IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

PKI service restart after CA renewal failed

Browse Source 
Fix both the service restart procedure and registration of old
pki-cad well known service name.

This patch was adapted from original patch of Jan Cholasta 178 to
fix ticket 4092.

https://fedorahosted.org/freeipa/ticket/4092
This commit is contained in:
Jan Cholasta
2013-10-15 17:47:12 +00:00
committed by Martin Kosek
parent 4a64a1f18b
commit 911f5e9eb7
6 changed files with 42 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
install/restart_scripts/renew_ca_cert
View File

@@ -49,6 +49,7 @@ api.finalize()
configured_constants = dogtag.configured_constants(api) configured_constants = dogtag.configured_constants(api)
alias_dir = configured_constants.ALIAS_DIR alias_dir = configured_constants.ALIAS_DIR
dogtag_service = ipaservices.knownservices[configured_constants.SERVICE_NAME]
dogtag_instance = configured_constants.PKI_INSTANCE_NAME dogtag_instance = configured_constants.PKI_INSTANCE_NAME
# Fetch the new certificate # Fetch the new certificate
@@ -106,12 +107,13 @@ if nickname == 'auditSigningCert cert-pki-ca':
# off the servlet to verify that the CA is actually up and responding so # off the servlet to verify that the CA is actually up and responding so
# when this returns it should be good-to-go. The CA was stopped in the # when this returns it should be good-to-go. The CA was stopped in the
# pre-save state. # pre-save state.
syslog.syslog(syslog.LOG_NOTICE, 'Starting %sd' % dogtag_instance) syslog.syslog(syslog.LOG_NOTICE, 'Starting %s' % dogtag_service.service_name)
try: try:
if configured_constants.DOGTAG_VERSION == 9: dogtag_service.start(dogtag_instance)
ipaservices.knownservices.pki_cad.start(dogtag_instance)
else:
ipaservices.knownservices.pki_tomcatd.start(dogtag_instance)
except Exception, e: except Exception, e:
syslog.syslog(syslog.LOG_ERR, "Cannot start %sd: %s" % syslog.syslog(
(dogtag_instance, str(e))) syslog.LOG_ERR,
"Cannot start %s: %s" % (dogtag_service.service_name, e))
else:
syslog.syslog(
syslog.LOG_NOTICE, "Started %s" % dogtag_service.service_name)

30
install/restart_scripts/restart_pkicad Normal file → Executable file
View File

@@ -33,18 +33,25 @@ api.finalize()
configured_constants = dogtag.configured_constants(api) configured_constants = dogtag.configured_constants(api)
alias_dir = configured_constants.ALIAS_DIR alias_dir = configured_constants.ALIAS_DIR
dogtag_service = ipaservices.knownservices[configured_constants.SERVICE_NAME]
dogtag_instance = configured_constants.PKI_INSTANCE_NAME dogtag_instance = configured_constants.PKI_INSTANCE_NAME
# dogtag opens its NSS database in read/write mode so we need it # dogtag opens its NSS database in read/write mode so we need it
# shut down so certmonger can open it read/write mode. This avoids # shut down so certmonger can open it read/write mode. This avoids
# database corruption. It should already be stopped by the pre-command # database corruption. It should already be stopped by the pre-command
# but lets be sure. # but lets be sure.
if ipaservices.knownservices.pki_cad.is_running(dogtag_instance): if dogtag_service.is_running(dogtag_instance):
syslog.syslog(
syslog.LOG_NOTICE, "Stopping %s" % dogtag_service.service_name)
try: try:
ipaservices.knownservices.pki_cad.stop(dogtag_instance) dogtag_service.stop(dogtag_instance)
except Exception, e: except Exception, e:
syslog.syslog(syslog.LOG_ERR, "Cannot stop %sd: %s" % syslog.syslog(
(dogtag_instance, str(e))) syslog.LOG_ERR,
"Cannot stop %s: %s" % (dogtag_service.service_name, e))
else:
syslog.syslog(
syslog.LOG_NOTICE, "Stopped %s" % dogtag_service.service_name)
# Fix permissions on the audit cert if we're updating it # Fix permissions on the audit cert if we're updating it
if nickname == 'auditSigningCert cert-pki-ca': if nickname == 'auditSigningCert cert-pki-ca':
@@ -55,14 +62,13 @@ if nickname == 'auditSigningCert cert-pki-ca':
] ]
db.run_certutil(args) db.run_certutil(args)
syslog.syslog(syslog.LOG_NOTICE, 'Starting %s' % dogtag_service.service_name)
try: try:
if configured_constants.DOGTAG_VERSION == 9: dogtag_service.start(dogtag_instance)
ipaservices.knownservices.pki_cad.start(dogtag_instance)
else:
ipaservices.knownservices.pki_tomcatd.start(dogtag_instance)
except Exception, e: except Exception, e:
syslog.syslog(syslog.LOG_ERR, "Cannot start %sd: %s" % syslog.syslog(
(dogtag_instance, str(e))) syslog.LOG_ERR,
"Cannot start %s: %s" % (dogtag_service.service_name, e))
else: else:
syslog.syslog(syslog.LOG_NOTICE, "certmonger started %sd, nickname '%s'" % syslog.syslog(
(dogtag_instance, nickname)) syslog.LOG_NOTICE, "Started %s" % dogtag_service.service_name)

16
install/restart_scripts/stop_pkicad Normal file → Executable file
View File

@@ -29,15 +29,15 @@ api.bootstrap(context='restart')
api.finalize() api.finalize()
configured_constants = dogtag.configured_constants(api) configured_constants = dogtag.configured_constants(api)
dogtag_service = ipaservices.knownservices[configured_constants.SERVICE_NAME]
dogtag_instance = configured_constants.PKI_INSTANCE_NAME dogtag_instance = configured_constants.PKI_INSTANCE_NAME
syslog.syslog(syslog.LOG_NOTICE, "certmonger stopping %sd" % dogtag_instance) syslog.syslog(syslog.LOG_NOTICE, "Stopping %s" % dogtag_service.service_name)
try: try:
if configured_constants.DOGTAG_VERSION == 9: dogtag_service.stop(dogtag_instance)
ipaservices.knownservices.pki_cad.stop(dogtag_instance)
else:
ipaservices.knownservices.pki_tomcatd.stop(dogtag_instance)
except Exception, e: except Exception, e:
syslog.syslog(syslog.LOG_ERR, "Cannot stop %sd: %s" % syslog.syslog(
(dogtag_instance, str(e))) syslog.LOG_ERR, "Cannot stop %s: %s" % (dogtag_service.service_name, e))
else:
syslog.syslog(
syslog.LOG_NOTICE, "Stopped %s" % dogtag_service.service_name)

4
ipapython/dogtag.py
View File

@@ -62,6 +62,8 @@ class Dogtag10Constants(object):
SERVICE_PROFILE_DIR = '%s/ca/profiles/ca' % PKI_ROOT SERVICE_PROFILE_DIR = '%s/ca/profiles/ca' % PKI_ROOT
ALIAS_DIR = '/etc/pki/pki-tomcat/alias' ALIAS_DIR = '/etc/pki/pki-tomcat/alias'
SERVICE_NAME = 'pki_tomcatd'
RACERT_LINE_SEP = '\n' RACERT_LINE_SEP = '\n'
IPA_SERVICE_PROFILE = '%s/caIPAserviceCert.cfg' % SERVICE_PROFILE_DIR IPA_SERVICE_PROFILE = '%s/caIPAserviceCert.cfg' % SERVICE_PROFILE_DIR
@@ -92,6 +94,8 @@ class Dogtag9Constants(object):
SERVICE_PROFILE_DIR = '%s/profiles/ca' % PKI_ROOT SERVICE_PROFILE_DIR = '%s/profiles/ca' % PKI_ROOT
ALIAS_DIR = '%s/alias' % PKI_ROOT ALIAS_DIR = '%s/alias' % PKI_ROOT
SERVICE_NAME = 'pki-cad'
RACERT_LINE_SEP = '\r\n' RACERT_LINE_SEP = '\r\n'
ADMIN_SECURE_PORT = 9445 ADMIN_SECURE_PORT = 9445

2
ipapython/platform/base/__init__.py
View File

@@ -27,7 +27,7 @@ import os
wellknownservices = ['certmonger', 'dirsrv', 'httpd', 'ipa', 'krb5kdc', wellknownservices = ['certmonger', 'dirsrv', 'httpd', 'ipa', 'krb5kdc',
'messagebus', 'nslcd', 'nscd', 'ntpd', 'portmap', 'messagebus', 'nslcd', 'nscd', 'ntpd', 'portmap',
'rpcbind', 'kadmin', 'sshd', 'autofs', 'rpcgssd', 'rpcbind', 'kadmin', 'sshd', 'autofs', 'rpcgssd',
'rpcidmapd', 'pki_tomcatd', 'pki-cad', 'chronyd'] 'rpcidmapd', 'pki_tomcatd', 'pki_cad', 'chronyd']
# System may support more time&date services. FreeIPA supports ntpd only, other # System may support more time&date services. FreeIPA supports ntpd only, other
# services will be disabled during IPA installation # services will be disabled during IPA installation

4
ipaserver/install/cainstance.py
View File

@@ -1283,7 +1283,7 @@ class CAInstance(service.Service):
""" """
caconfig = dogtag.install_constants.CS_CFG_PATH caconfig = dogtag.install_constants.CS_CFG_PATH
with stopped_service('pki_tomcatd', with stopped_service(self.dogtag_constants.SERVICE_NAME,
instance_name=self.dogtag_constants.PKI_INSTANCE_NAME): instance_name=self.dogtag_constants.PKI_INSTANCE_NAME):
# Enable file publishing, disable LDAP # Enable file publishing, disable LDAP
@@ -1723,7 +1723,7 @@ def update_cert_config(nickname, cert, dogtag_constants=None):
'subsystemCert cert-pki-ca': 'ca.subsystem.cert', 'subsystemCert cert-pki-ca': 'ca.subsystem.cert',
'Server-Cert cert-pki-ca': 'ca.sslserver.cert'} 'Server-Cert cert-pki-ca': 'ca.sslserver.cert'}
with stopped_service('pki_tomcatd', with stopped_service(dogtag_constants.SERVICE_NAME,
instance_name=dogtag_constants.PKI_INSTANCE_NAME): instance_name=dogtag_constants.PKI_INSTANCE_NAME):
installutils.set_directive(dogtag.configured_constants().CS_CFG_PATH, installutils.set_directive(dogtag.configured_constants().CS_CFG_PATH,