mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-27 01:11:32 -06:00
90f7232454
Helper scripts now use api.bootstrap(log=None) to avoid the creation of log files. Helper scripts are typically executed from daemons which perform their own logging. The helpers still log to stderr/stdout. This also gets rid of some SELinux AVCs when the script tries to write to /root/.ipa/. Fixes: https://pagure.io/freeipa/issue/8075 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
64 lines
1.6 KiB
Python
64 lines
1.6 KiB
Python
#
|
|
# Copyright (C) 2019 IPA Project Contributors, see COPYING for license
|
|
#
|
|
"""Export / import Directory Manager password hash
|
|
"""
|
|
import json
|
|
import os
|
|
|
|
from ipalib import api
|
|
from ipalib import errors
|
|
from ipaplatform.paths import paths
|
|
from ipapython.dn import DN
|
|
from ipapython.ipaldap import LDAPClient, realm_to_ldapi_uri
|
|
from . import common
|
|
|
|
CN_CONFIG = DN(('cn', 'config'))
|
|
ROOTPW = 'nsslapd-rootpw'
|
|
|
|
|
|
def export_key(args, tmpdir, conn):
|
|
entry = conn.get_entry(CN_CONFIG, [ROOTPW])
|
|
data = {
|
|
'dmhash': entry.single_value[ROOTPW],
|
|
}
|
|
common.json_dump(data, args.exportfile)
|
|
|
|
|
|
def import_key(args, tmpdir, conn):
|
|
data = json.load(args.importfile)
|
|
dmhash = data['dmhash'].encode('ascii')
|
|
entry = conn.get_entry(CN_CONFIG, [ROOTPW])
|
|
entry.single_value[ROOTPW] = dmhash
|
|
try:
|
|
conn.update_entry(entry)
|
|
except errors.EmptyModlist:
|
|
pass
|
|
|
|
|
|
def main():
|
|
parser = common.mkparser(
|
|
description='ipa-custodia LDAP DM hash handler'
|
|
)
|
|
|
|
if os.getegid() != 0:
|
|
parser.error("Must be run as root user.\n")
|
|
|
|
# create LDAP connection using LDAPI and EXTERNAL bind as root
|
|
if not api.isdone('bootstrap'):
|
|
api.bootstrap(confdir=paths.ETC_IPA, log=None)
|
|
realm = api.env.realm
|
|
ldap_uri = realm_to_ldapi_uri(realm)
|
|
conn = LDAPClient(ldap_uri=ldap_uri, no_schema=True)
|
|
try:
|
|
conn.external_bind()
|
|
except Exception as e:
|
|
parser.error("Failed to connect to {}: {}\n".format(ldap_uri, e))
|
|
|
|
with conn:
|
|
common.main(parser, export_key, import_key, conn=conn)
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main()
|