mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-02-25 18:55:28 -06:00
Replace ntpd with chronyd in installation
Completely remove ipaserver/install/ntpinstance.py This is no longer needed as chrony client configuration is now handled in ipa-client-install. Part of ipclient/install/client.py related to ntp configuration has been refactored a bit to not lookup for srv records and/or run chrony if not necessary. Addresses: https://pagure.io/freeipa/issue/7024 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This commit is contained in:
Tibor Dudlák
committed by
Rob Crittenden
Rob Crittenden
parent
0090a90ba2
commit
ca9c4d70a0
@@ -74,8 +74,7 @@ logger = logging.getLogger(__name__)
|
||||
|
||||
# Used to determine install status
|
||||
IPA_MODULES = [
|
||||
'httpd', 'kadmin', 'dirsrv', 'pki-tomcatd', 'install', 'krb5kdc', 'ntpd',
|
||||
'named']
|
||||
'httpd', 'kadmin', 'dirsrv', 'pki-tomcatd', 'install', 'krb5kdc', 'named']
|
||||
|
||||
|
||||
class BadHostError(Exception):
|
||||
|
||||
@@ -131,7 +131,6 @@ class Backup(admintool.AdminTool):
|
||||
paths.RESOLV_CONF,
|
||||
paths.SYSCONFIG_PKI_TOMCAT,
|
||||
paths.SYSCONFIG_DIRSRV,
|
||||
paths.SYSCONFIG_NTPD,
|
||||
paths.SYSCONFIG_KRB5KDC_DIR,
|
||||
paths.SYSCONFIG_IPA_DNSKEYSYNCD,
|
||||
paths.SYSCONFIG_IPA_ODS_EXPORTER,
|
||||
|
||||
@@ -1,172 +0,0 @@
|
||||
# Authors: Karl MacMillan <kmacmillan@redhat.com>
|
||||
# Authors: Simo Sorce <ssorce@redhat.com>
|
||||
#
|
||||
# Copyright (C) 2007-2010 Red Hat
|
||||
# see file 'COPYING' for use and warranty information
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import logging
|
||||
|
||||
from ipaserver.install import service
|
||||
from ipaserver.install import sysupgrade
|
||||
from ipaplatform.constants import constants
|
||||
from ipaplatform.paths import paths
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
NTPD_OPTS_VAR = constants.NTPD_OPTS_VAR
|
||||
NTPD_OPTS_QUOTE = constants.NTPD_OPTS_QUOTE
|
||||
|
||||
NTP_EXPOSED_IN_LDAP = 'exposed_in_ldap'
|
||||
|
||||
|
||||
def ntp_ldap_enable(fqdn, base_dn, realm):
|
||||
ntp = NTPInstance(realm=realm)
|
||||
is_exposed_in_ldap = sysupgrade.get_upgrade_state(
|
||||
'ntp', NTP_EXPOSED_IN_LDAP)
|
||||
|
||||
was_running = ntp.is_running()
|
||||
|
||||
if ntp.is_configured() and not is_exposed_in_ldap:
|
||||
ntp.ldap_enable('NTP', fqdn, None, base_dn)
|
||||
sysupgrade.set_upgrade_state('ntp', NTP_EXPOSED_IN_LDAP, True)
|
||||
|
||||
if was_running:
|
||||
ntp.start()
|
||||
|
||||
|
||||
class NTPInstance(service.Service):
|
||||
def __init__(self, realm=None, fstore=None):
|
||||
super(NTPInstance, self).__init__(
|
||||
"ntpd",
|
||||
service_desc="NTP daemon",
|
||||
realm_name=realm,
|
||||
fstore=fstore
|
||||
)
|
||||
|
||||
def __write_config(self):
|
||||
|
||||
self.fstore.backup_file(paths.NTP_CONF)
|
||||
self.fstore.backup_file(paths.SYSCONFIG_NTPD)
|
||||
|
||||
local_srv = "127.127.1.0"
|
||||
fudge = ["fudge", "127.127.1.0", "stratum", "10"]
|
||||
|
||||
#read in memory, change it, then overwrite file
|
||||
ntpconf = []
|
||||
fd = open(paths.NTP_CONF, "r")
|
||||
for line in fd:
|
||||
opt = line.split()
|
||||
if len(opt) < 2:
|
||||
ntpconf.append(line)
|
||||
continue
|
||||
|
||||
if opt[0] == "server" and opt[1] == local_srv:
|
||||
line = ""
|
||||
elif opt[0] == "fudge":
|
||||
line = ""
|
||||
|
||||
ntpconf.append(line)
|
||||
|
||||
with open(paths.NTP_CONF, "w") as fd:
|
||||
for line in ntpconf:
|
||||
fd.write(line)
|
||||
fd.write("\n### Added by IPA Installer ###\n")
|
||||
fd.write("server {} iburst\n".format(local_srv))
|
||||
fd.write("{}\n".format(' '.join(fudge)))
|
||||
|
||||
#read in memory, find OPTIONS, check/change it, then overwrite file
|
||||
needopts = [ {'val':'-x', 'need':True},
|
||||
{'val':'-g', 'need':True} ]
|
||||
fd = open(paths.SYSCONFIG_NTPD, "r")
|
||||
lines = fd.readlines()
|
||||
fd.close()
|
||||
for line in lines:
|
||||
sline = line.strip()
|
||||
if not sline.startswith(NTPD_OPTS_VAR):
|
||||
continue
|
||||
sline = sline.replace(NTPD_OPTS_QUOTE, '')
|
||||
for opt in needopts:
|
||||
if sline.find(opt['val']) != -1:
|
||||
opt['need'] = False
|
||||
|
||||
newopts = []
|
||||
for opt in needopts:
|
||||
if opt['need']:
|
||||
newopts.append(opt['val'])
|
||||
|
||||
done = False
|
||||
if newopts:
|
||||
fd = open(paths.SYSCONFIG_NTPD, "w")
|
||||
for line in lines:
|
||||
if not done:
|
||||
sline = line.strip()
|
||||
if not sline.startswith(NTPD_OPTS_VAR):
|
||||
fd.write(line)
|
||||
continue
|
||||
sline = sline.replace(NTPD_OPTS_QUOTE, '')
|
||||
(_variable, opts) = sline.split('=', 1)
|
||||
fd.write(NTPD_OPTS_VAR + '="%s %s"\n' % (opts, ' '.join(newopts)))
|
||||
done = True
|
||||
else:
|
||||
fd.write(line)
|
||||
fd.close()
|
||||
|
||||
def __stop(self):
|
||||
self.backup_state("running", self.is_running())
|
||||
self.stop()
|
||||
|
||||
def __start(self):
|
||||
self.start()
|
||||
|
||||
def __enable(self):
|
||||
self.backup_state("enabled", self.is_enabled())
|
||||
self.enable()
|
||||
|
||||
def create_instance(self):
|
||||
|
||||
# we might consider setting the date manually using ntpd -qg in case
|
||||
# the current time is very far off.
|
||||
|
||||
self.step("stopping ntpd", self.__stop)
|
||||
self.step("writing configuration", self.__write_config)
|
||||
self.step("configuring ntpd to start on boot", self.__enable)
|
||||
self.step("starting ntpd", self.__start)
|
||||
|
||||
self.start_creation()
|
||||
|
||||
def uninstall(self):
|
||||
if self.is_configured():
|
||||
self.print_msg("Unconfiguring %s" % self.service_name)
|
||||
|
||||
running = self.restore_state("running")
|
||||
enabled = self.restore_state("enabled")
|
||||
|
||||
# service is not in LDAP, stop and disable service
|
||||
# before restoring configuration
|
||||
self.stop()
|
||||
self.disable()
|
||||
|
||||
try:
|
||||
self.fstore.restore_file(paths.NTP_CONF)
|
||||
except ValueError as error:
|
||||
logger.debug("%s", error)
|
||||
|
||||
if enabled:
|
||||
self.enable()
|
||||
|
||||
if running:
|
||||
self.restart()
|
||||
@@ -169,7 +169,7 @@ class ServerInstallInterface(ServerCertificateInstallInterface,
|
||||
kinit_attempts = 1
|
||||
fixed_primary = True
|
||||
ntp_servers = None
|
||||
force_ntpd = False
|
||||
force_chrony = False
|
||||
permit = False
|
||||
enable_dns_updates = False
|
||||
no_krb5_offline_passwords = False
|
||||
|
||||
@@ -35,7 +35,7 @@ import ipaclient.install.ntpconf
|
||||
from ipaserver.install import (
|
||||
adtrust, bindinstance, ca, dns, dsinstance,
|
||||
httpinstance, installutils, kra, krbinstance,
|
||||
ntpinstance, otpdinstance, custodiainstance, replication, service,
|
||||
otpdinstance, custodiainstance, replication, service,
|
||||
sysupgrade)
|
||||
from ipaserver.install.installutils import (
|
||||
IPA_MODULES, BadHostError, get_fqdn, get_server_ip_address,
|
||||
@@ -386,7 +386,7 @@ def install_check(installer):
|
||||
print(" * Configure a stand-alone CA (dogtag) for certificate "
|
||||
"management")
|
||||
if not options.no_ntp:
|
||||
print(" * Configure the Network Time Daemon (ntpd)")
|
||||
print(" * Configure the NTP client (chronyd)")
|
||||
print(" * Create and configure an instance of Directory Server")
|
||||
print(" * Create and configure a Kerberos Key Distribution Center (KDC)")
|
||||
print(" * Configure Apache (httpd)")
|
||||
@@ -401,7 +401,7 @@ def install_check(installer):
|
||||
if options.no_ntp:
|
||||
print("")
|
||||
print("Excluded by options:")
|
||||
print(" * Configure the Network Time Daemon (ntpd)")
|
||||
print(" * Configure the NTP client (chronyd)")
|
||||
if installer.interactive:
|
||||
print("")
|
||||
print("To accept the default shown in brackets, press the Enter key.")
|
||||
@@ -415,9 +415,9 @@ def install_check(installer):
|
||||
try:
|
||||
ipaclient.install.ntpconf.check_timedate_services()
|
||||
except ipaclient.install.ntpconf.NTPConflictingService as e:
|
||||
print(("WARNING: conflicting time&date synchronization service '%s'"
|
||||
" will be disabled" % e.conflicting_service))
|
||||
print("in favor of ntpd")
|
||||
print("WARNING: conflicting time&date synchronization service '%s'"
|
||||
" will be disabled" % e.conflicting_service)
|
||||
print("in favor of chronyd")
|
||||
print("")
|
||||
except ipaclient.install.ntpconf.NTPConfigurationError:
|
||||
pass
|
||||
@@ -761,13 +761,6 @@ def install(installer):
|
||||
|
||||
# Create a directory server instance
|
||||
if not options.external_cert_files:
|
||||
# Configure ntpd
|
||||
if not options.no_ntp:
|
||||
ipaclient.install.ntpconf.force_ntpd(sstore)
|
||||
ntp = ntpinstance.NTPInstance(fstore)
|
||||
if not ntp.is_configured():
|
||||
ntp.create_instance()
|
||||
|
||||
if options.dirsrv_cert_files:
|
||||
ds = dsinstance.DsInstance(fstore=fstore,
|
||||
domainlevel=options.domainlevel,
|
||||
@@ -793,8 +786,6 @@ def install(installer):
|
||||
hbac_allow=not options.no_hbac_allow,
|
||||
setup_pkinit=not options.no_pkinit)
|
||||
|
||||
ntpinstance.ntp_ldap_enable(host_name, ds.suffix, realm_name)
|
||||
|
||||
else:
|
||||
api.Backend.ldap2.connect()
|
||||
ds = dsinstance.DsInstance(fstore=fstore,
|
||||
@@ -963,10 +954,10 @@ def install(installer):
|
||||
"user-add)")
|
||||
print("\t and the web user interface.")
|
||||
|
||||
if not services.knownservices.ntpd.is_running():
|
||||
if not services.knownservices.chronyd.is_running():
|
||||
print("\t3. Kerberos requires time synchronization between clients")
|
||||
print("\t and servers for correct operation. You should consider "
|
||||
"enabling ntpd.")
|
||||
"enabling chronyd.")
|
||||
|
||||
print("")
|
||||
if setup_ca:
|
||||
@@ -1091,8 +1082,6 @@ def uninstall(installer):
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
ntpinstance.NTPInstance(fstore).uninstall()
|
||||
|
||||
kra.uninstall()
|
||||
|
||||
ca.uninstall()
|
||||
@@ -1121,7 +1110,7 @@ def uninstall(installer):
|
||||
|
||||
sstore._load()
|
||||
|
||||
ipaclient.install.ntpconf.restore_forced_ntpd(sstore)
|
||||
ipaclient.install.ntpconf.restore_forced_chronyd(sstore)
|
||||
|
||||
# Clean up group_exists (unused since IPA 2.2, not being set since 4.1)
|
||||
sstore.restore_state("install", "group_exists")
|
||||
|
||||
@@ -39,8 +39,7 @@ from ipalib.util import no_matching_interface_for_ip_address_warning
|
||||
from ipaclient.install.client import configure_krb5_conf, purge_host_keytab
|
||||
from ipaserver.install import (
|
||||
adtrust, bindinstance, ca, certs, dns, dsinstance, httpinstance,
|
||||
installutils, kra, krbinstance,
|
||||
ntpinstance, otpdinstance, custodiainstance, service)
|
||||
installutils, kra, krbinstance, otpdinstance, custodiainstance, service)
|
||||
from ipaserver.install.installutils import (
|
||||
create_replica_config, ReplicaConfig, load_pkcs12, is_ipa_configured)
|
||||
from ipaserver.install.replication import (
|
||||
@@ -585,7 +584,7 @@ def common_check(no_ntp):
|
||||
ipaclient.install.ntpconf.check_timedate_services()
|
||||
except ipaclient.install.ntpconf.NTPConflictingService as e:
|
||||
print("WARNING: conflicting time&date synchronization service "
|
||||
"'{svc}' will\nbe disabled in favor of ntpd\n"
|
||||
"'{svc}' will\nbe disabled in favor of chronyd\n"
|
||||
.format(svc=e.conflicting_service))
|
||||
except ipaclient.install.ntpconf.NTPConfigurationError:
|
||||
pass
|
||||
@@ -909,7 +908,7 @@ def install_check(installer):
|
||||
|
||||
|
||||
def ensure_enrolled(installer):
|
||||
args = [paths.IPA_CLIENT_INSTALL, "--unattended", "--no-ntp"]
|
||||
args = [paths.IPA_CLIENT_INSTALL, "--unattended"]
|
||||
stdin = None
|
||||
nolog = []
|
||||
|
||||
@@ -946,6 +945,10 @@ def ensure_enrolled(installer):
|
||||
args.append("--mkhomedir")
|
||||
if installer.force_join:
|
||||
args.append("--force-join")
|
||||
if installer.no_ntp:
|
||||
args.append("--no-ntp")
|
||||
else:
|
||||
args.append("--force-chrony")
|
||||
|
||||
try:
|
||||
# Call client install script
|
||||
@@ -1386,11 +1389,9 @@ def install(installer):
|
||||
elif installer._update_hosts_file:
|
||||
installutils.update_hosts_file(config.ips, config.host_name, fstore)
|
||||
|
||||
# Configure ntpd
|
||||
if not options.no_ntp:
|
||||
ipaclient.install.ntpconf.force_ntpd(sstore)
|
||||
ntp = ntpinstance.NTPInstance()
|
||||
ntp.create_instance()
|
||||
if not promote and not options.no_ntp:
|
||||
# in DL1, chrony is already installed
|
||||
ipaclient.install.ntpconf.force_chrony(sstore)
|
||||
|
||||
try:
|
||||
if promote:
|
||||
@@ -1420,8 +1421,6 @@ def install(installer):
|
||||
# Always try to install DNS records
|
||||
install_dns_records(config, options, remote_api)
|
||||
|
||||
ntpinstance.ntp_ldap_enable(config.host_name, ds.suffix,
|
||||
remote_api.env.realm)
|
||||
finally:
|
||||
if conn.isconnected():
|
||||
conn.disconnect()
|
||||
|
||||
@@ -31,7 +31,6 @@ from ipaplatform.paths import paths
|
||||
from ipaserver.install import installutils
|
||||
from ipaserver.install import dsinstance
|
||||
from ipaserver.install import httpinstance
|
||||
from ipaserver.install import ntpinstance
|
||||
from ipaserver.install import bindinstance
|
||||
from ipaserver.install import service
|
||||
from ipaserver.install import cainstance
|
||||
@@ -1735,8 +1734,6 @@ def upgrade_configuration():
|
||||
|
||||
ds.configure_dirsrv_ccache()
|
||||
|
||||
ntpinstance.ntp_ldap_enable(api.env.host, api.env.basedn, api.env.realm)
|
||||
|
||||
ds.stop(ds_serverid)
|
||||
fix_schema_file_syntax()
|
||||
remove_ds_ra_cert(subject_base)
|
||||
|
||||
@@ -51,7 +51,6 @@ SERVICE_LIST = {
|
||||
'DNS': ('named', 30),
|
||||
'HTTP': ('httpd', 40),
|
||||
'KEYS': ('ipa-custodia', 41),
|
||||
'NTP': ('ntpd', 45),
|
||||
'CA': ('pki-tomcatd', 50),
|
||||
'KRA': ('pki-tomcatd', 51),
|
||||
'ADTRUST': ('smb', 60),
|
||||
|
||||
Reference in New Issue
Block a user