IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-09-03 20:52:56 -05:00
Code Issues Packages Projects Releases Wiki Activity
4,813 Commits 11 Branches 63 Tags
1584807e022540af7ca1a89031f18f45194c31ab
Commit Graph
66 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Jan Cholasta afad0775e1 Configure SSH features of SSSD in ipa-client-install. 
OpenSSH server (sshd) is configured to fetch user authorized keys from
SSSD and OpenSSH client (ssh) is configured to use and trigger updates
of the SSSD-managed known hosts file.

This requires SSSD 1.8.0.
 2012-03-01 18:42:56 -05:00
Jan Cholasta 6488378764 Move the compat module from ipalib to ipapython. 
Fixes import problems trying to import just ipalib/compat.py.

https://fedorahosted.org/freeipa/ticket/754
 2012-02-13 22:22:49 -05:00
Jan Cholasta e5c0750806 Add SSH service to platform-specific services. 
Add method for getting configuration directory path of a service,
so that a different SSH configuration directory can be specified on
different platforms.

https://fedorahosted.org/freeipa/ticket/754
 2012-02-13 22:21:54 -05:00
Jan Cholasta ca3f304110 Base64-decode unicode values in Bytes parameters. 
Fix wrong handling of strings in --setattr/--addattr/--delattr.

These changes make it possible to use Bytes in --setattr/--addattr/
--delattr without errors.

Fixes managing SSH keys on command-line

https://fedorahosted.org/freeipa/ticket/754
 2012-02-13 22:21:50 -05:00
Jan Cholasta c00bf9e38a Configure ssh and sshd during ipa-client-install. 
For ssh, VerifyHostKeyDNS option is set to 'yes' if --ssh-trust-dns
ipa-client-install option is used.

For sshd, KerberosAuthentication, GSSAPIAuthentication and UsePAM
options are enabled (this can be disabled using --no-sshd
ipa-client-install option).

ticket 1634
 2012-02-13 22:21:47 -05:00
Jan Cholasta c34f5fbc88 Update host SSH public keys on the server during client install. 
This is done by calling host-mod to update the keys on IPA server and nsupdate
to update DNS SSHFP records. DNS update can be disabled using --no-dns-sshfp
ipa-client-install option.

https://fedorahosted.org/freeipa/ticket/1634
 2012-02-13 22:21:43 -05:00
Jan Cholasta 9b6649a1ce Move the nsupdate functionality to separate function in ipa-client-install. 
Done as part of adding SSH support.

https://fedorahosted.org/freeipa/ticket/1634
 2012-02-13 22:21:38 -05:00
Jan Cholasta 04b8575c52 Add API initialization to ipa-client-install. 
This change makes it possible to call IPA commands from ipa-client-install.

Done to support adding SSH host keys to DNS.

https://fedorahosted.org/freeipa/ticket/1634
 2012-02-13 22:21:35 -05:00
Jan Cholasta 3c2b0fc28a Add support for SSH public keys to user and host objects. 
This patch adds a new multivalue param "sshpubkey" for specifying SSH public
keys to both user and host objects. The accepted value is base64-encoded
public key blob as specified in RFC4253, section 6.6.

Additionaly, host commands automatically update DNS SSHFP records when
requested by user.

https://fedorahosted.org/freeipa/ticket/754
 2012-02-13 22:21:27 -05:00
Jan Cholasta 9b6baf9bee Add LDAP ACIs for SSH public key schema. 
https://fedorahosted.org/freeipa/ticket/754
 2012-02-13 22:20:23 -05:00
Jan Cholasta 63ea0a304e Add LDAP schema for SSH public keys. 
https://fedorahosted.org/freeipa/ticket/754
 2012-02-13 22:20:18 -05:00
Jan Cholasta 9beb467d98 Fix attempted write to attribute of read-only object. 
Add new class "cachedproperty" for creating property-like attributes
that cache the return value of a method call.

Also fix few issues in the unit tests to enable them to succeed.

ticket 1959
 2012-01-02 11:51:26 +03:00
Jan Cholasta 27931dcb29 Fix make-lint crash under certain circumstances. 
ticket 2136
 2011-11-30 17:09:22 +01:00
Jan Cholasta 135ccf89de Parse comma-separated lists of values in all parameter types. This can be enabled for a specific parameter by setting the "csv" option to True. 
Remove "List" parameter type and replace all occurences of it with appropriate
multi-valued parameter ("Str" in most cases) with csv enabled.

Add new parameter type "Any", capable of holding values of any type. This is
needed by the "batch" command, as "Str" is not suitable type for the "methods"
parameter.

ticket 2007
 2011-11-30 17:08:35 +01:00
Jan Cholasta e7a6d10555 Finalize plugin initialization on demand. 
This patch changes the way plugins are initialized. Instead of
finalizing all the plugins at once, plugins are finalized only after
they are accessed (currently applies to Command, Object and
Attribute subclasses, only in CLI by default).

This change provides significant performance boost, as only the
plugins that are actually used are finalized.

ticket 1336
 2011-11-22 00:52:24 -05:00
Jan Cholasta 592bf62161 Remove more redundant configuration values from krb5.conf. 
ticket 1358
 2011-10-11 22:00:50 -04:00
Jan Cholasta 0d823ddc4e Don't leak passwords through kdb5_ldap_util command line arguments. 
ticket 1948
 2011-10-11 21:25:17 -04:00
Jan Cholasta c0879cd00b Disallow deletion of global password policy. 
ticket 1936
 2011-10-12 10:12:49 +02:00
Jan Cholasta 209bcb0b98 Work around pkisilent bugs. 
Check directory manager password and certificate subject base for
invalid characters.
(https://bugzilla.redhat.com/show_bug.cgi?id=658641)

Shell-escape pkisilent command-line arguments.
(https://bugzilla.redhat.com/show_bug.cgi?id=741180)

ticket 1636
 2011-10-04 20:12:58 -04:00
Jan Cholasta 12bfed37d4 Add a function for formatting network locations of the form host:port for use in URLs. 
If the host part is a literal IPv6 address, it must be enclosed in square
brackets (RFC 2732).

ticket 1869
 2011-10-05 10:58:25 +02:00
Jan Cholasta 48a67d9a2e Validate name_from_ip parameter of dnszone. 
ticket 1627
 2011-10-04 09:25:44 +02:00
Jan Cholasta 5cd121d6dd Fix ipa-replica-prepare always warning the user about not using the system hostname. 
ticket 1717
 2011-09-26 17:11:09 +02:00
Jan Cholasta 7854d8166e Fix client install on IPv6 machines. 
ticket 1804
 2011-09-19 18:11:24 +02:00
Jan Cholasta b43a38e9cb Check that install hostname matches the server hostname. 
ticket 1717
 2011-09-14 22:42:05 -04:00
Jan Cholasta 610faff6f3 Verify that the external CA certificate files are correct. 
ticket 1572
 2011-08-23 01:23:41 -04:00
Jan Cholasta 9b0fa8debf Add subscription-manager dependency for RHEL. 
ticket 1664
 2011-08-23 00:27:30 -04:00
Jan Cholasta a797f907ee Search for users in all the naming contexts present on the directory server. 
ticket 1655, 1656
 2011-08-22 19:04:29 -04:00
Jan Cholasta b8d4f8ad9f Add option to install without the automatic redirect to the Web UI. 
ticket 1570
 2011-08-18 23:24:29 -04:00
Jan Cholasta cc7f9aa7a9 Verify that passwords specified through command line options of ipa-server-install meet the length requirement. 
ticket 1621
 2011-08-18 20:49:05 -04:00
Jan Cholasta 1ec531469e Make sure messagebus is running prior to starting certmonger. 
ticket 1580
 2011-08-18 20:15:48 -04:00
Jan Cholasta 8edd7ed998 Ask for reverse DNS zone information in attended install right after asking for DNS forwarders, so that DNS configuration is done in one place. 
ticket 1522
 2011-08-09 13:12:19 +02:00
Jan Cholasta a2641254fe Fix external CA install. 
ticket 1523
 2011-07-26 22:30:21 -04:00
Jan Cholasta 9e7a3e7f3c Make sure that hostname specified by user is not an IP address. 
ticket 1375
 2011-07-25 01:47:52 -04:00
Jan Cholasta df7ee2ccf5 Fix ipa-compat-manage not working after recent ipa-nis-manage change. 
ticket 1147
 2011-07-22 10:38:49 +02:00
Jan Cholasta c1f5dadc4e Don't delete NIS netgroup compat suffix on 'ipa-nis-manage disable'. 
ticket 1469
 2011-07-19 13:45:01 +02:00
Jan Cholasta c09f116f43 Clean up of IP address checks in install scripts. 
Fixes ipa-dns-install incorrect warning.

ticket 1486
 2011-07-19 12:30:47 +02:00
Jan Cholasta 95901bbdb5 Update minimum required version of python-netaddr. 
ticket 1288
 2011-07-17 22:44:21 -04:00
Jan Cholasta 5f0adc3fbe Fix exit status of ipa-nis-manage enable. 
ticket 1247
 2011-07-15 02:39:17 -04:00
Jan Cholasta b203756a88 Add ability to specify DNS reverse zone name by IP network address. 
In order for this to work, chaining of parameters through
default_from is made possible.

ticket 1474
 2011-07-15 02:21:23 -04:00
Jan Cholasta 881df73568 Fix creation of reverse DNS zones. 
Create reverse DNS zone for /24 IPv4 subnet and /64 IPv6 subnet by
default instead of using the netmask from the --ip-address option.

Custom reverse DNS zone can be specified using new --reverse-zone
option, which replaces the old --ip-address netmask way of creating
reverse zones.

The reverse DNS zone name is printed to the user during the install.

ticket 1398
 2011-07-15 16:42:16 +02:00
Jan Cholasta 1c5028c17d Configure SSSD to store user password if offline. 
ticket 1359
 2011-07-14 19:26:25 -04:00
Jan Cholasta 67b807d640 Replace the 'private' option in netgroup-find with 'managed'. 
The 'private' option is kept in to maintain API compatibility, but
is hidden from the user.

ticket 1120
 2011-06-28 01:57:11 -04:00
Jan Cholasta f05141e646 Remove redundant configuration values from krb5.conf. 
ticket 1358
 2011-06-28 01:10:06 -04:00
Jan Cholasta 3656d9be3c Verify that the hostname is fully-qualified before accessing the service information in ipactl. 
Fail gracefully if the supplied hostname isn't fully-qualified in
ipa-server-install.

ticket 1035
 2011-06-24 01:23:14 -04:00
Jan Cholasta 574d07be1f Improve IP address handling in the host-add command. 
IP addresses are more strictly checked. Netmasks can be specified
and are used in DNS PTR record creation.

ticket 1234
 2011-06-19 20:44:19 -04:00
Jan Cholasta d2b483cbb3 Fix directory manager password validation in ipa-nis-manage. 
ticket 1283, 1284
 2011-06-13 12:59:22 +02:00
Jan Cholasta fd639bc88c Do stricter checking of IP addressed passed to server install. 
ticket 1213
 2011-05-30 13:38:46 +02:00
Jan Cholasta db78f36235 Honor netmask in DNS reverse zone setup. 
ticket 910
 2011-05-30 13:37:03 +02:00
Jan Cholasta 80b4b3d44b Parse netmasks in IP addresses passed to server install. 
ticket 1212
 2011-05-30 13:36:26 +02:00
Jan Cholasta 6c66d37655 Assume ipa help for plugins. 
ticket 914
 2011-05-13 13:25:34 -04:00
Jan Cholasta 3edb8ed545 Fix regressions introduced by pylint false positive fixes. 
ticket 1198
 2011-05-11 16:50:01 +02:00
Jan Cholasta 16d1db4996 Fix issues found by Coverity. 
tickets 1166, 1167, 1168, 1169
 2011-05-09 16:23:40 -04:00
Jan Cholasta 7e0d4531c3 Several improvements of the lint script. 
Report missing python packages, inform about false positives, fail
gracefully if pylint isn't installed. Fixed a bug in the ignore
list and added few more files/directories to it.

ticket 1184
 2011-05-05 11:54:07 +02:00
Jan Cholasta 88353edcb1 Run lint during each build. 
ticket 1180
 2011-05-05 11:52:45 +02:00
Jan Cholasta 5700920627 Fix uninitialized attributes. 2011-04-21 10:41:29 +02:00
Jan Cholasta c31d7b9ad6 Fix some minor issues uncovered by pylint. 
Disable pylint error _ undefined in i18n tests
Fix missing os import in ipa-nis-manage
 2011-04-20 14:38:02 -04:00
Jan Cholasta f8cb129b93 Remove unused classes. 
Removed NSPRConnection and NSPRHTTP from ipapython.nsslib, as they
are not used anywhere in FreeIPA.
 2011-04-20 14:36:32 -04:00
Jan Cholasta 1ac3ed2c27 Fix lint false positives. 2011-04-13 15:58:45 +02:00
Jan Cholasta fb329bc8b0 Add lint script for static code analysis. 
ticket 867
 2011-04-13 15:43:47 +02:00
Jan Cholasta b007233470 Fix double definition of output_for_cli. 2011-04-13 12:09:45 +02:00
Jan Cholasta 267f39dcea Fix uninitialized variables. 2011-04-13 11:59:04 +02:00
Jan Cholasta df8120702a Fix typo in ipa-server-install. 2011-04-08 09:27:01 +02:00
Jan Cholasta 7515fd5563 Add note about ipa-dns-install to ipa-server-install man page. 
ticket 1082
 2011-03-31 16:38:43 -04:00
Jan Cholasta b29bd47273 Fix wording of error message. 
ticket 1009
 2011-03-29 13:47:06 -04:00
Jan Cholasta 06be021c72 Fix handling of /etc/hosts 
ticket 971
 2011-02-15 15:39:26 -05:00
Jan Cholasta 8c1647af2e Remove unnecessary BuildRequires from the specfile. 2011-02-10 13:47:45 -05:00