Imported Upstream version 4.6.2
This commit is contained in:
Mario Fetka
40
install/tools/Makefile.am
Normal file
40
install/tools/Makefile.am
Normal file
@@ -0,0 +1,40 @@
|
||||
NULL =
|
||||
|
||||
SUBDIRS = \
|
||||
man \
|
||||
$(NULL)
|
||||
|
||||
dist_sbin_SCRIPTS = \
|
||||
ipa-ca-install \
|
||||
ipa-dns-install \
|
||||
ipa-kra-install \
|
||||
ipa-server-install \
|
||||
ipa-adtrust-install \
|
||||
ipa-replica-conncheck \
|
||||
ipa-replica-install \
|
||||
ipa-replica-prepare \
|
||||
ipa-replica-manage \
|
||||
ipa-csreplica-manage \
|
||||
ipa-server-certinstall \
|
||||
ipa-server-upgrade \
|
||||
ipactl \
|
||||
ipa-compat-manage \
|
||||
ipa-nis-manage \
|
||||
ipa-managed-entries \
|
||||
ipa-ldap-updater \
|
||||
ipa-otptoken-import \
|
||||
ipa-backup \
|
||||
ipa-restore \
|
||||
ipa-advise \
|
||||
ipa-cacert-manage \
|
||||
ipa-winsync-migrate \
|
||||
ipa-pkinit-manage \
|
||||
$(NULL)
|
||||
|
||||
appdir = $(libexecdir)/ipa/
|
||||
dist_app_SCRIPTS = \
|
||||
ipa-custodia \
|
||||
ipa-custodia-check \
|
||||
ipa-httpd-kdcproxy \
|
||||
ipa-pki-retrieve-key \
|
||||
$(NULL)
|
||||
873
install/tools/Makefile.in
Normal file
873
install/tools/Makefile.in
Normal file
@@ -0,0 +1,873 @@
|
||||
# Makefile.in generated by automake 1.15.1 from Makefile.am.
|
||||
# @configure_input@
|
||||
|
||||
# Copyright (C) 1994-2017 Free Software Foundation, Inc.
|
||||
|
||||
# This Makefile.in is free software; the Free Software Foundation
|
||||
# gives unlimited permission to copy and/or distribute it,
|
||||
# with or without modifications, as long as this notice is preserved.
|
||||
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
|
||||
# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
|
||||
# PARTICULAR PURPOSE.
|
||||
|
||||
@SET_MAKE@
|
||||
|
||||
VPATH = @srcdir@
|
||||
am__is_gnu_make = { \
|
||||
if test -z '$(MAKELEVEL)'; then \
|
||||
false; \
|
||||
elif test -n '$(MAKE_HOST)'; then \
|
||||
true; \
|
||||
elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
|
||||
true; \
|
||||
else \
|
||||
false; \
|
||||
fi; \
|
||||
}
|
||||
am__make_running_with_option = \
|
||||
case $${target_option-} in \
|
||||
?) ;; \
|
||||
*) echo "am__make_running_with_option: internal error: invalid" \
|
||||
"target option '$${target_option-}' specified" >&2; \
|
||||
exit 1;; \
|
||||
esac; \
|
||||
has_opt=no; \
|
||||
sane_makeflags=$$MAKEFLAGS; \
|
||||
if $(am__is_gnu_make); then \
|
||||
sane_makeflags=$$MFLAGS; \
|
||||
else \
|
||||
case $$MAKEFLAGS in \
|
||||
*\\[\ \ ]*) \
|
||||
bs=\\; \
|
||||
sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
|
||||
| sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \
|
||||
esac; \
|
||||
fi; \
|
||||
skip_next=no; \
|
||||
strip_trailopt () \
|
||||
{ \
|
||||
flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
|
||||
}; \
|
||||
for flg in $$sane_makeflags; do \
|
||||
test $$skip_next = yes && { skip_next=no; continue; }; \
|
||||
case $$flg in \
|
||||
*=*|--*) continue;; \
|
||||
-*I) strip_trailopt 'I'; skip_next=yes;; \
|
||||
-*I?*) strip_trailopt 'I';; \
|
||||
-*O) strip_trailopt 'O'; skip_next=yes;; \
|
||||
-*O?*) strip_trailopt 'O';; \
|
||||
-*l) strip_trailopt 'l'; skip_next=yes;; \
|
||||
-*l?*) strip_trailopt 'l';; \
|
||||
-[dEDm]) skip_next=yes;; \
|
||||
-[JT]) skip_next=yes;; \
|
||||
esac; \
|
||||
case $$flg in \
|
||||
*$$target_option*) has_opt=yes; break;; \
|
||||
esac; \
|
||||
done; \
|
||||
test $$has_opt = yes
|
||||
am__make_dryrun = (target_option=n; $(am__make_running_with_option))
|
||||
am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
|
||||
pkgdatadir = $(datadir)/@PACKAGE@
|
||||
pkgincludedir = $(includedir)/@PACKAGE@
|
||||
pkglibdir = $(libdir)/@PACKAGE@
|
||||
pkglibexecdir = $(libexecdir)/@PACKAGE@
|
||||
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
|
||||
install_sh_DATA = $(install_sh) -c -m 644
|
||||
install_sh_PROGRAM = $(install_sh) -c
|
||||
install_sh_SCRIPT = $(install_sh) -c
|
||||
INSTALL_HEADER = $(INSTALL_DATA)
|
||||
transform = $(program_transform_name)
|
||||
NORMAL_INSTALL = :
|
||||
PRE_INSTALL = :
|
||||
POST_INSTALL = :
|
||||
NORMAL_UNINSTALL = :
|
||||
PRE_UNINSTALL = :
|
||||
POST_UNINSTALL = :
|
||||
build_triplet = @build@
|
||||
host_triplet = @host@
|
||||
subdir = install/tools
|
||||
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
|
||||
am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
|
||||
$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
|
||||
$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
|
||||
$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
|
||||
$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
|
||||
$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
|
||||
$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
|
||||
$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/VERSION.m4 \
|
||||
$(top_srcdir)/server.m4 $(top_srcdir)/configure.ac
|
||||
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
|
||||
$(ACLOCAL_M4)
|
||||
DIST_COMMON = $(srcdir)/Makefile.am $(dist_app_SCRIPTS) \
|
||||
$(dist_sbin_SCRIPTS) $(am__DIST_COMMON)
|
||||
mkinstalldirs = $(install_sh) -d
|
||||
CONFIG_HEADER = $(top_builddir)/config.h
|
||||
CONFIG_CLEAN_FILES =
|
||||
CONFIG_CLEAN_VPATH_FILES =
|
||||
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
|
||||
am__vpath_adj = case $$p in \
|
||||
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
|
||||
*) f=$$p;; \
|
||||
esac;
|
||||
am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
|
||||
am__install_max = 40
|
||||
am__nobase_strip_setup = \
|
||||
srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
|
||||
am__nobase_strip = \
|
||||
for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
|
||||
am__nobase_list = $(am__nobase_strip_setup); \
|
||||
for p in $$list; do echo "$$p $$p"; done | \
|
||||
sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
|
||||
$(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
|
||||
if (++n[$$2] == $(am__install_max)) \
|
||||
{ print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
|
||||
END { for (dir in files) print dir, files[dir] }'
|
||||
am__base_list = \
|
||||
sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
|
||||
sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
|
||||
am__uninstall_files_from_dir = { \
|
||||
test -z "$$files" \
|
||||
|| { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
|
||||
|| { echo " ( cd '$$dir' && rm -f" $$files ")"; \
|
||||
$(am__cd) "$$dir" && rm -f $$files; }; \
|
||||
}
|
||||
am__installdirs = "$(DESTDIR)$(appdir)" "$(DESTDIR)$(sbindir)"
|
||||
SCRIPTS = $(dist_app_SCRIPTS) $(dist_sbin_SCRIPTS)
|
||||
AM_V_P = $(am__v_P_@AM_V@)
|
||||
am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
|
||||
am__v_P_0 = false
|
||||
am__v_P_1 = :
|
||||
AM_V_GEN = $(am__v_GEN_@AM_V@)
|
||||
am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
|
||||
am__v_GEN_0 = @echo " GEN " $@;
|
||||
am__v_GEN_1 =
|
||||
AM_V_at = $(am__v_at_@AM_V@)
|
||||
am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
|
||||
am__v_at_0 = @
|
||||
am__v_at_1 =
|
||||
SOURCES =
|
||||
DIST_SOURCES =
|
||||
RECURSIVE_TARGETS = all-recursive check-recursive cscopelist-recursive \
|
||||
ctags-recursive dvi-recursive html-recursive info-recursive \
|
||||
install-data-recursive install-dvi-recursive \
|
||||
install-exec-recursive install-html-recursive \
|
||||
install-info-recursive install-pdf-recursive \
|
||||
install-ps-recursive install-recursive installcheck-recursive \
|
||||
installdirs-recursive pdf-recursive ps-recursive \
|
||||
tags-recursive uninstall-recursive
|
||||
am__can_run_installinfo = \
|
||||
case $$AM_UPDATE_INFO_DIR in \
|
||||
n|no|NO) false;; \
|
||||
*) (install-info --version) >/dev/null 2>&1;; \
|
||||
esac
|
||||
RECURSIVE_CLEAN_TARGETS = mostlyclean-recursive clean-recursive \
|
||||
distclean-recursive maintainer-clean-recursive
|
||||
am__recursive_targets = \
|
||||
$(RECURSIVE_TARGETS) \
|
||||
$(RECURSIVE_CLEAN_TARGETS) \
|
||||
$(am__extra_recursive_targets)
|
||||
AM_RECURSIVE_TARGETS = $(am__recursive_targets:-recursive=) TAGS CTAGS \
|
||||
distdir
|
||||
am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
|
||||
# Read a list of newline-separated strings from the standard input,
|
||||
# and print each of them once, without duplicates. Input order is
|
||||
# *not* preserved.
|
||||
am__uniquify_input = $(AWK) '\
|
||||
BEGIN { nonempty = 0; } \
|
||||
{ items[$$0] = 1; nonempty = 1; } \
|
||||
END { if (nonempty) { for (i in items) print i; }; } \
|
||||
'
|
||||
# Make sure the list of sources is unique. This is necessary because,
|
||||
# e.g., the same source file might be shared among _SOURCES variables
|
||||
# for different programs/libraries.
|
||||
am__define_uniq_tagged_files = \
|
||||
list='$(am__tagged_files)'; \
|
||||
unique=`for i in $$list; do \
|
||||
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
|
||||
done | $(am__uniquify_input)`
|
||||
ETAGS = etags
|
||||
CTAGS = ctags
|
||||
DIST_SUBDIRS = $(SUBDIRS)
|
||||
am__DIST_COMMON = $(srcdir)/Makefile.in
|
||||
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
|
||||
am__relativize = \
|
||||
dir0=`pwd`; \
|
||||
sed_first='s,^\([^/]*\)/.*$$,\1,'; \
|
||||
sed_rest='s,^[^/]*/*,,'; \
|
||||
sed_last='s,^.*/\([^/]*\)$$,\1,'; \
|
||||
sed_butlast='s,/*[^/]*$$,,'; \
|
||||
while test -n "$$dir1"; do \
|
||||
first=`echo "$$dir1" | sed -e "$$sed_first"`; \
|
||||
if test "$$first" != "."; then \
|
||||
if test "$$first" = ".."; then \
|
||||
dir2=`echo "$$dir0" | sed -e "$$sed_last"`/"$$dir2"; \
|
||||
dir0=`echo "$$dir0" | sed -e "$$sed_butlast"`; \
|
||||
else \
|
||||
first2=`echo "$$dir2" | sed -e "$$sed_first"`; \
|
||||
if test "$$first2" = "$$first"; then \
|
||||
dir2=`echo "$$dir2" | sed -e "$$sed_rest"`; \
|
||||
else \
|
||||
dir2="../$$dir2"; \
|
||||
fi; \
|
||||
dir0="$$dir0"/"$$first"; \
|
||||
fi; \
|
||||
fi; \
|
||||
dir1=`echo "$$dir1" | sed -e "$$sed_rest"`; \
|
||||
done; \
|
||||
reldir="$$dir2"
|
||||
ACLOCAL = @ACLOCAL@
|
||||
AMTAR = @AMTAR@
|
||||
AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
|
||||
API_VERSION = @API_VERSION@
|
||||
AR = @AR@
|
||||
AUTOCONF = @AUTOCONF@
|
||||
AUTOHEADER = @AUTOHEADER@
|
||||
AUTOMAKE = @AUTOMAKE@
|
||||
AWK = @AWK@
|
||||
CC = @CC@
|
||||
CCDEPMODE = @CCDEPMODE@
|
||||
CFLAGS = @CFLAGS@
|
||||
CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
|
||||
CMOCKA_LIBS = @CMOCKA_LIBS@
|
||||
CONFIG_STATUS = @CONFIG_STATUS@
|
||||
CPP = @CPP@
|
||||
CPPFLAGS = @CPPFLAGS@
|
||||
CRYPTO_CFLAGS = @CRYPTO_CFLAGS@
|
||||
CRYPTO_LIBS = @CRYPTO_LIBS@
|
||||
CYGPATH_W = @CYGPATH_W@
|
||||
DATA_VERSION = @DATA_VERSION@
|
||||
DEFS = @DEFS@
|
||||
DEPDIR = @DEPDIR@
|
||||
DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
|
||||
DIRSRV_LIBS = @DIRSRV_LIBS@
|
||||
DLLTOOL = @DLLTOOL@
|
||||
DSYMUTIL = @DSYMUTIL@
|
||||
DUMPBIN = @DUMPBIN@
|
||||
ECHO_C = @ECHO_C@
|
||||
ECHO_N = @ECHO_N@
|
||||
ECHO_T = @ECHO_T@
|
||||
EGREP = @EGREP@
|
||||
EXEEXT = @EXEEXT@
|
||||
FGREP = @FGREP@
|
||||
GETTEXT_DOMAIN = @GETTEXT_DOMAIN@
|
||||
GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
|
||||
GIT_BRANCH = @GIT_BRANCH@
|
||||
GIT_VERSION = @GIT_VERSION@
|
||||
GMSGFMT = @GMSGFMT@
|
||||
GMSGFMT_015 = @GMSGFMT_015@
|
||||
GREP = @GREP@
|
||||
INI_CFLAGS = @INI_CFLAGS@
|
||||
INI_LIBS = @INI_LIBS@
|
||||
INSTALL = @INSTALL@
|
||||
INSTALL_DATA = @INSTALL_DATA@
|
||||
INSTALL_PROGRAM = @INSTALL_PROGRAM@
|
||||
INSTALL_SCRIPT = @INSTALL_SCRIPT@
|
||||
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
|
||||
INTLLIBS = @INTLLIBS@
|
||||
INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
|
||||
IPAPLATFORM = @IPAPLATFORM@
|
||||
IPA_DATA_DIR = @IPA_DATA_DIR@
|
||||
IPA_SYSCONF_DIR = @IPA_SYSCONF_DIR@
|
||||
JSLINT = @JSLINT@
|
||||
KRAD_LIBS = @KRAD_LIBS@
|
||||
KRB5KDC_SERVICE = @KRB5KDC_SERVICE@
|
||||
KRB5_CFLAGS = @KRB5_CFLAGS@
|
||||
KRB5_LIBS = @KRB5_LIBS@
|
||||
LD = @LD@
|
||||
LDAP_CFLAGS = @LDAP_CFLAGS@
|
||||
LDAP_LIBS = @LDAP_LIBS@
|
||||
LDFLAGS = @LDFLAGS@
|
||||
LIBICONV = @LIBICONV@
|
||||
LIBINTL = @LIBINTL@
|
||||
LIBINTL_LIBS = @LIBINTL_LIBS@
|
||||
LIBOBJS = @LIBOBJS@
|
||||
LIBPDB_NAME = @LIBPDB_NAME@
|
||||
LIBS = @LIBS@
|
||||
LIBTOOL = @LIBTOOL@
|
||||
LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
|
||||
LIBVERTO_LIBS = @LIBVERTO_LIBS@
|
||||
LIPO = @LIPO@
|
||||
LN_S = @LN_S@
|
||||
LTLIBICONV = @LTLIBICONV@
|
||||
LTLIBINTL = @LTLIBINTL@
|
||||
LTLIBOBJS = @LTLIBOBJS@
|
||||
LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
|
||||
MAKEINFO = @MAKEINFO@
|
||||
MANIFEST_TOOL = @MANIFEST_TOOL@
|
||||
MKDIR_P = @MKDIR_P@
|
||||
MK_ASSIGN = @MK_ASSIGN@
|
||||
MK_ELSE = @MK_ELSE@
|
||||
MK_ENDIF = @MK_ENDIF@
|
||||
MK_IFEQ = @MK_IFEQ@
|
||||
MSGATTRIB = @MSGATTRIB@
|
||||
MSGFMT = @MSGFMT@
|
||||
MSGFMT_015 = @MSGFMT_015@
|
||||
MSGMERGE = @MSGMERGE@
|
||||
NAMED_GROUP = @NAMED_GROUP@
|
||||
NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
|
||||
NDRNBT_LIBS = @NDRNBT_LIBS@
|
||||
NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
|
||||
NDRPAC_LIBS = @NDRPAC_LIBS@
|
||||
NDR_CFLAGS = @NDR_CFLAGS@
|
||||
NDR_LIBS = @NDR_LIBS@
|
||||
NM = @NM@
|
||||
NMEDIT = @NMEDIT@
|
||||
NSPR_CFLAGS = @NSPR_CFLAGS@
|
||||
NSPR_LIBS = @NSPR_LIBS@
|
||||
NSS_CFLAGS = @NSS_CFLAGS@
|
||||
NSS_LIBS = @NSS_LIBS@
|
||||
NUM_VERSION = @NUM_VERSION@
|
||||
OBJDUMP = @OBJDUMP@
|
||||
OBJEXT = @OBJEXT@
|
||||
ODS_USER = @ODS_USER@
|
||||
OTOOL = @OTOOL@
|
||||
OTOOL64 = @OTOOL64@
|
||||
PACKAGE = @PACKAGE@
|
||||
PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
|
||||
PACKAGE_NAME = @PACKAGE_NAME@
|
||||
PACKAGE_STRING = @PACKAGE_STRING@
|
||||
PACKAGE_TARNAME = @PACKAGE_TARNAME@
|
||||
PACKAGE_URL = @PACKAGE_URL@
|
||||
PACKAGE_VERSION = @PACKAGE_VERSION@
|
||||
PATH_SEPARATOR = @PATH_SEPARATOR@
|
||||
PKG_CONFIG = @PKG_CONFIG@
|
||||
PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
|
||||
PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
|
||||
POPT_CFLAGS = @POPT_CFLAGS@
|
||||
POPT_LIBS = @POPT_LIBS@
|
||||
POSUB = @POSUB@
|
||||
PYLINT = @PYLINT@
|
||||
PYTHON = @PYTHON@
|
||||
PYTHON2 = @PYTHON2@
|
||||
PYTHON3 = @PYTHON3@
|
||||
PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
|
||||
PYTHON_INSTALL_EXTRA_OPTIONS = @PYTHON_INSTALL_EXTRA_OPTIONS@
|
||||
PYTHON_PLATFORM = @PYTHON_PLATFORM@
|
||||
PYTHON_PREFIX = @PYTHON_PREFIX@
|
||||
PYTHON_VERSION = @PYTHON_VERSION@
|
||||
RANLIB = @RANLIB@
|
||||
SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
|
||||
SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
|
||||
SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
|
||||
SASL_CFLAGS = @SASL_CFLAGS@
|
||||
SASL_LIBS = @SASL_LIBS@
|
||||
SED = @SED@
|
||||
SET_MAKE = @SET_MAKE@
|
||||
SHELL = @SHELL@
|
||||
SSSCERTMAP_CFLAGS = @SSSCERTMAP_CFLAGS@
|
||||
SSSCERTMAP_LIBS = @SSSCERTMAP_LIBS@
|
||||
SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
|
||||
SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
|
||||
SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
|
||||
SSSNSSIDMAP_LIBS = @SSSNSSIDMAP_LIBS@
|
||||
STRIP = @STRIP@
|
||||
TALLOC_CFLAGS = @TALLOC_CFLAGS@
|
||||
TALLOC_LIBS = @TALLOC_LIBS@
|
||||
TEVENT_CFLAGS = @TEVENT_CFLAGS@
|
||||
TEVENT_LIBS = @TEVENT_LIBS@
|
||||
UNISTRING_LIBS = @UNISTRING_LIBS@
|
||||
UNLINK = @UNLINK@
|
||||
USE_NLS = @USE_NLS@
|
||||
UUID_CFLAGS = @UUID_CFLAGS@
|
||||
UUID_LIBS = @UUID_LIBS@
|
||||
VENDOR_SUFFIX = @VENDOR_SUFFIX@
|
||||
VERSION = @VERSION@
|
||||
XGETTEXT = @XGETTEXT@
|
||||
XGETTEXT_015 = @XGETTEXT_015@
|
||||
XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
|
||||
XMLRPC_CFLAGS = @XMLRPC_CFLAGS@
|
||||
XMLRPC_LIBS = @XMLRPC_LIBS@
|
||||
abs_builddir = @abs_builddir@
|
||||
abs_srcdir = @abs_srcdir@
|
||||
abs_top_builddir = @abs_top_builddir@
|
||||
abs_top_srcdir = @abs_top_srcdir@
|
||||
ac_ct_AR = @ac_ct_AR@
|
||||
ac_ct_CC = @ac_ct_CC@
|
||||
ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
|
||||
am__include = @am__include@
|
||||
am__leading_dot = @am__leading_dot@
|
||||
am__quote = @am__quote@
|
||||
am__tar = @am__tar@
|
||||
am__untar = @am__untar@
|
||||
bindir = @bindir@
|
||||
build = @build@
|
||||
build_alias = @build_alias@
|
||||
build_cpu = @build_cpu@
|
||||
build_os = @build_os@
|
||||
build_vendor = @build_vendor@
|
||||
builddir = @builddir@
|
||||
datadir = @datadir@
|
||||
datarootdir = @datarootdir@
|
||||
docdir = @docdir@
|
||||
dvidir = @dvidir@
|
||||
exec_prefix = @exec_prefix@
|
||||
host = @host@
|
||||
host_alias = @host_alias@
|
||||
host_cpu = @host_cpu@
|
||||
host_os = @host_os@
|
||||
host_vendor = @host_vendor@
|
||||
htmldir = @htmldir@
|
||||
i18ntests = @i18ntests@
|
||||
includedir = @includedir@
|
||||
infodir = @infodir@
|
||||
install_sh = @install_sh@
|
||||
krb5rundir = @krb5rundir@
|
||||
libdir = @libdir@
|
||||
libexecdir = @libexecdir@
|
||||
localedir = @localedir@
|
||||
localstatedir = @localstatedir@
|
||||
mandir = @mandir@
|
||||
mkdir_p = @mkdir_p@
|
||||
oldincludedir = @oldincludedir@
|
||||
pdfdir = @pdfdir@
|
||||
pkgpyexecdir = @pkgpyexecdir@
|
||||
pkgpythondir = @pkgpythondir@
|
||||
prefix = @prefix@
|
||||
program_transform_name = @program_transform_name@
|
||||
psdir = @psdir@
|
||||
pyexecdir = @pyexecdir@
|
||||
pythondir = @pythondir@
|
||||
sbindir = @sbindir@
|
||||
sharedstatedir = @sharedstatedir@
|
||||
srcdir = @srcdir@
|
||||
sysconfdir = @sysconfdir@
|
||||
sysconfenvdir = @sysconfenvdir@
|
||||
systemdsystemunitdir = @systemdsystemunitdir@
|
||||
systemdtmpfilesdir = @systemdtmpfilesdir@
|
||||
target_alias = @target_alias@
|
||||
top_build_prefix = @top_build_prefix@
|
||||
top_builddir = @top_builddir@
|
||||
top_srcdir = @top_srcdir@
|
||||
NULL =
|
||||
SUBDIRS = \
|
||||
man \
|
||||
$(NULL)
|
||||
|
||||
dist_sbin_SCRIPTS = \
|
||||
ipa-ca-install \
|
||||
ipa-dns-install \
|
||||
ipa-kra-install \
|
||||
ipa-server-install \
|
||||
ipa-adtrust-install \
|
||||
ipa-replica-conncheck \
|
||||
ipa-replica-install \
|
||||
ipa-replica-prepare \
|
||||
ipa-replica-manage \
|
||||
ipa-csreplica-manage \
|
||||
ipa-server-certinstall \
|
||||
ipa-server-upgrade \
|
||||
ipactl \
|
||||
ipa-compat-manage \
|
||||
ipa-nis-manage \
|
||||
ipa-managed-entries \
|
||||
ipa-ldap-updater \
|
||||
ipa-otptoken-import \
|
||||
ipa-backup \
|
||||
ipa-restore \
|
||||
ipa-advise \
|
||||
ipa-cacert-manage \
|
||||
ipa-winsync-migrate \
|
||||
ipa-pkinit-manage \
|
||||
$(NULL)
|
||||
|
||||
appdir = $(libexecdir)/ipa/
|
||||
dist_app_SCRIPTS = \
|
||||
ipa-custodia \
|
||||
ipa-custodia-check \
|
||||
ipa-httpd-kdcproxy \
|
||||
ipa-pki-retrieve-key \
|
||||
$(NULL)
|
||||
|
||||
all: all-recursive
|
||||
|
||||
.SUFFIXES:
|
||||
$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
|
||||
@for dep in $?; do \
|
||||
case '$(am__configure_deps)' in \
|
||||
*$$dep*) \
|
||||
( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
|
||||
&& { if test -f $@; then exit 0; else break; fi; }; \
|
||||
exit 1;; \
|
||||
esac; \
|
||||
done; \
|
||||
echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign install/tools/Makefile'; \
|
||||
$(am__cd) $(top_srcdir) && \
|
||||
$(AUTOMAKE) --foreign install/tools/Makefile
|
||||
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
|
||||
@case '$?' in \
|
||||
*config.status*) \
|
||||
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
|
||||
*) \
|
||||
echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
|
||||
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
|
||||
esac;
|
||||
|
||||
$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
|
||||
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
|
||||
|
||||
$(top_srcdir)/configure: $(am__configure_deps)
|
||||
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
|
||||
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
|
||||
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
|
||||
$(am__aclocal_m4_deps):
|
||||
install-dist_appSCRIPTS: $(dist_app_SCRIPTS)
|
||||
@$(NORMAL_INSTALL)
|
||||
@list='$(dist_app_SCRIPTS)'; test -n "$(appdir)" || list=; \
|
||||
if test -n "$$list"; then \
|
||||
echo " $(MKDIR_P) '$(DESTDIR)$(appdir)'"; \
|
||||
$(MKDIR_P) "$(DESTDIR)$(appdir)" || exit 1; \
|
||||
fi; \
|
||||
for p in $$list; do \
|
||||
if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
|
||||
if test -f "$$d$$p"; then echo "$$d$$p"; echo "$$p"; else :; fi; \
|
||||
done | \
|
||||
sed -e 'p;s,.*/,,;n' \
|
||||
-e 'h;s|.*|.|' \
|
||||
-e 'p;x;s,.*/,,;$(transform)' | sed 'N;N;N;s,\n, ,g' | \
|
||||
$(AWK) 'BEGIN { files["."] = ""; dirs["."] = 1; } \
|
||||
{ d=$$3; if (dirs[d] != 1) { print "d", d; dirs[d] = 1 } \
|
||||
if ($$2 == $$4) { files[d] = files[d] " " $$1; \
|
||||
if (++n[d] == $(am__install_max)) { \
|
||||
print "f", d, files[d]; n[d] = 0; files[d] = "" } } \
|
||||
else { print "f", d "/" $$4, $$1 } } \
|
||||
END { for (d in files) print "f", d, files[d] }' | \
|
||||
while read type dir files; do \
|
||||
if test "$$dir" = .; then dir=; else dir=/$$dir; fi; \
|
||||
test -z "$$files" || { \
|
||||
echo " $(INSTALL_SCRIPT) $$files '$(DESTDIR)$(appdir)$$dir'"; \
|
||||
$(INSTALL_SCRIPT) $$files "$(DESTDIR)$(appdir)$$dir" || exit $$?; \
|
||||
} \
|
||||
; done
|
||||
|
||||
uninstall-dist_appSCRIPTS:
|
||||
@$(NORMAL_UNINSTALL)
|
||||
@list='$(dist_app_SCRIPTS)'; test -n "$(appdir)" || exit 0; \
|
||||
files=`for p in $$list; do echo "$$p"; done | \
|
||||
sed -e 's,.*/,,;$(transform)'`; \
|
||||
dir='$(DESTDIR)$(appdir)'; $(am__uninstall_files_from_dir)
|
||||
install-dist_sbinSCRIPTS: $(dist_sbin_SCRIPTS)
|
||||
@$(NORMAL_INSTALL)
|
||||
@list='$(dist_sbin_SCRIPTS)'; test -n "$(sbindir)" || list=; \
|
||||
if test -n "$$list"; then \
|
||||
echo " $(MKDIR_P) '$(DESTDIR)$(sbindir)'"; \
|
||||
$(MKDIR_P) "$(DESTDIR)$(sbindir)" || exit 1; \
|
||||
fi; \
|
||||
for p in $$list; do \
|
||||
if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
|
||||
if test -f "$$d$$p"; then echo "$$d$$p"; echo "$$p"; else :; fi; \
|
||||
done | \
|
||||
sed -e 'p;s,.*/,,;n' \
|
||||
-e 'h;s|.*|.|' \
|
||||
-e 'p;x;s,.*/,,;$(transform)' | sed 'N;N;N;s,\n, ,g' | \
|
||||
$(AWK) 'BEGIN { files["."] = ""; dirs["."] = 1; } \
|
||||
{ d=$$3; if (dirs[d] != 1) { print "d", d; dirs[d] = 1 } \
|
||||
if ($$2 == $$4) { files[d] = files[d] " " $$1; \
|
||||
if (++n[d] == $(am__install_max)) { \
|
||||
print "f", d, files[d]; n[d] = 0; files[d] = "" } } \
|
||||
else { print "f", d "/" $$4, $$1 } } \
|
||||
END { for (d in files) print "f", d, files[d] }' | \
|
||||
while read type dir files; do \
|
||||
if test "$$dir" = .; then dir=; else dir=/$$dir; fi; \
|
||||
test -z "$$files" || { \
|
||||
echo " $(INSTALL_SCRIPT) $$files '$(DESTDIR)$(sbindir)$$dir'"; \
|
||||
$(INSTALL_SCRIPT) $$files "$(DESTDIR)$(sbindir)$$dir" || exit $$?; \
|
||||
} \
|
||||
; done
|
||||
|
||||
uninstall-dist_sbinSCRIPTS:
|
||||
@$(NORMAL_UNINSTALL)
|
||||
@list='$(dist_sbin_SCRIPTS)'; test -n "$(sbindir)" || exit 0; \
|
||||
files=`for p in $$list; do echo "$$p"; done | \
|
||||
sed -e 's,.*/,,;$(transform)'`; \
|
||||
dir='$(DESTDIR)$(sbindir)'; $(am__uninstall_files_from_dir)
|
||||
|
||||
mostlyclean-libtool:
|
||||
-rm -f *.lo
|
||||
|
||||
clean-libtool:
|
||||
-rm -rf .libs _libs
|
||||
|
||||
# This directory's subdirectories are mostly independent; you can cd
|
||||
# into them and run 'make' without going through this Makefile.
|
||||
# To change the values of 'make' variables: instead of editing Makefiles,
|
||||
# (1) if the variable is set in 'config.status', edit 'config.status'
|
||||
# (which will cause the Makefiles to be regenerated when you run 'make');
|
||||
# (2) otherwise, pass the desired values on the 'make' command line.
|
||||
$(am__recursive_targets):
|
||||
@fail=; \
|
||||
if $(am__make_keepgoing); then \
|
||||
failcom='fail=yes'; \
|
||||
else \
|
||||
failcom='exit 1'; \
|
||||
fi; \
|
||||
dot_seen=no; \
|
||||
target=`echo $@ | sed s/-recursive//`; \
|
||||
case "$@" in \
|
||||
distclean-* | maintainer-clean-*) list='$(DIST_SUBDIRS)' ;; \
|
||||
*) list='$(SUBDIRS)' ;; \
|
||||
esac; \
|
||||
for subdir in $$list; do \
|
||||
echo "Making $$target in $$subdir"; \
|
||||
if test "$$subdir" = "."; then \
|
||||
dot_seen=yes; \
|
||||
local_target="$$target-am"; \
|
||||
else \
|
||||
local_target="$$target"; \
|
||||
fi; \
|
||||
($(am__cd) $$subdir && $(MAKE) $(AM_MAKEFLAGS) $$local_target) \
|
||||
|| eval $$failcom; \
|
||||
done; \
|
||||
if test "$$dot_seen" = "no"; then \
|
||||
$(MAKE) $(AM_MAKEFLAGS) "$$target-am" || exit 1; \
|
||||
fi; test -z "$$fail"
|
||||
|
||||
ID: $(am__tagged_files)
|
||||
$(am__define_uniq_tagged_files); mkid -fID $$unique
|
||||
tags: tags-recursive
|
||||
TAGS: tags
|
||||
|
||||
tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
|
||||
set x; \
|
||||
here=`pwd`; \
|
||||
if ($(ETAGS) --etags-include --version) >/dev/null 2>&1; then \
|
||||
include_option=--etags-include; \
|
||||
empty_fix=.; \
|
||||
else \
|
||||
include_option=--include; \
|
||||
empty_fix=; \
|
||||
fi; \
|
||||
list='$(SUBDIRS)'; for subdir in $$list; do \
|
||||
if test "$$subdir" = .; then :; else \
|
||||
test ! -f $$subdir/TAGS || \
|
||||
set "$$@" "$$include_option=$$here/$$subdir/TAGS"; \
|
||||
fi; \
|
||||
done; \
|
||||
$(am__define_uniq_tagged_files); \
|
||||
shift; \
|
||||
if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
|
||||
test -n "$$unique" || unique=$$empty_fix; \
|
||||
if test $$# -gt 0; then \
|
||||
$(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
|
||||
"$$@" $$unique; \
|
||||
else \
|
||||
$(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
|
||||
$$unique; \
|
||||
fi; \
|
||||
fi
|
||||
ctags: ctags-recursive
|
||||
|
||||
CTAGS: ctags
|
||||
ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
|
||||
$(am__define_uniq_tagged_files); \
|
||||
test -z "$(CTAGS_ARGS)$$unique" \
|
||||
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
|
||||
$$unique
|
||||
|
||||
GTAGS:
|
||||
here=`$(am__cd) $(top_builddir) && pwd` \
|
||||
&& $(am__cd) $(top_srcdir) \
|
||||
&& gtags -i $(GTAGS_ARGS) "$$here"
|
||||
cscopelist: cscopelist-recursive
|
||||
|
||||
cscopelist-am: $(am__tagged_files)
|
||||
list='$(am__tagged_files)'; \
|
||||
case "$(srcdir)" in \
|
||||
[\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \
|
||||
*) sdir=$(subdir)/$(srcdir) ;; \
|
||||
esac; \
|
||||
for i in $$list; do \
|
||||
if test -f "$$i"; then \
|
||||
echo "$(subdir)/$$i"; \
|
||||
else \
|
||||
echo "$$sdir/$$i"; \
|
||||
fi; \
|
||||
done >> $(top_builddir)/cscope.files
|
||||
|
||||
distclean-tags:
|
||||
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
|
||||
|
||||
distdir: $(DISTFILES)
|
||||
@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
|
||||
topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
|
||||
list='$(DISTFILES)'; \
|
||||
dist_files=`for file in $$list; do echo $$file; done | \
|
||||
sed -e "s|^$$srcdirstrip/||;t" \
|
||||
-e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
|
||||
case $$dist_files in \
|
||||
*/*) $(MKDIR_P) `echo "$$dist_files" | \
|
||||
sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
|
||||
sort -u` ;; \
|
||||
esac; \
|
||||
for file in $$dist_files; do \
|
||||
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
|
||||
if test -d $$d/$$file; then \
|
||||
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
|
||||
if test -d "$(distdir)/$$file"; then \
|
||||
find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
|
||||
fi; \
|
||||
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
|
||||
cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
|
||||
find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
|
||||
fi; \
|
||||
cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
|
||||
else \
|
||||
test -f "$(distdir)/$$file" \
|
||||
|| cp -p $$d/$$file "$(distdir)/$$file" \
|
||||
|| exit 1; \
|
||||
fi; \
|
||||
done
|
||||
@list='$(DIST_SUBDIRS)'; for subdir in $$list; do \
|
||||
if test "$$subdir" = .; then :; else \
|
||||
$(am__make_dryrun) \
|
||||
|| test -d "$(distdir)/$$subdir" \
|
||||
|| $(MKDIR_P) "$(distdir)/$$subdir" \
|
||||
|| exit 1; \
|
||||
dir1=$$subdir; dir2="$(distdir)/$$subdir"; \
|
||||
$(am__relativize); \
|
||||
new_distdir=$$reldir; \
|
||||
dir1=$$subdir; dir2="$(top_distdir)"; \
|
||||
$(am__relativize); \
|
||||
new_top_distdir=$$reldir; \
|
||||
echo " (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) top_distdir="$$new_top_distdir" distdir="$$new_distdir" \\"; \
|
||||
echo " am__remove_distdir=: am__skip_length_check=: am__skip_mode_fix=: distdir)"; \
|
||||
($(am__cd) $$subdir && \
|
||||
$(MAKE) $(AM_MAKEFLAGS) \
|
||||
top_distdir="$$new_top_distdir" \
|
||||
distdir="$$new_distdir" \
|
||||
am__remove_distdir=: \
|
||||
am__skip_length_check=: \
|
||||
am__skip_mode_fix=: \
|
||||
distdir) \
|
||||
|| exit 1; \
|
||||
fi; \
|
||||
done
|
||||
check-am: all-am
|
||||
check: check-recursive
|
||||
all-am: Makefile $(SCRIPTS)
|
||||
installdirs: installdirs-recursive
|
||||
installdirs-am:
|
||||
for dir in "$(DESTDIR)$(appdir)" "$(DESTDIR)$(sbindir)"; do \
|
||||
test -z "$$dir" || $(MKDIR_P) "$$dir"; \
|
||||
done
|
||||
install: install-recursive
|
||||
install-exec: install-exec-recursive
|
||||
install-data: install-data-recursive
|
||||
uninstall: uninstall-recursive
|
||||
|
||||
install-am: all-am
|
||||
@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
|
||||
|
||||
installcheck: installcheck-recursive
|
||||
install-strip:
|
||||
if test -z '$(STRIP)'; then \
|
||||
$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
|
||||
install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
|
||||
install; \
|
||||
else \
|
||||
$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
|
||||
install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
|
||||
"INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
|
||||
fi
|
||||
mostlyclean-generic:
|
||||
|
||||
clean-generic:
|
||||
|
||||
distclean-generic:
|
||||
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
|
||||
-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
|
||||
|
||||
maintainer-clean-generic:
|
||||
@echo "This command is intended for maintainers to use"
|
||||
@echo "it deletes files that may require special tools to rebuild."
|
||||
clean: clean-recursive
|
||||
|
||||
clean-am: clean-generic clean-libtool mostlyclean-am
|
||||
|
||||
distclean: distclean-recursive
|
||||
-rm -f Makefile
|
||||
distclean-am: clean-am distclean-generic distclean-tags
|
||||
|
||||
dvi: dvi-recursive
|
||||
|
||||
dvi-am:
|
||||
|
||||
html: html-recursive
|
||||
|
||||
html-am:
|
||||
|
||||
info: info-recursive
|
||||
|
||||
info-am:
|
||||
|
||||
install-data-am: install-dist_appSCRIPTS
|
||||
|
||||
install-dvi: install-dvi-recursive
|
||||
|
||||
install-dvi-am:
|
||||
|
||||
install-exec-am: install-dist_sbinSCRIPTS
|
||||
|
||||
install-html: install-html-recursive
|
||||
|
||||
install-html-am:
|
||||
|
||||
install-info: install-info-recursive
|
||||
|
||||
install-info-am:
|
||||
|
||||
install-man:
|
||||
|
||||
install-pdf: install-pdf-recursive
|
||||
|
||||
install-pdf-am:
|
||||
|
||||
install-ps: install-ps-recursive
|
||||
|
||||
install-ps-am:
|
||||
|
||||
installcheck-am:
|
||||
|
||||
maintainer-clean: maintainer-clean-recursive
|
||||
-rm -f Makefile
|
||||
maintainer-clean-am: distclean-am maintainer-clean-generic
|
||||
|
||||
mostlyclean: mostlyclean-recursive
|
||||
|
||||
mostlyclean-am: mostlyclean-generic mostlyclean-libtool
|
||||
|
||||
pdf: pdf-recursive
|
||||
|
||||
pdf-am:
|
||||
|
||||
ps: ps-recursive
|
||||
|
||||
ps-am:
|
||||
|
||||
uninstall-am: uninstall-dist_appSCRIPTS uninstall-dist_sbinSCRIPTS
|
||||
|
||||
.MAKE: $(am__recursive_targets) install-am install-strip
|
||||
|
||||
.PHONY: $(am__recursive_targets) CTAGS GTAGS TAGS all all-am check \
|
||||
check-am clean clean-generic clean-libtool cscopelist-am ctags \
|
||||
ctags-am distclean distclean-generic distclean-libtool \
|
||||
distclean-tags distdir dvi dvi-am html html-am info info-am \
|
||||
install install-am install-data install-data-am \
|
||||
install-dist_appSCRIPTS install-dist_sbinSCRIPTS install-dvi \
|
||||
install-dvi-am install-exec install-exec-am install-html \
|
||||
install-html-am install-info install-info-am install-man \
|
||||
install-pdf install-pdf-am install-ps install-ps-am \
|
||||
install-strip installcheck installcheck-am installdirs \
|
||||
installdirs-am maintainer-clean maintainer-clean-generic \
|
||||
mostlyclean mostlyclean-generic mostlyclean-libtool pdf pdf-am \
|
||||
ps ps-am tags tags-am uninstall uninstall-am \
|
||||
uninstall-dist_appSCRIPTS uninstall-dist_sbinSCRIPTS
|
||||
|
||||
.PRECIOUS: Makefile
|
||||
|
||||
|
||||
# Tell versions [3.59,3.63) of GNU make to not export all variables.
|
||||
# Otherwise a system limit (for SysV at least) may be exceeded.
|
||||
.NOEXPORT:
|
||||
254
install/tools/ipa-adtrust-install
Executable file
254
install/tools/ipa-adtrust-install
Executable file
@@ -0,0 +1,254 @@
|
||||
#! /usr/bin/python2
|
||||
#
|
||||
# Authors: Sumit Bose <sbose@redhat.com>
|
||||
# Based on ipa-server-install by Karl MacMillan <kmacmillan@mentalrootkit.com>
|
||||
# and ipa-dns-install by Martin Nagy
|
||||
#
|
||||
# Copyright (C) 2011 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
from __future__ import print_function
|
||||
|
||||
import logging
|
||||
import os
|
||||
import sys
|
||||
|
||||
import six
|
||||
|
||||
from optparse import SUPPRESS_HELP # pylint: disable=deprecated-module
|
||||
|
||||
from ipalib.install import sysrestore
|
||||
from ipaserver.install import adtrust
|
||||
from ipaserver.install.installutils import (
|
||||
read_password,
|
||||
check_server_configuration,
|
||||
run_script)
|
||||
from ipapython.admintool import ScriptError
|
||||
from ipapython import version
|
||||
from ipapython import ipautil
|
||||
from ipalib import api, errors, krb_utils
|
||||
from ipapython.config import IPAOptionParser
|
||||
from ipaplatform.paths import paths
|
||||
from ipapython.ipa_log_manager import standard_logging_setup
|
||||
|
||||
if six.PY3:
|
||||
unicode = str
|
||||
|
||||
logger = logging.getLogger(os.path.basename(__file__))
|
||||
|
||||
log_file_name = paths.IPASERVER_INSTALL_LOG
|
||||
|
||||
|
||||
def parse_options():
|
||||
parser = IPAOptionParser(version=version.VERSION)
|
||||
parser.add_option("-d", "--debug", dest="debug", action="store_true",
|
||||
default=False, help="print debugging information")
|
||||
parser.add_option("--netbios-name", dest="netbios_name",
|
||||
help="NetBIOS name of the IPA domain")
|
||||
|
||||
# no-msdcs has not effect, option is here just for backward compatibility
|
||||
parser.add_option("--no-msdcs", dest="no_msdcs", action="store_true",
|
||||
default=False, help=SUPPRESS_HELP)
|
||||
|
||||
parser.add_option("--rid-base", dest="rid_base", type=int, default=1000,
|
||||
help="Start value for mapping UIDs and GIDs to RIDs")
|
||||
parser.add_option("--secondary-rid-base", dest="secondary_rid_base",
|
||||
type=int, default=100000000,
|
||||
help="Start value of the secondary range for mapping "
|
||||
"UIDs and GIDs to RIDs")
|
||||
parser.add_option("-U", "--unattended", dest="unattended",
|
||||
action="store_true",
|
||||
default=False,
|
||||
help="unattended installation never prompts the user")
|
||||
parser.add_option("-a", "--admin-password",
|
||||
sensitive=True, dest="admin_password",
|
||||
help="admin user kerberos password")
|
||||
parser.add_option("-A", "--admin-name",
|
||||
sensitive=True, dest="admin_name", default='admin',
|
||||
help="admin user principal")
|
||||
parser.add_option("--add-sids", dest="add_sids", action="store_true",
|
||||
default=False, help="Add SIDs for existing users and"
|
||||
" groups as the final step")
|
||||
parser.add_option("--add-agents", dest="add_agents", action="store_true",
|
||||
default=False,
|
||||
help="Add IPA masters to a list of hosts allowed to "
|
||||
"serve information about users from trusted forests")
|
||||
parser.add_option("--enable-compat",
|
||||
dest="enable_compat", default=False, action="store_true",
|
||||
help="Enable support for trusted domains for old "
|
||||
"clients")
|
||||
|
||||
options, _args = parser.parse_args()
|
||||
safe_options = parser.get_safe_opts(options)
|
||||
|
||||
return safe_options, options
|
||||
|
||||
|
||||
def read_admin_password(admin_name):
|
||||
print("Configuring cross-realm trusts for IPA server requires password "
|
||||
"for user '%s'." % (admin_name))
|
||||
print("This user is a regular system account used for IPA server "
|
||||
"administration.")
|
||||
print("")
|
||||
admin_password = read_password(admin_name, confirm=False, validate=None)
|
||||
return admin_password
|
||||
|
||||
|
||||
def ensure_admin_kinit(admin_name, admin_password):
|
||||
try:
|
||||
ipautil.run(['kinit', admin_name], stdin=admin_password+'\n')
|
||||
except ipautil.CalledProcessError:
|
||||
print("There was error to automatically re-kinit your admin user "
|
||||
"ticket.")
|
||||
return False
|
||||
return True
|
||||
|
||||
|
||||
def main():
|
||||
safe_options, options = parse_options()
|
||||
|
||||
if os.getegid() != 0:
|
||||
raise ScriptError("Must be root to setup AD trusts on server")
|
||||
|
||||
standard_logging_setup(log_file_name, debug=options.debug, filemode='a')
|
||||
print("\nThe log file for this installation can be found in %s"
|
||||
% log_file_name)
|
||||
|
||||
logger.debug('%s was invoked with options: %s', sys.argv[0], safe_options)
|
||||
logger.debug(
|
||||
"missing options might be asked for interactively later\n")
|
||||
logger.debug('IPA version %s', version.VENDOR_VERSION)
|
||||
|
||||
check_server_configuration()
|
||||
|
||||
fstore = sysrestore.FileStore(paths.SYSRESTORE)
|
||||
|
||||
print("================================================================"
|
||||
"==============")
|
||||
print("This program will setup components needed to establish trust to "
|
||||
"AD domains for")
|
||||
print("the FreeIPA Server.")
|
||||
print("")
|
||||
print("This includes:")
|
||||
print(" * Configure Samba")
|
||||
print(" * Add trust related objects to FreeIPA LDAP server")
|
||||
# TODO:
|
||||
# print " * Add a SID to all users and Posix groups"
|
||||
print("")
|
||||
print("To accept the default shown in brackets, press the Enter key.")
|
||||
print("")
|
||||
|
||||
# Check if samba packages are installed
|
||||
# the same check is in the adtrust module but we must fail first if the
|
||||
# package is missing
|
||||
adtrust.check_for_installed_deps()
|
||||
|
||||
# Initialize the ipalib api
|
||||
api.bootstrap(
|
||||
in_server=True,
|
||||
debug=options.debug,
|
||||
context='install',
|
||||
confdir=paths.ETC_IPA
|
||||
)
|
||||
api.finalize()
|
||||
|
||||
admin_password = options.admin_password
|
||||
if not (options.unattended or admin_password):
|
||||
admin_password = read_admin_password(options.admin_name)
|
||||
|
||||
admin_kinited = None
|
||||
if admin_password:
|
||||
admin_kinited = ensure_admin_kinit(options.admin_name, admin_password)
|
||||
if not admin_kinited:
|
||||
print("Proceeding with credentials that existed before")
|
||||
|
||||
try:
|
||||
principal = krb_utils.get_principal()
|
||||
except errors.CCacheError as e:
|
||||
raise ScriptError(
|
||||
"Must have Kerberos credentials to setup AD trusts on server: "
|
||||
"{err}".format(err=e))
|
||||
|
||||
try:
|
||||
api.Backend.ldap2.connect()
|
||||
except errors.ACIError:
|
||||
raise ScriptError(
|
||||
"Outdated Kerberos credentials. "
|
||||
"Use kdestroy and kinit to update your ticket")
|
||||
except errors.DatabaseError:
|
||||
raise ScriptError(
|
||||
"Cannot connect to the LDAP database. Please check if IPA "
|
||||
"is running")
|
||||
|
||||
try:
|
||||
user = api.Command.user_show(
|
||||
principal.partition('@')[0].partition('/')[0])['result']
|
||||
group = api.Command.group_show(u'admins')['result']
|
||||
if not (user['uid'][0] in group['member_user'] and
|
||||
group['cn'][0] in user['memberof_group']):
|
||||
raise errors.RequirementError(name='admins group membership')
|
||||
except errors.RequirementError as e:
|
||||
raise ScriptError(
|
||||
"Must have administrative privileges to setup AD trusts on server"
|
||||
)
|
||||
except Exception as e:
|
||||
raise ScriptError(
|
||||
"Unrecognized error during check of admin rights: %s" % e)
|
||||
|
||||
adtrust.install_check(True, options, api)
|
||||
adtrust.install(True, options, fstore, api)
|
||||
|
||||
print("""
|
||||
=============================================================================
|
||||
Setup complete
|
||||
|
||||
You must make sure these network ports are open:
|
||||
\tTCP Ports:
|
||||
\t * 135: epmap
|
||||
\t * 138: netbios-dgm
|
||||
\t * 139: netbios-ssn
|
||||
\t * 445: microsoft-ds
|
||||
\t * 1024..1300: epmap listener range
|
||||
\t * 3268: msft-gc
|
||||
\tUDP Ports:
|
||||
\t * 138: netbios-dgm
|
||||
\t * 139: netbios-ssn
|
||||
\t * 389: (C)LDAP
|
||||
\t * 445: microsoft-ds
|
||||
|
||||
See the ipa-adtrust-install(1) man page for more details
|
||||
|
||||
=============================================================================
|
||||
""")
|
||||
if admin_password:
|
||||
admin_kinited = ensure_admin_kinit(options.admin_name, admin_password)
|
||||
|
||||
if not admin_kinited:
|
||||
print("""
|
||||
WARNING: you MUST re-kinit admin user before using 'ipa trust-*' commands
|
||||
family in order to re-generate Kerberos tickets to include AD-specific
|
||||
information""")
|
||||
|
||||
api.Backend.ldap2.disconnect()
|
||||
|
||||
return 0
|
||||
|
||||
if __name__ == '__main__':
|
||||
run_script(
|
||||
main,
|
||||
log_file_name=log_file_name,
|
||||
operation_name='ipa-adtrust-install')
|
||||
23
install/tools/ipa-advise
Executable file
23
install/tools/ipa-advise
Executable file
@@ -0,0 +1,23 @@
|
||||
#! /usr/bin/python2 -E
|
||||
# Authors: Tomas Babej <tbabej@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2013 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
from ipaserver.advise.base import IpaAdvise
|
||||
|
||||
IpaAdvise.run_cli()
|
||||
23
install/tools/ipa-backup
Executable file
23
install/tools/ipa-backup
Executable file
@@ -0,0 +1,23 @@
|
||||
#! /usr/bin/python2 -E
|
||||
# Authors: Rob Crittenden <rcritten@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2013 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
from ipaserver.install.ipa_backup import Backup
|
||||
|
||||
Backup.run_cli()
|
||||
354
install/tools/ipa-ca-install
Executable file
354
install/tools/ipa-ca-install
Executable file
@@ -0,0 +1,354 @@
|
||||
#! /usr/bin/python2 -E
|
||||
# Authors: Rob Crittenden <rcritten@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2011 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import logging
|
||||
import sys
|
||||
import os
|
||||
import shutil
|
||||
import tempfile
|
||||
|
||||
from ipalib.install.kinit import kinit_keytab
|
||||
from ipapython import ipautil
|
||||
|
||||
from ipaclient.install import ipa_certupdate
|
||||
from ipaserver.install import installutils
|
||||
from ipaserver.install.installutils import create_replica_config
|
||||
from ipaserver.install.installutils import check_creds, ReplicaConfig
|
||||
from ipaserver.install import dsinstance, ca
|
||||
from ipaserver.install import cainstance, service
|
||||
from ipapython import version
|
||||
from ipalib import api
|
||||
from ipalib.constants import DOMAIN_LEVEL_0
|
||||
from ipapython.config import IPAOptionParser
|
||||
from ipapython.ipa_log_manager import standard_logging_setup
|
||||
from ipaplatform.paths import paths
|
||||
|
||||
logger = logging.getLogger(os.path.basename(__file__))
|
||||
|
||||
log_file_name = paths.IPAREPLICA_CA_INSTALL_LOG
|
||||
REPLICA_INFO_TOP_DIR = None
|
||||
|
||||
def parse_options():
|
||||
usage = "%prog [options] [REPLICA_FILE]"
|
||||
parser = IPAOptionParser(usage=usage, version=version.VERSION)
|
||||
parser.add_option("-d", "--debug", dest="debug", action="store_true",
|
||||
default=False, help="gather extra debugging information")
|
||||
parser.add_option("-p", "--password", dest="password", sensitive=True,
|
||||
help="Directory Manager (existing master) password")
|
||||
parser.add_option("-w", "--admin-password", dest="admin_password", sensitive=True,
|
||||
help="Admin user Kerberos password used for connection check")
|
||||
parser.add_option("--no-host-dns", dest="no_host_dns", action="store_true",
|
||||
default=False,
|
||||
help="Do not use DNS for hostname lookup during installation")
|
||||
parser.add_option("--skip-conncheck", dest="skip_conncheck", action="store_true",
|
||||
default=False, help="skip connection check to remote master")
|
||||
parser.add_option("--skip-schema-check", dest="skip_schema_check", action="store_true",
|
||||
default=False, help="skip check for updated CA DS schema on the remote master")
|
||||
parser.add_option("-U", "--unattended", dest="unattended", action="store_true",
|
||||
default=False, help="unattended installation never prompts the user")
|
||||
parser.add_option("--external-ca", dest="external_ca", action="store_true",
|
||||
default=False, help="Generate a CSR to be signed by an external CA")
|
||||
ext_cas = tuple(x.value for x in cainstance.ExternalCAType)
|
||||
parser.add_option("--external-ca-type", dest="external_ca_type",
|
||||
type="choice", choices=ext_cas,
|
||||
metavar="{{{0}}}".format(",".join(ext_cas)),
|
||||
help="Type of the external CA. Default: generic")
|
||||
parser.add_option("--external-ca-profile", dest="external_ca_profile",
|
||||
type='constructor', constructor=cainstance.ExternalCAProfile,
|
||||
default=None, metavar="PROFILE-SPEC",
|
||||
help="Specify the certificate profile/template to use "
|
||||
"at the external CA")
|
||||
parser.add_option("--external-cert-file", dest="external_cert_files",
|
||||
action="append", metavar="FILE",
|
||||
help="File containing the IPA CA certificate and the external CA certificate chain")
|
||||
ca_algos = ('SHA1withRSA', 'SHA256withRSA', 'SHA512withRSA')
|
||||
parser.add_option("--ca-signing-algorithm", dest="ca_signing_algorithm",
|
||||
type="choice", choices=ca_algos,
|
||||
metavar="{{{0}}}".format(",".join(ca_algos)),
|
||||
help="Signing algorithm of the IPA CA certificate")
|
||||
parser.add_option("-P", "--principal", dest="principal", sensitive=True,
|
||||
default=None, help="User allowed to manage replicas")
|
||||
parser.add_option("--subject-base", dest="subject_base",
|
||||
default=None,
|
||||
help=(
|
||||
"The certificate subject base "
|
||||
"(default O=<realm-name>). "
|
||||
"RDNs are in LDAP order (most specific RDN first)."))
|
||||
parser.add_option("--ca-subject", dest="ca_subject",
|
||||
default=None,
|
||||
help=(
|
||||
"The CA certificate subject DN "
|
||||
"(default CN=Certificate Authority,O=<realm-name>). "
|
||||
"RDNs are in LDAP order (most specific RDN first)."))
|
||||
|
||||
options, args = parser.parse_args()
|
||||
safe_options = parser.get_safe_opts(options)
|
||||
|
||||
if args:
|
||||
filename = args[0]
|
||||
|
||||
if len(args) != 1:
|
||||
parser.error("you must provide a file generated by "
|
||||
"ipa-replica-prepare")
|
||||
|
||||
options.external_ca = None
|
||||
options.external_cert_files = None
|
||||
else:
|
||||
filename = None
|
||||
|
||||
if options.external_ca:
|
||||
if options.external_cert_files:
|
||||
parser.error("You cannot specify --external-cert-file "
|
||||
"together with --external-ca")
|
||||
|
||||
if options.external_ca_type and not options.external_ca:
|
||||
parser.error(
|
||||
"You cannot specify --external-ca-type without --external-ca")
|
||||
|
||||
if options.external_ca_profile and not options.external_ca:
|
||||
parser.error(
|
||||
"You cannot specify --external-ca-profile "
|
||||
"without --external-ca")
|
||||
|
||||
return safe_options, options, filename
|
||||
|
||||
|
||||
def _get_dirman_password(password=None, unattended=False):
|
||||
# sys.exit() is used on purpose, because otherwise user is advised to
|
||||
# uninstall the component, even though it is not needed
|
||||
if not password:
|
||||
if unattended:
|
||||
sys.exit('Directory Manager password required')
|
||||
password = installutils.read_password(
|
||||
"Directory Manager (existing master)", confirm=False,
|
||||
validate=False)
|
||||
try:
|
||||
installutils.validate_dm_password_ldap(password)
|
||||
except ValueError:
|
||||
sys.exit("Directory Manager password is invalid")
|
||||
|
||||
return password
|
||||
|
||||
|
||||
def install_replica(safe_options, options, filename):
|
||||
if options.ca_subject:
|
||||
sys.exit("--ca-subject cannot be used when installing a CA replica")
|
||||
if options.subject_base:
|
||||
sys.exit("--subject-base cannot be used when installing a CA replica")
|
||||
|
||||
if options.promote:
|
||||
if filename is not None:
|
||||
sys.exit("Too many parameters provided. "
|
||||
"No replica file is required")
|
||||
else:
|
||||
if filename is None:
|
||||
sys.exit("A replica file is required")
|
||||
if not os.path.isfile(filename):
|
||||
sys.exit("Replica file %s does not exist" % filename)
|
||||
|
||||
if not options.promote:
|
||||
# Check if we have admin creds already, otherwise acquire them
|
||||
check_creds(options, api.env.realm)
|
||||
|
||||
# get the directory manager password
|
||||
dirman_password = _get_dirman_password(
|
||||
options.password, options.unattended)
|
||||
|
||||
if (not options.promote and not options.admin_password and
|
||||
not options.skip_conncheck and options.unattended):
|
||||
sys.exit('admin password required')
|
||||
|
||||
# Run ipa-certupdate to ensure we have the CA cert. This is
|
||||
# necessary if the admin has just promoted the topology from
|
||||
# CA-less to CA-ful, and ipa-certupdate has not been run yet.
|
||||
ipa_certupdate.run_with_args(api)
|
||||
|
||||
# CertUpdate restarts DS causing broken pipe on the original
|
||||
# connection, so reconnect the backend.
|
||||
api.Backend.ldap2.disconnect()
|
||||
api.Backend.ldap2.connect()
|
||||
|
||||
if options.promote:
|
||||
config = ReplicaConfig()
|
||||
config.ca_host_name = None
|
||||
config.realm_name = api.env.realm
|
||||
config.host_name = api.env.host
|
||||
config.domain_name = api.env.domain
|
||||
config.dirman_password = dirman_password
|
||||
config.ca_ds_port = 389
|
||||
config.top_dir = tempfile.mkdtemp("ipa")
|
||||
config.dir = config.top_dir
|
||||
cafile = paths.IPA_CA_CRT
|
||||
else:
|
||||
config = create_replica_config(dirman_password, filename, options)
|
||||
config.ca_host_name = config.master_host_name
|
||||
cafile = config.dir + '/ca.crt'
|
||||
|
||||
global REPLICA_INFO_TOP_DIR
|
||||
REPLICA_INFO_TOP_DIR = config.top_dir
|
||||
config.setup_ca = True
|
||||
|
||||
if config.subject_base is None:
|
||||
attrs = api.Backend.ldap2.get_ipa_config()
|
||||
config.subject_base = attrs.get('ipacertificatesubjectbase')[0]
|
||||
|
||||
if config.ca_host_name is None:
|
||||
config.ca_host_name = \
|
||||
service.find_providing_server('CA', api.Backend.ldap2, api.env.ca_host)
|
||||
|
||||
options.realm_name = config.realm_name
|
||||
options.domain_name = config.domain_name
|
||||
options.dm_password = config.dirman_password
|
||||
options.host_name = config.host_name
|
||||
if os.path.exists(cafile):
|
||||
options.ca_cert_file = cafile
|
||||
else:
|
||||
options.ca_cert_file = None
|
||||
|
||||
ca.install_check(True, config, options)
|
||||
ca.install(True, config, options)
|
||||
|
||||
|
||||
def install_master(safe_options, options):
|
||||
dm_password = _get_dirman_password(
|
||||
options.password, options.unattended)
|
||||
|
||||
options.realm_name = api.env.realm
|
||||
options.domain_name = api.env.domain
|
||||
options.dm_password = dm_password
|
||||
options.host_name = api.env.host
|
||||
|
||||
if not options.subject_base:
|
||||
options.subject_base = str(
|
||||
installutils.default_subject_base(api.env.realm))
|
||||
if not options.ca_subject:
|
||||
options.ca_subject = str(
|
||||
installutils.default_ca_subject_dn(options.subject_base))
|
||||
|
||||
try:
|
||||
ca.subject_validator(ca.VALID_SUBJECT_BASE_ATTRS, options.subject_base)
|
||||
except ValueError as e:
|
||||
sys.exit("Subject base: {}".format(e))
|
||||
try:
|
||||
ca.subject_validator(ca.VALID_SUBJECT_ATTRS, options.ca_subject)
|
||||
except ValueError as e:
|
||||
sys.exit("CA subject: {}".format(e))
|
||||
|
||||
ca.install_check(True, None, options)
|
||||
ca.install(True, None, options)
|
||||
|
||||
# Run ipa-certupdate to add the new CA certificate to
|
||||
# certificate databases on this server.
|
||||
logger.info("Updating certificate databases.")
|
||||
ipa_certupdate.run_with_args(api)
|
||||
|
||||
def install(safe_options, options, filename):
|
||||
options.promote = False
|
||||
|
||||
try:
|
||||
if filename is None:
|
||||
install_master(safe_options, options)
|
||||
else:
|
||||
install_replica(safe_options, options, filename)
|
||||
|
||||
finally:
|
||||
# Clean up if we created custom credentials
|
||||
created_ccache_file = getattr(options, 'created_ccache_file', None)
|
||||
if created_ccache_file is not None:
|
||||
try:
|
||||
os.unlink(created_ccache_file)
|
||||
except OSError:
|
||||
pass
|
||||
|
||||
|
||||
def promote(safe_options, options, filename):
|
||||
options.promote = True
|
||||
|
||||
with ipautil.private_ccache():
|
||||
ccache = os.environ['KRB5CCNAME']
|
||||
|
||||
kinit_keytab(
|
||||
'host/{env.host}@{env.realm}'.format(env=api.env),
|
||||
paths.KRB5_KEYTAB,
|
||||
ccache)
|
||||
|
||||
ca_host = service.find_providing_server('CA', api.Backend.ldap2)
|
||||
if ca_host is None:
|
||||
install_master(safe_options, options)
|
||||
else:
|
||||
install_replica(safe_options, options, filename)
|
||||
|
||||
|
||||
def main():
|
||||
safe_options, options, filename = parse_options()
|
||||
|
||||
if os.geteuid() != 0:
|
||||
sys.exit("\nYou must be root to run this script.\n")
|
||||
|
||||
if not dsinstance.DsInstance().is_configured():
|
||||
sys.exit("IPA server is not configured on this system.\n")
|
||||
|
||||
if (not options.external_cert_files and
|
||||
cainstance.is_ca_installed_locally()):
|
||||
sys.exit("CA is already installed on this host.")
|
||||
|
||||
standard_logging_setup(log_file_name, debug=options.debug)
|
||||
logger.debug("%s was invoked with options: %s,%s",
|
||||
sys.argv[0], safe_options, filename)
|
||||
logger.debug("IPA version %s", version.VENDOR_VERSION)
|
||||
|
||||
# override ra_plugin setting read from default.conf so that we have
|
||||
# functional dogtag backend plugins during CA install
|
||||
api.bootstrap(
|
||||
context='install', confdir=paths.ETC_IPA,
|
||||
in_server=True, ra_plugin='dogtag'
|
||||
)
|
||||
api.finalize()
|
||||
api.Backend.ldap2.connect()
|
||||
|
||||
domain_level = dsinstance.get_domain_level(api)
|
||||
if domain_level > DOMAIN_LEVEL_0:
|
||||
promote(safe_options, options, filename)
|
||||
else:
|
||||
install(safe_options, options, filename)
|
||||
|
||||
# execute ipactl to refresh services status
|
||||
ipautil.run(['ipactl', 'start', '--ignore-service-failures'],
|
||||
raiseonerr=False)
|
||||
|
||||
api.Backend.ldap2.disconnect()
|
||||
|
||||
fail_message = '''
|
||||
Your system may be partly configured.
|
||||
Run /usr/sbin/ipa-server-install --uninstall to clean up.
|
||||
'''
|
||||
|
||||
if __name__ == '__main__':
|
||||
try:
|
||||
installutils.run_script(main, log_file_name=log_file_name,
|
||||
operation_name='ipa-ca-install',
|
||||
fail_message=fail_message)
|
||||
finally:
|
||||
# always try to remove decrypted replica file
|
||||
try:
|
||||
if REPLICA_INFO_TOP_DIR:
|
||||
shutil.rmtree(REPLICA_INFO_TOP_DIR)
|
||||
except OSError:
|
||||
pass
|
||||
23
install/tools/ipa-cacert-manage
Normal file
23
install/tools/ipa-cacert-manage
Normal file
@@ -0,0 +1,23 @@
|
||||
#! /usr/bin/python2 -E
|
||||
# Authors: Jan Cholasta <jcholast@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2014 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
from ipaserver.install.ipa_cacert_manage import CACertManage
|
||||
|
||||
CACertManage.run_cli()
|
||||
191
install/tools/ipa-compat-manage
Executable file
191
install/tools/ipa-compat-manage
Executable file
@@ -0,0 +1,191 @@
|
||||
#!/usr/bin/python2
|
||||
# Authors: Rob Crittenden <rcritten@redhat.com>
|
||||
# Authors: Simo Sorce <ssorce@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2008-2016 Red Hat, Inc.
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
from __future__ import print_function
|
||||
|
||||
import sys
|
||||
from ipaplatform.paths import paths
|
||||
try:
|
||||
from optparse import OptionParser # pylint: disable=deprecated-module
|
||||
from ipapython import ipautil, config
|
||||
from ipaserver.install import installutils
|
||||
from ipaserver.install.ldapupdate import LDAPUpdate
|
||||
from ipalib import api, errors
|
||||
from ipapython.ipa_log_manager import standard_logging_setup
|
||||
from ipapython.dn import DN
|
||||
except ImportError as e:
|
||||
print("""\
|
||||
There was a problem importing one of the required Python modules. The
|
||||
error was:
|
||||
|
||||
%s
|
||||
""" % e, file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
compat_dn = DN(('cn', 'Schema Compatibility'), ('cn', 'plugins'), ('cn', 'config'))
|
||||
nis_config_dn = DN(('cn', 'NIS Server'), ('cn', 'plugins'), ('cn', 'config'))
|
||||
|
||||
def parse_options():
|
||||
usage = "%prog [options] <enable|disable|status>\n"
|
||||
usage += "%prog [options]\n"
|
||||
parser = OptionParser(usage=usage, formatter=config.IPAFormatter())
|
||||
|
||||
parser.add_option("-d", "--debug", action="store_true", dest="debug",
|
||||
help="Display debugging information about the update(s)")
|
||||
parser.add_option("-y", dest="password",
|
||||
help="File containing the Directory Manager password")
|
||||
|
||||
config.add_standard_options(parser)
|
||||
options, args = parser.parse_args()
|
||||
|
||||
return options, args
|
||||
|
||||
def get_dirman_password():
|
||||
"""Prompt the user for the Directory Manager password and verify its
|
||||
correctness.
|
||||
"""
|
||||
password = installutils.read_password("Directory Manager", confirm=False, validate=False)
|
||||
|
||||
return password
|
||||
|
||||
def get_entry(dn):
|
||||
"""
|
||||
Return the entry for the given DN. If the entry is not found return
|
||||
None.
|
||||
"""
|
||||
entry = None
|
||||
try:
|
||||
entry = api.Backend.ldap2.get_entry(dn)
|
||||
except errors.NotFound:
|
||||
pass
|
||||
return entry
|
||||
|
||||
def main():
|
||||
retval = 0
|
||||
files = [paths.SCHEMA_COMPAT_ULDIF]
|
||||
|
||||
options, args = parse_options()
|
||||
|
||||
if len(args) != 1:
|
||||
sys.exit("You must specify one action: enable | disable | status")
|
||||
elif args[0] != "enable" and args[0] != "disable" and args[0] != "status":
|
||||
sys.exit("Unrecognized action [" + args[0] + "]")
|
||||
|
||||
standard_logging_setup(None, debug=options.debug)
|
||||
|
||||
dirman_password = ""
|
||||
if options.password:
|
||||
pw = ipautil.template_file(options.password, [])
|
||||
dirman_password = pw.strip()
|
||||
else:
|
||||
dirman_password = get_dirman_password()
|
||||
if dirman_password is None:
|
||||
sys.exit("Directory Manager password required")
|
||||
|
||||
api.bootstrap(context='cli',
|
||||
in_server=True,
|
||||
debug=options.debug,
|
||||
confdir=paths.ETC_IPA)
|
||||
api.finalize()
|
||||
api.Backend.ldap2.connect(bind_pw=dirman_password)
|
||||
|
||||
if args[0] == "status":
|
||||
entry = None
|
||||
try:
|
||||
entry = get_entry(compat_dn)
|
||||
if entry is not None and entry.get('nsslapd-pluginenabled', [''])[0].lower() == 'on':
|
||||
print("Plugin Enabled")
|
||||
else:
|
||||
print("Plugin Disabled")
|
||||
except errors.LDAPError as lde:
|
||||
print("An error occurred while talking to the server.")
|
||||
print(lde)
|
||||
|
||||
if args[0] == "enable":
|
||||
entry = None
|
||||
try:
|
||||
entry = get_entry(compat_dn)
|
||||
if entry is not None and entry.get('nsslapd-pluginenabled', [''])[0].lower() == 'on':
|
||||
print("Plugin already Enabled")
|
||||
retval = 2
|
||||
else:
|
||||
print("Enabling plugin")
|
||||
|
||||
if entry is None:
|
||||
ld = LDAPUpdate(dm_password=dirman_password, sub_dict={})
|
||||
if not ld.update(files):
|
||||
print("Updating Directory Server failed.")
|
||||
retval = 1
|
||||
else:
|
||||
entry['nsslapd-pluginenabled'] = ['on']
|
||||
api.Backend.ldap2.update_entry(entry)
|
||||
except errors.ExecutionError as lde:
|
||||
print("An error occurred while talking to the server.")
|
||||
print(lde)
|
||||
retval = 1
|
||||
|
||||
elif args[0] == "disable":
|
||||
entry = None
|
||||
try:
|
||||
entry = get_entry(nis_config_dn)
|
||||
# We can't disable schema compat if the NIS plugin is enabled
|
||||
if entry is not None and entry.get('nsslapd-pluginenabled', [''])[0].lower() == 'on':
|
||||
print("The NIS plugin is configured, cannot disable compatibility.", file=sys.stderr)
|
||||
print("Run 'ipa-nis-manage disable' first.", file=sys.stderr)
|
||||
retval = 2
|
||||
except errors.ExecutionError as lde:
|
||||
print("An error occurred while talking to the server.")
|
||||
print(lde)
|
||||
retval = 1
|
||||
|
||||
if retval == 0:
|
||||
entry = None
|
||||
try:
|
||||
entry = get_entry(compat_dn)
|
||||
if entry is None or entry.get('nsslapd-pluginenabled', [''])[0].lower() == 'off':
|
||||
print("Plugin is already disabled")
|
||||
retval = 2
|
||||
else:
|
||||
print("Disabling plugin")
|
||||
|
||||
entry['nsslapd-pluginenabled'] = ['off']
|
||||
api.Backend.ldap2.update_entry(entry)
|
||||
except errors.DatabaseError as dbe:
|
||||
print("An error occurred while talking to the server.")
|
||||
print(dbe)
|
||||
retval = 1
|
||||
except errors.ExecutionError as lde:
|
||||
print("An error occurred while talking to the server.")
|
||||
print(lde)
|
||||
retval = 1
|
||||
|
||||
else:
|
||||
retval = 1
|
||||
|
||||
if retval == 0:
|
||||
print("This setting will not take effect until you restart Directory Server.")
|
||||
|
||||
api.Backend.ldap2.disconnect()
|
||||
|
||||
return retval
|
||||
|
||||
if __name__ == '__main__':
|
||||
installutils.run_script(main, operation_name='ipa-compat-manage')
|
||||
502
install/tools/ipa-csreplica-manage
Executable file
502
install/tools/ipa-csreplica-manage
Executable file
@@ -0,0 +1,502 @@
|
||||
#! /usr/bin/python2 -E
|
||||
# Authors: Rob Crittenden <rcritten@redhat.com>
|
||||
#
|
||||
# Based on ipa-replica-manage by Karl MacMillan <kmacmillan@mentalrootkit.com>
|
||||
#
|
||||
# Copyright (C) 2011 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
from __future__ import print_function
|
||||
|
||||
import logging
|
||||
import sys
|
||||
import os
|
||||
|
||||
from ipaplatform.paths import paths
|
||||
from ipaserver.install import (replication, installutils, bindinstance,
|
||||
cainstance)
|
||||
from ipalib import api, errors
|
||||
from ipalib.util import has_managed_topology
|
||||
from ipapython import ipautil, ipaldap, version
|
||||
from ipapython.dn import DN
|
||||
|
||||
logger = logging.getLogger(os.path.basename(__file__))
|
||||
|
||||
# dict of command name and tuples of min/max num of args needed
|
||||
commands = {
|
||||
"list": (0, 1, "[master fqdn]", ""),
|
||||
"connect": (1, 2, "<master fqdn> [other master fqdn]",
|
||||
"must provide the name of the servers to connect"),
|
||||
"disconnect": (1, 2, "<master fqdn> [other master fqdn]",
|
||||
"must provide the name of the server to disconnect"),
|
||||
"del": (1, 1, "<master fqdn>",
|
||||
"must provide hostname of master to delete"),
|
||||
"re-initialize": (0, 0, "", ""),
|
||||
"force-sync": (0, 0, "", ""),
|
||||
"set-renewal-master": (0, 1, "[master fqdn]", "")
|
||||
}
|
||||
|
||||
|
||||
def parse_options():
|
||||
from optparse import OptionParser # pylint: disable=deprecated-module
|
||||
|
||||
parser = OptionParser(version=version.VERSION)
|
||||
parser.add_option("-H", "--host", dest="host", help="starting host")
|
||||
parser.add_option("-p", "--password", dest="dirman_passwd", help="Directory Manager password")
|
||||
parser.add_option("-v", "--verbose", dest="verbose", action="store_true", default=False,
|
||||
help="provide additional information")
|
||||
parser.add_option("-f", "--force", dest="force", action="store_true", default=False,
|
||||
help="ignore some types of errors")
|
||||
parser.add_option("--from", dest="fromhost", help="Host to get data from")
|
||||
|
||||
options, args = parser.parse_args()
|
||||
|
||||
valid_syntax = False
|
||||
|
||||
if len(args):
|
||||
n = len(args) - 1
|
||||
k = commands.keys()
|
||||
for cmd in k:
|
||||
if cmd == args[0]:
|
||||
v = commands[cmd]
|
||||
err = None
|
||||
if n < v[0]:
|
||||
err = v[3]
|
||||
elif n > v[1]:
|
||||
err = "too many arguments"
|
||||
else:
|
||||
valid_syntax = True
|
||||
if err:
|
||||
parser.error("Invalid syntax: %s\nUsage: %s [options] %s" % (err, cmd, v[2]))
|
||||
|
||||
if not valid_syntax:
|
||||
cmdstr = " | ".join(commands.keys())
|
||||
parser.error("must provide a command [%s]" % cmdstr)
|
||||
|
||||
return options, args
|
||||
|
||||
def list_replicas(realm, host, replica, dirman_passwd, verbose):
|
||||
|
||||
peers = {}
|
||||
|
||||
try:
|
||||
# connect to main IPA LDAP server
|
||||
ldap_uri = ipaldap.get_ldap_uri(host, 636, cacert=paths.IPA_CA_CRT)
|
||||
conn = ipaldap.LDAPClient(ldap_uri, cacert=paths.IPA_CA_CRT)
|
||||
conn.simple_bind(bind_dn=ipaldap.DIRMAN_DN,
|
||||
bind_password=dirman_passwd)
|
||||
|
||||
dn = DN(('cn', 'masters'), ('cn', 'ipa'), ('cn', 'etc'), ipautil.realm_to_suffix(realm))
|
||||
entries = conn.get_entries(dn, conn.SCOPE_ONELEVEL)
|
||||
|
||||
for ent in entries:
|
||||
try:
|
||||
cadn = DN(('cn', 'CA'), DN(ent.dn))
|
||||
entry = conn.get_entry(cadn)
|
||||
peers[ent.single_value['cn']] = ['master', '']
|
||||
except errors.NotFound:
|
||||
peers[ent.single_value['cn']] = ['CA not configured', '']
|
||||
|
||||
except Exception as e:
|
||||
sys.exit(
|
||||
"Failed to get data from '%s' while trying to list replicas: %s" %
|
||||
(host, e))
|
||||
finally:
|
||||
conn.unbind()
|
||||
|
||||
if not replica:
|
||||
for k, p in peers.items():
|
||||
print('%s: %s' % (k, p[0]))
|
||||
return
|
||||
|
||||
try:
|
||||
repl = replication.get_cs_replication_manager(realm, replica, dirman_passwd)
|
||||
except Exception as e:
|
||||
sys.exit(str(e))
|
||||
|
||||
entries = repl.find_replication_agreements()
|
||||
|
||||
for entry in entries:
|
||||
print('%s' % entry.single_value.get('nsds5replicahost'))
|
||||
|
||||
if verbose:
|
||||
print(" last init status: %s" % entry.single_value.get(
|
||||
'nsds5replicalastinitstatus'))
|
||||
print(" last init ended: %s" % str(
|
||||
ipautil.parse_generalized_time(
|
||||
entry.single_value['nsds5replicalastinitend'])))
|
||||
print(" last update status: %s" % entry.single_value.get(
|
||||
'nsds5replicalastupdatestatus'))
|
||||
print(" last update ended: %s" % str(
|
||||
ipautil.parse_generalized_time(
|
||||
entry.single_value['nsds5replicalastupdateend'])))
|
||||
|
||||
def del_link(realm, replica1, replica2, dirman_passwd, force=False):
|
||||
|
||||
repl2 = None
|
||||
|
||||
try:
|
||||
repl1 = replication.get_cs_replication_manager(realm, replica1, dirman_passwd)
|
||||
|
||||
repl1.hostnames = [replica1, replica2]
|
||||
|
||||
repl_list1 = repl1.find_replication_agreements()
|
||||
|
||||
# Find the DN of the replication agreement to remove
|
||||
replica1_dn = None
|
||||
for e in repl_list1:
|
||||
if e.single_value.get('nsDS5ReplicaHost') == replica2:
|
||||
replica1_dn = e.dn
|
||||
break
|
||||
|
||||
if replica1_dn is None:
|
||||
sys.exit("'%s' has no replication agreement for '%s'" % (replica1, replica2))
|
||||
|
||||
repl1.hostnames = [replica1, replica2]
|
||||
|
||||
except errors.NetworkError as e:
|
||||
sys.exit("Unable to connect to %s: %s" % (replica1, e))
|
||||
except Exception as e:
|
||||
sys.exit("Failed to get data from '%s': %s" % (replica1, e))
|
||||
|
||||
try:
|
||||
repl2 = replication.get_cs_replication_manager(realm, replica2, dirman_passwd)
|
||||
|
||||
repl2.hostnames = [replica1, replica2]
|
||||
|
||||
repl_list = repl2.find_replication_agreements()
|
||||
|
||||
# Now that we've confirmed that both hostnames are vaild, make sure
|
||||
# that we aren't removing the last link from either side.
|
||||
if not force and len(repl_list) <= 1:
|
||||
print("Cannot remove the last replication link of '%s'" % replica2)
|
||||
print("Please use the 'del' command to remove it from the domain")
|
||||
sys.exit(1)
|
||||
|
||||
if not force and len(repl_list1) <= 1:
|
||||
print("Cannot remove the last replication link of '%s'" % replica1)
|
||||
print("Please use the 'del' command to remove it from the domain")
|
||||
sys.exit(1)
|
||||
|
||||
# Find the DN of the replication agreement to remove
|
||||
replica2_dn = None
|
||||
for entry in repl_list:
|
||||
if entry.single_value.get('nsDS5ReplicaHost') == replica1:
|
||||
replica2_dn = entry.dn
|
||||
break
|
||||
|
||||
# This should never happen
|
||||
if replica2_dn is None:
|
||||
sys.exit("'%s' has no replication agreement for '%s'" % (replica1, replica2))
|
||||
|
||||
except errors.NotFound:
|
||||
print("'%s' has no replication agreement for '%s'" % (replica2, replica1))
|
||||
if not force:
|
||||
return
|
||||
except Exception as exc:
|
||||
print("Failed to get data from '%s': %s" % (replica2, exc))
|
||||
if not force:
|
||||
sys.exit(1)
|
||||
|
||||
if repl2:
|
||||
failed = False
|
||||
try:
|
||||
repl2.delete_agreement(replica1, replica2_dn)
|
||||
repl2.delete_referral(replica1, repl1.port)
|
||||
except Exception as exc:
|
||||
print("Unable to remove agreement on %s: %s" % (replica2, exc))
|
||||
failed = True
|
||||
|
||||
if failed:
|
||||
if force:
|
||||
print("Forcing removal on '%s'" % replica1)
|
||||
else:
|
||||
sys.exit(1)
|
||||
|
||||
if not repl2 and force:
|
||||
print("Forcing removal on '%s'" % replica1)
|
||||
|
||||
repl1.delete_agreement(replica2, replica1_dn)
|
||||
repl1.delete_referral(replica2, repl2.port)
|
||||
|
||||
print("Deleted replication agreement from '%s' to '%s'" % (replica1, replica2))
|
||||
|
||||
def del_master(realm, hostname, options):
|
||||
delrepl = None
|
||||
|
||||
# 1. Connect to the local dogtag DS server
|
||||
try:
|
||||
thisrepl = replication.get_cs_replication_manager(realm, options.host,
|
||||
options.dirman_passwd)
|
||||
except Exception as e:
|
||||
sys.exit("Failed to connect to server %s: %s" % (options.host, e))
|
||||
|
||||
# 2. Ensure we have an agreement with the master
|
||||
if thisrepl.get_replication_agreement(hostname) is None:
|
||||
sys.exit("'%s' has no replication agreement for '%s'" % (options.host, hostname))
|
||||
|
||||
# 3. Connect to the dogtag DS to be removed.
|
||||
try:
|
||||
delrepl = replication.get_cs_replication_manager(realm, hostname,
|
||||
options.dirman_passwd)
|
||||
except Exception as e:
|
||||
if not options.force:
|
||||
print("Unable to delete replica %s: %s" % (hostname, e))
|
||||
sys.exit(1)
|
||||
else:
|
||||
print("Unable to connect to replica %s, forcing removal" % hostname)
|
||||
|
||||
# 4. Get list of agreements.
|
||||
if delrepl is None:
|
||||
# server not up, just remove it from this server
|
||||
replica_names = [options.host]
|
||||
else:
|
||||
replica_entries = delrepl.find_ipa_replication_agreements()
|
||||
replica_names = [rep.single_value.get('nsds5replicahost')
|
||||
for rep in replica_entries]
|
||||
|
||||
# 5. Remove each agreement
|
||||
for r in replica_names:
|
||||
try:
|
||||
del_link(realm, r, hostname, options.dirman_passwd, force=True)
|
||||
except Exception as e:
|
||||
sys.exit("There were issues removing a connection: %s" % e)
|
||||
|
||||
# 6. Pick CA renewal master
|
||||
ca = cainstance.CAInstance(api.env.realm)
|
||||
if ca.is_renewal_master(hostname):
|
||||
ca.set_renewal_master(options.host)
|
||||
|
||||
# 7. And clean up the removed replica DNS entries if any.
|
||||
try:
|
||||
if bindinstance.dns_container_exists(api.env.basedn):
|
||||
bind = bindinstance.BindInstance()
|
||||
bind.update_system_records()
|
||||
except Exception as e:
|
||||
print("Failed to cleanup %s DNS entries: %s" % (hostname, e))
|
||||
print("You may need to manually remove them from the tree")
|
||||
|
||||
def add_link(realm, replica1, replica2, dirman_passwd, options):
|
||||
try:
|
||||
repl2 = replication.get_cs_replication_manager(realm, replica2,
|
||||
dirman_passwd)
|
||||
except Exception as e:
|
||||
sys.exit(str(e))
|
||||
try:
|
||||
ldap_uri = ipaldap.get_ldap_uri(replica2, 636, cacert=paths.IPA_CA_CRT)
|
||||
conn = ipaldap.LDAPClient(ldap_uri, cacert=paths.IPA_CA_CRT)
|
||||
conn.simple_bind(bind_dn=ipaldap.DIRMAN_DN,
|
||||
bind_password=dirman_passwd)
|
||||
|
||||
dn = DN(('cn', 'CA'), ('cn', replica2), ('cn', 'masters'), ('cn', 'ipa'), ('cn', 'etc'),
|
||||
ipautil.realm_to_suffix(realm))
|
||||
conn.get_entries(dn, conn.SCOPE_BASE)
|
||||
conn.unbind()
|
||||
except errors.NotFound:
|
||||
sys.exit('%s does not have a CA configured.' % replica2)
|
||||
except errors.NetworkError as e:
|
||||
sys.exit("Unable to connect to %s: %s" % (ipautil.format_netloc(replica2, 636), str(e)))
|
||||
except Exception as e:
|
||||
sys.exit("Failed to get data while trying to bind to '%s': %s" % (replica1, str(e)))
|
||||
|
||||
try:
|
||||
repl1 = replication.get_cs_replication_manager(realm, replica1,
|
||||
dirman_passwd)
|
||||
entries = repl1.find_replication_agreements()
|
||||
for e in entries:
|
||||
if e.single_value.get('nsDS5ReplicaHost') == replica2:
|
||||
sys.exit('This replication agreement already exists.')
|
||||
repl1.hostnames = [replica1, replica2]
|
||||
|
||||
except errors.NotFound:
|
||||
sys.exit("Cannot find replica '%s'" % replica1)
|
||||
except errors.NetworkError as e:
|
||||
sys.exit("Unable to connect to %s: %s" % (replica1, e))
|
||||
except Exception as e:
|
||||
sys.exit(
|
||||
"Failed to get data from '%s' while trying to get current "
|
||||
"agreements: %s" % (replica1, e))
|
||||
|
||||
repl1.setup_replication(
|
||||
replica2, repl2.port, 0, DN(('cn', 'Directory Manager')),
|
||||
dirman_passwd, is_cs_replica=True, local_port=repl1.port)
|
||||
print("Connected '%s' to '%s'" % (replica1, replica2))
|
||||
|
||||
def re_initialize(realm, options):
|
||||
|
||||
if not options.fromhost:
|
||||
sys.exit("re-initialize requires the option --from <host name>")
|
||||
|
||||
thishost = installutils.get_fqdn()
|
||||
|
||||
try:
|
||||
repl = replication.get_cs_replication_manager(realm, options.fromhost,
|
||||
options.dirman_passwd)
|
||||
thisrepl = replication.get_cs_replication_manager(realm, thishost,
|
||||
options.dirman_passwd)
|
||||
except Exception as e:
|
||||
sys.exit(str(e))
|
||||
|
||||
filter = repl.get_agreement_filter(host=thishost)
|
||||
try:
|
||||
entry = repl.conn.get_entries(
|
||||
DN(('cn', 'config')), repl.conn.SCOPE_SUBTREE, filter)
|
||||
except errors.NotFound:
|
||||
logger.error("Unable to find %s -> %s replication agreement",
|
||||
options.fromhost, thishost)
|
||||
sys.exit(1)
|
||||
if len(entry) > 1:
|
||||
logger.error("Found multiple agreements for %s. Only initializing the "
|
||||
"first one returned: %s", thishost, entry[0].dn)
|
||||
|
||||
repl.hostnames = thisrepl.hostnames = [thishost, options.fromhost]
|
||||
thisrepl.enable_agreement(options.fromhost)
|
||||
repl.enable_agreement(thishost)
|
||||
|
||||
repl.initialize_replication(entry[0].dn, repl.conn)
|
||||
repl.wait_for_repl_init(repl.conn, entry[0].dn)
|
||||
|
||||
def force_sync(realm, thishost, fromhost, dirman_passwd):
|
||||
|
||||
try:
|
||||
repl = replication.get_cs_replication_manager(realm, fromhost,
|
||||
dirman_passwd)
|
||||
repl.force_sync(repl.conn, thishost)
|
||||
except Exception as e:
|
||||
sys.exit(str(e))
|
||||
|
||||
def set_renewal_master(realm, replica):
|
||||
if not replica:
|
||||
replica = installutils.get_fqdn()
|
||||
|
||||
ca = cainstance.CAInstance(realm)
|
||||
if ca.is_renewal_master(replica):
|
||||
sys.exit("%s is already the renewal master" % replica)
|
||||
|
||||
try:
|
||||
ca.set_renewal_master(replica)
|
||||
except Exception as e:
|
||||
sys.exit("Failed to set renewal master to %s: %s" % (replica, e))
|
||||
|
||||
print("%s is now the renewal master" % replica)
|
||||
|
||||
|
||||
def exit_on_managed_topology(what, hint="topologysegment"):
|
||||
if hint == "topologysegment":
|
||||
hinttext = ("Please use `ipa topologysegment-*` commands to manage "
|
||||
"the topology.")
|
||||
elif hint == "ipa-replica-manage-del":
|
||||
hinttext = ("Please use the `ipa-replica-manage del` command.")
|
||||
else:
|
||||
assert False, "Unexpected value"
|
||||
sys.exit("{0} is deprecated with managed IPA replication topology. {1}"
|
||||
.format(what, hinttext))
|
||||
|
||||
|
||||
def main():
|
||||
options, args = parse_options()
|
||||
|
||||
# Just initialize the environment. This is so the installer can have
|
||||
# access to the plugin environment
|
||||
api_env = {}
|
||||
if os.getegid() != 0:
|
||||
api_env['log'] = None # turn off logging for non-root
|
||||
|
||||
api.bootstrap(
|
||||
context='cli',
|
||||
in_server=True,
|
||||
verbose=options.verbose,
|
||||
confdir=paths.ETC_IPA,
|
||||
**api_env
|
||||
)
|
||||
api.finalize()
|
||||
|
||||
dirman_passwd = None
|
||||
realm = api.env.realm
|
||||
|
||||
if options.host:
|
||||
host = options.host
|
||||
else:
|
||||
host = installutils.get_fqdn()
|
||||
|
||||
options.host = host
|
||||
|
||||
if options.dirman_passwd:
|
||||
dirman_passwd = options.dirman_passwd
|
||||
else:
|
||||
dirman_passwd = installutils.read_password("Directory Manager", confirm=False,
|
||||
validate=False, retry=False)
|
||||
if dirman_passwd is None:
|
||||
sys.exit("Directory Manager password required")
|
||||
|
||||
options.dirman_passwd = dirman_passwd
|
||||
|
||||
api.Backend.ldap2.connect(bind_pw=options.dirman_passwd)
|
||||
|
||||
if args[0] == "list":
|
||||
replica = None
|
||||
if len(args) == 2:
|
||||
replica = args[1]
|
||||
list_replicas(realm, host, replica, dirman_passwd, options.verbose)
|
||||
elif args[0] == "del":
|
||||
if has_managed_topology(api):
|
||||
exit_on_managed_topology(
|
||||
"Removal of IPA CS replication agreement and replication data",
|
||||
hint="ipa-replica-manage-del")
|
||||
del_master(realm, args[1], options)
|
||||
elif args[0] == "re-initialize":
|
||||
re_initialize(realm, options)
|
||||
elif args[0] == "force-sync":
|
||||
if not options.fromhost:
|
||||
sys.exit("force-sync requires the option --from <host name>")
|
||||
force_sync(realm, host, options.fromhost, options.dirman_passwd)
|
||||
elif args[0] == "connect":
|
||||
if has_managed_topology(api):
|
||||
exit_on_managed_topology("Creation of IPA CS replication agreement")
|
||||
if len(args) == 3:
|
||||
replica1 = args[1]
|
||||
replica2 = args[2]
|
||||
elif len(args) == 2:
|
||||
replica1 = host
|
||||
replica2 = args[1]
|
||||
add_link(realm, replica1, replica2, dirman_passwd, options)
|
||||
elif args[0] == "disconnect":
|
||||
if has_managed_topology(api):
|
||||
exit_on_managed_topology("Removal of IPA CS replication agreement")
|
||||
if len(args) == 3:
|
||||
replica1 = args[1]
|
||||
replica2 = args[2]
|
||||
elif len(args) == 2:
|
||||
replica1 = host
|
||||
replica2 = args[1]
|
||||
del_link(realm, replica1, replica2, dirman_passwd, options.force)
|
||||
elif args[0] == 'set-renewal-master':
|
||||
replica = None
|
||||
if len(args) > 1:
|
||||
replica = args[1]
|
||||
set_renewal_master(realm, replica)
|
||||
|
||||
api.Backend.ldap2.disconnect()
|
||||
|
||||
try:
|
||||
main()
|
||||
except KeyboardInterrupt:
|
||||
sys.exit(1)
|
||||
except SystemExit as e:
|
||||
sys.exit(e)
|
||||
except Exception as e:
|
||||
sys.exit("unexpected error: %s" % e)
|
||||
6
install/tools/ipa-custodia
Executable file
6
install/tools/ipa-custodia
Executable file
@@ -0,0 +1,6 @@
|
||||
#!/usr/bin/python2
|
||||
# Copyright (C) 2017 IPA Project Contributors, see COPYING for license
|
||||
from ipaserver.secrets.service import main
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
286
install/tools/ipa-custodia-check
Executable file
286
install/tools/ipa-custodia-check
Executable file
@@ -0,0 +1,286 @@
|
||||
#!/usr/bin/python2
|
||||
"""Test client for ipa-custodia
|
||||
|
||||
The test script is expected to be executed on an IPA server with existing
|
||||
Custodia server keys.
|
||||
"""
|
||||
from __future__ import print_function
|
||||
import argparse
|
||||
import logging
|
||||
import os
|
||||
import platform
|
||||
import socket
|
||||
import warnings
|
||||
|
||||
from custodia.message.kem import KEY_USAGE_SIG, KEY_USAGE_ENC, KEY_USAGE_MAP
|
||||
|
||||
from jwcrypto.common import json_decode
|
||||
from jwcrypto.jwk import JWK
|
||||
|
||||
from ipalib import api
|
||||
from ipaplatform.paths import paths
|
||||
import ipapython.version
|
||||
from ipaserver.install.installutils import is_ipa_configured
|
||||
|
||||
try:
|
||||
# FreeIPA >= 4.5
|
||||
from ipaserver.secrets.client import CustodiaClient
|
||||
except ImportError:
|
||||
# FreeIPA <= 4.4
|
||||
from ipapython.secrets.client import CustodiaClient
|
||||
|
||||
# Ignore security warning from vendored and non-vendored urllib3
|
||||
try:
|
||||
from urllib3.exceptions import SecurityWarning
|
||||
except ImportError:
|
||||
SecurityWarning = None
|
||||
else:
|
||||
warnings.simplefilter("ignore", SecurityWarning)
|
||||
|
||||
try:
|
||||
from requests.packages.urllib3.exceptions import SecurityWarning
|
||||
except ImportError:
|
||||
SecurityWarning = None
|
||||
else:
|
||||
warnings.simplefilter("ignore", SecurityWarning)
|
||||
|
||||
|
||||
KEYS = [
|
||||
'dm/DMHash',
|
||||
'ra/ipaCert',
|
||||
'ca/auditSigningCert cert-pki-ca',
|
||||
'ca/caSigningCert cert-pki-ca',
|
||||
'ca/ocspSigningCert cert-pki-ca',
|
||||
'ca/subsystemCert cert-pki-ca',
|
||||
]
|
||||
|
||||
IPA_CUSTODIA_KEYFILE = os.path.join(paths.IPA_CUSTODIA_CONF_DIR,
|
||||
'server.keys')
|
||||
|
||||
|
||||
logger = logging.getLogger('ipa-custodia-tester')
|
||||
|
||||
|
||||
parser = argparse.ArgumentParser(
|
||||
"IPA Custodia check",
|
||||
)
|
||||
# --store is dangerous and therefore hidden! Don't use it unless you really
|
||||
# know what you are doing! Keep in mind that it might destroy your NSSDB
|
||||
# unless it uses sqlite format.
|
||||
parser.add_argument(
|
||||
"--store", action='store_true', dest='store',
|
||||
help=argparse.SUPPRESS
|
||||
)
|
||||
parser.add_argument(
|
||||
"--debug", action='store_true',
|
||||
help="Debug mode"
|
||||
)
|
||||
parser.add_argument(
|
||||
"--verbose", action='store_true',
|
||||
help='Verbose mode'
|
||||
)
|
||||
parser.add_argument(
|
||||
"server",
|
||||
help="FQDN of a IPA server (can be own FQDN for self-test)"
|
||||
)
|
||||
parser.add_argument(
|
||||
'keys', nargs='*', default=KEYS,
|
||||
help="Remote key ({})".format(', '.join(KEYS))
|
||||
)
|
||||
|
||||
|
||||
class IPACustodiaTester(object):
|
||||
files = [
|
||||
paths.IPA_DEFAULT_CONF,
|
||||
paths.KRB5_KEYTAB,
|
||||
paths.IPA_CUSTODIA_CONF,
|
||||
IPA_CUSTODIA_KEYFILE
|
||||
]
|
||||
|
||||
def __init__(self, parser, args):
|
||||
self.parser = parser
|
||||
self.args = args
|
||||
if not api.isdone('bootstrap'):
|
||||
# bootstrap to initialize api.env
|
||||
api.bootstrap()
|
||||
self.debug("IPA API bootstrapped")
|
||||
self.realm = api.env.realm
|
||||
self.host = api.env.host
|
||||
self.host_spn = 'host/{}@{}'.format(self.host, self.realm)
|
||||
self.server_spn = 'host/{}@{}'.format(self.args.server, self.realm)
|
||||
self.client = None
|
||||
self._errors = []
|
||||
|
||||
def error(self, msg, fatal=False):
|
||||
self._errors.append(msg)
|
||||
logger.error(msg, exc_info=self.args.verbose)
|
||||
if fatal:
|
||||
self.exit()
|
||||
|
||||
def exit(self):
|
||||
if self._errors:
|
||||
self.parser.exit(1, "[ERROR] One or more tests have failed.\n")
|
||||
else:
|
||||
self.parser.exit(0, "All tests have passed successfully.\n")
|
||||
|
||||
def warning(self, msg):
|
||||
logger.warning(msg)
|
||||
|
||||
def info(self, msg):
|
||||
logger.info(msg)
|
||||
|
||||
def debug(self, msg):
|
||||
logger.debug(msg)
|
||||
|
||||
def check(self):
|
||||
self.status()
|
||||
self.check_fqdn()
|
||||
self.check_files()
|
||||
self.check_client()
|
||||
self.check_jwk()
|
||||
self.check_keys()
|
||||
|
||||
def status(self):
|
||||
self.info("Platform: {}".format(platform.platform()))
|
||||
self.info("IPA version: {}".format(
|
||||
ipapython.version.VERSION
|
||||
))
|
||||
self.info("IPA vendor version: {}".format(
|
||||
ipapython.version.VENDOR_VERSION
|
||||
))
|
||||
self.info("Realm: {}".format(self.realm))
|
||||
self.info("Host: {}".format(self.host))
|
||||
self.info("Remote server: {}".format(self.args.server))
|
||||
if self.host == self.args.server:
|
||||
self.warning("Performing self-test only.")
|
||||
|
||||
def check_fqdn(self):
|
||||
fqdn = socket.getfqdn()
|
||||
if self.host != fqdn:
|
||||
self.warning(
|
||||
"socket.getfqdn() reports hostname '{}'".format(fqdn)
|
||||
)
|
||||
|
||||
def check_files(self):
|
||||
for filename in self.files:
|
||||
if not os.path.isfile(filename):
|
||||
self.error("File '{0}' is missing.".format(filename))
|
||||
else:
|
||||
self.info("File '{0}' exists.".format(filename))
|
||||
|
||||
def check_client(self):
|
||||
try:
|
||||
self.client = CustodiaClient(
|
||||
server=self.args.server,
|
||||
client_service='host@{}'.format(self.host),
|
||||
keyfile=IPA_CUSTODIA_KEYFILE,
|
||||
keytab=paths.KRB5_KEYTAB,
|
||||
realm=self.realm,
|
||||
)
|
||||
except Exception as e:
|
||||
self.error("Failed to create client: {}".format(e), fatal=True)
|
||||
else:
|
||||
self.info("Custodia client created.")
|
||||
|
||||
def _check_jwk_single(self, usage_id):
|
||||
usage = KEY_USAGE_MAP[usage_id]
|
||||
with open(IPA_CUSTODIA_KEYFILE) as f:
|
||||
dictkeys = json_decode(f.read())
|
||||
|
||||
try:
|
||||
pkey = JWK(**dictkeys[usage_id])
|
||||
local_pubkey = json_decode(pkey.export_public())
|
||||
except Exception:
|
||||
self.error("Failed to load and parse local JWK.", fatal=True)
|
||||
else:
|
||||
self.info("Loaded key for usage '{}' from '{}'.".format(
|
||||
usage, IPA_CUSTODIA_KEYFILE
|
||||
))
|
||||
|
||||
if pkey.key_id != self.host_spn:
|
||||
self.error(
|
||||
"KID '{}' != host service principal name '{}' "
|
||||
"(usage: {})".format(pkey.key_id, self.host_spn, usage),
|
||||
fatal=True
|
||||
)
|
||||
else:
|
||||
self.info(
|
||||
"JWK KID matches host's service principal name '{}'.".format(
|
||||
self.host_spn
|
||||
))
|
||||
|
||||
# LDAP doesn't contain KID
|
||||
local_pubkey.pop("kid", None)
|
||||
find_key = self.client.ikk.find_key
|
||||
try:
|
||||
host_pubkey = json_decode(find_key(self.host_spn, usage_id))
|
||||
except Exception:
|
||||
self.error("Fetching host keys {} (usage: {}) failed.".format(
|
||||
self.host_spn, usage), fatal=True)
|
||||
else:
|
||||
self.info("Checked host LDAP keys '{}' for usage {}.".format(
|
||||
self.host_spn, usage
|
||||
))
|
||||
|
||||
if host_pubkey != local_pubkey:
|
||||
self.debug("LDAP: '{}'".format(host_pubkey))
|
||||
self.debug("Local: '{}'".format(local_pubkey))
|
||||
self.error(
|
||||
"Host key in LDAP does not match local key.", fatal=True)
|
||||
else:
|
||||
self.info(
|
||||
"Local key for usage '{}' matches key in LDAP.".format(usage)
|
||||
)
|
||||
|
||||
try:
|
||||
server_pubkey = json_decode(find_key(self.server_spn, usage_id))
|
||||
except Exception:
|
||||
self.error("Fetching server keys {} (usage: {}) failed.".format(
|
||||
self.server_spn, usage), fatal=True)
|
||||
else:
|
||||
self.info("Checked server LDAP keys '{}' for usage {}.".format(
|
||||
self.server_spn, usage
|
||||
))
|
||||
|
||||
return local_pubkey, host_pubkey, server_pubkey
|
||||
|
||||
def check_jwk(self):
|
||||
self._check_jwk_single(KEY_USAGE_SIG)
|
||||
self._check_jwk_single(KEY_USAGE_ENC)
|
||||
|
||||
def check_keys(self):
|
||||
for key in self.args.keys:
|
||||
try:
|
||||
result = self.client.fetch_key(key, store=self.args.store)
|
||||
except Exception as e:
|
||||
self.error("Failed to retrieve key '{}': {}.".format(
|
||||
key, e
|
||||
))
|
||||
else:
|
||||
self.info("Successfully retrieved '{}'.".format(key))
|
||||
if not self.args.store:
|
||||
self.debug(result)
|
||||
|
||||
|
||||
def main():
|
||||
args = parser.parse_args()
|
||||
if args.debug:
|
||||
args.verbose = True
|
||||
|
||||
logging.basicConfig(
|
||||
level=logging.DEBUG if args.debug else logging.INFO,
|
||||
format='[%(asctime)s %(name)s] <%(levelname)s>: %(message)s',
|
||||
datefmt='%Y-%m-%dT%H:%M:%S',
|
||||
)
|
||||
if not is_ipa_configured():
|
||||
parser.error("IPA is not configured on this system.\n")
|
||||
if os.geteuid() != 0:
|
||||
parser.error("Script must be executed as root.\n")
|
||||
|
||||
tester = IPACustodiaTester(parser, args)
|
||||
tester.check()
|
||||
tester.exit()
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
162
install/tools/ipa-dns-install
Executable file
162
install/tools/ipa-dns-install
Executable file
@@ -0,0 +1,162 @@
|
||||
#! /usr/bin/python2 -E
|
||||
# Authors: Martin Nagy <mnagy@redhat.com>
|
||||
# Based on ipa-server-install by Karl MacMillan <kmacmillan@mentalrootkit.com>
|
||||
#
|
||||
# Copyright (C) 2007 - 2009 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
from __future__ import print_function
|
||||
|
||||
import logging
|
||||
import os
|
||||
import sys
|
||||
|
||||
from optparse import SUPPRESS_HELP # pylint: disable=deprecated-module
|
||||
|
||||
from ipaserver.install import bindinstance
|
||||
from ipaserver.install import installutils
|
||||
from ipapython import version
|
||||
from ipalib import api
|
||||
from ipaplatform.paths import paths
|
||||
from ipapython import ipautil
|
||||
from ipapython.config import IPAOptionParser
|
||||
from ipapython.ipa_log_manager import standard_logging_setup
|
||||
|
||||
from ipaserver.install import dns as dns_installer
|
||||
|
||||
logger = logging.getLogger(os.path.basename(__file__))
|
||||
|
||||
log_file_name = paths.IPASERVER_INSTALL_LOG
|
||||
|
||||
def parse_options():
|
||||
parser = IPAOptionParser(version=version.VERSION)
|
||||
parser.add_option("-p", "--ds-password", dest="dm_password",
|
||||
sensitive=True, help=SUPPRESS_HELP)
|
||||
parser.add_option("-d", "--debug", dest="debug", action="store_true",
|
||||
default=False, help="print debugging information")
|
||||
parser.add_option("--ip-address", dest="ip_addresses", metavar="IP_ADDRESS",
|
||||
default=[], action="append",
|
||||
type="ip",
|
||||
help="Master Server IP Address. This option can be used "
|
||||
"multiple times")
|
||||
parser.add_option("--forwarder", dest="forwarders", action="append",
|
||||
type="ip_with_loopback", help="Add a DNS forwarder. This option can be used multiple times")
|
||||
parser.add_option("--no-forwarders", dest="no_forwarders", action="store_true",
|
||||
default=False, help="Do not add any DNS forwarders, use root servers instead")
|
||||
parser.add_option("--auto-forwarders", dest="auto_forwarders",
|
||||
action="store_true", default=False,
|
||||
help="Use DNS forwarders configured in /etc/resolv.conf")
|
||||
parser.add_option("--forward-policy", dest="forward_policy",
|
||||
choices=("first", "only"), default=None,
|
||||
help="DNS forwarding policy for global forwarders")
|
||||
parser.add_option("--reverse-zone", dest="reverse_zones",
|
||||
default=[], action="append", metavar="REVERSE_ZONE",
|
||||
help="The reverse DNS zone to use. This option can be used multiple times")
|
||||
parser.add_option("--no-reverse", dest="no_reverse", action="store_true",
|
||||
default=False, help="Do not create new reverse DNS zone")
|
||||
parser.add_option("--auto-reverse", dest="auto_reverse", action="store_true",
|
||||
default=False, help="Create necessary DNS zones")
|
||||
parser.add_option("--allow-zone-overlap", dest="allow_zone_overlap",
|
||||
action="store_true", default=False, help="Create DNS "
|
||||
"zone even if it already exists")
|
||||
parser.add_option("--no-dnssec-validation", dest="no_dnssec_validation", action="store_true",
|
||||
default=False, help="Disable DNSSEC validation")
|
||||
parser.add_option("--dnssec-master", dest="dnssec_master", action="store_true",
|
||||
default=False, help="Setup server to be DNSSEC key master")
|
||||
parser.add_option("--zonemgr", action="callback", callback=bindinstance.zonemgr_callback,
|
||||
type="string",
|
||||
help="DNS zone manager e-mail address. Defaults to hostmaster@DOMAIN")
|
||||
parser.add_option("-U", "--unattended", dest="unattended", action="store_true",
|
||||
default=False, help="unattended installation never prompts the user")
|
||||
parser.add_option("--disable-dnssec-master", dest="disable_dnssec_master",
|
||||
action="store_true", default=False, help="Disable the "
|
||||
"DNSSEC master on this server")
|
||||
parser.add_option("--kasp-db", dest="kasp_db_file", type="string",
|
||||
metavar="FILE", action="store", help="Copy OpenDNSSEC "
|
||||
"metadata from the specified file (will not create a new "
|
||||
"kasp.db file)")
|
||||
parser.add_option("--force", dest="force", action="store_true",
|
||||
help="Force install")
|
||||
|
||||
options, _args = parser.parse_args()
|
||||
safe_options = parser.get_safe_opts(options)
|
||||
|
||||
if options.dnssec_master and options.disable_dnssec_master:
|
||||
parser.error("Invalid combination of parameters: --dnssec-master and "
|
||||
"--disable-dnssec-master")
|
||||
|
||||
if options.forwarders and options.no_forwarders:
|
||||
parser.error("You cannot specify a --forwarder option together with --no-forwarders")
|
||||
elif options.reverse_zones and options.no_reverse:
|
||||
parser.error("You cannot specify a --reverse-zone option together with --no-reverse")
|
||||
elif options.auto_reverse and options.no_reverse:
|
||||
parser.error("You cannot specify a --auto-reverse option together with --no-reverse")
|
||||
|
||||
if options.unattended:
|
||||
if (not options.forwarders
|
||||
and not options.no_forwarders
|
||||
and not options.auto_forwarders):
|
||||
parser.error("You must specify at least one option: "
|
||||
"--forwarder or --no-forwarders or --auto-forwarders")
|
||||
|
||||
if options.kasp_db_file and not os.path.isfile(options.kasp_db_file):
|
||||
parser.error("File %s does not exist" % options.kasp_db_file)
|
||||
|
||||
if options.dm_password:
|
||||
print ("WARNING: Option -p/--ds-password is deprecated "
|
||||
"and should not be used anymore.")
|
||||
return safe_options, options
|
||||
|
||||
def main():
|
||||
safe_options, options = parse_options()
|
||||
|
||||
if os.getegid() != 0:
|
||||
sys.exit("Must be root to setup server")
|
||||
|
||||
standard_logging_setup(log_file_name, debug=options.debug, filemode='a')
|
||||
print("\nThe log file for this installation can be found in %s" % log_file_name)
|
||||
|
||||
logger.debug('%s was invoked with options: %s', sys.argv[0], safe_options)
|
||||
logger.debug("missing options might be asked for interactively later\n")
|
||||
logger.debug('IPA version %s', version.VENDOR_VERSION)
|
||||
|
||||
installutils.check_server_configuration()
|
||||
|
||||
# Initialize the ipalib api
|
||||
api.bootstrap(
|
||||
context='install', confdir=paths.ETC_IPA,
|
||||
in_server=True, debug=options.debug,
|
||||
)
|
||||
api.finalize()
|
||||
api.Backend.ldap2.connect()
|
||||
|
||||
options.setup_ca = None # must be None to enable autodetection
|
||||
|
||||
dns_installer.install_check(True, api, False, options, hostname=api.env.host)
|
||||
dns_installer.install(True, False, options)
|
||||
|
||||
# execute ipactl to refresh services status
|
||||
ipautil.run(['ipactl', 'start', '--ignore-service-failures'],
|
||||
raiseonerr=False)
|
||||
|
||||
api.Backend.ldap2.disconnect()
|
||||
|
||||
return 0
|
||||
|
||||
if __name__ == '__main__':
|
||||
installutils.run_script(main, log_file_name=log_file_name,
|
||||
operation_name='ipa-dns-install')
|
||||
215
install/tools/ipa-httpd-kdcproxy
Executable file
215
install/tools/ipa-httpd-kdcproxy
Executable file
@@ -0,0 +1,215 @@
|
||||
#!/usr/bin/python2
|
||||
# Authors:
|
||||
# Christian Heimes <cheimes@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2015 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
"""ipa-httpd-kdproxy
|
||||
|
||||
This script creates or removes the symlink from /etc/ipa/ipa-kdc-proxy.conf
|
||||
to /etc/httpd/conf.d/. It's called from ExecStartPre hook in httpd.service.
|
||||
"""
|
||||
import logging
|
||||
import os
|
||||
import socket
|
||||
import sys
|
||||
|
||||
from ipalib import api, errors
|
||||
from ipapython.ipa_log_manager import standard_logging_setup
|
||||
from ipapython.ipaldap import LDAPClient
|
||||
from ipapython.dn import DN
|
||||
from ipaplatform.paths import paths
|
||||
|
||||
logger = logging.getLogger(os.path.basename(__file__))
|
||||
|
||||
|
||||
DEBUG = False
|
||||
TIME_LIMIT = 2
|
||||
|
||||
|
||||
class Error(Exception):
|
||||
"""Base error class"""
|
||||
|
||||
|
||||
class ConfigFileError(Error):
|
||||
"""Something is wrong with the config file"""
|
||||
|
||||
|
||||
class CheckError(Error):
|
||||
"""An unrecoverable error has occured
|
||||
|
||||
The exit code is 0.
|
||||
"""
|
||||
|
||||
|
||||
class FatalError(Error):
|
||||
"""A fatal error has occured
|
||||
|
||||
Fatal errors cause the command to exit with a non-null exit code.
|
||||
"""
|
||||
|
||||
|
||||
class KDCProxyConfig(object):
|
||||
ipaconfig_flag = 'ipaKDCProxyEnabled'
|
||||
|
||||
def __init__(self, time_limit=TIME_LIMIT):
|
||||
self.time_limit = time_limit
|
||||
self.con = None
|
||||
self.ldap_uri = api.env.ldap_uri
|
||||
self.kdc_dn = DN(('cn', 'KDC'), ('cn', api.env.host),
|
||||
('cn', 'masters'), ('cn', 'ipa'), ('cn', 'etc'),
|
||||
api.env.basedn)
|
||||
self.conf = paths.HTTPD_IPA_KDCPROXY_CONF
|
||||
self.conflink = paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK
|
||||
|
||||
def _ldap_con(self):
|
||||
"""Establish LDAP connection"""
|
||||
logger.debug('ldap_uri: %s', self.ldap_uri)
|
||||
try:
|
||||
self.con = LDAPClient(self.ldap_uri)
|
||||
self.con.external_bind()
|
||||
except (errors.NetworkError, socket.timeout) as e:
|
||||
msg = 'Unable to connect to dirsrv: %s' % e
|
||||
raise CheckError(msg)
|
||||
except errors.AuthorizationError as e:
|
||||
msg = 'Authorization error: %s' % e
|
||||
raise CheckError(msg)
|
||||
except Exception as e:
|
||||
msg = ('Unknown error while retrieving setting from %s: %s' %
|
||||
(self.ldap_uri, e))
|
||||
logger.exception('%s', msg)
|
||||
raise FatalError(msg)
|
||||
|
||||
def _find_entry(self, dn, attrs, filter, scope=LDAPClient.SCOPE_BASE):
|
||||
"""Find an LDAP entry, handles NotFound and Limit"""
|
||||
try:
|
||||
entries = self.con.get_entries(
|
||||
dn, scope, filter, attrs, time_limit=self.time_limit)
|
||||
except errors.NotFound:
|
||||
logger.debug('Entry not found: %s', dn)
|
||||
return None
|
||||
except Exception as e:
|
||||
msg = ('Unknown error while retrieving setting from %s: %s' %
|
||||
(self.ldap_uri, e))
|
||||
logger.exception('%s', msg)
|
||||
raise FatalError(msg)
|
||||
return entries[0]
|
||||
|
||||
def is_host_enabled(self):
|
||||
"""Check replica specific flag"""
|
||||
logger.debug('Read settings from dn: %s', self.kdc_dn)
|
||||
srcfilter = self.con.make_filter(
|
||||
{'ipaConfigString': u'kdcProxyEnabled'}
|
||||
)
|
||||
entry = self._find_entry(self.kdc_dn, ['cn'], srcfilter)
|
||||
logger.debug('%s ipaConfigString: %s', self.kdc_dn, entry)
|
||||
return entry is not None
|
||||
|
||||
def validate_symlink(self):
|
||||
"""Validate symlink in Apache conf.d"""
|
||||
if not os.path.exists(self.conflink):
|
||||
return False
|
||||
if not os.path.islink(self.conflink):
|
||||
raise ConfigFileError(
|
||||
"'%s' already exists, but it is not a symlink"
|
||||
% self.conflink)
|
||||
dest = os.readlink(self.conflink)
|
||||
if dest != self.conf:
|
||||
raise ConfigFileError(
|
||||
"'%s' points to '%s', expected '%s'"
|
||||
% (self.conflink, dest, self.conf))
|
||||
return True
|
||||
|
||||
def create_symlink(self):
|
||||
"""Create symlink to enable KDC proxy support"""
|
||||
try:
|
||||
valid = self.validate_symlink()
|
||||
except ConfigFileError as e:
|
||||
logger.warning("Cannot enable KDC proxy: %s ", e)
|
||||
return False
|
||||
|
||||
if valid:
|
||||
logger.debug("Symlink exists and is valid")
|
||||
return True
|
||||
|
||||
if not os.path.isfile(self.conf):
|
||||
logger.warning("'%s' does not exist", self.conf)
|
||||
return False
|
||||
|
||||
# create the symbolic link
|
||||
logger.debug("Creating symlink from '%s' to '%s'",
|
||||
self.conf, self.conflink)
|
||||
os.symlink(self.conf, self.conflink)
|
||||
return True
|
||||
|
||||
def remove_symlink(self):
|
||||
"""Delete symlink to disable KDC proxy support"""
|
||||
try:
|
||||
valid = self.validate_symlink()
|
||||
except CheckError as e:
|
||||
logger.warning("Cannot disable KDC proxy: %s ", e)
|
||||
return False
|
||||
|
||||
if valid:
|
||||
logger.debug("Removing symlink '%s'", self.conflink)
|
||||
os.unlink(self.conflink)
|
||||
else:
|
||||
logger.debug("Symlink '%s' has already been removed.",
|
||||
self.conflink)
|
||||
|
||||
return True
|
||||
|
||||
def __enter__(self):
|
||||
self._ldap_con()
|
||||
return self
|
||||
|
||||
def __exit__(self, exc_type, exc_value, traceback):
|
||||
if self.con is not None:
|
||||
self.con.unbind()
|
||||
self.con = None
|
||||
|
||||
|
||||
def main(debug=DEBUG, time_limit=TIME_LIMIT):
|
||||
# initialize API without file logging
|
||||
if not api.isdone('bootstrap'):
|
||||
api.bootstrap(context='server', confdir=paths.ETC_IPA,
|
||||
log=None, debug=debug)
|
||||
standard_logging_setup(verbose=True, debug=debug)
|
||||
|
||||
try:
|
||||
cfg = KDCProxyConfig(time_limit)
|
||||
with cfg:
|
||||
if cfg.is_host_enabled():
|
||||
if cfg.create_symlink():
|
||||
logger.info('KDC proxy enabled')
|
||||
return 0
|
||||
else:
|
||||
if cfg.remove_symlink():
|
||||
logger.info('KDC proxy disabled')
|
||||
return 0
|
||||
except CheckError as e:
|
||||
logger.warning('%s', str(e))
|
||||
logger.warning('Disabling KDC proxy')
|
||||
cfg.remove_symlink()
|
||||
return 0
|
||||
except Exception as e:
|
||||
logger.error('%s', str(e))
|
||||
return 1
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
sys.exit(main())
|
||||
23
install/tools/ipa-kra-install
Normal file
23
install/tools/ipa-kra-install
Normal file
@@ -0,0 +1,23 @@
|
||||
#! /usr/bin/python2 -E
|
||||
# Authors: Ade Lee <alee@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2014 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
from ipaserver.install.ipa_kra_install import KRAInstall
|
||||
|
||||
KRAInstall.run_cli()
|
||||
25
install/tools/ipa-ldap-updater
Executable file
25
install/tools/ipa-ldap-updater
Executable file
@@ -0,0 +1,25 @@
|
||||
#!/usr/bin/python2
|
||||
# Authors: Rob Crittenden <rcritten@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2008 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
# Documentation can be found at http://freeipa.org/page/LdapUpdate
|
||||
|
||||
from ipaserver.install.ipa_ldap_updater import LDAPUpdater
|
||||
|
||||
LDAPUpdater.run_cli()
|
||||
203
install/tools/ipa-managed-entries
Executable file
203
install/tools/ipa-managed-entries
Executable file
@@ -0,0 +1,203 @@
|
||||
#!/usr/bin/python2
|
||||
# Authors: Jr Aquino <jr.aquino@citrix.com>
|
||||
#
|
||||
# Copyright (C) 2011 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
from __future__ import print_function
|
||||
|
||||
import logging
|
||||
import os
|
||||
import re
|
||||
import sys
|
||||
from optparse import OptionParser # pylint: disable=deprecated-module
|
||||
|
||||
from ipaplatform.paths import paths
|
||||
from ipapython import config
|
||||
from ipaserver.install import installutils
|
||||
from ipalib import api, errors
|
||||
from ipapython.ipa_log_manager import standard_logging_setup
|
||||
from ipapython.dn import DN
|
||||
|
||||
logger = logging.getLogger(os.path.basename(__file__))
|
||||
|
||||
|
||||
def parse_options():
|
||||
usage = "%prog [options] <status|enable|disable>\n"
|
||||
usage += "%prog [options]\n"
|
||||
parser = OptionParser(usage=usage, formatter=config.IPAFormatter())
|
||||
|
||||
parser.add_option("-d", "--debug", action="store_true", dest="debug",
|
||||
help="Display debugging information about the update(s)")
|
||||
parser.add_option("-e", "--entry", dest="managed_entry",
|
||||
default=None, type="string",
|
||||
help="DN for the Managed Entry Definition")
|
||||
parser.add_option("-l", "--list", dest="list_managed_entries",
|
||||
action="store_true",
|
||||
help="List available Managed Entries")
|
||||
parser.add_option("-p", "--password", dest="dirman_password",
|
||||
help="Directory Manager password")
|
||||
|
||||
options, args = parser.parse_args()
|
||||
|
||||
return options, args
|
||||
|
||||
def get_dirman_password():
|
||||
"""Prompt the user for the Directory Manager password and verify its
|
||||
correctness.
|
||||
"""
|
||||
password = installutils.read_password("Directory Manager", confirm=False,
|
||||
validate=True)
|
||||
|
||||
return password
|
||||
|
||||
def main():
|
||||
retval = 0
|
||||
def_dn = None
|
||||
|
||||
installutils.check_server_configuration()
|
||||
|
||||
options, args = parse_options()
|
||||
|
||||
if options.list_managed_entries:
|
||||
pass
|
||||
elif len(args) != 1:
|
||||
sys.exit("You must specify an action, either status, enable or disable")
|
||||
elif args[0] != "enable" and args[0] != "disable" and args[0] != "status":
|
||||
sys.exit("Unrecognized action [" + args[0] + "]")
|
||||
standard_logging_setup(None, debug=options.debug)
|
||||
|
||||
api.bootstrap(
|
||||
context='cli',
|
||||
in_server=True,
|
||||
debug=options.debug,
|
||||
confdir=paths.ETC_IPA)
|
||||
api.finalize()
|
||||
api.Backend.ldap2.connect(bind_pw=options.dirman_password)
|
||||
|
||||
managed_entry_definitions_dn = DN(
|
||||
('cn', 'Definitions'),
|
||||
('cn', 'Managed Entries'),
|
||||
('cn', 'etc'),
|
||||
api.env.basedn
|
||||
)
|
||||
|
||||
filter = '(objectClass=extensibleObject)'
|
||||
|
||||
if options.list_managed_entries:
|
||||
# List available Managed Entry Plugins
|
||||
managed_entries = None
|
||||
try:
|
||||
entries = api.Backend.ldap2.get_entries(
|
||||
managed_entry_definitions_dn, api.Backend.ldap2.SCOPE_SUBTREE, filter)
|
||||
except Exception as e:
|
||||
logger.debug("Search for managed entries failed: %s", str(e))
|
||||
sys.exit("Unable to find managed entries at %s" % managed_entry_definitions_dn)
|
||||
managed_entries = [entry.single_value['cn'] for entry in entries]
|
||||
if managed_entries:
|
||||
print("Available Managed Entry Definitions:")
|
||||
for managed_entry in managed_entries:
|
||||
print(managed_entry)
|
||||
retval = 0
|
||||
sys.exit()
|
||||
|
||||
if not options.managed_entry:
|
||||
sys.exit("\nYou must specify a managed entry definition")
|
||||
else:
|
||||
def_dn = DN(('cn', options.managed_entry), managed_entry_definitions_dn)
|
||||
|
||||
disabled = True
|
||||
try:
|
||||
entry = api.Backend.ldap2.get_entry(def_dn)
|
||||
disable_attr = '(objectclass=disable)'
|
||||
try:
|
||||
org_filter = entry.single_value.get('originfilter')
|
||||
disabled = re.search(r'%s' % disable_attr, org_filter)
|
||||
except KeyError:
|
||||
sys.exit("%s is not a valid Managed Entry" % def_dn)
|
||||
except errors.NotFound:
|
||||
sys.exit("%s is not a valid Managed Entry" % def_dn)
|
||||
except errors.ExecutionError as lde:
|
||||
print("An error occurred while talking to the server.")
|
||||
print(lde)
|
||||
|
||||
if args[0] == "status":
|
||||
if not disabled:
|
||||
print("Plugin Enabled")
|
||||
else:
|
||||
print("Plugin Disabled")
|
||||
return 0
|
||||
|
||||
if args[0] == "enable":
|
||||
try:
|
||||
if not disabled:
|
||||
print("Plugin already Enabled")
|
||||
retval = 2
|
||||
else:
|
||||
# Remove disable_attr from filter
|
||||
enable_attr = org_filter.replace(disable_attr, '')
|
||||
#enable_attr = {'originfilter': enable_attr}
|
||||
entry['originfilter'] = [enable_attr]
|
||||
api.Backend.ldap2.update_entry(entry)
|
||||
print("Enabling Plugin")
|
||||
retval = 0
|
||||
except errors.NotFound:
|
||||
print("Enabling Plugin")
|
||||
except errors.ExecutionError as lde:
|
||||
print("An error occurred while talking to the server.")
|
||||
print(lde)
|
||||
retval = 1
|
||||
|
||||
elif args[0] == "disable":
|
||||
# Set originFilter to objectclass=disabled
|
||||
# In future we should we should dedicate an attribute for enabling/
|
||||
# disabling.
|
||||
try:
|
||||
if disabled:
|
||||
print("Plugin already disabled")
|
||||
retval = 2
|
||||
else:
|
||||
if org_filter[:2] == '(&' and org_filter[-1] == ')':
|
||||
disable_attr = org_filter[:2] + disable_attr + org_filter[2:]
|
||||
else:
|
||||
disable_attr = '(&%s(%s))' % (disable_attr, org_filter)
|
||||
entry['originfilter'] = [disable_attr]
|
||||
api.Backend.ldap2.update_entry(entry)
|
||||
print("Disabling Plugin")
|
||||
except errors.NotFound:
|
||||
print("Plugin is already disabled")
|
||||
retval = 2
|
||||
except errors.DatabaseError as dbe:
|
||||
print("An error occurred while talking to the server.")
|
||||
print(dbe)
|
||||
retval = 1
|
||||
except errors.ExecutionError as lde:
|
||||
print("An error occurred while talking to the server.")
|
||||
print(lde)
|
||||
retval = 1
|
||||
|
||||
else:
|
||||
retval = 1
|
||||
|
||||
api.Backend.ldap2.disconnect()
|
||||
|
||||
return retval
|
||||
|
||||
if __name__ == '__main__':
|
||||
if not os.geteuid() == 0:
|
||||
sys.exit("\nMust be run as root\n")
|
||||
installutils.run_script(main, operation_name='ipa-managed-entries')
|
||||
205
install/tools/ipa-nis-manage
Executable file
205
install/tools/ipa-nis-manage
Executable file
@@ -0,0 +1,205 @@
|
||||
#!/usr/bin/python2
|
||||
# Authors: Rob Crittenden <rcritten@redhat.com>
|
||||
# Authors: Simo Sorce <ssorce@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2009 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
from __future__ import print_function
|
||||
|
||||
import sys
|
||||
import os
|
||||
from ipaplatform.paths import paths
|
||||
try:
|
||||
from optparse import OptionParser # pylint: disable=deprecated-module
|
||||
from ipapython import ipautil, config
|
||||
from ipaserver.install import installutils
|
||||
from ipaserver.install.ldapupdate import LDAPUpdate
|
||||
from ipalib import api, errors
|
||||
from ipapython.ipa_log_manager import standard_logging_setup
|
||||
from ipapython.dn import DN
|
||||
from ipaplatform import services
|
||||
except ImportError as e:
|
||||
print("""\
|
||||
There was a problem importing one of the required Python modules. The
|
||||
error was:
|
||||
|
||||
%s
|
||||
""" % e, file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
nis_config_dn = DN(('cn', 'NIS Server'), ('cn', 'plugins'), ('cn', 'config'))
|
||||
compat_dn = DN(('cn', 'Schema Compatibility'), ('cn', 'plugins'), ('cn', 'config'))
|
||||
|
||||
def parse_options():
|
||||
usage = "%prog [options] <enable|disable|status>\n"
|
||||
usage += "%prog [options]\n"
|
||||
parser = OptionParser(usage=usage, formatter=config.IPAFormatter())
|
||||
|
||||
parser.add_option("-d", "--debug", action="store_true", dest="debug",
|
||||
help="Display debugging information about the update(s)")
|
||||
parser.add_option("-y", dest="password",
|
||||
help="File containing the Directory Manager password")
|
||||
|
||||
config.add_standard_options(parser)
|
||||
options, args = parser.parse_args()
|
||||
|
||||
return options, args
|
||||
|
||||
def get_dirman_password():
|
||||
"""Prompt the user for the Directory Manager password and verify its
|
||||
correctness.
|
||||
"""
|
||||
password = installutils.read_password("Directory Manager", confirm=False, validate=False, retry=False)
|
||||
|
||||
return password
|
||||
|
||||
def get_entry(dn):
|
||||
"""
|
||||
Return the entry for the given DN. If the entry is not found return
|
||||
None.
|
||||
"""
|
||||
entry = None
|
||||
try:
|
||||
entry = api.Backend.ldap2.get_entry(dn)
|
||||
except errors.NotFound:
|
||||
pass
|
||||
return entry
|
||||
|
||||
def main():
|
||||
retval = 0
|
||||
files = [paths.NIS_ULDIF]
|
||||
servicemsg = ""
|
||||
|
||||
if os.getegid() != 0:
|
||||
sys.exit('Must be root to use this tool.')
|
||||
|
||||
installutils.check_server_configuration()
|
||||
|
||||
options, args = parse_options()
|
||||
|
||||
if len(args) != 1:
|
||||
sys.exit("You must specify one action: enable | disable | status")
|
||||
elif args[0] not in {"enable", "disable", "status"}:
|
||||
sys.exit("Unrecognized action [" + args[0] + "]")
|
||||
|
||||
standard_logging_setup(None, debug=options.debug)
|
||||
dirman_password = ""
|
||||
if options.password:
|
||||
try:
|
||||
pw = ipautil.template_file(options.password, [])
|
||||
except IOError:
|
||||
sys.exit("File \"%s\" not found or not readable" % options.password)
|
||||
dirman_password = pw.strip()
|
||||
else:
|
||||
dirman_password = get_dirman_password()
|
||||
if dirman_password is None:
|
||||
sys.exit("Directory Manager password required")
|
||||
|
||||
if not dirman_password:
|
||||
sys.exit("No password supplied")
|
||||
|
||||
api.bootstrap(
|
||||
context='cli', confdir=paths.ETC_IPA,
|
||||
debug=options.debug, in_server=True)
|
||||
api.finalize()
|
||||
api.Backend.ldap2.connect(bind_pw=dirman_password)
|
||||
|
||||
if args[0] == "enable":
|
||||
compat = get_entry(compat_dn)
|
||||
if compat is None or compat.get('nsslapd-pluginenabled', [''])[0].lower() == 'off':
|
||||
sys.exit("The compat plugin needs to be enabled: ipa-compat-manage enable")
|
||||
entry = None
|
||||
try:
|
||||
entry = get_entry(nis_config_dn)
|
||||
except errors.ExecutionError as lde:
|
||||
print("An error occurred while talking to the server.")
|
||||
print(lde)
|
||||
retval = 1
|
||||
|
||||
# Enable either the portmap or rpcbind service
|
||||
portmap = services.knownservices.portmap
|
||||
rpcbind = services.knownservices.rpcbind
|
||||
|
||||
if portmap.is_installed():
|
||||
portmap.enable()
|
||||
servicemsg = portmap.service_name
|
||||
elif rpcbind.is_installed():
|
||||
rpcbind.enable()
|
||||
servicemsg = rpcbind.service_name
|
||||
else:
|
||||
print("Unable to enable either %s or %s" % (portmap.service_name, rpcbind.service_name))
|
||||
retval = 3
|
||||
|
||||
# The cn=config entry for the plugin may already exist but it
|
||||
# could be turned off, handle both cases.
|
||||
if entry is None:
|
||||
print("Enabling plugin")
|
||||
ld = LDAPUpdate(dm_password=dirman_password, sub_dict={}, ldapi=True)
|
||||
if ld.update(files) != True:
|
||||
retval = 1
|
||||
elif entry.get('nsslapd-pluginenabled', [''])[0].lower() == 'off':
|
||||
print("Enabling plugin")
|
||||
# Already configured, just enable the plugin
|
||||
entry['nsslapd-pluginenabled'] = ['on']
|
||||
api.Backend.ldap2.update_entry(entry)
|
||||
else:
|
||||
print("Plugin already Enabled")
|
||||
retval = 2
|
||||
|
||||
elif args[0] == "disable":
|
||||
try:
|
||||
entry = api.Backend.ldap2.get_entry(nis_config_dn, ['nsslapd-pluginenabled'])
|
||||
entry['nsslapd-pluginenabled'] = ['off']
|
||||
api.Backend.ldap2.update_entry(entry)
|
||||
except (errors.NotFound, errors.EmptyModlist):
|
||||
print("Plugin is already disabled")
|
||||
retval = 2
|
||||
except errors.LDAPError as lde:
|
||||
print("An error occurred while talking to the server.")
|
||||
print(lde)
|
||||
retval = 1
|
||||
|
||||
elif args[0] == "status":
|
||||
nis_entry = get_entry(nis_config_dn)
|
||||
enabled = (nis_entry and
|
||||
nis_entry.get(
|
||||
'nsslapd-pluginenabled', '')[0].lower() == "on")
|
||||
if enabled:
|
||||
print("Plugin is enabled")
|
||||
retval = 0
|
||||
else:
|
||||
print("Plugin is not enabled")
|
||||
retval = 4
|
||||
|
||||
else:
|
||||
retval = 1
|
||||
|
||||
if retval == 0:
|
||||
if args[0] in {"enable", "disable"}:
|
||||
print("This setting will not take effect until you restart "
|
||||
"Directory Server.")
|
||||
|
||||
if args[0] == "enable":
|
||||
print("The %s service may need to be started." % servicemsg)
|
||||
|
||||
api.Backend.ldap2.disconnect()
|
||||
|
||||
return retval
|
||||
|
||||
if __name__ == '__main__':
|
||||
installutils.run_script(main, operation_name='ipa-nis-manage')
|
||||
23
install/tools/ipa-otptoken-import
Executable file
23
install/tools/ipa-otptoken-import
Executable file
@@ -0,0 +1,23 @@
|
||||
#! /usr/bin/python2 -E
|
||||
# Authors: Nathaniel McCallum <npmccallum@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2014 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
from ipaserver.install.ipa_otptoken_import import OTPTokenImport
|
||||
|
||||
OTPTokenImport.run_cli()
|
||||
42
install/tools/ipa-pki-retrieve-key
Executable file
42
install/tools/ipa-pki-retrieve-key
Executable file
@@ -0,0 +1,42 @@
|
||||
#!/usr/bin/python2
|
||||
|
||||
from __future__ import print_function
|
||||
|
||||
import os
|
||||
import sys
|
||||
import traceback
|
||||
|
||||
from ipalib import constants
|
||||
from ipalib.config import Env
|
||||
from ipaplatform.paths import paths
|
||||
from ipaserver.secrets.client import CustodiaClient
|
||||
|
||||
|
||||
def main():
|
||||
env = Env()
|
||||
env._finalize()
|
||||
|
||||
keyname = "ca_wrapped/" + sys.argv[1]
|
||||
servername = sys.argv[2]
|
||||
|
||||
service = constants.PKI_GSSAPI_SERVICE_NAME
|
||||
client_keyfile = os.path.join(paths.PKI_TOMCAT, service + '.keys')
|
||||
client_keytab = os.path.join(paths.PKI_TOMCAT, service + '.keytab')
|
||||
|
||||
# pylint: disable=no-member
|
||||
client = CustodiaClient(
|
||||
client_service='%s@%s' % (service, env.host), server=servername,
|
||||
realm=env.realm, ldap_uri="ldaps://" + env.host,
|
||||
keyfile=client_keyfile, keytab=client_keytab,
|
||||
)
|
||||
|
||||
# Print the response JSON to stdout; it is already in the format
|
||||
# that Dogtag's ExternalProcessKeyRetriever expects
|
||||
print(client.fetch_key(keyname, store=False))
|
||||
|
||||
|
||||
try:
|
||||
main()
|
||||
except BaseException:
|
||||
traceback.print_exc()
|
||||
sys.exit(1)
|
||||
8
install/tools/ipa-pkinit-manage
Executable file
8
install/tools/ipa-pkinit-manage
Executable file
@@ -0,0 +1,8 @@
|
||||
#! /usr/bin/python2 -E
|
||||
#
|
||||
# Copyright (C) 2017 FreeIPA Contributors see COPYING for license
|
||||
#
|
||||
|
||||
from ipaserver.install.ipa_pkinit_manage import PKINITManage
|
||||
|
||||
PKINITManage.run_cli()
|
||||
660
install/tools/ipa-replica-conncheck
Executable file
660
install/tools/ipa-replica-conncheck
Executable file
@@ -0,0 +1,660 @@
|
||||
#! /usr/bin/python2 -E
|
||||
# Authors: Martin Kosek <mkosek@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2011 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
from __future__ import print_function
|
||||
|
||||
import logging
|
||||
|
||||
import ipaclient.install.ipachangeconf
|
||||
from ipapython.config import IPAOptionParser
|
||||
from ipapython.dn import DN
|
||||
from ipapython import version
|
||||
from ipapython import ipautil, certdb
|
||||
from ipalib import api, errors, x509
|
||||
from ipaserver.install import installutils
|
||||
# pylint: disable=deprecated-module
|
||||
from optparse import OptionGroup, OptionValueError
|
||||
# pylint: enable=deprecated-module
|
||||
from ipapython.ipa_log_manager import standard_logging_setup
|
||||
import copy
|
||||
import sys
|
||||
import os
|
||||
import signal
|
||||
import tempfile
|
||||
import select
|
||||
import socket
|
||||
import time
|
||||
import threading
|
||||
import traceback
|
||||
from socket import SOCK_STREAM, SOCK_DGRAM
|
||||
import distutils.spawn
|
||||
from ipaplatform.paths import paths
|
||||
import gssapi
|
||||
|
||||
logger = logging.getLogger(os.path.basename(__file__))
|
||||
|
||||
CONNECT_TIMEOUT = 5
|
||||
RESPONDER = None
|
||||
QUIET = False
|
||||
CCACHE_FILE = None
|
||||
KRB5_CONFIG = None
|
||||
|
||||
|
||||
class SshExec(object):
|
||||
def __init__(self, user, addr):
|
||||
self.user = user
|
||||
self.addr = addr
|
||||
self.cmd = distutils.spawn.find_executable('ssh')
|
||||
# Bail if ssh is not installed
|
||||
if self.cmd is None:
|
||||
raise RuntimeError("ssh not installed")
|
||||
|
||||
def __call__(self, command, verbose=False):
|
||||
|
||||
tmpf = tempfile.NamedTemporaryFile()
|
||||
cmd = [
|
||||
self.cmd,
|
||||
'-o StrictHostKeychecking=no',
|
||||
'-o UserKnownHostsFile=%s' % tmpf.name,
|
||||
'-o GSSAPIAuthentication=yes',
|
||||
'-o User=%s' % self.user,
|
||||
'%s' % self.addr,
|
||||
command
|
||||
]
|
||||
if verbose:
|
||||
cmd.insert(1, '-v')
|
||||
|
||||
env = dict()
|
||||
if KRB5_CONFIG is not None:
|
||||
env['KRB5_CONFIG'] = KRB5_CONFIG
|
||||
elif 'KRB5_CONFIG' in os.environ:
|
||||
env['KRB5_CONFIG'] = os.environ['KRB5_CONFIG']
|
||||
if CCACHE_FILE is not None:
|
||||
env['KRB5CCNAME'] = CCACHE_FILE
|
||||
elif 'KRB5CCNAME' in os.environ:
|
||||
env['KRB5CCNAME'] = os.environ['KRB5CCNAME']
|
||||
|
||||
return ipautil.run(cmd, env=env, raiseonerr=False,
|
||||
capture_output=True, capture_error=True)
|
||||
|
||||
|
||||
class CheckedPort(object):
|
||||
def __init__(self, port, port_type, description):
|
||||
self.port = port
|
||||
self.port_type = port_type
|
||||
self.description = description
|
||||
|
||||
|
||||
BASE_PORTS = [
|
||||
CheckedPort(389, SOCK_STREAM, "Directory Service: Unsecure port"),
|
||||
CheckedPort(636, SOCK_STREAM, "Directory Service: Secure port"),
|
||||
CheckedPort(88, SOCK_STREAM, "Kerberos KDC: TCP"),
|
||||
CheckedPort(88, SOCK_DGRAM, "Kerberos KDC: UDP"),
|
||||
CheckedPort(464, SOCK_STREAM, "Kerberos Kpasswd: TCP"),
|
||||
CheckedPort(464, SOCK_DGRAM, "Kerberos Kpasswd: UDP"),
|
||||
CheckedPort(80, SOCK_STREAM, "HTTP Server: Unsecure port"),
|
||||
CheckedPort(443, SOCK_STREAM, "HTTP Server: Secure port"),
|
||||
]
|
||||
|
||||
|
||||
def parse_options():
|
||||
def ca_cert_file_callback(option, opt, value, parser):
|
||||
if not os.path.exists(value):
|
||||
raise OptionValueError(
|
||||
"%s option '%s' does not exist" % (opt, value))
|
||||
if not os.path.isfile(value):
|
||||
raise OptionValueError(
|
||||
"%s option '%s' is not a file" % (opt, value))
|
||||
if not os.path.isabs(value):
|
||||
raise OptionValueError(
|
||||
"%s option '%s' is not an absolute file path" % (opt, value))
|
||||
|
||||
try:
|
||||
x509.load_certificate_list_from_file(value)
|
||||
except Exception:
|
||||
raise OptionValueError(
|
||||
"%s option '%s' is not a valid certificate file" %
|
||||
(opt, value))
|
||||
|
||||
parser.values.ca_cert_file = value
|
||||
|
||||
parser = IPAOptionParser(version=version.VERSION)
|
||||
|
||||
replica_group = OptionGroup(parser, "on-replica options")
|
||||
replica_group.add_option("-m", "--master", dest="master",
|
||||
help="Master address with running IPA for output connection check")
|
||||
replica_group.add_option("-a", "--auto-master-check", dest="auto_master_check",
|
||||
action="store_true",
|
||||
default=False,
|
||||
help="Automatically execute connection check on master")
|
||||
replica_group.add_option("-r", "--realm", dest="realm",
|
||||
help="Realm name")
|
||||
replica_group.add_option("-k", "--kdc", dest="kdc",
|
||||
help="Master KDC. Defaults to master address")
|
||||
replica_group.add_option("-p", "--principal", dest="principal",
|
||||
default=None, help="Principal to use to log in to remote master")
|
||||
replica_group.add_option("-w", "--password", dest="password", sensitive=True,
|
||||
help="Password for the principal")
|
||||
replica_group.add_option("--ca-cert-file", dest="ca_cert_file",
|
||||
type="string", action="callback",
|
||||
callback=ca_cert_file_callback,
|
||||
help="load the CA certificate from this file")
|
||||
parser.add_option_group(replica_group)
|
||||
|
||||
|
||||
master_group = OptionGroup(parser, "on-master options")
|
||||
master_group.add_option("-R", "--replica", dest="replica",
|
||||
help="Address of remote replica machine to check against")
|
||||
parser.add_option_group(master_group)
|
||||
|
||||
common_group = OptionGroup(parser, "common options")
|
||||
common_group.add_option("-c", "--check-ca", dest="check_ca",
|
||||
action="store_true",
|
||||
default=False,
|
||||
help="Check also ports for Certificate Authority "
|
||||
"(for servers installed before IPA 3.1)")
|
||||
|
||||
common_group.add_option("", "--hostname", dest="hostname",
|
||||
help="The hostname of this server (FQDN). "
|
||||
"By default the result of getfqdn() call from "
|
||||
"Python's socket module is used.")
|
||||
parser.add_option_group(common_group)
|
||||
|
||||
parser.add_option("-d", "--debug", dest="debug",
|
||||
action="store_true",
|
||||
default=False, help="Print debugging information")
|
||||
parser.add_option("-q", "--quiet", dest="quiet",
|
||||
action="store_true",
|
||||
default=False, help="Output only errors")
|
||||
parser.add_option("--no-log", dest="log_to_file", action="store_false",
|
||||
default=True, help="Do not log into file")
|
||||
|
||||
options, _args = parser.parse_args()
|
||||
safe_options = parser.get_safe_opts(options)
|
||||
|
||||
if options.master and options.replica:
|
||||
parser.error("on-master and on-replica options are mutually exclusive!")
|
||||
|
||||
if options.master:
|
||||
if options.auto_master_check and not options.realm:
|
||||
parser.error("Realm is parameter is required to connect to remote master!")
|
||||
if not os.getegid() == 0:
|
||||
parser.error("You can only run on-replica part as root.")
|
||||
|
||||
if options.master and not options.kdc:
|
||||
options.kdc = options.master
|
||||
|
||||
if not options.master and not options.replica:
|
||||
parser.error("No action: you should select either --replica or --master option.")
|
||||
|
||||
if not options.hostname:
|
||||
options.hostname = socket.getfqdn()
|
||||
|
||||
return safe_options, options
|
||||
|
||||
|
||||
def logging_setup(options):
|
||||
log_file = None
|
||||
|
||||
if os.getegid() == 0 and options.log_to_file:
|
||||
log_file = paths.IPAREPLICA_CONNCHECK_LOG
|
||||
|
||||
standard_logging_setup(log_file, verbose=(not options.quiet),
|
||||
debug=options.debug, console_format='%(message)s')
|
||||
|
||||
|
||||
def sigterm_handler(signum, frame):
|
||||
# do what SIGINT does (raise a KeyboardInterrupt)
|
||||
sigint_handler = signal.getsignal(signal.SIGINT)
|
||||
if callable(sigint_handler):
|
||||
sigint_handler(signum, frame)
|
||||
|
||||
|
||||
def configure_krb5_conf(realm, kdc, filename):
|
||||
|
||||
krbconf = ipaclient.install.ipachangeconf.IPAChangeConf("IPA Installer")
|
||||
krbconf.setOptionAssignment((" = ", " "))
|
||||
krbconf.setSectionNameDelimiters(("[","]"))
|
||||
krbconf.setSubSectionDelimiters(("{","}"))
|
||||
krbconf.setIndent((""," "," "))
|
||||
|
||||
opts = [{'name':'comment', 'type':'comment', 'value':'File created by ipa-replica-conncheck'},
|
||||
{'name':'empty', 'type':'empty'}]
|
||||
|
||||
#[libdefaults]
|
||||
libdefaults = [{'name':'default_realm', 'type':'option', 'value':realm}]
|
||||
libdefaults.append({'name':'dns_lookup_realm', 'type':'option', 'value':'false'})
|
||||
libdefaults.append({'name':'dns_lookup_kdc', 'type':'option', 'value':'true'})
|
||||
libdefaults.append({'name':'rdns', 'type':'option', 'value':'false'})
|
||||
libdefaults.append({'name':'ticket_lifetime', 'type':'option', 'value':'24h'})
|
||||
libdefaults.append({'name':'forwardable', 'type':'option', 'value':'true'})
|
||||
libdefaults.append({'name':'udp_preference_limit', 'type':'option', 'value':'0'})
|
||||
|
||||
opts.append({'name':'libdefaults', 'type':'section', 'value': libdefaults})
|
||||
opts.append({'name':'empty', 'type':'empty'})
|
||||
|
||||
#the following are necessary only if DNS discovery does not work
|
||||
#[realms]
|
||||
realms_info =[{'name':'kdc', 'type':'option', 'value':ipautil.format_netloc(kdc, 88)},
|
||||
{'name':'master_kdc', 'type':'option', 'value':ipautil.format_netloc(kdc, 88)},
|
||||
{'name':'admin_server', 'type':'option', 'value':ipautil.format_netloc(kdc, 749)}]
|
||||
realms = [{'name':realm, 'type':'subsection', 'value':realms_info}]
|
||||
|
||||
opts.append({'name':'realms', 'type':'section', 'value':realms})
|
||||
opts.append({'name':'empty', 'type':'empty'})
|
||||
|
||||
#[appdefaults]
|
||||
pamopts = [{'name':'debug', 'type':'option', 'value':'false'},
|
||||
{'name':'ticket_lifetime', 'type':'option', 'value':'36000'},
|
||||
{'name':'renew_lifetime', 'type':'option', 'value':'36000'},
|
||||
{'name':'forwardable', 'type':'option', 'value':'true'},
|
||||
{'name':'krb4_convert', 'type':'option', 'value':'false'}]
|
||||
appopts = [{'name':'pam', 'type':'subsection', 'value':pamopts}]
|
||||
opts.append({'name':'appdefaults', 'type':'section', 'value':appopts})
|
||||
|
||||
logger.debug("Writing temporary Kerberos configuration to %s:\n%s",
|
||||
filename, krbconf.dump(opts))
|
||||
|
||||
krbconf.newConf(filename, opts)
|
||||
|
||||
|
||||
class PortResponder(threading.Thread):
|
||||
|
||||
PROTO = {socket.SOCK_STREAM: 'tcp',
|
||||
socket.SOCK_DGRAM: 'udp'}
|
||||
|
||||
def __init__(self, ports):
|
||||
"""
|
||||
ports: a list of CheckedPort
|
||||
"""
|
||||
super(PortResponder, self).__init__()
|
||||
# copy ports to avoid the need to synchronize it between threads
|
||||
self.ports = copy.deepcopy(ports)
|
||||
self._sockets = []
|
||||
self._close = False
|
||||
self._close_lock = threading.Lock()
|
||||
self.responder_data = b'FreeIPA'
|
||||
self.ports_opened = False
|
||||
self.ports_open_cond = threading.Condition()
|
||||
|
||||
def run(self):
|
||||
logger.debug('Starting listening thread.')
|
||||
|
||||
for port in self.ports:
|
||||
self._bind_to_port(port.port, port.port_type)
|
||||
with self.ports_open_cond:
|
||||
self.ports_opened = True
|
||||
logger.debug('Ports opened, notify original thread')
|
||||
self.ports_open_cond.notify()
|
||||
|
||||
while not self._is_closing():
|
||||
ready_socks, _socks1, _socks2 = select.select(
|
||||
self._sockets, [], [], 1)
|
||||
if ready_socks:
|
||||
ready_sock = ready_socks[0]
|
||||
self._respond(ready_sock)
|
||||
|
||||
for sock in self._sockets:
|
||||
port = sock.getsockname()[1]
|
||||
proto = PortResponder.PROTO[sock.type]
|
||||
sock.close()
|
||||
logger.debug('%d %s: Stopped listening', port, proto)
|
||||
|
||||
def _is_closing(self):
|
||||
with self._close_lock: # pylint: disable=not-context-manager
|
||||
return self._close
|
||||
|
||||
def _bind_to_port(self, port, socket_type):
|
||||
# Use IPv6 socket as it is able to accept both IPv6 and IPv4
|
||||
# connections. Since IPv6 kernel module is required by other
|
||||
# parts of IPA, it should always be available.
|
||||
family = socket.AF_INET6
|
||||
host = '::' # all available interfaces
|
||||
proto = PortResponder.PROTO[socket_type]
|
||||
|
||||
try:
|
||||
sock = socket.socket(family, socket_type)
|
||||
|
||||
# Make sure IPv4 clients can connect to IPv6 socket
|
||||
sock.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 0)
|
||||
|
||||
if socket_type == socket.SOCK_STREAM:
|
||||
sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
|
||||
|
||||
sock.bind((host, port))
|
||||
if socket_type == socket.SOCK_STREAM:
|
||||
# There might be a delay before accepting the connection,
|
||||
# because a single thread is used to handle all the
|
||||
# connections. Thus a backlog size of at least 1 is needed.
|
||||
sock.listen(1)
|
||||
|
||||
logger.debug('%d %s: Started listening', port, proto)
|
||||
except socket.error:
|
||||
logger.warning('%d %s: Failed to bind', port, proto)
|
||||
logger.debug("%s", traceback.format_exc())
|
||||
else:
|
||||
self._sockets.append(sock)
|
||||
|
||||
def _respond(self, sock):
|
||||
port = sock.getsockname()[1]
|
||||
if sock.type == socket.SOCK_STREAM:
|
||||
connection, addr = sock.accept()
|
||||
try:
|
||||
connection.sendall(self.responder_data)
|
||||
logger.debug('%d tcp: Responded to %s', port, addr[0])
|
||||
finally:
|
||||
connection.close()
|
||||
elif sock.type == socket.SOCK_DGRAM:
|
||||
_data, addr = sock.recvfrom(1)
|
||||
sock.sendto(self.responder_data, addr)
|
||||
logger.debug('%d udp: Responded to %s', port, addr[0])
|
||||
|
||||
def stop(self):
|
||||
logger.debug('Stopping listening thread.')
|
||||
|
||||
with self._close_lock: # pylint: disable=not-context-manager
|
||||
self._close = True
|
||||
|
||||
|
||||
def port_check(host, port_list):
|
||||
ports_failed = []
|
||||
ports_udp_warning = [] # conncheck could not verify that port is open
|
||||
log_level = {
|
||||
SOCK_DGRAM: logging.WARNING,
|
||||
SOCK_STREAM: logging.ERROR
|
||||
}
|
||||
for port in port_list:
|
||||
try:
|
||||
port_open = ipautil.host_port_open(
|
||||
host, port.port, port.port_type,
|
||||
socket_timeout=CONNECT_TIMEOUT, log_errors=True,
|
||||
log_level=log_level[port.port_type])
|
||||
except socket.gaierror:
|
||||
raise RuntimeError("Port check failed! Unable to resolve host name '%s'" % host)
|
||||
if port_open:
|
||||
result = "OK"
|
||||
else:
|
||||
if port.port_type == socket.SOCK_DGRAM:
|
||||
ports_udp_warning.append(port)
|
||||
result = "WARNING"
|
||||
else:
|
||||
ports_failed.append(port)
|
||||
result = "FAILED"
|
||||
logger.info(" %s (%d): %s", port.description, port.port, result)
|
||||
|
||||
if ports_udp_warning:
|
||||
logger.warning(
|
||||
("The following UDP ports could not be verified as open: %s\n"
|
||||
"This can happen if they are already bound to an application\n"
|
||||
"and ipa-replica-conncheck cannot attach own UDP responder."),
|
||||
", ".join(str(port.port) for port in ports_udp_warning))
|
||||
|
||||
if ports_failed:
|
||||
msg_ports = []
|
||||
for port in ports_failed:
|
||||
port_type_text = "TCP" if port.port_type == SOCK_STREAM else "UDP"
|
||||
msg_ports.append('%d (%s)' % (port.port, port_type_text))
|
||||
raise RuntimeError("Port check failed! Inaccessible port(s): %s" \
|
||||
% ", ".join(msg_ports))
|
||||
|
||||
|
||||
def main():
|
||||
global RESPONDER
|
||||
safe_options, options = parse_options()
|
||||
|
||||
logging_setup(options)
|
||||
logger.debug('%s was invoked with options: %s', sys.argv[0], safe_options)
|
||||
logger.debug("missing options might be asked for interactively later\n")
|
||||
logger.debug('IPA version %s', version.VENDOR_VERSION)
|
||||
|
||||
signal.signal(signal.SIGTERM, sigterm_handler)
|
||||
|
||||
required_ports = BASE_PORTS
|
||||
if options.check_ca:
|
||||
# Check old Dogtag CA replication port
|
||||
# New installs with unified databases use main DS port (checked above)
|
||||
required_ports.append(CheckedPort(7389, SOCK_STREAM,
|
||||
"PKI-CA: Directory Service port"))
|
||||
|
||||
if options.replica:
|
||||
logger.info("Check connection from master to remote replica '%s':",
|
||||
options.replica)
|
||||
port_check(options.replica, required_ports)
|
||||
logger.info("\nConnection from master to replica is OK.")
|
||||
|
||||
# kinit to foreign master
|
||||
if options.master:
|
||||
# check ports on master first
|
||||
logger.info("Check connection from replica to remote master '%s':",
|
||||
options.master)
|
||||
tcp_ports = [ port for port in required_ports if port.port_type == SOCK_STREAM ]
|
||||
udp_ports = [ port for port in required_ports if port.port_type == SOCK_DGRAM ]
|
||||
port_check(options.master, tcp_ports)
|
||||
|
||||
if udp_ports:
|
||||
logger.info("\nThe following list of ports use UDP protocol"
|
||||
"and would need to be\n"
|
||||
"checked manually:")
|
||||
for port in udp_ports:
|
||||
result = "SKIPPED"
|
||||
logger.info(" %s (%d): %s",
|
||||
port.description, port.port, result)
|
||||
|
||||
logger.info("\nConnection from replica to master is OK.")
|
||||
|
||||
# create listeners
|
||||
logger.info("Start listening on required ports for remote "
|
||||
"master check")
|
||||
|
||||
RESPONDER = PortResponder(required_ports)
|
||||
RESPONDER.start()
|
||||
|
||||
with RESPONDER.ports_open_cond:
|
||||
if not RESPONDER.ports_opened:
|
||||
logger.debug('Original thread stopped')
|
||||
RESPONDER.ports_open_cond.wait()
|
||||
logger.debug('Original thread resumed')
|
||||
|
||||
remote_check_opts = ['--replica %s' % options.hostname]
|
||||
|
||||
if options.auto_master_check:
|
||||
logger.info("Get credentials to log in to remote master")
|
||||
cred = None
|
||||
if options.principal is None:
|
||||
# Check if ccache is available
|
||||
try:
|
||||
logger.debug('KRB5CCNAME set to %s',
|
||||
os.environ.get('KRB5CCNAME', None))
|
||||
# get default creds, will raise if none found
|
||||
cred = gssapi.creds.Credentials()
|
||||
principal = str(cred.name)
|
||||
except gssapi.raw.misc.GSSError as e:
|
||||
logger.debug('Failed to find default ccache: %s', e)
|
||||
# Use admin as the default principal
|
||||
principal = "admin"
|
||||
else:
|
||||
principal = options.principal
|
||||
|
||||
if cred is None:
|
||||
(krb_fd, krb_name) = tempfile.mkstemp()
|
||||
os.close(krb_fd)
|
||||
configure_krb5_conf(options.realm, options.kdc, krb_name)
|
||||
global KRB5_CONFIG
|
||||
KRB5_CONFIG = krb_name
|
||||
(ccache_fd, ccache_name) = tempfile.mkstemp()
|
||||
os.close(ccache_fd)
|
||||
global CCACHE_FILE
|
||||
CCACHE_FILE = ccache_name
|
||||
|
||||
if principal.find('@') == -1:
|
||||
principal = '%s@%s' % (principal, options.realm)
|
||||
|
||||
if options.password:
|
||||
password=options.password
|
||||
else:
|
||||
password = installutils.read_password(principal, confirm=False,
|
||||
validate=False, retry=False)
|
||||
if password is None:
|
||||
sys.exit("Principal password required")
|
||||
|
||||
|
||||
result = ipautil.run([paths.KINIT, principal],
|
||||
env={'KRB5_CONFIG':KRB5_CONFIG, 'KRB5CCNAME':CCACHE_FILE},
|
||||
stdin=password, raiseonerr=False, capture_error=True)
|
||||
if result.returncode != 0:
|
||||
raise RuntimeError("Cannot acquire Kerberos ticket: %s" %
|
||||
result.error_output)
|
||||
|
||||
# Verify kinit was actually successful
|
||||
result = ipautil.run([paths.BIN_KVNO,
|
||||
'host/%s' % options.master],
|
||||
env={'KRB5_CONFIG':KRB5_CONFIG, 'KRB5CCNAME':CCACHE_FILE},
|
||||
raiseonerr=False, capture_error=True)
|
||||
if result.returncode != 0:
|
||||
raise RuntimeError("Could not get ticket for master server: %s" %
|
||||
result.error_output)
|
||||
# Now that the cred cache file is initialized,
|
||||
# use it for the IPA API calls
|
||||
os.environ['KRB5CCNAME'] = CCACHE_FILE
|
||||
|
||||
try:
|
||||
logger.info("Check RPC connection to remote master")
|
||||
|
||||
xmlrpc_uri = ('https://%s/ipa/xml' %
|
||||
ipautil.format_netloc(options.master))
|
||||
|
||||
if options.ca_cert_file:
|
||||
nss_dir = None
|
||||
else:
|
||||
nss_dir = paths.IPA_NSSDB_DIR
|
||||
|
||||
with certdb.NSSDatabase(nss_dir) as nss_db:
|
||||
if options.ca_cert_file:
|
||||
nss_db.create_db()
|
||||
ca_certs = x509.load_certificate_list_from_file(
|
||||
options.ca_cert_file)
|
||||
for ca_cert in ca_certs:
|
||||
nss_db.add_cert(
|
||||
ca_cert,
|
||||
str(DN(ca_cert.subject)),
|
||||
certdb.EXTERNAL_CA_TRUST_FLAGS)
|
||||
|
||||
api.bootstrap(context='client',
|
||||
confdir=paths.ETC_IPA,
|
||||
xmlrpc_uri=xmlrpc_uri,
|
||||
nss_dir=nss_db.secdir)
|
||||
api.finalize()
|
||||
try:
|
||||
api.Backend.rpcclient.connect()
|
||||
api.Command.ping()
|
||||
except Exception as e:
|
||||
logger.info(
|
||||
"Could not connect to the remote host: %s", e)
|
||||
raise
|
||||
|
||||
logger.info("Execute check on remote master")
|
||||
try:
|
||||
result = api.Backend.rpcclient.forward(
|
||||
'server_conncheck',
|
||||
ipautil.fsdecode(options.master),
|
||||
ipautil.fsdecode(options.hostname),
|
||||
version=u'2.162',
|
||||
)
|
||||
except (errors.CommandError, errors.NetworkError) as e:
|
||||
logger.info(
|
||||
"Remote master does not support check over RPC: "
|
||||
"%s", e)
|
||||
raise
|
||||
except errors.PublicError as e:
|
||||
returncode = 1
|
||||
stderr = e
|
||||
else:
|
||||
for message in result['messages']:
|
||||
logger.info('%s', message['message'])
|
||||
returncode = int(not result['result'])
|
||||
stderr = ("ipa-replica-conncheck returned non-zero "
|
||||
"exit code")
|
||||
finally:
|
||||
if api.Backend.rpcclient.isconnected():
|
||||
api.Backend.rpcclient.disconnect()
|
||||
except Exception as e:
|
||||
logger.debug("RPC connection failed: %s", e)
|
||||
logger.info("Retrying using SSH...")
|
||||
|
||||
# Ticket 5812 Always qualify requests for admin
|
||||
user = principal
|
||||
try:
|
||||
ssh = SshExec(user, options.master)
|
||||
except RuntimeError as e:
|
||||
logger.warning("WARNING: %s, skipping ssh test", e)
|
||||
return 0
|
||||
|
||||
logger.info("Check SSH connection to remote master")
|
||||
result = ssh('echo OK', verbose=True)
|
||||
if result.returncode != 0:
|
||||
logger.debug('%s', result.error_output)
|
||||
raise RuntimeError(
|
||||
'Could not SSH to remote host.\n'
|
||||
'See /var/log/ipareplica-conncheck.log for more '
|
||||
'information.')
|
||||
|
||||
logger.info("Execute check on remote master")
|
||||
result = ssh(
|
||||
"/usr/sbin/ipa-replica-conncheck " +
|
||||
" ".join(remote_check_opts))
|
||||
returncode = result.returncode
|
||||
stderr = result.error_output
|
||||
logger.info('%s', result.output)
|
||||
if returncode != 0:
|
||||
raise RuntimeError(
|
||||
"Remote master check failed with following "
|
||||
"error message(s):\n%s" % stderr)
|
||||
else:
|
||||
# wait until user test is ready
|
||||
logger.info(
|
||||
"Listeners are started. Use CTRL+C to terminate the listening "
|
||||
"part after the test.\n\n"
|
||||
"Please run the following command on remote master:\n"
|
||||
"/usr/sbin/ipa-replica-conncheck %s",
|
||||
" ".join(remote_check_opts))
|
||||
time.sleep(3600)
|
||||
logger.info(
|
||||
"Connection check timeout: terminating listening program")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
try:
|
||||
sys.exit(main())
|
||||
except KeyboardInterrupt:
|
||||
logger.info("\nCleaning up...")
|
||||
sys.exit(1)
|
||||
except RuntimeError as e:
|
||||
logger.error('ERROR: %s', e)
|
||||
sys.exit(1)
|
||||
finally:
|
||||
if RESPONDER is not None:
|
||||
RESPONDER.stop()
|
||||
RESPONDER.join()
|
||||
for file_name in (CCACHE_FILE, KRB5_CONFIG):
|
||||
if file_name:
|
||||
try:
|
||||
os.remove(file_name)
|
||||
except OSError:
|
||||
pass
|
||||
23
install/tools/ipa-replica-install
Executable file
23
install/tools/ipa-replica-install
Executable file
@@ -0,0 +1,23 @@
|
||||
#! /usr/bin/python2 -E
|
||||
# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
|
||||
#
|
||||
# Copyright (C) 2007 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
from ipaserver.install import ipa_replica_install
|
||||
|
||||
ipa_replica_install.run()
|
||||
1638
install/tools/ipa-replica-manage
Executable file
1638
install/tools/ipa-replica-manage
Executable file
File diff suppressed because it is too large
Load Diff
23
install/tools/ipa-replica-prepare
Executable file
23
install/tools/ipa-replica-prepare
Executable file
@@ -0,0 +1,23 @@
|
||||
#! /usr/bin/python2 -E
|
||||
# Authors: Petr Viktorin <pviktori@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2012 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
from ipaserver.install.ipa_replica_prepare import ReplicaPrepare
|
||||
|
||||
ReplicaPrepare.run_cli()
|
||||
23
install/tools/ipa-restore
Executable file
23
install/tools/ipa-restore
Executable file
@@ -0,0 +1,23 @@
|
||||
#! /usr/bin/python2 -E
|
||||
# Authors: Rob Crittenden <rcritten@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2013 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
from ipaserver.install.ipa_restore import Restore
|
||||
|
||||
Restore.run_cli()
|
||||
23
install/tools/ipa-server-certinstall
Executable file
23
install/tools/ipa-server-certinstall
Executable file
@@ -0,0 +1,23 @@
|
||||
#! /usr/bin/python2 -E
|
||||
# Authors: Jan Cholasta <jcholast@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2013 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
from ipaserver.install.ipa_server_certinstall import ServerCertInstall
|
||||
|
||||
ServerCertInstall.run_cli()
|
||||
25
install/tools/ipa-server-install
Executable file
25
install/tools/ipa-server-install
Executable file
@@ -0,0 +1,25 @@
|
||||
#! /usr/bin/python2 -E
|
||||
# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
|
||||
# Simo Sorce <ssorce@redhat.com>
|
||||
# Rob Crittenden <rcritten@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2007-2014 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
from ipaserver.install import ipa_server_install
|
||||
|
||||
ipa_server_install.run()
|
||||
12
install/tools/ipa-server-upgrade
Normal file
12
install/tools/ipa-server-upgrade
Normal file
@@ -0,0 +1,12 @@
|
||||
#!/usr/bin/python2
|
||||
#
|
||||
# Copyright (C) 2015 FreeIPA Contributors see COPYING for license
|
||||
#
|
||||
|
||||
# Documentation can be found at:
|
||||
# http://freeipa.org/page/LdapUpdate
|
||||
# http://www.freeipa.org/page/V4/Server_Upgrade_Refactoring
|
||||
|
||||
from ipaserver.install.ipa_server_upgrade import ServerUpgrade
|
||||
|
||||
ServerUpgrade.run_cli()
|
||||
23
install/tools/ipa-winsync-migrate
Executable file
23
install/tools/ipa-winsync-migrate
Executable file
@@ -0,0 +1,23 @@
|
||||
#! /usr/bin/python2 -E
|
||||
# Authors: Tomas Babej <tbabej@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2015 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
from ipaserver.install.ipa_winsync_migrate import WinsyncMigrate
|
||||
|
||||
WinsyncMigrate.run_cli()
|
||||
604
install/tools/ipactl
Executable file
604
install/tools/ipactl
Executable file
@@ -0,0 +1,604 @@
|
||||
#!/usr/bin/python2
|
||||
# Authors: Simo Sorce <ssorce@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2008-2010 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
from __future__ import print_function
|
||||
|
||||
import sys
|
||||
import os
|
||||
import json
|
||||
|
||||
import ldapurl
|
||||
|
||||
from ipaserver.install import service, installutils
|
||||
from ipaserver.install.dsinstance import config_dirname
|
||||
from ipaserver.install.installutils import is_ipa_configured, ScriptError
|
||||
from ipalib import api, errors
|
||||
from ipapython.ipaldap import LDAPClient
|
||||
from ipapython.ipautil import wait_for_open_ports, wait_for_open_socket
|
||||
from ipapython.ipautil import run
|
||||
from ipapython import config
|
||||
from ipaplatform.tasks import tasks
|
||||
from ipapython.dn import DN
|
||||
from ipaplatform import services
|
||||
from ipaplatform.paths import paths
|
||||
|
||||
MSG_HINT_IGNORE_SERVICE_FAILURE = (
|
||||
"Hint: You can use --ignore-service-failure option for forced start in "
|
||||
"case that a non-critical service failed"
|
||||
)
|
||||
|
||||
|
||||
class IpactlError(ScriptError):
|
||||
pass
|
||||
|
||||
def check_IPA_configuration():
|
||||
if not is_ipa_configured():
|
||||
# LSB status code 6: program is not configured
|
||||
raise IpactlError("IPA is not configured " +
|
||||
"(see man pages of ipa-server-install for help)", 6)
|
||||
|
||||
def deduplicate(lst):
|
||||
"""Remove duplicates and preserve order.
|
||||
Returns copy of list with preserved order and removed duplicates.
|
||||
"""
|
||||
new_lst = []
|
||||
s = set(lst)
|
||||
for i in lst:
|
||||
if i in s:
|
||||
s.remove(i)
|
||||
new_lst.append(i)
|
||||
|
||||
return new_lst
|
||||
|
||||
def is_dirsrv_debugging_enabled():
|
||||
"""
|
||||
Check the 389-ds instance to see if debugging is enabled.
|
||||
If so we suppress that in our output.
|
||||
|
||||
returns True or False
|
||||
"""
|
||||
debugging = False
|
||||
serverid = installutils.realm_to_serverid(api.env.realm)
|
||||
dselist = [config_dirname(serverid)]
|
||||
for dse in dselist:
|
||||
try:
|
||||
fd = open(dse + 'dse.ldif', 'r')
|
||||
except IOError:
|
||||
continue
|
||||
lines = fd.readlines()
|
||||
fd.close()
|
||||
for line in lines:
|
||||
if line.lower().startswith('nsslapd-errorlog-level'):
|
||||
_option, value = line.split(':')
|
||||
if int(value) > 0:
|
||||
debugging = True
|
||||
|
||||
return debugging
|
||||
|
||||
def get_capture_output(service, debug):
|
||||
"""
|
||||
We want to display any output of a start/stop command with the
|
||||
exception of 389-ds when debugging is enabled because it outputs
|
||||
tons and tons of information.
|
||||
"""
|
||||
if service == 'dirsrv' and not debug and is_dirsrv_debugging_enabled():
|
||||
print(' debugging enabled, suppressing output.')
|
||||
return True
|
||||
else:
|
||||
return False
|
||||
|
||||
def parse_options():
|
||||
usage = "%prog start|stop|restart|status\n"
|
||||
parser = config.IPAOptionParser(usage=usage,
|
||||
formatter=config.IPAFormatter())
|
||||
|
||||
parser.add_option("-d", "--debug", action="store_true", dest="debug",
|
||||
help="Display debugging information")
|
||||
parser.add_option("-f", "--force", action="store_true", dest="force",
|
||||
help="Force IPA to start. Combine options "
|
||||
"--skip-version-check and --ignore-service-failures")
|
||||
parser.add_option("--ignore-service-failures", action="store_true",
|
||||
dest="ignore_service_failures",
|
||||
help="If any service start fails, do not rollback the "
|
||||
"services, continue with the operation")
|
||||
parser.add_option("--skip-version-check", action="store_true",
|
||||
dest="skip_version_check", default=False,
|
||||
help="skip version check")
|
||||
|
||||
options, args = parser.parse_args()
|
||||
safe_options = parser.get_safe_opts(options)
|
||||
|
||||
if options.force:
|
||||
options.ignore_service_failures = True
|
||||
options.skip_version_check = True
|
||||
|
||||
return safe_options, options, args
|
||||
|
||||
def emit_err(err):
|
||||
sys.stderr.write(err + '\n')
|
||||
|
||||
|
||||
def version_check():
|
||||
try:
|
||||
installutils.check_version()
|
||||
except (installutils.UpgradeMissingVersionError,
|
||||
installutils.UpgradeDataOlderVersionError) as exc:
|
||||
emit_err("IPA version error: %s" % exc)
|
||||
except installutils.UpgradeVersionError as e:
|
||||
emit_err("IPA version error: %s" % e)
|
||||
else:
|
||||
return
|
||||
|
||||
emit_err("Automatically running upgrade, for details see {}".format(
|
||||
paths.IPAUPGRADE_LOG))
|
||||
emit_err("Be patient, this may take a few minutes.")
|
||||
|
||||
# Fork out to call ipa-server-upgrade so that logging is sane.
|
||||
result = run([paths.IPA_SERVER_UPGRADE], raiseonerr=False,
|
||||
capture_error=True)
|
||||
if result.returncode != 0:
|
||||
emit_err("Automatic upgrade failed: %s" % result.error_output)
|
||||
emit_err("See the upgrade log for more details and/or run {} again".
|
||||
format(paths.IPA_SERVER_UPGRADE))
|
||||
raise IpactlError("Aborting ipactl")
|
||||
|
||||
|
||||
def get_config(dirsrv):
|
||||
base = DN(('cn', api.env.host), ('cn', 'masters'), ('cn', 'ipa'), ('cn', 'etc'), api.env.basedn)
|
||||
srcfilter = '(ipaConfigString=enabledService)'
|
||||
attrs = ['cn', 'ipaConfigString']
|
||||
if not dirsrv.is_running():
|
||||
raise IpactlError("Failed to get list of services to probe status:\n" +
|
||||
"Directory Server is stopped", 3)
|
||||
|
||||
try:
|
||||
# The start/restart functions already wait for the server to be
|
||||
# started. What we are doing with this wait is really checking to see
|
||||
# if the server is listening at all.
|
||||
lurl = ldapurl.LDAPUrl(api.env.ldap_uri)
|
||||
if lurl.urlscheme == 'ldapi':
|
||||
wait_for_open_socket(lurl.hostport, timeout=api.env.startup_timeout)
|
||||
else:
|
||||
(host, port) = lurl.hostport.split(':')
|
||||
wait_for_open_ports(host, [int(port)], timeout=api.env.startup_timeout)
|
||||
con = LDAPClient(api.env.ldap_uri)
|
||||
con.external_bind()
|
||||
res = con.get_entries(
|
||||
base,
|
||||
filter=srcfilter,
|
||||
attrs_list=attrs,
|
||||
scope=con.SCOPE_SUBTREE,
|
||||
time_limit=10)
|
||||
except errors.NetworkError:
|
||||
# LSB status code 3: program is not running
|
||||
raise IpactlError("Failed to get list of services to probe status:\n" +
|
||||
"Directory Server is stopped", 3)
|
||||
except errors.NotFound:
|
||||
masters_list = []
|
||||
dn = DN(('cn', 'masters'), ('cn', 'ipa'), ('cn', 'etc'), api.env.basedn)
|
||||
attrs = ['cn']
|
||||
try:
|
||||
entries = con.get_entries(dn, con.SCOPE_ONELEVEL, attrs_list=attrs)
|
||||
except Exception as e:
|
||||
masters_list.append("No master found because of error: %s" % str(e))
|
||||
else:
|
||||
for master_entry in entries:
|
||||
masters_list.append(master_entry.single_value['cn'])
|
||||
|
||||
masters = "\n".join(masters_list)
|
||||
|
||||
raise IpactlError("Failed to get list of services to probe status!\n"
|
||||
"Configured hostname '%s' does not match any master server in LDAP:\n%s"
|
||||
% (api.env.host, masters))
|
||||
except Exception as e:
|
||||
raise IpactlError("Unknown error when retrieving list of services from LDAP: " + str(e))
|
||||
|
||||
svc_list = []
|
||||
|
||||
for entry in res:
|
||||
name = entry.single_value['cn']
|
||||
for p in entry['ipaConfigString']:
|
||||
if p.startswith('startOrder '):
|
||||
try:
|
||||
order = int(p.split()[1])
|
||||
except ValueError:
|
||||
raise IpactlError("Expected order as integer in: %s:%s" % (
|
||||
name, p))
|
||||
svc_list.append([order, name])
|
||||
|
||||
ordered_list = []
|
||||
for (order, svc) in sorted(svc_list):
|
||||
if svc in service.SERVICE_LIST:
|
||||
ordered_list.append(service.SERVICE_LIST[svc][0])
|
||||
return ordered_list
|
||||
|
||||
def get_config_from_file():
|
||||
|
||||
svc_list = []
|
||||
|
||||
try:
|
||||
f = open(tasks.get_svc_list_file(), 'r')
|
||||
svc_list = json.load(f)
|
||||
except Exception as e:
|
||||
raise IpactlError("Unknown error when retrieving list of services from file: " + str(e))
|
||||
|
||||
# the framework can start/stop a number of related services we are not
|
||||
# authoritative for, so filter the list through SERVICES_LIST and order it
|
||||
# accordingly too.
|
||||
|
||||
def_svc_list = []
|
||||
for svc in service.SERVICE_LIST:
|
||||
s = service.SERVICE_LIST[svc]
|
||||
def_svc_list.append([s[1], s[0]])
|
||||
|
||||
ordered_list = []
|
||||
for _order, svc in sorted(def_svc_list):
|
||||
if svc in svc_list:
|
||||
ordered_list.append(svc)
|
||||
|
||||
return ordered_list
|
||||
|
||||
|
||||
def stop_services(svc_list):
|
||||
for svc in svc_list:
|
||||
svc_off = services.service(svc, api=api)
|
||||
try:
|
||||
svc_off.stop(capture_output=False)
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
|
||||
def stop_dirsrv(dirsrv):
|
||||
try:
|
||||
dirsrv.stop(capture_output=False)
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
|
||||
def ipa_start(options):
|
||||
|
||||
if not options.skip_version_check:
|
||||
version_check()
|
||||
else:
|
||||
print("Skipping version check")
|
||||
|
||||
if os.path.isfile(tasks.get_svc_list_file()):
|
||||
emit_err("Existing service file detected!")
|
||||
emit_err("Assuming stale, cleaning and proceeding")
|
||||
# remove file with list of started services
|
||||
# This is ok as systemd will just skip services
|
||||
# that are already running and just return, so that the
|
||||
# stop() method of the base class will simply fill in the
|
||||
# service file again
|
||||
os.unlink(paths.SVC_LIST_FILE)
|
||||
|
||||
dirsrv = services.knownservices.dirsrv
|
||||
try:
|
||||
print("Starting Directory Service")
|
||||
dirsrv.start(capture_output=get_capture_output('dirsrv', options.debug))
|
||||
except Exception as e:
|
||||
raise IpactlError("Failed to start Directory Service: " + str(e))
|
||||
|
||||
try:
|
||||
svc_list = get_config(dirsrv)
|
||||
except Exception as e:
|
||||
emit_err("Failed to read data from service file: " + str(e))
|
||||
emit_err("Shutting down")
|
||||
|
||||
if not options.ignore_service_failures:
|
||||
stop_dirsrv(dirsrv)
|
||||
|
||||
if isinstance(e, IpactlError):
|
||||
# do not display any other error message
|
||||
raise IpactlError(rval=e.rval) # pylint: disable=no-member
|
||||
else:
|
||||
raise IpactlError()
|
||||
|
||||
if len(svc_list) == 0:
|
||||
# no service to start
|
||||
return
|
||||
|
||||
svc_list = deduplicate(svc_list)
|
||||
for svc in svc_list:
|
||||
svchandle = services.service(svc, api=api)
|
||||
try:
|
||||
print("Starting %s Service" % svc)
|
||||
svchandle.start(capture_output=get_capture_output(svc, options.debug))
|
||||
except Exception:
|
||||
emit_err("Failed to start %s Service" % svc)
|
||||
# if ignore_service_failures is specified, skip rollback and
|
||||
# continue with the next service
|
||||
if options.ignore_service_failures:
|
||||
emit_err("Forced start, ignoring %s Service, continuing normal operation" % svc)
|
||||
continue
|
||||
|
||||
emit_err("Shutting down")
|
||||
stop_services(svc_list)
|
||||
stop_dirsrv(dirsrv)
|
||||
|
||||
emit_err(MSG_HINT_IGNORE_SERVICE_FAILURE)
|
||||
raise IpactlError("Aborting ipactl")
|
||||
|
||||
def ipa_stop(options):
|
||||
dirsrv = services.knownservices.dirsrv
|
||||
try:
|
||||
svc_list = get_config_from_file()
|
||||
except Exception as e:
|
||||
# Issue reading the file ? Let's try to get data from LDAP as a
|
||||
# fallback
|
||||
try:
|
||||
dirsrv.start(capture_output=False)
|
||||
svc_list = get_config(dirsrv)
|
||||
except Exception as e:
|
||||
emit_err("Failed to read data from Directory Service: " + str(e))
|
||||
emit_err("Shutting down")
|
||||
try:
|
||||
# just try to stop it, do not read a result
|
||||
dirsrv.stop()
|
||||
finally:
|
||||
raise IpactlError()
|
||||
|
||||
svc_list = deduplicate(svc_list)
|
||||
for svc in reversed(svc_list):
|
||||
svchandle = services.service(svc, api=api)
|
||||
try:
|
||||
print("Stopping %s Service" % svc)
|
||||
svchandle.stop(capture_output=False)
|
||||
except Exception:
|
||||
emit_err("Failed to stop %s Service" % svc)
|
||||
|
||||
try:
|
||||
print("Stopping Directory Service")
|
||||
dirsrv.stop(capture_output=False)
|
||||
except Exception:
|
||||
raise IpactlError("Failed to stop Directory Service")
|
||||
|
||||
# remove file with list of started services
|
||||
try:
|
||||
os.unlink(paths.SVC_LIST_FILE)
|
||||
except OSError:
|
||||
pass
|
||||
|
||||
|
||||
def ipa_restart(options):
|
||||
if not options.skip_version_check:
|
||||
try:
|
||||
version_check()
|
||||
except Exception as e:
|
||||
try:
|
||||
ipa_stop(options)
|
||||
except Exception:
|
||||
# We don't care about errors that happened while stopping.
|
||||
# We need to raise the upgrade error.
|
||||
pass
|
||||
raise e
|
||||
else:
|
||||
print("Skipping version check")
|
||||
|
||||
dirsrv = services.knownservices.dirsrv
|
||||
new_svc_list = []
|
||||
dirsrv_restart = True
|
||||
if not dirsrv.is_running():
|
||||
try:
|
||||
print("Starting Directory Service")
|
||||
dirsrv.start(capture_output=get_capture_output('dirsrv', options.debug))
|
||||
dirsrv_restart = False
|
||||
except Exception as e:
|
||||
raise IpactlError("Failed to start Directory Service: " + str(e))
|
||||
|
||||
try:
|
||||
new_svc_list = get_config(dirsrv)
|
||||
except Exception as e:
|
||||
emit_err("Failed to read data from Directory Service: " + str(e))
|
||||
emit_err("Shutting down")
|
||||
try:
|
||||
dirsrv.stop(capture_output=False)
|
||||
except Exception:
|
||||
pass
|
||||
if isinstance(e, IpactlError):
|
||||
# do not display any other error message
|
||||
raise IpactlError(rval=e.rval) # pylint: disable=no-member
|
||||
else:
|
||||
raise IpactlError()
|
||||
|
||||
old_svc_list = []
|
||||
try:
|
||||
old_svc_list = get_config_from_file()
|
||||
except Exception as e:
|
||||
emit_err("Failed to get service list from file: " + str(e))
|
||||
# fallback to what's in LDAP
|
||||
old_svc_list = new_svc_list
|
||||
|
||||
# match service to start/stop
|
||||
svc_list = []
|
||||
for s in new_svc_list:
|
||||
if s in old_svc_list:
|
||||
svc_list.append(s)
|
||||
|
||||
#remove commons
|
||||
for s in svc_list:
|
||||
if s in old_svc_list:
|
||||
old_svc_list.remove(s)
|
||||
for s in svc_list:
|
||||
if s in new_svc_list:
|
||||
new_svc_list.remove(s)
|
||||
|
||||
if len(old_svc_list) != 0:
|
||||
# we need to definitely stop some services
|
||||
old_svc_list = deduplicate(old_svc_list)
|
||||
for svc in reversed(old_svc_list):
|
||||
svchandle = services.service(svc, api=api)
|
||||
try:
|
||||
print("Stopping %s Service" % svc)
|
||||
svchandle.stop(capture_output=False)
|
||||
except Exception:
|
||||
emit_err("Failed to stop %s Service" % svc)
|
||||
|
||||
try:
|
||||
if dirsrv_restart:
|
||||
print("Restarting Directory Service")
|
||||
dirsrv.restart(capture_output=get_capture_output('dirsrv', options.debug))
|
||||
except Exception as e:
|
||||
emit_err("Failed to restart Directory Service: " + str(e))
|
||||
emit_err("Shutting down")
|
||||
|
||||
if not options.ignore_service_failures:
|
||||
stop_services(reversed(svc_list))
|
||||
stop_dirsrv(dirsrv)
|
||||
|
||||
raise IpactlError("Aborting ipactl")
|
||||
|
||||
if len(svc_list) != 0:
|
||||
# there are services to restart
|
||||
svc_list = deduplicate(svc_list)
|
||||
for svc in svc_list:
|
||||
svchandle = services.service(svc, api=api)
|
||||
try:
|
||||
print("Restarting %s Service" % svc)
|
||||
svchandle.restart(capture_output=get_capture_output(svc, options.debug))
|
||||
except Exception:
|
||||
emit_err("Failed to restart %s Service" % svc)
|
||||
# if ignore_service_failures is specified,
|
||||
# skip rollback and continue with the next service
|
||||
if options.ignore_service_failures:
|
||||
emit_err("Forced restart, ignoring %s Service, continuing normal operation" % svc)
|
||||
continue
|
||||
|
||||
emit_err("Shutting down")
|
||||
stop_services(svc_list)
|
||||
stop_dirsrv(dirsrv)
|
||||
|
||||
emit_err(MSG_HINT_IGNORE_SERVICE_FAILURE)
|
||||
raise IpactlError("Aborting ipactl")
|
||||
|
||||
if len(new_svc_list) != 0:
|
||||
# we still need to start some services
|
||||
new_svc_list = deduplicate(new_svc_list)
|
||||
for svc in new_svc_list:
|
||||
svchandle = services.service(svc, api=api)
|
||||
try:
|
||||
print("Starting %s Service" % svc)
|
||||
svchandle.start(capture_output=get_capture_output(svc, options.debug))
|
||||
except Exception:
|
||||
emit_err("Failed to start %s Service" % svc)
|
||||
# if ignore_service_failures is specified, skip rollback and
|
||||
# continue with the next service
|
||||
if options.ignore_service_failures:
|
||||
emit_err("Forced start, ignoring %s Service, continuing normal operation" % svc)
|
||||
continue
|
||||
|
||||
emit_err("Shutting down")
|
||||
stop_services(svc_list)
|
||||
stop_dirsrv(dirsrv)
|
||||
|
||||
emit_err(MSG_HINT_IGNORE_SERVICE_FAILURE)
|
||||
raise IpactlError("Aborting ipactl")
|
||||
|
||||
def ipa_status(options):
|
||||
|
||||
try:
|
||||
dirsrv = services.knownservices.dirsrv
|
||||
if dirsrv.is_running():
|
||||
svc_list = get_config(dirsrv)
|
||||
else:
|
||||
svc_list = get_config_from_file()
|
||||
except IpactlError as e:
|
||||
if os.path.exists(tasks.get_svc_list_file()):
|
||||
raise e
|
||||
else:
|
||||
svc_list = []
|
||||
except Exception as e:
|
||||
raise IpactlError("Failed to get list of services to probe status: " + str(e))
|
||||
|
||||
dirsrv = services.knownservices.dirsrv
|
||||
try:
|
||||
if dirsrv.is_running():
|
||||
print("Directory Service: RUNNING")
|
||||
else:
|
||||
print("Directory Service: STOPPED")
|
||||
if len(svc_list) == 0:
|
||||
print(("Directory Service must be running in order to " +
|
||||
"obtain status of other services"))
|
||||
except:
|
||||
raise IpactlError("Failed to get Directory Service status")
|
||||
|
||||
if len(svc_list) == 0:
|
||||
return
|
||||
|
||||
svc_list = deduplicate(svc_list)
|
||||
for svc in svc_list:
|
||||
svchandle = services.service(svc, api=api)
|
||||
try:
|
||||
if svchandle.is_running():
|
||||
print("%s Service: RUNNING" % svc)
|
||||
else:
|
||||
print("%s Service: STOPPED" % svc)
|
||||
except Exception:
|
||||
emit_err("Failed to get %s Service status" % svc)
|
||||
|
||||
def main():
|
||||
if not os.getegid() == 0:
|
||||
# LSB status code 4: user had insufficient privilege
|
||||
raise IpactlError("You must be root to run ipactl.", 4)
|
||||
|
||||
_safe_options, options, args = parse_options()
|
||||
|
||||
if len(args) != 1:
|
||||
# LSB status code 2: invalid or excess argument(s)
|
||||
raise IpactlError("You must specify one action", 2)
|
||||
elif args[0] != "start" and args[0] != "stop" and args[0] != "restart" and args[0] != "status":
|
||||
raise IpactlError("Unrecognized action [" + args[0] + "]", 2)
|
||||
|
||||
# check if IPA is configured at all
|
||||
try:
|
||||
check_IPA_configuration()
|
||||
except IpactlError as e:
|
||||
if args[0].lower() == "status":
|
||||
# Different LSB return code for status command:
|
||||
# 4 - program or service status is unknown
|
||||
# This should differentiate uninstalled IPA from status
|
||||
# code 3 - program is not running
|
||||
e.rval = 4
|
||||
raise e
|
||||
else:
|
||||
raise e
|
||||
|
||||
api.bootstrap(in_server=True,
|
||||
context='ipactl',
|
||||
confdir=paths.ETC_IPA,
|
||||
debug=options.debug)
|
||||
api.finalize()
|
||||
|
||||
if '.' not in api.env.host:
|
||||
raise IpactlError("Invalid hostname '%s' in IPA configuration!\n"
|
||||
"The hostname must be fully-qualified" % api.env.host)
|
||||
|
||||
if args[0].lower() == "start":
|
||||
ipa_start(options)
|
||||
elif args[0].lower() == "stop":
|
||||
ipa_stop(options)
|
||||
elif args[0].lower() == "restart":
|
||||
ipa_restart(options)
|
||||
elif args[0].lower() == "status":
|
||||
ipa_status(options)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
installutils.run_script(main, operation_name='ipactl')
|
||||
35
install/tools/man/Makefile.am
Normal file
35
install/tools/man/Makefile.am
Normal file
@@ -0,0 +1,35 @@
|
||||
# This file will be processed with automake-1.7 to create Makefile.in
|
||||
|
||||
AUTOMAKE_OPTIONS = 1.7
|
||||
|
||||
NULL=
|
||||
|
||||
dist_man1_MANS = \
|
||||
ipa-replica-conncheck.1 \
|
||||
ipa-replica-install.1 \
|
||||
ipa-replica-manage.1 \
|
||||
ipa-csreplica-manage.1 \
|
||||
ipa-replica-prepare.1 \
|
||||
ipa-server-certinstall.1 \
|
||||
ipa-server-install.1 \
|
||||
ipa-server-upgrade.1 \
|
||||
ipa-dns-install.1 \
|
||||
ipa-adtrust-install.1 \
|
||||
ipa-ca-install.1 \
|
||||
ipa-kra-install.1 \
|
||||
ipa-ldap-updater.1 \
|
||||
ipa-compat-manage.1 \
|
||||
ipa-nis-manage.1 \
|
||||
ipa-managed-entries.1 \
|
||||
ipa-backup.1 \
|
||||
ipa-restore.1 \
|
||||
ipa-advise.1 \
|
||||
ipa-otptoken-import.1 \
|
||||
ipa-cacert-manage.1 \
|
||||
ipa-winsync-migrate.1 \
|
||||
ipa-pkinit-manage.1 \
|
||||
$(NULL)
|
||||
|
||||
dist_man8_MANS = \
|
||||
ipactl.8 \
|
||||
$(NULL)
|
||||
702
install/tools/man/Makefile.in
Normal file
702
install/tools/man/Makefile.in
Normal file
@@ -0,0 +1,702 @@
|
||||
# Makefile.in generated by automake 1.15.1 from Makefile.am.
|
||||
# @configure_input@
|
||||
|
||||
# Copyright (C) 1994-2017 Free Software Foundation, Inc.
|
||||
|
||||
# This Makefile.in is free software; the Free Software Foundation
|
||||
# gives unlimited permission to copy and/or distribute it,
|
||||
# with or without modifications, as long as this notice is preserved.
|
||||
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
|
||||
# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
|
||||
# PARTICULAR PURPOSE.
|
||||
|
||||
@SET_MAKE@
|
||||
|
||||
# This file will be processed with automake-1.7 to create Makefile.in
|
||||
VPATH = @srcdir@
|
||||
am__is_gnu_make = { \
|
||||
if test -z '$(MAKELEVEL)'; then \
|
||||
false; \
|
||||
elif test -n '$(MAKE_HOST)'; then \
|
||||
true; \
|
||||
elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
|
||||
true; \
|
||||
else \
|
||||
false; \
|
||||
fi; \
|
||||
}
|
||||
am__make_running_with_option = \
|
||||
case $${target_option-} in \
|
||||
?) ;; \
|
||||
*) echo "am__make_running_with_option: internal error: invalid" \
|
||||
"target option '$${target_option-}' specified" >&2; \
|
||||
exit 1;; \
|
||||
esac; \
|
||||
has_opt=no; \
|
||||
sane_makeflags=$$MAKEFLAGS; \
|
||||
if $(am__is_gnu_make); then \
|
||||
sane_makeflags=$$MFLAGS; \
|
||||
else \
|
||||
case $$MAKEFLAGS in \
|
||||
*\\[\ \ ]*) \
|
||||
bs=\\; \
|
||||
sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
|
||||
| sed "s/$$bs$$bs[$$bs $$bs ]*//g"`;; \
|
||||
esac; \
|
||||
fi; \
|
||||
skip_next=no; \
|
||||
strip_trailopt () \
|
||||
{ \
|
||||
flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
|
||||
}; \
|
||||
for flg in $$sane_makeflags; do \
|
||||
test $$skip_next = yes && { skip_next=no; continue; }; \
|
||||
case $$flg in \
|
||||
*=*|--*) continue;; \
|
||||
-*I) strip_trailopt 'I'; skip_next=yes;; \
|
||||
-*I?*) strip_trailopt 'I';; \
|
||||
-*O) strip_trailopt 'O'; skip_next=yes;; \
|
||||
-*O?*) strip_trailopt 'O';; \
|
||||
-*l) strip_trailopt 'l'; skip_next=yes;; \
|
||||
-*l?*) strip_trailopt 'l';; \
|
||||
-[dEDm]) skip_next=yes;; \
|
||||
-[JT]) skip_next=yes;; \
|
||||
esac; \
|
||||
case $$flg in \
|
||||
*$$target_option*) has_opt=yes; break;; \
|
||||
esac; \
|
||||
done; \
|
||||
test $$has_opt = yes
|
||||
am__make_dryrun = (target_option=n; $(am__make_running_with_option))
|
||||
am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
|
||||
pkgdatadir = $(datadir)/@PACKAGE@
|
||||
pkgincludedir = $(includedir)/@PACKAGE@
|
||||
pkglibdir = $(libdir)/@PACKAGE@
|
||||
pkglibexecdir = $(libexecdir)/@PACKAGE@
|
||||
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
|
||||
install_sh_DATA = $(install_sh) -c -m 644
|
||||
install_sh_PROGRAM = $(install_sh) -c
|
||||
install_sh_SCRIPT = $(install_sh) -c
|
||||
INSTALL_HEADER = $(INSTALL_DATA)
|
||||
transform = $(program_transform_name)
|
||||
NORMAL_INSTALL = :
|
||||
PRE_INSTALL = :
|
||||
POST_INSTALL = :
|
||||
NORMAL_UNINSTALL = :
|
||||
PRE_UNINSTALL = :
|
||||
POST_UNINSTALL = :
|
||||
build_triplet = @build@
|
||||
host_triplet = @host@
|
||||
subdir = install/tools/man
|
||||
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
|
||||
am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
|
||||
$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
|
||||
$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
|
||||
$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
|
||||
$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
|
||||
$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
|
||||
$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
|
||||
$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/VERSION.m4 \
|
||||
$(top_srcdir)/server.m4 $(top_srcdir)/configure.ac
|
||||
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
|
||||
$(ACLOCAL_M4)
|
||||
DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
|
||||
mkinstalldirs = $(install_sh) -d
|
||||
CONFIG_HEADER = $(top_builddir)/config.h
|
||||
CONFIG_CLEAN_FILES =
|
||||
CONFIG_CLEAN_VPATH_FILES =
|
||||
AM_V_P = $(am__v_P_@AM_V@)
|
||||
am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
|
||||
am__v_P_0 = false
|
||||
am__v_P_1 = :
|
||||
AM_V_GEN = $(am__v_GEN_@AM_V@)
|
||||
am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
|
||||
am__v_GEN_0 = @echo " GEN " $@;
|
||||
am__v_GEN_1 =
|
||||
AM_V_at = $(am__v_at_@AM_V@)
|
||||
am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
|
||||
am__v_at_0 = @
|
||||
am__v_at_1 =
|
||||
SOURCES =
|
||||
DIST_SOURCES =
|
||||
am__can_run_installinfo = \
|
||||
case $$AM_UPDATE_INFO_DIR in \
|
||||
n|no|NO) false;; \
|
||||
*) (install-info --version) >/dev/null 2>&1;; \
|
||||
esac
|
||||
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
|
||||
am__vpath_adj = case $$p in \
|
||||
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
|
||||
*) f=$$p;; \
|
||||
esac;
|
||||
am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
|
||||
am__install_max = 40
|
||||
am__nobase_strip_setup = \
|
||||
srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
|
||||
am__nobase_strip = \
|
||||
for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
|
||||
am__nobase_list = $(am__nobase_strip_setup); \
|
||||
for p in $$list; do echo "$$p $$p"; done | \
|
||||
sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
|
||||
$(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
|
||||
if (++n[$$2] == $(am__install_max)) \
|
||||
{ print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
|
||||
END { for (dir in files) print dir, files[dir] }'
|
||||
am__base_list = \
|
||||
sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
|
||||
sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
|
||||
am__uninstall_files_from_dir = { \
|
||||
test -z "$$files" \
|
||||
|| { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
|
||||
|| { echo " ( cd '$$dir' && rm -f" $$files ")"; \
|
||||
$(am__cd) "$$dir" && rm -f $$files; }; \
|
||||
}
|
||||
man1dir = $(mandir)/man1
|
||||
am__installdirs = "$(DESTDIR)$(man1dir)" "$(DESTDIR)$(man8dir)"
|
||||
man8dir = $(mandir)/man8
|
||||
NROFF = nroff
|
||||
MANS = $(dist_man1_MANS) $(dist_man8_MANS)
|
||||
am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
|
||||
am__DIST_COMMON = $(dist_man1_MANS) $(dist_man8_MANS) \
|
||||
$(srcdir)/Makefile.in
|
||||
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
|
||||
ACLOCAL = @ACLOCAL@
|
||||
AMTAR = @AMTAR@
|
||||
AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
|
||||
API_VERSION = @API_VERSION@
|
||||
AR = @AR@
|
||||
AUTOCONF = @AUTOCONF@
|
||||
AUTOHEADER = @AUTOHEADER@
|
||||
AUTOMAKE = @AUTOMAKE@
|
||||
AWK = @AWK@
|
||||
CC = @CC@
|
||||
CCDEPMODE = @CCDEPMODE@
|
||||
CFLAGS = @CFLAGS@
|
||||
CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
|
||||
CMOCKA_LIBS = @CMOCKA_LIBS@
|
||||
CONFIG_STATUS = @CONFIG_STATUS@
|
||||
CPP = @CPP@
|
||||
CPPFLAGS = @CPPFLAGS@
|
||||
CRYPTO_CFLAGS = @CRYPTO_CFLAGS@
|
||||
CRYPTO_LIBS = @CRYPTO_LIBS@
|
||||
CYGPATH_W = @CYGPATH_W@
|
||||
DATA_VERSION = @DATA_VERSION@
|
||||
DEFS = @DEFS@
|
||||
DEPDIR = @DEPDIR@
|
||||
DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
|
||||
DIRSRV_LIBS = @DIRSRV_LIBS@
|
||||
DLLTOOL = @DLLTOOL@
|
||||
DSYMUTIL = @DSYMUTIL@
|
||||
DUMPBIN = @DUMPBIN@
|
||||
ECHO_C = @ECHO_C@
|
||||
ECHO_N = @ECHO_N@
|
||||
ECHO_T = @ECHO_T@
|
||||
EGREP = @EGREP@
|
||||
EXEEXT = @EXEEXT@
|
||||
FGREP = @FGREP@
|
||||
GETTEXT_DOMAIN = @GETTEXT_DOMAIN@
|
||||
GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
|
||||
GIT_BRANCH = @GIT_BRANCH@
|
||||
GIT_VERSION = @GIT_VERSION@
|
||||
GMSGFMT = @GMSGFMT@
|
||||
GMSGFMT_015 = @GMSGFMT_015@
|
||||
GREP = @GREP@
|
||||
INI_CFLAGS = @INI_CFLAGS@
|
||||
INI_LIBS = @INI_LIBS@
|
||||
INSTALL = @INSTALL@
|
||||
INSTALL_DATA = @INSTALL_DATA@
|
||||
INSTALL_PROGRAM = @INSTALL_PROGRAM@
|
||||
INSTALL_SCRIPT = @INSTALL_SCRIPT@
|
||||
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
|
||||
INTLLIBS = @INTLLIBS@
|
||||
INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
|
||||
IPAPLATFORM = @IPAPLATFORM@
|
||||
IPA_DATA_DIR = @IPA_DATA_DIR@
|
||||
IPA_SYSCONF_DIR = @IPA_SYSCONF_DIR@
|
||||
JSLINT = @JSLINT@
|
||||
KRAD_LIBS = @KRAD_LIBS@
|
||||
KRB5KDC_SERVICE = @KRB5KDC_SERVICE@
|
||||
KRB5_CFLAGS = @KRB5_CFLAGS@
|
||||
KRB5_LIBS = @KRB5_LIBS@
|
||||
LD = @LD@
|
||||
LDAP_CFLAGS = @LDAP_CFLAGS@
|
||||
LDAP_LIBS = @LDAP_LIBS@
|
||||
LDFLAGS = @LDFLAGS@
|
||||
LIBICONV = @LIBICONV@
|
||||
LIBINTL = @LIBINTL@
|
||||
LIBINTL_LIBS = @LIBINTL_LIBS@
|
||||
LIBOBJS = @LIBOBJS@
|
||||
LIBPDB_NAME = @LIBPDB_NAME@
|
||||
LIBS = @LIBS@
|
||||
LIBTOOL = @LIBTOOL@
|
||||
LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
|
||||
LIBVERTO_LIBS = @LIBVERTO_LIBS@
|
||||
LIPO = @LIPO@
|
||||
LN_S = @LN_S@
|
||||
LTLIBICONV = @LTLIBICONV@
|
||||
LTLIBINTL = @LTLIBINTL@
|
||||
LTLIBOBJS = @LTLIBOBJS@
|
||||
LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
|
||||
MAKEINFO = @MAKEINFO@
|
||||
MANIFEST_TOOL = @MANIFEST_TOOL@
|
||||
MKDIR_P = @MKDIR_P@
|
||||
MK_ASSIGN = @MK_ASSIGN@
|
||||
MK_ELSE = @MK_ELSE@
|
||||
MK_ENDIF = @MK_ENDIF@
|
||||
MK_IFEQ = @MK_IFEQ@
|
||||
MSGATTRIB = @MSGATTRIB@
|
||||
MSGFMT = @MSGFMT@
|
||||
MSGFMT_015 = @MSGFMT_015@
|
||||
MSGMERGE = @MSGMERGE@
|
||||
NAMED_GROUP = @NAMED_GROUP@
|
||||
NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
|
||||
NDRNBT_LIBS = @NDRNBT_LIBS@
|
||||
NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
|
||||
NDRPAC_LIBS = @NDRPAC_LIBS@
|
||||
NDR_CFLAGS = @NDR_CFLAGS@
|
||||
NDR_LIBS = @NDR_LIBS@
|
||||
NM = @NM@
|
||||
NMEDIT = @NMEDIT@
|
||||
NSPR_CFLAGS = @NSPR_CFLAGS@
|
||||
NSPR_LIBS = @NSPR_LIBS@
|
||||
NSS_CFLAGS = @NSS_CFLAGS@
|
||||
NSS_LIBS = @NSS_LIBS@
|
||||
NUM_VERSION = @NUM_VERSION@
|
||||
OBJDUMP = @OBJDUMP@
|
||||
OBJEXT = @OBJEXT@
|
||||
ODS_USER = @ODS_USER@
|
||||
OTOOL = @OTOOL@
|
||||
OTOOL64 = @OTOOL64@
|
||||
PACKAGE = @PACKAGE@
|
||||
PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
|
||||
PACKAGE_NAME = @PACKAGE_NAME@
|
||||
PACKAGE_STRING = @PACKAGE_STRING@
|
||||
PACKAGE_TARNAME = @PACKAGE_TARNAME@
|
||||
PACKAGE_URL = @PACKAGE_URL@
|
||||
PACKAGE_VERSION = @PACKAGE_VERSION@
|
||||
PATH_SEPARATOR = @PATH_SEPARATOR@
|
||||
PKG_CONFIG = @PKG_CONFIG@
|
||||
PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
|
||||
PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
|
||||
POPT_CFLAGS = @POPT_CFLAGS@
|
||||
POPT_LIBS = @POPT_LIBS@
|
||||
POSUB = @POSUB@
|
||||
PYLINT = @PYLINT@
|
||||
PYTHON = @PYTHON@
|
||||
PYTHON2 = @PYTHON2@
|
||||
PYTHON3 = @PYTHON3@
|
||||
PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
|
||||
PYTHON_INSTALL_EXTRA_OPTIONS = @PYTHON_INSTALL_EXTRA_OPTIONS@
|
||||
PYTHON_PLATFORM = @PYTHON_PLATFORM@
|
||||
PYTHON_PREFIX = @PYTHON_PREFIX@
|
||||
PYTHON_VERSION = @PYTHON_VERSION@
|
||||
RANLIB = @RANLIB@
|
||||
SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
|
||||
SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
|
||||
SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
|
||||
SASL_CFLAGS = @SASL_CFLAGS@
|
||||
SASL_LIBS = @SASL_LIBS@
|
||||
SED = @SED@
|
||||
SET_MAKE = @SET_MAKE@
|
||||
SHELL = @SHELL@
|
||||
SSSCERTMAP_CFLAGS = @SSSCERTMAP_CFLAGS@
|
||||
SSSCERTMAP_LIBS = @SSSCERTMAP_LIBS@
|
||||
SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
|
||||
SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
|
||||
SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
|
||||
SSSNSSIDMAP_LIBS = @SSSNSSIDMAP_LIBS@
|
||||
STRIP = @STRIP@
|
||||
TALLOC_CFLAGS = @TALLOC_CFLAGS@
|
||||
TALLOC_LIBS = @TALLOC_LIBS@
|
||||
TEVENT_CFLAGS = @TEVENT_CFLAGS@
|
||||
TEVENT_LIBS = @TEVENT_LIBS@
|
||||
UNISTRING_LIBS = @UNISTRING_LIBS@
|
||||
UNLINK = @UNLINK@
|
||||
USE_NLS = @USE_NLS@
|
||||
UUID_CFLAGS = @UUID_CFLAGS@
|
||||
UUID_LIBS = @UUID_LIBS@
|
||||
VENDOR_SUFFIX = @VENDOR_SUFFIX@
|
||||
VERSION = @VERSION@
|
||||
XGETTEXT = @XGETTEXT@
|
||||
XGETTEXT_015 = @XGETTEXT_015@
|
||||
XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
|
||||
XMLRPC_CFLAGS = @XMLRPC_CFLAGS@
|
||||
XMLRPC_LIBS = @XMLRPC_LIBS@
|
||||
abs_builddir = @abs_builddir@
|
||||
abs_srcdir = @abs_srcdir@
|
||||
abs_top_builddir = @abs_top_builddir@
|
||||
abs_top_srcdir = @abs_top_srcdir@
|
||||
ac_ct_AR = @ac_ct_AR@
|
||||
ac_ct_CC = @ac_ct_CC@
|
||||
ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
|
||||
am__include = @am__include@
|
||||
am__leading_dot = @am__leading_dot@
|
||||
am__quote = @am__quote@
|
||||
am__tar = @am__tar@
|
||||
am__untar = @am__untar@
|
||||
bindir = @bindir@
|
||||
build = @build@
|
||||
build_alias = @build_alias@
|
||||
build_cpu = @build_cpu@
|
||||
build_os = @build_os@
|
||||
build_vendor = @build_vendor@
|
||||
builddir = @builddir@
|
||||
datadir = @datadir@
|
||||
datarootdir = @datarootdir@
|
||||
docdir = @docdir@
|
||||
dvidir = @dvidir@
|
||||
exec_prefix = @exec_prefix@
|
||||
host = @host@
|
||||
host_alias = @host_alias@
|
||||
host_cpu = @host_cpu@
|
||||
host_os = @host_os@
|
||||
host_vendor = @host_vendor@
|
||||
htmldir = @htmldir@
|
||||
i18ntests = @i18ntests@
|
||||
includedir = @includedir@
|
||||
infodir = @infodir@
|
||||
install_sh = @install_sh@
|
||||
krb5rundir = @krb5rundir@
|
||||
libdir = @libdir@
|
||||
libexecdir = @libexecdir@
|
||||
localedir = @localedir@
|
||||
localstatedir = @localstatedir@
|
||||
mandir = @mandir@
|
||||
mkdir_p = @mkdir_p@
|
||||
oldincludedir = @oldincludedir@
|
||||
pdfdir = @pdfdir@
|
||||
pkgpyexecdir = @pkgpyexecdir@
|
||||
pkgpythondir = @pkgpythondir@
|
||||
prefix = @prefix@
|
||||
program_transform_name = @program_transform_name@
|
||||
psdir = @psdir@
|
||||
pyexecdir = @pyexecdir@
|
||||
pythondir = @pythondir@
|
||||
sbindir = @sbindir@
|
||||
sharedstatedir = @sharedstatedir@
|
||||
srcdir = @srcdir@
|
||||
sysconfdir = @sysconfdir@
|
||||
sysconfenvdir = @sysconfenvdir@
|
||||
systemdsystemunitdir = @systemdsystemunitdir@
|
||||
systemdtmpfilesdir = @systemdtmpfilesdir@
|
||||
target_alias = @target_alias@
|
||||
top_build_prefix = @top_build_prefix@
|
||||
top_builddir = @top_builddir@
|
||||
top_srcdir = @top_srcdir@
|
||||
AUTOMAKE_OPTIONS = 1.7
|
||||
NULL =
|
||||
dist_man1_MANS = \
|
||||
ipa-replica-conncheck.1 \
|
||||
ipa-replica-install.1 \
|
||||
ipa-replica-manage.1 \
|
||||
ipa-csreplica-manage.1 \
|
||||
ipa-replica-prepare.1 \
|
||||
ipa-server-certinstall.1 \
|
||||
ipa-server-install.1 \
|
||||
ipa-server-upgrade.1 \
|
||||
ipa-dns-install.1 \
|
||||
ipa-adtrust-install.1 \
|
||||
ipa-ca-install.1 \
|
||||
ipa-kra-install.1 \
|
||||
ipa-ldap-updater.1 \
|
||||
ipa-compat-manage.1 \
|
||||
ipa-nis-manage.1 \
|
||||
ipa-managed-entries.1 \
|
||||
ipa-backup.1 \
|
||||
ipa-restore.1 \
|
||||
ipa-advise.1 \
|
||||
ipa-otptoken-import.1 \
|
||||
ipa-cacert-manage.1 \
|
||||
ipa-winsync-migrate.1 \
|
||||
ipa-pkinit-manage.1 \
|
||||
$(NULL)
|
||||
|
||||
dist_man8_MANS = \
|
||||
ipactl.8 \
|
||||
$(NULL)
|
||||
|
||||
all: all-am
|
||||
|
||||
.SUFFIXES:
|
||||
$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
|
||||
@for dep in $?; do \
|
||||
case '$(am__configure_deps)' in \
|
||||
*$$dep*) \
|
||||
( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
|
||||
&& { if test -f $@; then exit 0; else break; fi; }; \
|
||||
exit 1;; \
|
||||
esac; \
|
||||
done; \
|
||||
echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign install/tools/man/Makefile'; \
|
||||
$(am__cd) $(top_srcdir) && \
|
||||
$(AUTOMAKE) --foreign install/tools/man/Makefile
|
||||
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
|
||||
@case '$?' in \
|
||||
*config.status*) \
|
||||
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
|
||||
*) \
|
||||
echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
|
||||
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
|
||||
esac;
|
||||
|
||||
$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
|
||||
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
|
||||
|
||||
$(top_srcdir)/configure: $(am__configure_deps)
|
||||
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
|
||||
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
|
||||
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
|
||||
$(am__aclocal_m4_deps):
|
||||
|
||||
mostlyclean-libtool:
|
||||
-rm -f *.lo
|
||||
|
||||
clean-libtool:
|
||||
-rm -rf .libs _libs
|
||||
install-man1: $(dist_man1_MANS)
|
||||
@$(NORMAL_INSTALL)
|
||||
@list1='$(dist_man1_MANS)'; \
|
||||
list2=''; \
|
||||
test -n "$(man1dir)" \
|
||||
&& test -n "`echo $$list1$$list2`" \
|
||||
|| exit 0; \
|
||||
echo " $(MKDIR_P) '$(DESTDIR)$(man1dir)'"; \
|
||||
$(MKDIR_P) "$(DESTDIR)$(man1dir)" || exit 1; \
|
||||
{ for i in $$list1; do echo "$$i"; done; \
|
||||
if test -n "$$list2"; then \
|
||||
for i in $$list2; do echo "$$i"; done \
|
||||
| sed -n '/\.1[a-z]*$$/p'; \
|
||||
fi; \
|
||||
} | while read p; do \
|
||||
if test -f $$p; then d=; else d="$(srcdir)/"; fi; \
|
||||
echo "$$d$$p"; echo "$$p"; \
|
||||
done | \
|
||||
sed -e 'n;s,.*/,,;p;h;s,.*\.,,;s,^[^1][0-9a-z]*$$,1,;x' \
|
||||
-e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,' | \
|
||||
sed 'N;N;s,\n, ,g' | { \
|
||||
list=; while read file base inst; do \
|
||||
if test "$$base" = "$$inst"; then list="$$list $$file"; else \
|
||||
echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man1dir)/$$inst'"; \
|
||||
$(INSTALL_DATA) "$$file" "$(DESTDIR)$(man1dir)/$$inst" || exit $$?; \
|
||||
fi; \
|
||||
done; \
|
||||
for i in $$list; do echo "$$i"; done | $(am__base_list) | \
|
||||
while read files; do \
|
||||
test -z "$$files" || { \
|
||||
echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(man1dir)'"; \
|
||||
$(INSTALL_DATA) $$files "$(DESTDIR)$(man1dir)" || exit $$?; }; \
|
||||
done; }
|
||||
|
||||
uninstall-man1:
|
||||
@$(NORMAL_UNINSTALL)
|
||||
@list='$(dist_man1_MANS)'; test -n "$(man1dir)" || exit 0; \
|
||||
files=`{ for i in $$list; do echo "$$i"; done; \
|
||||
} | sed -e 's,.*/,,;h;s,.*\.,,;s,^[^1][0-9a-z]*$$,1,;x' \
|
||||
-e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,'`; \
|
||||
dir='$(DESTDIR)$(man1dir)'; $(am__uninstall_files_from_dir)
|
||||
install-man8: $(dist_man8_MANS)
|
||||
@$(NORMAL_INSTALL)
|
||||
@list1='$(dist_man8_MANS)'; \
|
||||
list2=''; \
|
||||
test -n "$(man8dir)" \
|
||||
&& test -n "`echo $$list1$$list2`" \
|
||||
|| exit 0; \
|
||||
echo " $(MKDIR_P) '$(DESTDIR)$(man8dir)'"; \
|
||||
$(MKDIR_P) "$(DESTDIR)$(man8dir)" || exit 1; \
|
||||
{ for i in $$list1; do echo "$$i"; done; \
|
||||
if test -n "$$list2"; then \
|
||||
for i in $$list2; do echo "$$i"; done \
|
||||
| sed -n '/\.8[a-z]*$$/p'; \
|
||||
fi; \
|
||||
} | while read p; do \
|
||||
if test -f $$p; then d=; else d="$(srcdir)/"; fi; \
|
||||
echo "$$d$$p"; echo "$$p"; \
|
||||
done | \
|
||||
sed -e 'n;s,.*/,,;p;h;s,.*\.,,;s,^[^8][0-9a-z]*$$,8,;x' \
|
||||
-e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,' | \
|
||||
sed 'N;N;s,\n, ,g' | { \
|
||||
list=; while read file base inst; do \
|
||||
if test "$$base" = "$$inst"; then list="$$list $$file"; else \
|
||||
echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man8dir)/$$inst'"; \
|
||||
$(INSTALL_DATA) "$$file" "$(DESTDIR)$(man8dir)/$$inst" || exit $$?; \
|
||||
fi; \
|
||||
done; \
|
||||
for i in $$list; do echo "$$i"; done | $(am__base_list) | \
|
||||
while read files; do \
|
||||
test -z "$$files" || { \
|
||||
echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(man8dir)'"; \
|
||||
$(INSTALL_DATA) $$files "$(DESTDIR)$(man8dir)" || exit $$?; }; \
|
||||
done; }
|
||||
|
||||
uninstall-man8:
|
||||
@$(NORMAL_UNINSTALL)
|
||||
@list='$(dist_man8_MANS)'; test -n "$(man8dir)" || exit 0; \
|
||||
files=`{ for i in $$list; do echo "$$i"; done; \
|
||||
} | sed -e 's,.*/,,;h;s,.*\.,,;s,^[^8][0-9a-z]*$$,8,;x' \
|
||||
-e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,'`; \
|
||||
dir='$(DESTDIR)$(man8dir)'; $(am__uninstall_files_from_dir)
|
||||
tags TAGS:
|
||||
|
||||
ctags CTAGS:
|
||||
|
||||
cscope cscopelist:
|
||||
|
||||
|
||||
distdir: $(DISTFILES)
|
||||
@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
|
||||
topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
|
||||
list='$(DISTFILES)'; \
|
||||
dist_files=`for file in $$list; do echo $$file; done | \
|
||||
sed -e "s|^$$srcdirstrip/||;t" \
|
||||
-e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
|
||||
case $$dist_files in \
|
||||
*/*) $(MKDIR_P) `echo "$$dist_files" | \
|
||||
sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
|
||||
sort -u` ;; \
|
||||
esac; \
|
||||
for file in $$dist_files; do \
|
||||
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
|
||||
if test -d $$d/$$file; then \
|
||||
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
|
||||
if test -d "$(distdir)/$$file"; then \
|
||||
find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
|
||||
fi; \
|
||||
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
|
||||
cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
|
||||
find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
|
||||
fi; \
|
||||
cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
|
||||
else \
|
||||
test -f "$(distdir)/$$file" \
|
||||
|| cp -p $$d/$$file "$(distdir)/$$file" \
|
||||
|| exit 1; \
|
||||
fi; \
|
||||
done
|
||||
check-am: all-am
|
||||
check: check-am
|
||||
all-am: Makefile $(MANS)
|
||||
installdirs:
|
||||
for dir in "$(DESTDIR)$(man1dir)" "$(DESTDIR)$(man8dir)"; do \
|
||||
test -z "$$dir" || $(MKDIR_P) "$$dir"; \
|
||||
done
|
||||
install: install-am
|
||||
install-exec: install-exec-am
|
||||
install-data: install-data-am
|
||||
uninstall: uninstall-am
|
||||
|
||||
install-am: all-am
|
||||
@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
|
||||
|
||||
installcheck: installcheck-am
|
||||
install-strip:
|
||||
if test -z '$(STRIP)'; then \
|
||||
$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
|
||||
install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
|
||||
install; \
|
||||
else \
|
||||
$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
|
||||
install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
|
||||
"INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
|
||||
fi
|
||||
mostlyclean-generic:
|
||||
|
||||
clean-generic:
|
||||
|
||||
distclean-generic:
|
||||
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
|
||||
-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
|
||||
|
||||
maintainer-clean-generic:
|
||||
@echo "This command is intended for maintainers to use"
|
||||
@echo "it deletes files that may require special tools to rebuild."
|
||||
clean: clean-am
|
||||
|
||||
clean-am: clean-generic clean-libtool mostlyclean-am
|
||||
|
||||
distclean: distclean-am
|
||||
-rm -f Makefile
|
||||
distclean-am: clean-am distclean-generic
|
||||
|
||||
dvi: dvi-am
|
||||
|
||||
dvi-am:
|
||||
|
||||
html: html-am
|
||||
|
||||
html-am:
|
||||
|
||||
info: info-am
|
||||
|
||||
info-am:
|
||||
|
||||
install-data-am: install-man
|
||||
|
||||
install-dvi: install-dvi-am
|
||||
|
||||
install-dvi-am:
|
||||
|
||||
install-exec-am:
|
||||
|
||||
install-html: install-html-am
|
||||
|
||||
install-html-am:
|
||||
|
||||
install-info: install-info-am
|
||||
|
||||
install-info-am:
|
||||
|
||||
install-man: install-man1 install-man8
|
||||
|
||||
install-pdf: install-pdf-am
|
||||
|
||||
install-pdf-am:
|
||||
|
||||
install-ps: install-ps-am
|
||||
|
||||
install-ps-am:
|
||||
|
||||
installcheck-am:
|
||||
|
||||
maintainer-clean: maintainer-clean-am
|
||||
-rm -f Makefile
|
||||
maintainer-clean-am: distclean-am maintainer-clean-generic
|
||||
|
||||
mostlyclean: mostlyclean-am
|
||||
|
||||
mostlyclean-am: mostlyclean-generic mostlyclean-libtool
|
||||
|
||||
pdf: pdf-am
|
||||
|
||||
pdf-am:
|
||||
|
||||
ps: ps-am
|
||||
|
||||
ps-am:
|
||||
|
||||
uninstall-am: uninstall-man
|
||||
|
||||
uninstall-man: uninstall-man1 uninstall-man8
|
||||
|
||||
.MAKE: install-am install-strip
|
||||
|
||||
.PHONY: all all-am check check-am clean clean-generic clean-libtool \
|
||||
cscopelist-am ctags-am distclean distclean-generic \
|
||||
distclean-libtool distdir dvi dvi-am html html-am info info-am \
|
||||
install install-am install-data install-data-am install-dvi \
|
||||
install-dvi-am install-exec install-exec-am install-html \
|
||||
install-html-am install-info install-info-am install-man \
|
||||
install-man1 install-man8 install-pdf install-pdf-am \
|
||||
install-ps install-ps-am install-strip installcheck \
|
||||
installcheck-am installdirs maintainer-clean \
|
||||
maintainer-clean-generic mostlyclean mostlyclean-generic \
|
||||
mostlyclean-libtool pdf pdf-am ps ps-am tags-am uninstall \
|
||||
uninstall-am uninstall-man uninstall-man1 uninstall-man8
|
||||
|
||||
.PRECIOUS: Makefile
|
||||
|
||||
|
||||
# Tell versions [3.59,3.63) of GNU make to not export all variables.
|
||||
# Otherwise a system limit (for SysV at least) may be exceeded.
|
||||
.NOEXPORT:
|
||||
148
install/tools/man/ipa-adtrust-install.1
Normal file
148
install/tools/man/ipa-adtrust-install.1
Normal file
@@ -0,0 +1,148 @@
|
||||
.\" A man page for ipa-adtrust-install
|
||||
.\" Copyright (C) 2011 Red Hat, Inc.
|
||||
.\"
|
||||
.\" This program is free software; you can redistribute it and/or modify
|
||||
.\" it under the terms of the GNU General Public License as published by
|
||||
.\" the Free Software Foundation, either version 3 of the License, or
|
||||
.\" (at your option) any later version.
|
||||
.\"
|
||||
.\" This program is distributed in the hope that it will be useful, but
|
||||
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
.\" General Public License for more details.
|
||||
.\"
|
||||
.\" You should have received a copy of the GNU General Public License
|
||||
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
.\"
|
||||
.\" Author: Sumit Bose <sbose@redhat.com>
|
||||
.\"
|
||||
.TH "ipa-adtrust-install" "1" "April 11 2017" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-adtrust\-install \- Prepare an IPA server to be able to establish trust relationships with AD domains
|
||||
.SH "SYNOPSIS"
|
||||
ipa\-adtrust\-install [\fIOPTION\fR]...
|
||||
.SH "DESCRIPTION"
|
||||
Adds all necessary objects and configuration to allow an IPA server to create a
|
||||
trust to an Active Directory domain. This requires that the IPA server is
|
||||
already installed and configured.
|
||||
|
||||
Please note you will not be able to establish a trust to an Active Directory
|
||||
domain unless the realm name of the IPA server matches its domain name.
|
||||
|
||||
ipa\-adtrust\-install can be run multiple times to reinstall deleted objects or
|
||||
broken configuration files. E.g. a fresh samba configuration (smb.conf) file and
|
||||
registry based configuration can be created. Other items like e.g. the
|
||||
configuration of the local range cannot be changed by running
|
||||
ipa\-adtrust\-install a second time because with changes here other objects
|
||||
might be affected as well.
|
||||
|
||||
.SS "Firewall Requirements"
|
||||
In addition to the IPA server firewall requirements, ipa\-adtrust\-install requires
|
||||
the following ports to be open to allow IPA and Active Directory to communicate together:
|
||||
|
||||
\fBTCP Ports\fR
|
||||
.IP
|
||||
\(bu 135/tcp EPMAP
|
||||
.IP
|
||||
\(bu 138/tcp NetBIOS-DGM
|
||||
.IP
|
||||
\(bu 139/tcp NetBIOS-SSN
|
||||
.IP
|
||||
\(bu 445/tcp Microsoft-DS
|
||||
.IP
|
||||
\(bu 1024/tcp through 1300/tcp to allow EPMAP on port 135/tcp to create a TCP listener based
|
||||
on an incoming request.
|
||||
.IP
|
||||
\(bu 3268/tcp Microsoft-GC
|
||||
.TP
|
||||
\fBUDP Ports\fR
|
||||
.IP
|
||||
\(bu 138/udp NetBIOS-DGM
|
||||
.IP
|
||||
\(bu 139/udp NetBIOS-SSN
|
||||
.IP
|
||||
\(bu 389/udp LDAP
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-d\fR, \fB\-\-debug\fR
|
||||
Enable debug logging when more verbose output is needed.
|
||||
.TP
|
||||
\fB\-\-netbios\-name\fR=\fINETBIOS_NAME\fR
|
||||
The NetBIOS name for the IPA domain. If not provided then this is determined
|
||||
based on the leading component of the DNS domain name. Running
|
||||
ipa\-adtrust\-install for a second time with a different NetBIOS name will
|
||||
change the name. Please note that changing the NetBIOS name might break
|
||||
existing trust relationships to other domains.
|
||||
.TP
|
||||
\fB\-\-add\-sids\fR
|
||||
Add SIDs to existing users and groups as one of the final steps of the
|
||||
ipa\-adtrust\-install run. If there a many existing users and groups and a
|
||||
couple of replicas in the environment this operation might lead to a high
|
||||
replication traffic and a performance degradation of all IPA servers in the
|
||||
environment. To avoid this the SID generation can be run after
|
||||
ipa\-adtrust\-install is run and scheduled independently. To start this task
|
||||
you have to load an edited version of ipa-sidgen-task-run.ldif with the
|
||||
ldapmodify command info the directory server.
|
||||
.TP
|
||||
\fB\-\-add\-agents\fR
|
||||
Add IPA masters to the list that allows to serve information about
|
||||
users from trusted forests. Starting with FreeIPA 4.2, a regular IPA master
|
||||
can provide this information to SSSD clients. IPA masters aren't added
|
||||
to the list automatically as restart of the LDAP service on each of them
|
||||
is required. The host where ipa\-adtrust\-install is being run is added
|
||||
automatically.
|
||||
.IP
|
||||
Note that IPA masters where ipa\-adtrust\-install wasn't run, can serve
|
||||
information about users from trusted forests only if they are enabled
|
||||
via \ipa-adtrust\-install run on any other IPA master. At least SSSD
|
||||
version 1.13 on IPA master is required to be able to perform as a trust agent.
|
||||
.TP
|
||||
\fB\-U\fR, \fB\-\-unattended\fR
|
||||
An unattended installation that will never prompt for user input.
|
||||
.TP
|
||||
\fB\-\-rid-base\fR=\fIRID_BASE\fR
|
||||
First RID value of the local domain. The first POSIX ID of the local domain will
|
||||
be assigned to this RID, the second to RID+1 etc. See the online help of the
|
||||
idrange CLI for details.
|
||||
.TP
|
||||
\fB\-\-secondary-rid-base\fR=\fISECONDARY_RID_BASE\fR
|
||||
Start value of the secondary RID range, which is only used in the case a user
|
||||
and a group share numerically the same POSIX ID. See the online help of the
|
||||
idrange CLI for details.
|
||||
.TP
|
||||
\fB\-A\fR, \fB\-\-admin\-name\fR=\fIADMIN_NAME\fR
|
||||
The name of the user with administrative privileges for this IPA server. Defaults to 'admin'.
|
||||
.TP
|
||||
\fB\-a\fR, \fB\-\-admin\-password\fR=\fIpassword\fR
|
||||
The password of the user with administrative privileges for this IPA server. Will be asked interactively if \fB\-U\fR is not specified.
|
||||
.TP
|
||||
The credentials of the admin user will be used to obtain Kerberos ticket before configuring cross-realm trusts support and afterwards, to ensure that the ticket contains MS-PAC information required to actually add a trust with Active Directory domain via 'ipa trust\-add \-\-type=ad' command.
|
||||
.TP
|
||||
\fB\-\-enable\-compat\fR
|
||||
Enables support for trusted domains users for old clients through Schema Compatibility plugin.
|
||||
SSSD supports trusted domains natively starting with version 1.9. For platforms that
|
||||
lack SSSD or run older SSSD version one needs to use this option. When enabled, slapi\-nis package
|
||||
needs to be installed and schema\-compat\-plugin will be configured to provide lookup of
|
||||
users and groups from trusted domains via SSSD on IPA server. These users and groups will be
|
||||
available under \fBcn=users,cn=compat,$SUFFIX\fR and \fBcn=groups,cn=compat,$SUFFIX\fR trees.
|
||||
SSSD will normalize names of users and groups to lower case.
|
||||
.IP
|
||||
In addition to providing these users and groups through the compat tree, this option enables
|
||||
authentication over LDAP for trusted domain users with DN under compat tree, i.e. using bind DN
|
||||
\fBuid=administrator@ad.domain,cn=users,cn=compat,$SUFFIX\fR.
|
||||
.IP
|
||||
LDAP authentication performed by the compat tree is done via PAM '\fBsystem\-auth\fR' service.
|
||||
This service exists by default on Linux systems and is provided by pam package as /etc/pam.d/system\-auth.
|
||||
If your IPA install does not have default HBAC rule 'allow_all' enabled, then make sure
|
||||
to define in IPA special service called '\fBsystem\-auth\fR' and create an HBAC
|
||||
rule to allow access to anyone to this rule on IPA masters.
|
||||
.IP
|
||||
As '\fBsystem\-auth\fR' PAM service is not used directly by any other
|
||||
application, it is safe to use it for trusted domain users via compatibility
|
||||
path.
|
||||
.TP
|
||||
.SH "EXIT STATUS"
|
||||
0 if the installation was successful
|
||||
|
||||
1 if an error occurred
|
||||
44
install/tools/man/ipa-advise.1
Normal file
44
install/tools/man/ipa-advise.1
Normal file
@@ -0,0 +1,44 @@
|
||||
.\" A man page for ipa-advise
|
||||
.\" Copyright (C) 2013 Red Hat, Inc.
|
||||
.\"
|
||||
.\" This program is free software; you can redistribute it and/or modify
|
||||
.\" it under the terms of the GNU General Public License as published by
|
||||
.\" the Free Software Foundation, either version 3 of the License, or
|
||||
.\" (at your option) any later version.
|
||||
.\"
|
||||
.\" This program is distributed in the hope that it will be useful, but
|
||||
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
.\" General Public License for more details.
|
||||
.\"
|
||||
.\" You should have received a copy of the GNU General Public License
|
||||
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
.\"
|
||||
.\" Author: Tomas Babej <tbabej@redhat.com>
|
||||
.\"
|
||||
.TH "ipa-advise" "1" "Jun 10 2013" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-advise \- Provide configurations advice for various use cases.
|
||||
.SH "SYNOPSIS"
|
||||
ipa\-advise ADVICE
|
||||
.SH "DESCRIPTION"
|
||||
Provides customized advice for various IPA configuration issues.
|
||||
.TP
|
||||
For the list of possible ADVICEs available, run the ipa\-advise with no arguments.
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-\-v\fR, \fB\-\-verbose\fR
|
||||
Print debugging information
|
||||
.TP
|
||||
\fB\-d\fR, \fB\-\-debug\fR
|
||||
Alias for \-\-verbose
|
||||
.TP
|
||||
\fB\-q\fR, \fB\-\-quiet\fR
|
||||
Output only errors
|
||||
.TP
|
||||
\fB\-\-log\-file\fR=\fIFILE\fR
|
||||
Log to the given file
|
||||
.SH "EXIT STATUS"
|
||||
0 if the command was successful
|
||||
|
||||
1 if an error occurred
|
||||
84
install/tools/man/ipa-backup.1
Normal file
84
install/tools/man/ipa-backup.1
Normal file
@@ -0,0 +1,84 @@
|
||||
.\" A man page for ipa-backup
|
||||
.\" Copyright (C) 2013 Red Hat, Inc.
|
||||
.\"
|
||||
.\" This program is free software; you can redistribute it and/or modify
|
||||
.\" it under the terms of the GNU General Public License as published by
|
||||
.\" the Free Software Foundation, either version 3 of the License, or
|
||||
.\" (at your option) any later version.
|
||||
.\"
|
||||
.\" This program is distributed in the hope that it will be useful, but
|
||||
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
.\" General Public License for more details.
|
||||
.\"
|
||||
.\" You should have received a copy of the GNU General Public License
|
||||
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
.\"
|
||||
.\" Author: Rob Crittenden <rcritten@redhat.com>
|
||||
.\"
|
||||
.TH "ipa-backup" "1" "Mar 22 2013" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-backup \- Back up an IPA master
|
||||
.SH "SYNOPSIS"
|
||||
ipa\-backup [\fIOPTION\fR]...
|
||||
.SH "DESCRIPTION"
|
||||
Two kinds of backups: full and data\-only.
|
||||
.TP
|
||||
The back up is optionally encrypted using either the default root GPG key or a named key. No passphrase is supported.
|
||||
.TP
|
||||
Backups are stored in a subdirectory in /var/lib/ipa/backup.
|
||||
.TP
|
||||
The naming convention for full backups is ipa\-full\-YEAR\-MM\-DD\-HH\-MM\-SS in the GMT time zone.
|
||||
.TP
|
||||
The naming convention for data backups is ipa\-data\-YEAR\-MM\-DD\-HH\-MM\-SS In the GMT time zone.
|
||||
.TP
|
||||
Within the subdirectory is file, header, that describes the back up including the type, system, date of backup, the version of IPA, the version of the backup and the services on the master.
|
||||
.TP
|
||||
A backup can not be restored on another host.
|
||||
.TP
|
||||
A backup can not be restored in a different version of IPA.
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-\-data\fR
|
||||
Back up data only. The default is to back up all IPA files plus data.
|
||||
.TP
|
||||
\fB\-\-gpg\fR
|
||||
Encrypt the back up file.
|
||||
.TP
|
||||
\fB\-\-gpg\-keyring\fR=\fIGPG_KEYRING\fR
|
||||
The full path to a GPG keyring. The keyring consists of two files, a public and a private key (.sec and .pub respectively). Specify the path without an extension.
|
||||
.TP
|
||||
\fB\-\-logs\fR
|
||||
Include the IPA service log files in the backup.
|
||||
.TP
|
||||
\fB\-\-online\fR
|
||||
Perform the backup on\-line. Requires the \-\-data option.
|
||||
.TP
|
||||
\fB\-\-v\fR, \fB\-\-verbose\fR
|
||||
Print debugging information
|
||||
.TP
|
||||
\fB\-d\fR, \fB\-\-debug\fR
|
||||
Alias for \-\-verbose
|
||||
.TP
|
||||
\fB\-q\fR, \fB\-\-quiet\fR
|
||||
Output only errors
|
||||
.TP
|
||||
\fB\-\-log\-file\fR=\fIFILE\fR
|
||||
Log to the given file
|
||||
.SH "EXIT STATUS"
|
||||
0 if the command was successful
|
||||
|
||||
1 if an error occurred
|
||||
.SH "FILES"
|
||||
.PP
|
||||
\fI/var/lib/ipa/backup\fR
|
||||
.RS 4
|
||||
The default directory for storing backup files.
|
||||
.RE
|
||||
.PP
|
||||
\fl/var/log/ipabackup.log\fR
|
||||
.RS 4
|
||||
The log file for backups
|
||||
.PP
|
||||
.SH "SEE ALSO"
|
||||
ipa\-restore(1).
|
||||
98
install/tools/man/ipa-ca-install.1
Normal file
98
install/tools/man/ipa-ca-install.1
Normal file
@@ -0,0 +1,98 @@
|
||||
.\" A man page for ipa-ca-install
|
||||
.\" Copyright (C) 2011-2017 Red Hat, Inc.
|
||||
.\"
|
||||
.\" This program is free software; you can redistribute it and/or modify
|
||||
.\" it under the terms of the GNU General Public License as published by
|
||||
.\" the Free Software Foundation, either version 3 of the License, or
|
||||
.\" (at your option) any later version.
|
||||
.\"
|
||||
.\" This program is distributed in the hope that it will be useful, but
|
||||
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
.\" General Public License for more details.
|
||||
.\"
|
||||
.\" You should have received a copy of the GNU General Public License
|
||||
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
.\"
|
||||
.\" Author: Rob Crittenden <rcritten@redhat.com>
|
||||
.\"
|
||||
.TH "ipa-ca-install" "1" "Mar 30 2017" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-ca\-install \- Install a CA on a server
|
||||
.SH "SYNOPSIS"
|
||||
.SS "DOMAIN LEVEL 0"
|
||||
.TP
|
||||
ipa\-ca\-install [\fIOPTION\fR]... [replica_file]
|
||||
.SS "DOMAIN LEVEL 1"
|
||||
.TP
|
||||
ipa\-ca\-install [\fIOPTION\fR]...
|
||||
.SH "DESCRIPTION"
|
||||
Adds a CA as an IPA\-managed service. This requires that the IPA server is already installed and configured.
|
||||
|
||||
In a domain at domain level 0, you can run ipa\-ca\-install without replica_file to upgrade from CA-less to CA-full, or with replica_file to install the CA service on the replica.
|
||||
|
||||
The replica_file is created using the ipa\-replica\-prepare utility and should be the same one used when originally installing the replica.
|
||||
|
||||
In a domain at domain level 1, ipa\-ca\-install can be used to upgrade from CA-less to CA-full or to install the CA service on a replica, and does not require any replica file.
|
||||
.SH "OPTIONS"
|
||||
\fB\-d\fR, \fB\-\-debug\fR
|
||||
Enable debug logging when more verbose output is needed
|
||||
.TP
|
||||
\fB\-p\fR \fIDM_PASSWORD\fR, \fB\-\-password\fR=\fIDM_PASSWORD\fR
|
||||
Directory Manager (existing master) password
|
||||
.TP
|
||||
\fB\-w\fR \fIADMIN_PASSWORD\fR, \fB\-\-admin\-password\fR=\fIADMIN_PASSWORD\fR
|
||||
Admin user Kerberos password used for connection check
|
||||
.TP
|
||||
\fB\-\-external\-ca\fR
|
||||
Generate a CSR for the IPA CA certificate to be signed by an external CA.
|
||||
.TP
|
||||
\fB\-\-external\-ca\-type\fR=\fITYPE\fR
|
||||
Type of the external CA. Possible values are "generic", "ms-cs". Default value is "generic". Use "ms-cs" to include the template name required by Microsoft Certificate Services (MS CS) in the generated CSR (see \fB\-\-external\-ca\-profile\fR for full details).
|
||||
|
||||
.TP
|
||||
\fB\-\-external\-ca\-profile\fR=\fIPROFILE_SPEC\fR
|
||||
Specify the certificate profile or template to use at the external CA.
|
||||
|
||||
When \fB\-\-external\-ca\-type\fR is "ms-cs" the following specifiers may be used:
|
||||
|
||||
.RS
|
||||
.TP
|
||||
\fB<oid>:<majorVersion>[:<minorVersion>]\fR
|
||||
Specify a certificate template by OID and major version, optionally also specifying minor version.
|
||||
.TP
|
||||
\fB<name>\fR
|
||||
Specify a certificate template by name. The name cannot contain any \fI:\fR characters and cannot be an OID (otherwise the OID-based template specifier syntax takes precedence).
|
||||
.TP
|
||||
\fBdefault\fR
|
||||
If no template is specified, the template name "SubCA" is used.
|
||||
.RE
|
||||
|
||||
.TP
|
||||
\fB\-\-external\-cert\-file\fR=\fIFILE\fR
|
||||
File containing the IPA CA certificate and the external CA certificate chain. The file is accepted in PEM and DER certificate and PKCS#7 certificate chain formats. This option may be used multiple times.
|
||||
.TP
|
||||
\fB\-\-ca\-subject\fR=\fISUBJECT\fR
|
||||
The CA certificate subject DN (default CN=Certificate Authority,O=REALM.NAME). RDNs are in LDAP order (most specific RDN first).
|
||||
.TP
|
||||
\fB\-\-subject\-base\fR=\fISUBJECT\fR
|
||||
The subject base for certificates issued by IPA (default O=REALM.NAME). RDNs are in LDAP order (most specific RDN first).
|
||||
.TP
|
||||
\fB\-\-ca\-signing\-algorithm\fR=\fIALGORITHM\fR
|
||||
Signing algorithm of the IPA CA certificate. Possible values are SHA1withRSA, SHA256withRSA, SHA512withRSA. Default value is SHA256withRSA. Use this option with --external-ca if the external CA does not support the default signing algorithm.
|
||||
.TP
|
||||
\fB\-\-no\-host\-dns\fR
|
||||
Do not use DNS for hostname lookup during installation
|
||||
.TP
|
||||
\fB\-\-skip\-conncheck\fR
|
||||
Skip connection check to remote master
|
||||
.TP
|
||||
\fB\-\-skip\-schema\-check\fR
|
||||
Skip check for updated CA DS schema on the remote master
|
||||
.TP
|
||||
\fB\-U\fR, \fB\-\-unattended\fR
|
||||
An unattended installation that will never prompt for user input
|
||||
.SH "EXIT STATUS"
|
||||
0 if the command was successful
|
||||
|
||||
1 if an error occurred
|
||||
129
install/tools/man/ipa-cacert-manage.1
Normal file
129
install/tools/man/ipa-cacert-manage.1
Normal file
@@ -0,0 +1,129 @@
|
||||
.\" A man page for ipa-cacert-manage
|
||||
.\" Copyright (C) 2014 Red Hat, Inc.
|
||||
.\"
|
||||
.\" This program is free software; you can redistribute it and/or modify
|
||||
.\" it under the terms of the GNU General Public License as published by
|
||||
.\" the Free Software Foundation, either version 3 of the License, or
|
||||
.\" (at your option) any later version.
|
||||
.\"
|
||||
.\" This program is distributed in the hope that it will be useful, but
|
||||
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
.\" General Public License for more details.
|
||||
.\"
|
||||
.\" You should have received a copy of the GNU General Public License
|
||||
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
.\"
|
||||
.\" Author: Jan Cholasta <jcholast@redhat.com>
|
||||
.\"
|
||||
.TH "ipa-cacert-manage" "1" "Aug 12 2013" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-cacert\-manage \- Manage CA certificates in IPA
|
||||
.SH "SYNOPSIS"
|
||||
\fBipa\-cacert\-manage\fR [\fIOPTIONS\fR...] renew
|
||||
.RE
|
||||
\fBipa\-cacert\-manage\fR [\fIOPTIONS\fR...] install \fICERTFILE\fR
|
||||
.SH "DESCRIPTION"
|
||||
\fBipa\-cacert\-manage\fR can be used to manage CA certificates in IPA.
|
||||
.SH "COMMANDS"
|
||||
.TP
|
||||
\fBrenew\fR
|
||||
\- Renew the IPA CA certificate
|
||||
.sp
|
||||
.RS
|
||||
This command can be used to manually renew the CA certificate of the IPA CA (NSS database nickname: "caSigningCert cert-pki-ca"). To renew other certificates, use getcert-resubmit(1).
|
||||
.sp
|
||||
When the IPA CA is the root CA (the default), it is not usually necessary to manually renew the CA certificate, as it will be renewed automatically when it is about to expire, but you can do so if you wish.
|
||||
.sp
|
||||
When the IPA CA is subordinate of an external CA, the renewal process involves submitting a CSR to the external CA and installing the newly issued certificate in IPA, which cannot be done automatically. It is necessary to manually renew the CA certificate in this setup.
|
||||
.sp
|
||||
When the IPA CA is not configured, this command is not available.
|
||||
.RE
|
||||
.TP
|
||||
\fBinstall\fR
|
||||
\- Install a CA certificate
|
||||
.sp
|
||||
.RS
|
||||
This command can be used to install the certificate contained in \fICERTFILE\fR as an additional CA certificate to IPA.
|
||||
.sp
|
||||
Important: this does not replace IPA CA but adds the provided certificate as a known CA. This is useful for instance when using ipa-server-certinstall to replace HTTP/LDAP certificates with third-party certificates signed by this additional CA.
|
||||
.sp
|
||||
Please do not forget to run ipa-certupdate on the master, all the replicas and all the clients after this command in order to update IPA certificates databases.
|
||||
.RE
|
||||
.SH "COMMON OPTIONS"
|
||||
.TP
|
||||
\fB\-\-version\fR
|
||||
Show the program's version and exit.
|
||||
.TP
|
||||
\fB\-h\fR, \fB\-\-help\fR
|
||||
Show the help for this program.
|
||||
.TP
|
||||
\fB\-p\fR \fIDM_PASSWORD\fR, \fB\-\-password\fR=\fIDM_PASSWORD\fR
|
||||
The Directory Manager password to use for authentication.
|
||||
.TP
|
||||
\fB\-v\fR, \fB\-\-verbose\fR
|
||||
Print debugging information.
|
||||
.TP
|
||||
\fB\-q\fR, \fB\-\-quiet\fR
|
||||
Output only errors.
|
||||
.TP
|
||||
\fB\-\-log\-file\fR=\fIFILE\fR
|
||||
Log to the given file.
|
||||
.RE
|
||||
.SH "RENEW OPTIONS"
|
||||
.TP
|
||||
\fB\-\-self\-signed\fR
|
||||
Sign the renewed certificate by itself.
|
||||
.TP
|
||||
\fB\-\-external\-ca\fR
|
||||
Sign the renewed certificate by external CA.
|
||||
.TP
|
||||
\fB\-\-external\-ca\-type\fR=\fITYPE\fR
|
||||
Type of the external CA. Possible values are "generic", "ms-cs". Default value is "generic". Use "ms-cs" to include the template name required by Microsoft Certificate Services (MS CS) in the generated CSR (see \fB\-\-external\-ca\-profile\fR for full details).
|
||||
|
||||
.TP
|
||||
\fB\-\-external\-ca\-profile\fR=\fIPROFILE_SPEC\fR
|
||||
Specify the certificate profile or template to use at the external CA.
|
||||
|
||||
When \fB\-\-external\-ca\-type\fR is "ms-cs" the following specifiers may be used:
|
||||
|
||||
.RS
|
||||
.TP
|
||||
\fB<oid>:<majorVersion>[:<minorVersion>]\fR
|
||||
Specify a certificate template by OID and major version, optionally also specifying minor version.
|
||||
.TP
|
||||
\fB<name>\fR
|
||||
Specify a certificate template by name. The name cannot contain any \fI:\fR characters and cannot be an OID (otherwise the OID-based template specifier syntax takes precedence).
|
||||
.TP
|
||||
\fBdefault\fR
|
||||
If no template is specified, the template name "SubCA" is used.
|
||||
.RE
|
||||
|
||||
.TP
|
||||
\fB\-\-external\-cert\-file\fR=\fIFILE\fR
|
||||
File containing the IPA CA certificate and the external CA certificate chain. The file is accepted in PEM and DER certificate and PKCS#7 certificate chain formats. This option may be used multiple times.
|
||||
.RE
|
||||
.SH "INSTALL OPTIONS"
|
||||
.TP
|
||||
\fB\-n\fR \fINICKNAME\fR, \fB\-\-nickname\fR=\fINICKNAME\fR
|
||||
Nickname for the certificate.
|
||||
.TP
|
||||
\fB\-t\fR \fITRUST_FLAGS\fR, \fB\-\-trust\-flags\fR=\fITRUST_FLAGS\fR
|
||||
Trust flags for the certificate in certutil format. Trust flags are of the form "A,B,C" or "A,B,C,D" where A is for SSL, B is for S/MIME, C is for code signing, and D is for PKINIT. Use ",," for no explicit trust.
|
||||
.sp
|
||||
The supported trust flags are:
|
||||
.RS
|
||||
.IP
|
||||
C \- CA trusted to issue server certificates
|
||||
.IP
|
||||
T \- CA trusted to issue client certificates
|
||||
.IP
|
||||
p \- not trusted
|
||||
.RE
|
||||
.SH "EXIT STATUS"
|
||||
0 if the command was successful
|
||||
|
||||
1 if an error occurred
|
||||
|
||||
.SH "SEE ALSO"
|
||||
.BR getcert-resubmit(1)
|
||||
47
install/tools/man/ipa-compat-manage.1
Normal file
47
install/tools/man/ipa-compat-manage.1
Normal file
@@ -0,0 +1,47 @@
|
||||
.\" A man page for ipa-compat-manage
|
||||
.\" Copyright (C) 2008 Red Hat, Inc.
|
||||
.\"
|
||||
.\" This program is free software; you can redistribute it and/or modify
|
||||
.\" it under the terms of the GNU General Public License as published by
|
||||
.\" the Free Software Foundation, either version 3 of the License, or
|
||||
.\" (at your option) any later version.
|
||||
.\"
|
||||
.\" This program is distributed in the hope that it will be useful, but
|
||||
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
.\" General Public License for more details.
|
||||
.\"
|
||||
.\" You should have received a copy of the GNU General Public License
|
||||
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
.\"
|
||||
.\" Author: Simo Sorce <ssorce@redhat.com>
|
||||
.\"
|
||||
.TH "ipa-compat-manage" "1" "Dec 2 2008" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-compat\-manage \- Enables or disables the schema compatibility plugin
|
||||
.SH "SYNOPSIS"
|
||||
ipa\-compat\-manage [options] <enable|disable|status>
|
||||
.SH "DESCRIPTION"
|
||||
Run the command with the \fBenable\fR option to enable the compat plugin.
|
||||
|
||||
Run the command with the \fBdisable\fR option to disable the compat plugin.
|
||||
|
||||
Run the command with the \fBstatus\fR to determine the current status of the compat plugin.
|
||||
|
||||
In all cases the user will be prompted to provide the Directory Manager's password unless option \fB\-y\fR is used.
|
||||
|
||||
Directory Server will need to be restarted after the schema compatibility plugin has been enabled.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-d\fR, \fB\-\-debug\fR
|
||||
Enable debug logging when more verbose output is needed
|
||||
.TP
|
||||
\fB\-y\fR \fIfile\fR
|
||||
File containing the Directory Manager password
|
||||
.SH "EXIT STATUS"
|
||||
0 if the command was successful
|
||||
|
||||
1 if an error occurred
|
||||
|
||||
2 if the plugin is already in the required status (enabled or disabled)
|
||||
103
install/tools/man/ipa-csreplica-manage.1
Normal file
103
install/tools/man/ipa-csreplica-manage.1
Normal file
@@ -0,0 +1,103 @@
|
||||
.\" A man page for ipa-csreplica-manage
|
||||
.\" Copyright (C) 2011 Red Hat, Inc.
|
||||
.\"
|
||||
.\" This program is free software; you can redistribute it and/or modify
|
||||
.\" it under the terms of the GNU General Public License as published by
|
||||
.\" the Free Software Foundation, either version 3 of the License, or
|
||||
.\" (at your option) any later version.
|
||||
.\"
|
||||
.\" This program is distributed in the hope that it will be useful, but
|
||||
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
.\" General Public License for more details.
|
||||
.\"
|
||||
.\" You should have received a copy of the GNU General Public License
|
||||
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
.\"
|
||||
.\" Author: Rob Crittenden <rcritten@redhat.com>
|
||||
.\"
|
||||
.TH "ipa-csreplica-manage" "1" "Jul 14 2011" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-csreplica\-manage \- Manage an IPA CS replica
|
||||
.SH "SYNOPSIS"
|
||||
ipa\-csreplica\-manage [\fIOPTION\fR]... [connect|disconnect|del|list|re\-initialize|force\-sync]
|
||||
.SH "DESCRIPTION"
|
||||
Manages the CA replication agreements of an IPA server for domain at domain level 0.
|
||||
|
||||
To manage CA replication agreements in a domain at domain level 1, use IPA CLI or Web UI, see `ipa help topology` for additional information.
|
||||
|
||||
.TP
|
||||
\fBconnect\fR [SERVER_A] <SERVER_B>
|
||||
\- Adds a new replication agreement between SERVER_A/localhost and SERVER_B. Applicable only at domain level 0.
|
||||
.TP
|
||||
\fBdisconnect\fR [SERVER_A] <SERVER_B>
|
||||
\- Removes a replication agreement between SERVER_A/localhost and SERVER_B. Applicable only at domain level 0.
|
||||
.TP
|
||||
\fBdel\fR <SERVER>
|
||||
\- Removes all replication agreements and data about SERVER. Applicable only at domain level 0.
|
||||
|
||||
.TP
|
||||
\fBlist\fR [SERVER]
|
||||
\- Lists all the servers or the list of agreements of SERVER
|
||||
.TP
|
||||
\fBre\-initialize\fR
|
||||
\- Forces a full re\-initialization of the IPA CA server retrieving data from the server specified with the \-\-from option
|
||||
.TP
|
||||
\fBforce\-sync\fR
|
||||
\- Immediately flush any data to be replicated from a server specified with the \-\-from option
|
||||
.TP
|
||||
\fBset\-renewal\-master\fR [SERVER]
|
||||
\- Set CA server which handles renewal of CA subsystem certificates to SERVER
|
||||
.TP
|
||||
The connect and disconnect options are used to manage the replication topology. When a replica is created it is only connected with the master that created it. The connect option may be used to connect it to other existing replicas.
|
||||
.TP
|
||||
The disconnect option cannot be used to remove the last link of a replica. To remove a replica from the topology use the del option.
|
||||
.TP
|
||||
If a replica is deleted and then re\-added within a short time-frame then the 389\-ds instance on the master that created it should be restarted before re\-installing the replica. The master will have the old service principals cached which will cause replication to fail.
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-H\fR \fIHOST\fR, \fB\-\-host\fR=\fIHOST\fR
|
||||
The IPA server to manage.
|
||||
The default is the machine on which the command is run
|
||||
Not honoured by the re\-initialize command.
|
||||
.TP
|
||||
\fB\-p\fR \fIDM_PASSWORD\fR, \fB\-\-password\fR=\fIDM_PASSWORD\fR
|
||||
The Directory Manager password to use for authentication
|
||||
.TP
|
||||
\fB\-v\fR, \fB\-\-verbose\fR
|
||||
Provide additional information
|
||||
.TP
|
||||
\fB\-f\fR, \fB\-\-force\fR
|
||||
Ignore some types of errors
|
||||
.TP
|
||||
\fB\-\-from\fR=\fISERVER\fR
|
||||
The server to pull the data from, used by the re\-initialize and force\-sync commands.
|
||||
.SH "EXAMPLES"
|
||||
.TP
|
||||
List a server's replication agreements.
|
||||
# ipa\-csreplica\-manage list srv1.example.com
|
||||
srv2.example.com
|
||||
srv3.example.com
|
||||
.TP
|
||||
Re\-initialize a replica:
|
||||
# ipa\-csreplica\-manage re\-initialize \-\-from srv2.example.com
|
||||
|
||||
This will re\-initialize the data on the server where you execute the command, retrieving the data from the srv2.example.com replica
|
||||
.TP
|
||||
Add a new replication agreement:
|
||||
# ipa\-csreplica\-manage connect srv2.example.com srv4.example.com
|
||||
.TP
|
||||
Remove an existing replication agreement:
|
||||
# ipa\-csreplica\-manage disconnect srv1.example.com srv3.example.com
|
||||
.TP
|
||||
Completely remove a replica at domain level 0:
|
||||
# ipa\-csreplica\-manage del srv4.example.com
|
||||
.TP
|
||||
Completely remove a replica at domain level 1:
|
||||
# ipa\-replica\-manage del srv4.example.com
|
||||
.TP
|
||||
Using connect/disconnect you can manage the replication topology.
|
||||
.SH "EXIT STATUS"
|
||||
0 if the command was successful
|
||||
.TP
|
||||
1 if an error occurred
|
||||
79
install/tools/man/ipa-dns-install.1
Normal file
79
install/tools/man/ipa-dns-install.1
Normal file
@@ -0,0 +1,79 @@
|
||||
.\" A man page for ipa-dns-install
|
||||
.\" Copyright (C) 2010-2016 FreeIPA Contributors see COPYING for license
|
||||
.\"
|
||||
.TH "ipa-dns-install" "1" "Jun 28, 2012" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-dns\-install \- Add DNS as a service to an IPA server
|
||||
.SH "SYNOPSIS"
|
||||
ipa\-dns\-install [\fIOPTION\fR]...
|
||||
.SH "DESCRIPTION"
|
||||
Configure an integrated DNS server on this IPA server, create DNS zone with the name of the IPA primary DNS domain, and fill it in with service records necessary for IPA deployment.
|
||||
In cases where the IPA server name does not belong to the primary DNS domain and is not resolvable using DNS, create a DNS zone containing the IPA server name as well.
|
||||
|
||||
IPA provides an integrated DNS server which can be used to simplify IPA deployment. If you decide to use it, IPA will automatically maintain SRV and other service records when you change your topology.
|
||||
|
||||
The DNS component in FreeIPA is optional and you may choose to manage all your DNS records manually on another third party DNS server. IPA DNS is not a general-purpose DNS server. If you need advanced features like DNS views, do not deploy IPA DNS.
|
||||
|
||||
This command requires that an IPA server is already installed and configured.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-d\fR, \fB\-\-debug\fR
|
||||
Enable debug logging when more verbose output is needed
|
||||
.TP
|
||||
\fB\-\-ip\-address\fR=\fIIP_ADDRESS\fR
|
||||
The IP address of the IPA server. If not provided then this is determined based on the hostname of the server.
|
||||
This this option can be used multiple times to specify more IP addresses of the server (e.g. multihomed and/or dualstacked server).
|
||||
.TP
|
||||
\fB\-\-forwarder\fR=\fIFORWARDER\fR
|
||||
A forwarder is a DNS server where queries for a specific non\-resolvable address can be directed. To define multiple forwarders use multiple instances of \fB\-\-forwarder\fR
|
||||
.TP
|
||||
\fB\-\-no\-forwarders\fR
|
||||
Do not add any DNS forwarders, send non\-resolvable addresses to the DNS root servers.
|
||||
.TP
|
||||
\fB\-\-auto\-forwarders\fR
|
||||
Add DNS forwarders configured in /etc/resolv.conf to the list of forwarders used by IPA DNS.
|
||||
.TP
|
||||
\fB\-\-forward\-policy\fR=\fIfirst|only\fR
|
||||
DNS forwarding policy for global forwarders specified using other options.
|
||||
Defaults to first if no IP address belonging to a private or reserved ranges is
|
||||
detected on local interfaces (RFC 6303). Defaults to only if a private
|
||||
IP address is detected.
|
||||
.TP
|
||||
\fB\-\-reverse\-zone\fR=\fIREVERSE_ZONE\fR
|
||||
The reverse DNS zone to use. This option can be used multiple times to specify multiple reverse zones.
|
||||
.TP
|
||||
\fB\-\-no\-reverse\fR
|
||||
Do not create new reverse DNS zone. If used on a replica and a reverse DNS zone already exists for the subnet, it will be used.
|
||||
.TP
|
||||
\fB\-\-auto\-reverse\fR
|
||||
Try to resolve reverse records and reverse zones for server IP addresses and if neither is resolvable creates these reverse zones.
|
||||
.TP
|
||||
\fB\-\-no\-dnssec\-validation\fR
|
||||
Disable DNSSEC validation on this server.
|
||||
.TP
|
||||
\fB\-\-dnssec\-master\fR
|
||||
Setup server to be DNSSEC key master.
|
||||
.TP
|
||||
\fB\-\-disable\-dnssec\-master\fR
|
||||
Disable the DNSSEC master on this server.
|
||||
.TP
|
||||
\fB\-\-kasp\-db\fR=\fIKASP_DB\fR
|
||||
Copy OpenDNSSEC metadata from the specified kasp.db file. This will not create a new kasp.db file.
|
||||
.TP
|
||||
\fB\-\-zonemgr\fR
|
||||
The e\-mail address of the DNS zone manager. Defaults to hostmaster@DOMAIN
|
||||
.TP
|
||||
\fB\-\-allow\-zone\-overlap\fR
|
||||
Allow creatin of (reverse) zone even if the zone is already resolvable. Using this option is discouraged as it result in later problems with domain name resolution.
|
||||
.TP
|
||||
\fB\-U\fR, \fB\-\-unattended\fR
|
||||
An unattended installation that will never prompt for user input
|
||||
.SH "DEPRECATED OPTIONS"
|
||||
.TP
|
||||
\fB\-p\fR \fIDM_PASSWORD\fR, \fB\-\-ds\-password\fR=\fIDM_PASSWORD\fR
|
||||
The password to be used by the Directory Server for the Directory Manager user
|
||||
.SH "EXIT STATUS"
|
||||
0 if the installation was successful
|
||||
|
||||
1 if an error occurred
|
||||
64
install/tools/man/ipa-kra-install.1
Normal file
64
install/tools/man/ipa-kra-install.1
Normal file
@@ -0,0 +1,64 @@
|
||||
.\" A man page for ipa-kra-install
|
||||
.\" Copyright (C) 2014 Red Hat, Inc.
|
||||
.\"
|
||||
.\" This program is free software; you can redistribute it and/or modify
|
||||
.\" it under the terms of the GNU General Public License as published by
|
||||
.\" the Free Software Foundation, either version 3 of the License, or
|
||||
.\" (at your option) any later version.
|
||||
.\"
|
||||
.\" This program is distributed in the hope that it will be useful, but
|
||||
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
.\" General Public License for more details.
|
||||
.\"
|
||||
.\" You should have received a copy of the GNU General Public License
|
||||
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
.\"
|
||||
.\" Author: Ade Lee <alee@redhat.com>
|
||||
.\"
|
||||
.TH "ipa-kra-install" "1" "May 10 2017" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-kra\-install \- Install a KRA on a server
|
||||
.SH "SYNOPSIS"
|
||||
.SS "DOMAIN LEVEL 0"
|
||||
.TP
|
||||
ipa\-kra\-install [\fIOPTION\fR]... [replica_file]
|
||||
.SS "DOMAIN LEVEL 1"
|
||||
.TP
|
||||
ipa\-kra\-install [\fIOPTION\fR]...
|
||||
.SH "DESCRIPTION"
|
||||
Adds a KRA as an IPA\-managed service. This requires that the IPA server is already installed and configured, including a CA.
|
||||
|
||||
The KRA (Key Recovery Authority) is a component used to securely store secrets such as passwords, symmetric keys and private asymmetric keys. It is used as the back-end repository for the IPA Password Vault.
|
||||
|
||||
In a domain at domain level 0, ipa\-kra\-install can be run without replica_file to add KRA to the existing CA, or with replica_file to install the KRA service on the replica.
|
||||
ipa\-kra\-install will contact the CA to determine if a KRA has already been installed on another replica, and if so, will exit indicating that a replica_file is required.
|
||||
|
||||
The replica_file is created using the ipa\-replica\-prepare utility. A new replica_file should be generated on the master IPA server after the KRA has been installed and configured, so that the replica_file will contain the master KRA configuration and system certificates.
|
||||
|
||||
In a domain at domain level 1, ipa\-kra\-install can be used to add KRA to the existing CA, or to install the KRA service on a replica, and does not require any replica file.
|
||||
|
||||
KRA can only be removed along with the entire server using ipa\-server\-install \-\-uninstall.
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-p\fR \fIDM_PASSWORD\fR, \fB\-\-password\fR=\fIDM_PASSWORD\fR
|
||||
Directory Manager (existing master) password
|
||||
.TP
|
||||
\fB\-\-no-host-dns\fR
|
||||
Do not use DNS for hostname lookup during installation
|
||||
.TP
|
||||
\fB\-U\fR, \fB\-\-unattended\fR
|
||||
An unattended installation that will never prompt for user input
|
||||
.TP
|
||||
\fB\-v\fR, \fB\-\-verbose\fR
|
||||
Enable debug output when more verbose output is needed
|
||||
.TP
|
||||
\fB\-q\fR, \fB\-\-quiet\fR
|
||||
Output only errors
|
||||
.TP
|
||||
\fB\-\-log-file\fR=\fRFILE\fR
|
||||
Log to the given file
|
||||
.SH "EXIT STATUS"
|
||||
0 if the command was successful
|
||||
|
||||
1 if an error occurred
|
||||
97
install/tools/man/ipa-ldap-updater.1
Normal file
97
install/tools/man/ipa-ldap-updater.1
Normal file
@@ -0,0 +1,97 @@
|
||||
.\" A man page for ipa-ldap-updater
|
||||
.\" Copyright (C) 2008 Red Hat, Inc.
|
||||
.\"
|
||||
.\" This program is free software; you can redistribute it and/or modify
|
||||
.\" it under the terms of the GNU General Public License as published by
|
||||
.\" the Free Software Foundation, either version 3 of the License, or
|
||||
.\" (at your option) any later version.
|
||||
.\"
|
||||
.\" This program is distributed in the hope that it will be useful, but
|
||||
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
.\" General Public License for more details.
|
||||
.\"
|
||||
.\" You should have received a copy of the GNU General Public License
|
||||
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
.\"
|
||||
.\" Author: Rob Crittenden <rcritten@redhat.com>
|
||||
.\"
|
||||
.TH "ipa-ldap-updater" "1" "Sep 12 2008" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-ldap\-updater \- Update the IPA LDAP configuration
|
||||
.SH "SYNOPSIS"
|
||||
ipa\-ldap\-updater [options] input_file(s)
|
||||
.SH "DESCRIPTION"
|
||||
ipa\-ldap\-updater is utility which can be used to update the IPA LDAP server.
|
||||
|
||||
An update file describes an LDAP entry and a set of operations to be performed on that entry. It can be used to add new entries or modify existing entries.
|
||||
|
||||
Blank lines and lines beginning with # are ignored.
|
||||
|
||||
There are 7 keywords:
|
||||
|
||||
* default: the starting value
|
||||
* add: add a value to an attribute
|
||||
* remove: remove a value from an attribute
|
||||
* only: set an attribute to this
|
||||
* onlyifexist: set an attribute to this only if the entry exists
|
||||
* deleteentry: remove the entry
|
||||
* replace: replace an existing value, format is old::new
|
||||
* addifnew: add a new attribute and value only if the attribute doesn't already exist. Only works with single\-value attributes.
|
||||
* addifexist: add a new attribute and value only if the entry exists. This is used to update optional entries.
|
||||
|
||||
The difference between the default and add keywords is if the DN of the entry exists then default is ignored. So for updating something like schema, which will be under cn=schema, you must always use add (because cn=schema is guaranteed to exist). It will not re\-add the same information again and again.
|
||||
|
||||
It also provides some things that can be templated such as architecture (for plugin paths), realm and domain name.
|
||||
|
||||
The available template variables are:
|
||||
|
||||
* $REALM \- the kerberos realm (EXAMPLE.COM)
|
||||
* $FQDN \- the fully\-qualified domain name of the IPA server being updated (ipa.example.com)
|
||||
* $DOMAIN \- the domain name (example.com)
|
||||
* $SUFFIX \- the IPA LDAP suffix (dc=example,dc=com)
|
||||
* $ESCAPED_SUFFIX \- the ldap\-escaped IPA LDAP suffix
|
||||
* $LIBARCH \- set to 64 on x86_64 systems to be used for plugin paths
|
||||
* $TIME \- an integer representation of current time
|
||||
|
||||
For base64 encoded values a double colon ('::') must be used between attribute and value.
|
||||
|
||||
Base64 format examples:
|
||||
add:binaryattr::d2UgbG92ZSBiYXNlNjQ=
|
||||
replace:binaryattr::SVBBIGlzIGdyZWF0::SVBBIGlzIHJlYWxseSBncmVhdA==
|
||||
|
||||
A few rules:
|
||||
|
||||
1. Only one rule per line
|
||||
2. Each line stands alone (e.g. an only followed by an only results in the last only being used)
|
||||
3. Adding a value that exists is ok. The request is ignored, duplicate values are not added
|
||||
4. Removing a value that doesn't exist is ok. It is simply ignored.
|
||||
5. If a DN doesn't exist it is created from the 'default' entry and all updates are applied
|
||||
6. If a DN does exist the default values are skipped
|
||||
7. Only the first rule on a line is respected
|
||||
|
||||
ipa-ldap-updater allows to execute update plugins.
|
||||
Plugins to be executed are specified with following keyword, in update files:
|
||||
* plugin: name of plugin
|
||||
|
||||
This keyword is not bounded to DN, and plugin names have to be registered in API.
|
||||
|
||||
Additionally, ipa-ldap-updater can update the schema based on LDIF files.
|
||||
Any missing object classes and attribute types are added, and differing ones are updated to match the LDIF file.
|
||||
To enable this behavior, use the \-\-schema-file options.
|
||||
Schema files should be in LDIF format, and may only specify attributeTypes and objectClasses attributes of cn=schema.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-d\fR, \fB\-\-debug\fR
|
||||
Enable debug logging when more verbose output is needed
|
||||
.TP
|
||||
\fB\-u\fR, \fB\-\-upgrade\fR
|
||||
Upgrade an installed server in offline mode (implies \-\-schema)
|
||||
.TP
|
||||
\fB\-S\fR, \fB\-\-schema\-file\fR
|
||||
Specify a schema file. May be used multiple times. Implies \-\-schema.
|
||||
.SH "EXIT STATUS"
|
||||
0 if the command was successful
|
||||
|
||||
1 if an error occurred
|
||||
56
install/tools/man/ipa-managed-entries.1
Normal file
56
install/tools/man/ipa-managed-entries.1
Normal file
@@ -0,0 +1,56 @@
|
||||
.\" A man page for ipa-managed-entries
|
||||
.\" Copyright (C) 2011 Red Hat, Inc.
|
||||
.\"
|
||||
.\" This program is free software; you can redistribute it and/or modify
|
||||
.\" it under the terms of the GNU General Public License as published by
|
||||
.\" the Free Software Foundation, either version 3 of the License, or
|
||||
.\" (at your option) any later version.
|
||||
.\"
|
||||
.\" This program is distributed in the hope that it will be useful, but
|
||||
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
.\" General Public License for more details.
|
||||
.\"
|
||||
.\" You should have received a copy of the GNU General Public License
|
||||
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
.\"
|
||||
.\" Author: Jr Aquino <jr.aquino@citrix.com>
|
||||
.\"
|
||||
.TH "ipa-managed-entries" "1" "Feb 06 2012" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-managed\-entries \- Enables or disables the schema Managed Entry plugins
|
||||
.SH "SYNOPSIS"
|
||||
ipa\-managed\-entries [options] <enable|disable|status>
|
||||
.SH "DESCRIPTION"
|
||||
Run the command with the \fBenable\fR option to enable the Managed Entry plugin.
|
||||
|
||||
Run the command with the \fBdisable\fR option to disable the Managed Entry plugin.
|
||||
|
||||
Run the command with the \fBstatus\fR to determine the current status of the Managed Entry plugin.
|
||||
|
||||
In all cases the user will be prompted to provide the Directory Manager's password unless option \fB\-p\fR is used.
|
||||
|
||||
Directory Server will need to be restarted after the Managed Entry plugin has been enabled.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-h\fR, \fB\-\-help\fR
|
||||
Show a help message and exit
|
||||
.TP
|
||||
\fB\-d\fR, \fB\-\-debug\fR
|
||||
Enable debug logging when more verbose output is needed
|
||||
.TP
|
||||
\fB\-e\fR, \fB\-\-entry\fR
|
||||
DN for the Managed Entry Definition
|
||||
.TP
|
||||
\fB\-l\fR, \fB-\-list\fR
|
||||
List available Managed Entries
|
||||
.TP
|
||||
\fB\-p\fR \fIDM_PASSWORD\fR, \fB\-\-password\fR=\fIDM_PASSWORD\fR
|
||||
The Directory Manager password to use for authentication
|
||||
.SH "EXIT STATUS"
|
||||
0 if the command was successful
|
||||
|
||||
1 if an error occurred
|
||||
|
||||
2 if the plugin is already in the required status (enabled or disabled)
|
||||
51
install/tools/man/ipa-nis-manage.1
Normal file
51
install/tools/man/ipa-nis-manage.1
Normal file
@@ -0,0 +1,51 @@
|
||||
.\" A man page for ipa-nis-manage
|
||||
.\" Copyright (C) 2009 Red Hat, Inc.
|
||||
.\"
|
||||
.\" This program is free software; you can redistribute it and/or modify
|
||||
.\" it under the terms of the GNU General Public License as published by
|
||||
.\" the Free Software Foundation, either version 3 of the License, or
|
||||
.\" (at your option) any later version.
|
||||
.\"
|
||||
.\" This program is distributed in the hope that it will be useful, but
|
||||
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
.\" General Public License for more details.
|
||||
.\"
|
||||
.\" You should have received a copy of the GNU General Public License
|
||||
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
.\"
|
||||
.\" Author: Rob Crittenden <rcritten@redhat.com>
|
||||
.\"
|
||||
.TH "ipa-nis-manage" "1" "April 25 2016" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-nis\-manage \- Enables or disables the NIS listener plugin
|
||||
.SH "SYNOPSIS"
|
||||
ipa\-nis\-manage [options] <enable|disable|status>
|
||||
.SH "DESCRIPTION"
|
||||
Run the command with the \fBenable\fR option to enable the NIS plugin.
|
||||
|
||||
Run the command with the \fBdisable\fR option to disable the NIS plugin.
|
||||
|
||||
Run the command with the \fBstatus\fR option to read status of the NIS plugin. Return code 0 indicates enabled plugin, return code 4 indicates disabled plugin.
|
||||
|
||||
In all cases the user will be prompted to provide the Directory Manager's password unless option \fB\-y\fR is used.
|
||||
|
||||
Directory Server will need to be restarted after the NIS listener plugin has been enabled.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-d\fR, \fB\-\-debug\fR
|
||||
Enable debug logging when more verbose output is needed
|
||||
.TP
|
||||
\fB\-y\fR \fIfile\fR
|
||||
File containing the Directory Manager password
|
||||
.SH "EXIT STATUS"
|
||||
0 if the command was successful
|
||||
|
||||
1 if an error occurred
|
||||
|
||||
2 if the plugin is already in the required status (enabled or disabled)
|
||||
|
||||
3 if RPC services cannot be enabled.
|
||||
|
||||
4 if status command detected plugin in disabled state.
|
||||
36
install/tools/man/ipa-otptoken-import.1
Normal file
36
install/tools/man/ipa-otptoken-import.1
Normal file
@@ -0,0 +1,36 @@
|
||||
.\" A man page for ipa-otptoken-import
|
||||
.\" Copyright (C) 2014 Red Hat, Inc.
|
||||
.\"
|
||||
.\" This program is free software; you can redistribute it and/or modify
|
||||
.\" it under the terms of the GNU General Public License as published by
|
||||
.\" the Free Software Foundation, either version 3 of the License, or
|
||||
.\" (at your option) any later version.
|
||||
.\"
|
||||
.\" This program is distributed in the hope that it will be useful, but
|
||||
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
.\" General Public License for more details.
|
||||
.\"
|
||||
.\" You should have received a copy of the GNU General Public License
|
||||
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
.\"
|
||||
.\" Author: Nathaniel McCallum <npmccallum@redhat.com>
|
||||
.\"
|
||||
.TH "ipa-otptoken-import" "1" "Jun 12 2014" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-otptoken\-import \- Imports OTP tokens from RFC 6030 XML file
|
||||
.SH "SYNOPSIS"
|
||||
ipa\-otptoken\-import [options] <infile> <outfile>
|
||||
.SH "DESCRIPTION"
|
||||
Running the command will attempt to import all tokens specified in \fBinfile\fR. If the command is unable to import a token, the reason for the failure will be printed to standard error and all failed tokens will be written to the \fBoutfile\fR for further inspection.
|
||||
|
||||
If the \fBinfile\fR contains encrypted token data, then the \fIkeyfile\fR (\fB-k\fR) option MUST be specified.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-k\fR \fIkeyfile\fR
|
||||
File containing the key used to decrypt the token data.
|
||||
.SH "EXIT STATUS"
|
||||
0 if the command was successful
|
||||
|
||||
1 if an error occurred
|
||||
34
install/tools/man/ipa-pkinit-manage.1
Normal file
34
install/tools/man/ipa-pkinit-manage.1
Normal file
@@ -0,0 +1,34 @@
|
||||
.\"
|
||||
.\" Copyright (C) 2017 FreeIPA Contributors see COPYING for license
|
||||
.\"
|
||||
.TH "ipa-pkinit-manage" "1" "Jun 05 2017" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-pkinit\-manage \- Enables or disables PKINIT
|
||||
.SH "SYNOPSIS"
|
||||
ipa\-pkinit\-manage [options] <enable|disable|status>
|
||||
.SH "DESCRIPTION"
|
||||
Run the command with the \fBenable\fR option to enable PKINIT.
|
||||
|
||||
Run the command with the \fBdisable\fR option to disable PKINIT.
|
||||
|
||||
Run the command with the \fBstatus\fR to determine the current status of PKINIT.
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-\-version\fR
|
||||
Show the program's version and exit.
|
||||
.TP
|
||||
\fB\-h\fR, \fB\-\-help\fR
|
||||
Show the help for this program.
|
||||
.TP
|
||||
\fB\-v\fR, \fB\-\-verbose\fR
|
||||
Print debugging information.
|
||||
.TP
|
||||
\fB\-q\fR, \fB\-\-quiet\fR
|
||||
Output only errors.
|
||||
.TP
|
||||
\fB\-\-log\-file\fR=\fIFILE\fR
|
||||
Log to the given file.
|
||||
.SH "EXIT STATUS"
|
||||
0 if the command was successful
|
||||
|
||||
1 if an error occurred
|
||||
87
install/tools/man/ipa-replica-conncheck.1
Normal file
87
install/tools/man/ipa-replica-conncheck.1
Normal file
@@ -0,0 +1,87 @@
|
||||
.\" A man page for ipa-replica-conncheck
|
||||
.\" Copyright (C) 2011 Red Hat, Inc.
|
||||
.\"
|
||||
.\" This program is free software; you can redistribute it and/or modify
|
||||
.\" it under the terms of the GNU General Public License as published by
|
||||
.\" the Free Software Foundation, either version 3 of the License, or
|
||||
.\" (at your option) any later version.
|
||||
.\"
|
||||
.\" This program is distributed in the hope that it will be useful, but
|
||||
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
.\" General Public License for more details.
|
||||
.\"
|
||||
.\" You should have received a copy of the GNU General Public License
|
||||
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
.\"
|
||||
.\" Author: Martin Kosek <mkosek@redhat.com>
|
||||
.\"
|
||||
.TH "ipa-replica-conncheck" "1" "Jun 2 2011" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-replica\-conncheck \- Check a replica\-master network connection before installation
|
||||
.SH "SYNOPSIS"
|
||||
ipa\-replica\-conncheck [\fIOPTION\fR]...
|
||||
.SH "DESCRIPTION"
|
||||
When an IPA replica is being installed a network connection between a replica machine and a replicated IPA master machine has to be prepared for master\-replica communication. In case of a flawed connection the installation may fail with inconvenient error messages. A common connection problem is a misconfigured firewall with closed required port on a replica or master machine.
|
||||
|
||||
The connection is checked by running a set of tests from both master and replica machines. The program is incorporated to ipa\-replica\-install(1) but can be also run separately.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.SS "REPLICA MACHINE OPTIONS"
|
||||
This set of options is used when the connection check is run on a prepared IPA replica machine.
|
||||
.TP
|
||||
\fB\-m\fR \fIMASTER\fR, \fB\-\-master\fR=\fIMASTER\fR
|
||||
Remote master machine address
|
||||
.TP
|
||||
\fB\-a\fR, \fB\-\-auto\-master\-check\fR
|
||||
Automatically log in to master machine and execute the master machine part of the connection check. The following options for replica part are only evaluated when this option is set
|
||||
.TP
|
||||
\fB\-r\fR \fIREALM\fR, \fB\-\-realm\fR=\fIREALM\fR
|
||||
The Kerberos realm name for the IPA server
|
||||
.TP
|
||||
\fB\-k\fR \fIKDC\fR, \fB\-\-kdc\fR=\fIKDC\fR
|
||||
KDC server address. Defaults to \fIMASTER\fR
|
||||
.TP
|
||||
\fB\-p\fR \fIPRINCIPAL\fR, \fB\-\-principal\fR=\fIPRINCIPAL\fR
|
||||
Authorized Kerberos principal to use to log in to master machine. Defaults to \fIadmin\fR
|
||||
.TP
|
||||
\fB\-w\fR \fIPASSWORD\fR, \fB\-\-password\fR=\fIPASSWORD\fR
|
||||
Password for given principal. The password will be prompted interactively when this option is missing
|
||||
|
||||
.SS "MASTER MACHINE OPTIONS"
|
||||
This set of options is used when the connection check is run on a master machine against a running ipa\-replica\-conncheck(1) on a replica machine.
|
||||
.TP
|
||||
\fB\-R\fR \fIREPLICA\fR, \fB\-\-replica\fR=\fIREPLICA\fR
|
||||
Remote replica machine address
|
||||
|
||||
.SS "COMMON OPTIONS"
|
||||
.TP
|
||||
\fB\-c\fR, \fB\-\-check\-ca\fR
|
||||
Include in a check also a set of dogtag connection requirements. Only needed when the master was installed with Dogtag 9 or lower.
|
||||
.TP
|
||||
\fB\-h\fR \fIHOSTNAME\fR, \fB\-\-hostname\fR=\fIHOSTNAME\fR
|
||||
The hostname of this server (FQDN). By default the result of getfqdn() call from Python's socket module is used.
|
||||
.TP
|
||||
\fB\-d\fR, \fB\-\-debug\fR
|
||||
Print debugging information
|
||||
.TP
|
||||
\fB\-q\fR, \fB\-\-quiet\fR
|
||||
Output only errors
|
||||
|
||||
.SH "EXAMPLES"
|
||||
.TP
|
||||
\fBipa\-replica\-conncheck \-m master.example.com\fR
|
||||
Run a replica machine connection check against a remote master \fImaster.example.com\fR. If the connection to the remote master machine is successful the program will switch to listening mode and prompt for running the master machine part. The second part check the connection from master to replica.
|
||||
.TP
|
||||
\fBipa\-replica\-conncheck \-R replica.example.com\fR
|
||||
Run a master machine connection check part. This is either run automatically by replica part of the connection check program (when \fI-a\fR option is set) or manually by the user. A running ipa-replica-conncheck(1) in a listening mode must be already running on a replica machine.
|
||||
.TP
|
||||
\fBipa\-replica\-conncheck \-m master.example.com \-a \-r EXAMPLE.COM \-w password\fR
|
||||
Run a replica\-master connection check. In case of a success switch to listening mode, automatically log to \fImaster.example.com\fR in a realm \fIEXAMPLE.COM\fR with a password \fIpassword\fR and run the second part of the connection check.
|
||||
|
||||
.SH "EXIT STATUS"
|
||||
0 if the connection check was successful
|
||||
|
||||
1 if an error occurred
|
||||
.SH "SEE ALSO"
|
||||
.BR ipa-replica-install (1)
|
||||
283
install/tools/man/ipa-replica-install.1
Normal file
283
install/tools/man/ipa-replica-install.1
Normal file
@@ -0,0 +1,283 @@
|
||||
.\" A man page for ipa-replica-install
|
||||
.\" Copyright (C) 2008-2016 FreeIPA Contributors see COPYING for license
|
||||
.\"
|
||||
.TH "ipa-replica-install" "1" "Dec 19 2016" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-replica\-install \- Create an IPA replica
|
||||
.SH "SYNOPSIS"
|
||||
.SS "DOMAIN LEVEL 0"
|
||||
.TP
|
||||
ipa\-replica\-install [\fIOPTION\fR]... [replica_file]
|
||||
.SS "DOMAIN LEVEL 1"
|
||||
.TP
|
||||
ipa\-replica\-install [\fIOPTION\fR]...
|
||||
.SH "DESCRIPTION"
|
||||
Configures a new IPA server that is a replica of the server. Once it has been created it is an exact copy of the original IPA server and is an equal master. Changes made to any master are automatically replicated to other masters.
|
||||
|
||||
To create a replica in a domain at domain level 0, you need to provide an replica file. The replica_file is created using the ipa\-replica\-prepare utility.
|
||||
|
||||
To create a replica in a domain at domain level 1, you don't have to provide a replica file, the machine only needs to be enrolled in the FreeIPA domain first. This process of turning the IPA client into a replica is also referred to as replica promotion.
|
||||
|
||||
If you're starting with an existing IPA client, simply run ipa\-replica\-install to have it promoted into a replica.
|
||||
|
||||
To promote a blank machine into a replica, you have two options, you can either run ipa\-client\-install in a separate step, or pass the enrollment related options to the ipa\-replica\-install (see DOMAIN LEVEL 1 CLIENT ENROLLMENT OPTIONS). In the latter case, ipa\-replica\-install will join the machine to the IPA realm automatically and will proceed with the promotion step.
|
||||
|
||||
If the installation fails you may need to run ipa\-server\-install \-\-uninstall and ipa\-client\-install before running ipa\-replica\-install again.
|
||||
|
||||
The installation will fail if the host you are installing the replica on exists as a host in IPA or an existing replication agreement exists (for example, from a previously failed installation).
|
||||
|
||||
A replica should only be installed on the same or higher version of IPA on the remote system.
|
||||
.SH "OPTIONS"
|
||||
.SS "DOMAIN LEVEL 1 OPTIONS"
|
||||
.TP
|
||||
\fB\-P\fR, \fB\-\-principal\fR
|
||||
The user principal which will be used to promote the client to the replica and enroll the client itself, if necessary.
|
||||
.TP
|
||||
\fB\-w\fR, \fB\-\-admin\-password\fR
|
||||
The Kerberos password for the given principal.
|
||||
|
||||
.SS "DOMAIN LEVEL 1 CLIENT ENROLLMENT OPTIONS"
|
||||
To install client and promote it to replica using a host keytab or One Time Password, the host needs to be a member of ipaservers group. This requires to create a host entry and add it to the host group prior replica installation.
|
||||
|
||||
\-\-server, \-\-domain, \-\-realm options are autodiscovered via DNS records by default. See manual page
|
||||
.BR ipa\-client\-install (1)
|
||||
for further details about these options.
|
||||
|
||||
.TP
|
||||
\fB\-p\fR \fIPASSWORD\fR, \fB\-\-password\fR=\fIPASSWORD\fR
|
||||
One Time Password for joining a machine to the IPA realm.
|
||||
.TP
|
||||
\fB\-k\fR, \fB\-\-keytab\fR
|
||||
Path to host keytab.
|
||||
.TP
|
||||
\fB\-\-server\fR
|
||||
The fully qualified domain name of the IPA server to enroll to.
|
||||
.TP
|
||||
\fB\-n\fR, \fB\-\-domain\fR=\fIDOMAIN\fR
|
||||
The primary DNS domain of an existing IPA deployment, e.g. example.com.
|
||||
This DNS domain should contain the SRV records generated by the IPA server installer.
|
||||
.TP
|
||||
\fB\-r\fR, \fB\-\-realm\fR=\fIREALM_NAME\fR
|
||||
The Kerberos realm of an existing IPA deployment.
|
||||
.TP
|
||||
\fB\-\-hostname\fR
|
||||
The hostname of this machine (FQDN). If specified, the hostname will be set and the system configuration will be updated to persist over reboot.
|
||||
.TP
|
||||
\fB\-\-force\-join\fR
|
||||
Join the host even if it is already enrolled.
|
||||
|
||||
.SS "DOMAIN LEVEL 0 OPTIONS"
|
||||
.TP
|
||||
\fB\-p\fR \fIPASSWORD\fR, \fB\-\-password\fR=\fIPASSWORD\fR
|
||||
Directory Manager (existing master) password
|
||||
.TP
|
||||
\fB\-w\fR, \fB\-\-admin\-password\fR
|
||||
Admin user Kerberos password used for connection check
|
||||
|
||||
.SS "BASIC OPTIONS"
|
||||
.TP
|
||||
\fB\-\-ip\-address\fR=\fIIP_ADDRESS\fR
|
||||
The IP address of this server. If this address does not match the address the host resolves to and \-\-setup\-dns is not selected the installation will fail. If the server hostname is not resolvable, a record for the hostname and IP_ADDRESS is added to /etc/hosts.
|
||||
This this option can be used multiple times to specify more IP addresses of the server (e.g. multihomed and/or dualstacked server).
|
||||
.TP
|
||||
\fB\-\-mkhomedir\fR
|
||||
Create home directories for users on their first login
|
||||
.TP
|
||||
\fB\-N\fR, \fB\-\-no\-ntp\fR
|
||||
Do not configure NTP
|
||||
.TP
|
||||
\fB\-\-no\-ui\-redirect\fR
|
||||
Do not automatically redirect to the Web UI.
|
||||
.TP
|
||||
\fB\-\-ssh\-trust\-dns\fR
|
||||
Configure OpenSSH client to trust DNS SSHFP records.
|
||||
.TP
|
||||
\fB\-\-no\-ssh\fR
|
||||
Do not configure OpenSSH client.
|
||||
.TP
|
||||
\fB\-\-no\-sshd\fR
|
||||
Do not configure OpenSSH server.
|
||||
.TP
|
||||
\fB\-\-skip\-conncheck\fR
|
||||
Skip connection check to remote master
|
||||
.TP
|
||||
\fB\-d\fR, \fB\-\-debug
|
||||
Enable debug logging when more verbose output is needed
|
||||
.TP
|
||||
\fB\-U\fR, \fB\-\-unattended\fR
|
||||
An unattended installation that will never prompt for user input
|
||||
.TP
|
||||
\fB\-\-dirsrv\-config\-file\fR
|
||||
The path to LDIF file that will be used to modify configuration of dse.ldif during installation of the directory server instance
|
||||
|
||||
.SS "CERTIFICATE SYSTEM OPTIONS"
|
||||
.TP
|
||||
\fB\-\-setup\-ca\fR
|
||||
Install and configure a CA on this replica. If a CA is not configured then
|
||||
certificate operations will be forwarded to a master with a CA installed.
|
||||
.TP
|
||||
\fB\-\-no\-pkinit\fR
|
||||
Disables pkinit setup steps. This is the default and only allowed behavior on domain level 0.
|
||||
.TP
|
||||
\fB\-\-dirsrv\-cert\-file\fR=FILE
|
||||
File containing the Directory Server SSL certificate and private key
|
||||
.TP
|
||||
\fB\-\-http\-cert\-file\fR=FILE
|
||||
File containing the Apache Server SSL certificate and private key
|
||||
.TP
|
||||
\fB\-\-pkinit\-cert\-file\fR=FILE
|
||||
File containing the Kerberos KDC SSL certificate and private key
|
||||
.TP
|
||||
\fB\-\-dirsrv\-pin\fR=PIN
|
||||
The password to unlock the Directory Server private key
|
||||
.TP
|
||||
\fB\-\-http\-pin\fR=PIN
|
||||
The password to unlock the Apache Server private key
|
||||
.TP
|
||||
\fB\-\-pkinit\-pin\fR=PIN
|
||||
The password to unlock the Kerberos KDC private key
|
||||
.TP
|
||||
\fB\-\-dirsrv\-cert\-name\fR=NAME
|
||||
Name of the Directory Server SSL certificate to install
|
||||
.TP
|
||||
\fB\-\-http\-cert\-name\fR=NAME
|
||||
Name of the Apache Server SSL certificate to install
|
||||
.TP
|
||||
\fB\-\-pkinit\-cert\-name\fR=NAME
|
||||
Name of the Kerberos KDC SSL certificate to install
|
||||
.TP
|
||||
\fB\-\-skip\-schema\-check\fR
|
||||
Skip check for updated CA DS schema on the remote master
|
||||
|
||||
.SS "SECRET MANAGEMENT OPTIONS"
|
||||
.TP
|
||||
\fB\-\-setup\-kra\fR
|
||||
Install and configure a KRA on this replica. If a KRA is not configured then
|
||||
vault operations will be forwarded to a master with a KRA installed.
|
||||
|
||||
.SS "DNS OPTIONS"
|
||||
.TP
|
||||
\fB\-\-setup\-dns\fR
|
||||
Configure an integrated DNS server, create a primary DNS zone (name specified by \-\-domain or taken from an existing deployment), and fill it with service records necessary for IPA deployment.
|
||||
In cases where the IPA server name does not belong to the primary DNS domain and is not resolvable using DNS, create a DNS zone containing the IPA server name as well.
|
||||
|
||||
This option requires that you either specify at least one DNS forwarder through
|
||||
the \fB\-\-forwarder\fR option or use the \fB\-\-no\-forwarders\fR option.
|
||||
|
||||
Note that you can set up a DNS at any time after the initial IPA server install by running
|
||||
.B ipa-dns-install
|
||||
(see
|
||||
.BR ipa-dns-install (1)).
|
||||
IPA DNS cannot be uninstalled.
|
||||
.TP
|
||||
\fB\-\-forwarder\fR=\fIIP_ADDRESS\fR
|
||||
Add a DNS forwarder to the DNS configuration. You can use this option multiple
|
||||
times to specify more forwarders, but at least one must be provided, unless
|
||||
the \fB\-\-no\-forwarders\fR option is specified.
|
||||
.TP
|
||||
\fB\-\-no\-forwarders\fR
|
||||
Do not add any DNS forwarders. Root DNS servers will be used instead.
|
||||
.TP
|
||||
\fB\-\-auto\-forwarders\fR
|
||||
Add DNS forwarders configured in /etc/resolv.conf to the list of forwarders used by IPA DNS.
|
||||
.TP
|
||||
\fB\-\-forward\-policy\fR=\fIfirst|only\fR
|
||||
DNS forwarding policy for global forwarders specified using other options.
|
||||
Defaults to first if no IP address belonging to a private or reserved ranges is
|
||||
detected on local interfaces (RFC 6303). Defaults to only if a private
|
||||
IP address is detected.
|
||||
.TP
|
||||
\fB\-\-reverse\-zone\fR=\fIREVERSE_ZONE\fR
|
||||
The reverse DNS zone to use. This option can be used multiple times to specify multiple reverse zones.
|
||||
.TP
|
||||
\fB\-\-no\-reverse\fR
|
||||
Do not create new reverse DNS zone. If a reverse DNS zone already exists for the subnet, it will be used.
|
||||
.TP
|
||||
\fB\-\-auto-reverse\fR
|
||||
Create necessary reverse zones
|
||||
.TP
|
||||
\fB\-\-allow-zone-overlap\fR
|
||||
Create DNS zone even if it already exists
|
||||
.TP
|
||||
\fB\-\-no\-host\-dns\fR
|
||||
Do not use DNS for hostname lookup during installation
|
||||
.TP
|
||||
\fB\-\-no\-dns\-sshfp\fR
|
||||
Do not automatically create DNS SSHFP records.
|
||||
.TP
|
||||
\fB\-\-no\-dnssec\-validation\fR
|
||||
Disable DNSSEC validation on this server.
|
||||
|
||||
.SS "AD TRUST OPTIONS"
|
||||
.TP
|
||||
\fB\-\-setup\-adtrust\fR
|
||||
Configure AD Trust capability on a replica.
|
||||
.TP
|
||||
\fB\-\-netbios\-name\fR=\fINETBIOS_NAME\fR
|
||||
The NetBIOS name for the IPA domain. If not provided then this is determined
|
||||
based on the leading component of the DNS domain name. Running
|
||||
ipa\-adtrust\-install for a second time with a different NetBIOS name will
|
||||
change the name. Please note that changing the NetBIOS name might break
|
||||
existing trust relationships to other domains.
|
||||
.TP
|
||||
\fB\-\-add\-sids\fR
|
||||
Add SIDs to existing users and groups as on of final steps of the
|
||||
ipa\-adtrust\-install run. If there a many existing users and groups and a
|
||||
couple of replicas in the environment this operation might lead to a high
|
||||
replication traffic and a performance degradation of all IPA servers in the
|
||||
environment. To avoid this the SID generation can be run after
|
||||
ipa\-adtrust\-install is run and scheduled independently. To start this task
|
||||
you have to load an edited version of ipa-sidgen-task-run.ldif with the
|
||||
ldapmodify command info the directory server.
|
||||
.TP
|
||||
\fB\-\-add\-agents\fR
|
||||
Add IPA masters to the list that allows to serve information about
|
||||
users from trusted forests. Starting with FreeIPA 4.2, a regular IPA master
|
||||
can provide this information to SSSD clients. IPA masters aren't added
|
||||
to the list automatically as restart of the LDAP service on each of them
|
||||
is required. The host where ipa\-adtrust\-install is being run is added
|
||||
automatically.
|
||||
.IP
|
||||
Note that IPA masters where ipa\-adtrust\-install wasn't run, can serve
|
||||
information about users from trusted forests only if they are enabled
|
||||
via \ipa-adtrust\-install run on any other IPA master. At least SSSD
|
||||
version 1.13 on IPA master is required to be able to perform as a trust agent.
|
||||
.TP
|
||||
\fB\-\-rid-base\fR=\fIRID_BASE\fR
|
||||
First RID value of the local domain. The first Posix ID of the local domain will
|
||||
be assigned to this RID, the second to RID+1 etc. See the online help of the
|
||||
idrange CLI for details.
|
||||
.TP
|
||||
\fB\-\-secondary-rid-base\fR=\fISECONDARY_RID_BASE\fR
|
||||
Start value of the secondary RID range, which is only used in the case a user
|
||||
and a group share numerically the same Posix ID. See the online help of the
|
||||
idrange CLI for details.
|
||||
.TP
|
||||
\fB\-\-enable\-compat\fR
|
||||
Enables support for trusted domains users for old clients through Schema Compatibility plugin.
|
||||
SSSD supports trusted domains natively starting with version 1.9. For platforms that
|
||||
lack SSSD or run older SSSD version one needs to use this option. When enabled, slapi\-nis package
|
||||
needs to be installed and schema\-compat\-plugin will be configured to provide lookup of
|
||||
users and groups from trusted domains via SSSD on IPA server. These users and groups will be
|
||||
available under \fBcn=users,cn=compat,$SUFFIX\fR and \fBcn=groups,cn=compat,$SUFFIX\fR trees.
|
||||
SSSD will normalize names of users and groups to lower case.
|
||||
.IP
|
||||
In addition to providing these users and groups through the compat tree, this option enables
|
||||
authentication over LDAP for trusted domain users with DN under compat tree, i.e. using bind DN
|
||||
\fBuid=administrator@ad.domain,cn=users,cn=compat,$SUFFIX\fR.
|
||||
.IP
|
||||
LDAP authentication performed by the compat tree is done via PAM '\fBsystem\-auth\fR' service.
|
||||
This service exists by default on Linux systems and is provided by pam package as /etc/pam.d/system\-auth.
|
||||
If your IPA install does not have default HBAC rule 'allow_all' enabled, then make sure
|
||||
to define in IPA special service called '\fBsystem\-auth\fR' and create an HBAC
|
||||
rule to allow access to anyone to this rule on IPA masters.
|
||||
.IP
|
||||
As '\fBsystem\-auth\fR' PAM service is not used directly by any other
|
||||
application, it is safe to use it for trusted domain users via compatibility
|
||||
path.
|
||||
.SH "EXIT STATUS"
|
||||
0 if the command was successful
|
||||
|
||||
1 if an error occurred
|
||||
|
||||
3 if the host exists in the IPA server or a replication agreement to the remote master already exists
|
||||
236
install/tools/man/ipa-replica-manage.1
Normal file
236
install/tools/man/ipa-replica-manage.1
Normal file
@@ -0,0 +1,236 @@
|
||||
.\" A man page for ipa-replica-manage
|
||||
.\" Copyright (C) 2008 Red Hat, Inc.
|
||||
.\"
|
||||
.\" This program is free software; you can redistribute it and/or modify
|
||||
.\" it under the terms of the GNU General Public License as published by
|
||||
.\" the Free Software Foundation, either version 3 of the License, or
|
||||
.\" (at your option) any later version.
|
||||
.\"
|
||||
.\" This program is distributed in the hope that it will be useful, but
|
||||
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
.\" General Public License for more details.
|
||||
.\"
|
||||
.\" You should have received a copy of the GNU General Public License
|
||||
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
.\"
|
||||
.\" Author: Rob Crittenden <rcritten@redhat.com>
|
||||
.\"
|
||||
.TH "ipa-replica-manage" "1" "Jul 12 2016" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-replica\-manage \- Manage an IPA replica
|
||||
.SH "SYNOPSIS"
|
||||
ipa\-replica\-manage [\fIOPTION\fR]... [COMMAND]
|
||||
.SH "DESCRIPTION"
|
||||
Manages the replication agreements of an IPA server.
|
||||
|
||||
To manage IPA replication agreements in a domain at domain level 1, use IPA CLI
|
||||
or Web UI, see `ipa help topology` for additional information.
|
||||
|
||||
The available commands are:
|
||||
.TP
|
||||
\fBconnect\fR [SERVER_A] <SERVER_B>
|
||||
\- Adds a new replication agreement between SERVER_A/localhost and SERVER_B. At domain level 1 applicable only for winsync agreements.
|
||||
.TP
|
||||
\fBdisconnect\fR [SERVER_A] <SERVER_B>
|
||||
\- Removes a replication agreement between SERVER_A/localhost and SERVER_B. At domain level 1 applicable only for winsync agreements.
|
||||
.TP
|
||||
\fBdel\fR <SERVER>
|
||||
\- Removes all replication agreements and data about SERVER. At domain level 1 it removes data and agreements for both suffixes - domain and ca.
|
||||
.TP
|
||||
\fBlist\fR [SERVER]
|
||||
\- Lists all the servers or the list of agreements of SERVER
|
||||
.TP
|
||||
\fBre\-initialize\fR
|
||||
\- Forces a full re\-initialization of the IPA server retrieving data from the server specified with the \-\-from option
|
||||
.TP
|
||||
\fBforce\-sync\fR
|
||||
\- Immediately flush any data to be replicated from a server specified with the \-\-from option
|
||||
.TP
|
||||
\fBlist\-ruv\fR
|
||||
\- List the replication IDs on this server.
|
||||
.TP
|
||||
\fBclean\-ruv\fR [REPLICATION_ID]
|
||||
\- Run the CLEANALLRUV task to remove a replication ID.
|
||||
.TP
|
||||
\fBclean\-dangling\-ruv\fR
|
||||
\- Cleans all RUVs and CS\-RUVs that are left in the system from uninstalled replicas.
|
||||
.TP
|
||||
\fBabort\-clean\-ruv\fR [REPLICATION_ID]
|
||||
\- Abort a running CLEANALLRUV task. With \-\-force option the task does not wait for all the replica servers to have been sent the abort task, or be online, before completing.
|
||||
.TP
|
||||
\fBlist\-clean\-ruv\fR
|
||||
\- List all running CLEANALLRUV and abort CLEANALLRUV tasks.
|
||||
.TP
|
||||
\fBdnarange\-show [SERVER]\fR
|
||||
\- List the DNA ranges
|
||||
.TP
|
||||
\fBdnarange\-set SERVER START\-END\fR
|
||||
\- Set the DNA range on a master
|
||||
.TP
|
||||
\fBdnanextrange\-show [SERVER]\fR
|
||||
\- List the next DNA ranges
|
||||
.TP
|
||||
\fBdnanextrange\-set SERVER START\-END\fR
|
||||
\- Set the DNA next range on a master
|
||||
.TP
|
||||
The connect and disconnect options are used to manage the replication topology. When a replica is created it is only connected with the master that created it. The connect option may be used to connect it to other existing replicas.
|
||||
.TP
|
||||
The disconnect option cannot be used to remove the last link of a replica. To remove a replica from the topology use the del option.
|
||||
.TP
|
||||
If a replica is deleted and then re\-added within a short time\-frame then the 389\-ds instance on the master that created it should be restarted before re\-installing the replica. The master will have the old service principals cached which will cause replication to fail.
|
||||
.TP
|
||||
Each IPA master server has a unique replication ID. This ID is used by 389\-ds\-base when storing information about replication status. The output consists of the masters and their respective replication ID. See \fBclean\-ruv\fR
|
||||
.TP
|
||||
When a master is removed, all other masters need to remove its replication ID from the list of masters. Normally this occurs automatically when a master is deleted with ipa\-replica\-manage. If one or more masters was down or unreachable when ipa\-replica\-manage was executed then this replica ID may still exist. The clean\-ruv command may be used to clean up an unused replication ID.
|
||||
.TP
|
||||
\fBNOTE\fR: clean\-ruv is \fBVERY DANGEROUS\fR. Execution against the wrong replication ID can result in inconsistent data on that master. The master should be re\-initialized from another if this happens.
|
||||
.TP
|
||||
The replication topology is examined when a master is deleted and will attempt to prevent a master from being orphaned. For example, if your topology is A <\-> B <\-> C and you attempt to delete master B it will fail because that would leave masters and A and C orphaned.
|
||||
.TP
|
||||
The list of masters is stored in cn=masters,cn=ipa,cn=etc,dc=example,dc=com. This should be cleaned up automatically when a master is deleted. If it occurs that you have deleted the master and all the agreements but these entries still exist then you will not be able to re\-install IPA on it, the installation will fail with:
|
||||
.TP
|
||||
An IPA master host cannot be deleted or disabled using standard commands (host\-del, for example).
|
||||
.TP
|
||||
An orphaned master may be cleaned up using the del directive with the \-\-cleanup option. This will remove the entries from cn=masters,cn=ipa,cn=etc that otherwise prevent host\-del from working, its dna profile, s4u2proxy configuration, service principals and remove it from the default DUA profile defaultServerList.
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-H\fR \fIHOST\fR, \fB\-\-host\fR=\fIHOST\fR
|
||||
The IPA server to manage.
|
||||
The default is the machine on which the command is run
|
||||
Not honoured by the re\-initialize command.
|
||||
.TP
|
||||
\fB\-p\fR \fIDM_PASSWORD\fR, \fB\-\-password\fR=\fIDM_PASSWORD\fR
|
||||
The Directory Manager password to use for authentication
|
||||
.TP
|
||||
\fB\-v\fR, \fB\-\-verbose\fR
|
||||
Provide additional information
|
||||
.TP
|
||||
\fB\-f\fR, \fB\-\-force\fR
|
||||
Ignore some types of errors, don't prompt when deleting a master
|
||||
.TP
|
||||
\fB\-c\fR, \fB\-\-cleanup\fR
|
||||
When deleting a master with the \-\-force flag, remove leftover references to an already deleted master.
|
||||
.TP
|
||||
\fB\-\-no\-lookup\fR
|
||||
Do not perform DNS lookup checks.
|
||||
.TP
|
||||
\fB\-\-binddn\fR=\fIADMIN_DN\fR
|
||||
Bind DN to use with remote server (default is cn=Directory Manager) \- Be careful to quote this value on the command line
|
||||
.TP
|
||||
\fB\-\-bindpw\fR=\fIADMIN_PWD\fR
|
||||
Password for Bind DN to use with remote server (default is the DM_PASSWORD above)
|
||||
.TP
|
||||
\fB\-\-winsync\fR
|
||||
Specifies to create/use a Windows Sync Agreement
|
||||
.TP
|
||||
\fB\-\-cacert\fR=\fI/path/to/cacertfile\fR
|
||||
Full path and filename of CA certificate to use with TLS/SSL to the remote server \- this CA certificate will be installed in the directory server's certificate database
|
||||
.TP
|
||||
\fB\-\-win\-subtree\fR=\fIcn=Users,dc=example,dc=com\fR
|
||||
DN of Windows subtree containing the users you want to sync (default cn=Users,<domain suffix> \- this is typically what Windows AD uses as the default value) \- Be careful to quote this value on the command line
|
||||
.TP
|
||||
\fB\-\-passsync\fR=\fIPASSSYNC_PWD\fR
|
||||
Password for the IPA system user used by the Windows PassSync plugin to synchronize passwords. Required when using \-\-winsync. This does not mean you have to use the PassSync service.
|
||||
.TP
|
||||
\fB\-\-from\fR=\fISERVER\fR
|
||||
The server to pull the data from, used by the re\-initialize and force\-sync commands.
|
||||
.TP
|
||||
.SH "RANGES"
|
||||
IPA uses the 389\-ds Distributed Numeric Assignment (DNA) Plugin to allocate POSIX ids for users and groups. A range is created when IPA is installed and half the range is assigned to the first IPA master for the purposes of allocation.
|
||||
.TP
|
||||
New IPA masters do not automatically get a DNA range assignment. A range assignment is done only when a user or POSIX group is added on that master.
|
||||
.TP
|
||||
The DNA plugin also supports an "on\-deck" or next range configuration. When the primary range is exhaused, rather than going to another master to ask for more, it will use its on\-deck range if one is defined. Each master can have only one range and one on\-deck range defined.
|
||||
.TP
|
||||
When a master is removed an attempt is made to save its DNA range(s) onto another master in its on\-deck range. IPA will not attempt to extend or merge ranges. If there are no available on\-deck range slots then this is reported to the user. The range is effectively lost unless it is manually merged into the range of another master.
|
||||
.TP
|
||||
The DNA range and on\-deck (next) values can be managed using the dnarange\-set and dnanextrange\-set commands. The rules for managing these ranges are:
|
||||
\- The range must be completely contained within a local range as defined by the ipa idrange command.
|
||||
|
||||
\- The range cannot overlap the DNA range or on\-deck range on another IPA master.
|
||||
|
||||
\- The range cannot overlap the ID range of an AD Trust.
|
||||
|
||||
\- The primary DNA range cannot be removed.
|
||||
|
||||
\- An on\-deck range range can be removed by setting it to 0\-0. The assumption is that the range will be manually moved or merged elsewhere.
|
||||
.TP
|
||||
The range and next range of a specific master can be displayed by passing the FQDN of that master to the dnarange\-show or dnanextrange\-show command.
|
||||
.TP
|
||||
Performing range changes as a delegated administrator (e.g. not using the Directory Manager password) requires additional 389\-ds ACIs. These are installed in upgraded masters but not existing ones. The changs are made in cn=config which is not replicated. The result is that DNA ranges cannot be managed on non\-upgraded masters as a delegated administrator.
|
||||
.SH "EXAMPLES"
|
||||
.TP
|
||||
List all masters:
|
||||
# ipa\-replica\-manage list
|
||||
srv1.example.com: master
|
||||
srv2.example.com: master
|
||||
srv3.example.com: master
|
||||
srv4.example.com: master
|
||||
.TP
|
||||
List a server's replication agreements.
|
||||
# ipa\-replica\-manage list srv1.example.com
|
||||
srv2.example.com: replica
|
||||
srv3.example.com: replica
|
||||
.TP
|
||||
Re\-initialize a replica:
|
||||
# ipa\-replica\-manage re\-initialize \-\-from srv2.example.com
|
||||
|
||||
This will re\-initialize the data on the server where you execute the command, retrieving the data from the srv2.example.com replica
|
||||
.TP
|
||||
Add a new replication agreement:
|
||||
# ipa\-replica\-manage connect srv2.example.com srv4.example.com
|
||||
.TP
|
||||
Remove an existing replication agreement:
|
||||
# ipa\-replica\-manage disconnect srv1.example.com srv3.example.com
|
||||
.TP
|
||||
Completely remove a replica:
|
||||
# ipa\-replica\-manage del srv4.example.com
|
||||
.TP
|
||||
Using connect/disconnect you can manage the replication topology.
|
||||
.TP
|
||||
List the replication IDs in use:
|
||||
# ipa\-replica\-manage list\-ruv
|
||||
Replica Update Vectors:
|
||||
srv1.example.com:389: 7
|
||||
srv2.example.com:389: 4
|
||||
Certificate Server Replica Update Vectors:
|
||||
srv1.example.com:389: 9
|
||||
.TP
|
||||
Remove references to an orphaned and deleted master:
|
||||
# ipa\-replica\-manage del \-\-force \-\-cleanup master.example.com
|
||||
.SH "WINSYNC"
|
||||
Creating a Windows AD Synchronization agreement is similar to creating an IPA replication agreement, there are just a couple of extra steps.
|
||||
|
||||
A special user entry is created for the PassSync service. The DN of this entry is uid=passsync,cn=sysaccounts,cn=etc,<basedn>. You are not required to use PassSync to use a Windows synchronization agreement but setting a password for the user is required.
|
||||
|
||||
The following examples use the AD administrator account as the synchronization user. This is not mandatory but the user must have read\-access to the subtree.
|
||||
|
||||
.TP
|
||||
1. Transfer the base64\-encoded Windows AD CA Certificate to your IPA Server
|
||||
.TP
|
||||
2. Remove any existing kerberos credentials
|
||||
# kdestroy
|
||||
.TP
|
||||
3. Add the winsync replication agreement
|
||||
# ipa\-replica\-manage connect \-\-winsync \-\-passsync=<bindpwd_for_syncuser_that will_be_used_for_agreement> \-\-cacert=/path/to/adscacert/WIN\-CA.cer \-\-binddn "cn=administrator,cn=users,dc=ad,dc=example,dc=com" \-\-bindpw <ads_administrator_password> \-v <adserver.fqdn>
|
||||
.TP
|
||||
You will be prompted to supply the Directory Manager's password.
|
||||
.TP
|
||||
Create a winsync replication agreement:
|
||||
|
||||
# ipa\-replica\-manage connect \-\-winsync \-\-passsync=MySecret
|
||||
\-\-cacert=/root/WIN\-CA.cer \-\-binddn "cn=administrator,cn=users,dc=ad,dc=example,dc=com"
|
||||
\-\-bindpw MySecret \-v windows.ad.example.com
|
||||
|
||||
.TP
|
||||
Remove a winsync replication agreement:
|
||||
# ipa\-replica\-manage disconnect windows.ad.example.com
|
||||
.SH "PASSSYNC"
|
||||
PassSync is a Windows service that runs on AD Domain Controllers to intercept password changes. It sends these password changes to the IPA LDAP server over TLS. These password changes bypass normal IPA password policy settings and the password is not set to immediately expire. This is because by the time IPA receives the password change it has already been accepted by AD so it is too late to reject it.
|
||||
.TP
|
||||
IPA maintains a list of DNs that are exempt from password policy. A special user is added automatically when a winsync replication agreement is created. The DN of this user is added to the exemption list stored in passSyncManagersDNs in the entry cn=ipa_pwd_extop,cn=plugins,cn=config.
|
||||
.SH "EXIT STATUS"
|
||||
0 if the command was successful
|
||||
|
||||
1 if an error occurred
|
||||
80
install/tools/man/ipa-replica-prepare.1
Normal file
80
install/tools/man/ipa-replica-prepare.1
Normal file
@@ -0,0 +1,80 @@
|
||||
.\" A man page for ipa-replica-prepare
|
||||
.\" Copyright (C) 2008 Red Hat, Inc.
|
||||
.\"
|
||||
.\" This program is free software; you can redistribute it and/or modify
|
||||
.\" it under the terms of the GNU General Public License as published by
|
||||
.\" the Free Software Foundation, either version 3 of the License, or
|
||||
.\" (at your option) any later version.
|
||||
.\"
|
||||
.\" This program is distributed in the hope that it will be useful, but
|
||||
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
.\" General Public License for more details.
|
||||
.\"
|
||||
.\" You should have received a copy of the GNU General Public License
|
||||
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
.\"
|
||||
.\" Author: Rob Crittenden <rcritten@redhat.com>
|
||||
.\"
|
||||
.TH "ipa-replica-prepare" "1" "Mar 14 2008" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-replica\-prepare \- Create an IPA replica file
|
||||
.SH "SYNOPSIS"
|
||||
ipa\-replica\-prepare [\fIOPTION\fR]... hostname
|
||||
.SH "DESCRIPTION"
|
||||
Generates a replica file that may be used with ipa\-replica\-install to create a replica of an IPA server.
|
||||
|
||||
A replica can be created on any IPA master or replica server.
|
||||
|
||||
You must provide the fully\-qualified hostname of the machine you want to install the replica on and a host\-specific replica_file will be created. It is host\-specific because SSL server certificates are generated as part of the process and they are specific to a particular hostname.
|
||||
|
||||
If IPA manages the DNS for your domain, you should either use the \fB\-\-ip\-address\fR option or add the forward and reverse records manually using IPA plugins.
|
||||
|
||||
Once the file has been created it will be named replica\-hostname. This file can then be moved across the network to the target machine and a new IPA replica setup by running ipa\-replica\-install replica\-hostname.
|
||||
.SS "Limitations"
|
||||
A replica should only be installed on the same or higher version of IPA on the remote system.
|
||||
|
||||
A replica with PKI can only be installed from a replica file prepared on a master with PKI.
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-\-dirsrv\-cert\-file\fR=\fIFILE\fR
|
||||
File containing the Directory Server SSL certificate and private key. The files are accepted in PEM and DER certificate, PKCS#7 certificate chain, PKCS#8 and raw private key and PKCS#12 formats. This option may be used multiple times.
|
||||
.TP
|
||||
\fB\-\-http\-cert\-file\fR=\fIFILE\fR
|
||||
File containing the Apache Server SSL certificate and private key. The files are accepted in PEM and DER certificate, PKCS#7 certificate chain, PKCS#8 and raw private key and PKCS#12 formats. This option may be used multiple times.
|
||||
.TP
|
||||
\fB\-\-dirsrv\-pin\fR=\fIPIN\fR
|
||||
The password to unlock the Directory Server private key
|
||||
.TP
|
||||
\fB\-\-http\-pin\fR=\fIPIN\fR
|
||||
The password to unlock the Apache Server private key
|
||||
.TP
|
||||
\fB\-\-dirsrv\-cert\-name\fR=\fINAME\fR
|
||||
Name of the Directory Server SSL certificate to install
|
||||
.TP
|
||||
\fB\-\-http\-cert\-name\fR=\fINAME\fR
|
||||
Name of the Apache Server SSL certificate to install
|
||||
.TP
|
||||
\fB\-p\fR \fIDM_PASSWORD\fR, \fB\-\-password\fR=\fIDM_PASSWORD\fR
|
||||
Directory Manager (existing master) password
|
||||
.TP
|
||||
\fB\-\-ip\-address\fR=\fIIP_ADDRESS\fR
|
||||
IPv4 or IPv6 address of the replica server. This option can be specified multiple times for each interface of the server
|
||||
(e.g. multihomed and/or dualstacked server), or for each IPv4 and IPv6 address of the server. The corresponding A or AAAA and
|
||||
PTR records will be added to the DNS if they do not exist already.
|
||||
.TP
|
||||
\fB\-\-reverse\-zone\fR=\fIREVERSE_ZONE\fR
|
||||
The reverse DNS zone to use. This option can be used multiple times to specify multiple reverse zones.
|
||||
.TP
|
||||
\fB\-\-no\-reverse\fR
|
||||
Do not create reverse DNS zone
|
||||
.TP
|
||||
\fB\-\-ca\fR=\fICA_FILE\fR
|
||||
Location of CA PKCS#12 file, default /root/cacert.p12
|
||||
.TP
|
||||
\fB\-\-debug\fR
|
||||
Prints info log messages to the output
|
||||
.SH "EXIT STATUS"
|
||||
0 if the command was successful
|
||||
|
||||
1 if an error occurred
|
||||
106
install/tools/man/ipa-restore.1
Normal file
106
install/tools/man/ipa-restore.1
Normal file
@@ -0,0 +1,106 @@
|
||||
.\" A man page for ipa-restore
|
||||
.\" Copyright (C) 2013 Red Hat, Inc.
|
||||
.\"
|
||||
.\" This program is free software; you can redistribute it and/or modify
|
||||
.\" it under the terms of the GNU General Public License as published by
|
||||
.\" the Free Software Foundation, either version 3 of the License, or
|
||||
.\" (at your option) any later version.
|
||||
.\"
|
||||
.\" This program is distributed in the hope that it will be useful, but
|
||||
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
.\" General Public License for more details.
|
||||
.\"
|
||||
.\" You should have received a copy of the GNU General Public License
|
||||
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
.\"
|
||||
.\" Author: Rob Crittenden <rcritten@redhat.com>
|
||||
.\"
|
||||
.TH "ipa-restore" "1" "Mar 22 2013" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-restore \- Restore an IPA master
|
||||
.SH "SYNOPSIS"
|
||||
ipa\-restore [\fIOPTION\fR]... BACKUP
|
||||
.SH "DESCRIPTION"
|
||||
Only the name of the backup needs to be passed in, not the full path. Backups are stored in a subdirectory in /var/lib/ipa/backup. If a backup is in another location then the full path must be provided.
|
||||
.TP
|
||||
The naming convention for full backups is ipa\-full\-YEAR\-MM\-DD\-HH\-MM\-SS in the GMT time zone.
|
||||
.TP
|
||||
The naming convention for data backups is ipa\-data\-YEAR\-MM\-DD\-HH\-MM\-SS In the GMT time zone.
|
||||
.TP
|
||||
The type of backup is automatically detected. A data restore can be done from either type.
|
||||
.TP
|
||||
\fBWARNING\fR: A full restore will restore files like /etc/passwd, /etc/group, /etc/resolv.conf as well. Any file that IPA may have touched is backed up and restored.
|
||||
.TP
|
||||
An encrypted backup is also automatically detected and the root keyring is used by default. The \-\-keyring option can be used to define the full path to the private and public keys.
|
||||
.TP
|
||||
Within the subdirectory is file, header, that describes the back up including the type, system, date of backup, the version of IPA, the version of the backup and the services on the master.
|
||||
.TP
|
||||
A backup can not be restored on another host.
|
||||
.TP
|
||||
A backup can not be restored in a different version of IPA.
|
||||
.TP
|
||||
Restoring from backup sets the server as the new data master. All other masters will need to be re\-initialized. The first step in restoring a backup is to disable replication on all the other masters. This is to prevent the changelog from overwriting the data in the backup.
|
||||
.TP
|
||||
Use the ipa\-replica\-manage and ipa\-csreplica\-manage commands to re\-initialize other masters. ipa\-csreplica\-manage only needs to be executed on masters that have a CA installed.
|
||||
.SH "REPLICATION"
|
||||
The restoration on other masters needs to be done carefully, to match the replication topology, working outward from the restored master. For example, if your topology is A <\-> B <\-> C and you restored master A you would restore B first, then C.
|
||||
.TP
|
||||
Replication is disabled on all masters that are available when a restoration is done. If a master is down at the time of the restoration you will need to proceed with extreme caution. If this master is brought back up after the restoration is complete it may send out replication updates that apply the very changes you were trying to back out. The only safe answer is to reinstall the master. This would involve deleting all replication agreements to the master. This could have a cascading effect if the master is a hub to other masters. They would need to be connected to other masters before removing the downed master.
|
||||
.TP
|
||||
If the restore point is from a period prior to a replication agreement then the master will need to be re\-installed. For example, you have masters A and B and you create a backup. You then add master C from B. Then you restore from the backup. The restored data is going to lose the replication agreement to C. The master on C will have a replication agreement pointing to B, but B won't have the reverse agreement. Master C won't be registered as an IPA master. It may be possible to manually correct these and re\-connect C to B but it would be very prone to error.
|
||||
.TP
|
||||
If re\-initializing on an IPA master version prior to 3.2 then the replication agreements will need to be manually re\-enabled otherwise the re\-initialization will never complete. To manually enable an agreement use ldapsearch to find the agreement name in cn=mapping tree,cn=config. The value of nsds5ReplicaEnabled needs to be on, and enabled on both sides. Remember that CA replication is done through a separate agreement and will need to be updated separately.
|
||||
.TP
|
||||
If you have older masters you should consider re\-creating them rather than trying to re\-initialize them.
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-p\fR, \fB\-\-password\fR=\fIPASSWORD\fR
|
||||
The Directory Manager password.
|
||||
.TP
|
||||
\fB\-\-data\fR
|
||||
Restore the data only. The default is to restore everything in the backup.
|
||||
.TP
|
||||
\fB\-\-gpg\-keyring\fR=\fIGPG_KEYRING\fR
|
||||
The full path to a GPG keyring. The keyring consists of two files, a public and a private key (.sec and .pub respectively). Specify the path without an extension.
|
||||
.TP
|
||||
\fB\-\-no\-logs\fR
|
||||
Exclude the IPA service log files in the backup (if they were backed up).
|
||||
.TP
|
||||
\fB\-\-online\fR
|
||||
Perform the restore on\-line. Requires data\-only backup or the \-\-data option.
|
||||
.TP
|
||||
\fB\-\-instance\fR=\fIINSTANCE\fR
|
||||
Restore only the databases in this 389\-ds instance. The default is to restore all found (at most this is the IPA REALM instance and the PKI\-IPA instance). Requires data\-only backup or the \-\-data option.
|
||||
.TP
|
||||
\fB\-\-backend\fR=\fIBACKEND\fR
|
||||
The backend to restore within an instance or instances. Requires data\-only backup or the \-\-data option.
|
||||
.TP
|
||||
\fB\-\-v\fR, \fB\-\-verbose\fR
|
||||
Print debugging information
|
||||
.TP
|
||||
\fB\-d\fR, \fB\-\-debug\fR
|
||||
Alias for \-\-verbose
|
||||
.TP
|
||||
\fB\-q\fR, \fB\-\-quiet\fR
|
||||
Output only errors
|
||||
.TP
|
||||
\fB\-\-log\-file\fR=\fIFILE\fR
|
||||
Log to the given file
|
||||
.SH "EXIT STATUS"
|
||||
0 if the command was successful
|
||||
|
||||
1 if an error occurred
|
||||
.SH "FILES"
|
||||
.PP
|
||||
\fI/var/lib/ipa/backup\fR
|
||||
.RS 4
|
||||
The default directory for storing backup files.
|
||||
.RE
|
||||
.PP
|
||||
\fl/var/log/iparestore.log\fR
|
||||
.RS 4
|
||||
The log file for restoration
|
||||
.PP
|
||||
.SH "SEE ALSO"
|
||||
ipa\-backup(1).
|
||||
55
install/tools/man/ipa-server-certinstall.1
Normal file
55
install/tools/man/ipa-server-certinstall.1
Normal file
@@ -0,0 +1,55 @@
|
||||
.\" A man page for ipa-server-certinstall
|
||||
.\" Copyright (C) 2008 Red Hat, Inc.
|
||||
.\"
|
||||
.\" This program is free software; you can redistribute it and/or modify
|
||||
.\" it under the terms of the GNU General Public License as published by
|
||||
.\" the Free Software Foundation, either version 3 of the License, or
|
||||
.\" (at your option) any later version.
|
||||
.\"
|
||||
.\" This program is distributed in the hope that it will be useful, but
|
||||
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
.\" General Public License for more details.
|
||||
.\"
|
||||
.\" You should have received a copy of the GNU General Public License
|
||||
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
.\"
|
||||
.\" Author: Rob Crittenden <rcritten@redhat.com>
|
||||
.\"
|
||||
.TH "ipa-server-certinstall" "1" "Mar 14 2008" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-server\-certinstall \- Install new SSL server certificates
|
||||
.SH "SYNOPSIS"
|
||||
ipa\-server\-certinstall [\fIOPTION\fR]... FILE...
|
||||
.SH "DESCRIPTION"
|
||||
Replace the current Directory server SSL certificate, Apache server SSL certificate and/or Kerberos KDC certificate with the certificate in the specified files. The files are accepted in PEM and DER certificate, PKCS#7 certificate chain, PKCS#8 and raw private key and PKCS#12 formats.
|
||||
|
||||
PKCS#12 is a file format used to safely transport SSL certificates and public/private keypairs.
|
||||
|
||||
They may be generated and managed using the NSS pk12util command or the OpenSSL pkcs12 command.
|
||||
|
||||
The service(s) are not automatically restarted. In order to use the newly installed certificate(s) you will need to manually restart the Directory, Apache and/or Krb5kdc servers.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-d\fR, \fB\-\-dirsrv\fR
|
||||
Install the certificate on the Directory Server
|
||||
.TP
|
||||
\fB\-w\fR, \fB\-\-http\fR
|
||||
Install the certificate in the Apache Web Server
|
||||
.TP
|
||||
\fB\-k\fR, \fB\-\-kdc\fR
|
||||
Install the certificate in the Kerberos KDC
|
||||
.TP
|
||||
\fB\-\-pin\fR=\fIPIN\fR
|
||||
The password to unlock the private key
|
||||
.TP
|
||||
\fB\-\-cert\-name\fR=\fINAME\fR
|
||||
Name of the certificate to install
|
||||
.TP
|
||||
\fB\-\-dirman\-password\fR=\fIDIRMAN_PASSWORD\fR
|
||||
Directory Manager password
|
||||
.SH "EXIT STATUS"
|
||||
0 if the installation was successful
|
||||
|
||||
1 if an error occurred
|
||||
288
install/tools/man/ipa-server-install.1
Normal file
288
install/tools/man/ipa-server-install.1
Normal file
@@ -0,0 +1,288 @@
|
||||
.\" A man page for ipa-server-install
|
||||
.\" Copyright (C) 2008-2017 FreeIPA Contributors see COPYING for license
|
||||
.\"
|
||||
.TH "ipa-server-install" "1" "Feb 17 2017" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-server\-install \- Configure an IPA server
|
||||
.SH "SYNOPSIS"
|
||||
ipa\-server\-install [\fIOPTION\fR]...
|
||||
.SH "DESCRIPTION"
|
||||
Configures the services needed by an IPA server. This includes setting up a Kerberos Key Distribution Center (KDC) and a Kadmin daemon with an LDAP back\-end, configuring Apache, configuring NTP and optionally configuring and starting an LDAP-backed DNS server. By default a dogtag\-based CA will be configured to issue server certificates.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.SS "BASIC OPTIONS"
|
||||
.TP
|
||||
\fB\-r\fR \fIREALM_NAME\fR, \fB\-\-realm\fR=\fIREALM_NAME\fR
|
||||
The Kerberos realm name for the new IPA deployment.
|
||||
|
||||
It is strongly recommended to \fBuse an upper-cased name of the primary DNS domain name\fR of your IPA deployment. You will not be able to establish trust with Active Directory unless the realm name is the upper-cased domain name.
|
||||
|
||||
The realm name cannot be changed after the installation.
|
||||
.TP
|
||||
\fB\-n\fR \fIDOMAIN_NAME\fR, \fB\-\-domain\fR=\fIDOMAIN_NAME\fR
|
||||
The primary DNS domain of the IPA deployment, e.g. example.com. This DNS domain should contain the SRV records generated by the IPA server installer. The specified DNS domain must not contain DNS records of any other LDAP or Kerberos based management system (like Active Directory or MIT Kerberos).
|
||||
|
||||
It is strongly recommended to \fBuse a lower-cased name of the IPA Kerberos realm name.\fR
|
||||
|
||||
The primary DNS domain name cannot be changed after the installation.
|
||||
.TP
|
||||
\fB\-p\fR \fIDM_PASSWORD\fR, \fB\-\-ds\-password\fR=\fIDM_PASSWORD\fR
|
||||
The password to be used by the Directory Server for the Directory Manager user.
|
||||
.TP
|
||||
\fB\-a\fR \fIADMIN_PASSWORD\fR, \fB\-\-admin\-password\fR=\fIADMIN_PASSWORD\fR
|
||||
The password for the IPA admin user.
|
||||
.TP
|
||||
\fB\-\-mkhomedir\fR
|
||||
Create home directories for users on their first login.
|
||||
.TP
|
||||
\fB\-\-hostname\fR=\fIHOST_NAME\fR
|
||||
The fully\-qualified DNS name of this server.
|
||||
.TP
|
||||
\fB\-\-ip\-address\fR=\fIIP_ADDRESS\fR
|
||||
The IP address of this server. If this address does not match the address the host resolves to and \-\-setup\-dns is not selected, the installation will fail. If the server hostname is not resolvable, a record for the hostname and IP_ADDRESS is added to /etc/hosts.
|
||||
This option can be used multiple times to specify more IP addresses of the server (e.g. multihomed and/or dualstacked server).
|
||||
.TP
|
||||
\fB\-N\fR, \fB\-\-no\-ntp\fR
|
||||
Do not configure NTP.
|
||||
.TP
|
||||
\fB\-\-idstart\fR=\fIIDSTART\fR
|
||||
The starting user and group id number (default random).
|
||||
.TP
|
||||
\fB\-\-idmax\fR=\fIIDMAX\fR
|
||||
The maximum user and group id number (default: idstart+199999). If set to zero, the default value will be used.
|
||||
.TP
|
||||
\fB\-\-no-hbac-allow\fR
|
||||
Don't install allow_all HBAC rule. This rule lets any user from any host access any service on any other host. It is expected that users will remove this rule before moving to production.
|
||||
.TP
|
||||
\fB\-\-ignore-topology-disconnect\fR
|
||||
Ignore errors reported when IPA server uninstall would lead to disconnected topology. This option can be used only when domain level is 1 or more.
|
||||
.TP
|
||||
\fB\-\-ignore-last-of-role\fR
|
||||
Ignore errors reported when IPA server uninstall would lead to removal of last CA/DNS server or DNSSec master. This option can be used only when domain level is 1 or more.
|
||||
.TP
|
||||
\fB\-\-no\-ui\-redirect\fR
|
||||
Do not automatically redirect to the Web UI.
|
||||
.TP
|
||||
\fB\-\-ssh\-trust\-dns\fR
|
||||
Configure OpenSSH client to trust DNS SSHFP records.
|
||||
.TP
|
||||
\fB\-\-no\-ssh\fR
|
||||
Do not configure OpenSSH client.
|
||||
.TP
|
||||
\fB\-\-no\-sshd\fR
|
||||
Do not configure OpenSSH server.
|
||||
.TP
|
||||
\fB\-d\fR, \fB\-\-debug\fR
|
||||
Enable debug logging when more verbose output is needed.
|
||||
.TP
|
||||
\fB\-U\fR, \fB\-\-unattended\fR
|
||||
An unattended installation that will never prompt for user input.
|
||||
.TP
|
||||
\fB\-\-dirsrv\-config\-file\fR
|
||||
The path to LDIF file that will be used to modify configuration of dse.ldif during installation of the directory server instance.
|
||||
|
||||
.SS "CERTIFICATE SYSTEM OPTIONS"
|
||||
.TP
|
||||
\fB\-\-external\-ca\fR
|
||||
Generate a CSR for the IPA CA certificate to be signed by an external CA.
|
||||
.TP
|
||||
\fB\-\-external\-ca\-type\fR=\fITYPE\fR
|
||||
Type of the external CA. Possible values are "generic", "ms-cs". Default value is "generic". Use "ms-cs" to include the template name required by Microsoft Certificate Services (MS CS) in the generated CSR (see \fB\-\-external\-ca\-profile\fR for full details).
|
||||
|
||||
.TP
|
||||
\fB\-\-external\-ca\-profile\fR=\fIPROFILE_SPEC\fR
|
||||
Specify the certificate profile or template to use at the external CA.
|
||||
|
||||
When \fB\-\-external\-ca\-type\fR is "ms-cs" the following specifiers may be used:
|
||||
|
||||
.RS
|
||||
.TP
|
||||
\fB<oid>:<majorVersion>[:<minorVersion>]\fR
|
||||
Specify a certificate template by OID and major version, optionally also specifying minor version.
|
||||
.TP
|
||||
\fB<name>\fR
|
||||
Specify a certificate template by name. The name cannot contain any \fI:\fR characters and cannot be an OID (otherwise the OID-based template specifier syntax takes precedence).
|
||||
.TP
|
||||
\fBdefault\fR
|
||||
If no template is specified, the template name "SubCA" is used.
|
||||
.RE
|
||||
|
||||
.TP
|
||||
\fB\-\-external\-cert\-file\fR=\fIFILE\fR
|
||||
File containing the IPA CA certificate and the external CA certificate chain. The file is accepted in PEM and DER certificate and PKCS#7 certificate chain formats. This option may be used multiple times.
|
||||
.TP
|
||||
\fB\-\-no\-pkinit\fR
|
||||
Disables pkinit setup steps. This is the default and only allowed behavior on domain level 0.
|
||||
.TP
|
||||
\fB\-\-dirsrv\-cert\-file\fR=\fIFILE\fR
|
||||
File containing the Directory Server SSL certificate and private key. The files are accepted in PEM and DER certificate, PKCS#7 certificate chain, PKCS#8 and raw private key and PKCS#12 formats. This option may be used multiple times.
|
||||
.TP
|
||||
\fB\-\-http\-cert\-file\fR=\fIFILE\fR
|
||||
File containing the Apache Server SSL certificate and private key. The files are accepted in PEM and DER certificate, PKCS#7 certificate chain, PKCS#8 and raw private key and PKCS#12 formats. This option may be used multiple times.
|
||||
.TP
|
||||
\fB\-\-pkinit\-cert\-file\fR=\fIFILE\fR
|
||||
File containing the Kerberos KDC SSL certificate and private key. The files are accepted in PEM and DER certificate, PKCS#7 certificate chain, PKCS#8 and raw private key and PKCS#12 formats. This option may be used multiple times.
|
||||
.TP
|
||||
\fB\-\-dirsrv\-pin\fR=\fIPIN\fR
|
||||
The password to unlock the Directory Server private key.
|
||||
.TP
|
||||
\fB\-\-http\-pin\fR=\fIPIN\fR
|
||||
The password to unlock the Apache Server private key.
|
||||
.TP
|
||||
\fB\-\-pkinit\-pin\fR=\fIPIN\fR
|
||||
The password to unlock the Kerberos KDC private key.
|
||||
.TP
|
||||
\fB\-\-dirsrv\-cert\-name\fR=\fINAME\fR
|
||||
Name of the Directory Server SSL certificate to install.
|
||||
.TP
|
||||
\fB\-\-http\-cert\-name\fR=\fINAME\fR
|
||||
Name of the Apache Server SSL certificate to install.
|
||||
.TP
|
||||
\fB\-\-pkinit\-cert\-name\fR=\fINAME\fR
|
||||
Name of the Kerberos KDC SSL certificate to install.
|
||||
.TP
|
||||
\fB\-\-ca\-cert\-file\fR=\fIFILE\fR
|
||||
File containing the CA certificate of the CA which issued the Directory Server, Apache Server and Kerberos KDC certificates. The file is accepted in PEM and DER certificate and PKCS#7 certificate chain formats. This option may be used multiple times. Use this option if the CA certificate is not present in the certificate files.
|
||||
.TP
|
||||
\fB\-\-ca\-subject\fR=\fISUBJECT\fR
|
||||
The CA certificate subject DN (default CN=Certificate Authority,O=REALM.NAME). RDNs are in LDAP order (most specific RDN first).
|
||||
.TP
|
||||
\fB\-\-subject\-base\fR=\fISUBJECT\fR
|
||||
The subject base for certificates issued by IPA (default O=REALM.NAME). RDNs are in LDAP order (most specific RDN first).
|
||||
.TP
|
||||
\fB\-\-ca\-signing\-algorithm\fR=\fIALGORITHM\fR
|
||||
Signing algorithm of the IPA CA certificate. Possible values are SHA1withRSA, SHA256withRSA, SHA512withRSA. Default value is SHA256withRSA. Use this option with --external-ca if the external CA does not support the default signing algorithm.
|
||||
|
||||
.SS "SECRET MANAGEMENT OPTIONS"
|
||||
.TP
|
||||
\fB\-\-setup\-kra\fR
|
||||
Install and configure a KRA on this server.
|
||||
|
||||
.SS "DNS OPTIONS"
|
||||
IPA provides an integrated DNS server which can be used to simplify IPA deployment. If you decide to use it, IPA will automatically maintain SRV and other service records when you change your topology.
|
||||
|
||||
The DNS component in FreeIPA is optional and you may choose to manage all your DNS records manually on another third party DNS server. IPA DNS is not a general-purpose DNS server. If you need advanced features like DNS views, do not deploy IPA DNS.
|
||||
|
||||
.TP
|
||||
\fB\-\-setup\-dns\fR
|
||||
Configure an integrated DNS server, create DNS zone specified by \-\-domain, and fill it with service records necessary for IPA deployment.
|
||||
In cases where the IPA server name does not belong to the primary DNS domain and is not resolvable using DNS, create a DNS zone containing the IPA server name as well.
|
||||
|
||||
This option requires that you either specify at least one DNS forwarder through
|
||||
the \fB\-\-forwarder\fR option or use the \fB\-\-no\-forwarders\fR option.
|
||||
|
||||
Note that you can set up a DNS at any time after the initial IPA server install by running
|
||||
.B ipa-dns-install
|
||||
(see
|
||||
.BR ipa-dns-install (1)).
|
||||
IPA DNS cannot be uninstalled.
|
||||
|
||||
.TP
|
||||
\fB\-\-forwarder\fR=\fIIP_ADDRESS\fR
|
||||
Add a DNS forwarder to the DNS configuration. You can use this option multiple
|
||||
times to specify more forwarders, but at least one must be provided, unless
|
||||
the \fB\-\-no\-forwarders\fR option is specified.
|
||||
.TP
|
||||
\fB\-\-no\-forwarders\fR
|
||||
Do not add any DNS forwarders. Root DNS servers will be used instead.
|
||||
.TP
|
||||
\fB\-\-auto\-forwarders\fR
|
||||
Add DNS forwarders configured in /etc/resolv.conf to the list of forwarders used by IPA DNS.
|
||||
.TP
|
||||
\fB\-\-forward\-policy\fR=\fIfirst|only\fR
|
||||
DNS forwarding policy for global forwarders specified using other options.
|
||||
Defaults to first if no IP address belonging to a private or reserved ranges is
|
||||
detected on local interfaces (RFC 6303). Defaults to only if a private
|
||||
IP address is detected.
|
||||
.TP
|
||||
\fB\-\-reverse\-zone\fR=\fIREVERSE_ZONE\fR
|
||||
The reverse DNS zone to use. This option can be used multiple times to specify multiple reverse zones.
|
||||
.TP
|
||||
\fB\-\-no\-reverse\fR
|
||||
Do not create reverse DNS zone.
|
||||
.TP
|
||||
\fB\-\-auto\-reverse\fR
|
||||
Try to resolve reverse records and reverse zones for server IP addresses. If neither is resolvable, creates the reverse zones.
|
||||
.TP
|
||||
\fB\-\-zonemgr\fR
|
||||
The e\-mail address of the DNS zone manager. Defaults to hostmaster@DOMAIN
|
||||
.TP
|
||||
\fB\-\-no\-host\-dns\fR
|
||||
Do not use DNS for hostname lookup during installation.
|
||||
.TP
|
||||
\fB\-\-no\-dns\-sshfp\fR
|
||||
Do not automatically create DNS SSHFP records.
|
||||
.TP
|
||||
\fB\-\-no\-dnssec\-validation\fR
|
||||
Disable DNSSEC validation on this server.
|
||||
.TP
|
||||
\fB\-\-allow\-zone\-overlap\fR
|
||||
Allow creation of (reverse) zone even if the zone is already resolvable. Using this option is discouraged as it result in later problems with domain name resolution.
|
||||
|
||||
.SS "AD TRUST OPTIONS"
|
||||
|
||||
.TP
|
||||
\fB\-\-setup\-adtrust\fR
|
||||
Configure AD Trust capability.
|
||||
.TP
|
||||
\fB\-\-netbios\-name\fR=\fINETBIOS_NAME\fR
|
||||
The NetBIOS name for the IPA domain. If not provided, this is determined
|
||||
based on the leading component of the DNS domain name. Running
|
||||
ipa\-adtrust\-install for a second time with a different NetBIOS name will
|
||||
change the name. Please note that changing the NetBIOS name might break
|
||||
existing trust relationships to other domains.
|
||||
.TP
|
||||
\fB\-\-rid-base\fR=\fIRID_BASE\fR
|
||||
First RID value of the local domain. The first POSIX ID of the local domain will
|
||||
be assigned to this RID, the second to RID+1 etc. See the online help of the
|
||||
idrange CLI for details.
|
||||
.TP
|
||||
\fB\-\-secondary-rid-base\fR=\fISECONDARY_RID_BASE\fR
|
||||
Start value of the secondary RID range, which is only used in the case a user
|
||||
and a group share numerically the same POSIX ID. See the online help of the
|
||||
idrange CLI for details.
|
||||
.TP
|
||||
\fB\-\-enable\-compat\fR
|
||||
Enables support for trusted domains users for old clients through Schema Compatibility plugin.
|
||||
SSSD supports trusted domains natively starting with version 1.9. For platforms that
|
||||
lack SSSD or run older SSSD version one needs to use this option. When enabled, slapi\-nis package
|
||||
needs to be installed and schema\-compat\-plugin will be configured to provide lookup of
|
||||
users and groups from trusted domains via SSSD on IPA server. These users and groups will be
|
||||
available under \fBcn=users,cn=compat,$SUFFIX\fR and \fBcn=groups,cn=compat,$SUFFIX\fR trees.
|
||||
SSSD will normalize names of users and groups to lower case.
|
||||
.IP
|
||||
In addition to providing these users and groups through the compat tree, this option enables
|
||||
authentication over LDAP for trusted domain users with DN under compat tree, i.e. using bind DN
|
||||
\fBuid=administrator@ad.domain,cn=users,cn=compat,$SUFFIX\fR.
|
||||
.IP
|
||||
LDAP authentication performed by the compat tree is done via PAM '\fBsystem\-auth\fR' service.
|
||||
This service exists by default on Linux systems and is provided by pam package as /etc/pam.d/system\-auth.
|
||||
If your IPA install does not have default HBAC rule 'allow_all' enabled, then make sure
|
||||
to define in IPA special service called '\fBsystem\-auth\fR' and create an HBAC
|
||||
rule to allow access to anyone to this rule on IPA masters.
|
||||
.IP
|
||||
As '\fBsystem\-auth\fR' PAM service is not used directly by any other
|
||||
application, it is safe to use it for trusted domain users via compatibility
|
||||
path.
|
||||
|
||||
.SS "UNINSTALL OPTIONS"
|
||||
.TP
|
||||
\fB\-\-uninstall\fR
|
||||
Uninstall an existing IPA installation.
|
||||
.TP
|
||||
\fB\-U\fR, \fB\-\-unattended\fR
|
||||
An unattended uninstallation that will never prompt for user input.
|
||||
|
||||
.SH "DEPRECATED OPTIONS"
|
||||
.TP
|
||||
\fB\-P\fR \fIMASTER_PASSWORD\fR, \fB\-\-master\-password\fR=\fIMASTER_PASSWORD\fR
|
||||
The kerberos master password (normally autogenerated).
|
||||
|
||||
.SH "EXIT STATUS"
|
||||
0 if the (un)installation was successful
|
||||
|
||||
1 if an error occurred
|
||||
|
||||
.SH "SEE ALSO"
|
||||
.BR ipa-dns-install (1)
|
||||
.BR ipa-adtrust-install (1)
|
||||
46
install/tools/man/ipa-server-upgrade.1
Normal file
46
install/tools/man/ipa-server-upgrade.1
Normal file
@@ -0,0 +1,46 @@
|
||||
.\"
|
||||
.\" Copyright (C) 2015 FreeIPA Contributors see COPYING for license
|
||||
.\"
|
||||
|
||||
.TH "ipa-server-upgrade" "1" "April 02 2015" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-server\-upgrade \- upgrade IPA server
|
||||
.SH "SYNOPSIS"
|
||||
ipa\-server\-upgrade [options]
|
||||
.SH "DESCRIPTION"
|
||||
ipa\-server\-upgrade is used to upgrade IPA server when the IPA packages are being updated. It is not intended to be executed by end\-users.
|
||||
|
||||
ipa\-server\-upgrade will:
|
||||
|
||||
* update LDAP schema
|
||||
* process all files with the extension .update in /usr/share/ipa/updates (including update plugins).
|
||||
* upgrade local configurations of IPA services
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-\-skip\-version\-check\fR
|
||||
Skip version check. WARNING: this option may break your system
|
||||
.TP
|
||||
\fB\-\-force\fR
|
||||
Force upgrade (alias for --skip-version-check)
|
||||
.TP
|
||||
\fB\-\-version\fR
|
||||
Show IPA version
|
||||
.TP
|
||||
\fB\-h\fR, \fB\-\-help\fR
|
||||
Show help message and exit
|
||||
.TP
|
||||
\fB\-v\fR, \fB\-\-verbose\fR
|
||||
Print debugging information
|
||||
.TP
|
||||
\fB\-q\fR, \fB\-\-quiet\fR
|
||||
Output only errors
|
||||
.TP
|
||||
\fB-\-log-file=FILE\fR
|
||||
Log to given file
|
||||
.TP
|
||||
|
||||
.SH "EXIT STATUS"
|
||||
0 if the command was successful
|
||||
|
||||
1 if an error occurred
|
||||
52
install/tools/man/ipa-winsync-migrate.1
Normal file
52
install/tools/man/ipa-winsync-migrate.1
Normal file
@@ -0,0 +1,52 @@
|
||||
.\" A man page for ipa-advise
|
||||
.\" Copyright (C) 2013 Red Hat, Inc.
|
||||
.\"
|
||||
.\" This program is free software; you can redistribute it and/or modify
|
||||
.\" it under the terms of the GNU General Public License as published by
|
||||
.\" the Free Software Foundation, either version 3 of the License, or
|
||||
.\" (at your option) any later version.
|
||||
.\"
|
||||
.\" This program is distributed in the hope that it will be useful, but
|
||||
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
.\" General Public License for more details.
|
||||
.\"
|
||||
.\" You should have received a copy of the GNU General Public License
|
||||
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
.\"
|
||||
.\" Author: Tomas Babej <tbabej@redhat.com>
|
||||
.\"
|
||||
.TH "ipa-winsync-migrate" "1" "Mar 10 2015" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipa\-winsync\-migrate \- Seamless migration of AD users created by winsync to native AD users.
|
||||
.SH "SYNOPSIS"
|
||||
ipa\-winsync\-migrate
|
||||
.SH "DESCRIPTION"
|
||||
Migrates AD users created by winsync agreement to ID overrides in
|
||||
the Default Trust View, thus preserving the actual POSIX attributes
|
||||
already established.
|
||||
|
||||
Prior to the actual migration, the winsync replication agreement
|
||||
will be removed to protect the removal of the user accounts
|
||||
on the Active Directory side.
|
||||
|
||||
During the migration, group, assigned roles, HBAC rules and SELinux
|
||||
memberships of the synced users will be preserved. Any local copies
|
||||
(created by winsync) of the migrated users will be removed.
|
||||
|
||||
.SH "WARNINGS"
|
||||
After the migration, any PassSync agreements need to be removed
|
||||
from Active Directory Domain Controllers, otherwise they might
|
||||
attempt to update passwords for accounts that no longer exist
|
||||
on the IPA server.
|
||||
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-\-realm\fR
|
||||
The Active Directory realm the winsynced users belong to.
|
||||
.TP
|
||||
\fB\-\-server\fR
|
||||
The hostname of Active Directory Domain Controller the winsync replication agreement is established with.
|
||||
.TP
|
||||
\fB\-\-unattended\fR
|
||||
Never prompts for user input.
|
||||
54
install/tools/man/ipactl.8
Normal file
54
install/tools/man/ipactl.8
Normal file
@@ -0,0 +1,54 @@
|
||||
.\" A man page for ipactl
|
||||
.\" Copyright (C) 2008 Red Hat, Inc.
|
||||
.\"
|
||||
.\" This program is free software; you can redistribute it and/or modify
|
||||
.\" it under the terms of the GNU General Public License as published by
|
||||
.\" the Free Software Foundation, either version 3 of the License, or
|
||||
.\" (at your option) any later version.
|
||||
.\"
|
||||
.\" This program is distributed in the hope that it will be useful, but
|
||||
.\" WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
.\" General Public License for more details.
|
||||
.\"
|
||||
.\" You should have received a copy of the GNU General Public License
|
||||
.\" along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
.\"
|
||||
.\" Author: Rob Crittenden <rcritten@redhat.com>
|
||||
.\"
|
||||
.TH "ipactl" "8" "Mar 14 2008" "FreeIPA" "FreeIPA Manual Pages"
|
||||
.SH "NAME"
|
||||
ipactl \- IPA Server Control Interface
|
||||
.SH "SYNOPSIS"
|
||||
ipactl \fIcommand\fR
|
||||
.SH "DESCRIPTION"
|
||||
A tool to help an administer control an IPA environment.
|
||||
|
||||
IPA glues several discrete services together to work in concert and the order that these services are started and stopped is important. ipactl ensures that they are started and stopped in the correct order.
|
||||
|
||||
IPA stores the available masters and the services configured on each one. The first thing ipactl does is start (if it is not already running) the IPA 389\-ds instance to query what services it controls. The hostname used in the query needs to match the hostname of the value stored in LDAP. This can be controlled with the host option in \fI/etc/ipa/default.conf\fR. This should be a fully\-qualified hostname.
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
start
|
||||
Start all of the services that make up IPA
|
||||
.TP
|
||||
stop
|
||||
Stop all of the services that make up IPA
|
||||
.TP
|
||||
restart
|
||||
Stop then start all of the services that make up IPA
|
||||
.TP
|
||||
status
|
||||
Provides status of all the services that make up IPA
|
||||
.TP
|
||||
\fB\-d\fR, \fB\-\-debug\fR
|
||||
Display debugging information
|
||||
.TP
|
||||
\fB\-\-skip\-version\-check\fR
|
||||
Skip version check
|
||||
.TP
|
||||
\fB\-\-ignore\-service\-failures\fR
|
||||
If any service start fails, do not rollback the services, continue with the operation
|
||||
.TP
|
||||
\fB\-f\fR, \fB\-\-force\fR
|
||||
Force IPA to start. Combine options --skip-version-check and --ignore-service-failures
|
||||
Reference in New Issue
Block a user