IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-23 15:40:01 -06:00
Code Issues Packages Projects Releases Wiki Activity
7233944e74
freeipa/install/updates/90-post_upgrade_plugins.update

46 lines
1.3 KiB
Plaintext
Raw Normal View History

Server Upgrade: specify order of plugins in update files * add 'plugin' directive * specify plugins order in update files * remove 'run plugins' options * use ldapupdater API instance in plugins * add update files representing former PreUpdate and PostUpdate order of plugins https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-03-18 09:46:00 -05:00
# first
# middle
topology: manage ca replication agreements Configure IPA so that topology plugin will manage also CA replication agreements. upgrades if CA is congigured: - ipaca suffix is added to cn=topology,cn=ipa,cn=etc,$SUFFIX - ipaReplTopoManagedSuffix: o=ipaca is added to master entry - binddngroup is added to o=ipaca replica entry Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-07-15 04:17:14 -05:00
plugin: update_ca_topology
Add ipaDNSVersion option to dnsconfig* commands and use new attribute Ad-hoc LDAP calls in DNS upgrade code were hard to maintain and ipaConfigString was bad idea from the very beginning as it was hard to manipulate the number in it. To avoid problems in future we are introducing new ipaDNSVersion attribute which is used on cn=dns instead of ipaConfigString. Original value of ipaConfigString is kept in the tree for now so older upgraders see it and do not execute the upgrade procedure again. The attribute can be changed only by installer/upgrade so it is not exposed in dnsconfig_mod API. Command dnsconfig_show displays it only if --all option was used. https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-04-25 07:07:16 -05:00
plugin: update_ipaconfigstring_dnsversion_to_ipadnsversion
Server Upgrade: specify order of plugins in update files * add 'plugin' directive * specify plugins order in update files * remove 'run plugins' options * use ldapupdater API instance in plugins * add update files representing former PreUpdate and PostUpdate order of plugins https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-03-18 09:46:00 -05:00
plugin: update_dnszones
plugin: update_dns_limits
upgrade: fix config of sidgen and extdom plugins During upgrade to IPA 4.2, literally "$SUFFIX" value was added to configuration of sidgen and extdom plugins. This cause that SID are not properly configured. Upgrade must fix "$SUFFIX" to reals suffix DN, and run sidgen task against IPA domain (if exists). All trusts added when plugins configuration was broken must be re-added. https://fedorahosted.org/freeipa/ticket/5665 Reviewed-By: Tomas Babej <tbabej@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2016-02-18 12:59:50 -06:00
plugin: update_sigden_extdom_broken_config
plugin: update_sids
Server Upgrade: specify order of plugins in update files * add 'plugin' directive * specify plugins order in update files * remove 'run plugins' options * use ldapupdater API instance in plugins * add update files representing former PreUpdate and PostUpdate order of plugins https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-03-18 09:46:00 -05:00
plugin: update_default_range
plugin: update_default_trust_view
Upgrade: add gidnumber to trusted domain entry The trusted domain entries created in earlier versions are missing gidnumber. During upgrade, a new plugin will read the gidnumber of the fallback group cn=Default SMB Group and add this value to trusted domain entries which do not have a gidNumber. https://pagure.io/freeipa/issue/6827 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2017-04-03 08:57:47 -05:00
plugin: update_tdo_gidnumber
upgrade: add trust upgrade to actual upgrade code Fixes: https://pagure.io/freeipa/issue/6077 Reviewed-By: Christian Heimes <cheimes@redhat.com>
2019-03-22 12:08:33 -05:00
plugin: update_tdo_to_new_layout
adtrust: update Samba domain controller keytab with host keys When DCERPC clients use Kerberos authentication, they use a service ticket to host/domain.controller because in Active Directory any service on the host is an alias to the machine account object. In FreeIPA each Kerberos service has own keys so host/.. and cifs/.. do not share the same keys. It means Samba suite needs to have access to host/.. keytab entries to validate incoming DCERPC requests. Unfortunately, MIT Kerberos has no means to operate on multiple keytabs at the same time and Samba doesn't implement this either. We cannot use GSS-Proxy as well because Samba daemons are running under root. As a workaround, copy missing aes256 and aes128 keys from the host keytab. SMB protocol doesn't use other encryption types and we don't have rc4-hmac for the host either. Fixes: https://pagure.io/freeipa/issue/3999 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2019-06-16 08:19:21 -05:00
plugin: update_host_cifs_keytabs
adtrust: add default read_keys permission for TDO objects If trusted domain object (TDO) is lacking ipaAllowedToPerform;read_keys attribute values, it cannot be used by SSSD to retrieve TDO keys and the whole communication with Active Directory domain controllers will not be possible. This seems to affect trusts which were created before ipaAllowedToPerform;read_keys permission granting was introduced (FreeIPA 4.2). Add back the default setting for the permissions which grants access to trust agents and trust admins. Resolves: https://pagure.io/freeipa/issue/8067 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2019-09-12 03:21:51 -05:00
plugin: update_tdo_default_read_keys_permissions
trust upgrade: ensure that host is member of adtrust agents After an upgrade, the group cn=adtrust agents may be missing some members. Each ad trust controller must appear twice as member: - krbprincipalname=cifs/hostname@realm,cn=services,cn=accounts,basedn - fqdn=hostname,cn=computers,cn=accounts,basedn Add an upgrade plugin that builds a list of hostnames from the cifs principals and adds if needed fqdn=hostname... Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1778777 Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
2019-12-03 05:56:22 -06:00
plugin: update_adtrust_agents_members
Server Upgrade: specify order of plugins in update files * add 'plugin' directive * specify plugins order in update files * remove 'run plugins' options * use ldapupdater API instance in plugins * add update files representing former PreUpdate and PostUpdate order of plugins https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-03-18 09:46:00 -05:00
plugin: update_ca_renewal_master
plugin: update_idrange_type
plugin: update_pacs
plugin: update_service_principalalias
Fix ipa-server-upgrade: This entry already exists ipa-server-upgrade fails when running the ipaload_cacrt plugin. The plugin finds all CA certificates in /etc/httpd/alias and uploads them in LDAP below cn=certificates,cn=ipa,cn=etc,$BASEDN. The issue happens because there is already an entry in LDAP for IPA CA, but with a different DN. The nickname in /etc/httpd/alias can differ from $DOMAIN IPA CA. To avoid the issue: 1/ during upgrade, run a new plugin that removes duplicates and restarts ldap (to make sure that uniqueness attr plugin is working after the new plugin) 2/ modify upload_cacert plugin so that it is using $DOMAIN IPA CA instead of cn=$nickname,cn=ipa,cn=etc,$BASEDN when uploading IPA CA. https://pagure.io/freeipa/issue/7125 Reviewed-By: Fraser Tweedale <ftweedal@redhat.com>
2017-08-28 03:50:58 -05:00
plugin: update_fix_duplicate_cacrt_in_ldap
Server Upgrade: specify order of plugins in update files * add 'plugin' directive * specify plugins order in update files * remove 'run plugins' options * use ldapupdater API instance in plugins * add update files representing former PreUpdate and PostUpdate order of plugins https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-03-18 09:46:00 -05:00
plugin: update_upload_cacrt
server upgrade: fix upgrade from pre-4.0 update_ca_renewal_master uses ipaCert certmonger tracking information to decide whether the local server is the CA renewal master or not. The information is lost when migrating from /etc/httpd/alias to /var/lib/ipa/radb in update_ra_cert_store. Make sure update_ra_cert_store is executed after update_ca_renewal_master so that correct information is used. https://fedorahosted.org/freeipa/ticket/5959 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-02-16 04:13:13 -06:00
# update_ra_cert_store has to be executed after update_ca_renewal_master
plugin: update_ra_cert_store
Support Samba 4.9 Samba 4.9 became a bit more strict about creating a local NT token and a failure to resolve or create BUILTIN\Guests group will cause a rejection of the connection for a successfully authenticated one. Add a default mapping of the nobody group to BUILTIN\Guests. BUILTIN\Guests is a special group SID that is added to the NT token for authenticated users. For real guests there is 'guest account' option in smb.conf which defaults to 'nobody' user. This was implicit behavior before as 'guest account = nobody' by default would pick up 'nobody' group as well. Fixes: https://pagure.io/freeipa/issue/7705 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2018-09-21 02:57:23 -05:00
plugin: update_mapping_Guests_to_nobody
upgrade: fix ipakra people entry 'description' attribute Add an upgrade script to detect when ipakra people entry has incorrect 'description' attribute and fix it. Part of: https://pagure.io/freeipa/issue/8084 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
2019-10-10 23:56:10 -05:00
plugin: fix_kra_people_entry
Add ipwpwdpolicy objectclass to all policies on upgrade ipapwdpolicy is the objectclass which defines the libpwquality attributes. For older sytems it isn't strictly necessary (or visible) but not having it included will result in policies not being visible with pwpolicy-find. https://pagure.io/freeipa/issue/8555 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2020-10-26 10:02:21 -05:00
plugin: update_pwpolicy
Set default on group pwpolicy with no grace limit in upgrade If an existing group policy lacks a password grace limit update it to -1 on upgrade. Fixes: https://pagure.io/freeipa/issue/9212 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
2022-08-04 11:04:41 -05:00
plugin: update_pwpolicy_grace
Server Upgrade: specify order of plugins in update files * add 'plugin' directive * specify plugins order in update files * remove 'run plugins' options * use ldapupdater API instance in plugins * add update files representing former PreUpdate and PostUpdate order of plugins https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-03-18 09:46:00 -05:00
# last
DNS upgrade: change forwarding policy to = only for conflicting forward zones This change is necessary to override automatic empty zone configuration in latest BIND and bind-dyndb-ldap 9.0+. This procedure is still not complete because we need to handle global forwarders too (in LDAP and in named.conf on each server). https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-04-27 07:44:17 -05:00
# DNS version 1
Server Upgrade: specify order of plugins in update files * add 'plugin' directive * specify plugins order in update files * remove 'run plugins' options * use ldapupdater API instance in plugins * add update files representing former PreUpdate and PostUpdate order of plugins https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-03-18 09:46:00 -05:00
plugin: update_master_to_dnsforwardzones
DNS upgrade: change forwarding policy to = only for conflicting forward zones This change is necessary to override automatic empty zone configuration in latest BIND and bind-dyndb-ldap 9.0+. This procedure is still not complete because we need to handle global forwarders too (in LDAP and in named.conf on each server). https://fedorahosted.org/freeipa/ticket/5710 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-04-27 07:44:17 -05:00
# DNS version 2
plugin: update_dnsforward_emptyzones
Server Upgrade: specify order of plugins in update files * add 'plugin' directive * specify plugins order in update files * remove 'run plugins' options * use ldapupdater API instance in plugins * add update files representing former PreUpdate and PostUpdate order of plugins https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-03-18 09:46:00 -05:00
plugin: update_managed_post
plugin: update_managed_permissions
fix permission: Read Replication Agreements This permission cannot be MANAGED permission because it is located in nonreplicating part of the LDAP tree. As side effect, the particular ACI has not been created on all replicas. This commit makes Read Replication Agreements non managed permission and also fix missing ACI on replicas. https://fedorahosted.org/freeipa/ticket/5631 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-02-04 09:23:40 -06:00
plugin: update_read_replication_agreements_permission
Server Upgrade: specify order of plugins in update files * add 'plugin' directive * specify plugins order in update files * remove 'run plugins' options * use ldapupdater API instance in plugins * add update files representing former PreUpdate and PostUpdate order of plugins https://fedorahosted.org/freeipa/ticket/4904 Reviewed-By: David Kupka <dkupka@redhat.com>
2015-03-18 09:46:00 -05:00
plugin: update_idrange_baserid
plugin: update_passync_privilege_update
DNS Locations: dnsserver: put server_id option into named.conf The option server_id is required for DNS location feature, otherwise it will not work. https://fedorahosted.org/freeipa/ticket/2008 Reviewed-By: Petr Spacek <pspacek@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-06-13 13:41:24 -05:00
plugin: update_dnsserver_configuration_into_ldap
Move ds.replica_populate to an update plugin Replica populate can be applied with other update plugins. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-10-13 08:08:31 -05:00
plugin: update_ldap_server_list
Moved update of DNA plugin among update plugins To make the code more general, moved the update_dna_shared_config among other update plugins. Bugfix: DNA shared config connection protocol was compared to a method string which would result in a try to always update it even if there was no need to. https://fedorahosted.org/389/ticket/48373 causes that two shared DNA config entries are created instead of one. https://fedorahosted.org/freeipa/ticket/6392 Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-10-18 03:16:29 -05:00
plugin: update_dna_shared_config
Switch nsslapd-unhashed-pw-switch to nolog 389-ds will change the default value of nsslapd-unhashed-pw-switch from 'on' to 'off' For new or upgraded IPA instance, in case of winsync deployment the attribute is set to 'on' and a warning is displayed. Else the attribute is set to 'nolog' https://pagure.io/freeipa/issue/4812 Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
2019-03-27 11:36:57 -05:00
plugin: update_unhashed_password
Generate CNAMEs for TXT+URI location krb records The IPA location system relies on DNS record priorities in order to give higher precedence to servers from the same location. For Kerberos, this is done by redirecting generic SRV records (e.g. _kerberos._udp.[domain].) to location-aware records (e.g. _kerberos._udp.[location]._locations.[domain].) using CNAMEs. This commit applies the same logic for URI records. URI location-aware record were created, but there were no redirection from generic URI records. It was causing them to be ignored in practice. Kerberos URI and TXT records have the same name: "_kerberos". However, CNAME records cannot coexist with any other record type. To avoid this conflict, the generic TXT realm record was replaced by location-aware records, even if the content of these records is the same for all locations. Fixes: https://pagure.io/freeipa/issue/9257 Signed-off-by: Julien Rische <jrische@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2022-10-04 08:03:28 -05:00
plugin: update_krb_uri_txt_records_for_locations
Reference in New Issue Copy Permalink