freeipa/ipa-server/ipa-install/ipa-server-install

#! /usr/bin/python -E
# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
#
# Copyright (C) 2007  Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License as
# published by the Free Software Foundation; version 2 only
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#


# requires the following packages:
# fedora-ds-base
# openldap-clients
# nss-tools

VERSION = "%prog .1"

import sys
sys.path.append("/usr/share/ipa")

import socket
import logging
import pwd
from optparse import OptionParser
import ipaserver.dsinstance
import ipaserver.krbinstance
from ipaserver.util import run

def parse_options():
    parser = OptionParser(version=VERSION)
    parser.add_option("-u", "--user", dest="ds_user",
                      help="ds user")
    parser.add_option("-r", "--realm", dest="realm_name",
                      help="realm name")
    parser.add_option("-p", "--ds-password", dest="dm_password",
                      help="admin password")
    parser.add_option("-P", "--master-password", dest="master_password",
                      help="kerberos master password")
    parser.add_option("-a", "--admin-password", dest="admin_password",
                      help="admin user kerberos password")
    parser.add_option("-d", "--debug", dest="debug", action="store_true",
                     dest="debug", default=False, help="print debugging information")
    parser.add_option("--hostname", dest="host_name", help="fully qualified name of server")
    parser.add_option("-U", "--unattended", dest="unattended",
                     help="unattended installation never prompts the user")

    options, args = parser.parse_args()

    if options.unattended and (not options.ds_user or
                               not options.realm_name or
                               not options.dm_password or
                               not options.admin_password or
                               not options.master_password):
        parser.error("error: In unattended mode you need to provide -u, -r, -p and -P options")

    return options

def logging_setup(options):
    # Always log everything (i.e., DEBUG) to the log
    # file.
    logging.basicConfig(level=logging.DEBUG,
                        format='%(asctime)s %(levelname)s %(message)s',
                        filename='ipaserver-install.log',
                        filemode='w')

    console = logging.StreamHandler()
    # If the debug option is set, also log debug messages to the console
    if options.debug:
        console.setLevel(logging.DEBUG)
    else:
        # Otherwise, log critical and error messages
        console.setLevel(logging.ERROR)
    formatter = logging.Formatter('%(name)-12s: %(levelname)-8s %(message)s')
    console.setFormatter(formatter)
    logging.getLogger('').addHandler(console)

def setup_hosts(host, ip):
    print ""
    print "TODO"
    print ""
    print ""

def main():
    options = parse_options()
    logging_setup(options)

    ds_user = ""
    realm_name = ""
    host_name = ""
    master_password = ""
    dm_password = ""
    admin_password = ""

    # check the hostname is correctly configured, it must be as the kldap
    # utilities just use the hostname as returned by gethostbyname to set
    # up some of the standard entries

    if options.host_name:
        host_name = options.host_name
    else:
        host_name = socket.gethostname()
    if len(host_name.split(".")) < 2:
        print "Invalid hostname <"+host_name+">"
        print "Check the /etc/hosts file and make sure to have a valid FQDN"
        return "-Fatal Error-"

    ip = socket.gethostbyname(host_name)
    if ip == "127.0.0.1":
        print "The hostname resolves to the localhost address (127.0.0.1)"
        print "Please change your /etc/hosts file or your DNS so that the"
        print "hostname resolves to the ip address of your network interface."
        print "The KDC service does not listen on 127.0.0.1"
        print ""
        if not options.unattended:
            change_hosts = raw_input("Do you want to change the /etc/hosts file ? [y/N] ")
            print ""
            if change_hosts.lower() == "y":
                ip = raw_input("What is the netowrk IP address used by this server ? ")
                print ""
                if (ip.find(".") == -1):
                    print "["+ip+"] is an invalid IP address"
                    return "-Fatal Error-"
                setup_hosts(host_name, ip)
            else:
                print "Please fix your /etc/hosts file and restart the setup program"
                print "-Aborted-"
        else:
            return "-Fatal Error-"
     
    print "The Final KDC Host Name will be: " + host_name + ". With IP address: " + ip
    print ""

    if not options.ds_user:

        try:
            pwd.getpwnam('dirsrv')

            print "To securely run Directory Server we need a user account to be set up."
            print "This will allow DS to run as a user and not as root."
            print "The user account will have access to some security material so it should not be shared with any other application."
            print "A user account named 'dirsrv' already exist. You should not share the account with any other service."
            print ""
            yesno = raw_input("Do you want to use the existing 'dirsrv' account ? (y/N)")
            print ""
            if yesno.lower() == "y":
                ds_user = "dirsrv"
            else:
                ds_user = raw_input("Which account name do you want to use for the DS instance ? ")
                print ""
        except KeyError:
            ds_user = "dirsrv"

        if ds_user == "":
             return "-Aborted-"
    else:
        ds_user = options.ds_user

    if not options.realm_name:
        print "The kerberos protocol requires a Realm name to be defined."
        print "Usually the domain name all in uppercase is used as realm name."
        print ""
        upper_dom = (host_name[host_name.find(".")+1:]).upper()
        dom_realm = raw_input("Do you want to use ["+upper_dom+"] as the realm name ? [y/N] ")
        print ""
        if dom_realm.lower() == "y":
            realm_name = upper_dom
        else:
            realm_name = raw_input("Please provide a realm name: ")
            print ""
            if realm_name == "":
                return "-Aborted-"
            upper_dom = realm_name.upper()
            if upper_dom != realm_name:
                print "It is strongly adviced to use a completely uppercased name for the realm."
                dom_realm = raw_input("Do you want to use "+upper_dom+" as realm name ? [Y/n] ")
                print ""
                if dom_realm.lower() != "y":
                    print "WARNING: Using a non upper-cased realm name may cause unexpected problems."
                else:
                    realm_name = upper_dom
        if realm_name == "":
             print "-Aborted-"
    else:
        realm_name = options.realm_name

    if not options.dm_password:
        print "The Directory Manager user is the equivalent of 'root' for Diretcory Server."
        print "This account has full access to the Directory and is used for system management tasks."
        print ""
        #TODO: provide the option of generating a random password
        dm_password = raw_input("Please provide a password for the Directory Manager: ")
        print ""
    else:
        dm_password = options.dm_password

    if not options.master_password:
        print "The Kerberos database is usually encrypted using a master password."
        print "Please store this password offline in a secure place."
        print "It may be necessary in a recovery situation or to install a replica."
        print "Without the master password the encrypted material can't be used by the KDC."
        print "If the master password gets lost all kerberos related secrets will be lost."
        print ""
        #TODO: provide the option of generating a random password
        master_password = raw_input("Please provide a master password: ")
        print ""
    else:
        master_password = options.master_password

    if not options.admin_password:
        print "The 'admin' user is the administrative user used to administare an IPA server."
        print "This account is the one that will be used for normal administration and is also a regular unix user"
        print ""
        #TODO: provide the option of generating a random password
        admin_password = raw_input("Please provide a kerberos password for the 'admin' user: ")
        print ""
    else:
        admin_password = options.admin_password

    # Create a directory server instance
    ds = ipaserver.dsinstance.DsInstance()
    ds.create_instance(ds_user, realm_name, host_name, dm_password)

    # Create a kerberos instance
    krb = ipaserver.krbinstance.KrbInstance()
    krb.create_instance(ds_user, realm_name, host_name, dm_password, master_password)

    # Restart ds after the krb instance has changed ds configurations
    ds.restart()

    # Restart apache
    run(["/sbin/service", "httpd", "restart"])

    # Set apache to start on boot
    run(["/sbin/chkconfig", "httpd", "on"])

    # Set fedora-ds to start on boot
    run(["/sbin/chkconfig", "dirsrv", "on"])

    # Set the KDC to start on boot
    run(["/sbin/chkconfig", "krb5kdc", "on"])

    # Set the Kpasswd to start on boot
    run(["/sbin/chkconfig", "ipa-kpasswd", "on"])

    # Start Kpasswd
    run(["/sbin/service", "ipa-kpasswd", "start"])

    # Set the admin user kerberos password
    ds.change_admin_password(admin_password)

    # Create the config file
    fd = open("/etc/ipa/ipa.conf", "w")
    fd.write("[defaults]\n")
    fd.write("server=" + host_name + "\n")
    fd.write("realm=" + realm_name + "\n")
    fd.close()

    return 0

main()