IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

DNSSEC: update message

Browse Source 
https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek <pspacek@redhat.com>
This commit is contained in:
Martin Basti
2015-06-17 13:35:18 +02:00
committed by Tomas Babej
parent e151492560
commit 2e4e8d759d
2 changed files with 22 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
install/tools/ipa-replica-manage
View File

@@ -663,6 +663,7 @@ def ensure_last_services(conn, hostname, masters, options):
dnssec_masters = opendnssecinstance.get_dnssec_key_masters(conn)
if hostname in dnssec_masters:
print "Replica is active DNSSEC key master. Uninstall could break your DNS system."
print "Please disable or replace DNSSEC key master first."
sys.exit("Deletion aborted")
ca = cainstance.CAInstance(api.env.realm, certs.NSS_DIR)

28
ipaserver/install/dns.py
View File

@@ -154,8 +154,15 @@ def install_check(standalone, replica, options, hostname):
if dnssec_zones and not options.force:
raise RuntimeError(
"Cannot disable DNSSEC key master, DNSSEC signing is still "
"enabled for following zone(s): %s\n"
"Use --force option to skip this check." %
"enabled for following zone(s):\n"
"%s\n"
"It is possible to move DNSSEC key master role to a different "
"server by using --force option to skip this check.\n\n"
"WARNING: You have to immediatelly copy kasp.db file to a new "
"server and run command 'ipa-dns-install --dnssec-master "
"--kasp-db'.\n"
"Your DNS zones will become unavailable if you "
"do not reinstall the DNSSEC key master role immediatelly." %
", ".join([str(zone) for zone in dnssec_zones]))
elif options.dnssec_master:
# check opendnssec packages are installed
@@ -186,8 +193,10 @@ def install_check(standalone, replica, options, hostname):
suplementary_groups=[named.get_group_name()])
except CalledProcessError as e:
root_logger.debug("%s", e)
raise RuntimeError("IPA server cannot be the new DNSSEC master "
"(some keys are missing)")
raise RuntimeError("This IPA server cannot be promoted to "
"DNSSEC master role because some keys were "
"not replicated from the original "
"DNSSEC master server")
finally:
if dnskeysyncd_running:
dnskeysyncd.start()
@@ -195,9 +204,14 @@ def install_check(standalone, replica, options, hostname):
# some zones have --dnssec=true, make sure a user really want to
# install new database
raise RuntimeError(
"DNSSEC is enabled for following zone(s): %s\n"
"Please use option --kasp-db to keep current OpenDNSSEC "
"database or use --force option to skip this check." %
"DNSSEC signing is already enabled for following zone(s): %s\n"
"Installation cannot continue without the OpenDNSSEC database "
"file from the original DNSSEC master server.\n"
"Please use option --kasp-db to specify location "
"of the kasp.db file copied from the original "
"DNSSEC master server.\n"
"WARNING: Zones will become unavailable if you do not provide "
"the original kasp.db file." %
", ".join([str(zone) for zone in dnssec_zones]))