IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-09-03 20:52:56 -05:00
Code Issues Packages Projects Releases Wiki Activity
5,977 Commits 11 Branches 63 Tags
57c504a5b98eb95eead667d9760eaba3d4b35433
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Jan Cholasta 252de46ebf Fix normalization of FQDNs in DNS installer code. 
https://fedorahosted.org/freeipa/ticket/3600
 2013-05-03 18:05:50 +02:00
Jan Cholasta ddd8988f1c Add support for OpenSSH 6.2. 
Run sss_ssh_authorizedkeyscommand as nobody. Automatically update sshd_config
on openssh-server update.

https://fedorahosted.org/freeipa/ticket/3571
 2013-04-30 11:05:39 -04:00
Jan Cholasta 63e79a3d86 Add ipa-ca records for existing CA masters when installing DNS for the first time. 
https://fedorahosted.org/freeipa/ticket/3564
 2013-04-24 14:36:28 +02:00
Jan Cholasta 014f296274 Add DNS records for existing masters when installing DNS for the first time. 
https://fedorahosted.org/freeipa/ticket/3564
 2013-04-24 14:36:28 +02:00
Jan Cholasta 692fe7cbf7 Use correct zone when removing DNS records of a master. 
https://fedorahosted.org/freeipa/ticket/3563
 2013-04-18 08:05:17 +02:00
Jan Cholasta fe00788bb4 Delete DNS records in ipa-ca on ipa-csreplica-manage del. 
https://fedorahosted.org/freeipa/ticket/3547
 2013-04-15 21:12:41 +02:00
Jan Cholasta f684c6d6f8 Use A/AAAA records instead of CNAME records in ipa-ca. 
https://fedorahosted.org/freeipa/ticket/3547
 2013-04-15 21:12:36 +02:00
Jan Cholasta b25080bbca Use only one URL for OCSP and CRL in IPA certificate profile. 
https://fedorahosted.org/freeipa/ticket/3552
 2013-04-11 13:50:35 +02:00
Jan Cholasta 3f053437c9 Do actually stop pki_cad in stop_pkicad instead of starting it. 
https://fedorahosted.org/freeipa/ticket/3554
 2013-04-09 16:22:23 +02:00
Jan Cholasta 5f26d2c6db Add Kerberos ticket flags management to service and host plugins. 
https://fedorahosted.org/freeipa/ticket/3329
 2013-03-29 16:34:46 +01:00
Jan Cholasta 9955ba0714 Disable schema retrieval and attribute decoding when talking to AD GC. 2013-03-08 14:47:52 +01:00
Jan Cholasta f423364fa8 Allow disabling attribute decoding in LDAPClient and IPAdmin. 2013-03-08 14:47:52 +01:00
Jan Cholasta fffd2eb32d Allow disabling LDAP schema retrieval in LDAPClient and IPAdmin. 2013-03-08 14:47:52 +01:00
Jan Cholasta 4152c36bf2 Do not fail if schema cannot be retrieved from LDAP server. 2013-03-08 14:47:52 +01:00
Jan Cholasta ead4280a92 Fix internal error in output_for_cli method of sudorule_{enable,disable}. 
Also fix incorrect super method call in output_for_cli method of
sudorule_{add,remove}_option.

https://fedorahosted.org/freeipa/ticket/3489
 2013-03-06 16:13:17 +01:00
Jan Cholasta 54080f46b0 Remove disabled entries from sudoers compat tree. 
The removal is triggered by generating an invalid RDN when ipaEnabledFlag of
the original entry is FALSE.

https://fedorahosted.org/freeipa/ticket/3437
 2013-03-06 16:08:20 +01:00
Jan Cholasta b194b850ca Fix remove while iterating in suppress_netgroup_memberof. 
https://fedorahosted.org/freeipa/ticket/3464
 2013-03-06 15:05:27 +01:00
Jan Cholasta 61c0938c76 Remove support for DN normalization from LDAPClient. 2013-03-01 16:59:47 +01:00
Jan Cholasta 5b2e0e2ba5 Remove DN normalization from the baseldap plugin. 2013-03-01 16:59:47 +01:00
Jan Cholasta a09c50671e Use full DNs in plugin code. 2013-03-01 16:59:47 +01:00
Jan Cholasta 3aa39547df Support attributes with multiple names in LDAPEntry. 2013-03-01 16:59:47 +01:00
Jan Cholasta f17aa00ff0 Aggregate IPASimpleLDAPObject in LDAPEntry. 2013-03-01 16:59:47 +01:00
Jan Cholasta 8f46ca5dd2 Preserve case of attribute names in LDAPEntry. 2013-03-01 16:59:46 +01:00
Jan Cholasta bb36683c84 Use the dn attribute of LDAPEntry to set/get DNs of entries. 
Convert all code that uses the 'dn' key of LDAPEntry for this to use the dn
attribute instead.
 2013-03-01 16:59:46 +01:00
Jan Cholasta 6896626baa Remove the Entry class. 2013-03-01 16:59:43 +01:00
Jan Cholasta c1d6937ea2 Remove the Entity class. 
Move Entity functionality to LDAPEntry.
 2013-03-01 16:59:43 +01:00
Jan Cholasta 8d92ca851c Add make_entry factory method to LDAPConnection. 
Replace all occurences of Entry instantiation with calls to make_entry.
 2013-03-01 16:59:43 +01:00
Jan Cholasta ef1cd6e247 Add custom mapping object for LDAP entry data. 2013-03-01 16:59:42 +01:00
Jan Cholasta cfbdeebe66 Run interactive_prompt callbacks after CSV values are split. 
https://fedorahosted.org/freeipa/ticket/3334
 2013-02-19 11:08:11 -05:00
Jan Cholasta 1d35043e46 Raise ValidationError on invalid CSV values. 
https://fedorahosted.org/freeipa/ticket/3323
 2013-02-08 15:16:37 +01:00
Jan Cholasta 86dde3a38e Add support for RFC 6594 SSHFP DNS records. 
https://fedorahosted.org/freeipa/ticket/2642
 2013-02-01 09:16:09 -05:00
Jan Cholasta c1735e1c80 Drop ipapython.compat. 2013-02-01 09:16:06 -05:00
Jan Cholasta 77bb4b5177 Pylint cleanup. 
Add more dynamic attribute info to IPATypeChecker in make-lint. Remove
unnecessary pylint comments. Fix false positivies introduced by Pylint 0.26.

https://fedorahosted.org/freeipa/ticket/3379
 2013-01-29 15:39:49 +01:00
Jan Cholasta 85a0cdeb69 Reword description of the --passsync option of ipa-replica-manage. 
https://fedorahosted.org/freeipa/ticket/3208
 2012-11-02 10:12:00 -04:00
Jan Cholasta a51b65d9d4 Do not show full SSH public keys in command output by default. 2012-10-11 12:19:17 +02:00
Jan Cholasta 9a167d667c SSHPublicKey.fingerprint_dns_sha1 should return unicode value. 2012-09-20 10:44:28 +02:00
Jan Cholasta f6fed3c547 Add --no-ssh option to ipa-client-install to disable OpenSSH client configuration. 
If both --no-ssh and --no-sshd are specified, do not configure the SSH service
in SSSD.

ticket 3070
 2012-09-13 13:13:48 +02:00
Jan Cholasta 8728d3145f Add the SSH service to SSSD config file before trying to activate it. 
ticket 3069
 2012-09-13 13:13:16 +02:00
Jan Cholasta 46ad724301 Use OpenSSH-style public keys as the preferred format of SSH public keys. 
Public keys in the old format (raw RFC 4253 blob) are automatically
converted to OpenSSH-style public keys. OpenSSH-style public keys are now
stored in LDAP.

Changed sshpubkeyfp to be an output parameter, as that is what it actually
is.

Allow parameter normalizers to be used on values of any type, not just
unicode, so that public key blobs (which are str) can be normalized to
OpenSSH-style public keys.

ticket 2932, 2935
 2012-09-06 19:11:57 -04:00
Jan Cholasta de63e95de3 Raise Base64DecodeError instead of ConversionError when base64 decoding fails in Bytes parameters. 
ticket 2962
 2012-08-14 15:55:44 +02:00
Jan Cholasta 72cc54bc27 Make --{set,add,del}attr more robust. 
This fixes --addattr on single value attributes in add commands and --delattr
on non-unicode attributes in mod commands.

ticket 2954
 2012-08-03 14:17:42 +02:00
Jan Cholasta 9bfa905e72 Add --{set,add,del}attr options to commands which are missing them. 
ticket 2963
 2012-08-03 10:18:30 +02:00
Jan Cholasta d62b2d9be5 SSH configuration fixes. 
Use GlobalKnownHostsFile instead of GlobalKnownHostsFile2 in ssh_config, as the
latter has been deprecated in OpenSSH 5.9.

If DNS host key verification is enabled, restrict the set of allowed host
public key algorithms to ssh-rsa and ssh-dss, as DNS SSHFP records support only
these algorithms.

Make sure public key user authentication is enabled in both ssh and sshd.

ticket 2769
 2012-05-30 07:47:27 +02:00
Jan Cholasta d9d1967989 Redo boolean value encoding. 
Move the code for encoding boolean values to LDAP boolean syntax from the
Parameter class to the Encoder class, where the rest of LDAP encoding takes
place. Remove encoding code from the Parameter class altogether, as all LDAP
encoding should be done in the Encoder class.
 2012-05-09 09:43:35 +02:00
Jan Cholasta 6569f355b6 Set the "KerberosAuthentication" option in sshd_config to "no" instead of "yes". 
Setting it to "yes" causes sshd to handle kinits itself, bypassing SSSD.

ticket 2689
 2012-04-29 19:45:13 -04:00
Jan Cholasta 3ba9cc8eb4 Refactor exc_callback invocation. 
Replace _call_exc_callbacks with a function wrapper, which will automatically
call exception callbacks when an exception is raised from the function. This
removes the need to specify the function and its arguments twice (once in the
function call itself and once in _call_exc_callbacks).

Add some extra checks to existing exception callbacks.
 2012-04-26 09:00:30 +02:00
Jan Cholasta c043a65728 Fix internal error when renaming user with an empty string. 
ticket 2629
 2012-04-18 09:03:53 +02:00
Jan Cholasta dcea80fc17 Check configured maximum user login length on user rename. 
ticket 2587
 2012-04-08 17:10:39 -04:00
Jan Cholasta cdebb29fec Check whether the default user group is POSIX when adding new user with --noprivate. 
ticket 2572
 2012-04-05 15:04:45 +02:00
Jan Cholasta a2299070c8 Change parameters to use only default_from for dynamic default values. 
Replace all occurences of create_default with equivalent default_from
and remove create_default from the framework. This is needed for
proper parameter validation, as there is no way to tell which
parameters to validate prior to calling create_default, because
create_default does not provide information about which parameters are
used for generating the default value.
 2012-03-28 14:04:31 +02:00
Jan Cholasta 5a55e11a25 Fix the procedure for getting default values of command parameters. 
The parameters used in default_from of other parameters are now
properly validated before the default_from is called.

ticket 1847
 2012-03-28 14:03:27 +02:00
Jan Cholasta bd440d515e Fix uses of O=REALM instead of the configured certificate subject base. 
ticket 2521
 2012-03-26 20:29:26 -04:00
Jan Cholasta 0024024897 Parse zone indices in IPv6 addresses in CheckedIPAddress. 
If a zone index is present in an IPv6 address, it is ignored.

ticket 2138
 2012-03-27 12:03:16 +02:00
Jan Cholasta d9e8b9a3ed Wait for child process to terminate after receiving SIGINT in ipautil.run. 
Do cleanup on KeyboardInterrupt rather than in custom SIGINT handler in
ipa-replica-conncheck.

https://fedorahosted.org/freeipa/ticket/2127
 2012-03-23 10:53:02 +01:00
Jan Cholasta afad0775e1 Configure SSH features of SSSD in ipa-client-install. 
OpenSSH server (sshd) is configured to fetch user authorized keys from
SSSD and OpenSSH client (ssh) is configured to use and trigger updates
of the SSSD-managed known hosts file.

This requires SSSD 1.8.0.
 2012-03-01 18:42:56 -05:00
Jan Cholasta 6488378764 Move the compat module from ipalib to ipapython. 
Fixes import problems trying to import just ipalib/compat.py.

https://fedorahosted.org/freeipa/ticket/754
 2012-02-13 22:22:49 -05:00
Jan Cholasta e5c0750806 Add SSH service to platform-specific services. 
Add method for getting configuration directory path of a service,
so that a different SSH configuration directory can be specified on
different platforms.

https://fedorahosted.org/freeipa/ticket/754
 2012-02-13 22:21:54 -05:00
Jan Cholasta ca3f304110 Base64-decode unicode values in Bytes parameters. 
Fix wrong handling of strings in --setattr/--addattr/--delattr.

These changes make it possible to use Bytes in --setattr/--addattr/
--delattr without errors.

Fixes managing SSH keys on command-line

https://fedorahosted.org/freeipa/ticket/754
 2012-02-13 22:21:50 -05:00
Jan Cholasta c00bf9e38a Configure ssh and sshd during ipa-client-install. 
For ssh, VerifyHostKeyDNS option is set to 'yes' if --ssh-trust-dns
ipa-client-install option is used.

For sshd, KerberosAuthentication, GSSAPIAuthentication and UsePAM
options are enabled (this can be disabled using --no-sshd
ipa-client-install option).

ticket 1634
 2012-02-13 22:21:47 -05:00
Jan Cholasta c34f5fbc88 Update host SSH public keys on the server during client install. 
This is done by calling host-mod to update the keys on IPA server and nsupdate
to update DNS SSHFP records. DNS update can be disabled using --no-dns-sshfp
ipa-client-install option.

https://fedorahosted.org/freeipa/ticket/1634
 2012-02-13 22:21:43 -05:00
Jan Cholasta 9b6649a1ce Move the nsupdate functionality to separate function in ipa-client-install. 
Done as part of adding SSH support.

https://fedorahosted.org/freeipa/ticket/1634
 2012-02-13 22:21:38 -05:00
Jan Cholasta 04b8575c52 Add API initialization to ipa-client-install. 
This change makes it possible to call IPA commands from ipa-client-install.

Done to support adding SSH host keys to DNS.

https://fedorahosted.org/freeipa/ticket/1634
 2012-02-13 22:21:35 -05:00
Jan Cholasta 3c2b0fc28a Add support for SSH public keys to user and host objects. 
This patch adds a new multivalue param "sshpubkey" for specifying SSH public
keys to both user and host objects. The accepted value is base64-encoded
public key blob as specified in RFC4253, section 6.6.

Additionaly, host commands automatically update DNS SSHFP records when
requested by user.

https://fedorahosted.org/freeipa/ticket/754
 2012-02-13 22:21:27 -05:00
Jan Cholasta 9b6baf9bee Add LDAP ACIs for SSH public key schema. 
https://fedorahosted.org/freeipa/ticket/754
 2012-02-13 22:20:23 -05:00
Jan Cholasta 63ea0a304e Add LDAP schema for SSH public keys. 
https://fedorahosted.org/freeipa/ticket/754
 2012-02-13 22:20:18 -05:00
Jan Cholasta 9beb467d98 Fix attempted write to attribute of read-only object. 
Add new class "cachedproperty" for creating property-like attributes
that cache the return value of a method call.

Also fix few issues in the unit tests to enable them to succeed.

ticket 1959
 2012-01-02 11:51:26 +03:00
Jan Cholasta 27931dcb29 Fix make-lint crash under certain circumstances. 
ticket 2136
 2011-11-30 17:09:22 +01:00
Jan Cholasta 135ccf89de Parse comma-separated lists of values in all parameter types. This can be enabled for a specific parameter by setting the "csv" option to True. 
Remove "List" parameter type and replace all occurences of it with appropriate
multi-valued parameter ("Str" in most cases) with csv enabled.

Add new parameter type "Any", capable of holding values of any type. This is
needed by the "batch" command, as "Str" is not suitable type for the "methods"
parameter.

ticket 2007
 2011-11-30 17:08:35 +01:00
Jan Cholasta e7a6d10555 Finalize plugin initialization on demand. 
This patch changes the way plugins are initialized. Instead of
finalizing all the plugins at once, plugins are finalized only after
they are accessed (currently applies to Command, Object and
Attribute subclasses, only in CLI by default).

This change provides significant performance boost, as only the
plugins that are actually used are finalized.

ticket 1336
 2011-11-22 00:52:24 -05:00
Jan Cholasta 592bf62161 Remove more redundant configuration values from krb5.conf. 
ticket 1358
 2011-10-11 22:00:50 -04:00
Jan Cholasta 0d823ddc4e Don't leak passwords through kdb5_ldap_util command line arguments. 
ticket 1948
 2011-10-11 21:25:17 -04:00
Jan Cholasta c0879cd00b Disallow deletion of global password policy. 
ticket 1936
 2011-10-12 10:12:49 +02:00
Jan Cholasta 209bcb0b98 Work around pkisilent bugs. 
Check directory manager password and certificate subject base for
invalid characters.
(https://bugzilla.redhat.com/show_bug.cgi?id=658641)

Shell-escape pkisilent command-line arguments.
(https://bugzilla.redhat.com/show_bug.cgi?id=741180)

ticket 1636
 2011-10-04 20:12:58 -04:00
Jan Cholasta 12bfed37d4 Add a function for formatting network locations of the form host:port for use in URLs. 
If the host part is a literal IPv6 address, it must be enclosed in square
brackets (RFC 2732).

ticket 1869
 2011-10-05 10:58:25 +02:00
Jan Cholasta 48a67d9a2e Validate name_from_ip parameter of dnszone. 
ticket 1627
 2011-10-04 09:25:44 +02:00
Jan Cholasta 5cd121d6dd Fix ipa-replica-prepare always warning the user about not using the system hostname. 
ticket 1717
 2011-09-26 17:11:09 +02:00
Jan Cholasta 7854d8166e Fix client install on IPv6 machines. 
ticket 1804
 2011-09-19 18:11:24 +02:00
Jan Cholasta b43a38e9cb Check that install hostname matches the server hostname. 
ticket 1717
 2011-09-14 22:42:05 -04:00
Jan Cholasta 610faff6f3 Verify that the external CA certificate files are correct. 
ticket 1572
 2011-08-23 01:23:41 -04:00
Jan Cholasta 9b0fa8debf Add subscription-manager dependency for RHEL. 
ticket 1664
 2011-08-23 00:27:30 -04:00
Jan Cholasta a797f907ee Search for users in all the naming contexts present on the directory server. 
ticket 1655, 1656
 2011-08-22 19:04:29 -04:00
Jan Cholasta b8d4f8ad9f Add option to install without the automatic redirect to the Web UI. 
ticket 1570
 2011-08-18 23:24:29 -04:00
Jan Cholasta cc7f9aa7a9 Verify that passwords specified through command line options of ipa-server-install meet the length requirement. 
ticket 1621
 2011-08-18 20:49:05 -04:00
Jan Cholasta 1ec531469e Make sure messagebus is running prior to starting certmonger. 
ticket 1580
 2011-08-18 20:15:48 -04:00
Jan Cholasta 8edd7ed998 Ask for reverse DNS zone information in attended install right after asking for DNS forwarders, so that DNS configuration is done in one place. 
ticket 1522
 2011-08-09 13:12:19 +02:00
Jan Cholasta a2641254fe Fix external CA install. 
ticket 1523
 2011-07-26 22:30:21 -04:00
Jan Cholasta 9e7a3e7f3c Make sure that hostname specified by user is not an IP address. 
ticket 1375
 2011-07-25 01:47:52 -04:00
Jan Cholasta df7ee2ccf5 Fix ipa-compat-manage not working after recent ipa-nis-manage change. 
ticket 1147
 2011-07-22 10:38:49 +02:00
Jan Cholasta c1f5dadc4e Don't delete NIS netgroup compat suffix on 'ipa-nis-manage disable'. 
ticket 1469
 2011-07-19 13:45:01 +02:00
Jan Cholasta c09f116f43 Clean up of IP address checks in install scripts. 
Fixes ipa-dns-install incorrect warning.

ticket 1486
 2011-07-19 12:30:47 +02:00
Jan Cholasta 95901bbdb5 Update minimum required version of python-netaddr. 
ticket 1288
 2011-07-17 22:44:21 -04:00
Jan Cholasta 5f0adc3fbe Fix exit status of ipa-nis-manage enable. 
ticket 1247
 2011-07-15 02:39:17 -04:00
Jan Cholasta b203756a88 Add ability to specify DNS reverse zone name by IP network address. 
In order for this to work, chaining of parameters through
default_from is made possible.

ticket 1474
 2011-07-15 02:21:23 -04:00
Jan Cholasta 881df73568 Fix creation of reverse DNS zones. 
Create reverse DNS zone for /24 IPv4 subnet and /64 IPv6 subnet by
default instead of using the netmask from the --ip-address option.

Custom reverse DNS zone can be specified using new --reverse-zone
option, which replaces the old --ip-address netmask way of creating
reverse zones.

The reverse DNS zone name is printed to the user during the install.

ticket 1398
 2011-07-15 16:42:16 +02:00
Jan Cholasta 1c5028c17d Configure SSSD to store user password if offline. 
ticket 1359
 2011-07-14 19:26:25 -04:00
Jan Cholasta 67b807d640 Replace the 'private' option in netgroup-find with 'managed'. 
The 'private' option is kept in to maintain API compatibility, but
is hidden from the user.

ticket 1120
 2011-06-28 01:57:11 -04:00
Jan Cholasta f05141e646 Remove redundant configuration values from krb5.conf. 
ticket 1358
 2011-06-28 01:10:06 -04:00
Jan Cholasta 3656d9be3c Verify that the hostname is fully-qualified before accessing the service information in ipactl. 
Fail gracefully if the supplied hostname isn't fully-qualified in
ipa-server-install.

ticket 1035
 2011-06-24 01:23:14 -04:00
Jan Cholasta 574d07be1f Improve IP address handling in the host-add command. 
IP addresses are more strictly checked. Netmasks can be specified
and are used in DNS PTR record creation.

ticket 1234
 2011-06-19 20:44:19 -04:00
Jan Cholasta d2b483cbb3 Fix directory manager password validation in ipa-nis-manage. 
ticket 1283, 1284
 2011-06-13 12:59:22 +02:00