANIFEST_TOOL@
MKDIR_P = @MKDIR_P@
MK_ASSIGN = @MK_ASSIGN@
MK_ELSE = @MK_ELSE@
MK_ENDIF = @MK_ENDIF@
MK_IFEQ = @MK_IFEQ@
MSGATTRIB = @MSGATTRIB@
MSGCMP = @MSGCMP@
MSGFMT = @MSGFMT@
MSGFMT_015 = @MSGFMT_015@
MSGINIT = @MSGINIT@
MSGMERGE = @MSGMERGE@
NAMED_GROUP = @NAMED_GROUP@
NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
NDRNBT_LIBS = @NDRNBT_LIBS@
NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
NDRPAC_LIBS = @NDRPAC_LIBS@
NDR_CFLAGS = @NDR_CFLAGS@
NDR_LIBS = @NDR_LIBS@
NM = @NM@
NMEDIT = @NMEDIT@
NSPR_CFLAGS = @NSPR_CFLAGS@
NSPR_LIBS = @NSPR_LIBS@
NSS_CFLAGS = @NSS_CFLAGS@
NSS_LIBS = @NSS_LIBS@
NUM_VERSION = @NUM_VERSION@
OBJDUMP = @OBJDUMP@
OBJEXT = @OBJEXT@
ODS_USER = @ODS_USER@
OTOOL = @OTOOL@
OTOOL64 = @OTOOL64@
PACKAGE = @PACKAGE@
PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
@@ -338,89 +247,33 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PKG_CONFIG = @PKG_CONFIG@
PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
PLATFORM_PYTHON = @PLATFORM_PYTHON@
POPT_CFLAGS = @POPT_CFLAGS@
POPT_LIBS = @POPT_LIBS@
POSUB = @POSUB@
PYLINT = @PYLINT@
PYTHON = @PYTHON@
PYTHON2 = @PYTHON2@
PYTHON3 = @PYTHON3@
PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
PYTHON_INSTALL_EXTRA_OPTIONS = @PYTHON_INSTALL_EXTRA_OPTIONS@
PYTHON_PLATFORM = @PYTHON_PLATFORM@
PYTHON_PREFIX = @PYTHON_PREFIX@
PYTHON_VERSION = @PYTHON_VERSION@
RANLIB = @RANLIB@
SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
SASL_CFLAGS = @SASL_CFLAGS@
SASL_LIBS = @SASL_LIBS@
SED = @SED@
SET_MAKE = @SET_MAKE@
SHELL = @SHELL@
SSSCERTMAP_CFLAGS = @SSSCERTMAP_CFLAGS@
SSSCERTMAP_LIBS = @SSSCERTMAP_LIBS@
SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
SSSNSSIDMAP_LIBS = @SSSNSSIDMAP_LIBS@
STRIP = @STRIP@
TALLOC_CFLAGS = @TALLOC_CFLAGS@
TALLOC_LIBS = @TALLOC_LIBS@
TEVENT_CFLAGS = @TEVENT_CFLAGS@
TEVENT_LIBS = @TEVENT_LIBS@
UNISTRING_LIBS = @UNISTRING_LIBS@
UNLINK = @UNLINK@
USE_NLS = @USE_NLS@
UUID_CFLAGS = @UUID_CFLAGS@
UUID_LIBS = @UUID_LIBS@
VENDOR_SUFFIX = @VENDOR_SUFFIX@
TX = @TX@
VERSION = @VERSION@
XGETTEXT = @XGETTEXT@
XGETTEXT_015 = @XGETTEXT_015@
XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
XMLRPC_CFLAGS = @XMLRPC_CFLAGS@
XMLRPC_LIBS = @XMLRPC_LIBS@
abs_builddir = @abs_builddir@
abs_srcdir = @abs_srcdir@
abs_top_builddir = @abs_top_builddir@
abs_top_srcdir = @abs_top_srcdir@
ac_ct_AR = @ac_ct_AR@
ac_ct_CC = @ac_ct_CC@
ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
am__include = @am__include@
am__leading_dot = @am__leading_dot@
am__quote = @am__quote@
am__tar = @am__tar@
am__untar = @am__untar@
bindir = @bindir@
build = @build@
build_alias = @build_alias@
build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
datadir = @datadir@
datarootdir = @datarootdir@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
host = @host@
host_alias = @host_alias@
host_cpu = @host_cpu@
host_os = @host_os@
host_vendor = @host_vendor@
htmldir = @htmldir@
i18ntests = @i18ntests@
includedir = @includedir@
infodir = @infodir@
install_sh = @install_sh@
krb5rundir = @krb5rundir@
libdir = @libdir@
libexecdir = @libexecdir@
localedir = @localedir@
@@ -429,20 +282,13 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
pkgpyexecdir = @pkgpyexecdir@
pkgpythondir = @pkgpythondir@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
pyexecdir = @pyexecdir@
pythondir = @pythondir@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
srcdir = @srcdir@
sysconfdir = @sysconfdir@
sysconfenvdir = @sysconfenvdir@
systemdsystemunitdir = @systemdsystemunitdir@
systemdtmpfilesdir = @systemdtmpfilesdir@
target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
@@ -452,37 +298,7 @@ SUBDIRS = \
man \
$(NULL)
dist_noinst_DATA = \
ipa-ca-install.in \
ipa-dns-install.in \
ipa-kra-install.in \
ipa-server-install.in \
ipa-adtrust-install.in \
ipa-replica-conncheck.in \
ipa-replica-install.in \
ipa-replica-manage.in \
ipa-csreplica-manage.in \
ipa-server-certinstall.in \
ipa-server-upgrade.in \
ipactl.in \
ipa-compat-manage.in \
ipa-nis-manage.in \
ipa-managed-entries.in \
ipa-ldap-updater.in \
ipa-otptoken-import.in \
ipa-backup.in \
ipa-restore.in \
ipa-advise.in \
ipa-cacert-manage.in \
ipa-winsync-migrate.in \
ipa-pkinit-manage.in \
ipa-custodia.in \
ipa-custodia-check.in \
ipa-httpd-kdcproxy.in \
ipa-pki-retrieve-key.in \
$(NULL)
nodist_sbin_SCRIPTS = \
sbin_SCRIPTS = \
ipa-ca-install \
ipa-dns-install \
ipa-kra-install \
@@ -490,6 +306,7 @@ nodist_sbin_SCRIPTS = \
ipa-adtrust-install \
ipa-replica-conncheck \
ipa-replica-install \
ipa-replica-prepare \
ipa-replica-manage \
ipa-csreplica-manage \
ipa-server-certinstall \
@@ -500,36 +317,32 @@ nodist_sbin_SCRIPTS = \
ipa-managed-entries \
ipa-ldap-updater \
ipa-otptoken-import \
ipa-upgradeconfig \
ipa-backup \
ipa-restore \
ipa-advise \
ipa-cacert-manage \
ipa-winsync-migrate \
ipa-pkinit-manage \
$(NULL)
EXTRA_DIST = \
README \
$(sbin_SCRIPTS) \
$(NULL)
appdir = $(libexecdir)/ipa/
nodist_app_SCRIPTS = \
ipa-custodia \
ipa-custodia-check \
app_SCRIPTS = \
ipa-httpd-kdcproxy \
ipa-pki-retrieve-key \
$(NULL)
dist_app_SCRIPTS = \
ipa-httpd-pwdreader \
$(NULL)
MAINTAINERCLEANFILES = \
*~ \
Makefile.in
PYTHON_SHEBANG = \
$(nodist_sbin_SCRIPTS) \
$(nodist_app_SCRIPTS) \
$(NULL)
CLEANFILES = $(PYTHON_SHEBANG)
all: all-recursive
.SUFFIXES:
$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(top_srcdir)/Makefile.pythonscripts.am $(am__configure_deps)
$(srcdir)/Makefile.in: @MAINTAINER_MODE_TRUE@ $(srcdir)/Makefile.am $(am__configure_deps)
@for dep in $?; do \
case '$(am__configure_deps)' in \
*$$dep*) \
@@ -538,30 +351,29 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(top_srcdir)/Makefile.pythonscrip
exit 1;; \
esac; \
done; \
echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign install/tools/Makefile'; \
echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign tools/Makefile'; \
$(am__cd) $(top_srcdir) && \
$(AUTOMAKE) --foreign install/tools/Makefile
$(AUTOMAKE) --foreign tools/Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
*config.status*) \
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
*) \
echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles)'; \
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles);; \
echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
esac;
$(top_srcdir)/Makefile.pythonscripts.am $(am__empty):
$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(top_srcdir)/configure: $(am__configure_deps)
$(top_srcdir)/configure: @MAINTAINER_MODE_TRUE@ $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
$(ACLOCAL_M4): @MAINTAINER_MODE_TRUE@ $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(am__aclocal_m4_deps):
install-dist_appSCRIPTS: $(dist_app_SCRIPTS)
install-appSCRIPTS: $(app_SCRIPTS)
@$(NORMAL_INSTALL)
@list='$(dist_app_SCRIPTS)'; test -n "$(appdir)" || list=; \
@list='$(app_SCRIPTS)'; test -n "$(appdir)" || list=; \
if test -n "$$list"; then \
echo " $(MKDIR_P) '$(DESTDIR)$(appdir)'"; \
$(MKDIR_P) "$(DESTDIR)$(appdir)" || exit 1; \
@@ -588,50 +400,15 @@ install-dist_appSCRIPTS: $(dist_app_SCRIPTS)
} \
; done
uninstall-dist_appSCRIPTS:
uninstall-appSCRIPTS:
@$(NORMAL_UNINSTALL)
@list='$(dist_app_SCRIPTS)'; test -n "$(appdir)" || exit 0; \
@list='$(app_SCRIPTS)'; test -n "$(appdir)" || exit 0; \
files=`for p in $$list; do echo "$$p"; done | \
sed -e 's,.*/,,;$(transform)'`; \
dir='$(DESTDIR)$(appdir)'; $(am__uninstall_files_from_dir)
install-nodist_appSCRIPTS: $(nodist_app_SCRIPTS)
install-sbinSCRIPTS: $(sbin_SCRIPTS)
@$(NORMAL_INSTALL)
@list='$(nodist_app_SCRIPTS)'; test -n "$(appdir)" || list=; \
if test -n "$$list"; then \
echo " $(MKDIR_P) '$(DESTDIR)$(appdir)'"; \
$(MKDIR_P) "$(DESTDIR)$(appdir)" || exit 1; \
fi; \
for p in $$list; do \
if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
if test -f "$$d$$p"; then echo "$$d$$p"; echo "$$p"; else :; fi; \
done | \
sed -e 'p;s,.*/,,;n' \
-e 'h;s|.*|.|' \
-e 'p;x;s,.*/,,;$(transform)' | sed 'N;N;N;s,\n, ,g' | \
$(AWK) 'BEGIN { files["."] = ""; dirs["."] = 1; } \
{ d=$$3; if (dirs[d] != 1) { print "d", d; dirs[d] = 1 } \
if ($$2 == $$4) { files[d] = files[d] " " $$1; \
if (++n[d] == $(am__install_max)) { \
print "f", d, files[d]; n[d] = 0; files[d] = "" } } \
else { print "f", d "/" $$4, $$1 } } \
END { for (d in files) print "f", d, files[d] }' | \
while read type dir files; do \
if test "$$dir" = .; then dir=; else dir=/$$dir; fi; \
test -z "$$files" || { \
echo " $(INSTALL_SCRIPT) $$files '$(DESTDIR)$(appdir)$$dir'"; \
$(INSTALL_SCRIPT) $$files "$(DESTDIR)$(appdir)$$dir" || exit $$?; \
} \
; done
uninstall-nodist_appSCRIPTS:
@$(NORMAL_UNINSTALL)
@list='$(nodist_app_SCRIPTS)'; test -n "$(appdir)" || exit 0; \
files=`for p in $$list; do echo "$$p"; done | \
sed -e 's,.*/,,;$(transform)'`; \
dir='$(DESTDIR)$(appdir)'; $(am__uninstall_files_from_dir)
install-nodist_sbinSCRIPTS: $(nodist_sbin_SCRIPTS)
@$(NORMAL_INSTALL)
@list='$(nodist_sbin_SCRIPTS)'; test -n "$(sbindir)" || list=; \
@list='$(sbin_SCRIPTS)'; test -n "$(sbindir)" || list=; \
if test -n "$$list"; then \
echo " $(MKDIR_P) '$(DESTDIR)$(sbindir)'"; \
$(MKDIR_P) "$(DESTDIR)$(sbindir)" || exit 1; \
@@ -658,19 +435,13 @@ install-nodist_sbinSCRIPTS: $(nodist_sbin_SCRIPTS)
} \
; done
uninstall-nodist_sbinSCRIPTS:
uninstall-sbinSCRIPTS:
@$(NORMAL_UNINSTALL)
@list='$(nodist_sbin_SCRIPTS)'; test -n "$(sbindir)" || exit 0; \
@list='$(sbin_SCRIPTS)'; test -n "$(sbindir)" || exit 0; \
files=`for p in $$list; do echo "$$p"; done | \
sed -e 's,.*/,,;$(transform)'`; \
dir='$(DESTDIR)$(sbindir)'; $(am__uninstall_files_from_dir)
mostlyclean-libtool:
-rm -f *.lo
clean-libtool:
-rm -rf .libs _libs
# This directory's subdirectories are mostly independent; you can cd
# into them and run 'make' without going through this Makefile.
# To change the values of 'make' variables: instead of editing Makefiles,
@@ -770,10 +541,7 @@ cscopelist-am: $(am__tagged_files)
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
distdir: $(BUILT_SOURCES)
$(MAKE) $(AM_MAKEFLAGS) distdir-am
distdir-am: $(DISTFILES)
distdir: $(DISTFILES)
@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
list='$(DISTFILES)'; \
@@ -830,10 +598,10 @@ distdir-am: $(DISTFILES)
done
check-am: all-am
check: check-recursive
all-am: Makefile $(SCRIPTS) $(DATA)
all-am: Makefile $(SCRIPTS)
installdirs: installdirs-recursive
installdirs-am:
for dir in "$(DESTDIR)$(appdir)" "$(DESTDIR)$(appdir)" "$(DESTDIR)$(sbindir)"; do \
for dir in "$(DESTDIR)$(appdir)" "$(DESTDIR)$(sbindir)"; do \
test -z "$$dir" || $(MKDIR_P) "$$dir"; \
done
install: install-recursive
@@ -858,7 +626,6 @@ install-strip:
mostlyclean-generic:
clean-generic:
-test -z "$(CLEANFILES)" || rm -f $(CLEANFILES)
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
@@ -867,9 +634,10 @@ distclean-generic:
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@echo "it deletes files that may require special tools to rebuild."
-test -z "$(MAINTAINERCLEANFILES)" || rm -f $(MAINTAINERCLEANFILES)
clean: clean-recursive
clean-am: clean-generic clean-libtool mostlyclean-am
clean-am: clean-generic mostlyclean-am
distclean: distclean-recursive
-rm -f Makefile
@@ -887,13 +655,13 @@ info: info-recursive
info-am:
install-data-am: install-dist_appSCRIPTS install-nodist_appSCRIPTS
install-data-am: install-appSCRIPTS
install-dvi: install-dvi-recursive
install-dvi-am:
install-exec-am: install-nodist_sbinSCRIPTS
install-exec-am: install-sbinSCRIPTS
install-html: install-html-recursive
@@ -921,7 +689,7 @@ maintainer-clean-am: distclean-am maintainer-clean-generic
mostlyclean: mostlyclean-recursive
mostlyclean-am: mostlyclean-generic mostlyclean-libtool
mostlyclean-am: mostlyclean-generic
pdf: pdf-recursive
@@ -931,36 +699,27 @@ ps: ps-recursive
ps-am:
uninstall-am: uninstall-dist_appSCRIPTS uninstall-nodist_appSCRIPTS \
uninstall-nodist_sbinSCRIPTS
uninstall-am: uninstall-appSCRIPTS uninstall-sbinSCRIPTS
.MAKE: $(am__recursive_targets) install-am install-strip
.PHONY: $(am__recursive_targets) CTAGS GTAGS TAGS all all-am check \
check-am clean clean-generic clean-libtool cscopelist-am ctags \
ctags-am distclean distclean-generic distclean-libtool \
distclean-tags distdir dvi dvi-am html html-am info info-am \
install install-am install-data install-data-am \
install-dist_appSCRIPTS install-dvi install-dvi-am \
install-exec install-exec-am install-html install-html-am \
install-info install-info-am install-man \
install-nodist_appSCRIPTS install-nodist_sbinSCRIPTS \
check-am clean clean-generic cscopelist-am ctags ctags-am \
distclean distclean-generic distclean-tags distdir dvi dvi-am \
html html-am info info-am install install-am \
install-appSCRIPTS install-data install-data-am install-dvi \
install-dvi-am install-exec install-exec-am install-html \
install-html-am install-info install-info-am install-man \
install-pdf install-pdf-am install-ps install-ps-am \
install-strip installcheck installcheck-am installdirs \
installdirs-am maintainer-clean maintainer-clean-generic \
mostlyclean mostlyclean-generic mostlyclean-libtool pdf pdf-am \
ps ps-am tags tags-am uninstall uninstall-am \
uninstall-dist_appSCRIPTS uninstall-nodist_appSCRIPTS \
uninstall-nodist_sbinSCRIPTS
install-sbinSCRIPTS install-strip installcheck installcheck-am \
installdirs installdirs-am maintainer-clean \
maintainer-clean-generic mostlyclean mostlyclean-generic pdf \
pdf-am ps ps-am tags tags-am uninstall uninstall-am \
uninstall-appSCRIPTS uninstall-sbinSCRIPTS
.PRECIOUS: Makefile
# special handling of Python scripts with auto-generated shebang line
$(PYTHON_SHEBANG):%: %.in Makefile
$(AM_V_GEN)sed -e 's|@PYTHONSHEBANG[@]|#!$(PYTHON) -E|g' $< > $@
$(AM_V_GEN)chmod +x $@
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:

505
install/tools/ipa-adtrust-install Executable file
View File

@@ -0,0 +1,505 @@
#! /usr/bin/python2
#
# Authors: Sumit Bose <sbose@redhat.com>
# Based on ipa-server-install by Karl MacMillan <kmacmillan@mentalrootkit.com>
# and ipa-dns-install by Martin Nagy
#
# Copyright (C) 2011 Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
from __future__ import print_function
import six
import gssapi
from ipaserver.install import adtrustinstance
from ipaserver.install.installutils import *
from ipaserver.install import service
from ipapython import version
from ipapython import ipautil, sysrestore, ipaldap
from ipalib import api, errors, krb_utils
from ipapython.config import IPAOptionParser
from ipaplatform.paths import paths
from ipapython.ipa_log_manager import *
from ipapython.dn import DN
if six.PY3:
unicode = str
log_file_name = paths.IPASERVER_INSTALL_LOG
def parse_options():
parser = IPAOptionParser(version=version.VERSION)
parser.add_option("-d", "--debug", dest="debug", action="store_true",
default=False, help="print debugging information")
parser.add_option("--netbios-name", dest="netbios_name",
help="NetBIOS name of the IPA domain")
parser.add_option("--no-msdcs", dest="no_msdcs", action="store_true",
default=False, help="Do not create DNS service records " \
"for Windows in managed DNS server")
parser.add_option("--rid-base", dest="rid_base", type=int, default=1000,
help="Start value for mapping UIDs and GIDs to RIDs")
parser.add_option("--secondary-rid-base", dest="secondary_rid_base",
type=int, default=100000000,
help="Start value of the secondary range for mapping " \
"UIDs and GIDs to RIDs")
parser.add_option("-U", "--unattended", dest="unattended", action="store_true",
default=False, help="unattended installation never prompts the user")
parser.add_option("-a", "--admin-password",
sensitive=True, dest="admin_password",
help="admin user kerberos password")
parser.add_option("-A", "--admin-name",
sensitive=True, dest="admin_name", default='admin',
help="admin user principal")
parser.add_option("--add-sids", dest="add_sids", action="store_true",
default=False, help="Add SIDs for existing users and" \
" groups as the final step")
parser.add_option("--add-agents", dest="add_agents", action="store_true",
default=False, help="Add IPA masters to a list of hosts allowed to serve" \
"information about users from trusted forests")
parser.add_option("--enable-compat",
dest="enable_compat", default=False, action="store_true",
help="Enable support for trusted domains for old clients")
options, args = parser.parse_args()
safe_options = parser.get_safe_opts(options)
return safe_options, options
def netbios_name_error(name):
print("\nIllegal NetBIOS name [%s].\n" % name)
print("Up to 15 characters and only uppercase ASCII letters, digits "
"and dashes are allowed.")
def read_netbios_name(netbios_default):
netbios_name = ""
print("Enter the NetBIOS name for the IPA domain.")
print("Only up to 15 uppercase ASCII letters, digits "
"and dashes are allowed.")
print("Example: EXAMPLE.")
print("")
print("")
if not netbios_default:
netbios_default = "EXAMPLE"
while True:
netbios_name = ipautil.user_input("NetBIOS domain name", netbios_default, allow_empty = False)
print("")
if adtrustinstance.check_netbios_name(netbios_name):
break
netbios_name_error(netbios_name)
return netbios_name
def read_admin_password(admin_name):
print("Configuring cross-realm trusts for IPA server requires password for user '%s'." % (admin_name))
print("This user is a regular system account used for IPA server administration.")
print("")
admin_password = read_password(admin_name, confirm=False, validate=None)
return admin_password
def set_and_check_netbios_name(netbios_name, unattended):
"""
Depending if trust in already configured or not a given NetBIOS domain
name must be handled differently.
If trust is not configured the given NetBIOS is used or the NetBIOS is
generated if none was given on the command line.
If trust is already configured the given NetBIOS name is used to reset
the stored NetBIOS name it it differs from the current one.
"""
flat_name_attr = 'ipantflatname'
cur_netbios_name = None
gen_netbios_name = None
reset_netbios_name = False
entry = None
try:
entry = api.Backend.ldap2.get_entry(
DN(('cn', api.env.domain), api.env.container_cifsdomains,
ipautil.realm_to_suffix(api.env.realm)),
[flat_name_attr])
except errors.NotFound:
# trust not configured
pass
else:
cur_netbios_name = entry.get(flat_name_attr)[0]
if cur_netbios_name and not netbios_name:
# keep the current NetBIOS name
netbios_name = cur_netbios_name
reset_netbios_name = False
elif cur_netbios_name and cur_netbios_name != netbios_name:
# change the NetBIOS name
print("Current NetBIOS domain name is %s, new name is %s.\n" % \
(cur_netbios_name, netbios_name))
print("Please note that changing the NetBIOS name might " \
"break existing trust relationships.")
if unattended:
reset_netbios_name = True
print("NetBIOS domain name will be changed to %s.\n" % \
netbios_name)
else:
print("Say 'yes' if the NetBIOS shall be changed and " \
"'no' if the old one shall be kept.")
reset_netbios_name = ipautil.user_input(
'Do you want to reset the NetBIOS domain name?',
default = False, allow_empty = False)
if not reset_netbios_name:
netbios_name = cur_netbios_name
elif cur_netbios_name and cur_netbios_name == netbios_name:
# keep the current NetBIOS name
reset_netbios_name = False
elif not cur_netbios_name:
if not netbios_name:
gen_netbios_name = adtrustinstance.make_netbios_name(api.env.domain)
if entry is not None:
# Fix existing trust configuration
print("Trust is configured but no NetBIOS domain name found, " \
"setting it now.")
reset_netbios_name = True
else:
# initial trust configuration
reset_netbios_name = False
else:
# all possible cases should be covered above
raise Exception('Unexpected state while checking NetBIOS domain name')
if not adtrustinstance.check_netbios_name(netbios_name):
if unattended and not gen_netbios_name:
netbios_name_error(netbios_name)
sys.exit("Aborting installation.")
else:
if netbios_name:
netbios_name_error(netbios_name)
netbios_name = None
if not unattended and not netbios_name:
netbios_name = read_netbios_name(gen_netbios_name)
if unattended and not netbios_name and gen_netbios_name:
netbios_name = gen_netbios_name
return (netbios_name, reset_netbios_name)
def ensure_admin_kinit(admin_name, admin_password):
try:
ipautil.run(['kinit', admin_name], stdin=admin_password+'\n')
except ipautil.CalledProcessError as e:
print("There was error to automatically re-kinit your admin user ticket.")
return False
return True
def enable_compat_tree():
print("Do you want to enable support for trusted domains in Schema Compatibility plugin?")
print("This will allow clients older than SSSD 1.9 and non-Linux clients to work with trusted users.")
print("")
enable_compat = ipautil.user_input("Enable trusted domains support in slapi-nis?", default = False, allow_empty = False)
print("")
return enable_compat
def main():
safe_options, options = parse_options()
if os.getegid() != 0:
sys.exit("Must be root to setup AD trusts on server")
standard_logging_setup(log_file_name, debug=options.debug, filemode='a')
print("\nThe log file for this installation can be found in %s" % log_file_name)
root_logger.debug('%s was invoked with options: %s' % (sys.argv[0], safe_options))
root_logger.debug("missing options might be asked for interactively later\n")
root_logger.debug('IPA version %s' % version.VENDOR_VERSION)
check_server_configuration()
global fstore
fstore = sysrestore.FileStore(paths.SYSRESTORE)
print("==============================================================================")
print("This program will setup components needed to establish trust to AD domains for")
print("the FreeIPA Server.")
print("")
print("This includes:")
print(" * Configure Samba")
print(" * Add trust related objects to FreeIPA LDAP server")
#TODO:
#print " * Add a SID to all users and Posix groups"
print("")
print("To accept the default shown in brackets, press the Enter key.")
print("")
# Check if samba packages are installed
if not adtrustinstance.check_inst():
sys.exit("Aborting installation.")
# Initialize the ipalib api
cfg = dict(
in_server=True,
debug=options.debug,
)
api.bootstrap(**cfg)
api.finalize()
# If domain name and realm does not match, IPA server will not be able
# to estabilish trust with Active Directory. Print big fat warning.
realm_not_matching_domain = (api.env.domain.upper() != api.env.realm)
if realm_not_matching_domain:
print("WARNING: Realm name does not match the domain name.\n"
"You will not be able to estabilish trusts with Active "
"Directory unless\nthe realm name of the IPA server matches its "
"domain name.\n\n")
if not options.unattended:
if not ipautil.user_input("Do you wish to continue?",
default = False,
allow_empty = False):
sys.exit("Aborting installation.")
# Check if /etc/samba/smb.conf already exists. In case it was not generated
# by IPA, print a warning that we will break existing configuration.
if adtrustinstance.ipa_smb_conf_exists():
if not options.unattended:
print("IPA generated smb.conf detected.")
if not ipautil.user_input("Overwrite smb.conf?",
default = False,
allow_empty = False):
sys.exit("Aborting installation.")
elif os.path.exists(paths.SMB_CONF):
print("WARNING: The smb.conf already exists. Running "
"ipa-adtrust-install will break your existing samba "
"configuration.\n\n")
if not options.unattended:
if not ipautil.user_input("Do you wish to continue?",
default = False,
allow_empty = False):
sys.exit("Aborting installation.")
if not options.unattended and not options.enable_compat:
options.enable_compat = enable_compat_tree()
admin_password = options.admin_password
if not (options.unattended or admin_password):
admin_password = read_admin_password(options.admin_name)
admin_kinited = None
if admin_password:
admin_kinited = ensure_admin_kinit(options.admin_name, admin_password)
if not admin_kinited:
print("Proceeding with credentials that existed before")
try:
principal = krb_utils.get_principal()
except errors.CCacheError as e:
sys.exit("Must have Kerberos credentials to setup AD trusts on server: %s" % e.message)
try:
api.Backend.ldap2.connect()
except errors.ACIError as e:
sys.exit("Outdated Kerberos credentials. Use kdestroy and kinit to update your ticket")
except errors.DatabaseError as e:
sys.exit("Cannot connect to the LDAP database. Please check if IPA is running")
try:
user = api.Command.user_show(principal.partition('@')[0].partition('/')[0])['result']
group = api.Command.group_show(u'admins')['result']
if not (user['uid'][0] in group['member_user'] and
group['cn'][0] in user['memberof_group']):
raise errors.RequirementError(name='admins group membership')
except errors.RequirementError as e:
sys.exit("Must have administrative privileges to setup AD trusts on server")
except Exception as e:
sys.exit("Unrecognized error during check of admin rights: %s" % (str(e)))
(netbios_name, reset_netbios_name) = \
set_and_check_netbios_name(options.netbios_name,
options.unattended)
if not options.add_sids:
# The filter corresponds to ipa_sidgen_task.c LDAP search filter
filter = '(&(objectclass=ipaobject)(!(objectclass=mepmanagedentry))' \
'(|(objectclass=posixaccount)(objectclass=posixgroup)' \
'(objectclass=ipaidobject))(!(ipantsecurityidentifier=*)))'
base_dn = api.env.basedn
try:
root_logger.debug("Searching for objects with missing SID with "
"filter=%s, base_dn=%s", filter, base_dn)
(entries, truncated) = api.Backend.ldap2.find_entries(filter=filter,
base_dn=base_dn, attrs_list=[''])
except errors.NotFound:
# All objects have SIDs assigned
pass
except (errors.DatabaseError, errors.NetworkError) as e:
print("Could not retrieve a list of objects that need a SID identifier assigned:")
print(unicode(e))
else:
object_count = len(entries)
if object_count > 0:
print("")
print("WARNING: %d existing users or groups do not have a SID identifier assigned." \
% len(entries))
print("Installer can run a task to have ipa-sidgen Directory Server plugin generate")
print("the SID identifier for all these users. Please note, the in case of a high")
print("number of users and groups, the operation might lead to high replication")
print("traffic and performance degradation. Refer to ipa-adtrust-install(1) man page")
print("for details.")
print("")
if options.unattended:
print("Unattended mode was selected, installer will NOT run ipa-sidgen task!")
else:
if ipautil.user_input("Do you want to run the ipa-sidgen task?", default=False,
allow_empty=False):
options.add_sids = True
if not options.unattended:
print("")
print("The following operations may take some minutes to complete.")
print("Please wait until the prompt is returned.")
print("")
smb = adtrustinstance.ADTRUSTInstance(fstore)
smb.realm = api.env.realm
smb.autobind = ipaldap.AUTOBIND_ENABLED
smb.setup(api.env.host, api.env.realm, api.env.domain,
netbios_name, reset_netbios_name,
options.rid_base, options.secondary_rid_base,
options.no_msdcs, options.add_sids,
enable_compat = options.enable_compat)
smb.find_local_id_range()
smb.create_instance()
if options.add_agents:
# Find out IPA masters which are not part of the cn=adtrust agents
# and propose them to be added to the list
base_dn = api.env.basedn
masters_dn = DN(('cn', 'masters'), ('cn', 'ipa'), ('cn', 'etc'), base_dn)
agents_dn = DN(('cn', 'adtrust agents'), ('cn', 'sysaccounts'), ('cn', 'etc'), base_dn)
new_agents = []
entries_m = []
entries_a = []
try:
# Search only masters which have support for domain levels
# because only these masters will have SSSD recent enough to support AD trust agents
(entries_m, truncated) = smb.admin_conn.find_entries(
filter="(&(objectclass=ipaSupportedDomainLevelConfig)(ipaMaxDomainLevel=*)(ipaMinDomainLevel=*))",
base_dn=masters_dn, attrs_list=['cn'], scope=ldap.SCOPE_ONELEVEL)
except errors.NotFound:
pass
except (errors.DatabaseError, errors.NetworkError) as e:
print("Could not retrieve a list of existing IPA masters:")
print(unicode(e))
try:
(entries_a, truncated) = smb.admin_conn.find_entries(filter="",
base_dn=agents_dn, attrs_list=['member'], scope=ldap.SCOPE_BASE)
except errors.NotFound:
pass
except (errors.DatabaseError, errors.NetworkError) as e:
print("Could not retrieve a list of adtrust agents:")
print(unicode(e))
if len(entries_m) > 0:
existing_masters = [x['cn'][0] for x in entries_m]
adtrust_agents = entries_a[0]['member']
potential_agents = []
for m in existing_masters:
mdn = DN(('fqdn', m), api.env.container_host, api.env.basedn)
found = False
for a in adtrust_agents:
if mdn == a:
found = True
break
if not found:
potential_agents += [[m, mdn]]
object_count = len(potential_agents)
if object_count > 0:
print("")
print("WARNING: %d IPA masters are not yet able to serve information about users from trusted forests." \
% (object_count))
print("Installer can add them to the list of IPA masters allowed to access infromation about trusts.")
print("If you choose to do so, you also need to restart LDAP service on those masters.")
print("Refer to ipa-adtrust-install(1) man page for details.")
print("")
if options.unattended:
print("Unattended mode was selected, installer will NOT add other IPA masters to the list of allowed to")
print("access information about trusted forests!")
else:
print("Do you want to allow following IPA masters to serve information about users from trusted forests?")
for (name, dn) in potential_agents:
if name == api.env.host:
# Don't add this host here
# it shouldn't be here as it was added by the adtrustinstance setup code
continue
if ipautil.user_input("IPA master [%s]?" % (name), default=False, allow_empty=False):
new_agents += [[name, dn]]
if len(new_agents) > 0:
# Add the CIFS and host principals to the 'adtrust agents' group
# as 389-ds only operates with GroupOfNames, we have to use
# the principal's proper dn as defined in self.cifs_agent
service.add_principals_to_group(smb.admin_conn, agents_dn, "member",
[x[1] for x in new_agents])
print("""
WARNING: you MUST restart (e.g. ipactl restart) the following IPA masters in order
to activate them to serve information about users from trusted forests:""")
for x in new_agents:
print(x[0])
print("""
=============================================================================
Setup complete
You must make sure these network ports are open:
\tTCP Ports:
\t * 135: epmap
\t * 138: netbios-dgm
\t * 139: netbios-ssn
\t * 445: microsoft-ds
\t * 1024..1300: epmap listener range
\tUDP Ports:
\t * 138: netbios-dgm
\t * 139: netbios-ssn
\t * 389: (C)LDAP
\t * 445: microsoft-ds
See the ipa-adtrust-install(1) man page for more details
=============================================================================
""")
if admin_password:
admin_kinited = ensure_admin_kinit(options.admin_name, admin_password)
if not admin_kinited:
print("""
WARNING: you MUST re-kinit admin user before using 'ipa trust-*' commands
family in order to re-generate Kerberos tickets to include AD-specific
information""")
return 0
if __name__ == '__main__':
run_script(main, log_file_name=log_file_name,
operation_name='ipa-adtrust-install')

258
install/tools/ipa-adtrust-install.in
View File

@@ -1,258 +0,0 @@
@PYTHONSHEBANG@
#
# Authors: Sumit Bose <sbose@redhat.com>
# Based on ipa-server-install by Karl MacMillan <kmacmillan@mentalrootkit.com>
# and ipa-dns-install by Martin Nagy
#
# Copyright (C) 2011 Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
from __future__ import print_function
import logging
import os
import sys
import six
from optparse import SUPPRESS_HELP # pylint: disable=deprecated-module
from ipalib.install import sysrestore
from ipaserver.install import adtrust, service
from ipaserver.install.installutils import (
read_password,
check_server_configuration,
run_script)
from ipapython.admintool import ScriptError
from ipapython import version
from ipapython import ipautil
from ipalib import api, errors, krb_utils
from ipapython.config import IPAOptionParser
from ipaplatform.paths import paths
from ipapython.ipa_log_manager import standard_logging_setup
if six.PY3:
unicode = str
logger = logging.getLogger(os.path.basename(__file__))
log_file_name = paths.IPASERVER_INSTALL_LOG
def parse_options():
parser = IPAOptionParser(version=version.VERSION)
parser.add_option("-d", "--debug", dest="debug", action="store_true",
default=False, help="print debugging information")
parser.add_option("--netbios-name", dest="netbios_name",
help="NetBIOS name of the IPA domain")
# no-msdcs has not effect, option is here just for backward compatibility
parser.add_option("--no-msdcs", dest="no_msdcs", action="store_true",
default=False, help=SUPPRESS_HELP)
parser.add_option("--rid-base", dest="rid_base", type=int, default=1000,
help="Start value for mapping UIDs and GIDs to RIDs")
parser.add_option("--secondary-rid-base", dest="secondary_rid_base",
type=int, default=100000000,
help="Start value of the secondary range for mapping "
"UIDs and GIDs to RIDs")
parser.add_option("-U", "--unattended", dest="unattended",
action="store_true",
default=False,
help="unattended installation never prompts the user")
parser.add_option("-a", "--admin-password",
sensitive=True, dest="admin_password",
help="admin user kerberos password")
parser.add_option("-A", "--admin-name",
sensitive=True, dest="admin_name", default='admin',
help="admin user principal")
parser.add_option("--add-sids", dest="add_sids", action="store_true",
default=False, help="Add SIDs for existing users and"
" groups as the final step")
parser.add_option("--add-agents", dest="add_agents", action="store_true",
default=False,
help="Add IPA masters to a list of hosts allowed to "
"serve information about users from trusted forests")
parser.add_option("--enable-compat",
dest="enable_compat", default=False, action="store_true",
help="Enable support for trusted domains for old "
"clients")
options, _args = parser.parse_args()
safe_options = parser.get_safe_opts(options)
return safe_options, options
def read_admin_password(admin_name):
print("Configuring cross-realm trusts for IPA server requires password "
"for user '%s'." % (admin_name))
print("This user is a regular system account used for IPA server "
"administration.")
print("")
admin_password = read_password(admin_name, confirm=False, validate=None)
return admin_password
def ensure_admin_kinit(admin_name, admin_password):
try:
ipautil.run([paths.KINIT, admin_name], stdin=admin_password+'\n')
except ipautil.CalledProcessError:
print("There was error to automatically re-kinit your admin user "
"ticket.")
return False
return True
def main():
safe_options, options = parse_options()
if os.getegid() != 0:
raise ScriptError("Must be root to setup AD trusts on server")
standard_logging_setup(log_file_name, debug=options.debug, filemode='a')
print("\nThe log file for this installation can be found in %s"
% log_file_name)
logger.debug('%s was invoked with options: %s', sys.argv[0], safe_options)
logger.debug(
"missing options might be asked for interactively later\n")
logger.debug('IPA version %s', version.VENDOR_VERSION)
check_server_configuration()
fstore = sysrestore.FileStore(paths.SYSRESTORE)
print("================================================================"
"==============")
print("This program will setup components needed to establish trust to "
"AD domains for")
print("the FreeIPA Server.")
print("")
print("This includes:")
print(" * Configure Samba")
print(" * Add trust related objects to FreeIPA LDAP server")
# TODO:
# print " * Add a SID to all users and Posix groups"
print("")
print("To accept the default shown in brackets, press the Enter key.")
print("")
# Check if samba packages are installed
# the same check is in the adtrust module but we must fail first if the
# package is missing
adtrust.check_for_installed_deps()
# Initialize the ipalib api
api.bootstrap(
in_server=True,
debug=options.debug,
context='install',
confdir=paths.ETC_IPA
)
api.finalize()
admin_password = options.admin_password
if not (options.unattended or admin_password):
admin_password = read_admin_password(options.admin_name)
admin_kinited = None
if admin_password:
admin_kinited = ensure_admin_kinit(options.admin_name, admin_password)
if not admin_kinited:
print("Proceeding with credentials that existed before")
try:
principal = krb_utils.get_principal()
except errors.CCacheError as e:
raise ScriptError(
"Must have Kerberos credentials to setup AD trusts on server: "
"{err}".format(err=e))
try:
api.Backend.ldap2.connect()
except errors.ACIError:
raise ScriptError(
"Outdated Kerberos credentials. "
"Use kdestroy and kinit to update your ticket")
except errors.DatabaseError:
raise ScriptError(
"Cannot connect to the LDAP database. Please check if IPA "
"is running")
try:
user = api.Command.user_show(
principal.partition('@')[0].partition('/')[0])['result']
group = api.Command.group_show(u'admins')['result']
if not (user['uid'][0] in group['member_user'] and
group['cn'][0] in user['memberof_group']):
raise errors.RequirementError(name='admins group membership')
except errors.RequirementError as e:
raise ScriptError(
"Must have administrative privileges to setup AD trusts on server"
)
except Exception as e:
raise ScriptError(
"Unrecognized error during check of admin rights: %s" % e)
adtrust.install_check(True, options, api)
adtrust.install(True, options, fstore, api)
# Enable configured services and update DNS SRV records
service.enable_services(api.env.host)
api.Command.dns_update_system_records()
print("""
=============================================================================
Setup complete
You must make sure these network ports are open:
\tTCP Ports:
\t * 135: epmap
\t * 138: netbios-dgm
\t * 139: netbios-ssn
\t * 445: microsoft-ds
\t * 1024..1300: epmap listener range
\t * 3268: msft-gc
\tUDP Ports:
\t * 138: netbios-dgm
\t * 139: netbios-ssn
\t * 389: (C)LDAP
\t * 445: microsoft-ds
See the ipa-adtrust-install(1) man page for more details
=============================================================================
""")
if admin_password:
admin_kinited = ensure_admin_kinit(options.admin_name, admin_password)
if not admin_kinited:
print("""
WARNING: you MUST re-kinit admin user before using 'ipa trust-*' commands
family in order to re-generate Kerberos tickets to include AD-specific
information""")
api.Backend.ldap2.disconnect()
return 0
if __name__ == '__main__':
run_script(
main,
log_file_name=log_file_name,
operation_name='ipa-adtrust-install')

2
install/tools/ipa-advise.in → install/tools/ipa-advise Normal file → Executable file
View File

@@ -1,4 +1,4 @@
@PYTHONSHEBANG@
#! /usr/bin/python2 -E
# Authors: Tomas Babej <tbabej@redhat.com>
#
# Copyright (C) 2013 Red Hat

2
install/tools/ipa-backup.in → install/tools/ipa-backup Normal file → Executable file
View File

@@ -1,4 +1,4 @@
@PYTHONSHEBANG@
#! /usr/bin/python2 -E
# Authors: Rob Crittenden <rcritten@redhat.com>
#
# Copyright (C) 2013 Red Hat

319
install/tools/ipa-ca-install Executable file
View File

@@ -0,0 +1,319 @@
#! /usr/bin/python2 -E
# Authors: Rob Crittenden <rcritten@redhat.com>
#
# Copyright (C) 2011 Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
import sys
import os
import shutil
import tempfile
from ipapython import ipautil
from ipaserver.install import installutils
from ipaserver.install import certs
from ipaserver.install.installutils import create_replica_config
from ipaserver.install.installutils import check_creds, ReplicaConfig
from ipaserver.install import dsinstance, ca
from ipaserver.install import cainstance, custodiainstance, service
from ipapython import version
from ipalib import api
from ipalib.constants import DOMAIN_LEVEL_0
from ipapython.dn import DN
from ipapython.config import IPAOptionParser
from ipapython.ipa_log_manager import *
from ipaplatform.paths import paths
log_file_name = paths.IPAREPLICA_CA_INSTALL_LOG
REPLICA_INFO_TOP_DIR = None
def parse_options():
usage = "%prog [options] REPLICA_FILE"
parser = IPAOptionParser(usage=usage, version=version.VERSION)
parser.add_option("-d", "--debug", dest="debug", action="store_true",
default=False, help="gather extra debugging information")
parser.add_option("-p", "--password", dest="password", sensitive=True,
help="Directory Manager (existing master) password")
parser.add_option("-w", "--admin-password", dest="admin_password", sensitive=True,
help="Admin user Kerberos password used for connection check")
parser.add_option("--no-host-dns", dest="no_host_dns", action="store_true",
default=False,
help="Do not use DNS for hostname lookup during installation")
parser.add_option("--skip-conncheck", dest="skip_conncheck", action="store_true",
default=False, help="skip connection check to remote master")
parser.add_option("--skip-schema-check", dest="skip_schema_check", action="store_true",
default=False, help="skip check for updated CA DS schema on the remote master")
parser.add_option("-U", "--unattended", dest="unattended", action="store_true",
default=False, help="unattended installation never prompts the user")
parser.add_option("--external-ca", dest="external_ca", action="store_true",
default=False, help="Generate a CSR to be signed by an external CA")
parser.add_option("--external-ca-type", dest="external_ca_type",
type="choice", choices=("generic", "ms-cs"),
help="Type of the external CA")
parser.add_option("--external-cert-file", dest="external_cert_files",
action="append", metavar="FILE",
help="File containing the IPA CA certificate and the external CA certificate chain")
parser.add_option("--ca-signing-algorithm", dest="ca_signing_algorithm",
type="choice",
choices=('SHA1withRSA', 'SHA256withRSA', 'SHA512withRSA'),
help="Signing algorithm of the IPA CA certificate")
parser.add_option("-P", "--principal", dest="principal", sensitive=True,
default=None, help="User allowed to manage replicas")
options, args = parser.parse_args()
safe_options = parser.get_safe_opts(options)
if args:
filename = args[0]
if len(args) != 1:
parser.error("you must provide a file generated by "
"ipa-replica-prepare")
options.external_ca = None
options.external_cert_files = None
else:
filename = None
if options.external_ca:
if options.external_cert_files:
parser.error("You cannot specify --external-cert-file "
"together with --external-ca")
if options.external_ca_type and not options.external_ca:
parser.error(
"You cannot specify --external-ca-type without --external-ca")
return safe_options, options, filename
def get_dirman_password():
return installutils.read_password(
"Directory Manager (existing master)", confirm=False, validate=False)
def install_replica(safe_options, options, filename):
if options.promote:
if filename is not None:
sys.exit("Too many parameters provided. "
"No replica file is required")
else:
if filename is None:
sys.exit("A replica file is required")
if not ipautil.file_exists(filename):
sys.exit("Replica file %s does not exist" % filename)
if not options.promote:
# Check if we have admin creds already, otherwise acquire them
check_creds(options, api.env.realm)
# get the directory manager password
dirman_password = options.password
if not dirman_password:
if options.unattended:
sys.exit('Directory Manager password required')
try:
dirman_password = get_dirman_password()
except KeyboardInterrupt:
sys.exit(0)
if dirman_password is None:
sys.exit("Directory Manager password required")
if (not options.promote and not options.admin_password and
not options.skip_conncheck and options.unattended):
sys.exit('admin password required')
if options.promote:
config = ReplicaConfig()
config.master_host_name = None
config.realm_name = api.env.realm
config.host_name = api.env.host
config.domain_name = api.env.domain
config.dirman_password = dirman_password
config.ca_ds_port = 389
config.top_dir = tempfile.mkdtemp("ipa")
config.dir = config.top_dir
cafile = paths.IPA_CA_CRT
else:
config = create_replica_config(dirman_password, filename, options)
cafile = config.dir + '/ca.crt'
global REPLICA_INFO_TOP_DIR
REPLICA_INFO_TOP_DIR = config.top_dir
config.setup_ca = True
conn = api.Backend.ldap2
conn.connect(bind_dn=DN(('cn', 'Directory Manager')),
bind_pw=dirman_password)
if config.subject_base is None:
attrs = conn.get_ipa_config()
config.subject_base = attrs.get('ipacertificatesubjectbase')[0]
if config.master_host_name is None:
config.ca_host_name = \
service.find_providing_server('CA', conn, api.env.ca_host)
config.master_host_name = config.ca_host_name
else:
config.ca_host_name = config.master_host_name
options.realm_name = config.realm_name
options.domain_name = config.domain_name
options.dm_password = config.dirman_password
options.host_name = config.host_name
options.subject = config.subject_base
if os.path.exists(cafile):
options.ca_cert_file = cafile
else:
options.ca_cert_file = None
ca.install_check(True, config, options)
if options.promote:
ca_data = (os.path.join(config.dir, 'cacert.p12'),
config.dirman_password)
custodia = custodiainstance.CustodiaInstance(config.host_name,
config.realm_name)
custodia.get_ca_keys(config.ca_host_name, ca_data[0], ca_data[1])
CA = cainstance.CAInstance(config.realm_name, certs.NSS_DIR,
host_name=config.host_name,
dm_password=config.dirman_password)
CA.configure_replica(config.ca_host_name,
subject_base=config.subject_base,
ca_cert_bundle=ca_data)
else:
ca.install(True, config, options)
def install_master(safe_options, options):
dm_password = options.password
if not dm_password:
if options.unattended:
sys.exit('Directory Manager password required')
try:
dm_password = get_dirman_password()
except KeyboardInterrupt:
sys.exit(0)
if dm_password is None:
sys.exit("Directory Manager password required")
api.Backend.ldap2.connect(bind_dn=DN(('cn', 'Directory Manager')),
bind_pw=dm_password)
config = api.Command['config_show']()['result']
subject_base = config['ipacertificatesubjectbase'][0]
options.realm_name = api.env.realm
options.domain_name = api.env.domain
options.dm_password = dm_password
options.host_name = api.env.host
options.subject = subject_base
ca.install_check(True, None, options)
ca.install(True, None, options)
def install(safe_options, options, filename):
options.promote = False
try:
if filename is None:
install_master(safe_options, options)
else:
install_replica(safe_options, options, filename)
finally:
# Clean up if we created custom credentials
created_ccache_file = getattr(options, 'created_ccache_file', None)
if created_ccache_file is not None:
try:
os.unlink(created_ccache_file)
except OSError:
pass
def promote(safe_options, options, filename):
options.promote = True
with ipautil.private_ccache():
ccache = os.environ['KRB5CCNAME']
ipautil.kinit_keytab(
'host/{env.host}@{env.realm}'.format(env=api.env),
paths.KRB5_KEYTAB,
ccache)
conn = api.Backend.ldap2
conn.connect(ccache=ccache)
ca_host = service.find_providing_server('CA', conn)
conn.disconnect()
if ca_host is None:
install_master(safe_options, options)
else:
install_replica(safe_options, options, filename)
def main():
safe_options, options, filename = parse_options()
if os.geteuid() != 0:
sys.exit("\nYou must be root to run this script.\n")
if not dsinstance.DsInstance().is_configured():
sys.exit("IPA server is not configured on this system.\n")
if (not options.external_cert_files and
cainstance.is_ca_installed_locally()):
sys.exit("CA is already installed on this host.")
standard_logging_setup(paths.IPASERVER_CA_INSTALL_LOG, debug=options.debug)
root_logger.debug("%s was invoked with options: %s,%s",
sys.argv[0], safe_options, filename)
root_logger.debug("IPA version %s", version.VENDOR_VERSION)
# override ra_plugin setting read from default.conf so that we have
# functional dogtag backend plugins during CA install
api.bootstrap(in_server=True, ra_plugin='dogtag')
api.finalize()
domain_level = dsinstance.get_domain_level(api)
if domain_level > DOMAIN_LEVEL_0:
promote(safe_options, options, filename)
else:
install(safe_options, options, filename)
# execute ipactl to refresh services status
ipautil.run(['ipactl', 'start', '--ignore-service-failures'],
raiseonerr=False)
fail_message = '''
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
'''
if __name__ == '__main__':
try:
installutils.run_script(main, log_file_name=log_file_name,
operation_name='ipa-ca-install',
fail_message=fail_message)
finally:
# always try to remove decrypted replica file
try:
if REPLICA_INFO_TOP_DIR:
shutil.rmtree(REPLICA_INFO_TOP_DIR)
except OSError:
pass

331
install/tools/ipa-ca-install.in
View File

@@ -1,331 +0,0 @@
@PYTHONSHEBANG@
# Authors: Rob Crittenden <rcritten@redhat.com>
#
# Copyright (C) 2011 Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
from __future__ import print_function
import logging
import sys
import os
import shutil
import tempfile
from ipalib.install.kinit import kinit_keytab
from ipapython import ipautil
from ipaclient.install import ipa_certupdate
from ipaserver.install import installutils
from ipaserver.install.installutils import check_creds, ReplicaConfig
from ipaserver.install import dsinstance, ca
from ipaserver.install import cainstance, service
from ipaserver.install import custodiainstance
from ipapython import version
from ipalib import api
from ipalib.constants import DOMAIN_LEVEL_1
from ipapython.config import IPAOptionParser
from ipapython.ipa_log_manager import standard_logging_setup
from ipaplatform.paths import paths
logger = logging.getLogger(os.path.basename(__file__))
log_file_name = paths.IPAREPLICA_CA_INSTALL_LOG
REPLICA_INFO_TOP_DIR = None
def parse_options():
usage = "%prog [options]"
parser = IPAOptionParser(usage=usage, version=version.VERSION)
parser.add_option("-d", "--debug", dest="debug", action="store_true",
default=False, help="gather extra debugging information")
parser.add_option("-p", "--password", dest="password", sensitive=True,
help="Directory Manager (existing master) password")
parser.add_option("-w", "--admin-password", dest="admin_password", sensitive=True,
help="Admin user Kerberos password used for connection check")
parser.add_option("--no-host-dns", dest="no_host_dns", action="store_true",
default=False,
help="Do not use DNS for hostname lookup during installation")
parser.add_option("--skip-conncheck", dest="skip_conncheck", action="store_true",
default=False, help="skip connection check to remote master")
parser.add_option("--skip-schema-check", dest="skip_schema_check", action="store_true",
default=False, help="skip check for updated CA DS schema on the remote master")
parser.add_option("-U", "--unattended", dest="unattended", action="store_true",
default=False, help="unattended installation never prompts the user")
parser.add_option("--external-ca", dest="external_ca", action="store_true",
default=False, help="Generate a CSR to be signed by an external CA")
ext_cas = tuple(x.value for x in cainstance.ExternalCAType)
parser.add_option("--external-ca-type", dest="external_ca_type",
type="choice", choices=ext_cas,
metavar="{{{0}}}".format(",".join(ext_cas)),
help="Type of the external CA. Default: generic")
parser.add_option("--external-ca-profile", dest="external_ca_profile",
type='constructor', constructor=cainstance.ExternalCAProfile,
default=None, metavar="PROFILE-SPEC",
help="Specify the certificate profile/template to use "
"at the external CA")
parser.add_option("--external-cert-file", dest="external_cert_files",
action="append", metavar="FILE",
help="File containing the IPA CA certificate and the external CA certificate chain")
ca_algos = ('SHA1withRSA', 'SHA256withRSA', 'SHA512withRSA')
parser.add_option("--ca-signing-algorithm", dest="ca_signing_algorithm",
type="choice", choices=ca_algos,
metavar="{{{0}}}".format(",".join(ca_algos)),
help="Signing algorithm of the IPA CA certificate")
parser.add_option("-P", "--principal", dest="principal", sensitive=True,
default=None, help="User allowed to manage replicas")
parser.add_option("--subject-base", dest="subject_base",
default=None,
help=(
"The certificate subject base "
"(default O=<realm-name>). "
"RDNs are in LDAP order (most specific RDN first)."))
parser.add_option("--ca-subject", dest="ca_subject",
default=None,
help=(
"The CA certificate subject DN "
"(default CN=Certificate Authority,O=<realm-name>). "
"RDNs are in LDAP order (most specific RDN first)."))
options, args = parser.parse_args()
safe_options = parser.get_safe_opts(options)
if args:
parser.error("Too many arguments provided")
if options.external_ca:
if options.external_cert_files:
parser.error("You cannot specify --external-cert-file "
"together with --external-ca")
if options.external_ca_type and not options.external_ca:
parser.error(
"You cannot specify --external-ca-type without --external-ca")
if options.external_ca_profile and not options.external_ca:
parser.error(
"You cannot specify --external-ca-profile "
"without --external-ca")
return safe_options, options
def _get_dirman_password(password=None, unattended=False):
# sys.exit() is used on purpose, because otherwise user is advised to
# uninstall the component, even though it is not needed
if not password:
if unattended:
sys.exit('Directory Manager password required')
password = installutils.read_password(
"Directory Manager (existing master)", confirm=False,
validate=False)
try:
installutils.validate_dm_password_ldap(password)
except ValueError:
sys.exit("Directory Manager password is invalid")
return password
def install_replica(safe_options, options):
if options.ca_subject:
sys.exit("--ca-subject cannot be used when installing a CA replica")
if options.subject_base:
sys.exit("--subject-base cannot be used when installing a CA replica")
# Check if we have admin creds already, otherwise acquire them
check_creds(options, api.env.realm)
# get the directory manager password
dirman_password = _get_dirman_password(
options.password, options.unattended)
# Run ipa-certupdate to ensure we have the CA cert. This is
# necessary if the admin has just promoted the topology from
# CA-less to CA-ful, and ipa-certupdate has not been run yet.
ipa_certupdate.run_with_args(api)
# CertUpdate restarts DS causing broken pipe on the original
# connection, so reconnect the backend.
api.Backend.ldap2.disconnect()
api.Backend.ldap2.connect()
config = ReplicaConfig()
config.ca_host_name = None
config.realm_name = api.env.realm
config.host_name = api.env.host
config.domain_name = api.env.domain
config.dirman_password = dirman_password
config.ca_ds_port = 389
config.top_dir = tempfile.mkdtemp("ipa")
config.dir = config.top_dir
cafile = paths.IPA_CA_CRT
global REPLICA_INFO_TOP_DIR
REPLICA_INFO_TOP_DIR = config.top_dir
config.setup_ca = True
if config.subject_base is None:
attrs = api.Backend.ldap2.get_ipa_config()
config.subject_base = attrs.get('ipacertificatesubjectbase')[0]
if config.ca_host_name is None:
config.ca_host_name = \
service.find_providing_server('CA', api.Backend.ldap2, api.env.ca_host)
options.realm_name = config.realm_name
options.domain_name = config.domain_name
options.dm_password = config.dirman_password
options.host_name = config.host_name
options.ca_host_name = config.ca_host_name
if os.path.exists(cafile):
options.ca_cert_file = cafile
else:
options.ca_cert_file = None
ca.install_check(True, config, options)
custodia = custodiainstance.get_custodia_instance(
options, custodiainstance.CustodiaModes.CA_PEER)
ca.install(True, config, options, custodia=custodia)
def install_master(safe_options, options):
dm_password = _get_dirman_password(
options.password, options.unattended)
options.realm_name = api.env.realm
options.domain_name = api.env.domain
options.dm_password = dm_password
options.host_name = api.env.host
if not options.subject_base:
options.subject_base = str(
installutils.default_subject_base(api.env.realm))
if not options.ca_subject:
options.ca_subject = str(
installutils.default_ca_subject_dn(options.subject_base))
try:
ca.subject_validator(ca.VALID_SUBJECT_BASE_ATTRS, options.subject_base)
except ValueError as e:
sys.exit("Subject base: {}".format(e))
try:
ca.subject_validator(ca.VALID_SUBJECT_ATTRS, options.ca_subject)
except ValueError as e:
sys.exit("CA subject: {}".format(e))
ca.install_check(True, None, options)
ca.print_ca_configuration(options)
print()
if not options.unattended:
if not ipautil.user_input(
"Continue to configure the CA with these values?", False):
sys.exit("Installation aborted")
# No CA peer available yet.
custodia = custodiainstance.get_custodia_instance(
options, custodiainstance.CustodiaModes.FIRST_MASTER)
ca.install(True, None, options, custodia=custodia)
# Run ipa-certupdate to add the new CA certificate to
# certificate databases on this server.
logger.info("Updating certificate databases.")
ipa_certupdate.run_with_args(api)
def install(safe_options, options):
with ipautil.private_ccache():
ccache = os.environ['KRB5CCNAME']
kinit_keytab(
'host/{env.host}@{env.realm}'.format(env=api.env),
paths.KRB5_KEYTAB,
ccache)
ca_host = service.find_providing_server('CA', api.Backend.ldap2)
if ca_host is None:
install_master(safe_options, options)
else:
install_replica(safe_options, options)
def main():
safe_options, options = parse_options()
if os.geteuid() != 0:
sys.exit("\nYou must be root to run this script.\n")
if not dsinstance.DsInstance().is_configured():
sys.exit("IPA server is not configured on this system.\n")
if (not options.external_cert_files and
cainstance.is_ca_installed_locally()):
sys.exit("CA is already installed on this host.")
standard_logging_setup(log_file_name, debug=options.debug)
logger.debug("%s was invoked with options: %s",
sys.argv[0], safe_options)
logger.debug("IPA version %s", version.VENDOR_VERSION)
# override ra_plugin setting read from default.conf so that we have
# functional dogtag backend plugins during CA install
api.bootstrap(
context='install', confdir=paths.ETC_IPA,
in_server=True, ra_plugin='dogtag'
)
api.finalize()
api.Backend.ldap2.connect()
domain_level = dsinstance.get_domain_level(api)
if domain_level < DOMAIN_LEVEL_1:
api.Backend.ldap2.disconnect()
sys.exit("Unsupported domain level %d" % domain_level)
install(safe_options, options)
# pki-spawn restarts 389-DS, reconnect
api.Backend.ldap2.close()
api.Backend.ldap2.connect()
# Enable configured services and update DNS SRV records
service.enable_services(api.env.host)
api.Command.dns_update_system_records()
api.Backend.ldap2.disconnect()
# execute ipactl to refresh services status
ipautil.run([paths.IPACTL, 'start', '--ignore-service-failures'],
raiseonerr=False)
fail_message = '''
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
'''
if __name__ == '__main__':
try:
installutils.run_script(main, log_file_name=log_file_name,
operation_name='ipa-ca-install',
fail_message=fail_message)
finally:
# always try to remove decrypted replica file
try:
if REPLICA_INFO_TOP_DIR:
shutil.rmtree(REPLICA_INFO_TOP_DIR)
except OSError:
pass

2
install/tools/ipa-cacert-manage.in → install/tools/ipa-cacert-manage
View File

@@ -1,4 +1,4 @@
@PYTHONSHEBANG@
#! /usr/bin/python2 -E
# Authors: Jan Cholasta <jcholast@redhat.com>
#
# Copyright (C) 2014 Red Hat

204
install/tools/ipa-compat-manage Executable file
View File

@@ -0,0 +1,204 @@
#!/usr/bin/python2
# Authors: Rob Crittenden <rcritten@redhat.com>
# Authors: Simo Sorce <ssorce@redhat.com>
#
# Copyright (C) 2008 Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
from __future__ import print_function
import sys
from ipaplatform.paths import paths
try:
from optparse import OptionParser
from ipapython import ipautil, config
from ipaserver.install import installutils
from ipaserver.install.ldapupdate import LDAPUpdate, BadSyntax
from ipaserver.plugins.ldap2 import ldap2
from ipalib import api, errors
from ipapython.ipa_log_manager import *
from ipapython.dn import DN
except ImportError as e:
print("""\
There was a problem importing one of the required Python modules. The
error was:
%s
""" % e, file=sys.stderr)
sys.exit(1)
compat_dn = DN(('cn', 'Schema Compatibility'), ('cn', 'plugins'), ('cn', 'config'))
nis_config_dn = DN(('cn', 'NIS Server'), ('cn', 'plugins'), ('cn', 'config'))
def parse_options():
usage = "%prog [options] <enable|disable>\n"
usage += "%prog [options]\n"
parser = OptionParser(usage=usage, formatter=config.IPAFormatter())
parser.add_option("-d", "--debug", action="store_true", dest="debug",
help="Display debugging information about the update(s)")
parser.add_option("-y", dest="password",
help="File containing the Directory Manager password")
config.add_standard_options(parser)
options, args = parser.parse_args()
config.init_config(options)
return options, args
def get_dirman_password():
"""Prompt the user for the Directory Manager password and verify its
correctness.
"""
password = installutils.read_password("Directory Manager", confirm=False, validate=False)
return password
def get_entry(dn, conn):
"""
Return the entry for the given DN. If the entry is not found return
None.
"""
entry = None
try:
entry = conn.get_entry(dn)
except errors.NotFound:
pass
return entry
def main():
retval = 0
files = [paths.SCHEMA_COMPAT_ULDIF]
options, args = parse_options()
if len(args) != 1:
sys.exit("You must specify one action, either enable or disable")
elif args[0] != "enable" and args[0] != "disable" and args[0] != "status":
sys.exit("Unrecognized action [" + args[0] + "]")
standard_logging_setup(None, debug=options.debug)
dirman_password = ""
if options.password:
pw = ipautil.template_file(options.password, [])
dirman_password = pw.strip()
else:
dirman_password = get_dirman_password()
if dirman_password is None:
sys.exit("Directory Manager password required")
api.bootstrap(context='cli', debug=options.debug)
api.finalize()
conn = None
try:
try:
conn = ldap2(api)
conn.connect(
bind_dn=DN(('cn', 'directory manager')), bind_pw=dirman_password
)
except errors.ExecutionError as lde:
sys.exit("An error occurred while connecting to the server.\n%s\n" % str(lde))
except errors.ACIError as e:
sys.exit("Authentication failed: %s" % e.info)
if args[0] == "status":
entry = None
try:
entry = get_entry(compat_dn, conn)
if entry is not None and entry.get('nsslapd-pluginenabled', [''])[0].lower() == 'on':
print("Plugin Enabled")
else:
print("Plugin Disabled")
except errors.LDAPError as lde:
print("An error occurred while talking to the server.")
print(lde)
if args[0] == "enable":
entry = None
try:
entry = get_entry(compat_dn, conn)
if entry is not None and entry.get('nsslapd-pluginenabled', [''])[0].lower() == 'on':
print("Plugin already Enabled")
retval = 2
else:
print("Enabling plugin")
if entry is None:
ld = LDAPUpdate(dm_password=dirman_password, sub_dict={})
if not ld.update(files):
print("Updating Directory Server failed.")
retval = 1
else:
entry['nsslapd-pluginenabled'] = ['on']
conn.update_entry(entry)
except errors.ExecutionError as lde:
print("An error occurred while talking to the server.")
print(lde)
retval = 1
elif args[0] == "disable":
entry = None
try:
entry = get_entry(nis_config_dn, conn)
# We can't disable schema compat if the NIS plugin is enabled
if entry is not None and entry.get('nsslapd-pluginenabled', [''])[0].lower() == 'on':
print("The NIS plugin is configured, cannot disable compatibility.", file=sys.stderr)
print("Run 'ipa-nis-manage disable' first.", file=sys.stderr)
retval = 2
except errors.ExecutionError as lde:
print("An error occurred while talking to the server.")
print(lde)
retval = 1
if retval == 0:
entry = None
try:
entry = get_entry(compat_dn, conn)
if entry is None or entry.get('nsslapd-pluginenabled', [''])[0].lower() == 'off':
print("Plugin is already disabled")
retval = 2
else:
print("Disabling plugin")
entry['nsslapd-pluginenabled'] = ['off']
conn.update_entry(entry)
except errors.DatabaseError as dbe:
print("An error occurred while talking to the server.")
print(dbe)
retval = 1
except errors.ExecutionError as lde:
print("An error occurred while talking to the server.")
print(lde)
retval = 1
else:
retval = 1
if retval == 0:
print("This setting will not take effect until you restart Directory Server.")
finally:
if conn and conn.isconnected():
conn.disconnect()
return retval
if __name__ == '__main__':
installutils.run_script(main, operation_name='ipa-compat-manage')

193
install/tools/ipa-compat-manage.in
View File

@@ -1,193 +0,0 @@
@PYTHONSHEBANG@
# Authors: Rob Crittenden <rcritten@redhat.com>
# Authors: Simo Sorce <ssorce@redhat.com>
#
# Copyright (C) 2008-2016 Red Hat, Inc.
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
from __future__ import print_function
import sys
from ipaplatform.paths import paths
try:
from optparse import OptionParser # pylint: disable=deprecated-module
from ipapython import ipautil, config
from ipaserver.install import installutils
from ipaserver.install.ldapupdate import LDAPUpdate
from ipalib import api, errors
from ipapython.ipa_log_manager import standard_logging_setup
from ipapython.dn import DN
except ImportError as e:
print("""\
There was a problem importing one of the required Python modules. The
error was:
%s
""" % e, file=sys.stderr)
sys.exit(1)
compat_dn = DN(('cn', 'Schema Compatibility'), ('cn', 'plugins'), ('cn', 'config'))
nis_config_dn = DN(('cn', 'NIS Server'), ('cn', 'plugins'), ('cn', 'config'))
def parse_options():
usage = "%prog [options] <enable|disable|status>\n"
usage += "%prog [options]\n"
parser = OptionParser(usage=usage, formatter=config.IPAFormatter())
parser.add_option("-d", "--debug", action="store_true", dest="debug",
help="Display debugging information about the update(s)")
parser.add_option("-y", dest="password",
help="File containing the Directory Manager password")
config.add_standard_options(parser)
options, args = parser.parse_args()
return options, args
def get_dirman_password():
"""Prompt the user for the Directory Manager password and verify its
correctness.
"""
password = installutils.read_password("Directory Manager", confirm=False, validate=False)
return password
def get_entry(dn):
"""
Return the entry for the given DN. If the entry is not found return
None.
"""
entry = None
try:
entry = api.Backend.ldap2.get_entry(dn)
except errors.NotFound:
pass
return entry
def main():
retval = 0
files = [paths.SCHEMA_COMPAT_ULDIF]
installutils.check_server_configuration()
options, args = parse_options()
if len(args) != 1:
sys.exit("You must specify one action: enable | disable | status")
elif args[0] != "enable" and args[0] != "disable" and args[0] != "status":
sys.exit("Unrecognized action [" + args[0] + "]")
standard_logging_setup(None, debug=options.debug)
dirman_password = ""
if options.password:
pw = ipautil.template_file(options.password, [])
dirman_password = pw.strip()
else:
dirman_password = get_dirman_password()
if dirman_password is None:
sys.exit("Directory Manager password required")
api.bootstrap(context='cli',
in_server=True,
debug=options.debug,
confdir=paths.ETC_IPA)
api.finalize()
api.Backend.ldap2.connect(bind_pw=dirman_password)
if args[0] == "status":
entry = None
try:
entry = get_entry(compat_dn)
if entry is not None and entry.get('nsslapd-pluginenabled', [''])[0].lower() == 'on':
print("Plugin Enabled")
else:
print("Plugin Disabled")
except errors.LDAPError as lde:
print("An error occurred while talking to the server.")
print(lde)
if args[0] == "enable":
entry = None
try:
entry = get_entry(compat_dn)
if entry is not None and entry.get('nsslapd-pluginenabled', [''])[0].lower() == 'on':
print("Plugin already Enabled")
retval = 2
else:
print("Enabling plugin")
if entry is None:
ld = LDAPUpdate(dm_password=dirman_password, sub_dict={})
if not ld.update(files):
print("Updating Directory Server failed.")
retval = 1
else:
entry['nsslapd-pluginenabled'] = ['on']
api.Backend.ldap2.update_entry(entry)
except errors.ExecutionError as lde:
print("An error occurred while talking to the server.")
print(lde)
retval = 1
elif args[0] == "disable":
entry = None
try:
entry = get_entry(nis_config_dn)
# We can't disable schema compat if the NIS plugin is enabled
if entry is not None and entry.get('nsslapd-pluginenabled', [''])[0].lower() == 'on':
print("The NIS plugin is configured, cannot disable compatibility.", file=sys.stderr)
print("Run 'ipa-nis-manage disable' first.", file=sys.stderr)
retval = 2
except errors.ExecutionError as lde:
print("An error occurred while talking to the server.")
print(lde)
retval = 1
if retval == 0:
entry = None
try:
entry = get_entry(compat_dn)
if entry is None or entry.get('nsslapd-pluginenabled', [''])[0].lower() == 'off':
print("Plugin is already disabled")
retval = 2
else:
print("Disabling plugin")
entry['nsslapd-pluginenabled'] = ['off']
api.Backend.ldap2.update_entry(entry)
except errors.DatabaseError as dbe:
print("An error occurred while talking to the server.")
print(dbe)
retval = 1
except errors.ExecutionError as lde:
print("An error occurred while talking to the server.")
print(lde)
retval = 1
else:
retval = 1
if retval == 0:
print("This setting will not take effect until you restart Directory Server.")
api.Backend.ldap2.disconnect()
return retval
if __name__ == '__main__':
installutils.run_script(main, operation_name='ipa-compat-manage')

84
install/tools/ipa-csreplica-manage.in → install/tools/ipa-csreplica-manage Normal file → Executable file
View File

@@ -1,4 +1,4 @@
@PYTHONSHEBANG@
#! /usr/bin/python2 -E
# Authors: Rob Crittenden <rcritten@redhat.com>
#
# Based on ipa-replica-manage by Karl MacMillan <kmacmillan@mentalrootkit.com>
@@ -22,21 +22,18 @@
from __future__ import print_function
import logging
import sys
import os
from ipaplatform.paths import paths
from ipapython.ipa_log_manager import *
from ipaserver.install import (replication, installutils, bindinstance,
cainstance)
cainstance, certs)
from ipalib import api, errors
from ipalib.constants import CACERT
from ipalib.util import has_managed_topology
from ipapython import ipautil, ipaldap, version
from ipapython.admintool import ScriptError
from ipapython import ipautil, ipaldap, version, dogtag
from ipapython.dn import DN
logger = logging.getLogger(os.path.basename(__file__))
# dict of command name and tuples of min/max num of args needed
commands = {
"list": (0, 1, "[master fqdn]", ""),
@@ -53,7 +50,7 @@ commands = {
def parse_options():
from optparse import OptionParser # pylint: disable=deprecated-module
from optparse import OptionParser
parser = OptionParser(version=version.VERSION)
parser.add_option("-H", "--host", dest="host", help="starting host")
@@ -70,7 +67,8 @@ def parse_options():
if len(args):
n = len(args) - 1
for cmd in commands:
k = commands.keys()
for cmd in k:
if cmd == args[0]:
v = commands[cmd]
err = None
@@ -95,10 +93,8 @@ def list_replicas(realm, host, replica, dirman_passwd, verbose):
try:
# connect to main IPA LDAP server
ldap_uri = ipaldap.get_ldap_uri(host, 636, cacert=paths.IPA_CA_CRT)
conn = ipaldap.LDAPClient(ldap_uri, cacert=paths.IPA_CA_CRT)
conn.simple_bind(bind_dn=ipaldap.DIRMAN_DN,
bind_password=dirman_passwd)
conn = ipaldap.IPAdmin(host, 636, cacert=CACERT)
conn.do_simple_bind(bindpw=dirman_passwd)
dn = DN(('cn', 'masters'), ('cn', 'ipa'), ('cn', 'etc'), ipautil.realm_to_suffix(realm))
entries = conn.get_entries(dn, conn.SCOPE_ONELEVEL)
@@ -194,9 +190,9 @@ def del_link(realm, replica1, replica2, dirman_passwd, force=False):
# Find the DN of the replication agreement to remove
replica2_dn = None
for entry in repl_list:
if entry.single_value.get('nsDS5ReplicaHost') == replica1:
replica2_dn = entry.dn
for e in repl_list:
if e.single_value.get('nsDS5ReplicaHost') == replica1:
replica2_dn = e.dn
break
# This should never happen
@@ -207,8 +203,8 @@ def del_link(realm, replica1, replica2, dirman_passwd, force=False):
print("'%s' has no replication agreement for '%s'" % (replica2, replica1))
if not force:
return
except Exception as exc:
print("Failed to get data from '%s': %s" % (replica2, exc))
except Exception as e:
print("Failed to get data from '%s': %s" % (replica2, e))
if not force:
sys.exit(1)
@@ -217,8 +213,8 @@ def del_link(realm, replica1, replica2, dirman_passwd, force=False):
try:
repl2.delete_agreement(replica1, replica2_dn)
repl2.delete_referral(replica1, repl1.port)
except Exception as exc:
print("Unable to remove agreement on %s: %s" % (replica2, exc))
except Exception as e:
print("Unable to remove agreement on %s: %s" % (replica2, e))
failed = True
if failed:
@@ -236,6 +232,9 @@ def del_link(realm, replica1, replica2, dirman_passwd, force=False):
print("Deleted replication agreement from '%s' to '%s'" % (replica1, replica2))
def del_master(realm, hostname, options):
force_del = False
delrepl = None
# 1. Connect to the local dogtag DS server
@@ -259,6 +258,7 @@ def del_master(realm, hostname, options):
sys.exit(1)
else:
print("Unable to connect to replica %s, forcing removal" % hostname)
force_del = True
# 4. Get list of agreements.
if delrepl is None:
@@ -277,15 +277,16 @@ def del_master(realm, hostname, options):
sys.exit("There were issues removing a connection: %s" % e)
# 6. Pick CA renewal master
ca = cainstance.CAInstance(api.env.realm)
ca = cainstance.CAInstance(api.env.realm, certs.NSS_DIR)
if ca.is_renewal_master(hostname):
ca.set_renewal_master(options.host)
# 7. And clean up the removed replica DNS entries if any.
try:
if bindinstance.dns_container_exists(api.env.basedn):
if bindinstance.dns_container_exists(options.host, api.env.basedn,
dm_password=options.dirman_passwd):
bind = bindinstance.BindInstance()
bind.update_system_records()
bind.remove_ipa_ca_dns_records(hostname, realm.lower())
except Exception as e:
print("Failed to cleanup %s DNS entries: %s" % (hostname, e))
print("You may need to manually remove them from the tree")
@@ -297,10 +298,8 @@ def add_link(realm, replica1, replica2, dirman_passwd, options):
except Exception as e:
sys.exit(str(e))
try:
ldap_uri = ipaldap.get_ldap_uri(replica2, 636, cacert=paths.IPA_CA_CRT)
conn = ipaldap.LDAPClient(ldap_uri, cacert=paths.IPA_CA_CRT)
conn.simple_bind(bind_dn=ipaldap.DIRMAN_DN,
bind_password=dirman_passwd)
conn = ipaldap.IPAdmin(replica2, 636, cacert=CACERT)
conn.do_simple_bind(bindpw=dirman_passwd)
dn = DN(('cn', 'CA'), ('cn', replica2), ('cn', 'masters'), ('cn', 'ipa'), ('cn', 'etc'),
ipautil.realm_to_suffix(realm))
@@ -356,12 +355,10 @@ def re_initialize(realm, options):
entry = repl.conn.get_entries(
DN(('cn', 'config')), repl.conn.SCOPE_SUBTREE, filter)
except errors.NotFound:
logger.error("Unable to find %s -> %s replication agreement",
options.fromhost, thishost)
root_logger.error("Unable to find %s -> %s replication agreement" % (options.fromhost, thishost))
sys.exit(1)
if len(entry) > 1:
logger.error("Found multiple agreements for %s. Only initializing the "
"first one returned: %s", thishost, entry[0].dn)
root_logger.error("Found multiple agreements for %s. Only initializing the first one returned: %s" % (thishost, entry[0].dn))
repl.hostnames = thisrepl.hostnames = [thishost, options.fromhost]
thisrepl.enable_agreement(options.fromhost)
@@ -383,7 +380,7 @@ def set_renewal_master(realm, replica):
if not replica:
replica = installutils.get_fqdn()
ca = cainstance.CAInstance(realm)
ca = cainstance.CAInstance(realm, certs.NSS_DIR)
if ca.is_renewal_master(replica):
sys.exit("%s is already the renewal master" % replica)
@@ -408,22 +405,18 @@ def exit_on_managed_topology(what, hint="topologysegment"):
def main():
installutils.check_server_configuration()
options, args = parse_options()
# Just initialize the environment. This is so the installer can have
# access to the plugin environment
api_env = {}
api_env = {'in_server' : True,
'verbose' : options.verbose,
}
if os.getegid() != 0:
api_env['log'] = None # turn off logging for non-root
api.bootstrap(
context='cli',
in_server=True,
verbose=options.verbose,
confdir=paths.ETC_IPA,
**api_env
)
api.bootstrap(**api_env)
api.finalize()
dirman_passwd = None
@@ -446,7 +439,8 @@ def main():
options.dirman_passwd = dirman_passwd
api.Backend.ldap2.connect(bind_pw=options.dirman_passwd)
api.Backend.ldap2.connect(bind_dn=DN(('cn', 'Directory Manager')),
bind_pw=options.dirman_passwd)
if args[0] == "list":
replica = None
@@ -491,13 +485,11 @@ def main():
replica = args[1]
set_renewal_master(realm, replica)
api.Backend.ldap2.disconnect()
try:
main()
except KeyboardInterrupt:
sys.exit(1)
except (SystemExit, ScriptError) as e:
except SystemExit as e:
sys.exit(e)
except Exception as e:
sys.exit("unexpected error: %s" % e)

296
install/tools/ipa-custodia-check.in
View File

@@ -1,296 +0,0 @@
@PYTHONSHEBANG@
"""Test client for ipa-custodia
The test script is expected to be executed on an IPA server with existing
Custodia server keys.
"""
from __future__ import print_function
import argparse
import logging
import os
import platform
import socket
import warnings
from custodia.message.kem import KEY_USAGE_SIG, KEY_USAGE_ENC, KEY_USAGE_MAP
from jwcrypto.common import json_decode
from jwcrypto.jwk import JWK
from ipalib import api
from ipaplatform.paths import paths
import ipapython.version
from ipaserver.install.installutils import is_ipa_configured
try:
# FreeIPA >= 4.5
from ipaserver.secrets.client import CustodiaClient
except ImportError:
# FreeIPA <= 4.4
from ipapython.secrets.client import CustodiaClient
# Ignore security warning from vendored and non-vendored urllib3
try:
from urllib3.exceptions import SecurityWarning
except ImportError:
SecurityWarning = None
else:
warnings.simplefilter("ignore", SecurityWarning)
try:
from requests.packages.urllib3.exceptions import SecurityWarning
except ImportError:
SecurityWarning = None
else:
warnings.simplefilter("ignore", SecurityWarning)
KEYS = [
'dm/DMHash',
'ra/ipaCert',
'ca/auditSigningCert cert-pki-ca',
'ca/caSigningCert cert-pki-ca',
'ca/ocspSigningCert cert-pki-ca',
'ca/subsystemCert cert-pki-ca',
]
IPA_CUSTODIA_KEYFILE = os.path.join(paths.IPA_CUSTODIA_CONF_DIR,
'server.keys')
logger = logging.getLogger('ipa-custodia-tester')
parser = argparse.ArgumentParser(
"IPA Custodia check",
)
# --store is dangerous and therefore hidden! Don't use it unless you really
# know what you are doing! Keep in mind that it might destroy your NSSDB
# unless it uses sqlite format.
parser.add_argument(
"--store", action='store_true', dest='store',
help=argparse.SUPPRESS
)
parser.add_argument(
"--debug", action='store_true',
help="Debug mode"
)
parser.add_argument(
"--verbose", action='store_true',
help='Verbose mode'
)
parser.add_argument(
"server",
help="FQDN of a IPA server (can be own FQDN for self-test)"
)
parser.add_argument(
'keys', nargs='*', default=KEYS,
help="Remote key ({})".format(', '.join(KEYS))
)
class IPACustodiaTester(object):
files = [
paths.IPA_DEFAULT_CONF,
paths.KRB5_KEYTAB,
paths.IPA_CUSTODIA_CONF,
IPA_CUSTODIA_KEYFILE
]
def __init__(self, parser, args):
self.parser = parser
self.args = args
if not api.isdone('bootstrap'):
# bootstrap to initialize api.env
api.bootstrap()
self.debug("IPA API bootstrapped")
self.realm = api.env.realm
self.host = api.env.host
self.host_spn = 'host/{}@{}'.format(self.host, self.realm)
self.server_spn = 'host/{}@{}'.format(self.args.server, self.realm)
self.client = None
self._errors = []
def error(self, msg, fatal=False):
self._errors.append(msg)
logger.error(msg, exc_info=self.args.verbose)
if fatal:
self.exit()
def exit(self):
if self._errors:
self.parser.exit(1, "[ERROR] One or more tests have failed.\n")
else:
self.parser.exit(0, "All tests have passed successfully.\n")
def warning(self, msg):
logger.warning(msg)
def info(self, msg):
logger.info(msg)
def debug(self, msg):
logger.debug(msg)
def check(self):
self.status()
self.check_fqdn()
self.check_files()
self.check_client()
self.check_jwk()
self.check_keys()
def status(self):
self.info("Platform: {}".format(platform.platform()))
self.info("IPA version: {}".format(
ipapython.version.VERSION
))
self.info("IPA vendor version: {}".format(
ipapython.version.VENDOR_VERSION
))
self.info("Realm: {}".format(self.realm))
self.info("Host: {}".format(self.host))
self.info("Remote server: {}".format(self.args.server))
if self.host == self.args.server:
self.warning("Performing self-test only.")
def check_fqdn(self):
fqdn = socket.getfqdn()
if self.host != fqdn:
self.warning(
"socket.getfqdn() reports hostname '{}'".format(fqdn)
)
def check_files(self):
for filename in self.files:
if not os.path.isfile(filename):
self.error("File '{0}' is missing.".format(filename))
else:
self.info("File '{0}' exists.".format(filename))
def check_client(self):
try:
self.client = CustodiaClient(
server=self.args.server,
client_service='host@{}'.format(self.host),
keyfile=IPA_CUSTODIA_KEYFILE,
keytab=paths.KRB5_KEYTAB,
realm=self.realm,
)
except Exception as e:
self.error("Failed to create client: {}".format(e), fatal=True)
else:
self.info("Custodia client created.")
def _check_jwk_single(self, usage_id):
usage = KEY_USAGE_MAP[usage_id]
with open(IPA_CUSTODIA_KEYFILE) as f:
dictkeys = json_decode(f.read())
try:
pkey = JWK(**dictkeys[usage_id])
local_pubkey = json_decode(pkey.export_public())
except Exception:
raise self.error(
"Failed to load and parse local JWK.", fatal=True
)
else:
self.info("Loaded key for usage '{}' from '{}'.".format(
usage, IPA_CUSTODIA_KEYFILE
))
if pkey.key_id != self.host_spn:
raise self.error(
"KID '{}' != host service principal name '{}' "
"(usage: {})".format(pkey.key_id, self.host_spn, usage),
fatal=True
)
else:
self.info(
"JWK KID matches host's service principal name '{}'.".format(
self.host_spn
))
# LDAP doesn't contain KID
local_pubkey.pop("kid", None)
find_key = self.client.ikk.find_key
try:
host_pubkey = json_decode(find_key(self.host_spn, usage_id))
except Exception:
raise self.error(
"Fetching host keys {} (usage: {}) failed.".format(
self.host_spn, usage),
fatal=True
)
else:
self.info("Checked host LDAP keys '{}' for usage {}.".format(
self.host_spn, usage
))
if host_pubkey != local_pubkey:
self.debug("LDAP: '{}'".format(host_pubkey))
self.debug("Local: '{}'".format(local_pubkey))
raise self.error(
"Host key in LDAP does not match local key.",
fatal=True
)
else:
self.info(
"Local key for usage '{}' matches key in LDAP.".format(usage)
)
try:
server_pubkey = json_decode(find_key(self.server_spn, usage_id))
except Exception:
raise self.error(
"Fetching server keys {} (usage: {}) failed.".format(
self.server_spn, usage),
fatal=True
)
else:
self.info("Checked server LDAP keys '{}' for usage {}.".format(
self.server_spn, usage
))
return local_pubkey, host_pubkey, server_pubkey
def check_jwk(self):
self._check_jwk_single(KEY_USAGE_SIG)
self._check_jwk_single(KEY_USAGE_ENC)
def check_keys(self):
for key in self.args.keys:
try:
result = self.client.fetch_key(key, store=self.args.store)
except Exception as e:
self.error("Failed to retrieve key '{}': {}.".format(
key, e
))
else:
self.info("Successfully retrieved '{}'.".format(key))
if not self.args.store:
self.debug(result)
def main():
args = parser.parse_args()
if args.debug:
args.verbose = True
logging.basicConfig(
level=logging.DEBUG if args.debug else logging.INFO,
format='[%(asctime)s %(name)s] <%(levelname)s>: %(message)s',
datefmt='%Y-%m-%dT%H:%M:%S',
)
if not is_ipa_configured():
parser.error("IPA is not configured on this system.\n")
if os.geteuid() != 0:
parser.error("Script must be executed as root.\n")
tester = IPACustodiaTester(parser, args)
tester.check()
tester.exit()
if __name__ == '__main__':
main()

6
install/tools/ipa-custodia.in
View File

@@ -1,6 +0,0 @@
@PYTHONSHEBANG@
# Copyright (C) 2017 IPA Project Contributors, see COPYING for license
from ipaserver.secrets.service import main
if __name__ == '__main__':
main()

67
install/tools/ipa-dns-install.in → install/tools/ipa-dns-install Normal file → Executable file
View File

@@ -1,4 +1,4 @@
@PYTHONSHEBANG@
#! /usr/bin/python2 -E
# Authors: Martin Nagy <mnagy@redhat.com>
# Based on ipa-server-install by Karl MacMillan <kmacmillan@mentalrootkit.com>
#
@@ -21,44 +21,37 @@
from __future__ import print_function
import logging
import os
import sys
from optparse import OptionGroup, SUPPRESS_HELP
from ipaserver.install import bindinstance
from ipaserver.install import bindinstance, httpinstance
from ipaserver.install.installutils import *
from ipaserver.install import installutils
from ipapython import version
from ipalib import api
from ipaplatform.paths import paths
from ipapython import ipautil
from ipapython.config import IPAOptionParser
from ipapython.ipa_log_manager import standard_logging_setup
from ipapython.ipa_log_manager import standard_logging_setup, root_logger
from ipaserver.install import dns as dns_installer
logger = logging.getLogger(os.path.basename(__file__))
log_file_name = paths.IPASERVER_INSTALL_LOG
def parse_options():
parser = IPAOptionParser(version=version.VERSION)
parser.add_option("-p", "--ds-password", dest="dm_password",
sensitive=True, help=SUPPRESS_HELP)
parser.add_option("-d", "--debug", dest="debug", action="store_true",
default=False, help="print debugging information")
parser.add_option("--ip-address", dest="ip_addresses", metavar="IP_ADDRESS",
default=[], action="append",
type="ip",
help="Master Server IP Address. This option can be used "
"multiple times")
type="ip", ip_local=True, help="Master Server IP Address. This option can be used multiple times")
parser.add_option("--forwarder", dest="forwarders", action="append",
type="ip_with_loopback", help="Add a DNS forwarder. This option can be used multiple times")
type="ip", help="Add a DNS forwarder. This option can be used multiple times")
parser.add_option("--no-forwarders", dest="no_forwarders", action="store_true",
default=False, help="Do not add any DNS forwarders, use root servers instead")
parser.add_option("--auto-forwarders", dest="auto_forwarders",
action="store_true", default=False,
help="Use DNS forwarders configured in /etc/resolv.conf")
parser.add_option("--forward-policy", dest="forward_policy",
choices=("first", "only"), default=None,
help="DNS forwarding policy for global forwarders")
parser.add_option("--reverse-zone", dest="reverse_zones",
default=[], action="append", metavar="REVERSE_ZONE",
help="The reverse DNS zone to use. This option can be used multiple times")
@@ -88,7 +81,7 @@ def parse_options():
parser.add_option("--force", dest="force", action="store_true",
help="Force install")
options, _args = parser.parse_args()
options, args = parser.parse_args()
safe_options = parser.get_safe_opts(options)
if options.dnssec_master and options.disable_dnssec_master:
@@ -103,15 +96,15 @@ def parse_options():
parser.error("You cannot specify a --auto-reverse option together with --no-reverse")
if options.unattended:
if (not options.forwarders
and not options.no_forwarders
and not options.auto_forwarders):
parser.error("You must specify at least one option: "
"--forwarder or --no-forwarders or --auto-forwarders")
if not options.forwarders and not options.no_forwarders:
parser.error("You must specify at least one --forwarder option or --no-forwarders option")
if options.kasp_db_file and not os.path.isfile(options.kasp_db_file):
if options.kasp_db_file and not ipautil.file_exists(options.kasp_db_file):
parser.error("File %s does not exist" % options.kasp_db_file)
if options.dm_password:
print ("WARNING: Option -p/--ds-password is deprecated "
"and should not be used anymore.")
return safe_options, options
def main():
@@ -123,32 +116,38 @@ def main():
standard_logging_setup(log_file_name, debug=options.debug, filemode='a')
print("\nThe log file for this installation can be found in %s" % log_file_name)
logger.debug('%s was invoked with options: %s', sys.argv[0], safe_options)
logger.debug("missing options might be asked for interactively later\n")
logger.debug('IPA version %s', version.VENDOR_VERSION)
root_logger.debug('%s was invoked with options: %s' % (sys.argv[0], safe_options))
root_logger.debug("missing options might be asked for interactively later\n")
root_logger.debug('IPA version %s' % version.VENDOR_VERSION)
installutils.check_server_configuration()
# Initialize the ipalib api
api.bootstrap(
context='install', confdir=paths.ETC_IPA,
in_server=True, debug=options.debug,
cfg = dict(
in_server=True,
debug=options.debug,
)
api.bootstrap(**cfg)
api.finalize()
api.Backend.ldap2.connect()
api.Backend.ldap2.connect(autobind=True)
options.setup_ca = None # must be None to enable autodetection
dns_installer.install_check(True, api, False, options, hostname=api.env.host)
dns_installer.install(True, False, options)
# Services are enabled in dns_installer.install()
# Restart http instance to make sure that python-dns has the right resolver
# https://bugzilla.redhat.com/show_bug.cgi?id=800368
fstore = sysrestore.FileStore(paths.SYSRESTORE)
http = httpinstance.HTTPInstance(fstore)
service.print_msg("Restarting the web server")
http.restart()
# execute ipactl to refresh services status
ipautil.run([paths.IPACTL, 'start', '--ignore-service-failures'],
ipautil.run(['ipactl', 'start', '--ignore-service-failures'],
raiseonerr=False)
api.Backend.ldap2.disconnect()
return 0
if __name__ == '__main__':

67
install/tools/ipa-httpd-kdcproxy.in → install/tools/ipa-httpd-kdcproxy Normal file → Executable file
View File

@@ -1,4 +1,4 @@
@PYTHONSHEBANG@
#!/usr/bin/python2
# Authors:
# Christian Heimes <cheimes@redhat.com>
#
@@ -23,19 +23,16 @@
This script creates or removes the symlink from /etc/ipa/ipa-kdc-proxy.conf
to /etc/httpd/conf.d/. It's called from ExecStartPre hook in httpd.service.
"""
import logging
import os
import socket
import sys
from ipalib import api, errors
from ipapython.ipa_log_manager import standard_logging_setup
from ipapython.ipaldap import LDAPClient
from ipapython.ipaldap import IPAdmin
from ipapython.dn import DN
from ipaplatform.paths import paths
logger = logging.getLogger(os.path.basename(__file__))
DEBUG = False
TIME_LIMIT = 2
@@ -69,6 +66,7 @@ class KDCProxyConfig(object):
def __init__(self, time_limit=TIME_LIMIT):
self.time_limit = time_limit
self.con = None
self.log = api.log
self.ldap_uri = api.env.ldap_uri
self.kdc_dn = DN(('cn', 'KDC'), ('cn', api.env.host),
('cn', 'masters'), ('cn', 'ipa'), ('cn', 'etc'),
@@ -78,10 +76,12 @@ class KDCProxyConfig(object):
def _ldap_con(self):
"""Establish LDAP connection"""
logger.debug('ldap_uri: %s', self.ldap_uri)
self.log.debug('ldap_uri: %s', self.ldap_uri)
try:
self.con = LDAPClient(self.ldap_uri)
self.con.external_bind()
self.con = IPAdmin(ldap_uri=self.ldap_uri)
# EXTERNAL bind as root user
self.con.ldapi = True
self.con.do_bind(timeout=self.time_limit)
except (errors.NetworkError, socket.timeout) as e:
msg = 'Unable to connect to dirsrv: %s' % e
raise CheckError(msg)
@@ -91,32 +91,34 @@ class KDCProxyConfig(object):
except Exception as e:
msg = ('Unknown error while retrieving setting from %s: %s' %
(self.ldap_uri, e))
logger.exception('%s', msg)
self.log.exception(msg)
raise FatalError(msg)
def _find_entry(self, dn, attrs, filter, scope=LDAPClient.SCOPE_BASE):
def _find_entry(self, dn, attrs, filter, scope=IPAdmin.SCOPE_BASE):
"""Find an LDAP entry, handles NotFound and Limit"""
try:
entries = self.con.get_entries(
dn, scope, filter, attrs, time_limit=self.time_limit)
entries, truncated = self.con.find_entries(
filter, attrs, dn, scope, time_limit=self.time_limit)
if truncated:
raise errors.LimitsExceeded()
except errors.NotFound:
logger.debug('Entry not found: %s', dn)
self.log.debug('Entry not found: %s', dn)
return None
except Exception as e:
msg = ('Unknown error while retrieving setting from %s: %s' %
(self.ldap_uri, e))
logger.exception('%s', msg)
self.log.exception(msg)
raise FatalError(msg)
return entries[0]
def is_host_enabled(self):
"""Check replica specific flag"""
logger.debug('Read settings from dn: %s', self.kdc_dn)
self.log.debug('Read settings from dn: %s', self.kdc_dn)
srcfilter = self.con.make_filter(
{'ipaConfigString': u'kdcProxyEnabled'}
)
entry = self._find_entry(self.kdc_dn, ['cn'], srcfilter)
logger.debug('%s ipaConfigString: %s', self.kdc_dn, entry)
self.log.debug('%s ipaConfigString: %s', self.kdc_dn, entry)
return entry is not None
def validate_symlink(self):
@@ -139,20 +141,20 @@ class KDCProxyConfig(object):
try:
valid = self.validate_symlink()
except ConfigFileError as e:
logger.warning("Cannot enable KDC proxy: %s ", e)
self.log.warn("Cannot enable KDC proxy: %s " % e)
return False
if valid:
logger.debug("Symlink exists and is valid")
self.log.debug("Symlink exists and is valid")
return True
if not os.path.isfile(self.conf):
logger.warning("'%s' does not exist", self.conf)
self.log.warn("'%s' does not exist", self.conf)
return False
# create the symbolic link
logger.debug("Creating symlink from '%s' to '%s'",
self.conf, self.conflink)
self.log.debug("Creating symlink from '%s' to '%s'",
self.conf, self.conflink)
os.symlink(self.conf, self.conflink)
return True
@@ -161,15 +163,15 @@ class KDCProxyConfig(object):
try:
valid = self.validate_symlink()
except CheckError as e:
logger.warning("Cannot disable KDC proxy: %s ", e)
self.log.warn("Cannot disable KDC proxy: %s " % e)
return False
if valid:
logger.debug("Removing symlink '%s'", self.conflink)
self.log.debug("Removing symlink '%s'", self.conflink)
os.unlink(self.conflink)
else:
logger.debug("Symlink '%s' has already been removed.",
self.conflink)
self.log.debug("Symlink '%s' has already been removed.",
self.conflink)
return True
@@ -186,8 +188,7 @@ class KDCProxyConfig(object):
def main(debug=DEBUG, time_limit=TIME_LIMIT):
# initialize API without file logging
if not api.isdone('bootstrap'):
api.bootstrap(context='server', confdir=paths.ETC_IPA,
log=None, debug=debug)
api.bootstrap(context='ipa-httpd-kdcproxy', log=None, debug=debug)
standard_logging_setup(verbose=True, debug=debug)
try:
@@ -195,22 +196,20 @@ def main(debug=DEBUG, time_limit=TIME_LIMIT):
with cfg:
if cfg.is_host_enabled():
if cfg.create_symlink():
logger.info('KDC proxy enabled')
api.log.info('KDC proxy enabled')
return 0
else:
if cfg.remove_symlink():
logger.info('KDC proxy disabled')
api.log.info('KDC proxy disabled')
return 0
except CheckError as e:
logger.warning('%s', str(e))
logger.warning('Disabling KDC proxy')
api.log.warn(str(e))
api.log.warn('Disabling KDC proxy')
cfg.remove_symlink()
return 0
except Exception as e:
logger.error('%s', str(e))
api.log.error(str(e))
return 1
else:
return 0
if __name__ == '__main__':

25
install/tools/ipa-httpd-pwdreader
View File

@@ -1,25 +0,0 @@
#!/bin/bash
# This program is a handler written for Apache mod_ssl's SSLPassPhraseDialog.
#
# If you'd like to write your custom binary providing passwords to mod_ssl,
# see the documentation of the aforementioned directive of the mod_ssl module.
USAGE="./ipa-pwdreader host:port RSA|DSA|ECC|number"
if [ "$#" -ne 2 ]; then
echo "Wrong number of arguments!" 1>&2
echo "$USAGE" 1>&2
exit 1
fi
fname=${1/:/-}-$2
pwdpath=/var/lib/ipa/passwds/$fname
# Make sure the values passed in do not contain path information
checkpath=$(/usr/bin/realpath -e ${pwdpath} 2>/dev/null)
if [ $pwdpath == "${checkpath}" ]; then
cat $pwdpath
else
echo "Invalid path ${pwdpath}" 1>&2
fi

2
install/tools/ipa-kra-install.in → install/tools/ipa-kra-install
View File

@@ -1,4 +1,4 @@
@PYTHONSHEBANG@
#! /usr/bin/python2 -E
# Authors: Ade Lee <alee@redhat.com>
#
# Copyright (C) 2014 Red Hat

2
install/tools/ipa-ldap-updater.in → install/tools/ipa-ldap-updater Normal file → Executable file
View File

@@ -1,4 +1,4 @@
@PYTHONSHEBANG@
#!/usr/bin/python2
# Authors: Rob Crittenden <rcritten@redhat.com>
#
# Copyright (C) 2008 Red Hat

69
install/tools/ipa-managed-entries.in → install/tools/ipa-managed-entries Normal file → Executable file
View File

@@ -1,4 +1,4 @@
@PYTHONSHEBANG@
#!/usr/bin/python2
# Authors: Jr Aquino <jr.aquino@citrix.com>
#
# Copyright (C) 2011 Red Hat
@@ -20,22 +20,17 @@
from __future__ import print_function
import logging
import os
import re
import sys
from optparse import OptionParser # pylint: disable=deprecated-module
from optparse import OptionParser
from ipaplatform.paths import paths
from ipapython import config
from ipapython import ipautil, config, ipaldap
from ipaserver.install import installutils
from ipalib import api, errors
from ipapython.ipa_log_manager import standard_logging_setup
from ipalib.constants import CACERT
from ipapython.ipa_log_manager import *
from ipapython.dn import DN
logger = logging.getLogger(os.path.basename(__file__))
def parse_options():
usage = "%prog [options] <status|enable|disable>\n"
usage += "%prog [options]\n"
@@ -48,7 +43,7 @@ def parse_options():
help="DN for the Managed Entry Definition")
parser.add_option("-l", "--list", dest="list_managed_entries",
action="store_true",
help="List available Managed Entries")
help="DN for the Managed Entry Definition")
parser.add_option("-p", "--password", dest="dirman_password",
help="Directory Manager password")
@@ -68,9 +63,6 @@ def get_dirman_password():
def main():
retval = 0
def_dn = None
installutils.check_server_configuration()
options, args = parse_options()
if options.list_managed_entries:
@@ -81,13 +73,9 @@ def main():
sys.exit("Unrecognized action [" + args[0] + "]")
standard_logging_setup(None, debug=options.debug)
api.bootstrap(
context='cli',
in_server=True,
debug=options.debug,
confdir=paths.ETC_IPA)
host = installutils.get_fqdn()
api.bootstrap(context='cli', debug=options.debug)
api.finalize()
api.Backend.ldap2.connect(bind_pw=options.dirman_password)
managed_entry_definitions_dn = DN(
('cn', 'Definitions'),
@@ -96,16 +84,38 @@ def main():
api.env.basedn
)
filter = '(objectClass=extensibleObject)'
conn = None
try:
filter = '(objectClass=extensibleObject)'
conn = ipaldap.IPAdmin(host, 636, cacert=CACERT)
if options.dirman_password:
try:
conn.do_simple_bind(bindpw=options.dirman_password)
except errors.ACIError:
sys.exit("Invalid credentials")
else:
conn.do_sasl_gssapi_bind()
except errors.ACIError:
dirman_password = get_dirman_password()
if dirman_password is None:
sys.exit("Directory Manager password required")
try:
conn.do_simple_bind(bindpw=dirman_password)
except errors.ACIError:
sys.exit("Invalid credentials")
except errors.ExecutionError as lde:
sys.exit("An error occurred while connecting to the server.\n%s\n" %
str(lde))
if options.list_managed_entries:
# List available Managed Entry Plugins
managed_entries = None
try:
entries = api.Backend.ldap2.get_entries(
managed_entry_definitions_dn, api.Backend.ldap2.SCOPE_SUBTREE, filter)
entries = conn.get_entries(
managed_entry_definitions_dn, conn.SCOPE_SUBTREE, filter)
except Exception as e:
logger.debug("Search for managed entries failed: %s", str(e))
root_logger.debug("Search for managed entries failed: %s" % str(e))
sys.exit("Unable to find managed entries at %s" % managed_entry_definitions_dn)
managed_entries = [entry.single_value['cn'] for entry in entries]
if managed_entries:
@@ -122,7 +132,8 @@ def main():
disabled = True
try:
entry = api.Backend.ldap2.get_entry(def_dn)
[entry] = conn.get_entries(def_dn, conn.SCOPE_BASE,
filter, ['originfilter'])
disable_attr = '(objectclass=disable)'
try:
org_filter = entry.single_value.get('originfilter')
@@ -152,7 +163,7 @@ def main():
enable_attr = org_filter.replace(disable_attr, '')
#enable_attr = {'originfilter': enable_attr}
entry['originfilter'] = [enable_attr]
api.Backend.ldap2.update_entry(entry)
conn.update_entry(entry)
print("Enabling Plugin")
retval = 0
except errors.NotFound:
@@ -176,7 +187,7 @@ def main():
else:
disable_attr = '(&%s(%s))' % (disable_attr, org_filter)
entry['originfilter'] = [disable_attr]
api.Backend.ldap2.update_entry(entry)
conn.update_entry(entry)
print("Disabling Plugin")
except errors.NotFound:
print("Plugin is already disabled")
@@ -193,11 +204,7 @@ def main():
else:
retval = 1
api.Backend.ldap2.disconnect()
return retval
if __name__ == '__main__':
if not os.geteuid() == 0:
sys.exit("\nMust be run as root\n")
installutils.run_script(main, operation_name='ipa-managed-entries')

175
install/tools/ipa-nis-manage.in → install/tools/ipa-nis-manage Normal file → Executable file
View File

@@ -1,4 +1,4 @@
@PYTHONSHEBANG@
#!/usr/bin/python2
# Authors: Rob Crittenden <rcritten@redhat.com>
# Authors: Simo Sorce <ssorce@redhat.com>
#
@@ -25,12 +25,13 @@ import sys
import os
from ipaplatform.paths import paths
try:
from optparse import OptionParser # pylint: disable=deprecated-module
from optparse import OptionParser
from ipapython import ipautil, config
from ipaserver.install import installutils
from ipaserver.install.ldapupdate import LDAPUpdate
from ipaserver.install.ldapupdate import LDAPUpdate, BadSyntax
from ipaserver.plugins.ldap2 import ldap2
from ipalib import api, errors
from ipapython.ipa_log_manager import standard_logging_setup
from ipapython.ipa_log_manager import *
from ipapython.dn import DN
from ipaplatform import services
except ImportError as e:
@@ -46,7 +47,7 @@ nis_config_dn = DN(('cn', 'NIS Server'), ('cn', 'plugins'), ('cn', 'config'))
compat_dn = DN(('cn', 'Schema Compatibility'), ('cn', 'plugins'), ('cn', 'config'))
def parse_options():
usage = "%prog [options] <enable|disable|status>\n"
usage = "%prog [options] <enable|disable>\n"
usage += "%prog [options]\n"
parser = OptionParser(usage=usage, formatter=config.IPAFormatter())
@@ -58,6 +59,8 @@ def parse_options():
config.add_standard_options(parser)
options, args = parser.parse_args()
config.init_config(options)
return options, args
def get_dirman_password():
@@ -68,14 +71,14 @@ def get_dirman_password():
return password
def get_entry(dn):
def get_entry(dn, conn):
"""
Return the entry for the given DN. If the entry is not found return
None.
"""
entry = None
try:
entry = api.Backend.ldap2.get_entry(dn)
entry = conn.get_entry(dn)
except errors.NotFound:
pass
return entry
@@ -93,8 +96,8 @@ def main():
options, args = parse_options()
if len(args) != 1:
sys.exit("You must specify one action: enable | disable | status")
elif args[0] not in {"enable", "disable", "status"}:
sys.exit("You must specify one action, either enable or disable")
elif args[0] != "enable" and args[0] != "disable":
sys.exit("Unrecognized action [" + args[0] + "]")
standard_logging_setup(None, debug=options.debug)
@@ -113,91 +116,89 @@ def main():
if not dirman_password:
sys.exit("No password supplied")
api.bootstrap(
context='cli', confdir=paths.ETC_IPA,
debug=options.debug, in_server=True)
api.bootstrap(context='cli', debug=options.debug)
api.finalize()
api.Backend.ldap2.connect(bind_pw=dirman_password)
if args[0] == "enable":
compat = get_entry(compat_dn)
if compat is None or compat.get('nsslapd-pluginenabled', [''])[0].lower() == 'off':
sys.exit("The compat plugin needs to be enabled: ipa-compat-manage enable")
entry = None
conn = None
try:
try:
entry = get_entry(nis_config_dn)
conn = ldap2(api)
conn.connect(
bind_dn=DN(('cn', 'directory manager')), bind_pw=dirman_password
)
except errors.ExecutionError as lde:
print("An error occurred while talking to the server.")
print(lde)
retval = 1
# Enable either the portmap or rpcbind service
portmap = services.knownservices.portmap
rpcbind = services.knownservices.rpcbind
if portmap.is_installed():
portmap.enable()
servicemsg = portmap.service_name
elif rpcbind.is_installed():
rpcbind.enable()
servicemsg = rpcbind.service_name
else:
print("Unable to enable either %s or %s" % (portmap.service_name, rpcbind.service_name))
retval = 3
# The cn=config entry for the plugin may already exist but it
# could be turned off, handle both cases.
if entry is None:
print("Enabling plugin")
ld = LDAPUpdate(dm_password=dirman_password, sub_dict={}, ldapi=True)
if ld.update(files) != True:
retval = 1
elif entry.get('nsslapd-pluginenabled', [''])[0].lower() == 'off':
print("Enabling plugin")
# Already configured, just enable the plugin
entry['nsslapd-pluginenabled'] = ['on']
api.Backend.ldap2.update_entry(entry)
else:
print("Plugin already Enabled")
retval = 2
elif args[0] == "disable":
try:
entry = api.Backend.ldap2.get_entry(nis_config_dn, ['nsslapd-pluginenabled'])
entry['nsslapd-pluginenabled'] = ['off']
api.Backend.ldap2.update_entry(entry)
except (errors.NotFound, errors.EmptyModlist):
print("Plugin is already disabled")
retval = 2
except errors.LDAPError as lde:
print("An error occurred while talking to the server.")
print(lde)
retval = 1
elif args[0] == "status":
nis_entry = get_entry(nis_config_dn)
enabled = (nis_entry and
nis_entry.get(
'nsslapd-pluginenabled', '')[0].lower() == "on")
if enabled:
print("Plugin is enabled")
retval = 0
else:
print("Plugin is not enabled")
retval = 4
else:
retval = 1
if retval == 0:
if args[0] in {"enable", "disable"}:
print("This setting will not take effect until you restart "
"Directory Server.")
sys.exit("An error occurred while connecting to the server: %s" % str(lde))
except errors.AuthorizationError:
sys.exit("Incorrect password")
if args[0] == "enable":
print("The %s service may need to be started." % servicemsg)
compat = get_entry(compat_dn, conn)
if compat is None or compat.get('nsslapd-pluginenabled', [''])[0].lower() == 'off':
sys.exit("The compat plugin needs to be enabled: ipa-compat-manage enable")
entry = None
try:
entry = get_entry(nis_config_dn, conn)
except errors.ExecutionError as lde:
print("An error occurred while talking to the server.")
print(lde)
retval = 1
api.Backend.ldap2.disconnect()
# Enable either the portmap or rpcbind service
try:
portmap = services.knownservices.portmap
portmap.enable()
servicemsg = portmap.service_name
except ipautil.CalledProcessError as cpe:
if cpe.returncode == 1:
try:
rpcbind = services.knownservices.rpcbind
rpcbind.enable()
servicemsg = rpcbind.service_name
except ipautil.CalledProcessError as cpe:
print("Unable to enable either %s or %s" % (portmap.service_name, rpcbind.service_name))
retval = 3
# The cn=config entry for the plugin may already exist but it
# could be turned off, handle both cases.
if entry is None:
print("Enabling plugin")
ld = LDAPUpdate(dm_password=dirman_password, sub_dict={}, ldapi=True)
if ld.update(files) != True:
retval = 1
elif entry.get('nsslapd-pluginenabled', [''])[0].lower() == 'off':
print("Enabling plugin")
# Already configured, just enable the plugin
entry['nsslapd-pluginenabled'] = ['on']
conn.update_entry(entry)
else:
print("Plugin already Enabled")
retval = 2
elif args[0] == "disable":
try:
entry = conn.get_entry(nis_config_dn, ['nsslapd-pluginenabled'])
entry['nsslapd-pluginenabled'] = ['off']
conn.update_entry(entry)
except (errors.NotFound, errors.EmptyModlist):
print("Plugin is already disabled")
retval = 2
except errors.LDAPError as lde:
print("An error occurred while talking to the server.")
print(lde)
retval = 1
else:
retval = 1
if retval == 0:
print("This setting will not take effect until you restart Directory Server.")
if args[0] == "enable":
print("The %s service may need to be started." % servicemsg)
finally:
if conn and conn.isconnected():
conn.disconnect()
return retval

4
install/tools/ipa-otptoken-import.in → install/tools/ipa-otptoken-import Normal file → Executable file
View File

@@ -1,4 +1,4 @@
@PYTHONSHEBANG@
#! /usr/bin/python2 -E
# Authors: Nathaniel McCallum <npmccallum@redhat.com>
#
# Copyright (C) 2014 Red Hat
@@ -19,5 +19,7 @@
#
from ipaserver.install.ipa_otptoken_import import OTPTokenImport
import nss.nss as nss
OTPTokenImport.run_cli()

42
install/tools/ipa-pki-retrieve-key.in
View File

@@ -1,42 +0,0 @@
@PYTHONSHEBANG@
from __future__ import print_function
import os
import sys
import traceback
from ipalib import constants
from ipalib.config import Env
from ipaplatform.paths import paths
from ipaserver.secrets.client import CustodiaClient
def main():
env = Env()
env._finalize()
keyname = "ca_wrapped/" + sys.argv[1]
servername = sys.argv[2]
service = constants.PKI_GSSAPI_SERVICE_NAME
client_keyfile = os.path.join(paths.PKI_TOMCAT, service + '.keys')
client_keytab = os.path.join(paths.PKI_TOMCAT, service + '.keytab')
# pylint: disable=no-member
client = CustodiaClient(
client_service='%s@%s' % (service, env.host), server=servername,
realm=env.realm, ldap_uri="ldaps://" + env.host,
keyfile=client_keyfile, keytab=client_keytab,
)
# Print the response JSON to stdout; it is already in the format
# that Dogtag's ExternalProcessKeyRetriever expects
print(client.fetch_key(keyname, store=False))
try:
main()
except BaseException:
traceback.print_exc()
sys.exit(1)

8
install/tools/ipa-pkinit-manage.in
View File

@@ -1,8 +0,0 @@
@PYTHONSHEBANG@
#
# Copyright (C) 2017 FreeIPA Contributors see COPYING for license
#
from ipaserver.install.ipa_pkinit_manage import PKINITManage
PKINITManage.run_cli()

361
install/tools/ipa-replica-conncheck.in → install/tools/ipa-replica-conncheck Normal file → Executable file
View File

@@ -1,4 +1,4 @@
@PYTHONSHEBANG@
#! /usr/bin/python2 -E
# Authors: Martin Kosek <mkosek@redhat.com>
#
# Copyright (C) 2011 Red Hat
@@ -20,53 +20,46 @@
from __future__ import print_function
import logging
import ipaclient.install.ipachangeconf
from ipapython.config import IPAOptionParser
from ipapython.dn import DN
from ipapython import version
from ipapython import ipautil, certdb
from ipapython.ipautil import CalledProcessError
from ipalib import api, errors, x509
from ipaserver.install import installutils
# pylint: disable=deprecated-module
import ipaclient.ipachangeconf
from optparse import OptionGroup, OptionValueError
# pylint: enable=deprecated-module
from ipapython.ipa_log_manager import standard_logging_setup
import copy
from ipapython.ipa_log_manager import *
import sys
import os
import signal
import tempfile
import select
import socket
import time
import threading
import traceback
import errno
from socket import SOCK_STREAM, SOCK_DGRAM
import distutils.spawn
from ipaplatform.paths import paths
import gssapi
logger = logging.getLogger(os.path.basename(__file__))
from nss import nss
CONNECT_TIMEOUT = 5
RESPONDER = None
RESPONDERS = [ ]
QUIET = False
CCACHE_FILE = None
KRB5_CONFIG = None
class SshExec(object):
def __init__(self, user, addr):
self.user = user
self.addr = addr
self.cmd = distutils.spawn.find_executable('ssh')
# Bail if ssh is not installed
if self.cmd is None:
raise RuntimeError("ssh not installed")
def __call__(self, command, verbose=False):
# Bail if ssh is not installed
if self.cmd is None:
print("WARNING: ssh not installed, skipping ssh test")
return ('', '', 0)
tmpf = tempfile.NamedTemporaryFile()
cmd = [
@@ -74,9 +67,7 @@ class SshExec(object):
'-o StrictHostKeychecking=no',
'-o UserKnownHostsFile=%s' % tmpf.name,
'-o GSSAPIAuthentication=yes',
'-o User=%s' % self.user,
'%s' % self.addr,
command
'%s@%s' % (self.user, self.addr), command
]
if verbose:
cmd.insert(1, '-v')
@@ -101,7 +92,6 @@ class CheckedPort(object):
self.port_type = port_type
self.description = description
BASE_PORTS = [
CheckedPort(389, SOCK_STREAM, "Directory Service: Unsecure port"),
CheckedPort(636, SOCK_STREAM, "Directory Service: Secure port"),
@@ -114,6 +104,10 @@ BASE_PORTS = [
]
def print_info(msg):
if not QUIET:
print(msg)
def parse_options():
def ca_cert_file_callback(option, opt, value, parser):
if not os.path.exists(value):
@@ -126,12 +120,16 @@ def parse_options():
raise OptionValueError(
"%s option '%s' is not an absolute file path" % (opt, value))
initialized = nss.nss_is_initialized()
try:
x509.load_certificate_list_from_file(value)
except Exception:
raise OptionValueError(
"%s option '%s' is not a valid certificate file" %
(opt, value))
finally:
if not initialized:
nss.nss_shutdown()
parser.values.ca_cert_file = value
@@ -151,7 +149,7 @@ def parse_options():
replica_group.add_option("-p", "--principal", dest="principal",
default=None, help="Principal to use to log in to remote master")
replica_group.add_option("-w", "--password", dest="password", sensitive=True,
help="Password for the principal")
help="Password for the principal"),
replica_group.add_option("--ca-cert-file", dest="ca_cert_file",
type="string", action="callback",
callback=ca_cert_file_callback,
@@ -173,8 +171,7 @@ def parse_options():
common_group.add_option("", "--hostname", dest="hostname",
help="The hostname of this server (FQDN). "
"By default the result of getfqdn() call from "
"Python's socket module is used.")
"By default a nodename from uname(2) is used.")
parser.add_option_group(common_group)
parser.add_option("-d", "--debug", dest="debug",
@@ -183,10 +180,8 @@ def parse_options():
parser.add_option("-q", "--quiet", dest="quiet",
action="store_true",
default=False, help="Output only errors")
parser.add_option("--no-log", dest="log_to_file", action="store_false",
default=True, help="Do not log into file")
options, _args = parser.parse_args()
options, args = parser.parse_args()
safe_options = parser.get_safe_opts(options)
if options.master and options.replica:
@@ -207,18 +202,30 @@ def parse_options():
if not options.hostname:
options.hostname = socket.getfqdn()
return safe_options, options
if options.quiet:
global QUIET
QUIET = True
return safe_options, options
def logging_setup(options):
log_file = None
if os.getegid() == 0 and options.log_to_file:
if os.getegid() == 0:
log_file = paths.IPAREPLICA_CONNCHECK_LOG
standard_logging_setup(log_file, verbose=(not options.quiet),
debug=options.debug, console_format='%(message)s')
standard_logging_setup(log_file, debug=options.debug)
def clean_responders(responders):
if not responders:
return
for responder in responders:
responder.stop()
for responder in responders:
responder.join()
responders.remove(responder)
def sigterm_handler(signum, frame):
# do what SIGINT does (raise a KeyboardInterrupt)
@@ -226,10 +233,9 @@ def sigterm_handler(signum, frame):
if callable(sigint_handler):
sigint_handler(signum, frame)
def configure_krb5_conf(realm, kdc, filename):
krbconf = ipaclient.install.ipachangeconf.IPAChangeConf("IPA Installer")
krbconf = ipaclient.ipachangeconf.IPAChangeConf("IPA Installer")
krbconf.setOptionAssignment((" = ", " "))
krbconf.setSectionNameDelimiters(("[","]"))
krbconf.setSubSectionDelimiters(("{","}"))
@@ -269,123 +275,45 @@ def configure_krb5_conf(realm, kdc, filename):
appopts = [{'name':'pam', 'type':'subsection', 'value':pamopts}]
opts.append({'name':'appdefaults', 'type':'section', 'value':appopts})
logger.debug("Writing temporary Kerberos configuration to %s:\n%s",
filename, krbconf.dump(opts))
root_logger.debug("Writing temporary Kerberos configuration to %s:\n%s"
% (filename, krbconf.dump(opts)))
krbconf.newConf(filename, opts)
class PortResponder(threading.Thread):
PROTO = {socket.SOCK_STREAM: 'tcp',
socket.SOCK_DGRAM: 'udp'}
def __init__(self, ports):
"""
ports: a list of CheckedPort
"""
def __init__(self, port, port_type, socket_timeout=1):
super(PortResponder, self).__init__()
# copy ports to avoid the need to synchronize it between threads
self.ports = copy.deepcopy(ports)
self._sockets = []
self._close = False
self._close_lock = threading.Lock()
self.responder_data = b'FreeIPA'
self.ports_opened = False
self.ports_open_cond = threading.Condition()
self.port = port
self.port_type = port_type
self.socket_timeout = socket_timeout
self._stop_request = False
def run(self):
logger.debug('Starting listening thread.')
for port in self.ports:
self._bind_to_port(port.port, port.port_type)
with self.ports_open_cond:
self.ports_opened = True
logger.debug('Ports opened, notify original thread')
self.ports_open_cond.notify()
while not self._is_closing():
ready_socks, _socks1, _socks2 = select.select(
self._sockets, [], [], 1)
if ready_socks:
ready_sock = ready_socks[0]
self._respond(ready_sock)
for sock in self._sockets:
port = sock.getsockname()[1]
proto = PortResponder.PROTO[sock.type]
sock.close()
logger.debug('%d %s: Stopped listening', port, proto)
def _is_closing(self):
with self._close_lock: # pylint: disable=not-context-manager
return self._close
def _bind_to_port(self, port, socket_type):
# Use IPv6 socket as it is able to accept both IPv6 and IPv4
# connections. Since IPv6 kernel module is required by other
# parts of IPA, it should always be available.
family = socket.AF_INET6
host = '::' # all available interfaces
proto = PortResponder.PROTO[socket_type]
try:
sock = socket.socket(family, socket_type)
# Make sure IPv4 clients can connect to IPv6 socket
sock.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 0)
if socket_type == socket.SOCK_STREAM:
sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
sock.bind((host, port))
if socket_type == socket.SOCK_STREAM:
# There might be a delay before accepting the connection,
# because a single thread is used to handle all the
# connections. Thus a backlog size of at least 1 is needed.
sock.listen(1)
logger.debug('%d %s: Started listening', port, proto)
except socket.error:
logger.warning('%d %s: Failed to bind', port, proto)
logger.debug("%s", traceback.format_exc())
else:
self._sockets.append(sock)
def _respond(self, sock):
port = sock.getsockname()[1]
if sock.type == socket.SOCK_STREAM:
connection, addr = sock.accept()
while not self._stop_request:
try:
connection.sendall(self.responder_data)
logger.debug('%d tcp: Responded to %s', port, addr[0])
finally:
connection.close()
elif sock.type == socket.SOCK_DGRAM:
_data, addr = sock.recvfrom(1)
sock.sendto(self.responder_data, addr)
logger.debug('%d udp: Responded to %s', port, addr[0])
ipautil.bind_port_responder(self.port,
self.port_type,
socket_timeout=self.socket_timeout,
responder_data="FreeIPA")
except socket.timeout:
pass
except socket.error as e:
if e.errno == errno.EADDRINUSE:
time.sleep(1)
else:
raise
def stop(self):
logger.debug('Stopping listening thread.')
with self._close_lock: # pylint: disable=not-context-manager
self._close = True
self._stop_request = True
def port_check(host, port_list):
ports_failed = []
ports_udp_warning = [] # conncheck could not verify that port is open
log_level = {
SOCK_DGRAM: logging.WARNING,
SOCK_STREAM: logging.ERROR
}
for port in port_list:
try:
port_open = ipautil.host_port_open(
host, port.port, port.port_type,
socket_timeout=CONNECT_TIMEOUT, log_errors=True,
log_level=log_level[port.port_type])
port_open = ipautil.host_port_open(host, port.port,
port.port_type, socket_timeout=CONNECT_TIMEOUT)
except socket.gaierror:
raise RuntimeError("Port check failed! Unable to resolve host name '%s'" % host)
if port_open:
@@ -397,14 +325,13 @@ def port_check(host, port_list):
else:
ports_failed.append(port)
result = "FAILED"
logger.info(" %s (%d): %s", port.description, port.port, result)
print_info(" %s (%d): %s" % (port.description, port.port, result))
if ports_udp_warning:
logger.warning(
("The following UDP ports could not be verified as open: %s\n"
"This can happen if they are already bound to an application\n"
"and ipa-replica-conncheck cannot attach own UDP responder."),
", ".join(str(port.port) for port in ports_udp_warning))
print("The following UDP ports could not be verified as open: %s" \
% ", ".join(str(port.port) for port in ports_udp_warning))
print("This can happen if they are already bound to an application")
print("and ipa-replica-conncheck cannot attach own UDP responder.")
if ports_failed:
msg_ports = []
@@ -414,15 +341,13 @@ def port_check(host, port_list):
raise RuntimeError("Port check failed! Inaccessible port(s): %s" \
% ", ".join(msg_ports))
def main():
global RESPONDER
safe_options, options = parse_options()
logging_setup(options)
logger.debug('%s was invoked with options: %s', sys.argv[0], safe_options)
logger.debug("missing options might be asked for interactively later\n")
logger.debug('IPA version %s', version.VENDOR_VERSION)
root_logger.debug('%s was invoked with options: %s' % (sys.argv[0], safe_options))
root_logger.debug("missing options might be asked for interactively later\n")
root_logger.debug('IPA version %s' % version.VENDOR_VERSION)
signal.signal(signal.SIGTERM, sigterm_handler)
@@ -434,59 +359,52 @@ def main():
"PKI-CA: Directory Service port"))
if options.replica:
logger.info("Check connection from master to remote replica '%s':",
options.replica)
print_info("Check connection from master to remote replica '%s':" % options.replica)
port_check(options.replica, required_ports)
logger.info("\nConnection from master to replica is OK.")
print_info("\nConnection from master to replica is OK.")
# kinit to foreign master
if options.master:
# check ports on master first
logger.info("Check connection from replica to remote master '%s':",
options.master)
print_info("Check connection from replica to remote master '%s':" % options.master)
tcp_ports = [ port for port in required_ports if port.port_type == SOCK_STREAM ]
udp_ports = [ port for port in required_ports if port.port_type == SOCK_DGRAM ]
port_check(options.master, tcp_ports)
if udp_ports:
logger.info("\nThe following list of ports use UDP protocol "
"and would need to be\n"
"checked manually:")
print_info("\nThe following list of ports use UDP protocol and would need to be")
print_info("checked manually:")
for port in udp_ports:
result = "SKIPPED"
logger.info(" %s (%d): %s",
port.description, port.port, result)
print_info(" %s (%d): %s" % (port.description, port.port, result))
logger.info("\nConnection from replica to master is OK.")
print_info("\nConnection from replica to master is OK.")
# create listeners
logger.info("Start listening on required ports for remote "
"master check")
global RESPONDERS
print_info("Start listening on required ports for remote master check")
RESPONDER = PortResponder(required_ports)
RESPONDER.start()
with RESPONDER.ports_open_cond:
if not RESPONDER.ports_opened:
logger.debug('Original thread stopped')
RESPONDER.ports_open_cond.wait()
logger.debug('Original thread resumed')
for port in required_ports:
root_logger.debug("Start listening on port %d (%s)" % (port.port, port.description))
responder = PortResponder(port.port, port.port_type)
responder.start()
RESPONDERS.append(responder)
remote_check_opts = ['--replica %s' % options.hostname]
if options.auto_master_check:
logger.info("Get credentials to log in to remote master")
print_info("Get credentials to log in to remote master")
cred = None
if options.principal is None:
# Check if ccache is available
try:
logger.debug('KRB5CCNAME set to %s',
os.environ.get('KRB5CCNAME', None))
root_logger.debug('KRB5CCNAME set to %s' %
os.environ.get('KRB5CCNAME', None))
# get default creds, will raise if none found
cred = gssapi.creds.Credentials()
principal = str(cred.name)
except gssapi.raw.misc.GSSError as e:
logger.debug('Failed to find default ccache: %s', e)
root_logger.debug('Failed to find default ccache: %s' % e)
# Use admin as the default principal
principal = "admin"
else:
@@ -530,15 +448,14 @@ def main():
if result.returncode != 0:
raise RuntimeError("Could not get ticket for master server: %s" %
result.error_output)
# Now that the cred cache file is initialized,
# use it for the IPA API calls
os.environ['KRB5CCNAME'] = CCACHE_FILE
try:
logger.info("Check RPC connection to remote master")
print_info("Check RPC connection to remote master")
xmlrpc_uri = ('https://%s/ipa/xml' %
ipautil.format_netloc(options.master))
api.bootstrap(context='client', xmlrpc_uri=xmlrpc_uri)
api.finalize()
if options.ca_cert_file:
nss_dir = None
@@ -547,29 +464,31 @@ def main():
with certdb.NSSDatabase(nss_dir) as nss_db:
if options.ca_cert_file:
nss_db.create_db()
nss_dir = nss_db.secdir
password = ipautil.ipa_generate_password()
password_file = ipautil.write_tmp_file(password)
nss_db.create_db(password_file.name)
ca_certs = x509.load_certificate_list_from_file(
options.ca_cert_file)
options.ca_cert_file, dbdir=nss_db.secdir)
for ca_cert in ca_certs:
nss_db.add_cert(
ca_cert,
str(DN(ca_cert.subject)),
certdb.EXTERNAL_CA_TRUST_FLAGS)
ca_cert.der_data, str(ca_cert.subject), 'C,,')
del ca_cert
del ca_certs
else:
nss_dir = None
api.bootstrap(context='client',
confdir=paths.ETC_IPA,
xmlrpc_uri=xmlrpc_uri,
nss_dir=nss_db.secdir)
api.finalize()
try:
api.Backend.rpcclient.connect()
api.Backend.rpcclient.connect(nss_dir=nss_dir)
api.Command.ping()
except Exception as e:
logger.info(
"Could not connect to the remote host: %s", e)
print_info(
"Could not connect to the remote host: %s" % e)
raise
logger.info("Execute check on remote master")
print_info("Execute check on remote master")
try:
result = api.Backend.rpcclient.forward(
'server_conncheck',
@@ -578,81 +497,67 @@ def main():
version=u'2.162',
)
except (errors.CommandError, errors.NetworkError) as e:
logger.info(
print_info(
"Remote master does not support check over RPC: "
"%s", e)
"%s" % e)
raise
except errors.PublicError as e:
returncode = 1
stderr = e
else:
for message in result['messages']:
logger.info('%s', message['message'])
print_info(message['message'])
returncode = int(not result['result'])
stderr = ("ipa-replica-conncheck returned non-zero "
"exit code")
finally:
if api.Backend.rpcclient.isconnected():
api.Backend.rpcclient.disconnect()
except Exception as e:
logger.debug("RPC connection failed: %s", e)
logger.info("Retrying using SSH...")
except Exception:
print_info("Retrying using SSH...")
# Ticket 5812 Always qualify requests for admin
user = principal
try:
ssh = SshExec(user, options.master)
except RuntimeError as e:
logger.warning("WARNING: %s, skipping ssh test", e)
return 0
user = principal.partition('@')[0]
ssh = SshExec(user, options.master)
logger.info("Check SSH connection to remote master")
print_info("Check SSH connection to remote master")
result = ssh('echo OK', verbose=True)
if result.returncode != 0:
logger.debug('%s', result.error_output)
raise RuntimeError(
'Could not SSH to remote host.\n'
'See /var/log/ipareplica-conncheck.log for more '
'information.')
print('Could not SSH into remote host. Error output:')
for line in result.error_output.splitlines():
print(' %s' % line)
raise RuntimeError('Could not SSH to remote host.')
logger.info("Execute check on remote master")
print_info("Execute check on remote master")
result = ssh(
"/usr/sbin/ipa-replica-conncheck " +
" ".join(remote_check_opts))
returncode = result.returncode
stderr = result.error_output
logger.info('%s', result.output)
print_info(result.output)
if returncode != 0:
raise RuntimeError(
"Remote master check failed with following "
"error message(s):\n%s" % stderr)
raise RuntimeError("Remote master check failed with following error message(s):\n%s" % stderr)
else:
# wait until user test is ready
logger.info(
"Listeners are started. Use CTRL+C to terminate the listening "
"part after the test.\n\n"
"Please run the following command on remote master:\n"
"/usr/sbin/ipa-replica-conncheck %s",
" ".join(remote_check_opts))
time.sleep(3600)
logger.info(
"Connection check timeout: terminating listening program")
return 0
print_info("Listeners are started. Use CTRL+C to terminate the listening part after the test.")
print_info("")
print_info("Please run the following command on remote master:")
print_info("/usr/sbin/ipa-replica-conncheck " + " ".join(remote_check_opts))
time.sleep(3600)
print_info("Connection check timeout: terminating listening program")
if __name__ == "__main__":
try:
sys.exit(main())
except SystemExit as e:
sys.exit(e)
except KeyboardInterrupt:
logger.info("\nCleaning up...")
print_info("\nCleaning up...")
sys.exit(1)
except RuntimeError as e:
logger.error('ERROR: %s', e)
sys.exit(1)
sys.exit(e)
finally:
if RESPONDER is not None:
RESPONDER.stop()
RESPONDER.join()
clean_responders(RESPONDERS)
for file_name in (CCACHE_FILE, KRB5_CONFIG):
if file_name:
try:

19
install/tools/ipa-replica-install.in → install/tools/ipa-replica-install Normal file → Executable file
View File

@@ -1,4 +1,4 @@
@PYTHONSHEBANG@
#! /usr/bin/python2 -E
# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
#
# Copyright (C) 2007 Red Hat
@@ -18,6 +18,19 @@
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
from ipaserver.install import ipa_replica_install
from ipapython.install import cli
from ipaplatform.paths import paths
from ipaserver.install.server import Replica
ipa_replica_install.run()
ReplicaInstall = cli.install_tool(
Replica,
command_name='ipa-replica-install',
positional_arguments='replica_file',
usage='%prog [options] REPLICA_FILE',
log_file_name=paths.IPAREPLICA_INSTALL_LOG,
debug_option=True,
)
ReplicaInstall.run_cli()

548
install/tools/ipa-replica-manage.in → install/tools/ipa-replica-manage Normal file → Executable file
View File

@@ -1,4 +1,4 @@
@PYTHONSHEBANG@
#! /usr/bin/python2 -E
# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
#
# Copyright (C) 2007 Red Hat
@@ -20,35 +20,33 @@
from __future__ import print_function
import logging
import sys
import os
import re
import traceback
import ldap
import socket
import traceback
import time
# pylint: disable=import-error
from six.moves.urllib.parse import urlparse
from six.moves.xmlrpc_client import MAXINT
# pylint: enable=import-error
from ipaclient.install import ipadiscovery
from ipapython import ipautil
from ipaserver.install import replication, dsinstance, installutils
from ipaserver.install import bindinstance, cainstance
from ipaserver.install import bindinstance, cainstance, certs
from ipaserver.install import opendnssecinstance, dnskeysyncinstance
from ipapython import version, ipaldap
from ipalib import api, errors
from ipalib.util import has_managed_topology, verify_host_resolvable
from ipapython.ipa_log_manager import standard_logging_setup
from ipalib import api, errors, util
from ipalib.constants import CACERT
from ipalib.util import (create_topology_graph,
get_topology_connection_errors, has_managed_topology)
from ipapython.ipa_log_manager import *
from ipapython.dn import DN
from ipapython.config import IPAOptionParser
from ipaclient import ipadiscovery
from six.moves.xmlrpc_client import MAXINT
from ipaplatform.paths import paths
logger = logging.getLogger(os.path.basename(__file__))
# dict of command name and tuples of min/max num of args needed
commands = {
"list":(0, 1, "[master fqdn]", ""),
@@ -71,14 +69,6 @@ commands = {
"dnanextrange-set":(2, 2, "<master fqdn> <range>", "must provide a master and ID range"),
}
# tuple of commands that work with ca tree and need Directory Manager password
dirman_passwd_req_commands = ("list-ruv", "clean-ruv", "abort-clean-ruv",
"clean-dangling-ruv")
class NoRUVsFound(Exception):
pass
def parse_options():
parser = IPAOptionParser(version=version.VERSION)
@@ -86,8 +76,6 @@ def parse_options():
parser.add_option("-p", "--password", dest="dirman_passwd", help="Directory Manager password")
parser.add_option("-v", "--verbose", dest="verbose", action="store_true", default=False,
help="provide additional information")
parser.add_option("-d", "--debug", dest="debug", action="store_true", default=False,
help="provide additional debug information")
parser.add_option("-f", "--force", dest="force", action="store_true", default=False,
help="ignore some types of errors")
parser.add_option("-c", "--cleanup", dest="cleanup", action="store_true", default=False,
@@ -114,7 +102,8 @@ def parse_options():
if len(args):
n = len(args) - 1
for cmd in commands:
k = commands.keys()
for cmd in k:
if cmd == args[0]:
v = commands[cmd]
err = None
@@ -145,7 +134,7 @@ def test_connection(realm, host, nolookup=False):
if not nolookup:
enforce_host_existence(host)
replman = replication.ReplicationManager(realm, host, None)
replman.find_replication_agreements()
ents = replman.find_replication_agreements()
del replman
return True
except errors.ACIError:
@@ -170,13 +159,11 @@ def list_replicas(realm, host, replica, dirman_passwd, verbose, nolookup=False):
peers = {}
try:
ldap_uri = ipaldap.get_ldap_uri(host, 636, cacert=paths.IPA_CA_CRT)
conn = ipaldap.LDAPClient(ldap_uri, cacert=paths.IPA_CA_CRT)
conn = ipaldap.IPAdmin(host, 636, cacert=CACERT)
if dirman_passwd:
conn.simple_bind(bind_dn=ipaldap.DIRMAN_DN,
bind_password=dirman_passwd)
conn.do_simple_bind(bindpw=dirman_passwd)
else:
conn.gssapi_bind()
conn.do_sasl_gssapi_bind()
except Exception as e:
print("Failed to connect to host '%s': %s" % (host, str(e)))
return
@@ -221,7 +208,7 @@ def list_replicas(realm, host, replica, dirman_passwd, verbose, nolookup=False):
if winsync_peer:
repl = replication.ReplicationManager(realm, winsync_peer,
dirman_passwd)
_cn, dn = repl.agreement_dn(replica)
cn, dn = repl.agreement_dn(replica)
entries = repl.conn.get_entries(
dn, conn.SCOPE_BASE,
"(objectclass=nsDSWindowsReplicationAgreement)")
@@ -313,7 +300,7 @@ def del_link(realm, replica1, replica2, dirman_passwd, force=False):
try:
repl2.set_readonly(readonly=True)
repl2.force_sync(repl2.conn, replica1)
_cn, dn = repl2.agreement_dn(repl1.conn.host)
cn, dn = repl2.agreement_dn(repl1.conn.host)
repl2.wait_for_repl_update(repl2.conn, dn, 30)
(range_start, range_max) = repl2.get_DNA_range(repl2.conn.host)
(next_start, next_max) = repl2.get_DNA_next_range(repl2.conn.host)
@@ -375,9 +362,8 @@ def get_ruv(realm, host, dirman_passwd, nolookup=False, ca=False):
else:
thisrepl = replication.ReplicationManager(realm, host, dirman_passwd)
except Exception as e:
logger.debug("%s", traceback.format_exc())
raise RuntimeError("Failed to connect to server {host}: {err}"
.format(host=host, err=e))
print("Failed to connect to server %s: %s" % (host, e))
sys.exit(1)
search_filter = '(&(nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff)(objectclass=nstombstone))'
try:
@@ -385,8 +371,8 @@ def get_ruv(realm, host, dirman_passwd, nolookup=False, ca=False):
thisrepl.db_suffix, thisrepl.conn.SCOPE_SUBTREE, search_filter,
['nsds50ruv'])
except errors.NotFound:
logger.debug("%s", traceback.format_exc())
raise NoRUVsFound("No RUV records found.")
print("No RUV records found.")
sys.exit(0)
servers = []
for e in entries:
@@ -396,96 +382,33 @@ def get_ruv(realm, host, dirman_passwd, nolookup=False, ca=False):
data = re.match('\{replica (\d+) (ldap://.*:\d+)\}(\s+\w+\s+\w*){0,1}', ruv)
if data:
rid = data.group(1)
(
_scheme, netloc, _path, _params, _query, _fragment
) = urlparse(data.group(2))
(scheme, netloc, path, params, query, fragment) = urlparse(data.group(2))
servers.append((netloc, rid))
else:
print("unable to decode: %s" % ruv)
return servers
def get_ruv_both_suffixes(realm, host, dirman_passwd, verbose, nolookup=False):
"""
Get RUVs for both domain and ipaca suffixes
"""
ruvs = {}
fail_gracefully = True
try:
ruvs['ca'] = get_ruv(realm, host, dirman_passwd, nolookup, True)
except (NoRUVsFound, RuntimeError) as e:
err = "Failed to get CS-RUVs from {host}: {err}".format(host=host,
err=e)
if isinstance(e, RuntimeError):
fail_gracefully = False
if verbose:
print(err)
logger.debug('%s', err)
try:
ruvs['domain'] = get_ruv(realm, host, dirman_passwd, nolookup)
except (NoRUVsFound, RuntimeError) as e:
err = "Failed to get RUVs from {host}: {err}".format(host=host, err=e)
if isinstance(e, RuntimeError):
if not fail_gracefully:
raise
if verbose:
print(err)
logger.debug('%s', err)
if not ruvs:
raise NoRUVsFound("No RUV records found.")
return ruvs
def list_ruv(realm, host, dirman_passwd, verbose, nolookup=False):
"""
List the Replica Update Vectors on this host to get the available
replica IDs.
"""
try:
servers = get_ruv_both_suffixes(realm, host, dirman_passwd,
verbose, nolookup)
except (NoRUVsFound, RuntimeError) as e:
print(e)
sys.exit(0 if isinstance(e, NoRUVsFound) else 1)
print('Replica Update Vectors:')
if servers.get('domain'):
for netloc, rid in servers['domain']:
print("\t{name}: {id}".format(name=netloc, id=rid))
else:
print('\tNo RUVs found.')
print('Certificate Server Replica Update Vectors:')
if servers.get('ca'):
for netloc, rid in servers['ca']:
print("\t{name}: {id}".format(name=netloc, id=rid))
else:
print('\tNo CS-RUVs found.')
servers = get_ruv(realm, host, dirman_passwd, nolookup)
for (netloc, rid) in servers:
print("%s: %s" % (netloc, rid))
def get_rid_by_host(realm, sourcehost, host, dirman_passwd, nolookup=False):
"""
Try to determine the RID by host name.
"""
try:
servers = get_ruv(realm, sourcehost, dirman_passwd, nolookup)
except RuntimeError as e:
print(e)
sys.exit(1)
except NoRUVsFound as e:
print(e)
servers = []
servers = get_ruv(realm, sourcehost, dirman_passwd, nolookup)
for (netloc, rid) in servers:
if '%s:389' % host == netloc:
return int(rid)
return None
def clean_ruv(realm, ruv, options):
def clean_ruv(realm, ruv, options, ca=False):
"""
Given an RID create a CLEANALLRUV task to clean it up.
"""
@@ -494,29 +417,19 @@ def clean_ruv(realm, ruv, options):
except ValueError:
sys.exit("Replica ID must be an integer: %s" % ruv)
try:
servers = get_ruv_both_suffixes(realm, options.host,
options.dirman_passwd,
options.verbose,
options.nolookup)
except (NoRUVsFound, RuntimeError) as e:
print(e)
sys.exit(0 if isinstance(e, NoRUVsFound) else 1)
servers = get_ruv(realm, options.host, options.dirman_passwd,
options.nolookup, ca=ca)
found = False
for (netloc, rid) in servers:
if ruv == int(rid):
found = True
hostname = netloc
break
tree_found = None
for tree, ruvs in servers.items():
for netloc, rid in ruvs:
if ruv == int(rid):
tree_found = tree
hostname = netloc
break
if tree_found:
break
if not tree_found:
if not found:
sys.exit("Replica ID %s not found" % ruv)
if tree_found == 'ca':
if ca:
print("Clean the Certificate Server Replication Update Vector for %s"
% hostname)
else:
@@ -531,7 +444,7 @@ def clean_ruv(realm, ruv, options):
if not ipautil.user_input("Continue to clean?", False):
sys.exit("Aborted")
if tree_found == 'ca':
if ca:
thisrepl = replication.get_cs_replication_manager(realm, options.host,
options.dirman_passwd)
else:
@@ -540,7 +453,6 @@ def clean_ruv(realm, ruv, options):
thisrepl.cleanallruv(ruv)
print("Cleanup task created")
def abort_clean_ruv(realm, ruv, options):
"""
Given an RID abort a CLEANALLRUV task.
@@ -550,41 +462,38 @@ def abort_clean_ruv(realm, ruv, options):
except ValueError:
sys.exit("Replica ID must be an integer: %s" % ruv)
try:
servers = get_ruv_both_suffixes(realm, options.host,
options.dirman_passwd,
options.verbose,
options.nolookup)
except (NoRUVsFound, RuntimeError) as e:
print(e)
sys.exit(0 if isinstance(e, NoRUVsFound) else 1)
servers = get_ruv(realm, options.host, options.dirman_passwd,
options.nolookup)
found = False
for (netloc, rid) in servers:
if ruv == int(rid):
found = True
hostname = netloc
break
tree_found = None
for tree, ruvs in servers.items():
for netloc, rid in ruvs:
if ruv == int(rid):
tree_found = tree
hostname = netloc
break
if tree_found:
break
if not found:
sys.exit("Replica ID %s not found" % ruv)
if not tree_found:
servers = get_ruv(realm, options.host, options.dirman_passwd,
options.nolookup)
found = False
for (netloc, rid) in servers:
if ruv == int(rid):
found = True
hostname = netloc
break
if not found:
sys.exit("Replica ID %s not found" % ruv)
print("Aborting the clean Replication Update Vector task for %s" % hostname)
print()
if tree_found == 'ca':
thisrepl = replication.get_cs_replication_manager(realm, options.host,
options.dirman_passwd)
else:
thisrepl = replication.ReplicationManager(realm, options.host,
options.dirman_passwd)
thisrepl = replication.ReplicationManager(realm, options.host,
options.dirman_passwd)
thisrepl.abortcleanallruv(ruv, options.force)
print("Cleanup task stopped")
def list_clean_ruv(realm, host, dirman_passwd, verbose, nolookup=False):
"""
List all clean RUV tasks.
@@ -632,11 +541,18 @@ def clean_dangling_ruvs(realm, host, options):
Cleans all RUVs and CS-RUVs that are left in the system from
uninstalled replicas
"""
ldap_uri = ipaldap.get_ldap_uri(host, 636, cacert=paths.IPA_CA_CRT)
conn = ipaldap.LDAPClient(ldap_uri, cacert=paths.IPA_CA_CRT)
# get the Directory Manager password
if not options.dirman_passwd:
options.dirman_passwd = installutils.read_password('Directory Manager',
confirm=False,
validate=False,
retry=False)
if options.dirman_passwd is None:
sys.exit('Directory Manager password is required')
conn = ipaldap.IPAdmin(host, 636, cacert=CACERT)
try:
conn.simple_bind(bind_dn=ipaldap.DIRMAN_DN,
bind_password=options.dirman_passwd)
conn.do_simple_bind(bindpw=options.dirman_passwd)
# get all masters
masters_dn = DN(api.env.container_masters, api.env.basedn)
@@ -680,55 +596,41 @@ def clean_dangling_ruvs(realm, host, options):
offlines = set()
for master_cn, master_info in info.items():
try:
ldap_uri = ipaldap.get_ldap_uri(master_cn, 636, cacert=paths.IPA_CA_CRT)
conn = ipaldap.LDAPClient(ldap_uri, cacert=paths.IPA_CA_CRT)
conn.simple_bind(bind_dn=ipaldap.DIRMAN_DN,
bind_password=options.dirman_passwd)
conn = ipaldap.IPAdmin(master_cn, 636, cacert=CACERT)
conn.do_simple_bind(bindpw=options.dirman_passwd)
master_info['online'] = True
except Exception:
except:
print("The server '{host}' appears to be offline."
.format(host=master_cn))
offlines.add(master_cn)
continue
try:
try:
entry = conn.get_entry(replica_dn)
ruv = (master_cn, entry.single_value.get('nsDS5ReplicaID'))
# the check whether ruv is already in ruvs is performed
# by the set type
ruvs.add(ruv)
except errors.NotFound:
pass
entry = conn.get_entry(replica_dn)
ruv = (master_cn, entry.single_value.get('nsDS5ReplicaID'))
# the check whether ruv is already in ruvs is performed by set type
ruvs.add(ruv)
if(master_info['ca']):
entry = conn.get_entry(csreplica_dn)
csruv = (master_cn, entry.single_value.get('nsDS5ReplicaID'))
csruvs.add(csruv)
# get_ruv returns server names with :port which needs to be split off
ruv_list = get_ruv(realm, master_cn, options.dirman_passwd,
options.nolookup)
master_info['ruvs'] = set([
(re.sub(':\d+', '', x), y)
for (x, y) in ruv_list
])
if master_info['ca']:
try:
entry = conn.get_entry(csreplica_dn)
csruv = (master_cn,
entry.single_value.get('nsDS5ReplicaID'))
csruvs.add(csruv)
except errors.NotFound:
pass
try:
ruv_dict = get_ruv_both_suffixes(realm, master_cn,
options.dirman_passwd,
options.verbose,
options.nolookup)
except (RuntimeError, NoRUVsFound):
continue
# get_ruv_both_suffixes returns server names with :port
# This needs needs to be split off
if ruv_dict.get('domain'):
master_info['ruvs'] = {
ruv_list = get_ruv(realm, master_cn, options.dirman_passwd,
options.nolookup, ca=True)
master_info['csruvs'] = set([
(re.sub(':\d+', '', x), y)
for (x, y) in ruv_dict['domain']
}
if ruv_dict.get('ca'):
master_info['csruvs'] = {
(re.sub(':\d+', '', x), y)
for (x, y) in ruv_dict['ca']
}
for (x, y) in ruv_list
])
except Exception as e:
sys.exit("Failed to obtain information from '{host}': {error}"
.format(host=master_cn, error=str(e)))
@@ -769,6 +671,10 @@ def clean_dangling_ruvs(realm, host, options):
print('\t\tid: {id}, hostname: {host}'
.format(id=csruv[1], host=csruv[0]))
# TODO: this can be removed when #5396 is fixed
if offlines:
sys.exit("ERROR: All replicas need to be online to proceed.")
if not options.force and not ipautil.user_input("Proceed with cleaning?", False):
sys.exit("Aborted")
@@ -783,7 +689,7 @@ def clean_dangling_ruvs(realm, host, options):
for csruv in master_info['clean_csruv']:
if csruv[1] not in cleaned:
cleaned.add(csruv[1])
clean_ruv(realm, csruv[1], options)
clean_ruv(realm, csruv[1], options, ca=True)
def check_last_link(delrepl, realm, dirman_passwd, force):
@@ -838,14 +744,10 @@ def check_last_link(delrepl, realm, dirman_passwd, force):
def enforce_host_existence(host, message=None):
if host is None:
return
try:
verify_host_resolvable(host)
except errors.DNSNotARecordError as ex:
if host is not None and not ipautil.host_exists(host):
if message is None:
message = "Unknown host %s: %s" % (host, ex)
message = "Unknown host %s" % host
sys.exit(message)
def ensure_last_services(conn, hostname, masters, options):
@@ -895,7 +797,7 @@ def ensure_last_services(conn, hostname, masters, options):
print("Please disable or replace DNSSEC key master first.")
sys.exit("Deletion aborted")
ca = cainstance.CAInstance(api.env.realm)
ca = cainstance.CAInstance(api.env.realm, certs.NSS_DIR)
if ca.is_renewal_master(hostname):
try:
ca.set_renewal_master(options.host)
@@ -907,9 +809,15 @@ def ensure_last_services(conn, hostname, masters, options):
def cleanup_server_dns_entries(realm, hostname, suffix, options):
try:
if bindinstance.dns_container_exists(suffix):
bindinstance.remove_master_dns_records(hostname, realm)
dnskeysyncinstance.remove_replica_public_keys(hostname)
if bindinstance.dns_container_exists(options.host, suffix,
dm_password=options.dirman_passwd):
bind = bindinstance.BindInstance()
bind.remove_master_dns_records(hostname, realm, realm.lower())
bind.remove_ipa_ca_dns_records(hostname, realm.lower())
bind.remove_server_ns_records(hostname)
keysyncd = dnskeysyncinstance.DNSKeySyncInstance()
keysyncd.remove_replica_public_keys(hostname)
except Exception as e:
print("Failed to cleanup %s DNS entries: %s" % (hostname, e))
print("You may need to manually remove them from the tree")
@@ -932,17 +840,144 @@ def del_master_managed(realm, hostname, options):
print("Can't remove itself: %s" % (options.host))
sys.exit(1)
server_del_options = dict(
force=options.cleanup,
ignore_topology_disconnect=options.force,
ignore_last_of_role=options.force
)
try:
replication.run_server_del_as_cli(
api, hostname_u, **server_del_options)
api.Command.server_show(hostname_u)
except errors.NotFound:
if not options.cleanup:
print("{hostname} is not listed among IPA masters.".format(
hostname=hostname))
print("Please specify an actual server or add the --cleanup "
"option to force clean up.")
sys.exit(1)
# 1. Connect to the local server
try:
thisrepl = replication.ReplicationManager(realm, options.host,
options.dirman_passwd)
except Exception as e:
sys.exit(e)
print("Failed to connect to server %s: %s" % (options.host, e))
sys.exit(1)
# 2. Get all masters
masters = api.Command.server_find('', sizelimit=0)['result']
# 3. Check topology connectivity in all suffixes
topo_errors = replication.check_last_link_managed(api, hostname, masters)
any_topo_error = any(topo_errors[t][0] or topo_errors[t][1]
for t in topo_errors)
if any_topo_error:
if not options.force:
sys.exit("Aborted")
else:
print("Forcing removal of %s" % hostname)
# 4. Check that we are not leaving the installation without CA and/or DNS
# And pick new CA master.
ensure_last_services(api.Backend.ldap2, hostname, masters, options)
# Save the RID value before we start deleting
rid = get_rid_by_host(realm, options.host, hostname,
options.dirman_passwd, options.nolookup)
# 5. Remove master entry. Topology plugin will remove replication agreements.
try:
api.Command.server_del(hostname_u)
except errors.NotFound:
print("Server entry already deleted: %s" % (hostname))
# 6. Cleanup
try:
thisrepl.replica_cleanup(hostname, realm, force=True)
except Exception as e:
print("Failed to cleanup %s entries: %s" % (hostname, e))
print("You may need to manually remove them from the tree")
# 7. Clean RUV for the deleted master
# Wait for topology plugin to delete segments
check_deleted_segments(hostname_u, masters, topo_errors, options.host)
# Clean RUV is handled by the topolgy plugin
# 8. And clean up the removed replica DNS entries if any.
cleanup_server_dns_entries(realm, hostname, thisrepl.suffix, options)
def check_deleted_segments(hostname, masters, topo_errors, starting_host):
def wait_for_segment_removal(hostname, master_cns, suffix_name,
topo_errors):
i = 0
while True:
left = api.Command.topologysegment_find(
suffix_name, iparepltoposegmentleftnode=hostname, sizelimit=0
)['result']
right = api.Command.topologysegment_find(
suffix_name, iparepltoposegmentrightnode=hostname, sizelimit=0
)['result']
# Relax check if topology was or is disconnected. Disconnected
# topology can contain segments with already deleted servers.
# Check only if segments of servers, which can contact this server,
# and the deleted server were removed.
# This code should handle a case where there was a topology with
# a central node(B): A <-> B <-> C, where A is current server.
# After removal of B, topology will be disconnected and removal of
# segment B <-> C won't be replicated back to server A, therefore
# presence of the segment has to be ignored.
if topo_errors[0] or topo_errors[1]:
# use errors after deletion because we don't care if some
# server can't contact the deleted one
cant_contact_me = [e[0] for e in topo_errors[1]
if starting_host in e[2]]
can_contact_me = set(master_cns) - set(cant_contact_me)
left = [s for s in left if s['iparepltoposegmentrightnode'][0]
in can_contact_me]
right = [s for s in right if s['iparepltoposegmentleftnode'][0]
in can_contact_me]
if not left and not right:
print("Agreements deleted")
return
time.sleep(2)
if i == 2: # taking too long, something is wrong, report
print("Waiting for removal of replication agreements")
if i > 90:
print("Taking too long, skipping")
print("Following segments were not deleted:")
for s in left:
print(" %s" % s['cn'][0])
for s in right:
print(" %s" % s['cn'][0])
return
i += 1
if not replication.check_hostname_in_masters(hostname, masters):
print("{0} not in masters, skipping agreement deletion check".format(
hostname))
return
suffixes = api.Command.topologysuffix_find('', sizelimit=0)['result']
suffix_to_masters = replication.map_masters_to_suffixes(masters, suffixes)
for suffix in suffixes:
suffix_name = suffix['cn'][0]
suffix_member_cns = [
m['cn'][0] for m in suffix_to_masters[suffix_name]
]
if hostname not in suffix_member_cns:
# If the server was already deleted, we can expect that all
# removals had been done in previous run and dangling segments
# were not deleted.
print("Skipping replication agreement deletion check for "
"suffix '{0}'".format(suffix_name))
continue
print("Checking for deleted segments in suffix '{0}'".format(
suffix_name))
wait_for_segment_removal(hostname, suffix_member_cns, suffix_name,
topo_errors[suffix_name])
def del_master_direct(realm, hostname, options):
@@ -1030,8 +1065,7 @@ def del_master_direct(realm, hostname, options):
# Check for orphans if the remote server is up.
if delrepl and not winsync:
try:
masters = api.Command.server_find(
'', sizelimit=0, no_members=False)['result']
masters = api.Command.server_find('', sizelimit=0)['result']
except Exception as e:
masters = []
print("Failed to read masters data from '%s': %s" % (
@@ -1096,11 +1130,10 @@ def add_link(realm, replica1, replica2, dirman_passwd, options):
if options.winsync:
if not options.binddn or not options.bindpw or not options.cacert or not options.passsync:
logger.error("The arguments --binddn, --bindpw, --passsync and "
"--cacert are required to create a winsync agreement")
root_logger.error("The arguments --binddn, --bindpw, --passsync and --cacert are required to create a winsync agreement")
sys.exit(1)
if os.getegid() != 0:
logger.error("winsync agreements need to be created as root")
root_logger.error("winsync agreements need to be created as root")
sys.exit(1)
elif has_managed_topology(api):
exit_on_managed_topology("Creation of IPA replication agreement")
@@ -1127,7 +1160,8 @@ def add_link(realm, replica1, replica2, dirman_passwd, options):
if options.cacert:
# have to install the given CA cert before doing anything else
ds = dsinstance.DsInstance(realm_name=realm)
ds = dsinstance.DsInstance(realm_name = realm,
dm_password = dirman_passwd)
if not ds.add_ca_cert(options.cacert):
print("Could not load the required CA certificate file [%s]" % options.cacert)
return
@@ -1206,11 +1240,8 @@ def re_initialize(realm, thishost, fromhost, dirman_passwd, nolookup=False):
repl = replication.ReplicationManager(realm, fromhost, dirman_passwd)
agreement = repl.get_replication_agreement(thishost)
try:
thisrepl.enable_agreement(fromhost)
repl.enable_agreement(thishost)
except errors.NotFound as e:
sys.exit(e)
thisrepl.enable_agreement(fromhost)
repl.enable_agreement(thishost)
repl.force_sync(repl.conn, thishost)
@@ -1220,7 +1251,7 @@ def re_initialize(realm, thishost, fromhost, dirman_passwd, nolookup=False):
# If the agreement doesn't have nsDS5ReplicatedAttributeListTotal it means
# we did not replicate memberOf, do so now.
if not agreement.single_value.get('nsDS5ReplicatedAttributeListTotal'):
ds = dsinstance.DsInstance(realm_name=realm)
ds = dsinstance.DsInstance(realm_name = realm, dm_password = dirman_passwd)
ds.ldapi = os.getegid() == 0
ds.init_memberof()
@@ -1240,14 +1271,8 @@ def force_sync(realm, thishost, fromhost, dirman_passwd, nolookup=False):
repl = replication.ReplicationManager(realm, thishost, dirman_passwd)
repl.force_sync(repl.conn, fromhost)
else:
ds = dsinstance.DsInstance(realm_name=realm)
ds.ldapi = os.getegid() == 0
ds.replica_manage_time_skew(prevent=False)
repl = replication.ReplicationManager(realm, fromhost, dirman_passwd)
repl.force_sync(repl.conn, thishost)
agreement = repl.get_replication_agreement(thishost)
repl.wait_for_repl_init(repl.conn, agreement.dn)
ds.replica_manage_time_skew(prevent=True)
def show_DNA_ranges(hostname, master, realm, dirman_passwd, nextrange=False,
nolookup=False):
@@ -1343,7 +1368,7 @@ def store_DNA_range(repl, range_start, range_max, deleted_master, realm,
except Exception as e:
print("Connection failed: %s" % e)
continue
next_start, _next_max = repl2.get_DNA_next_range(candidate)
(next_start, next_max) = repl2.get_DNA_next_range(candidate)
if next_start is None:
try:
return repl2.save_DNA_next_range(range_start, range_max)
@@ -1379,7 +1404,7 @@ def set_DNA_range(hostname, range, realm, dirman_passwd, next_range=False,
"""
try:
(dna_next, dna_max) = range.split('-', 1)
except ValueError:
except ValueError as e:
return "Invalid range, must be the form x-y"
try:
@@ -1458,7 +1483,7 @@ def set_DNA_range(hostname, range, realm, dirman_passwd, next_range=False,
entries = repl.conn.get_entries(dn, repl.conn.SCOPE_ONELEVEL,
"(objectclass=ipaDomainIDRange)")
except errors.NotFound as e:
sys.exit('Unable to load IPA ranges: {err}'.format(err=e))
sys.exit('Unable to load IPA ranges: %s' % e.message)
for ent in entries:
entry_start = int(ent.single_value['ipabaseid'])
@@ -1508,16 +1533,24 @@ def exit_on_managed_topology(what):
"Please use `ipa topologysegment-*` commands to manage "
"the topology.".format(what))
def main(options, args):
def main():
if os.getegid() == 0:
installutils.check_server_configuration()
elif not os.path.exists(paths.IPA_DEFAULT_CONF):
sys.exit("IPA is not configured on this system.")
api.bootstrap(
context='cli', confdir=paths.ETC_IPA,
in_server=True, verbose=options.verbose, debug=options.debug
)
options, args = parse_options()
# Just initialize the environment. This is so the installer can have
# access to the plugin environment
api_env = {'in_server' : True,
'verbose' : options.verbose,
}
if os.getegid() != 0:
api_env['log'] = None # turn off logging for non-root
api.bootstrap(**api_env)
api.finalize()
dirman_passwd = None
@@ -1533,18 +1566,20 @@ def main(options, args):
if options.dirman_passwd:
dirman_passwd = options.dirman_passwd
else:
if (not test_connection(realm, host, options.nolookup) or
args[0] in dirman_passwd_req_commands):
if not test_connection(realm, host, options.nolookup):
dirman_passwd = installutils.read_password("Directory Manager",
confirm=False, validate=False, retry=False)
if dirman_passwd is None or (
not dirman_passwd and args[0] in dirman_passwd_req_commands):
if dirman_passwd is None:
sys.exit("Directory Manager password required")
options.dirman_passwd = dirman_passwd
# Initialize the LDAP connection
api.Backend.ldap2.connect(bind_pw=options.dirman_passwd)
if options.dirman_passwd:
api.Backend.ldap2.connect(bind_dn=DN(('cn', 'Directory Manager')),
bind_pw=options.dirman_passwd)
else:
api.Backend.ldap2.connect()
if args[0] == "list":
replica = None
@@ -1614,11 +1649,8 @@ def main(options, args):
set_DNA_range(args[1], args[2], realm, dirman_passwd, next_range=True,
nolookup=options.nolookup)
api.Backend.ldap2.disconnect()
try:
options, args = parse_options()
main(options, args)
main()
except KeyboardInterrupt:
sys.exit(1)
except SystemExit as e:
@@ -1629,13 +1661,5 @@ except socket.timeout:
print("Connection timed out.")
sys.exit(1)
except Exception as e:
if options.verbose:
traceback.print_exc(file=sys.stdout)
else:
print(
"Re-run {} with --verbose option to get more information".format(
sys.argv[0])
)
print("Unexpected error: %s" % str(e))
print("unexpected error: %s" % str(e))
sys.exit(1)

23
install/tools/ipa-replica-prepare Executable file
View File

@@ -0,0 +1,23 @@
#! /usr/bin/python2 -E
# Authors: Petr Viktorin <pviktori@redhat.com>
#
# Copyright (C) 2012 Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
from ipaserver.install.ipa_replica_prepare import ReplicaPrepare
ReplicaPrepare.run_cli()

2
install/tools/ipa-restore.in → install/tools/ipa-restore Normal file → Executable file
View File

@@ -1,4 +1,4 @@
@PYTHONSHEBANG@
#! /usr/bin/python2 -E
# Authors: Rob Crittenden <rcritten@redhat.com>
#
# Copyright (C) 2013 Red Hat

2
install/tools/ipa-server-certinstall.in → install/tools/ipa-server-certinstall Normal file → Executable file
View File

@@ -1,4 +1,4 @@
@PYTHONSHEBANG@
#! /usr/bin/python2 -E
# Authors: Jan Cholasta <jcholast@redhat.com>
#
# Copyright (C) 2013 Red Hat

18
install/tools/ipa-server-install.in → install/tools/ipa-server-install Normal file → Executable file
View File

@@ -1,4 +1,4 @@
@PYTHONSHEBANG@
#! /usr/bin/python2 -E
# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
# Simo Sorce <ssorce@redhat.com>
# Rob Crittenden <rcritten@redhat.com>
@@ -20,6 +20,18 @@
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
from ipaserver.install import ipa_server_install
from ipapython.install import cli
from ipaplatform.paths import paths
from ipaserver.install.server import Server
ipa_server_install.run()
ServerInstall = cli.install_tool(
Server,
command_name='ipa-server-install',
log_file_name=paths.IPASERVER_INSTALL_LOG,
debug_option=True,
uninstall_log_file_name=paths.IPASERVER_UNINSTALL_LOG,
)
ServerInstall.run_cli()

2
install/tools/ipa-server-upgrade.in → install/tools/ipa-server-upgrade
View File

@@ -1,4 +1,4 @@
@PYTHONSHEBANG@
#!/usr/bin/python2
#
# Copyright (C) 2015 FreeIPA Contributors see COPYING for license
#

26
install/tools/ipa-upgradeconfig Executable file
View File

@@ -0,0 +1,26 @@
#!/usr/bin/python2
#
# Authors:
# Rob Crittenden <rcritten@redhat.com>
#
# Copyright (C) 2009 Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
import sys
if __name__ == '__main__':
sys.exit("Please run the 'ipa-server-upgrade' command to upgrade the "
"IPA server.")

2
install/tools/ipa-winsync-migrate.in → install/tools/ipa-winsync-migrate Normal file → Executable file
View File

@@ -1,4 +1,4 @@
@PYTHONSHEBANG@
#! /usr/bin/python2 -E
# Authors: Tomas Babej <tbabej@redhat.com>
#
# Copyright (C) 2015 Red Hat

92
install/tools/ipactl.in → install/tools/ipactl Normal file → Executable file
View File

@@ -1,4 +1,4 @@
@PYTHONSHEBANG@
#!/usr/bin/python2
# Authors: Simo Sorce <ssorce@redhat.com>
#
# Copyright (C) 2008-2010 Red Hat
@@ -30,21 +30,14 @@ from ipaserver.install import service, installutils
from ipaserver.install.dsinstance import config_dirname
from ipaserver.install.installutils import is_ipa_configured, ScriptError
from ipalib import api, errors
from ipapython.ipaldap import LDAPClient
from ipapython.ipaldap import IPAdmin
from ipapython.ipautil import wait_for_open_ports, wait_for_open_socket
from ipapython.ipautil import run
from ipapython import config
from ipapython import config, dogtag
from ipaplatform.tasks import tasks
from ipapython.dn import DN
from ipaplatform import services
from ipaplatform.paths import paths
MSG_HINT_IGNORE_SERVICE_FAILURE = (
"Hint: You can use --ignore-service-failure option for forced start in "
"case that a non-critical service failed"
)
class IpactlError(ScriptError):
pass
@@ -86,7 +79,7 @@ def is_dirsrv_debugging_enabled():
fd.close()
for line in lines:
if line.lower().startswith('nsslapd-errorlog-level'):
_option, value = line.split(':')
(option, value) = line.split(':')
if int(value) > 0:
debugging = True
@@ -139,24 +132,11 @@ def version_check():
try:
installutils.check_version()
except (installutils.UpgradeMissingVersionError,
installutils.UpgradeDataOlderVersionError) as exc:
emit_err("IPA version error: %s" % exc)
installutils.UpgradeDataOlderVersionError):
emit_err("Upgrade required: please run ipa-server-upgrade command")
raise IpactlError("Aborting ipactl")
except installutils.UpgradeVersionError as e:
emit_err("IPA version error: %s" % e)
else:
return
emit_err("Automatically running upgrade, for details see {}".format(
paths.IPAUPGRADE_LOG))
emit_err("Be patient, this may take a few minutes.")
# Fork out to call ipa-server-upgrade so that logging is sane.
result = run([paths.IPA_SERVER_UPGRADE], raiseonerr=False,
capture_error=True)
if result.returncode != 0:
emit_err("Automatic upgrade failed: %s" % result.error_output)
emit_err("See the upgrade log for more details and/or run {} again".
format(paths.IPA_SERVER_UPGRADE))
raise IpactlError("Aborting ipactl")
@@ -178,14 +158,16 @@ def get_config(dirsrv):
else:
(host, port) = lurl.hostport.split(':')
wait_for_open_ports(host, [int(port)], timeout=api.env.startup_timeout)
con = LDAPClient(api.env.ldap_uri)
con.external_bind()
res = con.get_entries(
base,
con = IPAdmin(ldap_uri=api.env.ldap_uri)
con.do_external_bind()
res, truncated = con.find_entries(
filter=srcfilter,
attrs_list=attrs,
base_dn=base,
scope=con.SCOPE_SUBTREE,
time_limit=10)
if truncated:
raise errors.LimitsExceeded()
except errors.NetworkError:
# LSB status code 3: program is not running
raise IpactlError("Failed to get list of services to probe status:\n" +
@@ -249,7 +231,7 @@ def get_config_from_file():
def_svc_list.append([s[1], s[0]])
ordered_list = []
for _order, svc in sorted(def_svc_list):
for (order, svc) in sorted(def_svc_list):
if svc in svc_list:
ordered_list.append(svc)
@@ -258,7 +240,7 @@ def get_config_from_file():
def stop_services(svc_list):
for svc in svc_list:
svc_off = services.service(svc, api=api)
svc_off = services.service(svc)
try:
svc_off.stop(capture_output=False)
except Exception:
@@ -296,6 +278,7 @@ def ipa_start(options):
except Exception as e:
raise IpactlError("Failed to start Directory Service: " + str(e))
ldap_list = []
try:
svc_list = get_config(dirsrv)
except Exception as e:
@@ -317,7 +300,7 @@ def ipa_start(options):
svc_list = deduplicate(svc_list)
for svc in svc_list:
svchandle = services.service(svc, api=api)
svchandle = services.service(svc)
try:
print("Starting %s Service" % svc)
svchandle.start(capture_output=get_capture_output(svc, options.debug))
@@ -333,7 +316,6 @@ def ipa_start(options):
stop_services(svc_list)
stop_dirsrv(dirsrv)
emit_err(MSG_HINT_IGNORE_SERVICE_FAILURE)
raise IpactlError("Aborting ipactl")
def ipa_stop(options):
@@ -357,17 +339,17 @@ def ipa_stop(options):
svc_list = deduplicate(svc_list)
for svc in reversed(svc_list):
svchandle = services.service(svc, api=api)
svchandle = services.service(svc)
try:
print("Stopping %s Service" % svc)
svchandle.stop(capture_output=False)
except Exception:
except:
emit_err("Failed to stop %s Service" % svc)
try:
print("Stopping Directory Service")
dirsrv.stop(capture_output=False)
except Exception:
except:
raise IpactlError("Failed to stop Directory Service")
# remove file with list of started services
@@ -379,16 +361,7 @@ def ipa_stop(options):
def ipa_restart(options):
if not options.skip_version_check:
try:
version_check()
except Exception as e:
try:
ipa_stop(options)
except Exception:
# We don't care about errors that happened while stopping.
# We need to raise the upgrade error.
pass
raise e
version_check()
else:
print("Skipping version check")
@@ -410,7 +383,7 @@ def ipa_restart(options):
emit_err("Shutting down")
try:
dirsrv.stop(capture_output=False)
except Exception:
except:
pass
if isinstance(e, IpactlError):
# do not display any other error message
@@ -444,11 +417,11 @@ def ipa_restart(options):
# we need to definitely stop some services
old_svc_list = deduplicate(old_svc_list)
for svc in reversed(old_svc_list):
svchandle = services.service(svc, api=api)
svchandle = services.service(svc)
try:
print("Stopping %s Service" % svc)
svchandle.stop(capture_output=False)
except Exception:
except:
emit_err("Failed to stop %s Service" % svc)
try:
@@ -469,7 +442,7 @@ def ipa_restart(options):
# there are services to restart
svc_list = deduplicate(svc_list)
for svc in svc_list:
svchandle = services.service(svc, api=api)
svchandle = services.service(svc)
try:
print("Restarting %s Service" % svc)
svchandle.restart(capture_output=get_capture_output(svc, options.debug))
@@ -485,14 +458,13 @@ def ipa_restart(options):
stop_services(svc_list)
stop_dirsrv(dirsrv)
emit_err(MSG_HINT_IGNORE_SERVICE_FAILURE)
raise IpactlError("Aborting ipactl")
if len(new_svc_list) != 0:
# we still need to start some services
new_svc_list = deduplicate(new_svc_list)
for svc in new_svc_list:
svchandle = services.service(svc, api=api)
svchandle = services.service(svc)
try:
print("Starting %s Service" % svc)
svchandle.start(capture_output=get_capture_output(svc, options.debug))
@@ -508,7 +480,6 @@ def ipa_restart(options):
stop_services(svc_list)
stop_dirsrv(dirsrv)
emit_err(MSG_HINT_IGNORE_SERVICE_FAILURE)
raise IpactlError("Aborting ipactl")
def ipa_status(options):
@@ -544,13 +515,13 @@ def ipa_status(options):
svc_list = deduplicate(svc_list)
for svc in svc_list:
svchandle = services.service(svc, api=api)
svchandle = services.service(svc)
try:
if svchandle.is_running():
print("%s Service: RUNNING" % svc)
else:
print("%s Service: STOPPED" % svc)
except Exception:
except:
emit_err("Failed to get %s Service status" % svc)
def main():
@@ -558,7 +529,7 @@ def main():
# LSB status code 4: user had insufficient privilege
raise IpactlError("You must be root to run ipactl.", 4)
_safe_options, options, args = parse_options()
safe_options, options, args = parse_options()
if len(args) != 1:
# LSB status code 2: invalid or excess argument(s)
@@ -580,10 +551,7 @@ def main():
else:
raise e
api.bootstrap(in_server=True,
context='ipactl',
confdir=paths.ETC_IPA,
debug=options.debug)
api.bootstrap(context='ipactl', debug=options.debug)
api.finalize()
if '.' not in api.env.host:

15
install/tools/man/Makefile.am
View File

@@ -4,11 +4,12 @@ AUTOMAKE_OPTIONS = 1.7
NULL=
dist_man1_MANS = \
man1_MANS = \
ipa-replica-conncheck.1 \
ipa-replica-install.1 \
ipa-replica-manage.1 \
ipa-csreplica-manage.1 \
ipa-replica-prepare.1 \
ipa-server-certinstall.1 \
ipa-server-install.1 \
ipa-server-upgrade.1 \
@@ -26,9 +27,17 @@ dist_man1_MANS = \
ipa-otptoken-import.1 \
ipa-cacert-manage.1 \
ipa-winsync-migrate.1 \
ipa-pkinit-manage.1 \
$(NULL)
dist_man8_MANS = \
man8_MANS = \
ipactl.8 \
ipa-upgradeconfig.8 \
$(NULL)
install-data-hook:
@for i in $(man1_MANS) ; do gzip -f $(DESTDIR)$(man1dir)/$$i ; done
@for i in $(man8_MANS) ; do gzip -f $(DESTDIR)$(man8dir)/$$i ; done
MAINTAINERCLEANFILES = \
Makefile.in \
$(NULL)

257
install/tools/man/Makefile.in
View File

@@ -1,7 +1,7 @@
# Makefile.in generated by automake 1.16.1 from Makefile.am.
# Makefile.in generated by automake 1.15 from Makefile.am.
# @configure_input@
# Copyright (C) 1994-2018 Free Software Foundation, Inc.
# Copyright (C) 1994-2014 Free Software Foundation, Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
@@ -87,19 +87,10 @@ POST_INSTALL = :
NORMAL_UNINSTALL = :
PRE_UNINSTALL = :
POST_UNINSTALL = :
build_triplet = @build@
host_triplet = @host@
subdir = install/tools/man
subdir = tools/man
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/VERSION.m4 \
$(top_srcdir)/server.m4 $(top_srcdir)/configure.ac
am__aclocal_m4_deps = $(top_srcdir)/../version.m4 \
$(top_srcdir)/configure.ac
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
@@ -157,118 +148,41 @@ man1dir = $(mandir)/man1
am__installdirs = "$(DESTDIR)$(man1dir)" "$(DESTDIR)$(man8dir)"
man8dir = $(mandir)/man8
NROFF = nroff
MANS = $(dist_man1_MANS) $(dist_man8_MANS)
MANS = $(man1_MANS) $(man8_MANS)
am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
am__DIST_COMMON = $(dist_man1_MANS) $(dist_man8_MANS) \
$(srcdir)/Makefile.in
am__DIST_COMMON = $(srcdir)/Makefile.in
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
ACLOCAL = @ACLOCAL@
AMTAR = @AMTAR@
AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
API_VERSION = @API_VERSION@
AR = @AR@
AUTOCONF = @AUTOCONF@
AUTOHEADER = @AUTOHEADER@
AUTOMAKE = @AUTOMAKE@
AWK = @AWK@
CC = @CC@
CCDEPMODE = @CCDEPMODE@
CFLAGS = @CFLAGS@
CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
CMOCKA_LIBS = @CMOCKA_LIBS@
CONFIG_STATUS = @CONFIG_STATUS@
CPP = @CPP@
CPPFLAGS = @CPPFLAGS@
CRYPTO_CFLAGS = @CRYPTO_CFLAGS@
CRYPTO_LIBS = @CRYPTO_LIBS@
CYGPATH_W = @CYGPATH_W@
DATA_VERSION = @DATA_VERSION@
DEFS = @DEFS@
DEPDIR = @DEPDIR@
DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
DIRSRV_LIBS = @DIRSRV_LIBS@
DLLTOOL = @DLLTOOL@
DSYMUTIL = @DSYMUTIL@
DUMPBIN = @DUMPBIN@
ECHO_C = @ECHO_C@
ECHO_N = @ECHO_N@
ECHO_T = @ECHO_T@
EGREP = @EGREP@
EXEEXT = @EXEEXT@
FGREP = @FGREP@
GETTEXT_DOMAIN = @GETTEXT_DOMAIN@
GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
GIT_BRANCH = @GIT_BRANCH@
GIT_VERSION = @GIT_VERSION@
GMSGFMT = @GMSGFMT@
GMSGFMT_015 = @GMSGFMT_015@
GREP = @GREP@
INI_CFLAGS = @INI_CFLAGS@
INI_LIBS = @INI_LIBS@
INSTALL = @INSTALL@
INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
INTLLIBS = @INTLLIBS@
INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
IPAPLATFORM = @IPAPLATFORM@
IPA_DATA_DIR = @IPA_DATA_DIR@
IPA_SYSCONF_DIR = @IPA_SYSCONF_DIR@
JSLINT = @JSLINT@
KRAD_LIBS = @KRAD_LIBS@
KRB5KDC_SERVICE = @KRB5KDC_SERVICE@
KRB5_CFLAGS = @KRB5_CFLAGS@
KRB5_LIBS = @KRB5_LIBS@
LD = @LD@
LDAP_CFLAGS = @LDAP_CFLAGS@
LDAP_LIBS = @LDAP_LIBS@
LDFLAGS = @LDFLAGS@
LIBICONV = @LIBICONV@
LIBINTL = @LIBINTL@
LIBINTL_LIBS = @LIBINTL_LIBS@
LIBOBJS = @LIBOBJS@
LIBPDB_NAME = @LIBPDB_NAME@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
LIBVERTO_LIBS = @LIBVERTO_LIBS@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBICONV = @LTLIBICONV@
LTLIBINTL = @LTLIBINTL@
LTLIBOBJS = @LTLIBOBJS@
LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
MAINT = @MAINT@
MAKEINFO = @MAKEINFO@
MANIFEST_TOOL = @MANIFEST_TOOL@
MKDIR_P = @MKDIR_P@
MK_ASSIGN = @MK_ASSIGN@
MK_ELSE = @MK_ELSE@
MK_ENDIF = @MK_ENDIF@
MK_IFEQ = @MK_IFEQ@
MSGATTRIB = @MSGATTRIB@
MSGCMP = @MSGCMP@
MSGFMT = @MSGFMT@
MSGFMT_015 = @MSGFMT_015@
MSGINIT = @MSGINIT@
MSGMERGE = @MSGMERGE@
NAMED_GROUP = @NAMED_GROUP@
NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
NDRNBT_LIBS = @NDRNBT_LIBS@
NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
NDRPAC_LIBS = @NDRPAC_LIBS@
NDR_CFLAGS = @NDR_CFLAGS@
NDR_LIBS = @NDR_LIBS@
NM = @NM@
NMEDIT = @NMEDIT@
NSPR_CFLAGS = @NSPR_CFLAGS@
NSPR_LIBS = @NSPR_LIBS@
NSS_CFLAGS = @NSS_CFLAGS@
NSS_LIBS = @NSS_LIBS@
NUM_VERSION = @NUM_VERSION@
OBJDUMP = @OBJDUMP@
OBJEXT = @OBJEXT@
ODS_USER = @ODS_USER@
OTOOL = @OTOOL@
OTOOL64 = @OTOOL64@
PACKAGE = @PACKAGE@
PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
@@ -277,89 +191,33 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PKG_CONFIG = @PKG_CONFIG@
PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
PLATFORM_PYTHON = @PLATFORM_PYTHON@
POPT_CFLAGS = @POPT_CFLAGS@
POPT_LIBS = @POPT_LIBS@
POSUB = @POSUB@
PYLINT = @PYLINT@
PYTHON = @PYTHON@
PYTHON2 = @PYTHON2@
PYTHON3 = @PYTHON3@
PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
PYTHON_INSTALL_EXTRA_OPTIONS = @PYTHON_INSTALL_EXTRA_OPTIONS@
PYTHON_PLATFORM = @PYTHON_PLATFORM@
PYTHON_PREFIX = @PYTHON_PREFIX@
PYTHON_VERSION = @PYTHON_VERSION@
RANLIB = @RANLIB@
SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
SASL_CFLAGS = @SASL_CFLAGS@
SASL_LIBS = @SASL_LIBS@
SED = @SED@
SET_MAKE = @SET_MAKE@
SHELL = @SHELL@
SSSCERTMAP_CFLAGS = @SSSCERTMAP_CFLAGS@
SSSCERTMAP_LIBS = @SSSCERTMAP_LIBS@
SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
SSSNSSIDMAP_LIBS = @SSSNSSIDMAP_LIBS@
STRIP = @STRIP@
TALLOC_CFLAGS = @TALLOC_CFLAGS@
TALLOC_LIBS = @TALLOC_LIBS@
TEVENT_CFLAGS = @TEVENT_CFLAGS@
TEVENT_LIBS = @TEVENT_LIBS@
UNISTRING_LIBS = @UNISTRING_LIBS@
UNLINK = @UNLINK@
USE_NLS = @USE_NLS@
UUID_CFLAGS = @UUID_CFLAGS@
UUID_LIBS = @UUID_LIBS@
VENDOR_SUFFIX = @VENDOR_SUFFIX@
TX = @TX@
VERSION = @VERSION@
XGETTEXT = @XGETTEXT@
XGETTEXT_015 = @XGETTEXT_015@
XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
XMLRPC_CFLAGS = @XMLRPC_CFLAGS@
XMLRPC_LIBS = @XMLRPC_LIBS@
abs_builddir = @abs_builddir@
abs_srcdir = @abs_srcdir@
abs_top_builddir = @abs_top_builddir@
abs_top_srcdir = @abs_top_srcdir@
ac_ct_AR = @ac_ct_AR@
ac_ct_CC = @ac_ct_CC@
ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
am__include = @am__include@
am__leading_dot = @am__leading_dot@
am__quote = @am__quote@
am__tar = @am__tar@
am__untar = @am__untar@
bindir = @bindir@
build = @build@
build_alias = @build_alias@
build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
datadir = @datadir@
datarootdir = @datarootdir@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
host = @host@
host_alias = @host_alias@
host_cpu = @host_cpu@
host_os = @host_os@
host_vendor = @host_vendor@
htmldir = @htmldir@
i18ntests = @i18ntests@
includedir = @includedir@
infodir = @infodir@
install_sh = @install_sh@
krb5rundir = @krb5rundir@
libdir = @libdir@
libexecdir = @libexecdir@
localedir = @localedir@
@@ -368,31 +226,25 @@ mandir = @mandir@
mkdir_p = @mkdir_p@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
pkgpyexecdir = @pkgpyexecdir@
pkgpythondir = @pkgpythondir@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
pyexecdir = @pyexecdir@
pythondir = @pythondir@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
srcdir = @srcdir@
sysconfdir = @sysconfdir@
sysconfenvdir = @sysconfenvdir@
systemdsystemunitdir = @systemdsystemunitdir@
systemdtmpfilesdir = @systemdtmpfilesdir@
target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
AUTOMAKE_OPTIONS = 1.7
NULL =
dist_man1_MANS = \
man1_MANS = \
ipa-replica-conncheck.1 \
ipa-replica-install.1 \
ipa-replica-manage.1 \
ipa-csreplica-manage.1 \
ipa-replica-prepare.1 \
ipa-server-certinstall.1 \
ipa-server-install.1 \
ipa-server-upgrade.1 \
@@ -410,17 +262,21 @@ dist_man1_MANS = \
ipa-otptoken-import.1 \
ipa-cacert-manage.1 \
ipa-winsync-migrate.1 \
ipa-pkinit-manage.1 \
$(NULL)
dist_man8_MANS = \
man8_MANS = \
ipactl.8 \
ipa-upgradeconfig.8 \
$(NULL)
MAINTAINERCLEANFILES = \
Makefile.in \
$(NULL)
all: all-am
.SUFFIXES:
$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
$(srcdir)/Makefile.in: @MAINTAINER_MODE_TRUE@ $(srcdir)/Makefile.am $(am__configure_deps)
@for dep in $?; do \
case '$(am__configure_deps)' in \
*$$dep*) \
@@ -429,35 +285,29 @@ $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
exit 1;; \
esac; \
done; \
echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign install/tools/man/Makefile'; \
echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign tools/man/Makefile'; \
$(am__cd) $(top_srcdir) && \
$(AUTOMAKE) --foreign install/tools/man/Makefile
$(AUTOMAKE) --foreign tools/man/Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
*config.status*) \
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
*) \
echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles)'; \
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles);; \
echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
esac;
$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(top_srcdir)/configure: $(am__configure_deps)
$(top_srcdir)/configure: @MAINTAINER_MODE_TRUE@ $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
$(ACLOCAL_M4): @MAINTAINER_MODE_TRUE@ $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(am__aclocal_m4_deps):
mostlyclean-libtool:
-rm -f *.lo
clean-libtool:
-rm -rf .libs _libs
install-man1: $(dist_man1_MANS)
install-man1: $(man1_MANS)
@$(NORMAL_INSTALL)
@list1='$(dist_man1_MANS)'; \
@list1='$(man1_MANS)'; \
list2=''; \
test -n "$(man1dir)" \
&& test -n "`echo $$list1$$list2`" \
@@ -491,14 +341,14 @@ install-man1: $(dist_man1_MANS)
uninstall-man1:
@$(NORMAL_UNINSTALL)
@list='$(dist_man1_MANS)'; test -n "$(man1dir)" || exit 0; \
@list='$(man1_MANS)'; test -n "$(man1dir)" || exit 0; \
files=`{ for i in $$list; do echo "$$i"; done; \
} | sed -e 's,.*/,,;h;s,.*\.,,;s,^[^1][0-9a-z]*$$,1,;x' \
-e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,'`; \
dir='$(DESTDIR)$(man1dir)'; $(am__uninstall_files_from_dir)
install-man8: $(dist_man8_MANS)
install-man8: $(man8_MANS)
@$(NORMAL_INSTALL)
@list1='$(dist_man8_MANS)'; \
@list1='$(man8_MANS)'; \
list2=''; \
test -n "$(man8dir)" \
&& test -n "`echo $$list1$$list2`" \
@@ -532,7 +382,7 @@ install-man8: $(dist_man8_MANS)
uninstall-man8:
@$(NORMAL_UNINSTALL)
@list='$(dist_man8_MANS)'; test -n "$(man8dir)" || exit 0; \
@list='$(man8_MANS)'; test -n "$(man8dir)" || exit 0; \
files=`{ for i in $$list; do echo "$$i"; done; \
} | sed -e 's,.*/,,;h;s,.*\.,,;s,^[^8][0-9a-z]*$$,8,;x' \
-e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,'`; \
@@ -544,10 +394,7 @@ ctags CTAGS:
cscope cscopelist:
distdir: $(BUILT_SOURCES)
$(MAKE) $(AM_MAKEFLAGS) distdir-am
distdir-am: $(DISTFILES)
distdir: $(DISTFILES)
@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
list='$(DISTFILES)'; \
@@ -614,9 +461,10 @@ distclean-generic:
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@echo "it deletes files that may require special tools to rebuild."
-test -z "$(MAINTAINERCLEANFILES)" || rm -f $(MAINTAINERCLEANFILES)
clean: clean-am
clean-am: clean-generic clean-libtool mostlyclean-am
clean-am: clean-generic mostlyclean-am
distclean: distclean-am
-rm -f Makefile
@@ -635,7 +483,8 @@ info: info-am
info-am:
install-data-am: install-man
@$(NORMAL_INSTALL)
$(MAKE) $(AM_MAKEFLAGS) install-data-hook
install-dvi: install-dvi-am
install-dvi-am:
@@ -668,7 +517,7 @@ maintainer-clean-am: distclean-am maintainer-clean-generic
mostlyclean: mostlyclean-am
mostlyclean-am: mostlyclean-generic mostlyclean-libtool
mostlyclean-am: mostlyclean-generic
pdf: pdf-am
@@ -682,24 +531,28 @@ uninstall-am: uninstall-man
uninstall-man: uninstall-man1 uninstall-man8
.MAKE: install-am install-strip
.MAKE: install-am install-data-am install-strip
.PHONY: all all-am check check-am clean clean-generic clean-libtool \
cscopelist-am ctags-am distclean distclean-generic \
distclean-libtool distdir dvi dvi-am html html-am info info-am \
install install-am install-data install-data-am install-dvi \
install-dvi-am install-exec install-exec-am install-html \
install-html-am install-info install-info-am install-man \
install-man1 install-man8 install-pdf install-pdf-am \
install-ps install-ps-am install-strip installcheck \
installcheck-am installdirs maintainer-clean \
maintainer-clean-generic mostlyclean mostlyclean-generic \
mostlyclean-libtool pdf pdf-am ps ps-am tags-am uninstall \
uninstall-am uninstall-man uninstall-man1 uninstall-man8
.PHONY: all all-am check check-am clean clean-generic cscopelist-am \
ctags-am distclean distclean-generic distdir dvi dvi-am html \
html-am info info-am install install-am install-data \
install-data-am install-data-hook install-dvi install-dvi-am \
install-exec install-exec-am install-html install-html-am \
install-info install-info-am install-man install-man1 \
install-man8 install-pdf install-pdf-am install-ps \
install-ps-am install-strip installcheck installcheck-am \
installdirs maintainer-clean maintainer-clean-generic \
mostlyclean mostlyclean-generic pdf pdf-am ps ps-am tags-am \
uninstall uninstall-am uninstall-man uninstall-man1 \
uninstall-man8
.PRECIOUS: Makefile
install-data-hook:
@for i in $(man1_MANS) ; do gzip -f $(DESTDIR)$(man1dir)/$$i ; done
@for i in $(man8_MANS) ; do gzip -f $(DESTDIR)$(man8dir)/$$i ; done
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:

49
install/tools/man/ipa-adtrust-install.1
View File

@@ -16,7 +16,7 @@
.\"
.\" Author: Sumit Bose <sbose@redhat.com>
.\"
.TH "ipa-adtrust-install" "1" "April 11 2017" "FreeIPA" "FreeIPA Manual Pages"
.TH "ipa-adtrust-install" "1" "Aug 23 2011" "FreeIPA" "FreeIPA Manual Pages"
.SH "NAME"
ipa\-adtrust\-install \- Prepare an IPA server to be able to establish trust relationships with AD domains
.SH "SYNOPSIS"
@@ -26,11 +26,11 @@ Adds all necessary objects and configuration to allow an IPA server to create a
trust to an Active Directory domain. This requires that the IPA server is
already installed and configured.
Please note you will not be able to establish a trust to an Active Directory
Please note you will not be able to estabilish an trust to an Active Directory
domain unless the realm name of the IPA server matches its domain name.
ipa\-adtrust\-install can be run multiple times to reinstall deleted objects or
broken configuration files. E.g. a fresh samba configuration (smb.conf) file and
broken configuration files. E.g. a fresh samba configuration (smb.conf file and
registry based configuration can be created. Other items like e.g. the
configuration of the local range cannot be changed by running
ipa\-adtrust\-install a second time because with changes here other objects
@@ -52,8 +52,6 @@ the following ports to be open to allow IPA and Active Directory to communicate
.IP
\(bu 1024/tcp through 1300/tcp to allow EPMAP on port 135/tcp to create a TCP listener based
on an incoming request.
.IP
\(bu 3268/tcp Microsoft-GC
.TP
\fBUDP Ports\fR
.IP
@@ -66,7 +64,7 @@ on an incoming request.
.SH "OPTIONS"
.TP
\fB\-d\fR, \fB\-\-debug\fR
Enable debug logging when more verbose output is needed.
Enable debug logging when more verbose output is needed
.TP
\fB\-\-netbios\-name\fR=\fINETBIOS_NAME\fR
The NetBIOS name for the IPA domain. If not provided then this is determined
@@ -75,8 +73,35 @@ ipa\-adtrust\-install for a second time with a different NetBIOS name will
change the name. Please note that changing the NetBIOS name might break
existing trust relationships to other domains.
.TP
\fB\-\-no\-msdcs\fR
Do not create DNS service records for Windows in managed DNS server. Since those
DNS service records are the only way to discover domain controllers of other
domains they must be added manually to a different DNS server to allow trust
realationships work properly. All needed service records are listed when
ipa\-adtrust\-install finishes and either \-\-no\-msdcs was given or no IPA DNS
service is configured. Typically service records for the following service names
are needed for the IPA domain which should point to all IPA servers:
.IP
\(bu _ldap._tcp
.IP
\(bu _kerberos._tcp
.IP
\(bu _kerberos._udp
.IP
\(bu _ldap._tcp.dc._msdcs
.IP
\(bu _kerberos._tcp.dc._msdcs
.IP
\(bu _kerberos._udp.dc._msdcs
.IP
\(bu _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs
.IP
\(bu _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs
.IP
\(bu _kerberos._udp.Default-First-Site-Name._sites.dc._msdcs
.TP
\fB\-\-add\-sids\fR
Add SIDs to existing users and groups as one of the final steps of the
Add SIDs to existing users and groups as on of final steps of the
ipa\-adtrust\-install run. If there a many existing users and groups and a
couple of replicas in the environment this operation might lead to a high
replication traffic and a performance degradation of all IPA servers in the
@@ -99,16 +124,16 @@ via \ipa-adtrust\-install run on any other IPA master. At least SSSD
version 1.13 on IPA master is required to be able to perform as a trust agent.
.TP
\fB\-U\fR, \fB\-\-unattended\fR
An unattended installation that will never prompt for user input.
An unattended installation that will never prompt for user input
.TP
\fB\-\-rid-base\fR=\fIRID_BASE\fR
First RID value of the local domain. The first POSIX ID of the local domain will
\fB\-U\fR, \fB\-\-rid-base\fR=\fIRID_BASE\fR
First RID value of the local domain. The first Posix ID of the local domain will
be assigned to this RID, the second to RID+1 etc. See the online help of the
idrange CLI for details.
.TP
\fB\-\-secondary-rid-base\fR=\fISECONDARY_RID_BASE\fR
\fB\-U\fR, \fB\-\-secondary-rid-base\fR=\fISECONDARY_RID_BASE\fR
Start value of the secondary RID range, which is only used in the case a user
and a group share numerically the same POSIX ID. See the online help of the
and a group share numerically the same Posix ID. See the online help of the
idrange CLI for details.
.TP
\fB\-A\fR, \fB\-\-admin\-name\fR=\fIADMIN_NAME\fR

14
install/tools/man/ipa-backup.1
View File

@@ -43,7 +43,10 @@ A backup can not be restored in a different version of IPA.
Back up data only. The default is to back up all IPA files plus data.
.TP
\fB\-\-gpg\fR
Encrypt the back up file. Set \fBGNUPGHOME\fR environment variable to use a custom keyring and gpg2 configuration.
Encrypt the back up file.
.TP
\fB\-\-gpg\-keyring\fR=\fIGPG_KEYRING\fR
The full path to a GPG keyring. The keyring consists of two files, a public and a private key (.sec and .pub respectively). Specify the path without an extension.
.TP
\fB\-\-logs\fR
Include the IPA service log files in the backup.
@@ -66,12 +69,6 @@ Log to the given file
0 if the command was successful
1 if an error occurred
2 if IPA is not configured
.SH "ENVIRONMENT VARIABLES"
.PP
\fBGNUPGHOME\fR
Use custom GnuPG keyring and settings (default: \fB~/.gnupg\fR).
.SH "FILES"
.PP
\fI/var/lib/ipa/backup\fR
@@ -84,5 +81,4 @@ The default directory for storing backup files.
The log file for backups
.PP
.SH "SEE ALSO"
.BR ipa\-restore(1)
.BR gpg2(1)
ipa\-restore(1).

39
install/tools/man/ipa-ca-install.1
View File

@@ -1,5 +1,5 @@
.\" A man page for ipa-ca-install
.\" Copyright (C) 2011-2017 Red Hat, Inc.
.\" Copyright (C) 2011 Red Hat, Inc.
.\"
.\" This program is free software; you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
@@ -16,19 +16,17 @@
.\"
.\" Author: Rob Crittenden <rcritten@redhat.com>
.\"
.TH "ipa-ca-install" "1" "Mar 30 2017" "FreeIPA" "FreeIPA Manual Pages"
.TH "ipa-ca-install" "1" "Jun 17 2011" "FreeIPA" "FreeIPA Manual Pages"
.SH "NAME"
ipa\-ca\-install \- Install a CA on a server
.SH "SYNOPSIS"
.TP
ipa\-ca\-install [\fIOPTION\fR]...
ipa\-ca\-install [\fIOPTION\fR]... [replica_file]
.SH "DESCRIPTION"
Adds a CA as an IPA\-managed service. This requires that the IPA server is already installed and configured.
ipa\-ca\-install can be used to upgrade from CA-less to CA-full or to install the CA service on a replica.
Domain level 0 is not supported anymore.
The replica_file is created using the ipa\-replica\-prepare utility and should be the same one used when originally installing the replica.
Alternatively, you can run ipa\-ca\-install without replica_file to upgrade from CA-less to CA-full.
.SH "OPTIONS"
\fB\-d\fR, \fB\-\-debug\fR
Enable debug logging when more verbose output is needed
@@ -43,36 +41,11 @@ Admin user Kerberos password used for connection check
Generate a CSR for the IPA CA certificate to be signed by an external CA.
.TP
\fB\-\-external\-ca\-type\fR=\fITYPE\fR
Type of the external CA. Possible values are "generic", "ms-cs". Default value is "generic". Use "ms-cs" to include the template name required by Microsoft Certificate Services (MS CS) in the generated CSR (see \fB\-\-external\-ca\-profile\fR for full details).
.TP
\fB\-\-external\-ca\-profile\fR=\fIPROFILE_SPEC\fR
Specify the certificate profile or template to use at the external CA.
When \fB\-\-external\-ca\-type\fR is "ms-cs" the following specifiers may be used:
.RS
.TP
\fB<oid>:<majorVersion>[:<minorVersion>]\fR
Specify a certificate template by OID and major version, optionally also specifying minor version.
.TP
\fB<name>\fR
Specify a certificate template by name. The name cannot contain any \fI:\fR characters and cannot be an OID (otherwise the OID-based template specifier syntax takes precedence).
.TP
\fBdefault\fR
If no template is specified, the template name "SubCA" is used.
.RE
Type of the external CA. Possible values are "generic", "ms-cs". Default value is "generic". Use "ms-cs" to include template name required by Microsoft Certificate Services (MS CS) in the generated CSR.
.TP
\fB\-\-external\-cert\-file\fR=\fIFILE\fR
File containing the IPA CA certificate and the external CA certificate chain. The file is accepted in PEM and DER certificate and PKCS#7 certificate chain formats. This option may be used multiple times.
.TP
\fB\-\-ca\-subject\fR=\fISUBJECT\fR
The CA certificate subject DN (default CN=Certificate Authority,O=REALM.NAME). RDNs are in LDAP order (most specific RDN first).
.TP
\fB\-\-subject\-base\fR=\fISUBJECT\fR
The subject base for certificates issued by IPA (default O=REALM.NAME). RDNs are in LDAP order (most specific RDN first).
.TP
\fB\-\-ca\-signing\-algorithm\fR=\fIALGORITHM\fR
Signing algorithm of the IPA CA certificate. Possible values are SHA1withRSA, SHA256withRSA, SHA512withRSA. Default value is SHA256withRSA. Use this option with --external-ca if the external CA does not support the default signing algorithm.
.TP

83
install/tools/man/ipa-cacert-manage.1
View File

@@ -20,11 +20,7 @@
.SH "NAME"
ipa\-cacert\-manage \- Manage CA certificates in IPA
.SH "SYNOPSIS"
\fBipa\-cacert\-manage\fR [\fIOPTIONS\fR...] renew
.RE
\fBipa\-cacert\-manage\fR [\fIOPTIONS\fR...] install \fICERTFILE\fR...
.RE
\fBipa\-cacert\-manage\fR [\fIOPTIONS\fR...] list
\fBipa\-cacert\-manage\fR [\fIOPTIONS\fR...] \fICOMMAND\fR
.SH "DESCRIPTION"
\fBipa\-cacert\-manage\fR can be used to manage CA certificates in IPA.
.SH "COMMANDS"
@@ -33,7 +29,7 @@ ipa\-cacert\-manage \- Manage CA certificates in IPA
\- Renew the IPA CA certificate
.sp
.RS
This command can be used to manually renew the CA certificate of the IPA CA (NSS database nickname: "caSigningCert cert-pki-ca"). To renew other certificates, use getcert-resubmit(1).
This command can be used to manually renew CA certificate of the IPA CA.
.sp
When the IPA CA is the root CA (the default), it is not usually necessary to manually renew the CA certificate, as it will be renewed automatically when it is about to expire, but you can do so if you wish.
.sp
@@ -43,83 +39,30 @@ When the IPA CA is not configured, this command is not available.
.RE
.TP
\fBinstall\fR
\- Install one or more CA certificates
\- Install a CA certificate
.sp
.RS
This command can be used to install the certificates contained in \fICERTFILE\fR as additional CA certificates to IPA.
.sp
Important: this does not replace IPA CA but adds the provided certificate as a known CA. This is useful for instance when using ipa-server-certinstall to replace HTTP/LDAP certificates with third-party certificates signed by this additional CA.
.sp
Please do not forget to run ipa-certupdate on the master, all the replicas and all the clients after this command in order to update IPA certificates databases.
.sp
The supported formats for the certificate files are DER, PEM and PKCS#7 format.
This command can be used to install new CA certificate to IPA.
.RE
\fBlist\fR
\- List the stored CA certificates
.sp
.RS
Display a list of the nicknames or subjects of the CA certificates that have been installed.
.RE
.SH "COMMON OPTIONS"
.TP
\fB\-\-version\fR
Show the program's version and exit.
.TP
\fB\-h\fR, \fB\-\-help\fR
Show the help for this program.
.SH "OPTIONS"
.TP
\fB\-p\fR \fIDM_PASSWORD\fR, \fB\-\-password\fR=\fIDM_PASSWORD\fR
The Directory Manager password to use for authentication.
.TP
\fB\-v\fR, \fB\-\-verbose\fR
Print debugging information.
.TP
\fB\-q\fR, \fB\-\-quiet\fR
Output only errors.
.TP
\fB\-\-log\-file\fR=\fIFILE\fR
Log to the given file.
.RE
.SH "RENEW OPTIONS"
.TP
\fB\-\-self\-signed\fR
Sign the renewed certificate by itself.
.TP
\fB\-\-external\-ca\fR
Sign the renewed certificate by external CA.
.TP
\fB\-\-external\-ca\-type\fR=\fITYPE\fR
Type of the external CA. Possible values are "generic", "ms-cs". Default value is "generic". Use "ms-cs" to include the template name required by Microsoft Certificate Services (MS CS) in the generated CSR (see \fB\-\-external\-ca\-profile\fR for full details).
.TP
\fB\-\-external\-ca\-profile\fR=\fIPROFILE_SPEC\fR
Specify the certificate profile or template to use at the external CA.
When \fB\-\-external\-ca\-type\fR is "ms-cs" the following specifiers may be used:
.RS
.TP
\fB<oid>:<majorVersion>[:<minorVersion>]\fR
Specify a certificate template by OID and major version, optionally also specifying minor version.
.TP
\fB<name>\fR
Specify a certificate template by name. The name cannot contain any \fI:\fR characters and cannot be an OID (otherwise the OID-based template specifier syntax takes precedence).
.TP
\fBdefault\fR
If no template is specified, the template name "SubCA" is used.
.RE
.TP
\fB\-\-external\-cert\-file\fR=\fIFILE\fR
File containing the IPA CA certificate and the external CA certificate chain. The file is accepted in PEM and DER certificate and PKCS#7 certificate chain formats. This option may be used multiple times.
.RE
.SH "INSTALL OPTIONS"
.TP
\fB\-n\fR \fINICKNAME\fR, \fB\-\-nickname\fR=\fINICKNAME\fR
Nickname for the certificate. Applicable only when a single certificate is being installed.
Nickname for the certificate.
.TP
\fB\-t\fR \fITRUST_FLAGS\fR, \fB\-\-trust\-flags\fR=\fITRUST_FLAGS\fR
Trust flags for the certificate in certutil format. Trust flags are of the form "A,B,C" or "A,B,C,D" where A is for SSL, B is for S/MIME, C is for code signing, and D is for PKINIT. Use ",," for no explicit trust.
Trust flags for the certificate in certutil format. Trust flags are of the form "X,Y,Z" where X is for SSL, Y is for S/MIME, and Z is for code signing. Use ",," for no explicit trust.
.sp
The supported trust flags are:
.RS
@@ -130,10 +73,16 @@ T \- CA trusted to issue client certificates
.IP
p \- not trusted
.RE
.TP
\fB\-v\fR, \fB\-\-verbose\fR
Print debugging information.
.TP
\fB\-q\fR, \fB\-\-quiet\fR
Output only errors.
.TP
\fB\-\-log\-file\fR=\fIFILE\fR
Log to the given file.
.SH "EXIT STATUS"
0 if the command was successful
1 if an error occurred
.SH "SEE ALSO"
.BR getcert-resubmit(1)

35
install/tools/man/ipa-dns-install.1
View File

@@ -1,5 +1,20 @@
.\" A man page for ipa-dns-install
.\" Copyright (C) 2010-2016 FreeIPA Contributors see COPYING for license
.\" Copyright (C) 2010 Red Hat, Inc.
.\"
.\" This program is free software; you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation, either version 3 of the License, or
.\" (at your option) any later version.
.\"
.\" This program is distributed in the hope that it will be useful, but
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
.\" General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
.\"
.\" Author: Rob Crittenden <rcritten@redhat.com>
.\"
.TH "ipa-dns-install" "1" "Jun 28, 2012" "FreeIPA" "FreeIPA Manual Pages"
.SH "NAME"
@@ -7,15 +22,7 @@ ipa\-dns\-install \- Add DNS as a service to an IPA server
.SH "SYNOPSIS"
ipa\-dns\-install [\fIOPTION\fR]...
.SH "DESCRIPTION"
Configure an integrated DNS server on this IPA server, create DNS zone with the name of the IPA primary DNS domain, and fill it in with service records necessary for IPA deployment.
In cases where the IPA server name does not belong to the primary DNS domain and is not resolvable using DNS, create a DNS zone containing the IPA server name as well.
IPA provides an integrated DNS server which can be used to simplify IPA deployment. If you decide to use it, IPA will automatically maintain SRV and other service records when you change your topology.
The DNS component in FreeIPA is optional and you may choose to manage all your DNS records manually on another third party DNS server. IPA DNS is not a general-purpose DNS server. If you need advanced features like DNS views, do not deploy IPA DNS.
This command requires that an IPA server is already installed and configured.
Adds DNS as an IPA\-managed service. This requires that the IPA server is already installed and configured.
.SH "OPTIONS"
.TP
\fB\-d\fR, \fB\-\-debug\fR
@@ -23,7 +30,7 @@ Enable debug logging when more verbose output is needed
.TP
\fB\-\-ip\-address\fR=\fIIP_ADDRESS\fR
The IP address of the IPA server. If not provided then this is determined based on the hostname of the server.
This option can be used multiple times to specify more IP addresses of the server (e.g. multihomed and/or dualstacked server).
This this option can be used multiple times to specify more IP addresses of the server (e.g. multihomed and/or dualstacked server).
.TP
\fB\-\-forwarder\fR=\fIFORWARDER\fR
A forwarder is a DNS server where queries for a specific non\-resolvable address can be directed. To define multiple forwarders use multiple instances of \fB\-\-forwarder\fR
@@ -34,12 +41,6 @@ Do not add any DNS forwarders, send non\-resolvable addresses to the DNS root se
\fB\-\-auto\-forwarders\fR
Add DNS forwarders configured in /etc/resolv.conf to the list of forwarders used by IPA DNS.
.TP
\fB\-\-forward\-policy\fR=\fIfirst|only\fR
DNS forwarding policy for global forwarders specified using other options.
Defaults to first if no IP address belonging to a private or reserved ranges is
detected on local interfaces (RFC 6303). Defaults to only if a private
IP address is detected.
.TP
\fB\-\-reverse\-zone\fR=\fIREVERSE_ZONE\fR
The reverse DNS zone to use. This option can be used multiple times to specify multiple reverse zones.
.TP

21
install/tools/man/ipa-kra-install.1
View File

@@ -16,40 +16,39 @@
.\"
.\" Author: Ade Lee <alee@redhat.com>
.\"
.TH "ipa-kra-install" "1" "May 10 2017" "FreeIPA" "FreeIPA Manual Pages"
.TH "ipa-kra-install" "1" "Aug 24 2014" "FreeIPA" "FreeIPA Manual Pages"
.SH "NAME"
ipa\-kra\-install \- Install a KRA on a server
.SH "SYNOPSIS"
.TP
ipa\-kra\-install [\fIOPTION\fR]...
ipa\-kra\-install [\fIOPTION\fR]... [replica_file]
.SH "DESCRIPTION"
Adds a KRA as an IPA\-managed service. This requires that the IPA server is already installed and configured, including a CA.
The KRA (Key Recovery Authority) is a component used to securely store secrets such as passwords, symmetric keys and private asymmetric keys. It is used as the back-end repository for the IPA Password Vault.
Domain level 0 is not supported anymore.
ipa\-kra\-install can be run without replica_file to add KRA to the existing CA.
ipa\-kra\-install will contact the CA to determine if a KRA has already been installed on another replica, and if so, will exit indicating that a replica_file is required.
ipa\-kra\-install can be used to add KRA to the existing CA, or to install the KRA service on a replica.
The replica_file is created using the ipa\-replica\-prepare utility. A new replica_file should be generated on the master IPA server after the KRA has been installed and configured, so that the replica_file will contain the master KRA configuration and system certificates.
KRA can only be removed along with the entire server using ipa\-server\-install \-\-uninstall.
The uninstall option can be used to remove the KRA from the local IPA server. KRA instances on other replicas are not affected. The KRA will also be removed if the entire server is removed using ipa\-server\-install \-\-uninstall.
.SH "OPTIONS"
.TP
\fB\-p\fR \fIDM_PASSWORD\fR, \fB\-\-password\fR=\fIDM_PASSWORD\fR
Directory Manager (existing master) password
.TP
\fB\-\-no-host-dns\fR
Do not use DNS for hostname lookup during installation
.TP
\fB\-U\fR, \fB\-\-unattended\fR
An unattended installation that will never prompt for user input
.TP
\fB\-\-uninstall\fR
Uninstall the KRA from the local IPA server.
.TP
\fB\-v\fR, \fB\-\-verbose\fR
Enable debug output when more verbose output is needed
.TP
\fB\-q\fR, \fB\-\-quiet\fR
Output only errors
.TP
\fB\-\-log-file\fR=\fRFILE\fR
\fB\-v\fR, \fB\-\-log-file\fR=\fFILE\fR
Log to the given file
.SH "EXIT STATUS"
0 if the command was successful

14
install/tools/man/ipa-nis-manage.1
View File

@@ -16,19 +16,17 @@
.\"
.\" Author: Rob Crittenden <rcritten@redhat.com>
.\"
.TH "ipa-nis-manage" "1" "April 25 2016" "FreeIPA" "FreeIPA Manual Pages"
.TH "ipa-nis-manage" "1" "May 6 2009" "FreeIPA" "FreeIPA Manual Pages"
.SH "NAME"
ipa\-nis\-manage \- Enables or disables the NIS listener plugin
.SH "SYNOPSIS"
ipa\-nis\-manage [options] <enable|disable|status>
ipa\-nis\-manage [options] <enable|disable>
.SH "DESCRIPTION"
Run the command with the \fBenable\fR option to enable the NIS plugin.
Run the command with the \fBdisable\fR option to disable the NIS plugin.
Run the command with the \fBdisable\fR option to disable the compat plugin.
Run the command with the \fBstatus\fR option to read status of the NIS plugin. Return code 0 indicates enabled plugin, return code 4 indicates disabled plugin.
In all cases the user will be prompted to provide the Directory Manager's password unless option \fB\-y\fR is used.
In both cases the user will be prompted to provide the Directory Manager's password unless option \fB\-y\fR is used.
Directory Server will need to be restarted after the NIS listener plugin has been enabled.
@@ -45,7 +43,3 @@ File containing the Directory Manager password
1 if an error occurred
2 if the plugin is already in the required status (enabled or disabled)
3 if RPC services cannot be enabled.
4 if status command detected plugin in disabled state.

34
install/tools/man/ipa-pkinit-manage.1
View File

@@ -1,34 +0,0 @@
.\"
.\" Copyright (C) 2017 FreeIPA Contributors see COPYING for license
.\"
.TH "ipa-pkinit-manage" "1" "Jun 05 2017" "FreeIPA" "FreeIPA Manual Pages"
.SH "NAME"
ipa\-pkinit\-manage \- Enables or disables PKINIT
.SH "SYNOPSIS"
ipa\-pkinit\-manage [options] <enable|disable|status>
.SH "DESCRIPTION"
Run the command with the \fBenable\fR option to enable PKINIT.
Run the command with the \fBdisable\fR option to disable PKINIT.
Run the command with the \fBstatus\fR to determine the current status of PKINIT.
.SH "OPTIONS"
.TP
\fB\-\-version\fR
Show the program's version and exit.
.TP
\fB\-h\fR, \fB\-\-help\fR
Show the help for this program.
.TP
\fB\-v\fR, \fB\-\-verbose\fR
Print debugging information.
.TP
\fB\-q\fR, \fB\-\-quiet\fR
Output only errors.
.TP
\fB\-\-log\-file\fR=\fIFILE\fR
Log to the given file.
.SH "EXIT STATUS"
0 if the command was successful
1 if an error occurred

4
install/tools/man/ipa-replica-conncheck.1
View File

@@ -40,7 +40,7 @@ Automatically log in to master machine and execute the master machine part of th
The Kerberos realm name for the IPA server
.TP
\fB\-k\fR \fIKDC\fR, \fB\-\-kdc\fR=\fIKDC\fR
KDC server address. Defaults to \fIMASTER\fR
KDC server address. Defaults t \fIMASTER\fR
.TP
\fB\-p\fR \fIPRINCIPAL\fR, \fB\-\-principal\fR=\fIPRINCIPAL\fR
Authorized Kerberos principal to use to log in to master machine. Defaults to \fIadmin\fR
@@ -60,7 +60,7 @@ Remote replica machine address
Include in a check also a set of dogtag connection requirements. Only needed when the master was installed with Dogtag 9 or lower.
.TP
\fB\-h\fR \fIHOSTNAME\fR, \fB\-\-hostname\fR=\fIHOSTNAME\fR
The hostname of this server (FQDN). By default the result of getfqdn() call from Python's socket module is used.
The hostname of this server (FQDN). By default a nodename from uname(2) is used
.TP
\fB\-d\fR, \fB\-\-debug\fR
Print debugging information

189
install/tools/man/ipa-replica-install.1
View File

@@ -1,22 +1,41 @@
.\" A man page for ipa-replica-install
.\" Copyright (C) 2008-2016 FreeIPA Contributors see COPYING for license
.\" Copyright (C) 2008-2012 Red Hat, Inc.
.\"
.TH "ipa-replica-install" "1" "Dec 19 2016" "FreeIPA" "FreeIPA Manual Pages"
.\" This program is free software; you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation, either version 3 of the License, or
.\" (at your option) any later version.
.\"
.\" This program is distributed in the hope that it will be useful, but
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
.\" General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
.\"
.\" Author: Rob Crittenden <rcritten@redhat.com>
.\"
.TH "ipa-replica-install" "1" "May 16 2012" "FreeIPA" "FreeIPA Manual Pages"
.SH "NAME"
ipa\-replica\-install \- Create an IPA replica
.SH "SYNOPSIS"
.SS "DOMAIN LEVEL 0"
.TP
ipa\-replica\-install [\fIOPTION\fR]... replica_file
.SS "DOMAIN LEVEL 1"
.TP
ipa\-replica\-install [\fIOPTION\fR]...
.SH "DESCRIPTION"
Configures a new IPA server that is a replica of the server. Once it has been created it is an exact copy of the original IPA server and is an equal master. Changes made to any master are automatically replicated to other masters.
Domain level 0 is not supported anymore.
To create a replica in a domain at domain level 0, you need to provide an replica file. The replica_file is created using the ipa\-replica\-prepare utility.
To create a replica, the machine only needs to be enrolled in the FreeIPA domain first. This process of turning the IPA client into a replica is also referred to as replica promotion.
To create a replica in a domain at domain level 1, you don't have to provide a replica file, the machine only needs to be enrolled in the FreeIPA domain first. This process of turning the IPA client into a replica is also referred to as replica promotion.
If you're starting with an existing IPA client, simply run ipa\-replica\-install to have it promoted into a replica. The NTP configuration cannot be updated during client promotion.
If you're starting with an existing IPA client, simply run ipa\-replica\-install to have it promoted into a replica.
To promote a blank machine into a replica, you have two options, you can either run ipa\-client\-install in a separate step, or pass the enrollment related options to the ipa\-replica\-install (see CLIENT ENROLLMENT OPTIONS). In the latter case, ipa\-replica\-install will join the machine to the IPA realm automatically and will proceed with the promotion step.
To promote a blank machine into a replica, you have two options, you can either run ipa\-client\-install in a separate step, or pass the enrollment related options to the ipa\-replica\-install (see DOMAIN LEVEL 1 CLIENT ENROLLMENT OPTIONS). In the latter case, ipa\-replica\-install will join the machine to the IPA realm automatically and will proceed with the promotion step.
If the installation fails you may need to run ipa\-server\-install \-\-uninstall and ipa\-client\-install before running ipa\-replica\-install again.
@@ -24,7 +43,7 @@ The installation will fail if the host you are installing the replica on exists
A replica should only be installed on the same or higher version of IPA on the remote system.
.SH "OPTIONS"
.SS "OPTIONS"
.SS "DOMAIN LEVEL 1 OPTIONS"
.TP
\fB\-P\fR, \fB\-\-principal\fR
The user principal which will be used to promote the client to the replica and enroll the client itself, if necessary.
@@ -32,12 +51,10 @@ The user principal which will be used to promote the client to the replica and e
\fB\-w\fR, \fB\-\-admin\-password\fR
The Kerberos password for the given principal.
.SS "CLIENT ENROLLMENT OPTIONS"
.SS "DOMAIN LEVEL 1 CLIENT ENROLLMENT OPTIONS"
To install client and promote it to replica using a host keytab or One Time Password, the host needs to be a member of ipaservers group. This requires to create a host entry and add it to the host group prior replica installation.
\-\-server, \-\-domain, \-\-realm options are autodiscovered via DNS records by default. See manual page
.BR ipa\-client\-install (1)
for further details about these options.
--server, --domain, --realm options are autodiscovered via DNS records by default.
.TP
\fB\-p\fR \fIPASSWORD\fR, \fB\-\-password\fR=\fIPASSWORD\fR
@@ -50,35 +67,33 @@ Path to host keytab.
The fully qualified domain name of the IPA server to enroll to.
.TP
\fB\-n\fR, \fB\-\-domain\fR=\fIDOMAIN\fR
The primary DNS domain of an existing IPA deployment, e.g. example.com.
This DNS domain should contain the SRV records generated by the IPA server installer.
Set the domain name to DOMAIN.
.TP
\fB\-r\fR, \fB\-\-realm\fR=\fIREALM_NAME\fR
The Kerberos realm of an existing IPA deployment.
\fB\-d\fR, \fB\-\-realm\fR=\fIREALM_NAME\fR
Set the IPA realm name to REALM_NAME.
.TP
\fB\-\-hostname\fR
The hostname of this machine (FQDN). If specified, the hostname will be set and the system configuration will be updated to persist over reboot.
.SS "DOMAIN LEVEL 0 OPTIONS"
.TP
\fB\-\-force\-join\fR
Join the host even if it is already enrolled.
\fB\-p\fR \fIPASSWORD\fR, \fB\-\-password\fR=\fIPASSWORD\fR
Directory Manager (existing master) password
.TP
\fB\-w\fR, \fB\-\-admin\-password\fR
Admin user Kerberos password used for connection check
.SS "BASIC OPTIONS"
.TP
\fB\-\-ip\-address\fR=\fIIP_ADDRESS\fR
The IP address of this server. If this address does not match the address the host resolves to and \-\-setup\-dns is not selected the installation will fail. If the server hostname is not resolvable, a record for the hostname and IP_ADDRESS is added to /etc/hosts.
This option can be used multiple times to specify more IP addresses of the server (e.g. multihomed and/or dualstacked server).
This this option can be used multiple times to specify more IP addresses of the server (e.g. multihomed and/or dualstacked server).
.TP
\fB\-\-mkhomedir\fR
Create home directories for users on their first login
.TP
\fB\-\-ntp\-server\fR=\fINTP_SERVER\fR
Configure chronyd to use this NTP server. This option can be used multiple times and it is used to specify exactly one time server.
.TP
\fB\-\-ntp\-pool\fR=\fINTP_SERVER_POOL\fR
Configure chronyd to use this NTP server pool. This option is meant to be pool of multiple servers resolved as one host name. This pool's servers may vary but pool address will be still same and chrony will choose only one server from this pool.
.TP
\fB\-N\fR, \fB\-\-no\-ntp\fR
Do not configure NTP client (chronyd).
Do not configure NTP
.TP
\fB\-\-no\-ui\-redirect\fR
Do not automatically redirect to the Web UI.
@@ -111,58 +126,17 @@ Install and configure a CA on this replica. If a CA is not configured then
certificate operations will be forwarded to a master with a CA installed.
.TP
\fB\-\-no\-pkinit\fR
Disables pkinit setup steps.
.TP
\fB\-\-dirsrv\-cert\-file\fR=FILE
File containing the Directory Server SSL certificate and private key
.TP
\fB\-\-http\-cert\-file\fR=FILE
File containing the Apache Server SSL certificate and private key
.TP
\fB\-\-pkinit\-cert\-file\fR=FILE
File containing the Kerberos KDC SSL certificate and private key
.TP
\fB\-\-dirsrv\-pin\fR=PIN
The password to unlock the Directory Server private key
.TP
\fB\-\-http\-pin\fR=PIN
The password to unlock the Apache Server private key
.TP
\fB\-\-pkinit\-pin\fR=PIN
The password to unlock the Kerberos KDC private key
.TP
\fB\-\-dirsrv\-cert\-name\fR=NAME
Name of the Directory Server SSL certificate to install
.TP
\fB\-\-http\-cert\-name\fR=NAME
Name of the Apache Server SSL certificate to install
.TP
\fB\-\-pkinit\-cert\-name\fR=NAME
Name of the Kerberos KDC SSL certificate to install
Disables pkinit setup steps
.TP
\fB\-\-skip\-schema\-check\fR
Skip check for updated CA DS schema on the remote master
.SS "SECRET MANAGEMENT OPTIONS"
.TP
\fB\-\-setup\-kra\fR
Install and configure a KRA on this replica. If a KRA is not configured then
vault operations will be forwarded to a master with a KRA installed.
.SS "DNS OPTIONS"
.TP
\fB\-\-setup\-dns\fR
Configure an integrated DNS server, create a primary DNS zone (name specified by \-\-domain or taken from an existing deployment), and fill it with service records necessary for IPA deployment.
In cases where the IPA server name does not belong to the primary DNS domain and is not resolvable using DNS, create a DNS zone containing the IPA server name as well.
Generate a DNS zone if it does not exist already and configure the DNS server.
This option requires that you either specify at least one DNS forwarder through
the \fB\-\-forwarder\fR option or use the \fB\-\-no\-forwarders\fR option.
Note that you can set up a DNS at any time after the initial IPA server install by running
.B ipa-dns-install
(see
.BR ipa-dns-install (1)).
IPA DNS cannot be uninstalled.
.TP
\fB\-\-forwarder\fR=\fIIP_ADDRESS\fR
Add a DNS forwarder to the DNS configuration. You can use this option multiple
@@ -175,24 +149,12 @@ Do not add any DNS forwarders. Root DNS servers will be used instead.
\fB\-\-auto\-forwarders\fR
Add DNS forwarders configured in /etc/resolv.conf to the list of forwarders used by IPA DNS.
.TP
\fB\-\-forward\-policy\fR=\fIfirst|only\fR
DNS forwarding policy for global forwarders specified using other options.
Defaults to first if no IP address belonging to a private or reserved ranges is
detected on local interfaces (RFC 6303). Defaults to only if a private
IP address is detected.
.TP
\fB\-\-reverse\-zone\fR=\fIREVERSE_ZONE\fR
The reverse DNS zone to use. This option can be used multiple times to specify multiple reverse zones.
.TP
\fB\-\-no\-reverse\fR
Do not create new reverse DNS zone. If a reverse DNS zone already exists for the subnet, it will be used.
.TP
\fB\-\-auto-reverse\fR
Create necessary reverse zones
.TP
\fB\-\-allow-zone-overlap\fR
Create DNS zone even if it already exists
.TP
\fB\-\-no\-host\-dns\fR
Do not use DNS for hostname lookup during installation
.TP
@@ -202,73 +164,6 @@ Do not automatically create DNS SSHFP records.
\fB\-\-no\-dnssec\-validation\fR
Disable DNSSEC validation on this server.
.SS "AD TRUST OPTIONS"
.TP
\fB\-\-setup\-adtrust\fR
Configure AD Trust capability on a replica.
.TP
\fB\-\-netbios\-name\fR=\fINETBIOS_NAME\fR
The NetBIOS name for the IPA domain. If not provided then this is determined
based on the leading component of the DNS domain name. Running
ipa\-adtrust\-install for a second time with a different NetBIOS name will
change the name. Please note that changing the NetBIOS name might break
existing trust relationships to other domains.
.TP
\fB\-\-add\-sids\fR
Add SIDs to existing users and groups as on of final steps of the
ipa\-adtrust\-install run. If there a many existing users and groups and a
couple of replicas in the environment this operation might lead to a high
replication traffic and a performance degradation of all IPA servers in the
environment. To avoid this the SID generation can be run after
ipa\-adtrust\-install is run and scheduled independently. To start this task
you have to load an edited version of ipa-sidgen-task-run.ldif with the
ldapmodify command info the directory server.
.TP
\fB\-\-add\-agents\fR
Add IPA masters to the list that allows to serve information about
users from trusted forests. Starting with FreeIPA 4.2, a regular IPA master
can provide this information to SSSD clients. IPA masters aren't added
to the list automatically as restart of the LDAP service on each of them
is required. The host where ipa\-adtrust\-install is being run is added
automatically.
.IP
Note that IPA masters where ipa\-adtrust\-install wasn't run, can serve
information about users from trusted forests only if they are enabled
via \ipa-adtrust\-install run on any other IPA master. At least SSSD
version 1.13 on IPA master is required to be able to perform as a trust agent.
.TP
\fB\-\-rid-base\fR=\fIRID_BASE\fR
First RID value of the local domain. The first Posix ID of the local domain will
be assigned to this RID, the second to RID+1 etc. See the online help of the
idrange CLI for details.
.TP
\fB\-\-secondary-rid-base\fR=\fISECONDARY_RID_BASE\fR
Start value of the secondary RID range, which is only used in the case a user
and a group share numerically the same Posix ID. See the online help of the
idrange CLI for details.
.TP
\fB\-\-enable\-compat\fR
Enables support for trusted domains users for old clients through Schema Compatibility plugin.
SSSD supports trusted domains natively starting with version 1.9. For platforms that
lack SSSD or run older SSSD version one needs to use this option. When enabled, slapi\-nis package
needs to be installed and schema\-compat\-plugin will be configured to provide lookup of
users and groups from trusted domains via SSSD on IPA server. These users and groups will be
available under \fBcn=users,cn=compat,$SUFFIX\fR and \fBcn=groups,cn=compat,$SUFFIX\fR trees.
SSSD will normalize names of users and groups to lower case.
.IP
In addition to providing these users and groups through the compat tree, this option enables
authentication over LDAP for trusted domain users with DN under compat tree, i.e. using bind DN
\fBuid=administrator@ad.domain,cn=users,cn=compat,$SUFFIX\fR.
.IP
LDAP authentication performed by the compat tree is done via PAM '\fBsystem\-auth\fR' service.
This service exists by default on Linux systems and is provided by pam package as /etc/pam.d/system\-auth.
If your IPA install does not have default HBAC rule 'allow_all' enabled, then make sure
to define in IPA special service called '\fBsystem\-auth\fR' and create an HBAC
rule to allow access to anyone to this rule on IPA masters.
.IP
As '\fBsystem\-auth\fR' PAM service is not used directly by any other
application, it is safe to use it for trusted domain users via compatibility
path.
.SH "EXIT STATUS"
0 if the command was successful

38
install/tools/man/ipa-replica-manage.1
View File

@@ -16,7 +16,7 @@
.\"
.\" Author: Rob Crittenden <rcritten@redhat.com>
.\"
.TH "ipa-replica-manage" "1" "Jul 12 2016" "FreeIPA" "FreeIPA Manual Pages"
.TH "ipa-replica-manage" "1" "Mar 1 2013" "FreeIPA" "FreeIPA Manual Pages"
.SH "NAME"
ipa\-replica\-manage \- Manage an IPA replica
.SH "SYNOPSIS"
@@ -24,19 +24,19 @@ ipa\-replica\-manage [\fIOPTION\fR]... [COMMAND]
.SH "DESCRIPTION"
Manages the replication agreements of an IPA server.
To manage IPA replication agreements in a domain, use IPA CLI
To manage IPA replication agreements in a domain at domain level 1, use IPA CLI
or Web UI, see `ipa help topology` for additional information.
The available commands are:
.TP
\fBconnect\fR [SERVER_A] <SERVER_B>
\- Adds a new replication agreement between SERVER_A/localhost and SERVER_B. Applicable only for winsync agreements.
\- Adds a new replication agreement between SERVER_A/localhost and SERVER_B. At domain level 1 applicable only for winsync agreements.
.TP
\fBdisconnect\fR [SERVER_A] <SERVER_B>
\- Removes a replication agreement between SERVER_A/localhost and SERVER_B. Applicable only for winsync agreements.
\- Removes a replication agreement between SERVER_A/localhost and SERVER_B. At domain level 1 applicable only for winsync agreements.
.TP
\fBdel\fR <SERVER>
\- Removes all replication agreements and data about SERVER. Removes data and agreements for both suffixes - domain and ca.
\- Removes all replication agreements and data about SERVER. At domain level 1 it removes data and agreements for both suffixes - domain and ca.
.TP
\fBlist\fR [SERVER]
\- Lists all the servers or the list of agreements of SERVER
@@ -109,12 +109,12 @@ Provide additional information
\fB\-f\fR, \fB\-\-force\fR
Ignore some types of errors, don't prompt when deleting a master
.TP
\fB\-c\fR, \fB\-\-no\-lookup\fR
Do not perform DNS lookup checks.
.TP
\fB\-c\fR, \fB\-\-cleanup\fR
When deleting a master with the \-\-force flag, remove leftover references to an already deleted master.
.TP
\fB\-\-no\-lookup\fR
Do not perform DNS lookup checks.
.TP
\fB\-\-binddn\fR=\fIADMIN_DN\fR
Bind DN to use with remote server (default is cn=Directory Manager) \- Be careful to quote this value on the command line
.TP
@@ -135,7 +135,6 @@ Password for the IPA system user used by the Windows PassSync plugin to synchron
.TP
\fB\-\-from\fR=\fISERVER\fR
The server to pull the data from, used by the re\-initialize and force\-sync commands.
.TP
.SH "RANGES"
IPA uses the 389\-ds Distributed Numeric Assignment (DNA) Plugin to allocate POSIX ids for users and groups. A range is created when IPA is installed and half the range is assigned to the first IPA master for the purposes of allocation.
.TP
@@ -158,20 +157,20 @@ The DNA range and on\-deck (next) values can be managed using the dnarange\-set
.TP
The range and next range of a specific master can be displayed by passing the FQDN of that master to the dnarange\-show or dnanextrange\-show command.
.TP
Performing range changes as a delegated administrator (e.g. not using the Directory Manager password) requires additional 389\-ds ACIs. These are installed in upgraded masters but not existing ones. The changes are made in cn=config which is not replicated. The result is that DNA ranges cannot be managed on non\-upgraded masters as a delegated administrator.
Performing range changes as a delegated administrator (e.g. not using the Directory Manager password) requires additional 389\-ds ACIs. These are installed in upgraded masters but not existing ones. The changs are made in cn=config which is not replicated. The result is that DNA ranges cannot be managed on non\-upgraded masters as a delegated administrator.
.SH "EXAMPLES"
.TP
List all masters:
# ipa\-replica\-manage list
srv1.example.com: master
srv2.example.com: master
srv3.example.com: master
srv4.example.com: master
srv1.example.com
srv2.example.com
srv3.example.com
srv4.example.com
.TP
List a server's replication agreements.
# ipa\-replica\-manage list srv1.example.com
srv2.example.com: replica
srv3.example.com: replica
srv2.example.com
srv3.example.com
.TP
Re\-initialize a replica:
# ipa\-replica\-manage re\-initialize \-\-from srv2.example.com
@@ -191,11 +190,8 @@ Using connect/disconnect you can manage the replication topology.
.TP
List the replication IDs in use:
# ipa\-replica\-manage list\-ruv
Replica Update Vectors:
srv1.example.com:389: 7
srv2.example.com:389: 4
Certificate Server Replica Update Vectors:
srv1.example.com:389: 9
srv1.example.com:389: 7
srv2.example.com:389: 4
.TP
Remove references to an orphaned and deleted master:
# ipa\-replica\-manage del \-\-force \-\-cleanup master.example.com

92
install/tools/man/ipa-replica-prepare.1 Normal file
View File

@@ -0,0 +1,92 @@
.\" A man page for ipa-replica-prepare
.\" Copyright (C) 2008 Red Hat, Inc.
.\"
.\" This program is free software; you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation, either version 3 of the License, or
.\" (at your option) any later version.
.\"
.\" This program is distributed in the hope that it will be useful, but
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
.\" General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
.\"
.\" Author: Rob Crittenden <rcritten@redhat.com>
.\"
.TH "ipa-replica-prepare" "1" "Mar 14 2008" "FreeIPA" "FreeIPA Manual Pages"
.SH "NAME"
ipa\-replica\-prepare \- Create an IPA replica file
.SH "SYNOPSIS"
ipa\-replica\-prepare [\fIOPTION\fR]... hostname
.SH "DESCRIPTION"
Generates a replica file that may be used with ipa\-replica\-install to create a replica of an IPA server.
A replica can be created on any IPA master or replica server.
You must provide the fully\-qualified hostname of the machine you want to install the replica on and a host\-specific replica_file will be created. It is host\-specific because SSL server certificates are generated as part of the process and they are specific to a particular hostname.
If IPA manages the DNS for your domain, you should either use the \fB\-\-ip\-address\fR option or add the forward and reverse records manually using IPA plugins.
Once the file has been created it will be named replica\-hostname. This file can then be moved across the network to the target machine and a new IPA replica setup by running ipa\-replica\-install replica\-hostname.
.SS "Limitations"
A replica should only be installed on the same or higher version of IPA on the remote system.
A replica with PKI can only be installed from a replica file prepared on a master with PKI.
.SH "OPTIONS"
.TP
\fB\-\-dirsrv\-cert\-file\fR=\fIFILE\fR
File containing the Directory Server SSL certificate and private key. The files are accepted in PEM and DER certificate, PKCS#7 certificate chain, PKCS#8 and raw private key and PKCS#12 formats. This option may be used multiple times.
.TP
\fB\-\-http\-cert\-file\fR=\fIFILE\fR
File containing the Apache Server SSL certificate and private key. The files are accepted in PEM and DER certificate, PKCS#7 certificate chain, PKCS#8 and raw private key and PKCS#12 formats. This option may be used multiple times.
.TP
\fB\-\-pkinit\-cert\-file\fR=\fIFILE\fR
File containing the Kerberos KDC SSL certificate and private key. The files are accepted in PEM and DER certificate, PKCS#7 certificate chain, PKCS#8 and raw private key and PKCS#12 formats. This option may be used multiple times.
.TP
\fB\-\-dirsrv\-pin\fR=\fIPIN\fR
The password to unlock the Directory Server private key
.TP
\fB\-\-http\-pin\fR=\fIPIN\fR
The password to unlock the Apache Server private key
.TP
\fB\-\-pkinit\-pin\fR=\fIPIN\fR
The password to unlock the Kerberos KDC private key
.TP
\fB\-\-dirsrv\-cert\-name\fR=\fINAME\fR
Name of the Directory Server SSL certificate to install
.TP
\fB\-\-http\-cert\-name\fR=\fINAME\fR
Name of the Apache Server SSL certificate to install
.TP
\fB\-\-pkinit\-cert\-name\fR=\fINAME\fR
Name of the Kerberos KDC SSL certificate to install
.TP
\fB\-p\fR \fIDM_PASSWORD\fR, \fB\-\-password\fR=\fIDM_PASSWORD\fR
Directory Manager (existing master) password
.TP
\fB\-\-ip\-address\fR=\fIIP_ADDRESS\fR
IPv4 or IPv6 address of the replica server. This option can be specified multiple times for each interface of the server
(e.g. multihomed and/or dualstacked server), or for each IPv4 and IPv6 address of the server. The corresponding A or AAAA and
PTR records will be added to the DNS if they do not exist already.
.TP
\fB\-\-reverse\-zone\fR=\fIREVERSE_ZONE\fR
The reverse DNS zone to use. This option can be used multiple times to specify multiple reverse zones.
.TP
\fB\-\-no\-reverse\fR
Do not create reverse DNS zone
.TP
\fB\-\-ca\fR=\fICA_FILE\fR
Location of CA PKCS#12 file, default /root/cacert.p12
.TP
\fB\-\-no\-pkinit\fR
Disables pkinit setup steps
.TP
\fB\-\-debug\fR
Prints info log messages to the output
.SH "EXIT STATUS"
0 if the command was successful
1 if an error occurred

12
install/tools/man/ipa-restore.1
View File

@@ -32,7 +32,7 @@ The type of backup is automatically detected. A data restore can be done from ei
.TP
\fBWARNING\fR: A full restore will restore files like /etc/passwd, /etc/group, /etc/resolv.conf as well. Any file that IPA may have touched is backed up and restored.
.TP
An encrypted backup is also automatically detected and the root keyring and gpg-agent is used by default. Set \fBGNUPGHOME\fR environment variable to use a custom keyring and gpg2 configuration.
An encrypted backup is also automatically detected and the root keyring is used by default. The \-\-keyring option can be used to define the full path to the private and public keys.
.TP
Within the subdirectory is file, header, that describes the back up including the type, system, date of backup, the version of IPA, the version of the backup and the services on the master.
.TP
@@ -61,6 +61,9 @@ The Directory Manager password.
\fB\-\-data\fR
Restore the data only. The default is to restore everything in the backup.
.TP
\fB\-\-gpg\-keyring\fR=\fIGPG_KEYRING\fR
The full path to a GPG keyring. The keyring consists of two files, a public and a private key (.sec and .pub respectively). Specify the path without an extension.
.TP
\fB\-\-no\-logs\fR
Exclude the IPA service log files in the backup (if they were backed up).
.TP
@@ -88,10 +91,6 @@ Log to the given file
0 if the command was successful
1 if an error occurred
.SH "ENVIRONMENT VARIABLES"
.PP
\fBGNUPGHOME\fR
Use custom GnuPG keyring and settings (default: \fB~/.gnupg\fR).
.SH "FILES"
.PP
\fI/var/lib/ipa/backup\fR
@@ -104,5 +103,4 @@ The default directory for storing backup files.
The log file for restoration
.PP
.SH "SEE ALSO"
.BR ipa\-backup(1)
.BR gpg2(1)
ipa\-backup(1).

8
install/tools/man/ipa-server-certinstall.1
View File

@@ -22,14 +22,13 @@ ipa\-server\-certinstall \- Install new SSL server certificates
.SH "SYNOPSIS"
ipa\-server\-certinstall [\fIOPTION\fR]... FILE...
.SH "DESCRIPTION"
Replace the current Directory server SSL certificate, Apache server SSL certificate and/or Kerberos KDC certificate with the certificate in the specified files. The files are accepted in PEM and DER certificate, PKCS#7 certificate chain, PKCS#8 and raw private key and PKCS#12 formats.
Replace the current SSL Directory and/or Apache server certificate(s) with the certificate in the specified files. The files are accepted in PEM and DER certificate, PKCS#7 certificate chain, PKCS#8 and raw private key and PKCS#12 formats.
PKCS#12 is a file format used to safely transport SSL certificates and public/private keypairs.
They may be generated and managed using the NSS pk12util command or the OpenSSL pkcs12 command.
The service(s) are not automatically restarted. In order to use the newly installed certificate(s) you will need to manually restart the Directory, Apache and/or Krb5kdc servers.
The service(s) are not automatically restarted. In order to use the newly installed certificate(s) you will need to manually restart the Directory and/or Apache servers.
.SH "OPTIONS"
.TP
\fB\-d\fR, \fB\-\-dirsrv\fR
@@ -38,9 +37,6 @@ Install the certificate on the Directory Server
\fB\-w\fR, \fB\-\-http\fR
Install the certificate in the Apache Web Server
.TP
\fB\-k\fR, \fB\-\-kdc\fR
Install the certificate in the Kerberos KDC
.TP
\fB\-\-pin\fR=\fIPIN\fR
The password to unlock the private key
.TP

190
install/tools/man/ipa-server-install.1
View File

@@ -1,7 +1,22 @@
.\" A man page for ipa-server-install
.\" Copyright (C) 2008-2017 FreeIPA Contributors see COPYING for license
.\" Copyright (C) 2008 Red Hat, Inc.
.\"
.TH "ipa-server-install" "1" "Feb 17 2017" "FreeIPA" "FreeIPA Manual Pages"
.\" This program is free software; you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation, either version 3 of the License, or
.\" (at your option) any later version.
.\"
.\" This program is distributed in the hope that it will be useful, but
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
.\" General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
.\"
.\" Author: Rob Crittenden <rcritten@redhat.com>
.\"
.TH "ipa-server-install" "1" "Jun 28 2012" "FreeIPA" "FreeIPA Manual Pages"
.SH "NAME"
ipa\-server\-install \- Configure an IPA server
.SH "SYNOPSIS"
@@ -13,60 +28,41 @@ Configures the services needed by an IPA server. This includes setting up a Kerb
.SS "BASIC OPTIONS"
.TP
\fB\-r\fR \fIREALM_NAME\fR, \fB\-\-realm\fR=\fIREALM_NAME\fR
The Kerberos realm name for the new IPA deployment.
It is strongly recommended to \fBuse an upper-cased name of the primary DNS domain name\fR of your IPA deployment. You will not be able to establish trust with Active Directory unless the realm name is the upper-cased domain name.
The realm name cannot be changed after the installation.
The Kerberos realm name for the IPA server. You will not be able to estabilish trust with Active Directory unless the realm name is uppercased domain name.
.TP
\fB\-n\fR \fIDOMAIN_NAME\fR, \fB\-\-domain\fR=\fIDOMAIN_NAME\fR
The primary DNS domain of the IPA deployment, e.g. example.com. This DNS domain should contain the SRV records generated by the IPA server installer. The specified DNS domain must not contain DNS records of any other LDAP or Kerberos based management system (like Active Directory or MIT Kerberos).
It is strongly recommended to \fBuse a lower-cased name of the IPA Kerberos realm name.\fR
The primary DNS domain name cannot be changed after the installation.
Your DNS domain name
.TP
\fB\-p\fR \fIDM_PASSWORD\fR, \fB\-\-ds\-password\fR=\fIDM_PASSWORD\fR
The password to be used by the Directory Server for the Directory Manager user.
The password to be used by the Directory Server for the Directory Manager user
.TP
\fB\-a\fR \fIADMIN_PASSWORD\fR, \fB\-\-admin\-password\fR=\fIADMIN_PASSWORD\fR
The password for the IPA admin user.
The password for the IPA admin user
.TP
\fB\-\-mkhomedir\fR
Create home directories for users on their first login.
Create home directories for users on their first login
.TP
\fB\-\-hostname\fR=\fIHOST_NAME\fR
The fully\-qualified DNS name of this server.
The fully\-qualified DNS name of this server. If the hostname does not match system hostname, the system hostname will be updated accordingly to prevent service failures.
.TP
\fB\-\-ip\-address\fR=\fIIP_ADDRESS\fR
The IP address of this server. If this address does not match the address the host resolves to and \-\-setup\-dns is not selected, the installation will fail. If the server hostname is not resolvable, a record for the hostname and IP_ADDRESS is added to /etc/hosts.
This option can be used multiple times to specify more IP addresses of the server (e.g. multihomed and/or dualstacked server).
.TP
Configure chronyd to use this NTP server. This option can be used multiple times and it is used to specify exactly one time server.
.TP
\fB\-\-ntp\-server\fR=\fINTP_SERVER\fR
Configure chronyd to use this NTP server. This option can be used multiple times and it is used to specify exactly one time server.
.TP
\fB\-\-ntp\-pool\fR=\fINTP_SERVER_POOL\fR
Configure chronyd to use this NTP server pool. This option is meant to be pool of multiple servers resolved as one host name. This pool's servers may vary but pool address will be still same and chrony will choose only one server from this pool.
The IP address of this server. If this address does not match the address the host resolves to and \-\-setup\-dns is not selected the installation will fail. If the server hostname is not resolvable, a record for the hostname and IP_ADDRESS is added to /etc/hosts.
This this option can be used multiple times to specify more IP addresses of the server (e.g. multihomed and/or dualstacked server).
.TP
\fB\-N\fR, \fB\-\-no\-ntp\fR
Do not configure NTP client (chronyd).
Do not configure NTP
.TP
\fB\-\-idstart\fR=\fIIDSTART\fR
The starting user and group id number (default random).
The starting user and group id number (default random)
.TP
\fB\-\-idmax\fR=\fIIDMAX\fR
The maximum user and group id number (default: idstart+199999). If set to zero, the default value will be used.
.TP
\fB\-\-no-hbac-allow\fR
\fB\-\-no_hbac_allow\fR
Don't install allow_all HBAC rule. This rule lets any user from any host access any service on any other host. It is expected that users will remove this rule before moving to production.
.TP
\fB\-\-ignore-topology-disconnect\fR
Ignore errors reported when IPA server uninstall would lead to disconnected topology.
.TP
\fB\-\-ignore-last-of-role\fR
Ignore errors reported when IPA server uninstall would lead to removal of last CA/DNS server or DNSSec master.
Ignore errors reported when IPA server uninstall would lead to disconnected topology. This option can be used only when domain level is 1 or more.
.TP
\fB\-\-no\-ui\-redirect\fR
Do not automatically redirect to the Web UI.
@@ -81,13 +77,13 @@ Do not configure OpenSSH client.
Do not configure OpenSSH server.
.TP
\fB\-d\fR, \fB\-\-debug\fR
Enable debug logging when more verbose output is needed.
Enable debug logging when more verbose output is needed
.TP
\fB\-U\fR, \fB\-\-unattended\fR
An unattended installation that will never prompt for user input.
An unattended installation that will never prompt for user input
.TP
\fB\-\-dirsrv\-config\-file\fR
The path to LDIF file that will be used to modify configuration of dse.ldif during installation of the directory server instance.
The path to LDIF file that will be used to modify configuration of dse.ldif during installation of the directory server instance
.SS "CERTIFICATE SYSTEM OPTIONS"
.TP
@@ -95,32 +91,13 @@ The path to LDIF file that will be used to modify configuration of dse.ldif duri
Generate a CSR for the IPA CA certificate to be signed by an external CA.
.TP
\fB\-\-external\-ca\-type\fR=\fITYPE\fR
Type of the external CA. Possible values are "generic", "ms-cs". Default value is "generic". Use "ms-cs" to include the template name required by Microsoft Certificate Services (MS CS) in the generated CSR (see \fB\-\-external\-ca\-profile\fR for full details).
.TP
\fB\-\-external\-ca\-profile\fR=\fIPROFILE_SPEC\fR
Specify the certificate profile or template to use at the external CA.
When \fB\-\-external\-ca\-type\fR is "ms-cs" the following specifiers may be used:
.RS
.TP
\fB<oid>:<majorVersion>[:<minorVersion>]\fR
Specify a certificate template by OID and major version, optionally also specifying minor version.
.TP
\fB<name>\fR
Specify a certificate template by name. The name cannot contain any \fI:\fR characters and cannot be an OID (otherwise the OID-based template specifier syntax takes precedence).
.TP
\fBdefault\fR
If no template is specified, the template name "SubCA" is used.
.RE
Type of the external CA. Possible values are "generic", "ms-cs". Default value is "generic". Use "ms-cs" to include template name required by Microsoft Certificate Services (MS CS) in the generated CSR.
.TP
\fB\-\-external\-cert\-file\fR=\fIFILE\fR
File containing the IPA CA certificate and the external CA certificate chain. The file is accepted in PEM and DER certificate and PKCS#7 certificate chain formats. This option may be used multiple times.
.TP
\fB\-\-no\-pkinit\fR
Disables pkinit setup steps.
Disables pkinit setup steps
.TP
\fB\-\-dirsrv\-cert\-file\fR=\fIFILE\fR
File containing the Directory Server SSL certificate and private key. The files are accepted in PEM and DER certificate, PKCS#7 certificate chain, PKCS#8 and raw private key and PKCS#12 formats. This option may be used multiple times.
@@ -132,50 +109,36 @@ File containing the Apache Server SSL certificate and private key. The files are
File containing the Kerberos KDC SSL certificate and private key. The files are accepted in PEM and DER certificate, PKCS#7 certificate chain, PKCS#8 and raw private key and PKCS#12 formats. This option may be used multiple times.
.TP
\fB\-\-dirsrv\-pin\fR=\fIPIN\fR
The password to unlock the Directory Server private key.
The password to unlock the Directory Server private key
.TP
\fB\-\-http\-pin\fR=\fIPIN\fR
The password to unlock the Apache Server private key.
The password to unlock the Apache Server private key
.TP
\fB\-\-pkinit\-pin\fR=\fIPIN\fR
The password to unlock the Kerberos KDC private key.
The password to unlock the Kerberos KDC private key
.TP
\fB\-\-dirsrv\-cert\-name\fR=\fINAME\fR
Name of the Directory Server SSL certificate to install.
Name of the Directory Server SSL certificate to install
.TP
\fB\-\-http\-cert\-name\fR=\fINAME\fR
Name of the Apache Server SSL certificate to install.
Name of the Apache Server SSL certificate to install
.TP
\fB\-\-pkinit\-cert\-name\fR=\fINAME\fR
Name of the Kerberos KDC SSL certificate to install.
Name of the Kerberos KDC SSL certificate to install
.TP
\fB\-\-ca\-cert\-file\fR=\fIFILE\fR
File containing the CA certificate of the CA which issued the Directory Server, Apache Server and Kerberos KDC certificates. The file is accepted in PEM and DER certificate and PKCS#7 certificate chain formats. This option may be used multiple times. Use this option if the CA certificate is not present in the certificate files.
.TP
\fB\-\-ca\-subject\fR=\fISUBJECT\fR
The CA certificate subject DN (default CN=Certificate Authority,O=REALM.NAME). RDNs are in LDAP order (most specific RDN first).
.TP
\fB\-\-subject\-base\fR=\fISUBJECT\fR
The subject base for certificates issued by IPA (default O=REALM.NAME). RDNs are in LDAP order (most specific RDN first).
\fB\-\-subject\fR=\fISUBJECT\fR
The certificate subject base (default O=REALM.NAME)
.TP
\fB\-\-ca\-signing\-algorithm\fR=\fIALGORITHM\fR
Signing algorithm of the IPA CA certificate. Possible values are SHA1withRSA, SHA256withRSA, SHA512withRSA. Default value is SHA256withRSA. Use this option with --external-ca if the external CA does not support the default signing algorithm.
.SS "SECRET MANAGEMENT OPTIONS"
.TP
\fB\-\-setup\-kra\fR
Install and configure a KRA on this server.
.SS "DNS OPTIONS"
IPA provides an integrated DNS server which can be used to simplify IPA deployment. If you decide to use it, IPA will automatically maintain SRV and other service records when you change your topology.
The DNS component in FreeIPA is optional and you may choose to manage all your DNS records manually on another third party DNS server. IPA DNS is not a general-purpose DNS server. If you need advanced features like DNS views, do not deploy IPA DNS.
.TP
\fB\-\-setup\-dns\fR
Configure an integrated DNS server, create DNS zone specified by \-\-domain, and fill it with service records necessary for IPA deployment.
In cases where the IPA server name does not belong to the primary DNS domain and is not resolvable using DNS, create a DNS zone containing the IPA server name as well.
Generate a DNS zone if it does not exist already and configure the DNS server.
This option requires that you either specify at least one DNS forwarder through
the \fB\-\-forwarder\fR option or use the \fB\-\-no\-forwarders\fR option.
@@ -183,8 +146,6 @@ Note that you can set up a DNS at any time after the initial IPA server install
.B ipa-dns-install
(see
.BR ipa-dns-install (1)).
IPA DNS cannot be uninstalled.
.TP
\fB\-\-forwarder\fR=\fIIP_ADDRESS\fR
Add a DNS forwarder to the DNS configuration. You can use this option multiple
@@ -197,26 +158,20 @@ Do not add any DNS forwarders. Root DNS servers will be used instead.
\fB\-\-auto\-forwarders\fR
Add DNS forwarders configured in /etc/resolv.conf to the list of forwarders used by IPA DNS.
.TP
\fB\-\-forward\-policy\fR=\fIfirst|only\fR
DNS forwarding policy for global forwarders specified using other options.
Defaults to first if no IP address belonging to a private or reserved ranges is
detected on local interfaces (RFC 6303). Defaults to only if a private
IP address is detected.
.TP
\fB\-\-reverse\-zone\fR=\fIREVERSE_ZONE\fR
The reverse DNS zone to use. This option can be used multiple times to specify multiple reverse zones.
.TP
\fB\-\-no\-reverse\fR
Do not create reverse DNS zone.
Do not create reverse DNS zone
.TP
\fB\-\-auto\-reverse\fR
Try to resolve reverse records and reverse zones for server IP addresses. If neither is resolvable, creates the reverse zones.
Try to resolve reverse records and reverse zones for server IP addresses and if neither is resolvable creates these reverse zones.
.TP
\fB\-\-zonemgr\fR
The e\-mail address of the DNS zone manager. Defaults to hostmaster@DOMAIN
.TP
\fB\-\-no\-host\-dns\fR
Do not use DNS for hostname lookup during installation.
Do not use DNS for hostname lookup during installation
.TP
\fB\-\-no\-dns\-sshfp\fR
Do not automatically create DNS SSHFP records.
@@ -225,61 +180,15 @@ Do not automatically create DNS SSHFP records.
Disable DNSSEC validation on this server.
.TP
\fB\-\-allow\-zone\-overlap\fR
Allow creation of (reverse) zone even if the zone is already resolvable. Using this option is discouraged as it result in later problems with domain name resolution.
.SS "AD TRUST OPTIONS"
.TP
\fB\-\-setup\-adtrust\fR
Configure AD Trust capability.
.TP
\fB\-\-netbios\-name\fR=\fINETBIOS_NAME\fR
The NetBIOS name for the IPA domain. If not provided, this is determined
based on the leading component of the DNS domain name. Running
ipa\-adtrust\-install for a second time with a different NetBIOS name will
change the name. Please note that changing the NetBIOS name might break
existing trust relationships to other domains.
.TP
\fB\-\-rid-base\fR=\fIRID_BASE\fR
First RID value of the local domain. The first POSIX ID of the local domain will
be assigned to this RID, the second to RID+1 etc. See the online help of the
idrange CLI for details.
.TP
\fB\-\-secondary-rid-base\fR=\fISECONDARY_RID_BASE\fR
Start value of the secondary RID range, which is only used in the case a user
and a group share numerically the same POSIX ID. See the online help of the
idrange CLI for details.
.TP
\fB\-\-enable\-compat\fR
Enables support for trusted domains users for old clients through Schema Compatibility plugin.
SSSD supports trusted domains natively starting with version 1.9. For platforms that
lack SSSD or run older SSSD version one needs to use this option. When enabled, slapi\-nis package
needs to be installed and schema\-compat\-plugin will be configured to provide lookup of
users and groups from trusted domains via SSSD on IPA server. These users and groups will be
available under \fBcn=users,cn=compat,$SUFFIX\fR and \fBcn=groups,cn=compat,$SUFFIX\fR trees.
SSSD will normalize names of users and groups to lower case.
.IP
In addition to providing these users and groups through the compat tree, this option enables
authentication over LDAP for trusted domain users with DN under compat tree, i.e. using bind DN
\fBuid=administrator@ad.domain,cn=users,cn=compat,$SUFFIX\fR.
.IP
LDAP authentication performed by the compat tree is done via PAM '\fBsystem\-auth\fR' service.
This service exists by default on Linux systems and is provided by pam package as /etc/pam.d/system\-auth.
If your IPA install does not have default HBAC rule 'allow_all' enabled, then make sure
to define in IPA special service called '\fBsystem\-auth\fR' and create an HBAC
rule to allow access to anyone to this rule on IPA masters.
.IP
As '\fBsystem\-auth\fR' PAM service is not used directly by any other
application, it is safe to use it for trusted domain users via compatibility
path.
Allow creatin of (reverse) zone even if the zone is already resolvable. Using this option is discouraged as it result in later problems with domain name resolution.
.SS "UNINSTALL OPTIONS"
.TP
\fB\-\-uninstall\fR
Uninstall an existing IPA installation.
Uninstall an existing IPA installation
.TP
\fB\-U\fR, \fB\-\-unattended\fR
An unattended uninstallation that will never prompt for user input.
An unattended uninstallation that will never prompt for user input
.SH "DEPRECATED OPTIONS"
.TP
@@ -293,4 +202,3 @@ The kerberos master password (normally autogenerated).
.SH "SEE ALSO"
.BR ipa-dns-install (1)
.BR ipa-adtrust-install (1)

42
install/tools/man/ipa-upgradeconfig.8 Normal file
View File

@@ -0,0 +1,42 @@
.\" A man page for ipa-upgradeconfig
.\" Copyright (C) 2010 Red Hat, Inc.
.\"
.\" This program is free software; you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation, either version 3 of the License, or
.\" (at your option) any later version.
.\"
.\" This program is distributed in the hope that it will be useful, but
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
.\" General Public License for more details.
.\"
.\" You should have received a copy of the GNU General Public License
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
.\"
.\" Author: Rob Crittenden <rcritten@redhat.com>
.\"
.TH "ipa-upgradeconfig" "8" "Jun 18 2012" "freeipa" ""
.SH "NAME"
ipa\-upgradeconfig \- Upgrade the IPA Apache configuration
.SH "SYNOPSIS"
ipa\-upgradeconfig
.SH "DESCRIPTION"
A tool to update the IPA Apache configuration during an upgrade.
It examines the VERSION value in the head of \fI/etc/httpd/conf.d/ipa.conf\fR and \fI/etc/httpd/conf.d/ipa\-rewrite.conf\fR and compares this with the templates. If an update is needed then new files are written.
It also will convert a CA configured to be accessible via ports 9443, 9444, 9445 and 9446 to be proxied by the IPA web server on ports 80 and 443.
This is not intended to be run by an end\-user. It is executed when the IPA rpms are upgraded. This must be run as the root user.
.SH "OPTIONS"
.TP
\fB\-d\fR, \fB\-\-debug\fR
Enable debug logging when more verbose output is needed
.TP
\fB\-q\fR, \fB\-\-quiet\fR
Output only errors
.SH "EXIT STATUS"
0 if the update was successful or there was nothing to do
1 if an error occurred

3
install/tools/man/ipactl.8
View File

@@ -38,9 +38,6 @@ Stop all of the services that make up IPA
restart
Stop then start all of the services that make up IPA
.TP
status
Provides status of all the services that make up IPA
.TP
\fB\-d\fR, \fB\-\-debug\fR
Display debugging information
.TP