Contribute, RHEL4 compatible, simple setup script

contrib/RHEL4/ipa-client-setup

@@ -0,0 +1,343 @@
+#! /usr/bin/python -E
+# Authors: Simo Sorce <ssorce@redhat.com>
+#          Karl MacMillan <kmacmillan@mentalrootkit.com>
+#
+# Copyright (C) 2007  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License as
+# published by the Free Software Foundation; version 2 only
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+#
+
+VERSION = "%prog .1"
+
+import sys
+import os
+import string
+import shutil
+import socket
+import logging
+from optparse import OptionParser
+import ipachangeconf
+import ldap
+from ldap import LDAPError
+
+class ipaserver:
+
+    def __init__(self, server):
+        self.server = server
+        self.realm = None
+        self.domain = None
+        self.basedn = None
+
+    def getServerName(self):
+        return str(self.server)
+
+    def getDomainName(self):
+        return str(self.domain)
+
+    def getRealmName(self):
+        return str(self.realm)
+
+    def getBaseDN(self):
+        return str(self.basedn)
+
+    def check(self):
+    
+        lret = []
+        lres = []
+        lattr = ""
+        linfo = ""
+        lrealms = []
+    
+        i = 0
+    
+        #now verify the server is really an IPA server
+        try:
+            logging.debug("Init ldap with: ldap://"+self.server+":389")
+            lh = ldap.initialize("ldap://"+self.server+":389")
+            lh.simple_bind_s("","")
+    
+            logging.debug("Search rootdse")
+            lret = lh.search_s("", ldap.SCOPE_BASE, "(objectClass=*)")
+            for lattr in lret[0][1]:
+                if lattr.lower() == "namingcontexts":
+                    self.basedn = lret[0][1][lattr][0]
+    
+            logging.debug("Search for (info=*) in "+self.basedn+"(base)")
+            lret = lh.search_s(self.basedn, ldap.SCOPE_BASE, "(info=IPA*)")
+            if not lret:
+                return False
+            logging.debug("Found: "+str(lret))
+    
+            for lattr in lret[0][1]:
+                if lattr.lower() == "info":
+                    linfo = lret[0][1][lattr][0].lower()
+                    break
+    
+            if not linfo:
+                return False
+    
+            #search and return known realms
+            logging.debug("Search for (objectClass=krbRealmContainer) in "+self.basedn+"(sub)")
+            lret = lh.search_s("cn=kerberos,"+self.basedn, ldap.SCOPE_SUBTREE, "(objectClass=krbRealmContainer)")
+            if not lret:
+                #something very wrong
+                return False
+            logging.debug("Found: "+str(lret))
+    
+            for lres in lret:
+                for lattr in lres[1]:
+                    if lattr.lower() == "cn":
+                        lrealms.append(lres[1][lattr][0])
+    
+    
+            if len(lrealms) != 1:
+                #which one? we can't attach to a multi-realm server without DNS working
+                return False
+            else:
+                self.realm = lrealms[0]
+                self.domain = lrealms[0].lower()
+                return True
+    
+        except LDAPError, err:
+            #no good
+            logging.error("Ldap Error: "+str(err))
+            return False
+
+ntp_conf = """# Permit time synchronization with our time source, but do not
+# permit the source to query or modify the service on this system.
+restrict default kod nomodify notrap nopeer noquery
+restrict -6 default kod nomodify notrap nopeer noquery
+
+# Permit all access over the loopback interface.  This could
+# be tightened as well, but to do so would effect some of
+# the administrative functions.
+restrict 127.0.0.1 
+restrict -6 ::1
+
+# Hosts on local network are less restricted.
+#restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap
+
+# Use public servers from the pool.ntp.org project.
+# Please consider joining the pool (http://www.pool.ntp.org/join.html).
+server $SERVER
+
+#broadcast 192.168.1.255 key 42		# broadcast server
+#broadcastclient			# broadcast client
+#broadcast 224.0.1.1 key 42		# multicast server
+#multicastclient 224.0.1.1		# multicast client
+#manycastserver 239.255.254.254		# manycast server
+#manycastclient 239.255.254.254 key 42	# manycast client
+
+# Undisciplined Local Clock. This is a fake driver intended for backup
+# and when no outside source of synchronized time is available. 
+server	127.127.1.0	# local clock
+#fudge	127.127.1.0 stratum 10	
+
+# Drift file.  Put this in a directory which the daemon can write to.
+# No symbolic links allowed, either, since the daemon updates the file
+# by creating a temporary in the same directory and then rename()'ing
+# it to the file.
+driftfile /var/lib/ntp/drift
+
+# Key file containing the keys and key identifiers used when operating
+# with symmetric key cryptography. 
+keys /etc/ntp/keys
+
+# Specify the key identifiers which are trusted.
+#trustedkey 4 8 42
+
+# Specify the key identifier to use with the ntpdc utility.
+#requestkey 8
+
+# Specify the key identifier to use with the ntpq utility.
+#controlkey 8
+"""
+
+def config_ntp(server_fqdn):
+
+    nc = string.replace(ntp_conf, "$SERVER", server_fqdn)
+    
+    shutil.copy("/etc/ntp.conf", "/etc/ntp.conf.ipabkp")
+    
+    fd = open("/etc/ntp.conf", "w")
+    fd.write(nc)
+    fd.close()
+
+    # Set the ntpd to start on boot
+    os.system("/sbin/chkconfig ntpd on")
+    
+    # Restart ntpd
+    os.system("/sbin/service ntpd restart")
+
+def parse_options():
+    parser = OptionParser(version=VERSION)
+    parser.add_option("--server", dest="server", help="IPA server")
+    parser.add_option("-d", "--debug", dest="debug", action="store_true",
+                      default=False, help="print debugging information")
+    parser.add_option("-U", "--unattended", dest="unattended",
+                      action="store_true",
+                      help="unattended installation never prompts the user")
+    parser.add_option("-N", "--no-ntp", action="store_false",
+                      help="do not configure ntp", default=True, dest="conf_ntp")
+
+    options, args = parser.parse_args()
+    if not options.server:
+        parser.error("error: must provide an IPA server name with --server")
+
+    return options
+
+def ask_for_confirmation(message):
+    yesno = raw_input(message + " [y/N]: ")
+    if not yesno or yesno.lower()[0] != "y":
+        return False
+    print "\n"
+    return True
+
+def logging_setup(options):
+    # Always log everything (i.e., DEBUG) to the log
+    # file.
+    logger = logging.getLogger('ipa-client-setup')
+    fh = logging.FileHandler('ipaclient-install.log')
+    formatter = logging.Formatter('%(name)-12s: %(levelname)-8s %(message)s')
+    fh.setFormatter(formatter)
+    logger.addHandler(fh)
+    
+    # If the debug option is set, also log debug messages to the console
+    if options.debug:
+        logger.setLevel(logging.DEBUG)
+    else:
+        # Otherwise, log critical and error messages
+        logger.setLevel(logging.ERROR)
+
+    return logger
+
+def main():
+    options = parse_options()
+    logger = logging_setup(options)
+    dnsok = True
+
+    ipasrv = ipaserver(options.server)
+
+    ret = ipasrv.check()
+    if ret == False:
+        print "Failed to verify that ["+options.server+"] is an IPA Server, aborting!"
+        return -1
+
+    print "IPA Server verified."
+    print "Realm: "+ipasrv.getRealmName()
+    print "DNS Domain: "+ipasrv.getDomainName()
+    print "IPA Server: "+ipasrv.getServerName()
+    print "BaseDN: "+ipasrv.getBaseDN()
+
+    print "\n"
+    if not options.unattended and not ask_for_confirmation("Continue to configure the system with these values?"):
+        return 1
+
+    # Configure ipa.conf
+    ipaconf = ipaclient.ipachangeconf.IPAChangeConf("IPA Installer")
+    ipaconf.setOptionAssignment(" = ")
+    ipaconf.setSectionNameDelimiters(("[","]"))
+
+    opts = [{'name':'comment', 'type':'comment', 'value':'File modified by ipa-client-install'},
+            {'name':'empty', 'type':'empty'}]
+
+    #[defaults]
+    defopts = [{'name':'server', 'type':'option', 'value':ipasrv.getServerName()},
+             {'name':'realm', 'type':'option', 'value':ipasrv.getRealmName()}]
+
+    opts.append({'name':'defaults', 'type':'section', 'value':defopts})
+    opts.append({'name':'empty', 'type':'empty'})
+
+    ipaconf.newConf("/etc/ipa/ipa.conf", opts)
+
+    # Configure ldap.conf
+    ldapconf = ipaclient.ipachangeconf.IPAChangeConf("IPA Installer")
+    ldapconf.setOptionAssignment(" ")
+
+    opts = [{'name':'comment', 'type':'comment', 'value':'File modified by ipa-client-install'},
+            {'name':'empty', 'type':'empty'},
+            {'name':'nss_base_passwd', 'type':'option', 'value':ipasrv.getBaseDN()+'?sub'},
+            {'name':'nss_base_group', 'type':'option', 'value':ipasrv.getBaseDN()+'?sub'},
+            {'name':'nss_map_attribute', 'type':'option', 'value':'uniqueMember member'},
+            {'name':'base', 'type':'option', 'value':ipasrv.getBaseDN()},
+            {'name':'ldap_version', 'type':'option', 'value':'3'},
+            {'name':'uri', 'type':'option', 'value':'ldap://'+ipasrv.getServerName()},
+            {'name':'empty', 'type':'empty'}]
+    try:
+        ldapconf.newConf("/etc/ldap.conf", opts)
+    except Exception, e:
+        print "Configuration failed: " + str(e)
+        return 1
+
+    if not "" == ipasrv.getRealmName():
+        #Configure krb5.conf
+        krbconf = ipaclient.ipachangeconf.IPAChangeConf("IPA Installer")
+        krbconf.setOptionAssignment(" = ")
+        krbconf.setSectionNameDelimiters(("[","]"))
+        krbconf.setSubSectionDelimiters(("{","}"))
+        krbconf.setIndent(("","  ","    "))
+
+        opts = [{'name':'comment', 'type':'comment', 'value':'File modified by ipa-client-install'},
+                {'name':'empty', 'type':'empty'}]
+
+        #[libdefaults]
+        libopts = [{'name':'default_realm', 'type':'option', 'value':ipasrv.getRealmName()}]
+        libopts.append({'name':'dns_lookup_realm', 'type':'option', 'value':'false'})
+        libopts.append({'name':'dns_lookup_kdc', 'type':'option', 'value':'false'})
+        libopts.append({'name':'ticket_lifetime', 'type':'option', 'value':'24h'})
+        libopts.append({'name':'forwardable', 'type':'option', 'value':'yes'})
+
+        opts.append({'name':'libdefaults', 'type':'section', 'value':libopts})
+        opts.append({'name':'empty', 'type':'empty'})
+
+        #[realms]
+        kropts =[{'name':'kdc', 'type':'option', 'value':ipasrv.getServerName()+':88'},
+                 {'name':'admin_server', 'type':'option', 'value':ipasrv.getServerName()+':749'},
+                 {'name':'default_domain', 'type':'option', 'value':ipasrv.getDomainName()}]
+        ropts = [{'name':ipasrv.getRealmName(), 'type':'subsection', 'value':kropts}]
+        opts.append({'name':'realms', 'type':'section', 'value':ropts})
+        opts.append({'name':'empty', 'type':'empty'})
+
+        #[domain_realm]
+        dropts = [{'name':'.'+ipasrv.getDomainName(), 'type':'option', 'value':ipasrv.getRealmName()},
+                  {'name':ipasrv.getDomainName(), 'type':'option', 'value':ipasrv.getRealmName()}]
+        opts.append({'name':'domain_realm', 'type':'section', 'value':dropts})
+        opts.append({'name':'empty', 'type':'empty'})
+
+        #[appdefaults]
+        pamopts = [{'name':'debug', 'type':'option', 'value':'false'},
+                   {'name':'ticket_lifetime', 'type':'option', 'value':'36000'},
+                   {'name':'renew_lifetime', 'type':'option', 'value':'36000'},
+                   {'name':'forwardable', 'type':'option', 'value':'true'},
+                   {'name':'krb4_convert', 'type':'option', 'value':'false'}]
+        appopts = [{'name':'pam', 'type':'subsection', 'value':pamopts}]
+        opts.append({'name':'appdefaults', 'type':'section', 'value':appopts})
+
+        krbconf.newConf("/etc/krb5.conf", opts);
+
+    #Modify nsswitch to add nss_ldap
+    os.system("/usr/sbin/authconfig --enableldap --kickstart")
+
+    #Modify pam to add pam_krb5
+    os.system("/usr/sbin/authconfig --enablekrb5 --kickstart")
+
+    if options.conf_ntp:
+        config_ntp(ipasrv.getServerName())
+
+    print "Client configuration complete."
+
+    return 0
+
+sys.exit(main())

contrib/RHEL4/ipachangeconf.py

@@ -0,0 +1,459 @@
+#
+# ipachangeconf - configuration file manipulation classes and functions
+# partially based on authconfig code
+# Copyright (c) 1999-2007 Red Hat, Inc.
+# Author: Simo Sorce <ssorce@redhat.com>
+#
+# This is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; version 2 only
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+#
+
+import fcntl
+import os
+import string
+import time
+import shutil
+
+def openLocked(filename, perms):
+    fd = -1
+    try:
+        fd = os.open(filename, os.O_RDWR | os.O_CREAT, perms)
+        
+        fcntl.lockf(fd, fcntl.LOCK_EX)
+    except OSError, (errno, strerr):
+        if fd != -1:
+            try:
+                os.close(fd)
+            except OSError:
+                pass
+        raise IOError(errno, strerr)
+    return os.fdopen(fd, "r+")
+
+
+    #TODO: add subsection as a concept
+    #      (ex. REALM.NAME = { foo = x bar = y } )
+    #TODO: put section delimiters as separating element of the list
+    #      so that we can process multiple sections in one go
+    #TODO: add a comment all but provided options as a section option
+class IPAChangeConf:
+
+    def __init__(self, name):
+        self.progname = name
+        self.indent = ("","","")
+        self.assign = (" = ","=")
+        self.dassign = self.assign[0]
+        self.comment = ("#",)
+        self.dcomment = self.comment[0]
+        self.eol = ("\n",)
+        self.deol = self.eol[0]
+        self.sectnamdel = ("[","]")
+        self.subsectdel = ("{","}")
+
+    def setProgName(self, name):
+        self.progname = name
+
+    def setIndent(self, indent):
+        if type(indent) is tuple:
+            self.indent = indent
+        elif type(indent) is str:
+            self.indent = (indent, )
+        else:
+           raise ValueError, 'Indent must be a list of strings'
+
+    def setOptionAssignment(self, assign):
+        if type(assign) is tuple:
+            self.assign = assign
+        else:
+            self.assign = (assign, )
+        self.dassign = self.assign[0]
+
+    def setCommentPrefix(self, comment):
+        if type(comment) is tuple:
+            self.comment = comment
+        else:
+            self.comment = (comment, )
+        self.dcomment = self.comment[0]
+
+    def setEndLine(self, eol):
+        if type(eol) is tuple:
+            self.eol = eol
+        else:
+            self.eol = (eol, )
+        self.deol = self.eol[0]
+
+    def setSectionNameDelimiters(self, delims):
+        self.sectnamdel = delims
+
+    def setSubSectionDelimiters(self, delims):
+        self.subsectdel = delims
+
+    def matchComment(self, line):
+        for v in self.comment:
+            if line.lstrip().startswith(v):
+                return line.lstrip()[len(v):]
+        return False
+
+    def matchEmpty(self, line):
+        if line.strip() == "":
+            return True
+        return False
+
+    def matchSection(self, line):
+        cl = "".join(line.strip().split()).lower()
+        if len(self.sectnamdel) != 2:
+            return False
+        if not cl.startswith(self.sectnamdel[0]):
+            return False
+        if not cl.endswith(self.sectnamdel[1]):
+            return False
+        return cl[len(self.sectnamdel[0]):-len(self.sectnamdel[1])]            
+
+    def matchSubSection(self, line):
+        if self.matchComment(line):
+            return False
+
+        parts = line.split(self.dassign, 1)
+        if len(parts) < 2:
+            return False
+
+        if parts[1].strip() == self.subsectdel[0]:
+            return parts[0].strip()
+
+        return False
+
+    def matchSubSectionEnd(self, line):
+        if self.matchComment(line):
+            return False
+
+        if line.strip() == self.subsectdel[1]:
+            return True
+
+        return False
+
+    def getSectionLine(self, section):
+        if len(self.sectnamdel) != 2:
+            return section
+        return self.sectnamdel[0]+section+self.sectnamdel[1]+self.deol
+
+    def dump(self, options, level=0):
+        output = ""
+        if level >= len(self.indent):
+            level = len(self.indent)-1
+
+        for o in options:
+            if o['type'] == "section":
+                output += self.sectnamdel[0]+o['name']+self.sectnamdel[1]+self.deol
+                output += self.dump(o['value'], level+1)
+                continue
+            if o['type'] == "subsection":
+                output += self.indent[level]+o['name']+self.dassign+self.subsectdel[0]+self.deol
+                output += self.dump(o['value'], level+1)
+                output += self.indent[level]+self.subsectdel[1]+self.deol
+                continue
+            if o['type'] == "option":
+                output += self.indent[level]+o['name']+self.dassign+o['value']+self.deol
+                continue
+            if o['type'] == "comment":
+                output += self.dcomment+o['value']+self.deol
+                continue
+            if o['type'] == "empty":
+                output += self.deol
+                continue
+            raise SyntaxError, 'Unknown type: ['+o['type']+']'
+
+        return output
+
+    def parseLine(self, line):
+
+        if self.matchEmpty(line):
+            return {'name':'empty', 'type':'empty'}
+
+        value = self.matchComment(line)
+        if value:
+            return {'name':'comment', 'type':'comment', 'value':value.rstrip()}
+
+        parts = line.split(self.dassign, 1)
+        if len(parts) < 2:
+            raise SyntaxError, 'Syntax Error: Unknown line format'
+
+        return {'name':parts[0].strip(), 'type':'option', 'value':parts[1].rstrip()}
+
+    def findOpts(self, opts, type, name, exclude_sections=False):
+
+        num = 0
+        for o in opts:
+            if o['type'] == type and o['name'] == name:
+                return (num, o)
+            if exclude_sections and (o['type'] == "section" or o['type'] == "subsection"):
+                return (num, None)
+            num += 1
+        return (num, None)
+
+    def commentOpts(self, inopts, level = 0):
+
+        opts = []
+
+        if level >= len(self.indent):
+            level = len(self.indent)-1
+
+        for o in inopts:
+            if o['type'] == 'section':
+                no = self.commentOpts(o['value'], level+1)
+                val = self.dcomment+self.sectnamdel[0]+o['name']+self.sectnamdel[1]
+                opts.append({'name':'comment', 'type':'comment', 'value':val})
+                for n in no:
+                    opts.append(n)
+                continue
+            if o['type'] == 'subsection':
+                no = self.commentOpts(o['value'], level+1)
+                val = self.indent[level]+o['name']+self.dassign+self.subsectdel[0]
+                opts.append({'name':'comment', 'type':'comment', 'value':val})
+                for n in no:
+                    opts.append(n)
+                val = self.indent[level]+self.subsectdel[1]
+                opts.append({'name':'comment', 'type':'comment', 'value':val})
+                continue
+            if o['type'] == 'option':
+                val = self.indent[level]+o['name']+self.dassign+o['value']
+                opts.append({'name':'comment', 'type':'comment', 'value':val})
+                continue
+            if o['type'] == 'comment':
+                opts.append(o)
+                continue
+            if o['type'] == 'empty':
+                opts.append({'name':'comment', 'type':'comment', 'value':''})
+                continue
+            raise SyntaxError, 'Unknown type: ['+o['type']+']'
+
+        return opts
+
+    def mergeOld(self, oldopts, newopts):
+
+        opts = []
+
+        for o in oldopts:
+            if o['type'] == "section" or o['type'] == "subsection":
+                (num, no) = self.findOpts(newopts, o['type'], o['name'])
+                if not no:
+                    opts.append(o)
+                    continue
+                if no['action'] == "set":
+                    mo = self.mergeOld(o['value'], no['value'])
+                    opts.append({'name':o['name'], 'type':o['type'], 'value':mo})
+                    continue
+                if no['action'] == "comment":
+                    co = self.commentOpts(o['value'])
+                    for c in co:
+                        opts.append(c)
+                    continue
+                if no['action'] == "remove":
+                    continue
+                raise SyntaxError, 'Unknown action: ['+no['action']+']'
+
+            if o['type'] == "comment" or o['type'] == "empty":
+                 opts.append(o)
+                 continue
+
+            if o['type'] == "option":
+                (num, no) = self.findOpts(newopts, 'option', o['name'], True)
+                if not no:
+                    opts.append(o)
+                    continue
+                if no['action'] == 'comment' or no['action'] == 'remove':
+                    if no['value'] != None and o['value'] != no['value']:
+                        opts.append(o)
+                        continue
+                    if no['action'] == 'comment':
+                       opts.append({'name':'comment', 'type':'comment',
+                                    'value':self.dcomment+o['name']+self.dassign+o['value']})
+                    continue
+                if no['action'] == 'set':
+                    opts.append(no)
+                    continue
+                raise SyntaxError, 'Unknown action: ['+o['action']+']'
+
+            raise SyntaxError, 'Unknown type: ['+o['type']+']'
+
+        return opts
+
+    def mergeNew(self, opts, newopts):
+
+        cline = 0
+
+        for no in newopts:
+
+            if no['type'] == "section" or no['type'] == "subsection":
+                (num, o) = self.findOpts(opts, no['type'], no['name'])
+                if not o:
+                    if no['action'] == 'set':
+                        opts.append(no)
+                    continue
+                if no['action'] == "set":
+                    self.mergeNew(o['value'], no['value'])
+                    continue
+                cline = num+1
+                continue
+
+            if no['type'] == "option":
+                (num, o) = self.findOpts(opts, no['type'], no['name'], True)
+                if not o:
+                    if no['action'] == 'set':
+                        opts.append(no)
+                    continue
+                cline = num+1
+                continue
+
+            if no['type'] == "comment" or no['type'] == "empty":
+                opts.insert(cline, no)
+                cline += 1
+                continue
+
+            raise SyntaxError, 'Unknown type: ['+no['type']+']'
+
+
+    def merge(self, oldopts, newopts):
+
+        #Use a two pass strategy
+        #First we create a new opts tree from oldopts removing/commenting
+        #  the options as indicated by the contents of newopts
+        #Second we fill in the new opts tree with options as indicated
+        #  in the newopts tree (this is becaus eentire (sub)sections may
+        #  exist in the newopts that do not exist in oldopts)
+
+        opts = self.mergeOld(oldopts, newopts)
+        self.mergeNew(opts, newopts)
+        return opts
+
+    #TODO: Make parse() recursive?
+    def parse(self, f):
+
+        opts = []
+        sectopts = []
+        section = None
+        subsectopts = []
+        subsection = None
+        curopts = opts
+        fatheropts = opts
+
+        # Read in the old file.
+        for line in f:
+
+            # It's a section start.
+            value = self.matchSection(line)
+            if value:
+                if section is not None:
+                    opts.append({'name':section, 'type':'section', 'value':sectopts})
+                sectopts = []
+                curopts = sectopts
+                fatheropts = sectopts
+                section = value
+                continue
+
+            # It's a subsection start.
+            value = self.matchSubSection(line)
+            if value:
+                if subsection is not None:
+                    raise SyntaxError, 'nested subsections are not supported yet'
+                subsectopts = []
+                curopts = subsectopts
+                subsection = value
+                continue
+
+            value = self.matchSubSectionEnd(line)
+            if value:
+                if subsection is None:
+                    raise SyntaxError, 'Unmatched end subsection terminator found'
+                fatheropts.append({'name':subsection, 'type':'subsection', 'value':subsectopts})
+                subsection = None
+                curopts = fatheropts
+                continue
+
+            # Copy anything else as is.
+            curopts.append(self.parseLine(line))
+
+        #Add last section if any
+        if len(sectopts) is not 0:
+            opts.append({'name':section, 'type':'section', 'value':sectopts})
+
+        return opts
+
+    # Write settings to configuration file
+    # file is a path
+    # options is a set of dictionaries in the form:
+    #     [{'name': 'foo', 'value': 'bar', 'action': 'set/comment'}]
+    # section is a section name like 'global'
+    def changeConf(self, file, newopts):
+        autosection = False
+        savedsection = None
+        done = False
+        output = ""
+        f = None
+        try:
+            #Do not catch an unexisting file error, we want to fail in that case
+            shutil.copy2(file, file+".ipabkp")
+
+            f = openLocked(file, 0644)
+
+            oldopts = self.parse(f)
+
+            options = self.merge(oldopts, newopts)
+
+            output = self.dump(options)
+
+            # Write it out and close it.
+            f.seek(0)
+            f.truncate(0)
+            f.write(output)
+        finally:
+            try:
+                if f:
+                    f.close()
+            except IOError:
+                pass
+        return True
+
+    # Write settings to new file, backup old
+    # file is a path
+    # options is a set of dictionaries in the form:
+    #     [{'name': 'foo', 'value': 'bar', 'action': 'set/comment'}]
+    # section is a section name like 'global'
+    def newConf(self, file, options):
+        autosection = False
+        savedsection = None
+        done = False
+        output = ""
+        f = None
+        try:
+            try:
+                shutil.copy2(file, file+".ipabkp")
+            except IOError, err:
+                if err.errno == 2:
+                    # The orign file did not exist
+                    pass
+
+            f = openLocked(file, 0644)
+
+            # Trunkate
+            f.seek(0)
+            f.truncate(0)
+
+            output = self.dump(options)
+
+            f.write(output)
+        finally:
+            try:
+                if f:
+                    f.close()
+            except IOError:
+                pass
+        return True