mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-29 10:21:18 -06:00
272 lines
10 KiB
Python
272 lines
10 KiB
Python
#! /usr/bin/python -E
|
|
# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
|
|
#
|
|
# Copyright (C) 2007 Red Hat
|
|
# see file 'COPYING' for use and warranty information
|
|
#
|
|
# This program is free software; you can redistribute it and/or
|
|
# modify it under the terms of the GNU General Public License as
|
|
# published by the Free Software Foundation; version 2 only
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program; if not, write to the Free Software
|
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
#
|
|
|
|
|
|
# requires the following packages:
|
|
# fedora-ds-base
|
|
# openldap-clients
|
|
# nss-tools
|
|
|
|
VERSION = "%prog .1"
|
|
|
|
import sys
|
|
sys.path.append("/usr/share/ipa")
|
|
|
|
import socket
|
|
import logging
|
|
import pwd
|
|
from optparse import OptionParser
|
|
import ipaserver.dsinstance
|
|
import ipaserver.krbinstance
|
|
from ipa.ipautil import run
|
|
|
|
def parse_options():
|
|
parser = OptionParser(version=VERSION)
|
|
parser.add_option("-u", "--user", dest="ds_user",
|
|
help="ds user")
|
|
parser.add_option("-r", "--realm", dest="realm_name",
|
|
help="realm name")
|
|
parser.add_option("-p", "--ds-password", dest="dm_password",
|
|
help="admin password")
|
|
parser.add_option("-P", "--master-password", dest="master_password",
|
|
help="kerberos master password")
|
|
parser.add_option("-a", "--admin-password", dest="admin_password",
|
|
help="admin user kerberos password")
|
|
parser.add_option("-d", "--debug", dest="debug", action="store_true",
|
|
dest="debug", default=False, help="print debugging information")
|
|
parser.add_option("--hostname", dest="host_name", help="fully qualified name of server")
|
|
parser.add_option("-U", "--unattended", dest="unattended",
|
|
help="unattended installation never prompts the user")
|
|
|
|
options, args = parser.parse_args()
|
|
|
|
if options.unattended and (not options.ds_user or
|
|
not options.realm_name or
|
|
not options.dm_password or
|
|
not options.admin_password or
|
|
not options.master_password):
|
|
parser.error("error: In unattended mode you need to provide -u, -r, -p and -P options")
|
|
|
|
return options
|
|
|
|
def logging_setup(options):
|
|
# Always log everything (i.e., DEBUG) to the log
|
|
# file.
|
|
logging.basicConfig(level=logging.DEBUG,
|
|
format='%(asctime)s %(levelname)s %(message)s',
|
|
filename='ipaserver-install.log',
|
|
filemode='w')
|
|
|
|
console = logging.StreamHandler()
|
|
# If the debug option is set, also log debug messages to the console
|
|
if options.debug:
|
|
console.setLevel(logging.DEBUG)
|
|
else:
|
|
# Otherwise, log critical and error messages
|
|
console.setLevel(logging.ERROR)
|
|
formatter = logging.Formatter('%(name)-12s: %(levelname)-8s %(message)s')
|
|
console.setFormatter(formatter)
|
|
logging.getLogger('').addHandler(console)
|
|
|
|
def setup_hosts(host, ip):
|
|
print ""
|
|
print "TODO"
|
|
print ""
|
|
print ""
|
|
|
|
def main():
|
|
options = parse_options()
|
|
logging_setup(options)
|
|
|
|
ds_user = ""
|
|
realm_name = ""
|
|
host_name = ""
|
|
master_password = ""
|
|
dm_password = ""
|
|
admin_password = ""
|
|
|
|
# check the hostname is correctly configured, it must be as the kldap
|
|
# utilities just use the hostname as returned by gethostbyname to set
|
|
# up some of the standard entries
|
|
|
|
if options.host_name:
|
|
host_name = options.host_name
|
|
else:
|
|
host_name = socket.gethostname()
|
|
if len(host_name.split(".")) < 2:
|
|
print "Invalid hostname <"+host_name+">"
|
|
print "Check the /etc/hosts file and make sure to have a valid FQDN"
|
|
return "-Fatal Error-"
|
|
|
|
ip = socket.gethostbyname(host_name)
|
|
if ip == "127.0.0.1":
|
|
print "The hostname resolves to the localhost address (127.0.0.1)"
|
|
print "Please change your /etc/hosts file or your DNS so that the"
|
|
print "hostname resolves to the ip address of your network interface."
|
|
print "The KDC service does not listen on 127.0.0.1"
|
|
print ""
|
|
if not options.unattended:
|
|
change_hosts = raw_input("Do you want to change the /etc/hosts file ? [y/N] ")
|
|
print ""
|
|
if change_hosts.lower() == "y":
|
|
ip = raw_input("What is the netowrk IP address used by this server ? ")
|
|
print ""
|
|
if (ip.find(".") == -1):
|
|
print "["+ip+"] is an invalid IP address"
|
|
return "-Fatal Error-"
|
|
setup_hosts(host_name, ip)
|
|
else:
|
|
print "Please fix your /etc/hosts file and restart the setup program"
|
|
print "-Aborted-"
|
|
else:
|
|
return "-Fatal Error-"
|
|
|
|
print "The Final KDC Host Name will be: " + host_name + ". With IP address: " + ip
|
|
print ""
|
|
|
|
if not options.ds_user:
|
|
|
|
try:
|
|
pwd.getpwnam('dirsrv')
|
|
|
|
print "To securely run Directory Server we need a user account to be set up."
|
|
print "This will allow DS to run as a user and not as root."
|
|
print "The user account will have access to some security material so it should not be shared with any other application."
|
|
print "A user account named 'dirsrv' already exist. You should not share the account with any other service."
|
|
print ""
|
|
yesno = raw_input("Do you want to use the existing 'dirsrv' account ? (y/N)")
|
|
print ""
|
|
if yesno.lower() == "y":
|
|
ds_user = "dirsrv"
|
|
else:
|
|
ds_user = raw_input("Which account name do you want to use for the DS instance ? ")
|
|
print ""
|
|
except KeyError:
|
|
ds_user = "dirsrv"
|
|
|
|
if ds_user == "":
|
|
return "-Aborted-"
|
|
else:
|
|
ds_user = options.ds_user
|
|
|
|
if not options.realm_name:
|
|
print "The kerberos protocol requires a Realm name to be defined."
|
|
print "Usually the domain name all in uppercase is used as realm name."
|
|
print ""
|
|
upper_dom = (host_name[host_name.find(".")+1:]).upper()
|
|
dom_realm = raw_input("Do you want to use ["+upper_dom+"] as the realm name ? [y/N] ")
|
|
print ""
|
|
if dom_realm.lower() == "y":
|
|
realm_name = upper_dom
|
|
else:
|
|
realm_name = raw_input("Please provide a realm name: ")
|
|
print ""
|
|
if realm_name == "":
|
|
return "-Aborted-"
|
|
upper_dom = realm_name.upper()
|
|
if upper_dom != realm_name:
|
|
print "It is strongly adviced to use a completely uppercased name for the realm."
|
|
dom_realm = raw_input("Do you want to use "+upper_dom+" as realm name ? [Y/n] ")
|
|
print ""
|
|
if dom_realm.lower() != "y":
|
|
print "WARNING: Using a non upper-cased realm name may cause unexpected problems."
|
|
else:
|
|
realm_name = upper_dom
|
|
if realm_name == "":
|
|
print "-Aborted-"
|
|
else:
|
|
realm_name = options.realm_name
|
|
|
|
if not options.dm_password:
|
|
print "The Directory Manager user is the equivalent of 'root' for Diretcory Server."
|
|
print "This account has full access to the Directory and is used for system management tasks."
|
|
print ""
|
|
#TODO: provide the option of generating a random password
|
|
dm_password = raw_input("Please provide a password for the Directory Manager: ")
|
|
print ""
|
|
else:
|
|
dm_password = options.dm_password
|
|
|
|
if not options.master_password:
|
|
print "The Kerberos database is usually encrypted using a master password."
|
|
print "Please store this password offline in a secure place."
|
|
print "It may be necessary in a recovery situation or to install a replica."
|
|
print "Without the master password the encrypted material can't be used by the KDC."
|
|
print "If the master password gets lost all kerberos related secrets will be lost."
|
|
print ""
|
|
#TODO: provide the option of generating a random password
|
|
master_password = raw_input("Please provide a master password: ")
|
|
print ""
|
|
else:
|
|
master_password = options.master_password
|
|
|
|
if not options.admin_password:
|
|
print "The 'admin' user is the administrative user used to administare an IPA server."
|
|
print "This account is the one that will be used for normal administration and is also a regular unix user"
|
|
print ""
|
|
#TODO: provide the option of generating a random password
|
|
admin_password = raw_input("Please provide a kerberos password for the 'admin' user: ")
|
|
print ""
|
|
else:
|
|
admin_password = options.admin_password
|
|
|
|
# Create a directory server instance
|
|
ds = ipaserver.dsinstance.DsInstance()
|
|
ds.create_instance(ds_user, realm_name, host_name, dm_password)
|
|
|
|
# Create a kerberos instance
|
|
krb = ipaserver.krbinstance.KrbInstance()
|
|
krb.create_instance(ds_user, realm_name, host_name, dm_password, master_password)
|
|
|
|
# Restart ds after the krb instance has changed ds configurations
|
|
ds.restart()
|
|
|
|
# Restart apache
|
|
run(["/sbin/service", "httpd", "restart"])
|
|
|
|
# Set apache to start on boot
|
|
run(["/sbin/chkconfig", "httpd", "on"])
|
|
|
|
# Set fedora-ds to start on boot
|
|
run(["/sbin/chkconfig", "dirsrv", "on"])
|
|
|
|
# Set the KDC to start on boot
|
|
run(["/sbin/chkconfig", "krb5kdc", "on"])
|
|
|
|
# Set the Kpasswd to start on boot
|
|
run(["/sbin/chkconfig", "ipa-kpasswd", "on"])
|
|
|
|
# Start Kpasswd
|
|
run(["/sbin/service", "ipa-kpasswd", "start"])
|
|
|
|
# Set the admin user kerberos password
|
|
ds.change_admin_password(admin_password)
|
|
|
|
# Create the config file
|
|
fd = open("/etc/ipa/ipa.conf", "w")
|
|
fd.write("[defaults]\n")
|
|
fd.write("server=" + host_name + "\n")
|
|
fd.write("realm=" + realm_name + "\n")
|
|
fd.close()
|
|
|
|
return 0
|
|
|
|
main()
|