Commit Graph

225 Commits

Author SHA1 Message Date
Petr Viktorin
5824a0e14e ipa-client-install: Verify RPC connection with a ping
With old servers, it is possible that xmlclient.connect() succeeds
but commands fail with a Kerberos error.

Verify that commands succeed by sending a ping after connecting.

Follow-up to: https://fedorahosted.org/freeipa/ticket/3931
2013-10-04 15:33:58 +02:00
Petr Viktorin
e01a28b584 ipa-client-install: Use direct RPC instead of api.Command
To make sure the installation works with older servers,
use XML-RPC directly, with a version set explicitly so the request
is not rejected.

RPC was chosen over ldapmodify, because going through the API allows
the server to process the request properly, or even cleanly reject
it if there are incompatible changes in future versions.

https://fedorahosted.org/freeipa/ticket/3931
2013-10-04 15:33:58 +02:00
Martin Kosek
7d2d1cb59d Do not set DNS discovery domain in server mode
In server mode, the discovery domain should be left unset in all
cases as the DNS discovery is only driven by the AD domains.

https://fedorahosted.org/freeipa/ticket/3947
2013-10-03 15:22:09 +02:00
Tomas Babej
316a9c2159 Use getent admin@domain for nss check in ipa-client-install
Use 'getent admin@domain' rather than 'getent admin@REALM' to check if nss
is working properly since admin@REALM check fails in case the domain and the realm
name does not match.

https://fedorahosted.org/freeipa/ticket/3906
2013-09-20 09:56:27 +02:00
Ana Krivokapic
66242e6ab0 Fix invocations of FileError in ipa-client-install
Some of the FileErrors in ipa-client-install were raised incorrectly
(without the 'reason' argument), which resulted in bad error messages
during ipa-client-install.

https://fedorahosted.org/freeipa/ticket/3758
2013-09-09 14:20:17 +02:00
Ana Krivokapic
95483d3b9f Add option to ipa-client-install to configure automount
Add the --automount-location option to ipa-client-install. If the option is
used, ipa-client-automount is called at the end of ipa-client-install.

https://fedorahosted.org/freeipa/ticket/3740
2013-09-05 12:43:52 +02:00
Tomas Babej
8a41b64a8c Change shebang to absolute path in ipa-client-automount
https://fedorahosted.org/freeipa/ticket/3811
2013-07-25 15:27:37 +02:00
Ana Krivokapic
8a22bce242 Use admin@REALM when testing if SSSD is ready
https://fedorahosted.org/freeipa/ticket/3771
2013-07-19 12:37:43 +02:00
Ana Krivokapic
595de183a7 Add 'ipa_server_mode' option to SSSD configuration
https://fedorahosted.org/freeipa/ticket/3652
2013-07-18 17:49:23 +02:00
Nathaniel McCallum
784f484cad Fix client install exception if /etc/ssh is missing
https://fedorahosted.org/freeipa/ticket/3766
2013-07-09 12:07:25 -04:00
Jan Cholasta
736dd0fcd6 Do not skip SSSD known hosts in ipa-client-install --ssh-trust-dns.
https://fedorahosted.org/freeipa/ticket/3705
2013-06-27 08:48:40 +02:00
Ana Krivokapic
caf40e76cd Improve handling of options in ipa-client-install
Improve handling of command line options related to forced client re-enrollment
in ipa-client-install:

* Make --keytab and --principal options mutually exclusive.
* Warn that using --force-join together with --keytab provides no additional
  functionality.

https://fedorahosted.org/freeipa/ticket/3686
2013-06-20 12:24:01 +02:00
Petr Spacek
9fbdf9f51f ipa-client-install: Add 'debug' and 'show' statements to nsupdate commands
https://fedorahosted.org/freeipa/ticket/3629
2013-05-22 12:29:47 +02:00
Rob Crittenden
bfdcc7c62d Drop uniqueMember mapping with nss-pam-ldapd.
nss-pam-ldapd in 0.8.4 changed the default to map uniqueMember to
member so it is no longer needed in the config file, and in fact
causes an error to be raised.

Add a Conflicts on older versions.

https://fedorahosted.org/freeipa/ticket/3589
2013-05-02 10:43:10 -04:00
Jan Cholasta
ddd8988f1c Add support for OpenSSH 6.2.
Run sss_ssh_authorizedkeyscommand as nobody. Automatically update sshd_config
on openssh-server update.

https://fedorahosted.org/freeipa/ticket/3571
2013-04-30 11:05:39 -04:00
Tomas Babej
5d6a9d3bef Preserve already configured options in openldap conf
We should respect already configured options present in
/etc/openldap/ldap.conf when generating our own configuration.

With this patch, we only rewrite URI, BASE and TLS_CACERT options
only if they are not configured. In the case they are, our suggested
configuration is inserted as a comment.

Also adds tab as a delimeter character in /etc/openldap/ldap.conf

https://fedorahosted.org/freeipa/ticket/3582
2013-04-30 10:54:10 -04:00
Tomas Babej
40966cbe63 Avoid removing sss from nssswitch.conf during client uninstall
This patch makes sure that sss is not removed from nsswitch.conf
which causes probles with later uses of sssd. Makes sure that
authconfig with --disablesssd option is not executed during
ipa client uninstall.

https://fedorahosted.org/freeipa/ticket/3577
2013-04-23 16:14:25 -04:00
Tomas Babej
6e8d311dac Add hint message about --force-join option when enrollment fails
When client enrollment fails due to the fact that host entry
already exists on the server, display an message informing the
user about the possibility of using --force-join option.

https://fedorahosted.org/freeipa/ticket/3572
2013-04-23 16:11:31 -04:00
Ana Krivokapic
2a8f1b0b16 Handle missing /etc/ipa in ipa-client-install
Make sure /etc/ipa is created and owned by freeipa-python package.

Report correct error to user if /etc/ipa is missing during client installation.

https://fedorahosted.org/freeipa/ticket/3551
2013-04-19 10:57:07 -04:00
Ana Krivokapic
43fc525fbb Remove CA cert on client uninstall
The CA cert (/etc/ipa/ca.crt) was not being removed
on client uninstall, causing failure on subsequent client
installation in some cases.

https://fedorahosted.org/freeipa/ticket/3537
2013-04-04 12:50:08 +02:00
Petr Viktorin
67c7bd3060 ipa-client-install: Do not request host certificate if server is CA-less
https://fedorahosted.org/freeipa/ticket/3536
2013-04-02 15:28:51 +02:00
Tomas Babej
a7ccc198a7 Allow host re-enrollment using delegation
A new option --force-join has been added to ipa-client-install.
It forces the host enrollment even if the host entry exists.
Old certificate is revoked, new certificate and ssh key pair
generated. See the relevant design for the re-enrollment part:
http://freeipa.org/page/V3/Forced_client_re-enrollment

https://fedorahosted.org/freeipa/ticket/3482
2013-03-25 10:53:25 +01:00
Martin Kosek
1336b39906 Improve client install LDAP cert retrieval fallback
CA certificate retrieval function did not fallback from LDAP to
HTTP based retrieval in case of an LDAP error, when for example
GSSAPI authentication failed.

https://fedorahosted.org/freeipa/ticket/3512
2013-03-21 16:12:12 +01:00
Martin Kosek
6540eff468 Use temporary CCACHE in ipa-client-install
ipa-client-install failed if user had set his own KRB5CCNAME in his
environment. Use a temporary CCACHE for the installer to avoid these
kind of errors.

https://fedorahosted.org/freeipa/ticket/3512
2013-03-21 16:12:12 +01:00
Martin Kosek
354a5db38e Avoid multiple client discovery with fixed server list
In client discovery module, we used to run up to three discovery
processes even though we received a fixed list of servers to connect
to. This could result in up to 3 identical "not an IPA server" error
messages when the passed server is not an IPA server.

Error out immediately when we are discovering against a fixed set
of servers.

Related to fixes in https://fedorahosted.org/freeipa/ticket/3418
2013-03-14 09:35:25 +01:00
Tomas Babej
ade4aaef9a Make sure uninstall script prompts for reboot as last
Parts of client uninstall logic could be skipped in attended
uninstallation if user agreed to reboot the machine. Particulary,
the uninstall script would not try to remove /etc/ipa/default.conf
and therefore subsequent installation would fail, client being
detected as already configured.

https://fedorahosted.org/freeipa/ticket/3462
https://fedorahosted.org/freeipa/ticket/3463
2013-03-13 16:53:19 +01:00
Petr Viktorin
a0242334fe Use IPAdmin rather than raw python-ldap in ipa-client-install
Part of the work for: https://fedorahosted.org/freeipa/ticket/3487
2013-03-13 12:36:33 +01:00
Tomas Babej
a38d93f65f Add support for re-enrolling hosts using keytab
A host that has been recreated  and does not have its
host entry disabled or removed, can be re-enrolled using
a previously backed up keytab file.

A new option --keytab has been added to ipa-client-install. This
can be used to specify path to the keytab and can be used instead
of -p or -w options.

A new option -f has been added to ipa-join. It forces client to
join even if the host entry already exits. A new certificate,
ssh keys are generated, ipaUniqueID stays the same.

Design page: http://freeipa.org/page/V3/Client_install_using_keytab

https://fedorahosted.org/freeipa/ticket/3374
2013-03-12 15:13:09 +01:00
Tomas Babej
a7110d7a32 Use default.conf as flag of IPA client being installed
When installing / uninstalling IPA client, the checks that
determine whether IPA client is installed now take the existence
of /etc/ipa/default.conf into consideration.

The client will not uninstall unless either something is backed
up or /etc/ipa/default.conf file does exist.

The client will not install if something is backed up or
default.conf file does exist (unless it's installation on master).

https://fedorahosted.org/freeipa/ticket/3331
2013-02-22 10:13:41 +01:00
Rob Crittenden
cbb262dc07 Add LDAP server fallback to client installer
Change the discovery code to validate all servers, regardless of where
the originated (either via SRV records or --server). This will prevent
the client installer from failing if one of those records points to a
server that is either not running or is not an IPA server.

If a server is not available it is not removed from the list of configured
servers, simply moved to the end of the list.

If a server is not an IPA server it is removed.

https://fedorahosted.org/freeipa/ticket/3388
2013-02-07 16:49:31 -05:00
Jan Cholasta
86dde3a38e Add support for RFC 6594 SSHFP DNS records.
https://fedorahosted.org/freeipa/ticket/2642
2013-02-01 09:16:09 -05:00
Jan Cholasta
77bb4b5177 Pylint cleanup.
Add more dynamic attribute info to IPATypeChecker in make-lint. Remove
unnecessary pylint comments. Fix false positivies introduced by Pylint 0.26.

https://fedorahosted.org/freeipa/ticket/3379
2013-01-29 15:39:49 +01:00
Rob Crittenden
31e41eea6c Don't initialize NSS if we don't have to, clean up unused cert refs
Check to see if NSS is initialized before trying to do so again.

If we are temporarily creating a certificate be sure to delete it in order
to remove references to it and avoid NSS shutdown issues.

In the certificate load validator shut down NSS if we end up initializing
it. I'm not entirely sure why but this prevents a later shutdown issue
if we are passed the --ca-cert-file option.
2013-01-23 14:26:42 -05:00
John Dennis
a1991aeac1 Use secure method to acquire IPA CA certificate
Major changes ipa-client-install:

* Use GSSAPI connection to LDAP server to download CA cert (now
  the default method)

* Add --ca-cert-file option to load the CA cert from a disk file.
  Validate the file. If this option is used the supplied CA cert
  is considered definitive.

* The insecure HTTP retrieval method is still supported but it must be
  explicitly forced and a warning will be emitted.

* Remain backward compatible with unattended case (except for aberrant
  condition when preexisting /etc/ipa/ca.crt differs from securely
  obtained CA cert, see below)

* If /etc/ipa/ca.crt CA cert preexists the validate it matches the
  securely acquired CA cert, if not:

  - If --unattended and not --force abort with error

  - If interactive query user to accept new CA cert, if not abort

  In either case warn user.

* If interactive and LDAP retrieval fails prompt user if they want to
  proceed with insecure HTTP method

* If not interactive and LDAP retrieval fails abort unless --force

* Backup preexisting /etc/ipa/ca.crt in FileStore prior to execution,
  if ipa-client-install fails it will be restored.

Other changes:

* Add new exception class CertificateInvalidError

* Add utility convert_ldap_error() to ipalib.ipautil

* Replace all hardcoded instances of /etc/ipa/ca.crt in
  ipa-client-install with CACERT constant (matches existing practice
  elsewhere).

* ipadiscovery no longer retrieves CA cert via HTTP.

* Handle LDAP minssf failures during discovery, treat failure to check
  ldap server as a warninbg in absebce of a provided CA certificate via
  --ca-cert-file or though existing /etc/ipa/ca.crt file.

Signed-off-by: Simo Sorce <simo@redhat.com>
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
2013-01-23 14:26:42 -05:00
Martin Kosek
b3ea7d2d62 Enable SSSD on client install
authconfig component changed its behavior. It no longer starts and
enables SSSD daemon when --enablesssd and --enablesssdauth options
are used. It only enables the PAM module and adds SSSD to nsswitch.

Enable SSSD on new client/server installs manually. Also make sure
that we stop&disable SSSD when we delete the configuration.

https://fedorahosted.org/freeipa/ticket/3307
2012-12-18 17:48:59 +01:00
John Dennis
9269e5d6dd Compliant client side session cookie behavior
In summary this patch does:

* Follow the defined rules for cookies when:

  - receiving a cookie (process the attributes)

  - storing a cookie (store cookie + attributes)

  - sending a cookie

    + validate the cookie domain against the request URL

    + validate the cookie path against the request URL

    + validate the cookie expiration

    + if valid then send only the cookie, no attribtues

* Modifies how a request URL is stored during a XMLRPC
  request/response sequence.

* Refactors a bit of the request/response logic to allow for making
  the decision whether to send a session cookie instead of full
  Kerberous auth easier.

* The server now includes expiration information in the session cookie
  it sends to the client. The server always had the information
  available to prevent using an expired session cookie. Now that
  expiration timestamp is returned to the client as well and now the
  client will not send an expired session cookie back to the server.

* Adds a new module and unit test for cookies (see below)

Formerly we were always returning the session cookie no matter what
the domain or path was in the URL. We were also sending the cookie
attributes which are for the client only (used to determine if to
return a cookie). The attributes are not meant to be sent to the
server and the previous behavior was a protocol violation. We also
were not checking the cookie expiration.

Cookie library issues:

We need a library to create, parse, manipulate and format cookies both
in a client context and a server context. Core Python has two cookie
libraries, Cookie.py and cookielib.py. Why did we add a new cookie
module instead of using either of these two core Python libaries?

Cookie.py is designed for server side generation but can be used to
parse cookies on the client. It's the library we were using in the
server. However when I tried to use it in the client I discovered it
has some serious bugs. There are 7 defined cookie elements, it fails
to correctly parse 3 of the 7 elements which makes it unusable because
we depend on those elements. Since Cookie.py was designed for server
side cookie processing it's not hard to understand how fails to
correctly parse a cookie because that's a client side need. (Cookie.py
also has an awkward baroque API and is missing some useful
functionality we would have to build on top of it).

cookielib.py is designed for client side. It's fully featured and obeys
all the RFC's. It would be great to use however it's tightly coupled
with another core library, urllib2.py. The http request and response
objects must be urllib2 objects. But we don't use urllib2, rather we use
httplib because xmlrpclib uses httplib. I don't see a reason why a
cookie library should be so tightly coupled to a protocol library, but
it is and that means we can't use it (I tried to just pick some isolated
entrypoints for our use but I kept hitting interaction/dependency problems).

I decided to solve the cookie library problems by writing a minimal
cookie library that does what we need and no more than that. It is a
new module in ipapython shared by both client and server and comes
with a new unit test. The module has plenty of documentation, no need
to repeat it here.

Request URL issues:

We also had problems in rpc.py whereby information from the request
which is needed when we process the response is not available. Most
important was the requesting URL. It turns out that the way the class
and object relationships are structured it's impossible to get this
information. Someone else must have run into the same issue because
there was a routine called reconstruct_url() which attempted to
recreate the request URL from other available
information. Unfortunately reconstruct_url() was not callable from
inside the response handler. So I decided to store the information in
the thread context and when the request is received extract it from
the thread context. It's perhaps not an ideal solution but we do
similar things elsewhere so at least it's consistent. I removed the
reconstruct_url() function because the exact information is now in the
context and trying to apply heuristics to recreate the url is probably
not robust.

Ticket https://fedorahosted.org/freeipa/ticket/3022
2012-12-10 12:45:09 -05:00
Martin Kosek
378ed3c971 Fix sshd feature check
OpenSSH server included in Fedora 18 raises a validation error when
the tested AuthorizedKeysCommand/PubKeyAgent option is tested with
an empty value. It requires a command with an absolute path to be
passed. Due to this issue, sshd support is never configured on
Fedora 18.

Pass the real agent we will use later to the testing command to
avoid this error.
2012-12-10 13:48:24 +01:00
Martin Kosek
211f6c9046 Stop and disable conflicting time&date services
Fedora 16 introduced chrony as default client time&date synchronization
service:
http://fedoraproject.org/wiki/Features/ChronyDefaultNTP
Thus, there may be people already using chrony as their time and date
synchronization service before installing IPA.

However, installing IPA server or client on such machine may lead to
unexpected behavior, as the IPA installer would configure ntpd and leave
the machine with both ntpd and chronyd enabled. However, since the OS
does not allow both chronyd and ntpd to be running concurrently and chronyd
has the precedence, ntpd would not be run on that system at all.

Make sure, that user is warned when trying to install IPA on such
system and is given a possibility to either not to let IPA configure
ntpd at all or to let the installer stop and disable chronyd.

https://fedorahosted.org/freeipa/ticket/2974
2012-12-07 13:07:36 -05:00
Jakub Hrozek
b64dc9362d Specify includedir in krb5.conf on new installs
https://fedorahosted.org/freeipa/ticket/3132
2012-12-06 10:53:22 -05:00
Martin Kosek
3896bf370a Change network configuration file
Fedora+systemd changed deprecated /etc/sysconfig/network which was
used by IPA to store static hostname for the IPA machine. See
https://bugzilla.redhat.com/show_bug.cgi?id=881785 for details.

Change Fedora platform files to store the hostname to /etc/hostname
instead.

https://fedorahosted.org/freeipa/ticket/3279
2012-12-05 13:30:31 +01:00
Sumit Bose
a45125f78d Restart sssd after authconfig update
Recent versions of authconfig do not restart sssd if only the
--enablesssd and --enablesssdauth options are used. To make sure sssd is
running after ipa-server-install is run this patch add an unconditional
restart of sssd after authconfig is run during the installation.

Since there already is some logic trying to determine if sssd needs to
be restarted or stopped if freeipa in uninstalled no changes are needed
here.

Fixes https://fedorahosted.org/freeipa/ticket/3267
2012-12-03 15:34:23 -05:00
Jakub Hrozek
33fb949826 Make enabling the autofs service more robust 2012-11-14 11:02:04 +01:00
Rob Crittenden
2d3e91ff1c The SECURE_NFS value needs to be lower-case yes on SysV systems.
The sysV rpcgssd init script tests for [ "${SECURE_NFS}" != "yes" ].

This also works as lower case for system so a simple fix.

https://fedorahosted.org/freeipa/ticket/3207
2012-10-26 15:18:55 -04:00
Jakub Hrozek
5e79743a0b ipa-client-automount: Add the autofs service if it doesn't exist yet
https://fedorahosted.org/freeipa/ticket/3201
2012-10-25 14:27:38 -04:00
Nikolai Kondrashov
92331c0074 Add uninstall command hints to ipa-*-install
Add uninstall command to the uninstall instructions in the "already
installed" responses of ipa-server-install, ipa-client-install and
ipa-replica-install.

https://fedorahosted.org/freeipa/ticket/3065
2012-10-16 09:12:41 +02:00
Tomas Babej
00a54b8b7f Notify user about necessary ports in ipa-client-install
Connection error message in ipa-client-install now warns the user
about the need of opening of all the necessary ports for ipa-client
enrollment when error that might have been caused by closed ports
is encountered. Mentions the ports needed after the client
enrollment as well.

Improves other error messages during installation in various ways.

https://fedorahosted.org/freeipa/ticket/2816
2012-10-09 16:57:06 -04:00
Rob Crittenden
5bf1cee702 Clear kernel keyring in client installer, save dbdir on new connections
This patch addresses two issues:

1. If a client is previously enrolled in an IPA server and the server
   gets re-installed then the client machine may still have a keyring
   entry for the old server. This can cause a redirect from the
   session URI to the negotiate one. As a rule, always clear the keyring
   when enrolling a new client.

2. We save the NSS dbdir in the connection so that when creating a new
   session we can determine if we need to re-initialize NSS or not. Most
   of the time we do not. The dbdir was not always being preserved between
   connections which could cause an NSS_Shutdown() to happen which would
   fail because of existing usage. This preserves the dbdir information when
   a new connection is created as part of the session mechanism.

https://fedorahosted.org/freeipa/ticket/3108
2012-10-03 19:22:00 +02:00
Petr Viktorin
ebfda866dd Don't use bare except: clauses in ipa-client-install
Instead of `except:`, use `except Exception:`. This means that errors
like KeyboardInterrupt are not handled, letting them terminate the
script as expected.

https://fedorahosted.org/freeipa/ticket/2941
2012-09-27 14:43:01 +02:00
Rob Crittenden
17016750f4 Fix python syntax in ipa-client-automount
https://fedorahosted.org/freeipa/ticket/3081
2012-09-24 18:00:36 +02:00
Sumit Bose
0d31833317 Set master_kdc and dns_lookup_kdc to true
https://fedorahosted.org/freeipa/ticket/2515
2012-09-19 20:47:12 -04:00