IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-30 10:47:08 -06:00
Code Issues Packages Projects Releases Wiki Activity
8b0e2ed991
freeipa/install/updates/Makefile.am

57 lines
1.2 KiB
Makefile
Raw Normal View History

Update files for the schema compatibility plugin and RFC4876 profiles Also handle syntax errors a bit more gracefully and allow the updater to work on more than one file at a time. Adjust to new config.py and use a custom exception class for syntax errors. Also fix a error in parsing the separate files Include slapi-nis in Requires Includes work provided by Martin Nagy 460055
2008-09-10 14:56:11 -05:00
NULL =
appdir = $(IPA_DATA_DIR)/updates
app_DATA = \
Enable 389-ds SSL host checking by defauilt Enforce that the remote hostname matches the remote SSL server certificate when 389-ds operates as an SSL client. Also add an update file to turn this off for existing installations. This also changes the way the ldapupdater modlist is generated to be more like the framework. Single-value attributes are done as replacements and there is a list of force-replacement attributes. ticket 1069
2011-05-19 21:30:53 -05:00
10-config.update \
Enable transactions by default, make password and modrdn TXN-aware The password and modrdn plugins needed to be made transaction aware for the pre and post operations. Remove the reverse member hoop jumping. Just fetch the entry once and all the memberof data is there (plus objectclass). Fix some unit tests that are failing because we actually get the data now due to transactions. Add small bit of code in user plugin to retrieve the user again ala wait_for_attr but in the case of transactions we need do it only once. Deprecate wait_for_attr code. Add a memberof fixup task for roles. https://fedorahosted.org/freeipa/ticket/1263 https://fedorahosted.org/freeipa/ticket/1891 https://fedorahosted.org/freeipa/ticket/2056 https://fedorahosted.org/freeipa/ticket/3043 https://fedorahosted.org/freeipa/ticket/3191 https://fedorahosted.org/freeipa/ticket/3046
2012-11-15 20:38:26 -06:00
10-enable-betxn.update \
Add update files for SELinuxUserMap https://fedorahosted.org/freeipa/ticket/2344
2012-02-09 15:52:07 -06:00
10-selinuxusermap.update \
Set the default attributes for RootDSE With 389 DS 1.3.3 upwards we can leverage the nsslapd-return-default-opattr attribute to enumerate the list of attributes that should be returned even if not specified explicitly. Use the behaviour to get the same attributes returned from searches on rootDSE as in 1.3.1. https://fedorahosted.org/freeipa/ticket/4288 Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-07-01 19:55:01 -05:00
10-rootdse.update \
Add uniqueness plugin configuration for sudorule cn We do a search looking for duplicate values but this leaves open the possibility that two adds are happening at the same time so both searches return NotFound therefore we get two entries with the same cn value. https://fedorahosted.org/freeipa/ticket/3017
2012-09-13 14:11:57 -05:00
10-uniqueness.update \
Add IPA OTP schema and ACLs This commit adds schema support for two factor authentication via OTP devices, including RADIUS or TOTP. This schema will be used by future patches which will enable two factor authentication directly. https://fedorahosted.org/freeipa/ticket/3365 http://freeipa.org/page/V3/OTP
2013-04-11 12:24:46 -05:00
10-schema_compat.update \
Move Managed Entries into their own container in the replicated space. Repoint cn=Managed Entries,cn=plugins,cn=config in common_setup Create: cn=Managed Entries,cn=etc,$SUFFIX Create: cn=Definitions,cn=Managed Entries,cn=etc,$SUFFIX Create: cn=Templates,cn=Managed Entries,cn=etc,$SUFFIX Create method for dynamically migrating any and all custom Managed Entries from the cn=config space into the new container. Separate the connection creation during update so that a restart can be performed to initialize changes before performing a delete. Add wait_for_open_socket() method in installutils https://fedorahosted.org/freeipa/ticket/1708
2011-09-08 14:07:26 -05:00
19-managed-entries.update \
Add aci to make managed netgroups immutable. ticket 962
2011-02-17 16:19:24 -06:00
20-aci.update \
Name update files so they can be easily sorted. We want to process some updates in a particular order (schema, structural). Using an init-inspired ordering mechanism.
2009-03-23 14:20:43 -05:00
20-dna.update \
Configure Managed Entries on replicas. The Managed Entries plugin configurations weren't being created on replica installs. The templates were there but the cn=config portions were not. This patch adds them as updates. The template portion will be added in the initial replication. ticket 1222
2011-05-18 14:12:22 -05:00
20-host_nis_groups.update \
Name update files so they can be easily sorted. We want to process some updates in a particular order (schema, structural). Using an init-inspired ordering mechanism.
2009-03-23 14:20:43 -05:00
20-indices.update \
20-nss_ldap.update \
20-replication.update \
Update SSL ciphers configured in 389-ds-base use configuration parameters to enable ciphers provided by NSS and not considered weak. This requires 389-ds version 1.3.3.2 or later https://fedorahosted.org/freeipa/ticket/4395 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
2014-09-12 05:43:31 -05:00
20-sslciphers.update \
Enable Retro Changelog and Content Synchronization DS plugins Enable Retro Changelog and Content Synchronization DS plugins which are required for SyncRepl support. Create a working directory /var/named/ipa required by bind-dyndb-ldap v4+. https://fedorahosted.org/freeipa/ticket/3967
2013-10-25 05:41:25 -05:00
20-syncrepl.update \
Configure Managed Entries on replicas. The Managed Entries plugin configurations weren't being created on replica installs. The templates were there but the cn=config portions were not. This patch adds them as updates. The template portion will be added in the initial replication. ticket 1222
2011-05-18 14:12:22 -05:00
20-user_private_groups.update \
Name update files so they can be easily sorted. We want to process some updates in a particular order (schema, structural). Using an init-inspired ordering mechanism.
2009-03-23 14:20:43 -05:00
20-winsync_index.update \
Store list of non-master replicas in DIT and provide way to list them Fixes: https://fedorahosted.org/freeipa/ticket/1007
2011-02-28 16:35:44 -06:00
21-replicas_container.update \
Use certmonger to renew CA subsystem certificates Certificate renewal can be done only one one CA as the certificates need to be shared amongst them. certmonger has been trained to communicate directly with dogtag to perform the renewals. The initial CA installation is the defacto certificate renewal master. A copy of the certificate is stored in the IPA LDAP tree in cn=ca_renewal,cn=ipa,cn=etc,$SUFFIX, the rdn being the nickname of the certificate, when a certificate is renewed. Only the most current certificate is stored. It is valid to have no certificates there, it means that no renewals have taken place. The clones are configured with a new certmonger CA type that polls this location in the IPA tree looking for an updated certificate. If one is not found then certmonger is put into the CA_WORKING state and will poll every 8 hours until an updated certificate is available. The RA agent certificate, ipaCert in /etc/httpd/alias, is a special case. When this certificate is updated we also need to update its entry in the dogtag tree, adding the updated certificate and telling dogtag which certificate to use. This is the certificate that lets IPA issue certificates. On upgrades we check to see if the certificate tracking is already in place. If not then we need to determine if this is the master that will do the renewals or not. This decision is made based on whether it was the first master installed. It is concievable that this master is no longer available meaning that none are actually tracking renewal. We will need to document this. https://fedorahosted.org/freeipa/ticket/2803
2012-07-11 14:51:01 -05:00
21-ca_renewal_container.update \
Add container for certificate store. Part of https://fedorahosted.org/freeipa/ticket/3259 Part of https://fedorahosted.org/freeipa/ticket/3520 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-06-10 07:05:22 -05:00
21-certstore_container.update \
Expand Referential Integrity checks Many attributes in IPA (e.g. manager, memberuser, managedby, ...) are used to store DNs of linked objects in IPA (users, hosts, sudo commands, etc.). However, when the linked objects is deleted or renamed, the attribute pointing to it stays with the objects and thus may create a dangling link causing issues in client software reading the data. Directory Server has a plugin to enforce referential integrity (RI) by checking DEL and MODRDN operations and updating affected links. It was already used for manager and secretary attributes and should be expanded for the missing attributes to avoid dangling links. As a prerequisite, all attributes checked for RI must have pres and eq indexes to avoid performance issues. Thus, the following indexes are added: * manager (pres index only) * secretary (pres index only) * memberHost * memberUser * sourcehost * memberservice * managedby * memberallowcmd * memberdenycmd * ipasudorunas * ipasudorunasgroup Referential Integrity plugin is updated to enforce RI for all these attributes. Unit tests covering RI checks for all these attributes were added as well. Note: this update will only fix RI on one master as RI plugin does not check replicated operations. https://fedorahosted.org/freeipa/ticket/2866
2012-09-12 03:00:35 -05:00
25-referint.update \
User Life Cycle: create containers and scoping DS plugins User Life Cycle is designed http://www.freeipa.org/page/V4/User_Life-Cycle_Management It manages 3 containers (Staging, Active, Delete). At install/upgrade Delete and Staging containers needs to be created. Active: cn=users,cn=accounts,$SUFFIX Delete: cn=deleted users,cn=accounts,cn=provisioning,$SUFFIX Stage: cn=staged users ,cn=accounts,cn=provisioning,$SUFFIX Plugins scopes: krbPrincipalName, krbCanonicalName, ipaUniqueID, uid: cn=accounts,SUFFIX cn=deleted users,cn=accounts,cn=provisioning,SUFFIX DNA: cn=accounts,SUFFIX Plugins exclude subtree: IPA UUID, Referential Integrity, memberOf: cn=provisioning,SUFFIX https://fedorahosted.org/freeipa/ticket/3813 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-08-07 09:29:02 -05:00
30-provisioning.update \
Configure s4u2proxy during installation. This creates a new container, cn=s4u2proxy,cn=etc,$SUFFIX Within that container we control which services are allowed to delegate tickets for other services. Right now that is limited from the IPA HTTP to ldap services. Requires a version of mod_auth_kerb that supports s4u2proxy https://fedorahosted.org/freeipa/ticket/1098
2012-01-10 21:39:26 -06:00
30-s4u2proxy.update \
Add permission/privilege for updating IPA configuration. ticket 950
2011-02-11 15:48:59 -06:00
40-delegation.update \
Add list of domains associated to our realm to cn=etc Add new LDAP container to store the list of domains associated with IPA realm. Add two new ipa commands (ipa realmdomains-show and ipa realmdomains-mod) to allow manipulation of the list of realm domains. Unit test file covering these new commands was added. https://fedorahosted.org/freeipa/ticket/2945
2013-02-12 09:50:00 -06:00
40-realm_domains.update \
Run the CLEANALLRUV task when deleting a replication agreement. This adds two new commands to ipa-replica-manage: list-ruv & clean-ruv list-ruv can be use to list the update vectors the master has configugured clean-ruv can be used to fire off the CLEANRUV task to remove a replication vector. It should be used with caution. https://fedorahosted.org/freeipa/ticket/2303
2012-09-17 10:45:42 -05:00
40-replication.update \
Fix DNS permissions and membership in privileges This resolves two issues: 1. The DNS acis lacked a prefix so weren't tied to permissions 2. The permissions were added before the privileges so the member values weren't calculated properly For updates we need to add in the members and recalculate memberof via a DS task. https://fedorahosted.org/freeipa/ticket/1898
2011-10-05 16:16:05 -05:00
40-dns.update \
Enable automember for upgraded servers automember functionality is depends on predefined data is in LDAP. Since we add it for fresh installs only, automember cannot be used for upgraded servers. Make sure that automember LDAP data is added during upgrade too. https://fedorahosted.org/freeipa/ticket/1992
2011-10-17 06:56:21 -05:00
40-automember.update \
Add IPA OTP schema and ACLs This commit adds schema support for two factor authentication via OTP devices, including RADIUS or TOTP. This schema will be used by future patches which will enable two factor authentication directly. https://fedorahosted.org/freeipa/ticket/3365 http://freeipa.org/page/V3/OTP
2013-04-11 12:24:46 -05:00
40-otp.update \
Add default roles and permissions for HBAC, SUDO and pw policy Created some default roles as examples. In doing so I realized that we were completely missing default rules for HBAC, SUDO and password policy so I added those as well. I ran into a problem when the updater has a default record and an add at the same time, it should handle it better now. ticket 585
2011-02-22 08:21:14 -06:00
45-roles.update \
Do not check userPassword with 7-bit plugin Default list of attributes that are checked with 7-bit plugin for being 7-bit clean includes userPassword. Consecutively, one is unable to set passwords that contain non-ascii characters. https://fedorahosted.org/freeipa/ticket/3640
2013-06-03 02:56:08 -05:00
50-7_bit_check.update \
Update Dogtag 9 database during replica installation When Dogtag 10 based FreeIPA replica is being installed for a Dogtag 9 based master, the PKI database is not updated and miss several ACLs which prevent some of the PKI functions, e.g. an ability to create other clones. Add an update file to do the database update. Content is based on recommendation from PKI team: * https://bugzilla.redhat.com/show_bug.cgi?id=1075118#c9 This update file can be removed when Dogtag database upgrades are done in PKI component. Upstream tickets: * https://fedorahosted.org/pki/ticket/710 (database upgrade framework) * https://fedorahosted.org/pki/ticket/906 (checking database version) Also make sure that PKI service is restarted in the end of the installation as the other services to make sure it picks changes done during LDAP updates. https://fedorahosted.org/freeipa/ticket/4243 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-03-13 02:25:11 -05:00
50-dogtag10-migration.update \
The default groups we create should have ipaUniqueId set This adds a new directive to ipa-ldap-updater: addifnew. This will add a new attribute only if it doesn't exist in the current entry. We can't compare values because the value we are adding is automatically generated. ticket 1177
2011-04-14 13:37:45 -05:00
50-lockout-policy.update \
50-groupuuid.update \
Add additional pam ftp services to HBAC, and a ftp HBAC service group This adds proftpd, pure-ftpd, vsftpd and gssftp. https://fedorahosted.org/freeipa/ticket/1703
2011-08-24 16:28:22 -05:00
50-hbacservice.update \
Add Camellia ciphers to allowed list. https://fedorahosted.org/freeipa/ticket/3749
2013-07-12 10:28:20 -05:00
50-krbenctypes.update \
Fix nis netgroup config entry so users appear in netgroup triple. https://fedorahosted.org/freeipa/ticket/2028
2011-10-26 16:42:59 -05:00
50-nis.update \
Add SELinux user mapping framework. This will allow one to define what SELinux context a given user gets on a given machine. A rule can contain a set of users and hosts or it can point to an existing HBAC rule that defines them. https://fedorahosted.org/freeipa/ticket/755
2011-11-23 15:59:21 -06:00
50-ipaconfig.update \
Reorder privileges so that memberof for permissions are generated properly. The privilege was added after the permission causing the memberof to not be generated. Add a new task to regenerate memberof for existing PBAC to fix upgrades. https://fedorahosted.org/freeipa/ticket/2058 https://fedorahosted.org/freeipa/ticket/2059 https://fedorahosted.org/freeipa/ticket/2060 https://fedorahosted.org/freeipa/ticket/2061
2011-12-08 03:04:09 -06:00
55-pbacmemberof.update \
Add separate attribute to store trusted domain SID We need two attributes in the ipaNTTrustedDomain objectclass to store different kind of SID. Currently ipaNTSecurityIdentifier is used to store the Domain-SID of the trusted domain. A second attribute is needed to store the SID for the trusted domain user. Since it cannot be derived safely from other values and since it does not make sense to create a separate object for the user a new attribute is needed. https://fedorahosted.org/freeipa/ticket/2191
2012-02-28 05:22:49 -06:00
60-trusts.update \
61-trusts-s4u2proxy.update \
Add objects for initial ID range
2012-06-12 04:58:41 -05:00
62-ranges.update \
idviews: Create container for ID views under cn=accounts Part of: https://fedorahosted.org/freeipa/ticket/3979 Reviewed-By: Petr Viktorin <pviktori@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-07-31 04:52:04 -05:00
71-idviews.update \
Update files for the schema compatibility plugin and RFC4876 profiles Also handle syntax errors a bit more gracefully and allow the updater to work on more than one file at a time. Adjust to new config.py and use a custom exception class for syntax errors. Also fix a error in parsing the separate files Include slapi-nis in Requires Includes work provided by Martin Nagy 460055
2008-09-10 14:56:11 -05:00
$(NULL)
EXTRA_DIST = \
$(app_DATA) \
$(NULL)
MAINTAINERCLEANFILES = \
*~ \
Makefile.in
Reference in New Issue Copy Permalink