mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-01-11 16:51:55 -06:00
e5e42fc83a
Part of: https://fedorahosted.org/freeipa/ticket/4052 Reviewed-By: Petr Viktorin <pviktori@redhat.com>
225 lines
8.4 KiB
Python
Executable File
225 lines
8.4 KiB
Python
Executable File
#! /usr/bin/python2 -E
|
|
# Authors: Rob Crittenden <rcritten@redhat.com>
|
|
#
|
|
# Copyright (C) 2011 Red Hat
|
|
# see file 'COPYING' for use and warranty information
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
#
|
|
|
|
import sys
|
|
import socket
|
|
|
|
import os, shutil
|
|
|
|
from ipapython import ipautil
|
|
|
|
from ipaserver.install import installutils, service
|
|
from ipaserver.install import certs
|
|
from ipaserver.install.installutils import (HostnameLocalhost, ReplicaConfig,
|
|
expand_replica_info, read_replica_info, get_host_name, BadHostError,
|
|
private_ccache, read_replica_info_dogtag_port)
|
|
from ipaserver.install import dsinstance, cainstance, bindinstance
|
|
from ipaserver.install.replication import replica_conn_check
|
|
from ipapython import version
|
|
from ipalib import api, util
|
|
from ipapython.dn import DN
|
|
from ipapython.config import IPAOptionParser
|
|
from ipapython import sysrestore
|
|
from ipapython import dogtag
|
|
from ipapython.ipa_log_manager import *
|
|
from ipaplatform import services
|
|
from ipaplatform.paths import paths
|
|
|
|
log_file_name = paths.IPAREPLICA_CA_INSTALL_LOG
|
|
REPLICA_INFO_TOP_DIR = None
|
|
|
|
def parse_options():
|
|
usage = "%prog [options] REPLICA_FILE"
|
|
parser = IPAOptionParser(usage=usage, version=version.VERSION)
|
|
parser.add_option("-d", "--debug", dest="debug", action="store_true",
|
|
default=False, help="gather extra debugging information")
|
|
parser.add_option("-p", "--password", dest="password", sensitive=True,
|
|
help="Directory Manager (existing master) password")
|
|
parser.add_option("-w", "--admin-password", dest="admin_password", sensitive=True,
|
|
help="Admin user Kerberos password used for connection check")
|
|
parser.add_option("--no-host-dns", dest="no_host_dns", action="store_true",
|
|
default=False,
|
|
help="Do not use DNS for hostname lookup during installation")
|
|
parser.add_option("--skip-conncheck", dest="skip_conncheck", action="store_true",
|
|
default=False, help="skip connection check to remote master")
|
|
parser.add_option("--skip-schema-check", dest="skip_schema_check", action="store_true",
|
|
default=False, help="skip check for updated CA DS schema on the remote master")
|
|
parser.add_option("-U", "--unattended", dest="unattended", action="store_true",
|
|
default=False, help="unattended installation never prompts the user")
|
|
|
|
options, args = parser.parse_args()
|
|
safe_options = parser.get_safe_opts(options)
|
|
|
|
if len(args) != 1:
|
|
parser.error("you must provide a file generated by ipa-replica-prepare")
|
|
|
|
return safe_options, options, args[0]
|
|
|
|
def get_dirman_password():
|
|
return installutils.read_password("Directory Manager (existing master)", confirm=False, validate=False)
|
|
|
|
def install_dns_records(config, options):
|
|
|
|
if not bindinstance.dns_container_exists(config.master_host_name,
|
|
ipautil.realm_to_suffix(config.realm_name),
|
|
dm_password=config.dirman_password):
|
|
return
|
|
|
|
bind = bindinstance.BindInstance(dm_password=config.dirman_password)
|
|
try:
|
|
api.Backend.ldap2.connect(bind_dn=DN(('cn', 'Directory Manager')),
|
|
bind_pw=config.dirman_password)
|
|
bind.add_ipa_ca_dns_records(config.host_name, config.domain_name)
|
|
finally:
|
|
if api.Backend.ldap2.isconnected():
|
|
api.Backend.ldap2.disconnect()
|
|
|
|
def main():
|
|
safe_options, options, filename = parse_options()
|
|
|
|
if os.geteuid() != 0:
|
|
sys.exit("\nYou must be root to run this script.\n")
|
|
|
|
standard_logging_setup(log_file_name, debug=options.debug)
|
|
|
|
root_logger.debug('%s was invoked with argument "%s" and options: %s' % (sys.argv[0], filename, safe_options))
|
|
root_logger.debug('IPA version %s' % version.VENDOR_VERSION)
|
|
|
|
if not ipautil.file_exists(filename):
|
|
sys.exit("Replica file %s does not exist" % filename)
|
|
|
|
global sstore
|
|
sstore = sysrestore.StateFile(paths.SYSRESTORE)
|
|
|
|
if not dsinstance.DsInstance().is_configured():
|
|
sys.exit("IPA server is not configured on this system.\n")
|
|
|
|
api.bootstrap(in_server=True)
|
|
api.finalize()
|
|
|
|
if api.env.ra_plugin == 'selfsign':
|
|
sys.exit('A selfsign CA can not be added')
|
|
|
|
# get the directory manager password
|
|
dirman_password = options.password
|
|
if not dirman_password:
|
|
if options.unattended:
|
|
sys.exit('Directory Manager password required')
|
|
try:
|
|
dirman_password = get_dirman_password()
|
|
except KeyboardInterrupt:
|
|
sys.exit(0)
|
|
if dirman_password is None:
|
|
sys.exit("Directory Manager password required")
|
|
|
|
if not options.admin_password and not options.skip_conncheck and \
|
|
options.unattended:
|
|
sys.exit('admin password required')
|
|
|
|
try:
|
|
top_dir, dir = expand_replica_info(filename, dirman_password)
|
|
global REPLICA_INFO_TOP_DIR
|
|
REPLICA_INFO_TOP_DIR = top_dir
|
|
except Exception, e:
|
|
print "ERROR: Failed to decrypt or open the replica file."
|
|
print "Verify you entered the correct Directory Manager password."
|
|
sys.exit(1)
|
|
|
|
config = ReplicaConfig()
|
|
read_replica_info(dir, config)
|
|
config.dirman_password = dirman_password
|
|
try:
|
|
host = get_host_name(options.no_host_dns)
|
|
except BadHostError, e:
|
|
root_logger.error(str(e))
|
|
sys.exit(1)
|
|
if config.host_name != host:
|
|
try:
|
|
print "This replica was created for '%s' but this machine is named '%s'" % (config.host_name, host)
|
|
if not ipautil.user_input("This may cause problems. Continue?", True):
|
|
sys.exit(0)
|
|
config.host_name = host
|
|
print ""
|
|
except KeyboardInterrupt:
|
|
sys.exit(0)
|
|
config.dir = dir
|
|
config.setup_ca = True
|
|
config.ca_ds_port = read_replica_info_dogtag_port(config.dir)
|
|
|
|
if not ipautil.file_exists(config.dir + "/cacert.p12"):
|
|
print 'CA cannot be installed in CA-less setup.'
|
|
sys.exit(1)
|
|
|
|
if not options.skip_conncheck:
|
|
replica_conn_check(
|
|
config.master_host_name, config.host_name, config.realm_name, True,
|
|
config.ca_ds_port, options.admin_password)
|
|
|
|
if options.skip_schema_check:
|
|
root_logger.info("Skipping CA DS schema check")
|
|
else:
|
|
cainstance.replica_ca_install_check(config)
|
|
|
|
# Configure the CA if necessary
|
|
CA = cainstance.install_replica_ca(config, postinstall=True)
|
|
|
|
# We need to ldap_enable the CA now that DS is up and running
|
|
CA.ldap_enable('CA', config.host_name, config.dirman_password,
|
|
ipautil.realm_to_suffix(config.realm_name))
|
|
|
|
# This is done within stopped_service context, which restarts CA
|
|
CA.enable_client_auth_to_db()
|
|
|
|
# Install CA DNS records
|
|
install_dns_records(config, options)
|
|
|
|
# We need to restart apache as we drop a new config file in there
|
|
services.knownservices.httpd.restart(capture_output=True)
|
|
|
|
#update dogtag version in config file
|
|
try:
|
|
fd = open(paths.IPA_DEFAULT_CONF, "a")
|
|
fd.write(
|
|
"dogtag_version=%s\n" % dogtag.install_constants.DOGTAG_VERSION)
|
|
fd.close()
|
|
except IOError, e:
|
|
print "Failed to update /etc/ipa/default.conf"
|
|
root_logger.error(str(e))
|
|
sys.exit(1)
|
|
|
|
fail_message = '''
|
|
Your system may be partly configured.
|
|
Run /usr/sbin/ipa-server-install --uninstall to clean up.
|
|
'''
|
|
|
|
if __name__ == '__main__':
|
|
try:
|
|
with private_ccache():
|
|
installutils.run_script(main, log_file_name=log_file_name,
|
|
operation_name='ipa-ca-install',
|
|
fail_message=fail_message)
|
|
finally:
|
|
# always try to remove decrypted replica file
|
|
try:
|
|
if REPLICA_INFO_TOP_DIR:
|
|
shutil.rmtree(REPLICA_INFO_TOP_DIR)
|
|
except OSError:
|
|
pass
|