IntenseWebs/freeipa
3
0 Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-11-02 20:30:26 -06:00
Code Issues Packages Projects Releases Wiki Activity

DNSSEC: update message

Browse Source 
https://fedorahosted.org/freeipa/ticket/4657

Reviewed-By: Petr Spacek <pspacek@redhat.com>
This commit is contained in:
Martin Basti authored and Tomas Babej committed 2015-07-07 08:37:15 +02:00
1 parent e151492560
commit 2e4e8d759d
2 files changed
+22 -7
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

install/tools/ipa-replica-manage
+1
View File
@@ -663,6 +663,7 @@ def ensure_last_services(conn, hostname, masters, options):
dnssec_masters = opendnssecinstance.get_dnssec_key_masters(conn) dnssec_masters = opendnssecinstance.get_dnssec_key_masters(conn)
if hostname in dnssec_masters: if hostname in dnssec_masters:
print "Replica is active DNSSEC key master. Uninstall could break your DNS system." print "Replica is active DNSSEC key master. Uninstall could break your DNS system."
print "Please disable or replace DNSSEC key master first."
sys.exit("Deletion aborted") sys.exit("Deletion aborted")
ca = cainstance.CAInstance(api.env.realm, certs.NSS_DIR) ca = cainstance.CAInstance(api.env.realm, certs.NSS_DIR)
ipaserver/install/dns.py
+21 -7
View File
@@ -154,8 +154,15 @@ def install_check(standalone, replica, options, hostname):
if dnssec_zones and not options.force: if dnssec_zones and not options.force:
raise RuntimeError( raise RuntimeError(
"Cannot disable DNSSEC key master, DNSSEC signing is still " "Cannot disable DNSSEC key master, DNSSEC signing is still "
"enabled for following zone(s): %s\n" "enabled for following zone(s):\n"
"Use --force option to skip this check." % "%s\n"
"It is possible to move DNSSEC key master role to a different "
"server by using --force option to skip this check.\n\n"
"WARNING: You have to immediatelly copy kasp.db file to a new "
"server and run command 'ipa-dns-install --dnssec-master "
"--kasp-db'.\n"
"Your DNS zones will become unavailable if you "
"do not reinstall the DNSSEC key master role immediatelly." %
", ".join([str(zone) for zone in dnssec_zones])) ", ".join([str(zone) for zone in dnssec_zones]))
elif options.dnssec_master: elif options.dnssec_master:
# check opendnssec packages are installed # check opendnssec packages are installed
@@ -186,8 +193,10 @@ def install_check(standalone, replica, options, hostname):
suplementary_groups=[named.get_group_name()]) suplementary_groups=[named.get_group_name()])
except CalledProcessError as e: except CalledProcessError as e:
root_logger.debug("%s", e) root_logger.debug("%s", e)
raise RuntimeError("IPA server cannot be the new DNSSEC master " raise RuntimeError("This IPA server cannot be promoted to "
"(some keys are missing)") "DNSSEC master role because some keys were "
"not replicated from the original "
"DNSSEC master server")
finally: finally:
if dnskeysyncd_running: if dnskeysyncd_running:
dnskeysyncd.start() dnskeysyncd.start()
@@ -195,9 +204,14 @@ def install_check(standalone, replica, options, hostname):
# some zones have --dnssec=true, make sure a user really want to # some zones have --dnssec=true, make sure a user really want to
# install new database # install new database
raise RuntimeError( raise RuntimeError(
"DNSSEC is enabled for following zone(s): %s\n" "DNSSEC signing is already enabled for following zone(s): %s\n"
"Please use option --kasp-db to keep current OpenDNSSEC " "Installation cannot continue without the OpenDNSSEC database "
"database or use --force option to skip this check." % "file from the original DNSSEC master server.\n"
"Please use option --kasp-db to specify location "
"of the kasp.db file copied from the original "
"DNSSEC master server.\n"
"WARNING: Zones will become unavailable if you do not provide "
"the original kasp.db file." %
", ".join([str(zone) for zone in dnssec_zones])) ", ".join([str(zone) for zone in dnssec_zones]))