mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-28 18:01:23 -06:00
229 lines
7.7 KiB
Python
229 lines
7.7 KiB
Python
#! /usr/bin/python -E
|
|
# Authors: Karl MacMillan <kmacmillan@mentalrootkit.com>
|
|
#
|
|
# Copyright (C) 2007 Red Hat
|
|
# see file 'COPYING' for use and warranty information
|
|
#
|
|
# This program is free software; you can redistribute it and/or
|
|
# modify it under the terms of the GNU General Public License as
|
|
# published by the Free Software Foundation; version 2 only
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program; if not, write to the Free Software
|
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
#
|
|
|
|
import sys
|
|
|
|
import tempfile, os, pwd, traceback, logging, shutil
|
|
from ConfigParser import SafeConfigParser
|
|
import ldap
|
|
|
|
from ipa import ipautil
|
|
|
|
from ipaserver import dsinstance, replication, installutils, krbinstance, service
|
|
from ipaserver import httpinstance, ntpinstance, certs, ipaldap
|
|
|
|
class ReplicaConfig:
|
|
def __init__(self):
|
|
self.realm_name = ""
|
|
self.master_host_name = ""
|
|
self.dirman_password = ""
|
|
self.ds_user = ""
|
|
self.host_name = ""
|
|
self.repl_password = ""
|
|
self.dir = ""
|
|
|
|
def parse_options():
|
|
from optparse import OptionParser
|
|
parser = OptionParser()
|
|
parser.add_option("-N", "--no-ntp", dest="conf_ntp", action="store_false",
|
|
help="do not configure ntp", default=True)
|
|
parser.add_option("-d", "--debug", dest="debug", action="store_true",
|
|
default=False, help="gather extra debugging information")
|
|
|
|
options, args = parser.parse_args()
|
|
|
|
if len(args) != 1:
|
|
parser.error("you must provide a file generated by ipa-replica-prepare")
|
|
|
|
return options, args[0]
|
|
|
|
def get_dirman_password():
|
|
return installutils.read_password("Directory Manager (existing master)")
|
|
|
|
def expand_info(filename):
|
|
top_dir = tempfile.mkdtemp("ipa")
|
|
dir = top_dir + "/realm_info"
|
|
ipautil.run(["tar", "xfz", filename, "-C", top_dir])
|
|
|
|
return top_dir, dir
|
|
|
|
def read_info(dir, rconfig):
|
|
filename = dir + "/realm_info"
|
|
fd = open(filename)
|
|
config = SafeConfigParser()
|
|
config.readfp(fd)
|
|
|
|
rconfig.realm_name = config.get("realm", "realm_name")
|
|
rconfig.master_host_name = config.get("realm", "master_host_name")
|
|
rconfig.ds_user = config.get("realm", "ds_user")
|
|
rconfig.domain_name = config.get("realm", "domain_name")
|
|
|
|
def get_host_name():
|
|
hostname = installutils.get_fqdn()
|
|
try:
|
|
installutils.verify_fqdn(hostname)
|
|
except RuntimeError, e:
|
|
logging.error(str(e))
|
|
sys.exit(1)
|
|
|
|
return hostname
|
|
|
|
def set_owner(config, dir):
|
|
pw = pwd.getpwnam(config.ds_user)
|
|
os.chown(dir, pw.pw_uid, pw.pw_gid)
|
|
|
|
def install_ds(config):
|
|
dsinstance.check_existing_installation()
|
|
dsinstance.check_ports()
|
|
|
|
# if we have a pkcs12 file, create the cert db from
|
|
# that. Otherwise the ds setup will create the CA
|
|
# cert
|
|
pkcs12_info = None
|
|
if ipautil.file_exists(config.dir + "/dscert.p12"):
|
|
pkcs12_info = (config.dir + "/dscert.p12",
|
|
config.dir + "/pwdfile.txt")
|
|
|
|
ds = dsinstance.DsInstance()
|
|
ds.create_instance(config.ds_user, config.realm_name, config.host_name, config.domain_name, config.dirman_password, pkcs12_info)
|
|
|
|
return ds
|
|
|
|
def install_krb(config):
|
|
krb = krbinstance.KrbInstance()
|
|
ldappwd_filename = config.dir + "/ldappwd"
|
|
krb.create_replica(config.ds_user, config.realm_name, config.host_name,
|
|
config.domain_name, config.dirman_password, ldappwd_filename)
|
|
|
|
def install_http(config):
|
|
# if we have a pkcs12 file, create the cert db from
|
|
# that. Otherwise the ds setup will create the CA
|
|
# cert
|
|
pkcs12_info = None
|
|
if ipautil.file_exists(config.dir + "/httpcert.p12"):
|
|
pkcs12_info = (config.dir + "/httpcert.p12",
|
|
config.dir + "/pwdfile.txt")
|
|
|
|
http = httpinstance.HTTPInstance()
|
|
http.create_instance(config.realm_name, config.host_name, config.domain_name, False, pkcs12_info)
|
|
|
|
# Now copy the autoconfiguration files
|
|
try:
|
|
shutil.copy(config.dir + "/preferences.html", "/usr/share/ipa/html/preferences.html")
|
|
shutil.copy(config.dir + "/configure.jar", "/usr/share/ipa/html/configure.jar")
|
|
shutil.copy(config.dir + "/ca.crt", "/usr/share/ipa/html/ca.crt")
|
|
os.chmod("/usr/share/ipa/html/ca.crt", 0444)
|
|
except Exception, e:
|
|
print "error copying files: " + str(e)
|
|
sys.exit(1)
|
|
|
|
def main():
|
|
options, filename = parse_options()
|
|
installutils.standard_logging_setup("/var/log/ipareplica-install.log", options.debug)
|
|
|
|
top_dir, dir = expand_info(filename)
|
|
|
|
config = ReplicaConfig()
|
|
read_info(dir, config)
|
|
config.host_name = get_host_name()
|
|
p = filename.split('-')
|
|
host = '-'.join(p[2:])
|
|
if host != config.host_name:
|
|
try:
|
|
print "This replica was created for '%s' but this machine is named '%s'" % (host, config.host_name)
|
|
yesno = raw_input("This may cause problems. Continue? [Y/n]: ")
|
|
print ""
|
|
if not yesno or yesno.lower()[0] == "y":
|
|
pass
|
|
else:
|
|
sys.exit(0)
|
|
except KeyboardInterrupt:
|
|
sys.exit(0)
|
|
config.repl_password = ipautil.ipa_generate_password()
|
|
config.dir = dir
|
|
|
|
# get the directory manager password
|
|
try:
|
|
config.dirman_password = get_dirman_password()
|
|
except KeyboardInterrupt:
|
|
sys.exit(0)
|
|
|
|
# Try out the password
|
|
try:
|
|
conn = ipaldap.IPAdmin(config.master_host_name)
|
|
conn.do_simple_bind(bindpw=config.dirman_password)
|
|
conn.unbind()
|
|
except ldap.CONNECT_ERROR, e:
|
|
sys.exit("\nUnable to connect to LDAP server %s" % config.master_host_name)
|
|
except ldap.SERVER_DOWN, e:
|
|
sys.exit("\nUnable to connect to LDAP server %s" % config.master_host_name)
|
|
except ldap.INVALID_CREDENTIALS, e :
|
|
sys.exit("\nThe password provided is incorrect for LDAP server %s" % config.master_host_name)
|
|
|
|
# Configure ntpd
|
|
if options.conf_ntp:
|
|
ntp = ntpinstance.NTPInstance()
|
|
ntp.create_instance()
|
|
|
|
# Configure dirsrv
|
|
ds = install_ds(config)
|
|
|
|
repl = replication.ReplicationManager(config.host_name, config.dirman_password)
|
|
if repl is None:
|
|
raise RuntimeError("Unable to connect to LDAP server %s." % config.host_name)
|
|
ret = repl.setup_replication(config.master_host_name, config.realm_name)
|
|
if ret is None:
|
|
raise RuntimeError("Unable to connect to LDAP server %s." % config.master_host_name)
|
|
if ret != 0:
|
|
raise RuntimeError("Failed to start replication")
|
|
|
|
install_krb(config)
|
|
install_http(config)
|
|
|
|
# Create a Web Gui instance
|
|
webgui = httpinstance.WebGuiInstance()
|
|
webgui.create_instance()
|
|
|
|
service.restart("dirsrv")
|
|
service.restart("krb5kdc")
|
|
|
|
# Call client install script
|
|
try:
|
|
ipautil.run(["/usr/sbin/ipa-client-install", "--on-master", "--unattended", "--domain", config.domain_name, "--server", config.host_name, "--realm", config.realm_name])
|
|
except Exception, e:
|
|
print "Configuration of client side components failed!"
|
|
print "ipa-client-install returned: " + str(e)
|
|
raise RuntimeError("Failed to configure the client")
|
|
|
|
ds.init_memberof()
|
|
|
|
try:
|
|
if not os.geteuid()==0:
|
|
sys.exit("\nYou must be root to run this script.\n")
|
|
|
|
main()
|
|
except Exception, e:
|
|
print "creation of replica failed: %s" % str(e)
|
|
message = str(e)
|
|
for str in traceback.format_tb(sys.exc_info()[2]):
|
|
message = message + "\n" + str
|
|
logging.debug(message)
|
|
sys.exit(1)
|