mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-28 01:41:14 -06:00
1250 lines
51 KiB
Python
Executable File
1250 lines
51 KiB
Python
Executable File
#! /usr/bin/python -E
|
|
# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
|
|
# Simo Sorce <ssorce@redhat.com>
|
|
# Rob Crittenden <rcritten@redhat.com>
|
|
#
|
|
# Copyright (C) 2007-2010 Red Hat
|
|
# see file 'COPYING' for use and warranty information
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
#
|
|
|
|
|
|
# requires the following packages:
|
|
# fedora-ds-base
|
|
# openldap-clients
|
|
# nss-tools
|
|
|
|
import sys
|
|
import os
|
|
import errno
|
|
import grp
|
|
import subprocess
|
|
import signal
|
|
import shutil
|
|
import glob
|
|
import pickle
|
|
import random
|
|
import tempfile
|
|
import nss.error
|
|
import base64
|
|
from optparse import OptionGroup, OptionValueError, SUPPRESS_HELP
|
|
|
|
from ipaserver.install import dsinstance
|
|
from ipaserver.install import krbinstance
|
|
from ipaserver.install import bindinstance
|
|
from ipaserver.install import httpinstance
|
|
from ipaserver.install import ntpinstance
|
|
from ipaserver.install import certs
|
|
from ipaserver.install import cainstance
|
|
from ipaserver.install import memcacheinstance
|
|
from ipaserver.install import sysupgrade
|
|
|
|
from ipaserver.install import service, installutils
|
|
from ipapython import version
|
|
from ipapython import certmonger
|
|
from ipaserver.install.installutils import *
|
|
from ipaserver.plugins.ldap2 import ldap2
|
|
|
|
from ipapython import sysrestore
|
|
from ipapython.ipautil import *
|
|
from ipapython import ipautil
|
|
from ipapython import dogtag
|
|
from ipalib import api, errors, util, x509
|
|
from ipapython.config import IPAOptionParser
|
|
from ipalib.x509 import load_certificate_from_file, load_certificate_chain_from_file
|
|
from ipalib.util import validate_domain_name
|
|
from ipapython import services as ipaservices
|
|
from ipapython.ipa_log_manager import *
|
|
from ipapython.dn import DN
|
|
|
|
import ipaclient.ntpconf
|
|
|
|
uninstalling = False
|
|
installation_cleanup = True
|
|
|
|
VALID_SUBJECT_ATTRS = ['st', 'o', 'ou', 'dnqualifier', 'c',
|
|
'serialnumber', 'l', 'title', 'sn', 'givenname',
|
|
'initials', 'generationqualifier', 'dc', 'mail',
|
|
'uid', 'postaladdress', 'postalcode', 'postofficebox',
|
|
'houseidentifier', 'e', 'street', 'pseudonym',
|
|
'incorporationlocality', 'incorporationstate',
|
|
'incorporationcountry', 'businesscategory']
|
|
|
|
def subject_callback(option, opt_str, value, parser):
|
|
"""
|
|
Make sure the certificate subject base is a valid DN
|
|
"""
|
|
v = unicode(value, 'utf-8')
|
|
if any(ord(c) < 0x20 for c in v):
|
|
raise OptionValueError("Subject base must not contain control characters")
|
|
if '&' in v:
|
|
raise OptionValueError("Subject base must not contain an ampersand (\"&\")")
|
|
try:
|
|
dn = DN(v)
|
|
for rdn in dn:
|
|
if rdn.attr.lower() not in VALID_SUBJECT_ATTRS:
|
|
raise OptionValueError('%s=%s has invalid attribute: "%s"' % (opt_str, value, rdn.attr))
|
|
except ValueError, e:
|
|
raise OptionValueError('%s=%s has invalid subject base format: %s' % (opt_str, value, e))
|
|
parser.values.subject = dn
|
|
|
|
def validate_dm_password(password):
|
|
if len(password) < 8:
|
|
raise ValueError("Password must be at least 8 characters long")
|
|
if any(ord(c) < 0x20 for c in password):
|
|
raise ValueError("Password must not contain control characters")
|
|
if any(ord(c) >= 0x7F for c in password):
|
|
raise ValueError("Password must only contain ASCII characters")
|
|
|
|
# Disallow characters that pkisilent doesn't process properly:
|
|
bad_characters = ' &\\<'
|
|
if any(c in bad_characters for c in password):
|
|
raise ValueError('Password must not contain these characters: %s' %
|
|
', '.join('"%s"' % c for c in bad_characters))
|
|
|
|
def parse_options():
|
|
# Guaranteed to give a random 200k range below the 2G mark (uint32_t limit)
|
|
namespace = random.randint(1, 10000) * 200000
|
|
parser = IPAOptionParser(version=version.VERSION)
|
|
|
|
basic_group = OptionGroup(parser, "basic options")
|
|
basic_group.add_option("-r", "--realm", dest="realm_name",
|
|
help="realm name")
|
|
basic_group.add_option("-n", "--domain", dest="domain_name",
|
|
help="domain name")
|
|
basic_group.add_option("-p", "--ds-password", dest="dm_password",
|
|
sensitive=True, help="admin password")
|
|
basic_group.add_option("-P", "--master-password",
|
|
dest="master_password", sensitive=True,
|
|
help="kerberos master password (normally autogenerated)")
|
|
basic_group.add_option("-a", "--admin-password",
|
|
sensitive=True, dest="admin_password",
|
|
help="admin user kerberos password")
|
|
basic_group.add_option("--mkhomedir",
|
|
dest="mkhomedir",
|
|
action="store_true",
|
|
default=False,
|
|
help="create home directories for users "
|
|
"on their first login")
|
|
basic_group.add_option("--hostname", dest="host_name", help="fully qualified name of server")
|
|
basic_group.add_option("--ip-address", dest="ip_address",
|
|
type="ip", ip_local=True,
|
|
help="Master Server IP Address")
|
|
basic_group.add_option("-N", "--no-ntp", dest="conf_ntp", action="store_false",
|
|
help="do not configure ntp", default=True)
|
|
basic_group.add_option("--idstart", dest="idstart", default=namespace, type=int,
|
|
help="The starting value for the IDs range (default random)")
|
|
basic_group.add_option("--idmax", dest="idmax", default=0, type=int,
|
|
help="The max value value for the IDs range (default: idstart+199999)")
|
|
basic_group.add_option("--no_hbac_allow", dest="hbac_allow", default=False,
|
|
action="store_true",
|
|
help="Don't install allow_all HBAC rule")
|
|
basic_group.add_option("--no-ui-redirect", dest="ui_redirect", action="store_false",
|
|
default=True, help="Do not automatically redirect to the Web UI")
|
|
basic_group.add_option("--ssh-trust-dns", dest="trust_sshfp", default=False, action="store_true",
|
|
help="configure OpenSSH client to trust DNS SSHFP records")
|
|
basic_group.add_option("--no-ssh", dest="conf_ssh", default=True, action="store_false",
|
|
help="do not configure OpenSSH client")
|
|
basic_group.add_option("--no-sshd", dest="conf_sshd", default=True, action="store_false",
|
|
help="do not configure OpenSSH server")
|
|
basic_group.add_option("-d", "--debug", dest="debug", action="store_true",
|
|
default=False, help="print debugging information")
|
|
basic_group.add_option("-U", "--unattended", dest="unattended", action="store_true",
|
|
default=False, help="unattended (un)installation never prompts the user")
|
|
parser.add_option_group(basic_group)
|
|
|
|
cert_group = OptionGroup(parser, "certificate system options")
|
|
cert_group.add_option("", "--external-ca", dest="external_ca", action="store_true",
|
|
default=False, help="Generate a CSR to be signed by an external CA")
|
|
cert_group.add_option("", "--external_cert_file", dest="external_cert_file",
|
|
help="PEM file containing a certificate signed by the external CA")
|
|
cert_group.add_option("", "--external_ca_file", dest="external_ca_file",
|
|
help="PEM file containing the external CA chain")
|
|
cert_group.add_option("--no-pkinit", dest="setup_pkinit", action="store_false",
|
|
default=True, help="disables pkinit setup steps")
|
|
cert_group.add_option("--dirsrv_pkcs12", dest="dirsrv_pkcs12",
|
|
help="PKCS#12 file containing the Directory Server SSL certificate")
|
|
cert_group.add_option("--http_pkcs12", dest="http_pkcs12",
|
|
help="PKCS#12 file containing the Apache Server SSL certificate")
|
|
cert_group.add_option("--pkinit_pkcs12", dest="pkinit_pkcs12",
|
|
help="PKCS#12 file containing the Kerberos KDC SSL certificate")
|
|
cert_group.add_option("--dirsrv_pin", dest="dirsrv_pin", sensitive=True,
|
|
help="The password of the Directory Server PKCS#12 file")
|
|
cert_group.add_option("--http_pin", dest="http_pin", sensitive=True,
|
|
help="The password of the Apache Server PKCS#12 file")
|
|
cert_group.add_option("--pkinit_pin", dest="pkinit_pin",
|
|
help="The password of the Kerberos KDC PKCS#12 file")
|
|
cert_group.add_option("--root-ca-file", dest="root_ca_file",
|
|
help="PEM file with root CA certificate(s) to trust")
|
|
cert_group.add_option("--subject", action="callback", callback=subject_callback,
|
|
type="string",
|
|
help="The certificate subject base (default O=<realm-name>)")
|
|
parser.add_option_group(cert_group)
|
|
|
|
dns_group = OptionGroup(parser, "DNS options")
|
|
dns_group.add_option("--setup-dns", dest="setup_dns", action="store_true",
|
|
default=False, help="configure bind with our zone")
|
|
dns_group.add_option("--forwarder", dest="forwarders", action="append",
|
|
type="ip", help="Add a DNS forwarder")
|
|
dns_group.add_option("--no-forwarders", dest="no_forwarders", action="store_true",
|
|
default=False, help="Do not add any DNS forwarders, use root servers instead")
|
|
dns_group.add_option("--reverse-zone", dest="reverse_zone", help="The reverse DNS zone to use")
|
|
dns_group.add_option("--no-reverse", dest="no_reverse", action="store_true",
|
|
default=False, help="Do not create reverse DNS zone")
|
|
dns_group.add_option("--zonemgr", action="callback", callback=bindinstance.zonemgr_callback,
|
|
type="string",
|
|
help="DNS zone manager e-mail address. Defaults to hostmaster@DOMAIN")
|
|
# this option name has been deprecated, persistent search has been enabled by default
|
|
dns_group.add_option("--zone-notif", dest="zone_notif",
|
|
action="store_true", default=False, help=SUPPRESS_HELP)
|
|
dns_group.add_option("--no-persistent-search", dest="persistent_search",
|
|
default=True, action="store_false",
|
|
help="Do not enable persistent search feature in the name server")
|
|
dns_group.add_option("--zone-refresh", dest="zone_refresh",
|
|
default=0, type="int",
|
|
help="When set to non-zero the name server will use DNS zone "
|
|
"detection based on polling instead of a persistent search")
|
|
dns_group.add_option("--no-host-dns", dest="no_host_dns", action="store_true",
|
|
default=False,
|
|
help="Do not use DNS for hostname lookup during installation")
|
|
dns_group.add_option("--no-dns-sshfp", dest="create_sshfp", default=True, action="store_false",
|
|
help="Do not automatically create DNS SSHFP records")
|
|
dns_group.add_option("--no-serial-autoincrement", dest="serial_autoincrement",
|
|
default=True, action="store_false",
|
|
help="Do not enable SOA serial autoincrement")
|
|
parser.add_option_group(dns_group)
|
|
|
|
uninstall_group = OptionGroup(parser, "uninstall options")
|
|
uninstall_group.add_option("", "--uninstall", dest="uninstall", action="store_true",
|
|
default=False, help="uninstall an existing installation. The uninstall can " \
|
|
"be run with --unattended option")
|
|
parser.add_option_group(uninstall_group)
|
|
|
|
options, args = parser.parse_args()
|
|
safe_options = parser.get_safe_opts(options)
|
|
|
|
if options.dm_password is not None:
|
|
try:
|
|
validate_dm_password(options.dm_password)
|
|
except ValueError, e:
|
|
parser.error("DS admin password: " + str(e))
|
|
if options.admin_password is not None and len(options.admin_password) < 8:
|
|
parser.error("Admin user password must be at least 8 characters long")
|
|
|
|
if options.domain_name is not None:
|
|
try:
|
|
validate_domain_name(options.domain_name)
|
|
except ValueError, e:
|
|
parser.error("invalid domain: " + unicode(e))
|
|
|
|
if not options.setup_dns:
|
|
if options.forwarders:
|
|
parser.error("You cannot specify a --forwarder option without the --setup-dns option")
|
|
if options.no_forwarders:
|
|
parser.error("You cannot specify a --no-forwarders option without the --setup-dns option")
|
|
if options.reverse_zone:
|
|
parser.error("You cannot specify a --reverse-zone option without the --setup-dns option")
|
|
if options.no_reverse:
|
|
parser.error("You cannot specify a --no-reverse option without the --setup-dns option")
|
|
elif options.forwarders and options.no_forwarders:
|
|
parser.error("You cannot specify a --forwarder option together with --no-forwarders")
|
|
elif options.reverse_zone and options.no_reverse:
|
|
parser.error("You cannot specify a --reverse-zone option together with --no-reverse")
|
|
|
|
if options.uninstall:
|
|
if (options.realm_name or
|
|
options.admin_password or options.master_password):
|
|
parser.error("In uninstall mode, -a, -r and -P options are not allowed")
|
|
elif options.unattended:
|
|
if (not options.realm_name or
|
|
not options.dm_password or not options.admin_password):
|
|
parser.error("In unattended mode you need to provide at least -r, -p and -a options")
|
|
if options.setup_dns:
|
|
if not options.forwarders and not options.no_forwarders:
|
|
parser.error("You must specify at least one --forwarder option or --no-forwarders option")
|
|
|
|
# If any of the PKCS#12 options are selected, all are required. Create a
|
|
# list of the options and count it to enforce that all are required without
|
|
# having a huge set of it blocks.
|
|
pkcs12 = [options.dirsrv_pkcs12, options.http_pkcs12, options.dirsrv_pin, options.http_pin]
|
|
cnt = pkcs12.count(None)
|
|
if cnt > 0 and cnt < 4:
|
|
parser.error("All PKCS#12 options are required if any are used.")
|
|
|
|
if options.dirsrv_pkcs12 and not options.root_ca_file:
|
|
parser.error(
|
|
"--root-ca-file must be given with the PKCS#12 options.")
|
|
if options.dirsrv_pkcs12 and not options.root_ca_file:
|
|
parser.error(
|
|
"The PKCS#12 options must be given with --root-ca-file.")
|
|
|
|
if (options.external_cert_file or options.external_ca_file) and options.dirsrv_pkcs12:
|
|
parser.error(
|
|
"PKCS#12 options cannot be used with the external CA options.")
|
|
|
|
if options.external_ca:
|
|
if options.external_cert_file:
|
|
parser.error("You cannot specify --external_cert_file together with --external-ca")
|
|
if options.external_ca_file:
|
|
parser.error("You cannot specify --external_ca_file together with --external-ca")
|
|
if options.dirsrv_pkcs12:
|
|
parser.error("You cannot specify PKCS#12 options together with --external-ca")
|
|
|
|
if ((options.external_cert_file and not options.external_ca_file) or
|
|
(not options.external_cert_file and options.external_ca_file)):
|
|
parser.error("if either external CA option is used, both are required.")
|
|
|
|
if (options.external_ca_file and not os.path.isabs(options.external_ca_file)):
|
|
parser.error("--external-ca-file must use an absolute path")
|
|
if (options.external_cert_file and not os.path.isabs(options.external_cert_file)):
|
|
parser.error("--external-cert-file must use an absolute path")
|
|
|
|
if options.idmax == 0:
|
|
options.idmax = int(options.idstart) + 200000 - 1
|
|
|
|
if options.idmax < options.idstart:
|
|
parser.error("idmax (%u) cannot be smaller than idstart (%u)" %
|
|
(options.idmax, options.idstart))
|
|
|
|
#Automatically disable pkinit w/ dogtag until that is supported
|
|
options.setup_pkinit = False
|
|
|
|
if options.zone_refresh < 0:
|
|
parser.error("negative numbers not allowed for --zone-refresh")
|
|
elif options.zone_refresh > 0:
|
|
options.persistent_search = False # mutually exclusive features
|
|
|
|
if options.serial_autoincrement and not options.persistent_search:
|
|
parser.error('persistent search feature is required for '
|
|
'DNS SOA serial autoincrement')
|
|
|
|
if options.zone_notif:
|
|
print >>sys.stderr, "WARNING: --zone-notif option is deprecated and has no effect"
|
|
|
|
return safe_options, options
|
|
|
|
def signal_handler(signum, frame):
|
|
global ds
|
|
print "\nCleaning up..."
|
|
if ds:
|
|
print "Removing configuration for %s instance" % ds.serverid
|
|
ds.stop()
|
|
if ds.serverid:
|
|
dsinstance.erase_ds_instance_data (ds.serverid)
|
|
sys.exit(1)
|
|
|
|
ANSWER_CACHE = "/root/.ipa_cache"
|
|
|
|
def read_cache(dm_password):
|
|
"""
|
|
Returns a dict of cached answers or empty dict if no cache file exists.
|
|
"""
|
|
if not ipautil.file_exists(ANSWER_CACHE):
|
|
return {}
|
|
|
|
top_dir = tempfile.mkdtemp("ipa")
|
|
fname = "%s/cache" % top_dir
|
|
try:
|
|
decrypt_file(ANSWER_CACHE, fname, dm_password, top_dir)
|
|
except Exception, e:
|
|
shutil.rmtree(top_dir)
|
|
raise Exception("Decryption of answer cache in %s failed, please check your password." % ANSWER_CACHE)
|
|
|
|
try:
|
|
with open(fname, 'rb') as f:
|
|
try:
|
|
optdict = pickle.load(f)
|
|
except Exception, e:
|
|
raise Exception("Parse error in %s: %s" % (ANSWER_CACHE, str(e)))
|
|
except IOError, e:
|
|
raise Exception("Read error in %s: %s" % (ANSWER_CACHE, str(e)))
|
|
finally:
|
|
shutil.rmtree(top_dir)
|
|
|
|
# These are the only ones that may be overridden
|
|
for opt in ('external_ca_file', 'external_cert_file'):
|
|
try:
|
|
del optdict[opt]
|
|
except KeyError:
|
|
pass
|
|
|
|
return optdict
|
|
|
|
def write_cache(options):
|
|
"""
|
|
Takes a dict as input and writes a cached file of answers
|
|
"""
|
|
top_dir = tempfile.mkdtemp("ipa")
|
|
fname = "%s/cache" % top_dir
|
|
try:
|
|
with open(fname, 'wb') as f:
|
|
pickle.dump(options, f)
|
|
ipautil.encrypt_file(fname, ANSWER_CACHE, options['dm_password'], top_dir)
|
|
except IOError, e:
|
|
raise Exception("Unable to cache command-line options %s" % str(e))
|
|
finally:
|
|
shutil.rmtree(top_dir)
|
|
|
|
def read_host_name(host_default,no_host_dns=False):
|
|
host_name = ""
|
|
|
|
print "Enter the fully qualified domain name of the computer"
|
|
print "on which you're setting up server software. Using the form"
|
|
print "<hostname>.<domainname>"
|
|
print "Example: master.example.com."
|
|
print ""
|
|
print ""
|
|
if host_default == "":
|
|
host_default = "master.example.com"
|
|
host_name = user_input("Server host name", host_default, allow_empty = False)
|
|
print ""
|
|
verify_fqdn(host_name,no_host_dns)
|
|
|
|
return host_name
|
|
|
|
def read_domain_name(domain_name, unattended):
|
|
print "The domain name has been determined based on the host name."
|
|
print ""
|
|
if not unattended:
|
|
domain_name = user_input("Please confirm the domain name", domain_name)
|
|
print ""
|
|
return domain_name
|
|
|
|
def read_realm_name(domain_name, unattended):
|
|
print "The kerberos protocol requires a Realm name to be defined."
|
|
print "This is typically the domain name converted to uppercase."
|
|
print ""
|
|
|
|
if unattended:
|
|
return domain_name.upper()
|
|
realm_name = user_input("Please provide a realm name", domain_name.upper())
|
|
upper_dom = realm_name.upper() #pylint: disable=E1103
|
|
if upper_dom != realm_name:
|
|
print "An upper-case realm name is required."
|
|
if not user_input("Do you want to use " + upper_dom + " as realm name?", True):
|
|
print ""
|
|
print "An upper-case realm name is required. Unable to continue."
|
|
sys.exit(1)
|
|
else:
|
|
realm_name = upper_dom
|
|
print ""
|
|
return realm_name
|
|
|
|
|
|
def read_dm_password():
|
|
print "Certain directory server operations require an administrative user."
|
|
print "This user is referred to as the Directory Manager and has full access"
|
|
print "to the Directory for system management tasks and will be added to the"
|
|
print "instance of directory server created for IPA."
|
|
print "The password must be at least 8 characters long."
|
|
print ""
|
|
#TODO: provide the option of generating a random password
|
|
dm_password = read_password("Directory Manager", validator=validate_dm_password)
|
|
return dm_password
|
|
|
|
def read_admin_password():
|
|
print "The IPA server requires an administrative user, named 'admin'."
|
|
print "This user is a regular system account used for IPA server administration."
|
|
print ""
|
|
#TODO: provide the option of generating a random password
|
|
admin_password = read_password("IPA admin")
|
|
return admin_password
|
|
|
|
def check_dirsrv(unattended):
|
|
(ds_unsecure, ds_secure) = dsinstance.check_ports()
|
|
if not ds_unsecure or not ds_secure:
|
|
print "IPA requires ports 389 and 636 for the Directory Server."
|
|
print "These are currently in use:"
|
|
if not ds_unsecure:
|
|
print "\t389"
|
|
if not ds_secure:
|
|
print "\t636"
|
|
sys.exit(1)
|
|
|
|
def uninstall():
|
|
|
|
rv = 0
|
|
|
|
print "Shutting down all IPA services"
|
|
try:
|
|
(stdout, stderr, rc) = run(["/usr/sbin/ipactl", "stop"], raiseonerr=False)
|
|
except Exception, e:
|
|
pass
|
|
|
|
# Need to get dogtag info before /etc/ipa/default.conf is removed
|
|
dogtag_constants = dogtag.configured_constants()
|
|
|
|
print "Removing IPA client configuration"
|
|
try:
|
|
(stdout, stderr, rc) = run(["/usr/sbin/ipa-client-install", "--on-master", "--unattended", "--uninstall"], raiseonerr=False)
|
|
if rc not in [0,2]:
|
|
root_logger.debug("ipa-client-install returned %d" % rc)
|
|
raise RuntimeError(stdout)
|
|
except Exception, e:
|
|
rv = 1
|
|
print "Uninstall of client side components failed!"
|
|
print "ipa-client-install returned: " + str(e)
|
|
|
|
ntpinstance.NTPInstance(fstore).uninstall()
|
|
if not dogtag_constants.SHARED_DB:
|
|
cads_instance = cainstance.CADSInstance(
|
|
dogtag_constants=dogtag_constants)
|
|
if cads_instance.is_configured():
|
|
cads_instance.uninstall()
|
|
cainstance.stop_tracking_certificates(dogtag_constants)
|
|
ca_instance = cainstance.CAInstance(
|
|
api.env.realm, certs.NSS_DIR, dogtag_constants=dogtag_constants)
|
|
if ca_instance.is_configured():
|
|
ca_instance.uninstall()
|
|
bindinstance.BindInstance(fstore).uninstall()
|
|
httpinstance.HTTPInstance(fstore).uninstall()
|
|
krbinstance.KrbInstance(fstore).uninstall()
|
|
dsinstance.DsInstance(fstore=fstore).uninstall()
|
|
memcacheinstance.MemcacheInstance().uninstall()
|
|
ipaservices.restore_network_configuration(fstore, sstore)
|
|
fstore.restore_all_files()
|
|
try:
|
|
os.remove(ANSWER_CACHE)
|
|
except Exception:
|
|
pass
|
|
|
|
# ipa-client-install removes /etc/ipa/default.conf
|
|
|
|
sstore._load()
|
|
|
|
ipaclient.ntpconf.restore_forced_ntpd(sstore)
|
|
|
|
group_exists = sstore.restore_state("install", "group_exists")
|
|
|
|
ipaservices.knownservices.ipa.disable()
|
|
|
|
ipautil.restore_hostname(sstore)
|
|
|
|
# remove upgrade state file
|
|
sysupgrade.remove_upgrade_file()
|
|
|
|
if fstore.has_files():
|
|
root_logger.error('Some files have not been restored, see /var/lib/ipa/sysrestore/sysrestore.index')
|
|
has_state = False
|
|
for module in IPA_MODULES: # from installutils
|
|
if sstore.has_state(module):
|
|
root_logger.error('Some installation state for %s has not been restored, see /var/lib/ipa/sysrestore/sysrestore.state' % module)
|
|
has_state = True
|
|
rv = 1
|
|
|
|
if has_state:
|
|
root_logger.error('Some installation state has not been restored.\nThis may cause re-installation to fail.\nIt should be safe to remove /var/lib/ipa/sysrestore.state but it may\nmean your system hasn\'t be restored to its pre-installation state.')
|
|
|
|
# Note that this name will be wrong after the first uninstall.
|
|
dirname = dsinstance.config_dirname(dsinstance.realm_to_serverid(api.env.realm))
|
|
dirs = [dirname, dogtag_constants.ALIAS_DIR, certs.NSS_DIR]
|
|
ids = certmonger.check_state(dirs)
|
|
if ids:
|
|
root_logger.error('Some certificates may still be tracked by certmonger.\nThis will cause re-installation to fail.\nStart the certmonger service and list the certificates being tracked\n # getcert list\nThese may be untracked by executing\n # getcert stop-tracking -i <request_id>\nfor each id in: %s' % ', '.join(ids))
|
|
|
|
return rv
|
|
|
|
|
|
def set_subject_in_config(realm_name, dm_password, suffix, subject_base):
|
|
ldapuri = 'ldapi://%%2fvar%%2frun%%2fslapd-%s.socket' % (
|
|
dsinstance.realm_to_serverid(realm_name)
|
|
)
|
|
try:
|
|
conn = ldap2(shared_instance=False, ldap_uri=ldapuri, base_dn=suffix)
|
|
conn.connect(bind_dn=DN(('cn', 'directory manager')), bind_pw=dm_password)
|
|
except errors.ExecutionError, e:
|
|
root_logger.critical("Could not connect to the Directory Server on %s" % realm_name)
|
|
raise e
|
|
(dn, entry_attrs) = conn.get_ipa_config()
|
|
if 'ipacertificatesubjectbase' not in entry_attrs:
|
|
mod = {'ipacertificatesubjectbase': str(subject_base)}
|
|
conn.update_entry(dn, mod)
|
|
conn.disconnect()
|
|
|
|
|
|
def main():
|
|
global ds
|
|
global uninstalling
|
|
global installation_cleanup
|
|
ds = None
|
|
|
|
safe_options, options = parse_options()
|
|
|
|
if os.getegid() != 0:
|
|
sys.exit("Must be root to set up server")
|
|
|
|
ipaservices.check_selinux_status()
|
|
|
|
signal.signal(signal.SIGTERM, signal_handler)
|
|
signal.signal(signal.SIGINT, signal_handler)
|
|
|
|
if options.uninstall:
|
|
uninstalling = True
|
|
standard_logging_setup("/var/log/ipaserver-uninstall.log", debug=options.debug)
|
|
installation_cleanup = False
|
|
else:
|
|
standard_logging_setup("/var/log/ipaserver-install.log", debug=options.debug)
|
|
print "\nThe log file for this installation can be found in /var/log/ipaserver-install.log"
|
|
if not options.external_ca and not options.external_cert_file and is_ipa_configured():
|
|
installation_cleanup = False
|
|
sys.exit("IPA server is already configured on this system.\n" +
|
|
"If you want to reinstall the IPA server, please uninstall " +
|
|
"it first using 'ipa-server-install --uninstall'.")
|
|
|
|
client_fstore = sysrestore.FileStore('/var/lib/ipa-client/sysrestore')
|
|
if client_fstore.has_files():
|
|
installation_cleanup = False
|
|
sys.exit("IPA client is already configured on this system.\n" +
|
|
"Please uninstall it before configuring the IPA server, " +
|
|
"using 'ipa-client-install --uninstall'")
|
|
|
|
root_logger.debug('%s was invoked with options: %s' % (sys.argv[0], safe_options))
|
|
root_logger.debug("missing options might be asked for interactively later\n")
|
|
|
|
global fstore
|
|
fstore = sysrestore.FileStore('/var/lib/ipa/sysrestore')
|
|
global sstore
|
|
sstore = sysrestore.StateFile('/var/lib/ipa/sysrestore')
|
|
|
|
# Configuration for ipalib, we will bootstrap and finalize later, after
|
|
# we are sure we have the configuration file ready.
|
|
cfg = dict(
|
|
context='installer',
|
|
in_server=True,
|
|
debug=options.debug
|
|
)
|
|
|
|
if options.uninstall:
|
|
|
|
# We will need at least api.env, finalize api now. This system is
|
|
# already installed, so the configuration file is there.
|
|
api.bootstrap(**cfg)
|
|
api.finalize()
|
|
|
|
if not options.unattended:
|
|
print "\nThis is a NON REVERSIBLE operation and will delete all data and configuration!\n"
|
|
if not user_input("Are you sure you want to continue with the uninstall procedure?", False):
|
|
print ""
|
|
print "Aborting uninstall operation."
|
|
sys.exit(1)
|
|
|
|
return uninstall()
|
|
|
|
if options.external_ca:
|
|
if cainstance.is_step_one_done():
|
|
print "CA is already installed.\nRun the installer with --external_cert_file and --external_ca_file."
|
|
sys.exit(1)
|
|
elif options.external_cert_file:
|
|
if not cainstance.is_step_one_done():
|
|
# This can happen if someone passes external_ca_file without
|
|
# already having done the first stage of the CA install.
|
|
print "CA is not installed yet. To install with an external CA is a two-stage process.\nFirst run the installer with --external-ca."
|
|
sys.exit(1)
|
|
|
|
# This will override any settings passed in on the cmdline
|
|
if ipautil.file_exists(ANSWER_CACHE):
|
|
if options.dm_password is not None:
|
|
dm_password = options.dm_password
|
|
else:
|
|
dm_password = read_password("Directory Manager", confirm=False)
|
|
if dm_password is None:
|
|
sys.exit("\nDirectory Manager password required")
|
|
try:
|
|
options._update_loose(read_cache(dm_password))
|
|
except Exception, e:
|
|
sys.exit("Cannot process the cache file: %s" % str(e))
|
|
|
|
if options.external_cert_file:
|
|
try:
|
|
extcert = load_certificate_from_file(options.external_cert_file)
|
|
except IOError, e:
|
|
print "Can't load the PEM certificate: %s." % str(e)
|
|
sys.exit(1)
|
|
except nss.error.NSPRError:
|
|
print "'%s' is not a valid PEM-encoded certificate." % options.external_cert_file
|
|
sys.exit(1)
|
|
|
|
certsubject = DN(str(extcert.subject))
|
|
wantsubject = DN(('CN','Certificate Authority'), options.subject)
|
|
if certsubject != wantsubject:
|
|
print "Subject of the external certificate is not correct (got %s, expected %s)." % (certsubject, wantsubject)
|
|
sys.exit(1)
|
|
|
|
try:
|
|
extchain = load_certificate_chain_from_file(options.external_ca_file)
|
|
except IOError, e:
|
|
print "Can't load the external CA chain: %s." % str(e)
|
|
sys.exit(1)
|
|
except nss.error.NSPRError:
|
|
print "'%s' is not a valid PEM-encoded certificate chain." % options.external_ca_file
|
|
sys.exit(1)
|
|
|
|
certdict = dict((DN(str(cert.subject)), cert) for cert in extchain)
|
|
certissuer = DN(str(extcert.issuer))
|
|
if certissuer not in certdict:
|
|
print "The external certificate is not signed by the external CA (unknown issuer %s)." % certissuer
|
|
sys.exit(1)
|
|
|
|
cert = extcert
|
|
while cert.issuer != cert.subject:
|
|
certissuer = DN(str(cert.issuer))
|
|
if certissuer not in certdict:
|
|
print "The external CA chain is incomplete (%s is missing from the chain)." % certissuer
|
|
sys.exit(1)
|
|
cert = certdict[certissuer]
|
|
|
|
if options.http_pkcs12:
|
|
http_pin_file = ipautil.write_tmp_file(options.http_pin)
|
|
http_pkcs12_info = (options.dirsrv_pkcs12, http_pin_file.name)
|
|
|
|
if options.dirsrv_pkcs12:
|
|
dirsrv_pin_file = ipautil.write_tmp_file(options.dirsrv_pin)
|
|
dirsrv_pkcs12_info = (options.dirsrv_pkcs12, dirsrv_pin_file.name)
|
|
|
|
if options.pkinit_pkcs12:
|
|
pkinit_pin_file = ipautil.write_tmp_file(options.pkinit_pin)
|
|
pkinit_pkcs12_info = (options.pkinit_pkcs12, pkinit_pin_file.name)
|
|
|
|
# We only set up the CA if the PKCS#12 options are not given.
|
|
if options.dirsrv_pkcs12:
|
|
setup_ca = False
|
|
else:
|
|
setup_ca = True
|
|
|
|
# Figure out what external CA step we're in. See cainstance.py for more
|
|
# info on the 3 states.
|
|
if options.external_cert_file:
|
|
external = 2
|
|
elif options.external_ca:
|
|
external = 1
|
|
else:
|
|
external = 0
|
|
|
|
print "=============================================================================="
|
|
print "This program will set up the FreeIPA Server."
|
|
print ""
|
|
print "This includes:"
|
|
if setup_ca:
|
|
print " * Configure a stand-alone CA (dogtag) for certificate management"
|
|
if options.conf_ntp:
|
|
print " * Configure the Network Time Daemon (ntpd)"
|
|
print " * Create and configure an instance of Directory Server"
|
|
print " * Create and configure a Kerberos Key Distribution Center (KDC)"
|
|
print " * Configure Apache (httpd)"
|
|
if options.setup_dns:
|
|
print " * Configure DNS (bind)"
|
|
if options.setup_pkinit:
|
|
print " * Configure the KDC to enable PKINIT"
|
|
if not options.conf_ntp:
|
|
print ""
|
|
print "Excluded by options:"
|
|
print " * Configure the Network Time Daemon (ntpd)"
|
|
if not options.unattended:
|
|
print ""
|
|
print "To accept the default shown in brackets, press the Enter key."
|
|
print ""
|
|
|
|
if external != 2:
|
|
# Make sure the 389-ds ports are available
|
|
check_dirsrv(options.unattended)
|
|
|
|
if options.conf_ntp:
|
|
try:
|
|
ipaclient.ntpconf.check_timedate_services()
|
|
except ipaclient.ntpconf.NTPConflictingService, e:
|
|
print "WARNING: conflicting time&date synchronization service '%s'" \
|
|
" will be disabled" % e.conflicting_service
|
|
print "in favor of ntpd"
|
|
print ""
|
|
except ipaclient.ntpconf.NTPConfigurationError:
|
|
pass
|
|
|
|
realm_name = ""
|
|
host_name = ""
|
|
domain_name = ""
|
|
ip_address = ""
|
|
master_password = ""
|
|
dm_password = ""
|
|
admin_password = ""
|
|
reverse_zone = None
|
|
|
|
if not options.setup_dns and not options.unattended:
|
|
if ipautil.user_input("Do you want to configure integrated DNS (BIND)?", False):
|
|
options.setup_dns = True
|
|
print ""
|
|
|
|
# check bind packages are installed
|
|
if options.setup_dns:
|
|
if not bindinstance.check_inst(options.unattended):
|
|
sys.exit("Aborting installation")
|
|
|
|
# Don't require an external DNS to say who we are if we are
|
|
# setting up a local DNS server.
|
|
options.no_host_dns = True
|
|
|
|
# check the hostname is correctly configured, it must be as the kldap
|
|
# utilities just use the hostname as returned by getaddrinfo to set
|
|
# up some of the standard entries
|
|
|
|
host_default = ""
|
|
if options.host_name:
|
|
host_default = options.host_name
|
|
else:
|
|
host_default = get_fqdn()
|
|
|
|
try:
|
|
if options.unattended or options.host_name:
|
|
verify_fqdn(host_default,options.no_host_dns)
|
|
host_name = host_default
|
|
else:
|
|
host_name = read_host_name(host_default,options.no_host_dns)
|
|
except BadHostError, e:
|
|
sys.exit(str(e) + "\n")
|
|
|
|
host_name = host_name.lower()
|
|
root_logger.debug("will use host_name: %s\n" % host_name)
|
|
|
|
system_hostname = get_fqdn()
|
|
if host_name != system_hostname:
|
|
print >>sys.stderr
|
|
print >>sys.stderr, "Warning: hostname %s does not match system hostname %s." \
|
|
% (host_name, system_hostname)
|
|
print >>sys.stderr, "System hostname will be updated during the installation process"
|
|
print >>sys.stderr, "to prevent service failures."
|
|
print >>sys.stderr
|
|
|
|
if not options.domain_name:
|
|
domain_name = read_domain_name(host_name[host_name.find(".")+1:], options.unattended)
|
|
root_logger.debug("read domain_name: %s\n" % domain_name)
|
|
try:
|
|
validate_domain_name(domain_name)
|
|
except ValueError, e:
|
|
sys.exit("Invalid domain name: %s" % unicode(e))
|
|
else:
|
|
domain_name = options.domain_name
|
|
|
|
if options.http_pkcs12:
|
|
# Check the given PKCS#12 files
|
|
ca_file = options.root_ca_file
|
|
check_pkcs12 = installutils.check_pkcs12
|
|
http_cert_name = check_pkcs12(http_pkcs12_info, ca_file, host_name)
|
|
dirsrv_cert_name = check_pkcs12(dirsrv_pkcs12_info, ca_file, host_name)
|
|
|
|
domain_name = domain_name.lower()
|
|
|
|
ip = get_server_ip_address(host_name, fstore, options.unattended, options)
|
|
ip_address = str(ip)
|
|
|
|
if options.reverse_zone and not bindinstance.verify_reverse_zone(options.reverse_zone, ip):
|
|
sys.exit(1)
|
|
|
|
if not options.realm_name:
|
|
realm_name = read_realm_name(domain_name, options.unattended)
|
|
root_logger.debug("read realm_name: %s\n" % realm_name)
|
|
else:
|
|
realm_name = options.realm_name.upper()
|
|
|
|
if not options.subject:
|
|
options.subject = DN(('O', realm_name))
|
|
|
|
if not options.dm_password:
|
|
dm_password = read_dm_password()
|
|
|
|
if dm_password is None:
|
|
sys.exit("\nDirectory Manager password required")
|
|
else:
|
|
dm_password = options.dm_password
|
|
|
|
if not options.master_password:
|
|
master_password = ipa_generate_password()
|
|
else:
|
|
master_password = options.master_password
|
|
|
|
if not options.admin_password:
|
|
admin_password = read_admin_password()
|
|
if admin_password is None:
|
|
sys.exit("\nIPA admin password required")
|
|
else:
|
|
admin_password = options.admin_password
|
|
|
|
if options.setup_dns:
|
|
if options.no_forwarders:
|
|
dns_forwarders = ()
|
|
elif options.forwarders:
|
|
dns_forwarders = options.forwarders
|
|
else:
|
|
dns_forwarders = read_dns_forwarders()
|
|
|
|
if options.reverse_zone:
|
|
reverse_zone = bindinstance.normalize_zone(options.reverse_zone)
|
|
elif not options.no_reverse:
|
|
if options.unattended:
|
|
reverse_zone = util.get_reverse_zone_default(ip)
|
|
elif bindinstance.create_reverse():
|
|
reverse_zone = util.get_reverse_zone_default(ip)
|
|
reverse_zone = bindinstance.read_reverse_zone(reverse_zone, ip)
|
|
|
|
if reverse_zone is not None:
|
|
print "Using reverse zone %s" % reverse_zone
|
|
else:
|
|
dns_forwarders = ()
|
|
root_logger.debug("will use dns_forwarders: %s\n" % str(dns_forwarders))
|
|
|
|
print
|
|
print "The IPA Master Server will be configured with:"
|
|
print "Hostname: %s" % host_name
|
|
print "IP address: %s" % ip_address
|
|
print "Domain name: %s" % domain_name
|
|
print "Realm name: %s" % realm_name
|
|
print
|
|
|
|
if options.setup_dns:
|
|
print "BIND DNS server will be configured to serve IPA domain with:"
|
|
print "Forwarders: %s" % ("No forwarders" if not dns_forwarders \
|
|
else ", ".join([str(ip) for ip in dns_forwarders]))
|
|
print "Reverse zone: %s" % ("No reverse zone" if options.no_reverse \
|
|
or reverse_zone is None else reverse_zone)
|
|
print
|
|
|
|
if not options.unattended and not user_input("Continue to configure the system with these values?", False):
|
|
sys.exit("Installation aborted")
|
|
|
|
# Installation has started. No IPA sysrestore items are restored in case of
|
|
# failure to enable root cause investigation
|
|
installation_cleanup = False
|
|
|
|
# Create the management framework config file and finalize api
|
|
target_fname = '/etc/ipa/default.conf'
|
|
fd = open(target_fname, "w")
|
|
fd.write("[global]\n")
|
|
fd.write("host=%s\n" % host_name)
|
|
fd.write("basedn=%s\n" % ipautil.realm_to_suffix(realm_name))
|
|
fd.write("realm=%s\n" % realm_name)
|
|
fd.write("domain=%s\n" % domain_name)
|
|
fd.write("xmlrpc_uri=https://%s/ipa/xml\n" % format_netloc(host_name))
|
|
fd.write("ldap_uri=ldapi://%%2fvar%%2frun%%2fslapd-%s.socket\n" % dsinstance.realm_to_serverid(realm_name))
|
|
if setup_ca:
|
|
fd.write("enable_ra=True\n")
|
|
fd.write("ra_plugin=dogtag\n")
|
|
fd.write("dogtag_version=%s\n" %
|
|
dogtag.install_constants.DOGTAG_VERSION)
|
|
else:
|
|
fd.write("enable_ra=False\n")
|
|
fd.write("ra_plugin=none\n")
|
|
fd.write("mode=production\n")
|
|
fd.close()
|
|
|
|
# Must be readable for everyone
|
|
os.chmod(target_fname, 0644)
|
|
|
|
api.bootstrap(**cfg)
|
|
api.finalize()
|
|
|
|
if not options.unattended:
|
|
print ""
|
|
print "The following operations may take some minutes to complete."
|
|
print "Please wait until the prompt is returned."
|
|
print ""
|
|
|
|
if host_name != system_hostname:
|
|
root_logger.debug("Chosen hostname (%s) differs from system hostname (%s) - change it" \
|
|
% (host_name, system_hostname))
|
|
# configure /etc/sysconfig/network to contain the custom hostname
|
|
ipaservices.backup_and_replace_hostname(fstore, sstore, host_name)
|
|
|
|
# Create DS group if it doesn't exist yet
|
|
try:
|
|
grp.getgrnam(dsinstance.DS_GROUP)
|
|
root_logger.debug("ds group %s exists" % dsinstance.DS_GROUP)
|
|
except KeyError:
|
|
args = ["/usr/sbin/groupadd", "-r", dsinstance.DS_GROUP]
|
|
try:
|
|
ipautil.run(args)
|
|
root_logger.debug("done adding DS group")
|
|
except ipautil.CalledProcessError, e:
|
|
root_logger.critical("failed to add DS group: %s" % e)
|
|
|
|
# Create a directory server instance
|
|
if external != 2:
|
|
# Configure ntpd
|
|
if options.conf_ntp:
|
|
ipaclient.ntpconf.force_ntpd(sstore)
|
|
ntp = ntpinstance.NTPInstance(fstore)
|
|
if not ntp.is_configured():
|
|
ntp.create_instance()
|
|
|
|
if options.dirsrv_pkcs12:
|
|
ds = dsinstance.DsInstance(fstore=fstore,
|
|
cert_nickname=dirsrv_cert_name)
|
|
ds.create_instance(realm_name, host_name, domain_name,
|
|
dm_password, dirsrv_pkcs12_info,
|
|
idstart=options.idstart, idmax=options.idmax,
|
|
subject_base=options.subject,
|
|
hbac_allow=not options.hbac_allow,
|
|
ca_file=ca_file)
|
|
else:
|
|
ds = dsinstance.DsInstance(fstore=fstore)
|
|
ds.create_instance(realm_name, host_name, domain_name,
|
|
dm_password,
|
|
idstart=options.idstart, idmax=options.idmax,
|
|
subject_base=options.subject,
|
|
hbac_allow=not options.hbac_allow)
|
|
else:
|
|
ds = dsinstance.DsInstance(fstore=fstore)
|
|
ds.init_info(
|
|
realm_name, host_name, domain_name, dm_password,
|
|
options.subject, 1101, 1100, None)
|
|
|
|
|
|
if setup_ca:
|
|
if not dogtag.install_constants.SHARED_DB:
|
|
cs = cainstance.CADSInstance(
|
|
host_name, realm_name, domain_name, dm_password)
|
|
if not cs.is_configured():
|
|
cs.create_instance(realm_name, host_name, domain_name,
|
|
dm_password, subject_base=options.subject)
|
|
|
|
ca = cainstance.CAInstance(realm_name, certs.NSS_DIR,
|
|
dogtag_constants=dogtag.install_constants)
|
|
if external == 0:
|
|
ca.configure_instance(host_name, domain_name, dm_password,
|
|
dm_password, subject_base=options.subject)
|
|
elif external == 1:
|
|
# stage 1 of external CA installation
|
|
options.realm_name = realm_name
|
|
options.domain_name = domain_name
|
|
options.master_password = master_password
|
|
options.dm_password = dm_password
|
|
options.admin_password = admin_password
|
|
options.host_name = host_name
|
|
options.unattended = True
|
|
options.forwarders = dns_forwarders
|
|
options.reverse_zone = reverse_zone
|
|
write_cache(vars(options))
|
|
ca.configure_instance(host_name, domain_name, dm_password,
|
|
dm_password, csr_file="/root/ipa.csr",
|
|
subject_base=options.subject)
|
|
else:
|
|
# stage 2 of external CA installation
|
|
ca.configure_instance(host_name, domain_name, dm_password,
|
|
dm_password,
|
|
cert_file=options.external_cert_file,
|
|
cert_chain_file=options.external_ca_file,
|
|
subject_base=options.subject)
|
|
|
|
# Now put the CA cert where other instances exepct it
|
|
ca.publish_ca_cert("/etc/ipa/ca.crt")
|
|
|
|
# we now need to enable ssl on the ds
|
|
ds.enable_ssl()
|
|
ds.restart()
|
|
|
|
if setup_ca:
|
|
# We need to ldap_enable the CA now that DS is up and running
|
|
ca.ldap_enable('CA', host_name, dm_password,
|
|
ipautil.realm_to_suffix(realm_name))
|
|
if not dogtag.install_constants.SHARED_DB:
|
|
# Turn on SSL in the dogtag LDAP instance. This will get restarted
|
|
# later, we don't need SSL now.
|
|
cs.create_certdb()
|
|
cs.enable_ssl()
|
|
# Add the IPA service for storing the PKI-IPA server certificate.
|
|
cs.add_simple_service(cs.principal)
|
|
cs.add_cert_to_service()
|
|
else:
|
|
ca.enable_client_auth_to_db()
|
|
ca.restart()
|
|
|
|
# Upload the CA cert to the directory
|
|
ds.upload_ca_cert()
|
|
else:
|
|
with open(options.root_ca_file) as f:
|
|
pem_cert = f.read()
|
|
|
|
# Trust the CA cert
|
|
root_logger.info(
|
|
'Trusting certificate authority from %s' % options.root_ca_file)
|
|
|
|
certs.NSSDatabase('/etc/pki/nssdb').import_pem_cert(
|
|
'External CA cert', 'CT,,', options.root_ca_file)
|
|
|
|
# Put a CA cert where other instances expect it
|
|
with open('/etc/ipa/ca.crt', 'wb') as f:
|
|
f.write(pem_cert)
|
|
|
|
# Install the CA cert for the HTTP server
|
|
with open('/usr/share/ipa/html/ca.crt', 'wb') as f:
|
|
f.write(pem_cert)
|
|
|
|
# Upload the CA cert to the directory
|
|
ds.upload_ca_dercert(base64.b64decode(x509.strip_header(pem_cert)))
|
|
|
|
krb = krbinstance.KrbInstance(fstore)
|
|
if options.pkinit_pkcs12:
|
|
krb.create_instance(realm_name, host_name, domain_name,
|
|
dm_password, master_password,
|
|
setup_pkinit=options.setup_pkinit,
|
|
pkcs12_info=pkinit_pkcs12_info,
|
|
subject_base=options.subject)
|
|
else:
|
|
krb.create_instance(realm_name, host_name, domain_name,
|
|
dm_password, master_password,
|
|
setup_pkinit=options.setup_pkinit,
|
|
subject_base=options.subject)
|
|
|
|
# The DS instance is created before the keytab, add the SSL cert we
|
|
# generated
|
|
ds.add_cert_to_service()
|
|
|
|
# Create a HTTP instance
|
|
|
|
memcache = memcacheinstance.MemcacheInstance()
|
|
memcache.create_instance('MEMCACHE', host_name, dm_password, ipautil.realm_to_suffix(realm_name))
|
|
|
|
http = httpinstance.HTTPInstance(fstore)
|
|
if options.http_pkcs12:
|
|
http.create_instance(
|
|
realm_name, host_name, domain_name, dm_password, autoconfig=False,
|
|
pkcs12_info=http_pkcs12_info, subject_base=options.subject,
|
|
auto_redirect=options.ui_redirect, ca_file=ca_file)
|
|
else:
|
|
http.create_instance(
|
|
realm_name, host_name, domain_name, dm_password, autoconfig=True,
|
|
subject_base=options.subject, auto_redirect=options.ui_redirect)
|
|
ipaservices.restore_context("/var/cache/ipa/sessions")
|
|
|
|
set_subject_in_config(realm_name, dm_password, ipautil.realm_to_suffix(realm_name), options.subject)
|
|
|
|
# Apply any LDAP updates. Needs to be done after the configuration file
|
|
# is created
|
|
service.print_msg("Applying LDAP updates")
|
|
ds.apply_updates()
|
|
|
|
# Restart ds and krb after configurations have been changed
|
|
service.print_msg("Restarting the directory server")
|
|
ds.restart()
|
|
|
|
service.print_msg("Restarting the KDC")
|
|
krb.restart()
|
|
|
|
# Create a BIND instance
|
|
bind = bindinstance.BindInstance(fstore, dm_password)
|
|
bind.setup(host_name, ip_address, realm_name, domain_name, dns_forwarders,
|
|
options.conf_ntp, reverse_zone, zonemgr=options.zonemgr,
|
|
zone_refresh=options.zone_refresh,
|
|
persistent_search=options.persistent_search,
|
|
serial_autoincrement=options.serial_autoincrement,
|
|
ca_configured=setup_ca)
|
|
if options.setup_dns:
|
|
api.Backend.ldap2.connect(bind_dn=DN(('cn', 'Directory Manager')), bind_pw=dm_password)
|
|
|
|
bind.create_instance()
|
|
print ""
|
|
bind.check_global_configuration()
|
|
print ""
|
|
else:
|
|
bind.create_sample_bind_zone()
|
|
|
|
# Restart httpd to pick up the new IPA configuration
|
|
service.print_msg("Restarting the web server")
|
|
http.restart()
|
|
|
|
# Set the admin user kerberos password
|
|
ds.change_admin_password(admin_password)
|
|
|
|
# Call client install script
|
|
try:
|
|
args = ["/usr/sbin/ipa-client-install", "--on-master", "--unattended", "--domain", domain_name, "--server", host_name, "--realm", realm_name, "--hostname", host_name]
|
|
if not options.create_sshfp:
|
|
args.append("--no-dns-sshfp")
|
|
if options.trust_sshfp:
|
|
args.append("--ssh-trust-dns")
|
|
if not options.conf_ssh:
|
|
args.append("--no-ssh")
|
|
if not options.conf_sshd:
|
|
args.append("--no-sshd")
|
|
if options.mkhomedir:
|
|
args.append("--mkhomedir")
|
|
run(args)
|
|
except Exception, e:
|
|
sys.exit("Configuration of client side components failed!\nipa-client-install returned: " + str(e))
|
|
|
|
|
|
#Everything installed properly, activate ipa service.
|
|
ipaservices.knownservices.ipa.enable()
|
|
|
|
print "=============================================================================="
|
|
print "Setup complete"
|
|
print ""
|
|
print "Next steps:"
|
|
print "\t1. You must make sure these network ports are open:"
|
|
print "\t\tTCP Ports:"
|
|
print "\t\t * 80, 443: HTTP/HTTPS"
|
|
print "\t\t * 389, 636: LDAP/LDAPS"
|
|
print "\t\t * 88, 464: kerberos"
|
|
if options.setup_dns:
|
|
print "\t\t * 53: bind"
|
|
print "\t\tUDP Ports:"
|
|
print "\t\t * 88, 464: kerberos"
|
|
if options.setup_dns:
|
|
print "\t\t * 53: bind"
|
|
if options.conf_ntp:
|
|
print "\t\t * 123: ntp"
|
|
print ""
|
|
print "\t2. You can now obtain a kerberos ticket using the command: 'kinit admin'"
|
|
print "\t This ticket will allow you to use the IPA tools (e.g., ipa user-add)"
|
|
print "\t and the web user interface."
|
|
|
|
if not ipaservices.knownservices.ntpd.is_running():
|
|
print "\t3. Kerberos requires time synchronization between clients"
|
|
print "\t and servers for correct operation. You should consider enabling ntpd."
|
|
|
|
print ""
|
|
if setup_ca:
|
|
print "Be sure to back up the CA certificate stored in /root/cacert.p12"
|
|
print "This file is required to create replicas. The password for this"
|
|
print "file is the Directory Manager password"
|
|
else:
|
|
print "In order for Firefox autoconfiguration to work you will need to"
|
|
print "use a SSL signing certificate. See the IPA documentation for more details."
|
|
|
|
if ipautil.file_exists(ANSWER_CACHE):
|
|
os.remove(ANSWER_CACHE)
|
|
return 0
|
|
|
|
if __name__ == '__main__':
|
|
success = False
|
|
try:
|
|
# FIXME: Common option parsing, logging setup, etc should be factored
|
|
# out from all install scripts
|
|
safe_options, options = parse_options()
|
|
if options.uninstall:
|
|
log_file_name = "/var/log/ipaserver-uninstall.log"
|
|
else:
|
|
log_file_name = "/var/log/ipaserver-install.log"
|
|
|
|
installutils.run_script(main, log_file_name=log_file_name,
|
|
operation_name='ipa-server-install')
|
|
success = True
|
|
|
|
finally:
|
|
if not success and installation_cleanup:
|
|
# Do a cautious clean up as we don't know what failed and what is
|
|
# the state of the environment
|
|
try:
|
|
fstore.restore_file('/etc/hosts')
|
|
except:
|
|
pass
|