IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-23 07:33:27 -06:00
Code Issues Packages Projects Releases Wiki Activity
0708f603e2
freeipa/install/Makefile.am

41 lines
1.3 KiB
Makefile
Raw Normal View History

Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
# This file will be processed with automake-1.7 to create Makefile.in
#
AUTOMAKE_OPTIONS = 1.7
NULL =
SUBDIRS = \
Use certmonger to renew CA subsystem certificates Certificate renewal can be done only one one CA as the certificates need to be shared amongst them. certmonger has been trained to communicate directly with dogtag to perform the renewals. The initial CA installation is the defacto certificate renewal master. A copy of the certificate is stored in the IPA LDAP tree in cn=ca_renewal,cn=ipa,cn=etc,$SUFFIX, the rdn being the nickname of the certificate, when a certificate is renewed. Only the most current certificate is stored. It is valid to have no certificates there, it means that no renewals have taken place. The clones are configured with a new certmonger CA type that polls this location in the IPA tree looking for an updated certificate. If one is not found then certmonger is put into the CA_WORKING state and will poll every 8 hours until an updated certificate is available. The RA agent certificate, ipaCert in /etc/httpd/alias, is a special case. When this certificate is updated we also need to update its entry in the dogtag tree, adding the updated certificate and telling dogtag which certificate to use. This is the certificate that lets IPA issue certificates. On upgrades we check to see if the certificate tracking is already in place. If not then we need to determine if this is the master that will do the renewals or not. This decision is made based on whether it was the first master installed. It is concievable that this master is no longer available meaning that none are actually tracking renewal. We will need to document this. https://fedorahosted.org/freeipa/ticket/2803
2012-07-11 14:51:01 -05:00
certmonger \
Move Custodia secrets handler to scripts Implement the import and export handlers for Custodia keys as external scripts. It's a prerequisite to drop DAC override permission and proper SELinux rules for ipa-custodia. Except for DMLDAP, handlers no longer run as root but as handler specific users with reduced privileges. The Dogtag-related handlers run as pkiuser, which also help with HSM support. The export and import handles are designed to be executed by sudo, too. In the future, ipa-custodia could be executed as an unprivileged process that runs the minimal helper scripts with higher privileges. Fixes: https://pagure.io/freeipa/issue/6888 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2019-01-30 07:08:38 -06:00
custodia \
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
html \
Add DS migration plugin and password migration page.
2010-01-12 09:40:09 -06:00
migration \
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
share \
rename static to ui Directory rename
2011-01-19 11:26:14 -06:00
ui \
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
tools \
updates \
Configure certmonger to execute restart scripts on renewal. certmonger now has the ability to execute a script when it renews a certificate. This can be used to automatically restart servers so the certificate doesn't expire in the running server. https://fedorahosted.org/freeipa/ticket/2050
2012-04-10 14:21:08 -05:00
restart_scripts \
Generate plugin index dynamically https://fedorahosted.org/freeipa/ticket/3235
2013-04-23 12:54:21 -05:00
wsgi \
trusts: add support for one-way trust and switch to it by default One-way trust is the default now, use 'trust add --two-way ' to force bidirectional trust https://fedorahosted.org/freeipa/ticket/4959 In case of one-way trust we cannot authenticate using cross-realm TGT against an AD DC. We have to use trusted domain object from within AD domain and access to this object is limited to avoid compromising the whole trust configuration. Instead, IPA framework can call out to oddjob daemon and ask it to run the script which can have access to the TDO object. This script (com.redhat.idm.trust-fetch-domains) is using cifs/ipa.master principal to retrieve TDO object credentials from IPA LDAP if needed and then authenticate against AD DCs using the TDO object credentials. The script pulls the trust topology out of AD DCs and updates IPA LDAP store. Then IPA framework can pick the updated data from the IPA LDAP under normal access conditions. Part of https://fedorahosted.org/freeipa/ticket/4546 Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-06-05 07:57:02 -05:00
oddjob \
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
$(NULL)
install-exec-local:
Build: move server directory handling from SPEC to Makefile.am This is next step towards fully functional make install. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-10 05:45:26 -06:00
$(INSTALL) -d -m 700 $(DESTDIR)$(IPA_SYSCONF_DIR)/custodia
$(INSTALL) -d -m 700 $(DESTDIR)$(localstatedir)/lib/ipa/backup
Configure HTTPD to work via Gss-Proxy https://fedorahosted.org/freeipa/ticket/4189 https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-11-29 10:10:22 -06:00
$(INSTALL) -d -m 700 $(DESTDIR)$(localstatedir)/lib/ipa/gssproxy
Build: move server directory handling from SPEC to Makefile.am This is next step towards fully functional make install. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-10 05:45:26 -06:00
$(INSTALL) -d -m 700 $(DESTDIR)$(localstatedir)/lib/ipa/sysrestore
$(INSTALL) -d -m 700 $(DESTDIR)$(localstatedir)/lib/ipa/sysupgrade
$(INSTALL) -d -m 755 $(DESTDIR)$(localstatedir)/lib/ipa/pki-ca
Move HTTPD cert/key pair to /var/lib/ipa/certs This moves the HTTPD certificates from their default location to IPA-specific one. This should be especially helpful from the container perspective. Related: https://pagure.io/freeipa/issue/3757 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2018-02-09 02:39:02 -06:00
$(INSTALL) -d -m 755 $(DESTDIR)$(localstatedir)/lib/ipa/certs
Encrypt httpd key stored on disk This commit adds configuration for HTTPD to encrypt/decrypt its key which we currently store in clear on the disc. A password-reading script is added for mod_ssl. This script is extensible for the future use of directory server with the expectation that key encryption/decription will be handled similarly by its configuration. https://pagure.io/freeipa/issue/7421 Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2018-02-26 03:15:05 -06:00
$(INSTALL) -d -m 700 $(DESTDIR)$(localstatedir)/lib/ipa/private
$(INSTALL) -d -m 700 $(DESTDIR)$(localstatedir)/lib/ipa/passwds
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
uninstall-local:
-rmdir $(DESTDIR)$(localstatedir)/lib/ipa/sysrestore
Add sysupgrade state file When IPA package is being updated, some of the configuration files are also updated. Sometimes it may be useful to store upgrade meta information for next package upgrades. For example an information that some config file was already updated and we don't want to update it again if user purposedly reverted the change. This patch adds a new StateFile in /var/lib/ipa/sysupgrade which is capable of holding this information. New sysupgrade.py module was created to provide simple API to access the upgrade state information.
2012-06-08 01:31:37 -05:00
-rmdir $(DESTDIR)$(localstatedir)/lib/ipa/sysupgrade
Move HTTPD cert/key pair to /var/lib/ipa/certs This moves the HTTPD certificates from their default location to IPA-specific one. This should be especially helpful from the container perspective. Related: https://pagure.io/freeipa/issue/3757 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2018-02-09 02:39:02 -06:00
-rmdir $(DESTDIR)$(localstatedir)/lib/ipa/certs
Encrypt httpd key stored on disk This commit adds configuration for HTTPD to encrypt/decrypt its key which we currently store in clear on the disc. A password-reading script is added for mod_ssl. This script is extensible for the future use of directory server with the expectation that key encryption/decription will be handled similarly by its configuration. https://pagure.io/freeipa/issue/7421 Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2018-02-26 03:15:05 -06:00
-rmdir $(DESTDIR)$(localstatedir)/lib/ipa/private
-rmdir $(DESTDIR)$(localstatedir)/lib/ipa/passwds
Get merged tree into an installalble state. I have only tested the all, rpms and *clean targets directly. install may work but the rpm moves a lot of things around for us. The Apache configuration file isn't in its final state but it works with the new mod_python configuration.
2009-02-02 12:50:53 -06:00
-rmdir $(DESTDIR)$(localstatedir)/lib/ipa
Build: fix distribution of install/REDME.schema file https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-02 11:11:10 -05:00
EXTRA_DIST = README.schema
Reference in New Issue Copy Permalink