#! /usr/bin/python -E # Authors: Karl MacMillan # # Copyright (C) 2007 Red Hat # see file 'COPYING' for use and warranty information # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License as # published by the Free Software Foundation; version 2 only # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA # # requires the following packages: # fedora-ds-base # openldap-clients # nss-tools VERSION = "%prog .1" import sys sys.path.append("/usr/share/ipa") import socket import logging import pwd from optparse import OptionParser import ipaserver.dsinstance import ipaserver.krbinstance from ipa.ipautil import run def parse_options(): parser = OptionParser(version=VERSION) parser.add_option("-u", "--user", dest="ds_user", help="ds user") parser.add_option("-r", "--realm", dest="realm_name", help="realm name") parser.add_option("-p", "--ds-password", dest="dm_password", help="admin password") parser.add_option("-P", "--master-password", dest="master_password", help="kerberos master password") parser.add_option("-a", "--admin-password", dest="admin_password", help="admin user kerberos password") parser.add_option("-d", "--debug", dest="debug", action="store_true", dest="debug", default=False, help="print debugging information") parser.add_option("--hostname", dest="host_name", help="fully qualified name of server") parser.add_option("-U", "--unattended", dest="unattended", help="unattended installation never prompts the user") options, args = parser.parse_args() if options.unattended and (not options.ds_user or not options.realm_name or not options.dm_password or not options.admin_password or not options.master_password): parser.error("error: In unattended mode you need to provide -u, -r, -p and -P options") return options def logging_setup(options): # Always log everything (i.e., DEBUG) to the log # file. logging.basicConfig(level=logging.DEBUG, format='%(asctime)s %(levelname)s %(message)s', filename='ipaserver-install.log', filemode='w') console = logging.StreamHandler() # If the debug option is set, also log debug messages to the console if options.debug: console.setLevel(logging.DEBUG) else: # Otherwise, log critical and error messages console.setLevel(logging.ERROR) formatter = logging.Formatter('%(name)-12s: %(levelname)-8s %(message)s') console.setFormatter(formatter) logging.getLogger('').addHandler(console) def setup_hosts(host, ip): print "" print "TODO" print "" print "" def main(): options = parse_options() logging_setup(options) ds_user = "" realm_name = "" host_name = "" master_password = "" dm_password = "" admin_password = "" # check the hostname is correctly configured, it must be as the kldap # utilities just use the hostname as returned by gethostbyname to set # up some of the standard entries if options.host_name: host_name = options.host_name else: host_name = socket.gethostname() if len(host_name.split(".")) < 2: print "Invalid hostname <"+host_name+">" print "Check the /etc/hosts file and make sure to have a valid FQDN" return "-Fatal Error-" ip = socket.gethostbyname(host_name) if ip == "127.0.0.1": print "The hostname resolves to the localhost address (127.0.0.1)" print "Please change your /etc/hosts file or your DNS so that the" print "hostname resolves to the ip address of your network interface." print "The KDC service does not listen on 127.0.0.1" print "" if not options.unattended: change_hosts = raw_input("Do you want to change the /etc/hosts file ? [y/N] ") print "" if change_hosts.lower() == "y": ip = raw_input("What is the netowrk IP address used by this server ? ") print "" if (ip.find(".") == -1): print "["+ip+"] is an invalid IP address" return "-Fatal Error-" setup_hosts(host_name, ip) else: print "Please fix your /etc/hosts file and restart the setup program" print "-Aborted-" else: return "-Fatal Error-" print "The Final KDC Host Name will be: " + host_name + ". With IP address: " + ip print "" if not options.ds_user: try: pwd.getpwnam('dirsrv') print "To securely run Directory Server we need a user account to be set up." print "This will allow DS to run as a user and not as root." print "The user account will have access to some security material so it should not be shared with any other application." print "A user account named 'dirsrv' already exist. You should not share the account with any other service." print "" yesno = raw_input("Do you want to use the existing 'dirsrv' account ? (y/N)") print "" if yesno.lower() == "y": ds_user = "dirsrv" else: ds_user = raw_input("Which account name do you want to use for the DS instance ? ") print "" except KeyError: ds_user = "dirsrv" if ds_user == "": return "-Aborted-" else: ds_user = options.ds_user if not options.realm_name: print "The kerberos protocol requires a Realm name to be defined." print "Usually the domain name all in uppercase is used as realm name." print "" upper_dom = (host_name[host_name.find(".")+1:]).upper() dom_realm = raw_input("Do you want to use ["+upper_dom+"] as the realm name ? [y/N] ") print "" if dom_realm.lower() == "y": realm_name = upper_dom else: realm_name = raw_input("Please provide a realm name: ") print "" if realm_name == "": return "-Aborted-" upper_dom = realm_name.upper() if upper_dom != realm_name: print "It is strongly adviced to use a completely uppercased name for the realm." dom_realm = raw_input("Do you want to use "+upper_dom+" as realm name ? [Y/n] ") print "" if dom_realm.lower() != "y": print "WARNING: Using a non upper-cased realm name may cause unexpected problems." else: realm_name = upper_dom if realm_name == "": print "-Aborted-" else: realm_name = options.realm_name if not options.dm_password: print "The Directory Manager user is the equivalent of 'root' for Diretcory Server." print "This account has full access to the Directory and is used for system management tasks." print "" #TODO: provide the option of generating a random password dm_password = raw_input("Please provide a password for the Directory Manager: ") print "" else: dm_password = options.dm_password if not options.master_password: print "The Kerberos database is usually encrypted using a master password." print "Please store this password offline in a secure place." print "It may be necessary in a recovery situation or to install a replica." print "Without the master password the encrypted material can't be used by the KDC." print "If the master password gets lost all kerberos related secrets will be lost." print "" #TODO: provide the option of generating a random password master_password = raw_input("Please provide a master password: ") print "" else: master_password = options.master_password if not options.admin_password: print "The 'admin' user is the administrative user used to administare an IPA server." print "This account is the one that will be used for normal administration and is also a regular unix user" print "" #TODO: provide the option of generating a random password admin_password = raw_input("Please provide a kerberos password for the 'admin' user: ") print "" else: admin_password = options.admin_password # Create a directory server instance ds = ipaserver.dsinstance.DsInstance() ds.create_instance(ds_user, realm_name, host_name, dm_password) # Create a kerberos instance krb = ipaserver.krbinstance.KrbInstance() krb.create_instance(ds_user, realm_name, host_name, dm_password, master_password) # Restart ds after the krb instance has changed ds configurations ds.restart() # Restart apache run(["/sbin/service", "httpd", "restart"]) # Set apache to start on boot run(["/sbin/chkconfig", "httpd", "on"]) # Set fedora-ds to start on boot run(["/sbin/chkconfig", "dirsrv", "on"]) # Set the KDC to start on boot run(["/sbin/chkconfig", "krb5kdc", "on"]) # Set the Kpasswd to start on boot run(["/sbin/chkconfig", "ipa-kpasswd", "on"]) # Start Kpasswd run(["/sbin/service", "ipa-kpasswd", "start"]) # Set the admin user kerberos password ds.change_admin_password(admin_password) # Create the config file fd = open("/etc/ipa/ipa.conf", "w") fd.write("[defaults]\n") fd.write("server=" + host_name + "\n") fd.write("realm=" + realm_name + "\n") fd.close() return 0 main()