freeipa/install/tools/ipa-ca-install

#! /usr/bin/python2 -E
# Authors: Rob Crittenden <rcritten@redhat.com>
#
# Copyright (C) 2011  Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
#

import sys
import os
import shutil
from ipapython import ipautil

from ipaserver.install import installutils
from ipaserver.install import certs
from ipaserver.install.installutils import (private_ccache,
    create_replica_config)
from ipaserver.install import dsinstance, ca
from ipapython import version
from ipalib import api
from ipapython.dn import DN
from ipapython.config import IPAOptionParser
from ipapython.ipa_log_manager import *
from ipaplatform.paths import paths

log_file_name = paths.IPAREPLICA_CA_INSTALL_LOG
REPLICA_INFO_TOP_DIR = None

def parse_options():
    usage = "%prog [options] REPLICA_FILE"
    parser = IPAOptionParser(usage=usage, version=version.VERSION)
    parser.add_option("-d", "--debug", dest="debug", action="store_true",
                      default=False, help="gather extra debugging information")
    parser.add_option("-p", "--password", dest="password", sensitive=True,
                      help="Directory Manager (existing master) password")
    parser.add_option("-w", "--admin-password", dest="admin_password", sensitive=True,
                      help="Admin user Kerberos password used for connection check")
    parser.add_option("--no-host-dns", dest="no_host_dns", action="store_true",
                      default=False,
                      help="Do not use DNS for hostname lookup during installation")
    parser.add_option("--skip-conncheck", dest="skip_conncheck", action="store_true",
                      default=False, help="skip connection check to remote master")
    parser.add_option("--skip-schema-check", dest="skip_schema_check", action="store_true",
                      default=False, help="skip check for updated CA DS schema on the remote master")
    parser.add_option("-U", "--unattended", dest="unattended", action="store_true",
                      default=False, help="unattended installation never prompts the user")
    parser.add_option("--external-ca", dest="external_ca", action="store_true",
                      default=False, help="Generate a CSR to be signed by an external CA")
    parser.add_option("--external-ca-type", dest="external_ca_type",
                      type="choice", choices=("generic", "ms-cs"),
                      help="Type of the external CA")
    parser.add_option("--external-cert-file", dest="external_cert_files",
                      action="append", metavar="FILE",
                      help="File containing the IPA CA certificate and the external CA certificate chain")
    parser.add_option("--ca-signing-algorithm", dest="ca_signing_algorithm",
                      type="choice",
                      choices=('SHA1withRSA', 'SHA256withRSA', 'SHA512withRSA'),
                      help="Signing algorithm of the IPA CA certificate")

    options, args = parser.parse_args()
    safe_options = parser.get_safe_opts(options)

    if args:
        filename = args[0]

        if len(args) != 1:
            parser.error("you must provide a file generated by "
                         "ipa-replica-prepare")

        options.external_ca = None
        options.external_cert_files = None
    else:
        filename = None

        if options.external_ca:
            if options.external_cert_files:
                parser.error("You cannot specify --external-cert-file "
                             "together with --external-ca")

        if options.external_ca_type and not options.external_ca:
            parser.error(
                "You cannot specify --external-ca-type without --external-ca")

    return safe_options, options, filename


def get_dirman_password():
    return installutils.read_password(
        "Directory Manager (existing master)", confirm=False, validate=False)


def install_replica(safe_options, options, filename):
    standard_logging_setup(log_file_name, debug=options.debug)

    root_logger.debug('%s was invoked with argument "%s" and options: %s',
        sys.argv[0], filename, safe_options)
    root_logger.debug('IPA version %s', version.VENDOR_VERSION)

    if not ipautil.file_exists(filename):
        sys.exit("Replica file %s does not exist" % filename)

    if not dsinstance.DsInstance().is_configured():
        sys.exit("IPA server is not configured on this system.\n")

    api.bootstrap(in_server=True)
    api.finalize()

    # get the directory manager password
    dirman_password = options.password
    if not dirman_password:
        if options.unattended:
            sys.exit('Directory Manager password required')
        try:
            dirman_password = get_dirman_password()
        except KeyboardInterrupt:
            sys.exit(0)
        if dirman_password is None:
            sys.exit("Directory Manager password required")

    if not options.admin_password and not options.skip_conncheck and \
            options.unattended:
        sys.exit('admin password required')

    config = create_replica_config(dirman_password, filename, options)
    global REPLICA_INFO_TOP_DIR
    REPLICA_INFO_TOP_DIR = config.top_dir
    config.setup_ca = True

    api.Backend.ldap2.connect(bind_dn=DN(('cn', 'Directory Manager')),
                              bind_pw=dirman_password)

    options.realm_name = config.realm_name
    options.domain_name = config.domain_name
    options.dm_password = config.dirman_password
    options.host_name = config.host_name
    options.subject = config.subject_base

    ca.install_check(True, config, options)
    ca.install(True, config, options)


def install_master(safe_options, options):
    standard_logging_setup(paths.IPASERVER_CA_INSTALL_LOG, debug=options.debug)

    root_logger.debug(
        "%s was invoked with options: %s", sys.argv[0], safe_options)
    root_logger.debug("IPA version %s", version.VENDOR_VERSION)

    if not dsinstance.DsInstance().is_configured():
        sys.exit("IPA server is not configured on this system.\n")

    api.bootstrap(in_server=True)
    api.finalize()

    dm_password = options.password
    if not dm_password:
        if options.unattended:
            sys.exit('Directory Manager password required')
        try:
            dm_password = get_dirman_password()
        except KeyboardInterrupt:
            sys.exit(0)
        if dm_password is None:
            sys.exit("Directory Manager password required")

    api.Backend.ldap2.connect(bind_dn=DN(('cn', 'Directory Manager')),
                              bind_pw=dm_password)

    config = api.Command['config_show']()['result']
    subject_base = config['ipacertificatesubjectbase'][0]

    options.realm_name = api.env.realm
    options.domain_name = api.env.domain
    options.dm_password = dm_password
    options.host_name = api.env.host
    options.subject = subject_base

    ca.install_check(True, None, options)
    ca.install(True, None, options)


def main():
    safe_options, options, filename = parse_options()

    if os.geteuid() != 0:
        sys.exit("\nYou must be root to run this script.\n")

    if filename is not None:
        install_replica(safe_options, options, filename)
    else:
        install_master(safe_options, options)

fail_message = '''
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.
'''

if __name__ == '__main__':
    try:
        with private_ccache():
            installutils.run_script(main, log_file_name=log_file_name,
                                    operation_name='ipa-ca-install',
                                    fail_message=fail_message)
    finally:
        # always try to remove decrypted replica file
        try:
            if REPLICA_INFO_TOP_DIR:
                shutil.rmtree(REPLICA_INFO_TOP_DIR)
        except OSError:
            pass