Use a common group for all DS instances

Also remove the option to choose a user.
It is silly to keep it, when you can't choose the group nor the CA
directory user.

Fixes: https://fedorahosted.org/freeipa/ticket/851

install/tools/ipa-replica-install

@@ -22,6 +22,7 @@ import sys
 import socket
 
 import tempfile, os, pwd, traceback, logging, shutil
+import grp
 from ConfigParser import SafeConfigParser
 
 from ipapython import ipautil
@@ -33,6 +34,7 @@ from ipaserver.plugins.ldap2 import ldap2
 from ipapython import version
 from ipalib import api, errors, util
 from ipapython.config import IPAOptionParser
+from ipapython import sysrestore
 
 CACERT="/etc/ipa/ca.crt"
 
@@ -45,7 +47,6 @@ class ReplicaConfig:
         self.domain_name = ""
         self.master_host_name = ""
         self.dirman_password = ""
-        self.ds_user = ""
         self.host_name = ""
         self.dir = ""
         self.subject_base = ""
@@ -116,7 +117,6 @@ def read_info(dir, rconfig):
 
     rconfig.realm_name = config.get("realm", "realm_name")
     rconfig.master_host_name = config.get("realm", "master_host_name")
-    rconfig.ds_user = config.get("realm", "ds_user")
     rconfig.domain_name = config.get("realm", "domain_name")
     rconfig.host_name = config.get("realm", "destination_host")
     rconfig.subject_base = config.get("realm", "subject_base")
@@ -145,7 +145,7 @@ def resolve_host(host_name):
         return None
 
 def set_owner(config, dir):
-    pw = pwd.getpwnam(config.ds_user)
+    pw = pwd.getpwnam(dsinstance.DS_USER)
     os.chown(dir, pw.pw_uid, pw.pw_gid)
 
 def install_ca(config):
@@ -168,9 +168,13 @@ def install_ca(config):
         sys.exit(1)
 
     cs = cainstance.CADSInstance()
-    cs.create_instance(config.ds_user, config.realm_name, config.host_name, config.domain_name, config.dirman_password)
+    cs.create_instance(config.realm_name, config.host_name,
+                       config.domain_name, config.dirman_password)
     ca = cainstance.CAInstance(config.realm_name, certs.NSS_DIR)
-    ca.configure_instance("pkiuser", config.host_name, config.dirman_password, config.dirman_password, pkcs12_info=(cafile,), master_host=config.master_host_name, subject_base=config.subject_base)
+    ca.configure_instance(config.host_name, config.dirman_password,
+                          config.dirman_password, pkcs12_info=(cafile,),
+                          master_host=config.master_host_name,
+                          subject_base=config.subject_base)
 
     return ca
 
@@ -187,7 +191,7 @@ def install_replica_ds(config):
                        config.dir + "/dirsrv_pin.txt")
 
     ds = dsinstance.DsInstance()
-    ds.create_replica(config.ds_user, config.realm_name,
+    ds.create_replica(config.realm_name,
                       config.master_host_name, config.host_name,
                       config.domain_name, config.dirman_password,
                       pkcs12_info)
@@ -205,7 +209,7 @@ def install_krb(config, setup_pkinit=False):
         pkcs12_info = (config.dir + "/pkinitcert.p12",
                        config.dir + "/pkinit_pin.txt")
 
-    krb.create_replica(config.ds_user, config.realm_name,
+    krb.create_replica(config.realm_name,
                        config.master_host_name, config.host_name,
                        config.domain_name, config.dirman_password,
                        ldappwd_filename, kpasswd_filename,
@@ -339,6 +343,9 @@ def main():
     if not ipautil.file_exists(filename):
         sys.exit("Replica file %s does not exist" % filename)
 
+    global sstore
+    sstore = sysrestore.StateFile('/var/lib/ipa/sysrestore')
+
     # check the bind is installed
     if options.setup_dns:
         check_bind()
@@ -393,6 +400,21 @@ def main():
     api.bootstrap(in_server=True)
     api.finalize()
 
+    # Create DS group if it doesn't exist yet
+    try:
+        grp.getgrnam(dsinstance.DS_GROUP)
+        logging.debug("ds group %s exists" % dsinstance.DS_GROUP)
+        group_exists = True
+    except KeyError:
+        group_exists = False
+        args = ["/usr/sbin/groupadd", "-r", dsinstance.DS_GROUP]
+        try:
+            ipautil.run(args)
+            logging.debug("done adding DS group")
+        except ipautil.CalledProcessError, e:
+            logging.critical("failed to add DS group: %s" % e)
+    sstore.backup_state("install", "group_exists", group_exists)
+
     #Automatically disable pkinit w/ dogtag until that is supported
     #[certs.ipa_self_signed() must be called only after api.finalize()]
     if not ipautil.file_exists(config.dir + "/pkinitcert.p12") and not certs.ipa_self_signed():

install/tools/ipa-replica-prepare

@@ -183,19 +183,13 @@ def export_ra_pkcs12(dir, dm_password):
     finally:
         os.remove(agent_name)
 
-def get_ds_user(ds_dir):
-    uid = os.stat(ds_dir).st_uid
-    user = pwd.getpwuid(uid)[0]
-
-    return user
-
-def save_config(dir, realm_name, host_name, ds_user, domain_name, dest_host,
+def save_config(dir, realm_name, host_name,
+                domain_name, dest_host,
                 subject_base):
     config = SafeConfigParser()
     config.add_section("realm")
     config.set("realm", "realm_name", realm_name)
     config.set("realm", "master_host_name", host_name)
-    config.set("realm", "ds_user", ds_user)
     config.set("realm", "domain_name", domain_name)
     config.set("realm", "destination_host", dest_host)
     config.set("realm", "subject_base", subject_base)
@@ -213,8 +207,8 @@ def copy_files(realm_name, dir):
     config_dir = dsinstance.config_dirname(dsinstance.realm_to_serverid(realm_name))
 
     try:
-        shutil.copy("/var/kerberos/krb5kdc/ldappwd", dir + "/ldappwd") 
-        shutil.copy("/var/kerberos/krb5kdc/kpasswd.keytab", dir + "/kpasswd.keytab") 
+        shutil.copy("/var/kerberos/krb5kdc/ldappwd", dir + "/ldappwd")
+        shutil.copy("/var/kerberos/krb5kdc/kpasswd.keytab", dir + "/kpasswd.keytab")
         shutil.copy("/usr/share/ipa/html/ca.crt", dir + "/ca.crt")
         if ipautil.file_exists("/usr/share/ipa/html/preferences.html"):
             shutil.copy("/usr/share/ipa/html/preferences.html", dir + "/preferences.html")
@@ -281,7 +275,6 @@ def main():
         print "You can't create a replica on itself"
         sys.exit(1)
     ds_dir = dsinstance.config_dirname(dsinstance.realm_to_serverid(api.env.realm))
-    ds_user = get_ds_user(ds_dir)
 
     # get the directory manager password
     dirman_password = options.password
@@ -404,7 +397,7 @@ def main():
     print "Copying additional files"
     copy_files(api.env.realm, dir)
     print "Finalizing configuration"
-    save_config(dir, api.env.realm, api.env.host, ds_user, api.env.domain, replica_fqdn, subject_base)
+    save_config(dir, api.env.realm, api.env.host, api.env.domain, replica_fqdn, subject_base)
 
     replicafile = "/var/lib/ipa/replica-info-" + replica_fqdn
     encfile = replicafile+".gpg"

install/tools/ipa-server-install

@@ -31,7 +31,7 @@ import os
 import socket
 import errno
 import logging
-import pwd
+import grp
 import subprocess
 import signal
 import shutil
@@ -58,8 +58,6 @@ from ipapython.ipautil import *
 from ipalib import api, errors, util
 from ipapython.config import IPAOptionParser
 
-DEF_DS_USER = 'dirsrv'
-
 pw_name = None
 uninstalling = False
 
@@ -68,8 +66,6 @@ def parse_options():
     # Guaranteed to give a random 200k range below the 2G mark (uint32_t limit)
     namespace = random.randint(1, 10000) * 200000
     parser = IPAOptionParser(version=version.VERSION)
-    parser.add_option("-u", "--user", dest="ds_user",
-                      help="ds user")
     parser.add_option("-r", "--realm", dest="realm_name",
                       help="realm name")
     parser.add_option("-n", "--domain", dest="domain_name",
@@ -151,12 +147,10 @@ def parse_options():
         parser.error("You cannot specify a --forwarder option together with --no-forwarders")
 
     if options.uninstall:
-        if (options.ds_user or options.realm_name or
+        if (options.realm_name or
             options.admin_password or options.master_password):
-            parser.error("In uninstall mode, -u, r and -P options are not allowed")
+            parser.error("In uninstall mode, -a, -r and -P options are not allowed")
     elif options.unattended:
-        if not options.ds_user:
-            options.ds_user = DEF_DS_USER
         if (not options.realm_name or
             not options.dm_password or not options.admin_password):
             parser.error("In unattended mode you need to provide at least -r, -p and -a options")
@@ -306,32 +300,6 @@ def resolve_host(host_name):
         print "Unable to lookup the IP address of the provided host"
     return ip
 
-def read_ds_user():
-    print "The server must run as a specific user in a specific group."
-    print "It is strongly recommended that this user should have no privileges"
-    print "on the computer (i.e. a non-root user).  The set up procedure"
-    print "will give this user/group some permissions in specific paths/files"
-    print "to perform server-specific operations."
-    print ""
-
-    ds_user = ""
-    try:
-        pwd.getpwnam(DEF_DS_USER)
-
-        print "A user account named %s already exists." % DEF_DS_USER
-        print "This is the user id that the Directory Server will run as."
-        print ""
-        if user_input("Do you want to use the existing %s account?" % DEF_DS_USER, True):
-            ds_user = DEF_DS_USER
-        else:
-            print ""
-            ds_user = user_input_plain("Which account name do you want to use for the DS instance?", allow_empty = False, allow_spaces = False)
-        print ""
-    except KeyError:
-        ds_user = DEF_DS_USER
-
-    return ds_user
-
 def read_domain_name(domain_name, unattended):
     print "The domain name has been calculated based on the host name."
     print ""
@@ -447,6 +415,18 @@ def uninstall():
         os.remove("/etc/httpd/conf.d/ipa.conf")
     except:
         pass
+
+    group_exists = sstore.restore_state("install", "group_exists")
+    if group_exists == False:
+        try:
+            grp.getgrnam(dsinstance.DS_GROUP)
+            try:
+                ipautil.run(["/usr/sbin/groupdel", dsinstance.DS_GROUP])
+            except ipautil.CalledProcessError, e:
+                logging.critical("failed to delete group %s" % e)
+        except KeyError:
+            logging.info("Group %s already removed", dsinstance.DS_GROUP)
+
     return 0
 
 
@@ -492,6 +472,8 @@ def main():
 
     global fstore
     fstore = sysrestore.FileStore('/var/lib/ipa/sysrestore')
+    global sstore
+    sstore = sysrestore.StateFile('/var/lib/ipa/sysrestore')
 
     # Configuration for ipalib, we will bootstrap and finalize later, after
     # we are sure we have the configuration file ready.
@@ -544,7 +526,6 @@ def main():
     if not options.external_ca:
         check_dirsrv(options.unattended)
 
-    ds_user = ""
     realm_name = ""
     host_name = ""
     domain_name = ""
@@ -629,14 +610,6 @@ def main():
     print "Domain name: " + domain_name
     print ""
 
-    if not options.ds_user:
-        ds_user = read_ds_user()
-        if ds_user == "":
-            sys.exit(1)
-        logging.debug("read ds_user: %s\n" % ds_user)
-    else:
-        ds_user = options.ds_user
-
     if not options.realm_name:
         realm_name = read_realm_name(domain_name, options.unattended)
         logging.debug("read realm_name: %s\n" % realm_name)
@@ -695,6 +668,21 @@ def main():
         print "Please wait until the prompt is returned."
         print ""
 
+    # Create DS group if it doesn't exist yet
+    try:
+        grp.getgrnam(dsinstance.DS_GROUP)
+        logging.debug("ds group %s exists" % dsinstance.DS_GROUP)
+        group_exists = True
+    except KeyError:
+        group_exists = False
+        args = ["/usr/sbin/groupadd", "-r", dsinstance.DS_GROUP]
+        try:
+            ipautil.run(args)
+            logging.debug("done adding DS group")
+        except ipautil.CalledProcessError, e:
+            logging.critical("failed to add DS group: %s" % e)
+    sstore.backup_state("install", "group_exists", group_exists)
+
     # Configure ntpd
     if options.conf_ntp:
         ntp = ntpinstance.NTPInstance(fstore)
@@ -730,21 +718,26 @@ def main():
 
         if options.external_cert_file is None:
             cs = cainstance.CADSInstance()
-            cs.create_instance("pkisrv", realm_name, host_name, domain_name, dm_password)
+            cs.create_instance(realm_name, host_name, domain_name, dm_password)
         ca = cainstance.CAInstance(realm_name, certs.NSS_DIR)
         if external == 0:
-            ca.configure_instance("pkiuser", host_name, dm_password, dm_password, subject_base=options.subject)
+            ca.configure_instance(host_name, dm_password, dm_password,
+                                  subject_base=options.subject)
         elif external == 1:
             options.realm_name = realm_name
             options.domain_name = domain_name
-            options.ds_user = ds_user
             options.master_password = master_password
             options.host_name = host_default
             options.unattended = True
             write_cache(options)
-            ca.configure_instance("pkiuser", host_name, dm_password, dm_password, csr_file="/root/ipa.csr", subject_base=options.subject)
+            ca.configure_instance(host_name, dm_password, dm_password,
+                                  csr_file="/root/ipa.csr",
+                                  subject_base=options.subject)
         else:
-            ca.configure_instance("pkiuser", host_name, dm_password, dm_password, cert_file=options.external_cert_file, cert_chain_file=options.external_ca_file, subject_base=options.subject)
+            ca.configure_instance(host_name, dm_password, dm_password,
+                                  cert_file=options.external_cert_file,
+                                  cert_chain_file=options.external_ca_file,
+                                  subject_base=options.subject)
 
     # Now put the CA cert where other instances exepct it
     ca.publish_ca_cert("/etc/ipa/ca.crt")
@@ -762,11 +755,14 @@ def main():
     if options.dirsrv_pkcs12:
         pkcs12_info = (options.dirsrv_pkcs12, pw_name)
         try:
-            ds.create_instance(ds_user, realm_name, host_name, domain_name, dm_password, pkcs12_info, subject_base=options.subject, hbac_allow=not options.hbac_allow)
+            ds.create_instance(realm_name, host_name, domain_name,
+                               dm_password, pkcs12_info,
+                               subject_base=options.subject,
+                               hbac_allow=not options.hbac_allow)
         finally:
             os.remove(pw_name)
     else:
-        ds.create_instance(ds_user, realm_name, host_name, domain_name,
+        ds.create_instance(realm_name, host_name, domain_name,
                            dm_password, self_signed_ca=options.selfsign,
                            idstart=options.idstart, idmax=options.idmax,
                            subject_base=options.subject,
@@ -786,13 +782,13 @@ def main():
     krb = krbinstance.KrbInstance(fstore)
     if options.pkinit_pkcs12:
         pkcs12_info = (options.pkinit_pkcs12, pw_name)
-        krb.create_instance(ds_user, realm_name, host_name, domain_name,
+        krb.create_instance(realm_name, host_name, domain_name,
                             dm_password, master_password,
                             setup_pkinit=options.setup_pkinit,
                             pkcs12_info=pkcs12_info,
                             subject_base=options.subject)
     else:
-        krb.create_instance(ds_user, realm_name, host_name, domain_name,
+        krb.create_instance(realm_name, host_name, domain_name,
                             dm_password, master_password,
                             setup_pkinit=options.setup_pkinit,
                             self_signed_ca=options.selfsign,