mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-01-04 13:17:15 -06:00
0ca29fac9a
All of our install/admin scripts had a try/except block calling the main function and handling common exceptions. These were copy-pasted from each other and modified to various levels of sophistication. This refactors them out of installers to a single function, which includes a final pass/fail message for all of the scripts. Non-install scripts that set up the same log handler levels for stderr and log file are not changed, as it's not possible to log to only the logfile without changing the logger configuration. https://fedorahosted.org/freeipa/ticket/2071
310 lines
9.6 KiB
Python
310 lines
9.6 KiB
Python
#!/usr/bin/python
|
|
#
|
|
# Authors:
|
|
# Rob Crittenden <rcritten@redhat.com>
|
|
#
|
|
# Copyright (C) 2009 Red Hat
|
|
# see file 'COPYING' for use and warranty information
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
"""
|
|
Upgrade configuration files to a newer template.
|
|
"""
|
|
|
|
import sys
|
|
try:
|
|
from ipapython import ipautil, sysrestore
|
|
from ipaserver.install import installutils
|
|
from ipaserver.install import dsinstance
|
|
from ipaserver.install import httpinstance
|
|
from ipaserver.install import memcacheinstance
|
|
from ipaserver.install import service
|
|
from ipaserver.install import cainstance
|
|
from ipaserver.install import certs
|
|
import ldap
|
|
import krbV
|
|
import re
|
|
import os
|
|
import shutil
|
|
import fileinput
|
|
import ipalib.errors
|
|
except ImportError:
|
|
print >> sys.stderr, """\
|
|
There was a problem importing one of the required Python modules. The
|
|
error was:
|
|
|
|
%s
|
|
""" % sys.exc_value
|
|
sys.exit(1)
|
|
|
|
class KpasswdInstance(service.SimpleServiceInstance):
|
|
def __init__(self):
|
|
service.SimpleServiceInstance.__init__(self, "ipa_kpasswd")
|
|
|
|
def uninstall_ipa_kpasswd():
|
|
"""
|
|
We can't use the full service uninstaller because that will attempt
|
|
to stop and disable the service which by now doesn't exist. We just
|
|
want to clean up sysrestore.state to remove all references to
|
|
ipa_kpasswd.
|
|
"""
|
|
ipa_kpasswd = KpasswdInstance()
|
|
|
|
running = ipa_kpasswd.restore_state("running")
|
|
enabled = not ipa_kpasswd.restore_state("enabled")
|
|
|
|
if enabled is not None and not enabled:
|
|
ipa_kpasswd.remove()
|
|
|
|
def backup_file(filename, ext):
|
|
"""Make a backup of filename using ext as the extension. Do not overwrite
|
|
previous backups."""
|
|
if not os.path.isabs(filename):
|
|
raise ValueError("Absolute path required")
|
|
|
|
backupfile = filename + ".bak"
|
|
(reldir, file) = os.path.split(filename)
|
|
|
|
while os.path.exists(backupfile):
|
|
backupfile = backupfile + "." + str(ext)
|
|
|
|
try:
|
|
shutil.copy2(filename, backupfile)
|
|
except IOError, e:
|
|
if e.errno == 2: # No such file or directory
|
|
pass
|
|
else:
|
|
raise e
|
|
|
|
def update_conf(sub_dict, filename, template_filename):
|
|
template = ipautil.template_file(template_filename, sub_dict)
|
|
fd = open(filename, "w")
|
|
fd.write(template)
|
|
fd.close()
|
|
|
|
def find_hostname():
|
|
"""Find the hostname currently configured in ipa-rewrite.conf"""
|
|
filename="/etc/httpd/conf.d/ipa-rewrite.conf"
|
|
|
|
if not ipautil.file_exists(filename):
|
|
return None
|
|
|
|
pattern = "^[\s#]*.*https:\/\/([A-Za-z0-9\.\-]*)\/.*"
|
|
p = re.compile(pattern)
|
|
for line in fileinput.input(filename):
|
|
if p.search(line):
|
|
fileinput.close()
|
|
return p.search(line).group(1)
|
|
fileinput.close()
|
|
|
|
raise RuntimeError("Unable to determine the fully qualified hostname from %s" % filename)
|
|
|
|
def find_version(filename):
|
|
"""Find the version of a configuration file"""
|
|
if os.path.exists(filename):
|
|
pattern = "^[\s#]*VERSION\s+([0-9]+)\s+.*"
|
|
p = re.compile(pattern)
|
|
for line in fileinput.input(filename):
|
|
if p.search(line):
|
|
fileinput.close()
|
|
return p.search(line).group(1)
|
|
fileinput.close()
|
|
|
|
# no VERSION found
|
|
return 0
|
|
else:
|
|
return -1
|
|
|
|
def upgrade(sub_dict, filename, template, add=False):
|
|
"""
|
|
Get the version from the current and template files and update the
|
|
installed configuration file if there is a new template.
|
|
|
|
If add is True then create a new configuration file.
|
|
"""
|
|
old = int(find_version(filename))
|
|
new = int(find_version(template))
|
|
|
|
if old < 0 and not add:
|
|
print "%s not found." % filename
|
|
sys.exit(1)
|
|
|
|
if new < 0:
|
|
print "%s not found." % template
|
|
|
|
if old < new or (add and old == 0):
|
|
backup_file(filename, new)
|
|
update_conf(sub_dict, filename, template)
|
|
print "Upgraded %s to version %d" % (filename, new)
|
|
|
|
def check_certs():
|
|
"""Check ca.crt is in the right place, and try to fix if not"""
|
|
if not os.path.exists("/usr/share/ipa/html/ca.crt"):
|
|
ca_file = "/etc/httpd/alias/cacert.asc"
|
|
if os.path.exists(ca_file):
|
|
old_umask = os.umask(022) # make sure its readable by httpd
|
|
try:
|
|
shutil.copyfile(ca_file, "/usr/share/ipa/html/ca.crt")
|
|
finally:
|
|
os.umask(old_umask)
|
|
else:
|
|
print "Missing Certification Authority file."
|
|
print "You should place a copy of the CA certificate in /usr/share/ipa/html/ca.crt"
|
|
|
|
def upgrade_pki(fstore):
|
|
"""
|
|
Update/add the dogtag proxy configuration. The IPA side of this is
|
|
handled in ipa-pki-proxy.conf.
|
|
|
|
This requires enabling SSL renegotiation.
|
|
"""
|
|
if not os.path.exists('/etc/pki-ca/CS.cfg'):
|
|
return
|
|
|
|
http = httpinstance.HTTPInstance(fstore)
|
|
http.enable_mod_nss_renegotiate()
|
|
if not installutils.get_directive('/etc/pki-ca/CS.cfg',
|
|
'proxy.securePort', '=') and \
|
|
os.path.exists('/usr/bin/pki-setup-proxy'):
|
|
ipautil.run(['/usr/bin/pki-setup-proxy', '-pki_instance_root=/var/lib'
|
|
,'-pki_instance_name=pki-ca','-subsystem_type=ca'])
|
|
|
|
def update_dbmodules(realm, filename="/etc/krb5.conf"):
|
|
newfile = []
|
|
found_dbrealm = False
|
|
found_realm = False
|
|
prefix = ''
|
|
|
|
st = os.stat(filename)
|
|
fd = open(filename)
|
|
|
|
lines = fd.readlines()
|
|
fd.close()
|
|
|
|
if ' db_library = ipadb.so\n' in lines:
|
|
# Already updated
|
|
return
|
|
|
|
for line in lines:
|
|
if line.startswith('[dbmodules]'):
|
|
found_dbrealm = True
|
|
if found_dbrealm and line.find(realm) > -1:
|
|
found_realm = True
|
|
prefix = '#'
|
|
if found_dbrealm and line.find('}') > -1 and found_realm:
|
|
found_realm = False
|
|
newfile.append('#%s' % line)
|
|
prefix = ''
|
|
continue
|
|
|
|
newfile.append('%s%s' % (prefix, line))
|
|
|
|
# Append updated dbmodules information
|
|
newfile.append(' %s = {\n' % realm)
|
|
newfile.append(' db_library = ipadb.so\n')
|
|
newfile.append(' }\n')
|
|
|
|
# Write out new file
|
|
fd = open(filename, 'w')
|
|
fd.write("".join(newfile))
|
|
fd.close()
|
|
|
|
def cleanup_kdc(fstore):
|
|
"""
|
|
Clean up old KDC files if they exist. We need to remove the actual
|
|
file and any references in the uninstall configuration.
|
|
"""
|
|
for file in ['kpasswd.keytab', 'ldappwd']:
|
|
filename = '/var/kerberos/krb5kdc/%s' % file
|
|
installutils.remove_file(filename)
|
|
if fstore.has_file(filename):
|
|
fstore.untrack_file(filename)
|
|
|
|
def upgrade_ipa_profile(realm):
|
|
"""
|
|
Update the IPA Profile provided by dogtag
|
|
"""
|
|
ca = cainstance.CAInstance(realm, certs.NSS_DIR)
|
|
if ca.is_configured():
|
|
if ca.enable_subject_key_identifier():
|
|
ca.restart()
|
|
|
|
def upgrade_httpd_selinux(fstore):
|
|
"""
|
|
Update SElinux configuration for httpd instance in the same way as the
|
|
new server installation does.
|
|
"""
|
|
http = httpinstance.HTTPInstance(fstore)
|
|
http.configure_selinux_for_httpd()
|
|
|
|
def main():
|
|
"""
|
|
Get some basics about the system. If getting those basics fail then
|
|
this is likely because the machine isn't currently an IPA server so
|
|
exit gracefully.
|
|
"""
|
|
|
|
if not os.geteuid()==0:
|
|
sys.exit("\nYou must be root to run this script.\n")
|
|
|
|
fstore = sysrestore.FileStore('/var/lib/ipa/sysrestore')
|
|
|
|
try:
|
|
krbctx = krbV.default_context()
|
|
except krbV.Krb5Error, e:
|
|
# Unable to get default kerberos realm
|
|
sys.exit(0)
|
|
|
|
fqdn = find_hostname()
|
|
if fqdn is None:
|
|
# ipa-rewrite.conf doesn't exist, nothing to do
|
|
sys.exit(0)
|
|
|
|
# Ok, we are an IPA server, do the additional tests
|
|
|
|
check_certs()
|
|
|
|
sub_dict = { "REALM" : krbctx.default_realm, "FQDN": fqdn }
|
|
|
|
upgrade(sub_dict, "/etc/httpd/conf.d/ipa.conf", ipautil.SHARE_DIR + "ipa.conf")
|
|
upgrade(sub_dict, "/etc/httpd/conf.d/ipa-rewrite.conf", ipautil.SHARE_DIR + "ipa-rewrite.conf")
|
|
upgrade(sub_dict, "/etc/httpd/conf.d/ipa-pki-proxy.conf", ipautil.SHARE_DIR + "ipa-pki-proxy.conf", add=True)
|
|
upgrade_pki(fstore)
|
|
update_dbmodules(krbctx.default_realm)
|
|
uninstall_ipa_kpasswd()
|
|
|
|
http = httpinstance.HTTPInstance(fstore)
|
|
http.remove_httpd_ccache()
|
|
http.configure_selinux_for_httpd()
|
|
|
|
memcache = memcacheinstance.MemcacheInstance()
|
|
memcache.ldapi = True
|
|
memcache.realm = krbctx.default_realm
|
|
try:
|
|
if not memcache.is_configured():
|
|
# 389-ds needs to be running to create the memcache instance
|
|
# because we record the new service in cn=masters.
|
|
ds = dsinstance.DsInstance()
|
|
ds.start()
|
|
memcache.create_instance('MEMCACHE', fqdn, None, ipautil.realm_to_suffix(krbctx.default_realm))
|
|
except (ldap.ALREADY_EXISTS, ipalib.errors.DuplicateEntry):
|
|
pass
|
|
|
|
cleanup_kdc(fstore)
|
|
upgrade_ipa_profile(krbctx.default_realm)
|
|
|
|
if __name__ == '__main__':
|
|
installutils.run_script(main, operation_name='ipa-upgradeconfig')
|