Now the option correctly adds missing reverse zones even in unattended
mode.
Still, this is not sufficient in all cases because 'automatic empty zones'
created by BIND (as specified in RFC 6303) can shadow the reverse zones
hosted on other servers. This needs to be solved in a separate patch.
https://fedorahosted.org/freeipa/ticket/5559
Reviewed-By: David Kupka <dkupka@redhat.com>
This error may potentially happen when plugin migration is skipped due
an error. In that case variable 'update' was undefined.
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Enables check and fixes:
ipaserver/install/otpdinstance.py:25: [C0304(missing-final-newline), ]
Final newline missing)
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Commit enables check and also fixes:
ipaserver/dcerpc.py:718: [W0150(lost-exception),
DomainValidator.__search_in_dc] return statement in finally block may
swallow exception)
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Wildcard imports should not be used.
Check for wildcard imports has been enabled in pylint.
Pylint note: options 'wildcard-import' causes too much false positive
results, so instead it I used 'unused-wildcard-import' option which has almost
the same effect.
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
When DNS is already installed somewhere in topology we should not check for
zone overlap because it would always say that we are overlapping our own domain.
ipa-replica-install already does that but ipa-dns-install did not.
https://fedorahosted.org/freeipa/ticket/5564
Reviewed-By: Petr Spacek <pspacek@redhat.com>
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
The first instance of KRA system should be allowed to install only by ipa-kra-install. This commit removes TODO and unneeded parts in code.
Reviewed-By: David Kupka <dkupka@redhat.com>
Only options explicitly set must be stored before installer exits first step
of external CA setup. When installer continues all stored option values must
be restored.
https://fedorahosted.org/freeipa/ticket/5556
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
this patch makes the check_last_link_managed() function more resistant to both
orphaned topology suffixes and also to cases when there are IPA masters do not
seem to manage any suffix. The function will now only complain loudly about
these cases and not cause crashes.
Reviewed-By: Martin Basti <mbasti@redhat.com>
In cases where domain is already delegated to IPA prior installation
we might get timeout or SERVFAIL. The answer depends on the recursive
server we are using for the check.
Reviewed-By: David Kupka <dkupka@redhat.com>
Introducing '--auto-reverse' option. When specified reverse records for
all server's IP addresses are checked and when record nor reverse zone
does not exist reverse zone is created.
Reviewed-By: Petr Spacek <pspacek@redhat.com>
Raise an error when the domain already exists. This can be overriden using
--force or --allow-zone-overlap options.
https://fedorahosted.org/freeipa/ticket/3681
Reviewed-By: Petr Spacek <pspacek@redhat.com>
ipa-client-install output is redirected to standard output, so let it print
its own error message for missing options.
https://fedorahosted.org/freeipa/ticket/5542
Reviewed-By: Tomas Babej <tbabej@redhat.com>
Without calling os.chmod(), umask is effective and may cause that
directory is created with permission that causes failure.
This can be related to https://fedorahosted.org/freeipa/ticket/5520
Reviewed-By: Tomas Babej <tbabej@redhat.com>
When IPA client is already installed, notify the user that the enrollment
options are ignored in ipa-replica-install.
https://fedorahosted.org/freeipa/ticket/5530
Reviewed-By: Tomas Babej <tbabej@redhat.com>
The ipautil.run function now returns an object with returncode and
output are accessible as attributes.
The stdout and stderr of all commands are logged (unless skip_output is given).
The stdout/stderr contents must be explicitly requested with a keyword
argument, otherwise they are None.
This is because in Python 3, the output needs to be decoded, and that can
fail if it's not decodable (human-readable) text.
The raw (bytes) output is always available from the result object,
as is "leniently" decoded output suitable for logging.
All calls are changed to reflect this.
A use of Popen in cainstance is changed to ipautil.run.
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Add server_conncheck command which calls ipa-replica-conncheck --replica
over oddjob.
https://fedorahosted.org/freeipa/ticket/5497
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Reviewed-By: Tomas Babej <tbabej@redhat.com>
During the promote_check phase, the subsequent checks after the machine
is enrolled may cause the installation to abort, hence leaving it
enrolled even though it might not have been prior to the execution of
the ipa-replica-install command.
Make sure that ipa-client-install --uninstall is called on the machine
that has not been enrolled before in case of failure during the
promote_check phase.
https://fedorahosted.org/freeipa/ticket/5529
Reviewed-By: Martin Basti <mbasti@redhat.com>
Topology disconnect is always ignored in domain level 0, so the option can
be safely ignored.
https://fedorahosted.org/freeipa/ticket/5409
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Check domain level before checking ipaservers membership to prevent
"not found" error when attempting replica promotion in domain level 0.
https://fedorahosted.org/freeipa/ticket/5401
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
This prevents crash when adding the host entry to ipaservers when
installing replica of a 4.2 or older server.
https://fedorahosted.org/freeipa/ticket/3416
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
Attribute _ca_enabled is set in promote_check() and is not available in
install(). When installing replica in domain level 0 we can determine existence
of CA service based on existence of cacert.p12 file in provided replica-file.
https://fedorahosted.org/freeipa/ticket/5531
Reviewed-By: Oleg Fayans <ofayans@redhat.com>
If the user is authorized to modify members of the ipaservers host group,
add the local host to ipaservers automatically.
https://fedorahosted.org/freeipa/ticket/5401
Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
Use the local host credentials rather than the user credentials when
setting up replication. The host must be a member of the ipaservers host
group. The user credentials are still required for connection check.
https://fedorahosted.org/freeipa/ticket/5401
Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
When a CA-less replica is installed, its IPA config file should be updated so
that ca_host points to nearest CA master and all certificate requests are
forwarded to it. A subsequent installation of CA subsystem on the replica
should clear this entry from the config so that all certificate requests are
handled by freshly installed local CA.
https://fedorahosted.org/freeipa/ticket/5506
Reviewed-By: Martin Basti <mbasti@redhat.com>
When uninstalling domain level 1 master its removal from topology is checked
on remote masters. The uninstaller also checks whether the uninstallation
disconnects the topology and if yes aborts the procedure. The
'--ignore-disconnected-topology' options skips this check.
https://fedorahosted.org/freeipa/ticket/5377https://fedorahosted.org/freeipa/ticket/5409
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
This facilitates reusability of this code in other components, e.g. IPA server
uninstallers.
https://fedorahosted.org/freeipa/ticket/5409
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
In non-interactive more option --auto-forwarders can be used to do the
same. --forward option can be used to supply additional IP addresses.
https://fedorahosted.org/freeipa/ticket/5438
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
