Commit Graph

96 Commits

Author SHA1 Message Date
Tomas Babej
6839483d29 Enforce host existence only where needed in ipa-replica-manage
In ipa-replica-manage commands, we enforce that hostnames we work
with are resolvable. However, this caused errors while deleting
or disconnecting a ipa / winsync replica, if that replica was down
and authoritative server for itself.

Also adds an --no-lookup flag to disable host existence checks.

https://fedorahosted.org/freeipa/ticket/3524
2013-05-02 10:53:15 -04:00
Petr Viktorin
006ab23c6d Remove obsolete self-sign references from man pages, docstrings, comments
Part of the work for https://fedorahosted.org/freeipa/ticket/3494
2013-04-15 16:56:06 -04:00
Petr Viktorin
b36380fff8 ipa-server-install: correct help text for --external_{cert,ca}_file
The options take PEM certificates, not PKCS#10.
This corrects both the --help output and the man page.

https://fedorahosted.org/freeipa/ticket/3523
2013-04-15 13:32:58 +02:00
Rob Crittenden
c8694cb19f Full system backup and restore
This will allow one to backup and restore the IPA files and data. This
does not cover individual entry restoration.

http://freeipa.org/page/V3/Backup_and_Restore

https://fedorahosted.org/freeipa/ticket/3128
2013-04-12 09:59:17 -04:00
Petr Viktorin
34aa490141 ipa-server-install: Remove the --selfsign option
Instead, certificates in pkcs12 files can be given to set up
IPA with no CA at all.
Use a flag, setup_ca, to signal if a CA is being installed.

Design: http://freeipa.org/page/V3/Drop_selfsign
Part of the work for: https://fedorahosted.org/freeipa/ticket/3494
2013-04-02 15:28:50 +02:00
Ana Krivokapic
dae163aa37 Add mkhomedir option to ipa-server-install and ipa-replica-install
Add the option to create home directories for users on their
first login to ipa-server-install and ipa-replica-install.

https://fedorahosted.org/freeipa/ticket/3515
2013-03-28 08:45:37 +01:00
Rob Crittenden
9005b9bc8a Extend ipa-replica-manage to be able to manage DNA ranges.
Attempt to automatically save DNA ranges when a master is removed.
This is done by trying to find a master that does not yet define
a DNA on-deck range. If one can be found then the range on the deleted
master is added.

If one cannot be found then it is reported as an error.

Some validation of the ranges are done to ensure that they do overlap
an IPA local range and do not overlap existing DNA ranges configured
on other masters.

http://freeipa.org/page/V3/Recover_DNA_Ranges

https://fedorahosted.org/freeipa/ticket/3321
2013-03-13 10:32:36 -04:00
Petr Viktorin
1d3ddeff54 Fix schema replication from old masters
The new merged database will replicate with both the IPA and CA trees, so all
DS instances (IPA and CA on the existing master, and the merged one on the
replica) need to have the same schema.

Dogtag does all its schema modifications online. Those are replicated normally.
The basic IPA schema, however, is delivered in ldif files, which are not
replicated. The files are not present on old CA DS instances. Any schema
update that references objects in these files will fail.

The whole 99user.ldif (i.e. changes introduced dynamically over LDAP) is
replicated as a blob. If we updated the old master's CA schema dynamically
during replica install, it would conflict with updates done during the
installation: the one with the lower CSN would get lost.
Dogtag's spawn script recently grew a new flag, 'pki_clone_replicate_schema'.
Turning it off tells Dogtag to create its schema in the clone, where the IPA
modifications are taking place, so that it is not overwritten by the IPA schema
on replication.

The patch solves the problems by:
- In __spawn_instance, turning off the pki_clone_replicate_schema flag.
- Providing a script to copy the IPA schema files to the CA DS instance.
  The script needs to be copied to old masters and run there.
- At replica CA install, checking if the schema is updated, and failing if not.
  The --skip-schema-check option is added to ipa-{replica,ca}-install to
  override the check.

All pre-3.1 CA servers in a domain will have to have the script run on them to
avoid schema replication errors.

https://fedorahosted.org/freeipa/ticket/3213
2012-11-23 12:19:19 +01:00
Rob Crittenden
f1f1b4e7f2 Enable transactions by default, make password and modrdn TXN-aware
The password and modrdn plugins needed to be made transaction aware
for the pre and post operations.

Remove the reverse member hoop jumping. Just fetch the entry once
and all the memberof data is there (plus objectclass).

Fix some unit tests that are failing because we actually get the data
now due to transactions.

Add small bit of code in user plugin to retrieve the user again
ala wait_for_attr but in the case of transactions we need do it only
once.

Deprecate wait_for_attr code.

Add a memberof fixup task for roles.

https://fedorahosted.org/freeipa/ticket/1263
https://fedorahosted.org/freeipa/ticket/1891
https://fedorahosted.org/freeipa/ticket/2056
https://fedorahosted.org/freeipa/ticket/3043
https://fedorahosted.org/freeipa/ticket/3191
https://fedorahosted.org/freeipa/ticket/3046
2012-11-21 14:55:12 +01:00
Sumit Bose
b204881ab9 ipa-adtrust-install: allow to reset te NetBIOS domain name
Fixes https://fedorahosted.org/freeipa/ticket/3192
2012-11-08 08:18:14 +01:00
Jan Cholasta
85a0cdeb69 Reword description of the --passsync option of ipa-replica-manage.
https://fedorahosted.org/freeipa/ticket/3208
2012-11-02 10:12:00 -04:00
Martin Kosek
a5ec992ed9 Report ipa-upgradeconfig errors during RPM upgrade
Report errors just like with ipa-ldap-updater. These messages should warn
user that some parts of the upgrades may have not been successful and
he should follow up on them. Otherwise, user may not notice them at all.

ipa-upgradeconfig now has a new --quiet option to make it output only error
level log messages or higher. ipa-upgradeconfig run without options still
pring INFO log messages as it can provide a clean overview about its
actions (unlike ipa-ldap-updater).

https://fedorahosted.org/freeipa/ticket/3157
2012-10-18 21:10:17 -04:00
Sumit Bose
58a99dd5ac Add SIDs for existing users and groups at the end of ipa-adtrust-install
Fixes https://fedorahosted.org/freeipa/ticket/3104
2012-10-04 22:15:36 -04:00
Sumit Bose
bdf5f464d7 Add --rid-base and --secondary-rid-base to ipa-adtrust-install man page
Fixes https://fedorahosted.org/freeipa/ticket/3038
2012-10-03 10:14:00 +02:00
Sumit Bose
e15a1c627d Enhance description of --no-msdcs in man page
Fixes https://fedorahosted.org/freeipa/ticket/2972
2012-10-03 10:14:00 +02:00
Sumit Bose
029300db79 Add man page paragraph about running ipa-adtrust-install multiple times
Fixes https://fedorahosted.org/freeipa/ticket/2967
2012-10-03 10:14:00 +02:00
Yuri Chornoivan
8bbb42b410 Fix various typos.
https://fedorahosted.org/freeipa/ticket/3089
2012-09-18 08:45:28 +02:00
Rob Crittenden
f695f79748 When deleting a master, try to prevent orphaning other servers.
If you have a replication topology like A <-> B <-> C and you try
to delete server B that will leave A and C orphaned. It may also
prevent re-installation of a new master on B because the cn=masters
entry for it probably still exists on at least one of the other masters.

Check on each master that it connects to to ensure that it isn't the
last link, and fail if it is. If any of the masters are not up then
warn that this could be a bad thing but let the user continue if
they want.

Add a new option to the del command, --cleanup, which runs the
replica_cleanup() routine to completely clean up references to a master.

https://fedorahosted.org/freeipa/ticket/2797
2012-09-17 17:57:27 +02:00
Rob Crittenden
c9c55a2845 Run the CLEANALLRUV task when deleting a replication agreement.
This adds two new commands to ipa-replica-manage: list-ruv & clean-ruv

list-ruv can be use to list the update vectors the master has
configugured

clean-ruv can be used to fire off the CLEANRUV task to remove a
replication vector. It should be used with caution.

https://fedorahosted.org/freeipa/ticket/2303
2012-09-17 17:48:25 +02:00
Jan Cholasta
f6fed3c547 Add --no-ssh option to ipa-client-install to disable OpenSSH client configuration.
If both --no-ssh and --no-sshd are specified, do not configure the SSH service
in SSSD.

ticket 3070
2012-09-13 13:13:48 +02:00
Rob Crittenden
26dfbe61dd Add version to replica prepare file, prevent installing to older version 2012-09-07 12:58:55 +02:00
Alexander Bokovoy
191f514640 Ask for admin password in ipa-adtrust-install
The credentials of the admin user will be used to obtain Kerberos ticket before
configuring  cross-realm  trusts  support and afterwards, to ensure that the
ticket contains MS-PAC information required to actually add a trust with Active
Directory domain via 'ipa trust-add --type=ad' command.

https://fedorahosted.org/freeipa/ticket/2852
2012-08-24 16:16:58 +03:00
Tomas Babej
2e00a9f45c Improves exception handling in ipa-replica-prepare.
A backtrace is no longer displayed when trying to prepare a replica
file with the local LDAP server down. Also adds --debug option and
no longer displays info messages without it.

https://fedorahosted.org/freeipa/ticket/2939
2012-08-14 15:48:59 +02:00
Alexander Bokovoy
68d5fe1ec7 Ensure ipa-adtrust-install is run with Kerberos ticket for admin user
When setting up AD trusts support, ipa-adtrust-install utility
needs to be run as:
   - root, for performing Samba configuration and using LDAPI/autobind
   - kinit-ed IPA admin user, to ensure proper ACIs are granted to
     fetch keytab

As result, we can get rid of Directory Manager credentials in ipa-adtrust-install

https://fedorahosted.org/freeipa/ticket/2815
2012-07-31 17:44:35 +02:00
Martin Kosek
9d69db80a3 Enable SOA serial autoincrement
SOA serial autoincrement is a requirement for major DNS features,
e.g. zone transfers or DNSSEC. Enable it by default in named.conf
both for new and upgraded installations. Name of the bind-dyndb-ldap
option is "serial_autoincrement".

From now on, idnsSOAserial attribute also has to be put to
replication agreement exclude list as serial will be incremented
on each DNS server separately and won't be shared. Exclude list
has to be updated both for new replication agreements and the
current ones.

Minimum number of connections for bind-dyndb-ldap has been rised
to 4 connections, the setting will be updated during package upgrade.

https://fedorahosted.org/freeipa/ticket/2554
2012-07-13 16:03:58 +02:00
Martin Kosek
5c54dd5b03 Fix ipa-managed-entries man page typo
Extra new line in .TH section of the man page caused invalid
wrapping.
2012-07-12 15:11:58 +02:00
Petr Viktorin
7e606b01d5 Fix wrong option name in ipa-managed-entries man page
The page said `-y` but the actual option is `-p`.
2012-07-11 15:33:12 +02:00
Rob Crittenden
c9954878b8 Add logging to ipa-upgradeconfig
Log to the same file as ipa-ldap-updater --upgrade,
/var/log/ipaupgrade.log

Will output basic stauts information if executed from the command-line.

https://fedorahosted.org/freeipa/ticket/2696
2012-06-21 20:53:36 -04:00
Martin Kosek
ce97d6f8e7 Enable persistent search by default
From IPA version 3.0, the persistent search is a preferred mechanism
to for DNS zone list management. It will be also a requirement for
several bind-dyndb-ldap features, like SOA serial automatic updates
or DNSSEC.

Make this mechanism default in ipa-server-install and ipa-dns-istall.

https://fedorahosted.org/freeipa/ticket/2524
2012-06-10 21:23:15 -04:00
Rob Crittenden
4b539a41d9 During replication installation see if an agreement already exists.
We were inferring that an agreement existed if the host was present
as an IPA host. This was not enough if the replica installation failed
early enough.

https://fedorahosted.org/freeipa/ticket/2030
2012-05-17 17:12:45 +02:00
Martin Kosek
1cc761353b Fix typos in ipa-replica-manage man page
Based on contribution by Brian Harrington.

https://fedorahosted.org/freeipa/ticket/2428
2012-03-02 14:38:45 +01:00
Rob Crittenden
2d55525652 Warn that deleting replica is irreversible, try to detect reconnection.
Using ipa-replica-manage del <replica> is irreversible. You can't
turn around and do a connect to it, all heck will break loose. This is
because we clean up all references to the replica when we delete so if
we connect to it again we'll end up deleting all of its principals.

When a connection is deleted then the agreement is removed on both sides.
What isn't removed is the nsDS5ReplicaBindDN so we can use that to
determine if we previously had a connection.

https://fedorahosted.org/freeipa/ticket/2126
2012-02-29 16:20:49 +01:00
Martin Kosek
e10af0b764 Ease zonemgr restrictions
Admin e-mail validator currently requires an email to be in
a second-level domain (hostmaster@example.com). This is too
restrictive. Top level domain e-mails (hostmaster@testrelm)
should also be allowed.

This patch also fixes default zonemgr value in help texts and man
pages.

https://fedorahosted.org/freeipa/ticket/2272
2012-02-20 15:34:45 +01:00
Jan Cholasta
c00bf9e38a Configure ssh and sshd during ipa-client-install.
For ssh, VerifyHostKeyDNS option is set to 'yes' if --ssh-trust-dns
ipa-client-install option is used.

For sshd, KerberosAuthentication, GSSAPIAuthentication and UsePAM
options are enabled (this can be disabled using --no-sshd
ipa-client-install option).

ticket 1634
2012-02-13 22:21:47 -05:00
Jan Cholasta
c34f5fbc88 Update host SSH public keys on the server during client install.
This is done by calling host-mod to update the keys on IPA server and nsupdate
to update DNS SSHFP records. DNS update can be disabled using --no-dns-sshfp
ipa-client-install option.

https://fedorahosted.org/freeipa/ticket/1634
2012-02-13 22:21:43 -05:00
Petr Viktorin
5362b0b566 Fix/add options in ipa-managed-entries man page
* The --entry option was wrongly listed as --entries; fix that.
  https://fedorahosted.org/freeipa/ticket/2277

* Add the --help option
2012-02-07 09:56:20 +01:00
Ondrej Hamada
2e860f6d07 Fix 'no-reverse' option description
The description of 'no-reverse' option was fixed in both code and
manpages of ipa-replica-install and ipa-dns-install.

https://fedorahosted.org/freeipa/ticket/2161
2012-02-02 17:50:55 -05:00
Rob Crittenden
f3b606b627 Update and package ipa-upgradeconfig man page.
Require that the tool be run as root to avoid a permission-related
backtrace.

https://fedorahosted.org/freeipa/ticket/1758
2012-01-23 16:07:49 +01:00
Martin Kosek
95f3ec5d70 Let replicas install without DNS
Let ipa-replica-prepare and ipa-replica-install work without
proper DNS records as records in /etc/hosts are sufficient for
DS replication.

  1) ipa-replica-prepare now just checks if the replica hostname
     is resolvable (DNS records are not required). It is now able
     to prepare a replica file even when the replica IP address is
     present in /etc/hosts only.
  2) ipa-replica-install is now able to proceed when the hostname
     is not resolvable. It uses an IP address passed in a new
     option --ip-address to create a record in /etc/hosts in the
     same way as ipa-server-install does.

https://fedorahosted.org/freeipa/ticket/2139
2012-01-13 09:11:05 +01:00
Sumit Bose
2ac9d4816a Add DNS service records for Windows
https://fedorahosted.org/freeipa/ticket/1939
2011-11-30 11:28:39 +01:00
Rob Crittenden
2f4b3972a0 Add plugin framework to LDAP updates.
There are two reasons for the plugin framework:
1. To provide a way of doing manual/complex LDAP changes without having
   to keep extending ldapupdate.py (like we did with managed entries).
2. Allows for better control of restarts.

There are two types of plugins, preop and postop. A preop plugin runs
before any file-based updates are loaded. A postop plugin runs after
all file-based updates are applied.

A preop plugin may update LDAP directly or craft update entries to be
applied with the file-based updates.

Either a preop or postop plugin may attempt to restart the dirsrv instance.
The instance is only restartable if ipa-ldap-updater is being executed
as root. A warning is printed if a restart is requested for a non-root
user.

Plugins are not executed by default. This is so we can use ldapupdate
to apply simple updates in commands like ipa-nis-manage.

https://fedorahosted.org/freeipa/ticket/1789
https://fedorahosted.org/freeipa/ticket/1790
https://fedorahosted.org/freeipa/ticket/2032
2011-11-22 23:57:10 -05:00
Rob Crittenden
eaec3c4968 Add explicit instructions to ipa-replica-manage for winsync replication
https://fedorahosted.org/freeipa/ticket/1946
2011-10-14 09:05:06 +02:00
Martin Kosek
77cc5e0246 Hostname used by IPA must be a system hostname
Make sure that the hostname IPA uses is a system hostname. If user
passes a non-system hostname, update the network settings and
system hostname in the same way that ipa-client-install does.

This step should prevent various services failures which may not
be ready to talk to IPA with non-system hostname.

https://fedorahosted.org/freeipa/ticket/1931
2011-10-13 00:54:41 -04:00
Rob Crittenden
7bd3b3e121 Fix DNS permissions and membership in privileges
This resolves two issues:

1. The DNS acis lacked a prefix so weren't tied to permissions
2. The permissions were added before the privileges so the member
   values weren't calculated properly

For updates we need to add in the members and recalculate memberof via
a DS task.

https://fedorahosted.org/freeipa/ticket/1898
2011-10-09 23:44:22 -04:00
Nalin Dahyabhai
7d5106de97 - note that PKCS#12 files also contain private keys, and that the "pkinit" options refer to the KDC's credentials 2011-10-04 22:59:56 -04:00
Martin Kosek
28603e0c3a Be more clear about selfsign option
Installing IPA server --selfsign option is currently a one-way ticket
to server with limited certificate capabilities. Make sure that user
really want to install it by implementing the following steps:

- moving the option to the bottom of certificate options section
- adding a warning to ipa-server-install man page
- adding a warning to ipa-server-install help
- adding a warning to ipa-server-install configuration summary
  when one runs ipa-server-install

https://fedorahosted.org/freeipa/ticket/1908
2011-10-04 11:00:42 +02:00
JR Aquino
1ac613fc18 25 Create Tool for Enabling/Disabling Managed Entry Plugins
Remove legacy ipa-host-net-manage
Add ipa-managed-entries tool
Add man page for ipa-managed-entries tool

https://fedorahosted.org/freeipa/ticket/1181
2011-09-21 09:22:13 +02:00
Sumit Bose
29a7a7e8ce Add ipa-adtrust-install utility
https://fedorahosted.org/freeipa/ticket/1619
2011-09-14 18:45:13 -04:00
Rob Crittenden
ba1bdda25f Update ipa-ldap-updater man page saying it is not an end-user utility
https://fedorahosted.org/freeipa/ticket/1792
2011-09-14 14:39:55 +02:00
Martin Kosek
dc3d0f3879 Improve man pages structure
There are too many options in ipa-*-install scripts which makes it
difficult to read. This patch adds subsections to install script
online help and man pages to improve readability. No option has
been changed.

To further improve man pages:

1) All man pages were changed to have the same header and top-center
   title to provide united look.

2) Few typos in man pages have been fixed

https://fedorahosted.org/freeipa/ticket/1687
2011-09-07 12:55:12 +02:00