IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Use dedicated keytab for Samba

Browse Source 
Samba just needs the cifs/ key on the ipa server. Configure samba to use a
different keytab file so that we do not risk samba commands (net, or similar)
to mess up the system keytab.

https://fedorahosted.org/freeipa/ticket/2168
This commit is contained in:
Alexander Bokovoy
2012-02-28 13:23:51 +02:00
committed by Martin Kosek
parent b32204fccc
commit dd244c02dd
2 changed files with 19 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
ipaserver/install/adtrustinstance.py
View File

@@ -255,7 +255,10 @@ class ADTRUSTInstance(service.Service):
conf_fd.close()
def __add_cldap_module(self):
self._ldap_mod("ipa-cldap-conf.ldif", self.sub_dict)
try:
self._ldap_mod("ipa-cldap-conf.ldif", self.sub_dict)
except:
pass
def __write_smb_registry(self):
template = os.path.join(ipautil.SHARE_DIR, "smb.conf.template")
@@ -279,21 +282,23 @@ class ADTRUSTInstance(service.Service):
def __setup_principal(self):
cifs_principal = "cifs/" + self.fqdn + "@" + self.realm_name
installutils.kadmin_addprinc(cifs_principal)
self.move_service(cifs_principal)
api.Command.service_add(unicode(cifs_principal))
try:
ipautil.run(["ipa-rmkeytab", "--principal", cifs_principal,
"-k", "/etc/krb5.keytab"])
except ipautil.CalledProcessError, e:
if e.returncode != 5:
root_logger.critical("Failed to remove old key for %s" % cifs_principal)
samba_keytab = "/etc/samba/samba.keytab"
if os.path.exists(samba_keytab):
try:
ipautil.run(["ipa-rmkeytab", "--principal", cifs_principal,
"-k", samba_keytab])
except ipautil.CalledProcessError, e:
root_logger.critical("Result of removing old key: %d" % e.returncode)
if e.returncode != 5:
root_logger.critical("Failed to remove old key for %s" % cifs_principal)
try:
ipautil.run(["ipa-getkeytab", "--server", self.fqdn,
"--principal", cifs_principal,
"-k", "/etc/krb5.keytab"])
"-k", samba_keytab])
except ipautil.CalledProcessError, e:
root_logger.critical("Failed to add key for %s" % cifs_principal)
@@ -368,7 +373,7 @@ class ADTRUSTInstance(service.Service):
try:
self.ldap_enable('ADTRUST', self.fqdn, self.dm_password, \
self.suffix)
except ldap.ALREADY_EXISTS:
except (ldap.ALREADY_EXISTS, errors.DuplicateEntry), e:
root_logger.critical("ADTRUST Service startup entry already exists.")
pass