mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-23 07:33:27 -06:00
71f642f751
pylint-1.6.4-1.fc26.noarch reports "C0201(consider-iterating-dictionary)" when building FreeIPA, we have to fix these errors https://fedorahosted.org/freeipa/ticket/6391 Reviewed-By: Martin Basti <mbasti@redhat.com>
3150 lines
123 KiB
Python
Executable File
3150 lines
123 KiB
Python
Executable File
#! /usr/bin/python2 -E
|
|
# Authors: Simo Sorce <ssorce@redhat.com>
|
|
# Karl MacMillan <kmacmillan@mentalrootkit.com>
|
|
#
|
|
# Copyright (C) 2007 Red Hat
|
|
# see file 'COPYING' for use and warranty information
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
#
|
|
|
|
from __future__ import print_function
|
|
|
|
try:
|
|
import sys
|
|
|
|
import os
|
|
import time
|
|
import socket
|
|
import tempfile
|
|
import getpass
|
|
from six.moves.configparser import RawConfigParser
|
|
from optparse import SUPPRESS_HELP, OptionGroup, OptionValueError
|
|
import dns
|
|
import gssapi
|
|
import netifaces
|
|
|
|
import nss.nss as nss
|
|
import SSSDConfig
|
|
from six.moves.urllib.parse import urlparse, urlunparse
|
|
|
|
from ipapython.ipa_log_manager import standard_logging_setup, root_logger
|
|
from ipaclient import ipadiscovery
|
|
import ipaclient.ipachangeconf
|
|
import ipaclient.ntpconf
|
|
from ipapython.ipautil import (
|
|
run, user_input, CalledProcessError, file_exists, dir_exists,
|
|
realm_to_suffix, is_fips_enabled)
|
|
from ipaplatform.tasks import tasks
|
|
from ipaplatform import services
|
|
from ipaplatform.paths import paths
|
|
from ipapython import ipautil, sysrestore, version, certmonger, ipaldap
|
|
from ipapython import kernel_keyring, certdb
|
|
from ipapython.config import IPAOptionParser
|
|
from ipalib import api, errors
|
|
from ipalib import x509, certstore
|
|
from ipalib.util import (
|
|
normalize_hostname, validate_domain_name, verify_host_resolvable,
|
|
network_ip_address_warning, broadcast_ip_address_warning
|
|
)
|
|
from ipalib.constants import CACERT
|
|
from ipapython.dn import DN
|
|
from ipapython.ssh import SSHPublicKey
|
|
from ipalib.rpc import delete_persistent_client_session_data
|
|
|
|
except ImportError as e:
|
|
print("""\
|
|
There was a problem importing one of the required Python modules. The
|
|
error was:
|
|
|
|
%s
|
|
""" % e, file=sys.stderr)
|
|
sys.exit(1)
|
|
|
|
SUCCESS = 0
|
|
CLIENT_INSTALL_ERROR = 1
|
|
CLIENT_NOT_CONFIGURED = 2
|
|
CLIENT_ALREADY_CONFIGURED = 3
|
|
CLIENT_UNINSTALL_ERROR = 4 # error after restoring files/state
|
|
|
|
|
|
fstore = sysrestore.FileStore(paths.IPA_CLIENT_SYSRESTORE)
|
|
statestore = sysrestore.StateFile(paths.IPA_CLIENT_SYSRESTORE)
|
|
|
|
|
|
def parse_options():
|
|
def validate_ca_cert_file_option(option, opt, value, parser):
|
|
if not os.path.exists(value):
|
|
raise OptionValueError("%s option '%s' does not exist" % (opt, value))
|
|
if not os.path.isfile(value):
|
|
raise OptionValueError("%s option '%s' is not a file" % (opt, value))
|
|
if not os.path.isabs(value):
|
|
raise OptionValueError("%s option '%s' is not an absolute file path" % (opt, value))
|
|
|
|
initialized = nss.nss_is_initialized()
|
|
try:
|
|
cert = x509.load_certificate_from_file(value)
|
|
except Exception:
|
|
raise OptionValueError("%s option '%s' is not a valid certificate file" % (opt, value))
|
|
else:
|
|
del(cert)
|
|
if not initialized:
|
|
nss.nss_shutdown()
|
|
|
|
parser.values.ca_cert_file = value
|
|
|
|
def kinit_attempts_callback(option, opt, value, parser):
|
|
if value < 1:
|
|
raise OptionValueError(
|
|
"Option %s expects an integer greater than 0."
|
|
% opt)
|
|
|
|
parser.values.kinit_attempts = value
|
|
|
|
parser = IPAOptionParser(version=version.VERSION)
|
|
|
|
basic_group = OptionGroup(parser, "basic options")
|
|
basic_group.add_option("--domain", dest="domain", help="domain name")
|
|
basic_group.add_option("--server", dest="server", help="FQDN of IPA server", action="append")
|
|
basic_group.add_option("--realm", dest="realm_name", help="realm name")
|
|
basic_group.add_option("--fixed-primary", dest="primary", action="store_true",
|
|
default=False, help="Configure sssd to use fixed server as primary IPA server")
|
|
basic_group.add_option("-p", "--principal", dest="principal",
|
|
help="principal to use to join the IPA realm")
|
|
basic_group.add_option("-w", "--password", dest="password", sensitive=True,
|
|
help="password to join the IPA realm (assumes bulk "
|
|
"password unless principal is also set)")
|
|
basic_group.add_option("-k", "--keytab", dest="keytab",
|
|
help="path to backed up keytab from previous enrollment")
|
|
basic_group.add_option("-W", dest="prompt_password", action="store_true",
|
|
default=False,
|
|
help="Prompt for a password to join the IPA realm")
|
|
basic_group.add_option("--mkhomedir", dest="mkhomedir",
|
|
action="store_true", default=False,
|
|
help="create home directories for users on their first login")
|
|
basic_group.add_option("", "--hostname", dest="hostname",
|
|
help="The hostname of this machine (FQDN). If specified, the hostname will be set and "
|
|
"the system configuration will be updated to persist over reboot. "
|
|
"By default the result of getfqdn() call from "
|
|
"Python's socket module is used.")
|
|
basic_group.add_option("", "--force-join", dest="force_join",
|
|
action="store_true", default=False,
|
|
help="Force client enrollment even if already enrolled")
|
|
basic_group.add_option("--ntp-server", dest="ntp_servers", action="append",
|
|
help="ntp server to use. This option can be used "
|
|
"multiple times")
|
|
basic_group.add_option("-N", "--no-ntp", action="store_false",
|
|
help="do not configure ntp", default=True, dest="conf_ntp")
|
|
basic_group.add_option("", "--force-ntpd", dest="force_ntpd",
|
|
action="store_true", default=False,
|
|
help="Stop and disable any time&date synchronization services besides ntpd")
|
|
basic_group.add_option("--nisdomain", dest="nisdomain",
|
|
help="NIS domain name")
|
|
basic_group.add_option("--no-nisdomain", action="store_true", default=False,
|
|
help="do not configure NIS domain name",
|
|
dest="no_nisdomain")
|
|
basic_group.add_option("--ssh-trust-dns", dest="trust_sshfp", default=False, action="store_true",
|
|
help="configure OpenSSH client to trust DNS SSHFP records")
|
|
basic_group.add_option("--no-ssh", dest="conf_ssh", default=True, action="store_false",
|
|
help="do not configure OpenSSH client")
|
|
basic_group.add_option("--no-sshd", dest="conf_sshd", default=True, action="store_false",
|
|
help="do not configure OpenSSH server")
|
|
basic_group.add_option("--no-sudo", dest="conf_sudo", default=True,
|
|
action="store_false",
|
|
help="do not configure SSSD as data source for sudo")
|
|
basic_group.add_option("--no-dns-sshfp", dest="create_sshfp", default=True, action="store_false",
|
|
help="do not automatically create DNS SSHFP records")
|
|
basic_group.add_option("--noac", dest="no_ac", default=False, action="store_true",
|
|
help="do not modify the nsswitch.conf and PAM configuration")
|
|
basic_group.add_option("-f", "--force", dest="force", action="store_true",
|
|
default=False, help="force setting of LDAP/Kerberos conf")
|
|
basic_group.add_option('--kinit-attempts', dest='kinit_attempts',
|
|
action='callback', type='int', default=5,
|
|
callback=kinit_attempts_callback,
|
|
help=("number of attempts to obtain host TGT"
|
|
" (defaults to %default)."))
|
|
basic_group.add_option("-d", "--debug", dest="debug", action="store_true",
|
|
default=False, help="print debugging information")
|
|
basic_group.add_option("-U", "--unattended", dest="unattended",
|
|
action="store_true",
|
|
help="unattended (un)installation never prompts the user")
|
|
basic_group.add_option("--ca-cert-file", dest="ca_cert_file",
|
|
type="string", action="callback", callback=validate_ca_cert_file_option,
|
|
help="load the CA certificate from this file")
|
|
basic_group.add_option("--request-cert", dest="request_cert",
|
|
action="store_true", default=False,
|
|
help="request certificate for the machine")
|
|
# --on-master is used in ipa-server-install and ipa-replica-install
|
|
# only, it isn't meant to be used on clients.
|
|
basic_group.add_option("--on-master", dest="on_master", action="store_true",
|
|
help=SUPPRESS_HELP, default=False)
|
|
basic_group.add_option("--automount-location", dest="location",
|
|
help="Automount location")
|
|
basic_group.add_option("--configure-firefox", dest="configure_firefox",
|
|
action="store_true", default=False,
|
|
help="configure Firefox to use IPA domain credentials")
|
|
basic_group.add_option("--firefox-dir", dest="firefox_dir", default=None,
|
|
help="specify directory where Firefox is installed (for example: '/usr/lib/firefox')")
|
|
basic_group.add_option("--ip-address", dest="ip_addresses", default=[],
|
|
action="append", help="Specify IP address that should be added to DNS."
|
|
" This option can be used multiple times")
|
|
basic_group.add_option("--all-ip-addresses", dest="all_ip_addresses",
|
|
default=False, action="store_true", help="All routable IP"
|
|
" addresses configured on any inteface will be added to DNS")
|
|
parser.add_option_group(basic_group)
|
|
|
|
sssd_group = OptionGroup(parser, "SSSD options")
|
|
sssd_group.add_option("--permit", dest="permit",
|
|
action="store_true", default=False,
|
|
help="disable access rules by default, permit all access.")
|
|
sssd_group.add_option("", "--enable-dns-updates", dest="dns_updates",
|
|
action="store_true", default=False,
|
|
help="Configures the machine to attempt dns updates when the ip address changes.")
|
|
sssd_group.add_option("--no-krb5-offline-passwords", dest="krb5_offline_passwords",
|
|
action="store_false", default=True,
|
|
help="Configure SSSD not to store user password when the server is offline")
|
|
sssd_group.add_option("-S", "--no-sssd", dest="sssd",
|
|
action="store_false", default=True,
|
|
help="Do not configure the client to use SSSD for authentication")
|
|
sssd_group.add_option("--preserve-sssd", dest="preserve_sssd",
|
|
action="store_true", default=False,
|
|
help="Preserve old SSSD configuration if possible")
|
|
parser.add_option_group(sssd_group)
|
|
|
|
uninstall_group = OptionGroup(parser, "uninstall options")
|
|
uninstall_group.add_option("", "--uninstall", dest="uninstall", action="store_true",
|
|
default=False, help="uninstall an existing installation. The uninstall can " \
|
|
"be run with --unattended option")
|
|
parser.add_option_group(uninstall_group)
|
|
|
|
options, _args = parser.parse_args()
|
|
safe_opts = parser.get_safe_opts(options)
|
|
|
|
if (options.server and not options.domain):
|
|
parser.error("--server cannot be used without providing --domain")
|
|
|
|
if options.domain:
|
|
try:
|
|
validate_domain_name(options.domain)
|
|
except ValueError as ex:
|
|
parser.error("invalid domain name: %s" % ex)
|
|
options.domain = normalize_hostname(options.domain)
|
|
|
|
if options.force_ntpd and not options.conf_ntp:
|
|
parser.error("--force-ntpd cannot be used together with --no-ntp")
|
|
|
|
if options.firefox_dir and not options.configure_firefox:
|
|
parser.error("--firefox-dir cannot be used without --configure-firefox option")
|
|
|
|
if options.no_nisdomain and options.nisdomain:
|
|
parser.error("--no-nisdomain cannot be used together with --nisdomain")
|
|
|
|
if options.ip_addresses:
|
|
if options.dns_updates:
|
|
parser.error("--ip-address cannot be used together with"
|
|
" --enable-dns-updates")
|
|
|
|
if options.all_ip_addresses:
|
|
parser.error("--ip-address cannot be used together with"
|
|
" --all-ip-addresses")
|
|
|
|
return safe_opts, options
|
|
|
|
def logging_setup(options):
|
|
log_file = paths.IPACLIENT_INSTALL_LOG
|
|
|
|
if options.uninstall:
|
|
log_file = paths.IPACLIENT_UNINSTALL_LOG
|
|
|
|
standard_logging_setup(
|
|
filename=log_file, verbose=True, debug=options.debug,
|
|
console_format='%(message)s')
|
|
|
|
|
|
def remove_file(filename):
|
|
"""
|
|
Deletes a file. If the file does not exist (OSError 2) does nothing.
|
|
Otherwise logs an error message and instructs the user to remove the
|
|
offending file manually
|
|
:param filename: name of the file to be removed
|
|
"""
|
|
|
|
try:
|
|
os.remove(filename)
|
|
except OSError as e:
|
|
if e.errno == 2:
|
|
return
|
|
|
|
root_logger.error("Failed to remove file %s: %s", filename, e)
|
|
root_logger.error('Please remove %s manually, as it can cause '
|
|
'subsequent installation to fail.', filename)
|
|
|
|
|
|
def log_service_error(name, action, error):
|
|
root_logger.error("%s failed to %s: %s", name, action, str(error))
|
|
|
|
def cert_summary(msg, certs, indent=' '):
|
|
if msg:
|
|
s = '%s\n' % msg
|
|
else:
|
|
s = ''
|
|
for cert in certs:
|
|
s += '%sSubject: %s\n' % (indent, cert.subject)
|
|
s += '%sIssuer: %s\n' % (indent, cert.issuer)
|
|
s += '%sValid From: %s\n' % (indent, cert.valid_not_before_str)
|
|
s += '%sValid Until: %s\n' % (indent, cert.valid_not_after_str)
|
|
s += '\n'
|
|
s = s[:-1]
|
|
|
|
return s
|
|
|
|
def get_cert_path(cert_path):
|
|
"""
|
|
If a CA certificate is passed in on the command line, use that.
|
|
|
|
Else if a CA file exists in CACERT then use that.
|
|
|
|
Otherwise return None.
|
|
"""
|
|
if cert_path is not None:
|
|
return cert_path
|
|
|
|
if os.path.exists(CACERT):
|
|
return CACERT
|
|
|
|
return None
|
|
|
|
|
|
def save_state(service):
|
|
enabled = service.is_enabled()
|
|
running = service.is_running()
|
|
|
|
if enabled or running:
|
|
statestore.backup_state(service.service_name, 'enabled', enabled)
|
|
statestore.backup_state(service.service_name, 'running', running)
|
|
|
|
|
|
def restore_state(service):
|
|
enabled = statestore.restore_state(service.service_name, 'enabled')
|
|
running = statestore.restore_state(service.service_name, 'running')
|
|
|
|
if enabled:
|
|
try:
|
|
service.enable()
|
|
except Exception:
|
|
root_logger.warning(
|
|
"Failed to configure automatic startup of the %s daemon",
|
|
service.service_name
|
|
)
|
|
if running:
|
|
try:
|
|
service.start()
|
|
except Exception:
|
|
root_logger.warning(
|
|
"Failed to restart the %s daemon",
|
|
service.service_name
|
|
)
|
|
|
|
|
|
# Checks whether nss_ldap or nss-pam-ldapd is installed. If anyone of mandatory files was found returns True and list of all files found.
|
|
def nssldap_exists():
|
|
files_to_check = [{'function':'configure_ldap_conf', 'mandatory':[paths.LDAP_CONF,paths.NSS_LDAP_CONF,paths.LIBNSS_LDAP_CONF], 'optional':[paths.PAM_LDAP_CONF]},
|
|
{'function':'configure_nslcd_conf', 'mandatory':[paths.NSLCD_CONF]}]
|
|
files_found = {}
|
|
retval = False
|
|
|
|
for function in files_to_check:
|
|
files_found[function['function']]=[]
|
|
for file_type in ['mandatory','optional']:
|
|
try:
|
|
for filename in function[file_type]:
|
|
if file_exists(filename):
|
|
files_found[function['function']].append(filename)
|
|
if file_type == 'mandatory':
|
|
retval = True
|
|
except KeyError:
|
|
pass
|
|
|
|
return (retval, files_found)
|
|
|
|
# helper function for uninstall
|
|
# deletes IPA domain from sssd.conf
|
|
def delete_ipa_domain():
|
|
try:
|
|
sssdconfig = SSSDConfig.SSSDConfig()
|
|
sssdconfig.import_config()
|
|
domains = sssdconfig.list_active_domains()
|
|
|
|
ipa_domain_name = None
|
|
|
|
for name in domains:
|
|
domain = sssdconfig.get_domain(name)
|
|
try:
|
|
provider = domain.get_option('id_provider')
|
|
if provider == "ipa":
|
|
ipa_domain_name = name
|
|
break
|
|
except SSSDConfig.NoOptionError:
|
|
continue
|
|
|
|
if ipa_domain_name is not None:
|
|
sssdconfig.delete_domain(ipa_domain_name)
|
|
sssdconfig.write()
|
|
else:
|
|
root_logger.warning("IPA domain could not be found in "
|
|
"/etc/sssd/sssd.conf and therefore not deleted")
|
|
except IOError:
|
|
root_logger.warning("IPA domain could not be deleted. "
|
|
"No access to the /etc/sssd/sssd.conf file.")
|
|
|
|
def is_ipa_client_installed(on_master=False):
|
|
"""
|
|
Consider IPA client not installed if nothing is backed up
|
|
and default.conf file does not exist. If on_master is set to True,
|
|
the existence of default.conf file is not taken into consideration,
|
|
since it has been already created by ipa-server-install.
|
|
"""
|
|
|
|
installed = fstore.has_files() or \
|
|
(not on_master and os.path.exists(paths.IPA_DEFAULT_CONF))
|
|
|
|
return installed
|
|
|
|
def configure_nsswitch_database(fstore, database, services, preserve=True,
|
|
append=True, default_value=()):
|
|
"""
|
|
Edits the specified nsswitch.conf database (e.g. passwd, group, sudoers)
|
|
to use the specified service(s).
|
|
|
|
Arguments:
|
|
fstore - FileStore to backup the nsswitch.conf
|
|
database - database configuration that should be ammended, e.g 'sudoers'
|
|
service - list of services that should be added, e.g. ['sss']
|
|
preserve - if True, the already configured services will be preserved
|
|
|
|
The next arguments modify the behaviour if preserve=True:
|
|
append - if True, the services will be appended, if False, prepended
|
|
default_value - list of services that are considered as default (if
|
|
the database is not mentioned in nsswitch.conf), e.g.
|
|
['files']
|
|
"""
|
|
|
|
# Backup the original version of nsswitch.conf, we're going to edit it now
|
|
if not fstore.has_file(paths.NSSWITCH_CONF):
|
|
fstore.backup_file(paths.NSSWITCH_CONF)
|
|
|
|
conf = ipaclient.ipachangeconf.IPAChangeConf("IPA Installer")
|
|
conf.setOptionAssignment(':')
|
|
|
|
if preserve:
|
|
# Read the existing configuration
|
|
with open(paths.NSSWITCH_CONF, 'r') as f:
|
|
opts = conf.parse(f)
|
|
raw_database_entry = conf.findOpts(opts, 'option', database)[1]
|
|
|
|
# Detect the list of already configured services
|
|
if not raw_database_entry:
|
|
# If there is no database entry, database is not present in
|
|
# the nsswitch.conf. Set the list of services to the
|
|
# default list, if passed.
|
|
configured_services = list(default_value)
|
|
else:
|
|
configured_services = raw_database_entry['value'].strip().split()
|
|
|
|
# Make sure no service is added if already mentioned in the list
|
|
added_services = [s for s in services
|
|
if s not in configured_services]
|
|
|
|
# Prepend / append the list of new services
|
|
if append:
|
|
new_value = ' ' + ' '.join(configured_services + added_services)
|
|
else:
|
|
new_value = ' ' + ' '.join(added_services + configured_services)
|
|
|
|
else:
|
|
# Preserve not set, let's rewrite existing configuration
|
|
new_value = ' ' + ' '.join(services)
|
|
|
|
# Set new services as sources for database
|
|
opts = [{'name': database,
|
|
'type':'option',
|
|
'action':'set',
|
|
'value': new_value
|
|
},
|
|
{'name':'empty',
|
|
'type':'empty'
|
|
}]
|
|
|
|
conf.changeConf(paths.NSSWITCH_CONF, opts)
|
|
root_logger.info("Configured %s in %s" % (database, paths.NSSWITCH_CONF))
|
|
|
|
|
|
def uninstall(options, env):
|
|
|
|
if not is_ipa_client_installed():
|
|
root_logger.error("IPA client is not configured on this system.")
|
|
return CLIENT_NOT_CONFIGURED
|
|
|
|
server_fstore = sysrestore.FileStore(paths.SYSRESTORE)
|
|
if server_fstore.has_files() and not options.on_master:
|
|
root_logger.error(
|
|
"IPA client is configured as a part of IPA server on this system.")
|
|
root_logger.info("Refer to ipa-server-install for uninstallation.")
|
|
return CLIENT_NOT_CONFIGURED
|
|
|
|
try:
|
|
run(["ipa-client-automount", "--uninstall", "--debug"])
|
|
except Exception as e:
|
|
root_logger.error(
|
|
"Unconfigured automount client failed: %s", str(e))
|
|
|
|
# Reload the state as automount unconfigure may have modified it
|
|
fstore._load()
|
|
statestore._load()
|
|
|
|
hostname = None
|
|
ipa_domain = None
|
|
was_sssd_configured = False
|
|
try:
|
|
sssdconfig = SSSDConfig.SSSDConfig()
|
|
sssdconfig.import_config()
|
|
domains = sssdconfig.list_active_domains()
|
|
all_domains = sssdconfig.list_domains()
|
|
|
|
# we consider all the domains, because handling sssd.conf
|
|
# during uninstall is dependant on was_sssd_configured flag
|
|
# so the user does not lose info about inactive domains
|
|
if len(all_domains) > 1:
|
|
# There was more than IPA domain configured
|
|
was_sssd_configured = True
|
|
for name in domains:
|
|
domain = sssdconfig.get_domain(name)
|
|
try:
|
|
provider = domain.get_option('id_provider')
|
|
except SSSDConfig.NoOptionError:
|
|
continue
|
|
if provider == "ipa":
|
|
try:
|
|
hostname = domain.get_option('ipa_hostname')
|
|
except SSSDConfig.NoOptionError:
|
|
continue
|
|
try:
|
|
ipa_domain = domain.get_option('ipa_domain')
|
|
except SSSDConfig.NoOptionError:
|
|
pass
|
|
except Exception as e:
|
|
# We were unable to read existing SSSD config. This might mean few things:
|
|
# - sssd wasn't installed
|
|
# - sssd was removed after install and before uninstall
|
|
# - there are no active domains
|
|
# in both cases we cannot continue with SSSD
|
|
pass
|
|
|
|
if hostname is None:
|
|
hostname = socket.getfqdn()
|
|
|
|
ipa_db = certdb.NSSDatabase(paths.IPA_NSSDB_DIR)
|
|
sys_db = certdb.NSSDatabase(paths.NSS_DB_DIR)
|
|
|
|
cmonger = services.knownservices.certmonger
|
|
if ipa_db.has_nickname('Local IPA host'):
|
|
try:
|
|
certmonger.stop_tracking(paths.IPA_NSSDB_DIR,
|
|
nickname='Local IPA host')
|
|
except RuntimeError as e:
|
|
root_logger.error("%s failed to stop tracking certificate: %s",
|
|
cmonger.service_name, e)
|
|
|
|
client_nss_nickname = 'IPA Machine Certificate - %s' % hostname
|
|
if sys_db.has_nickname(client_nss_nickname):
|
|
try:
|
|
certmonger.stop_tracking(paths.NSS_DB_DIR,
|
|
nickname=client_nss_nickname)
|
|
except RuntimeError as e:
|
|
root_logger.error("%s failed to stop tracking certificate: %s",
|
|
cmonger.service_name, e)
|
|
|
|
for filename in (os.path.join(ipa_db.secdir, 'cert8.db'),
|
|
os.path.join(ipa_db.secdir, 'key3.db'),
|
|
os.path.join(ipa_db.secdir, 'secmod.db'),
|
|
os.path.join(ipa_db.secdir, 'pwdfile.txt')):
|
|
remove_file(filename)
|
|
|
|
# Remove any special principal names we added to the IPA CA helper
|
|
certmonger.remove_principal_from_cas()
|
|
|
|
try:
|
|
cmonger.stop()
|
|
except Exception as e:
|
|
log_service_error(cmonger.service_name, 'stop', e)
|
|
|
|
try:
|
|
cmonger.disable()
|
|
except Exception as e:
|
|
root_logger.error(
|
|
"Failed to disable automatic startup of the %s service: %s",
|
|
cmonger.service_name, str(e))
|
|
|
|
if not options.on_master and os.path.exists(paths.IPA_DEFAULT_CONF):
|
|
root_logger.info("Unenrolling client from IPA server")
|
|
join_args = [paths.SBIN_IPA_JOIN, "--unenroll", "-h", hostname]
|
|
if options.debug:
|
|
join_args.append("-d")
|
|
env['XMLRPC_TRACE_CURL'] = 'yes'
|
|
result = run(join_args, raiseonerr=False, env=env)
|
|
if result.returncode != 0:
|
|
root_logger.error("Unenrolling host failed: %s", result.error_log)
|
|
|
|
if os.path.exists(paths.IPA_DEFAULT_CONF):
|
|
root_logger.info(
|
|
"Removing Kerberos service principals from /etc/krb5.keytab")
|
|
try:
|
|
parser = RawConfigParser()
|
|
fp = open(paths.IPA_DEFAULT_CONF, 'r')
|
|
parser.readfp(fp)
|
|
fp.close()
|
|
realm = parser.get('global', 'realm')
|
|
run([paths.IPA_RMKEYTAB, "-k", paths.KRB5_KEYTAB, "-r", realm])
|
|
except CalledProcessError as err:
|
|
if err.returncode != 5:
|
|
# 5 means Principal name or realm not found in keytab
|
|
# and can be ignored
|
|
root_logger.error(
|
|
"Failed to remove Kerberos service principals: %s",
|
|
str(err))
|
|
except Exception as e:
|
|
root_logger.error(
|
|
"Failed to remove Kerberos service principals: %s", str(e))
|
|
|
|
root_logger.info("Disabling client Kerberos and LDAP configurations")
|
|
was_sssd_installed = False
|
|
was_sshd_configured = False
|
|
if fstore.has_files():
|
|
was_sssd_installed = fstore.has_file(paths.SSSD_CONF)
|
|
|
|
sshd_config = os.path.join(services.knownservices.sshd.get_config_dir(), "sshd_config")
|
|
was_sshd_configured = fstore.has_file(sshd_config)
|
|
try:
|
|
tasks.restore_pre_ipa_client_configuration(fstore,
|
|
statestore,
|
|
was_sssd_installed,
|
|
was_sssd_configured)
|
|
except Exception as e:
|
|
root_logger.error(
|
|
"Failed to remove krb5/LDAP configuration: %s", str(e))
|
|
return CLIENT_INSTALL_ERROR
|
|
|
|
# Clean up the SSSD cache before SSSD service is stopped or restarted
|
|
remove_file(paths.SSSD_MC_GROUP)
|
|
remove_file(paths.SSSD_MC_PASSWD)
|
|
|
|
if ipa_domain:
|
|
sssd_domain_ldb = "cache_" + ipa_domain + ".ldb"
|
|
sssd_ldb_file = os.path.join(paths.SSSD_DB, sssd_domain_ldb)
|
|
remove_file(sssd_ldb_file)
|
|
|
|
sssd_domain_ccache = "ccache_" + ipa_domain.upper()
|
|
sssd_ccache_file = os.path.join(paths.SSSD_DB, sssd_domain_ccache)
|
|
remove_file(sssd_ccache_file)
|
|
|
|
# Next if-elif-elif construction deals with sssd.conf file.
|
|
# Old pre-IPA domains are preserved due merging the old sssd.conf
|
|
# during the installation of ipa-client but any new domains are
|
|
# only present in sssd.conf now, so we don't want to delete them
|
|
# by rewriting sssd.conf file. IPA domain is removed gracefully.
|
|
|
|
# SSSD was installed before our installation and other non-IPA domains
|
|
# found, restore backed up sssd.conf to sssd.conf.bkp and remove IPA
|
|
# domain from the current sssd.conf
|
|
if was_sssd_installed and was_sssd_configured:
|
|
root_logger.info(
|
|
"The original configuration of SSSD included other domains than " +
|
|
"the IPA-based one.")
|
|
|
|
delete_ipa_domain()
|
|
|
|
|
|
restored = False
|
|
try:
|
|
restored = fstore.restore_file(paths.SSSD_CONF,paths.SSSD_CONF_BKP)
|
|
except OSError:
|
|
root_logger.debug("Error while restoring pre-IPA /etc/sssd/sssd.conf.")
|
|
|
|
if restored:
|
|
root_logger.info("Original pre-IPA SSSD configuration file was "
|
|
"restored to /etc/sssd/sssd.conf.bkp.")
|
|
|
|
root_logger.info("IPA domain removed from current one, " +
|
|
"restarting SSSD service")
|
|
sssd = services.service('sssd')
|
|
try:
|
|
sssd.restart()
|
|
except CalledProcessError:
|
|
root_logger.warning("SSSD service restart was unsuccessful.")
|
|
|
|
# SSSD was not installed before our installation, but other domains found,
|
|
# delete IPA domain, but leave other domains intact
|
|
elif not was_sssd_installed and was_sssd_configured:
|
|
delete_ipa_domain()
|
|
root_logger.info("Other domains than IPA domain found, " +
|
|
"IPA domain was removed from /etc/sssd/sssd.conf.")
|
|
|
|
sssd = services.service('sssd')
|
|
try:
|
|
sssd.restart()
|
|
except CalledProcessError:
|
|
root_logger.warning("SSSD service restart was unsuccessful.")
|
|
|
|
# SSSD was not installed before our installation, and no other domains
|
|
# than IPA are configured in sssd.conf - make sure config file is removed
|
|
elif not was_sssd_installed and not was_sssd_configured:
|
|
try:
|
|
os.rename(paths.SSSD_CONF,paths.SSSD_CONF_DELETED)
|
|
except OSError:
|
|
root_logger.debug("Error while moving /etc/sssd/sssd.conf to %s" %
|
|
paths.SSSD_CONF_DELETED)
|
|
|
|
root_logger.info("Redundant SSSD configuration file " +
|
|
"/etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deleted")
|
|
|
|
sssd = services.service('sssd')
|
|
try:
|
|
sssd.stop()
|
|
except CalledProcessError:
|
|
root_logger.warning("SSSD service could not be stopped")
|
|
|
|
try:
|
|
sssd.disable()
|
|
except CalledProcessError as e:
|
|
root_logger.warning(
|
|
"Failed to disable automatic startup of the SSSD daemon: %s", e)
|
|
|
|
tasks.restore_hostname(fstore, statestore)
|
|
|
|
if fstore.has_files():
|
|
root_logger.info("Restoring client configuration files")
|
|
fstore.restore_all_files()
|
|
|
|
unconfigure_nisdomain()
|
|
|
|
nscd = services.knownservices.nscd
|
|
nslcd = services.knownservices.nslcd
|
|
|
|
for service in (nscd, nslcd):
|
|
if service.is_installed():
|
|
restore_state(service)
|
|
else:
|
|
# this is an optional service, just log
|
|
root_logger.info(
|
|
"%s daemon is not installed, skip configuration",
|
|
service.service_name
|
|
)
|
|
|
|
ntp_configured = statestore.has_state('ntp')
|
|
if ntp_configured:
|
|
ntp_enabled = statestore.restore_state('ntp', 'enabled')
|
|
ntp_step_tickers = statestore.restore_state('ntp', 'step-tickers')
|
|
restored = False
|
|
|
|
try:
|
|
# Restore might fail due to file missing in backup
|
|
# the reason for it might be that freeipa-client was updated
|
|
# to this version but not unenrolled/enrolled again
|
|
# In such case it is OK to fail
|
|
restored = fstore.restore_file(paths.NTP_CONF)
|
|
restored |= fstore.restore_file(paths.SYSCONFIG_NTPD)
|
|
if ntp_step_tickers:
|
|
restored |= fstore.restore_file(paths.NTP_STEP_TICKERS)
|
|
except Exception:
|
|
pass
|
|
|
|
if not ntp_enabled:
|
|
services.knownservices.ntpd.stop()
|
|
services.knownservices.ntpd.disable()
|
|
else:
|
|
if restored:
|
|
services.knownservices.ntpd.restart()
|
|
|
|
try:
|
|
ipaclient.ntpconf.restore_forced_ntpd(statestore)
|
|
except CalledProcessError as e:
|
|
root_logger.error('Failed to start chronyd: %s', e)
|
|
|
|
if was_sshd_configured and services.knownservices.sshd.is_running():
|
|
services.knownservices.sshd.restart()
|
|
|
|
# Remove the Firefox configuration
|
|
if statestore.has_state('firefox'):
|
|
root_logger.info("Removing Firefox configuration.")
|
|
preferences_fname = statestore.restore_state('firefox', 'preferences_fname')
|
|
if preferences_fname is not None:
|
|
if file_exists(preferences_fname):
|
|
try:
|
|
os.remove(preferences_fname)
|
|
except Exception as e:
|
|
root_logger.warning("'%s' could not be removed: %s." % preferences_fname, str(e))
|
|
root_logger.warning("Please remove file '%s' manually." % preferences_fname)
|
|
|
|
rv = 0
|
|
|
|
if fstore.has_files():
|
|
root_logger.error('Some files have not been restored, see %s' %
|
|
paths.SYSRESTORE_INDEX)
|
|
has_state = False
|
|
for module in statestore.modules:
|
|
root_logger.error('Some installation state for %s has not been '
|
|
'restored, see /var/lib/ipa/sysrestore/sysrestore.state',
|
|
module)
|
|
has_state = True
|
|
rv = 1
|
|
|
|
if has_state:
|
|
root_logger.warning(
|
|
'Some installation state has not been restored.\n'
|
|
'This may cause re-installation to fail.\n'
|
|
'It should be safe to remove /var/lib/ipa-client/sysrestore.state '
|
|
'but it may\n mean your system hasn\'t been restored '
|
|
'to its pre-installation state.')
|
|
|
|
# Remove the IPA configuration file
|
|
remove_file(paths.IPA_DEFAULT_CONF)
|
|
|
|
# Remove the CA cert from the systemwide certificate store
|
|
tasks.remove_ca_certs_from_systemwide_ca_store()
|
|
|
|
# Remove the CA cert
|
|
remove_file(CACERT)
|
|
|
|
root_logger.info("Client uninstall complete.")
|
|
|
|
# The next block of code prompts for reboot, therefore all uninstall
|
|
# logic has to be done before
|
|
|
|
if not options.unattended:
|
|
root_logger.info(
|
|
"The original nsswitch.conf configuration has been restored.")
|
|
root_logger.info(
|
|
"You may need to restart services or reboot the machine.")
|
|
if not options.on_master:
|
|
if user_input("Do you want to reboot the machine?", False):
|
|
try:
|
|
run([paths.SBIN_REBOOT])
|
|
except Exception as e:
|
|
root_logger.error(
|
|
"Reboot command failed to exceute: %s", str(e))
|
|
return CLIENT_UNINSTALL_ERROR
|
|
|
|
# IMPORTANT: Do not put any client uninstall logic after the block above
|
|
|
|
return rv
|
|
|
|
def configure_ipa_conf(fstore, cli_basedn, cli_realm, cli_domain, cli_server, hostname):
|
|
ipaconf = ipaclient.ipachangeconf.IPAChangeConf("IPA Installer")
|
|
ipaconf.setOptionAssignment(" = ")
|
|
ipaconf.setSectionNameDelimiters(("[","]"))
|
|
|
|
opts = [{'name':'comment', 'type':'comment', 'value':'File modified by ipa-client-install'},
|
|
{'name':'empty', 'type':'empty'}]
|
|
|
|
#[global]
|
|
defopts = [{'name':'basedn', 'type':'option', 'value':cli_basedn},
|
|
{'name':'realm', 'type':'option', 'value':cli_realm},
|
|
{'name':'domain', 'type':'option', 'value':cli_domain},
|
|
{'name':'server', 'type':'option', 'value':cli_server[0]},
|
|
{'name':'host', 'type':'option', 'value':hostname},
|
|
{'name':'xmlrpc_uri', 'type':'option', 'value':'https://%s/ipa/xml' % ipautil.format_netloc(cli_server[0])},
|
|
{'name':'enable_ra', 'type':'option', 'value':'True'}]
|
|
|
|
opts.append({'name':'global', 'type':'section', 'value':defopts})
|
|
opts.append({'name':'empty', 'type':'empty'})
|
|
|
|
target_fname = paths.IPA_DEFAULT_CONF
|
|
fstore.backup_file(target_fname)
|
|
ipaconf.newConf(target_fname, opts)
|
|
os.chmod(target_fname, 0o644)
|
|
|
|
return 0
|
|
|
|
|
|
def disable_ra():
|
|
"""Set the enable_ra option in /etc/ipa/default.conf to False
|
|
|
|
Note that api.env will retain the old value (it is readonly).
|
|
"""
|
|
parser = RawConfigParser()
|
|
parser.read(paths.IPA_DEFAULT_CONF)
|
|
parser.set('global', 'enable_ra', 'False')
|
|
fp = open(paths.IPA_DEFAULT_CONF, 'w')
|
|
parser.write(fp)
|
|
fp.close()
|
|
|
|
|
|
def configure_ldap_conf(fstore, cli_basedn, cli_realm, cli_domain, cli_server, dnsok, options, files):
|
|
ldapconf = ipaclient.ipachangeconf.IPAChangeConf("IPA Installer")
|
|
ldapconf.setOptionAssignment(" ")
|
|
|
|
opts = [{'name':'comment', 'type':'comment', 'value':'File modified by ipa-client-install'},
|
|
{'name':'empty', 'type':'empty'},
|
|
{'name':'ldap_version', 'type':'option', 'value':'3'},
|
|
{'name':'base', 'type':'option', 'value':cli_basedn},
|
|
{'name':'empty', 'type':'empty'},
|
|
{'name':'nss_base_passwd', 'type':'option', 'value':str(DN(('cn', 'users'), ('cn', 'accounts'), cli_basedn))+'?sub'},
|
|
{'name':'nss_base_group', 'type':'option', 'value':str(DN(('cn', 'groups'), ('cn', 'accounts'), cli_basedn))+'?sub'},
|
|
{'name':'nss_schema', 'type':'option', 'value':'rfc2307bis'},
|
|
{'name':'nss_map_attribute', 'type':'option', 'value':'uniqueMember member'},
|
|
{'name':'nss_initgroups_ignoreusers', 'type':'option', 'value':'root,dirsrv'},
|
|
{'name':'empty', 'type':'empty'},
|
|
{'name':'nss_reconnect_maxsleeptime', 'type':'option', 'value':'8'},
|
|
{'name':'nss_reconnect_sleeptime', 'type':'option', 'value':'1'},
|
|
{'name':'bind_timelimit', 'type':'option', 'value':'5'},
|
|
{'name':'timelimit', 'type':'option', 'value':'15'},
|
|
{'name':'empty', 'type':'empty'}]
|
|
if not dnsok or options.force or options.on_master:
|
|
if options.on_master:
|
|
opts.append({'name':'uri', 'type':'option', 'value':'ldap://localhost'})
|
|
else:
|
|
opts.append({'name':'uri', 'type':'option', 'value':'ldap://'+ipautil.format_netloc(cli_server[0])})
|
|
else:
|
|
opts.append({'name':'nss_srv_domain', 'type':'option', 'value':cli_domain})
|
|
|
|
opts.append({'name':'empty', 'type':'empty'})
|
|
|
|
# Depending on the release and distribution this may exist in any
|
|
# number of different file names, update what we find
|
|
for filename in files:
|
|
try:
|
|
fstore.backup_file(filename)
|
|
ldapconf.newConf(filename, opts)
|
|
except Exception as e:
|
|
root_logger.error("Creation of %s failed: %s", filename, str(e))
|
|
return (1, 'LDAP', filename)
|
|
|
|
if files:
|
|
return (0, 'LDAP', ', '.join(files))
|
|
|
|
return 0, None, None
|
|
|
|
def configure_nslcd_conf(fstore, cli_basedn, cli_realm, cli_domain, cli_server, dnsok, options, files):
|
|
nslcdconf = ipaclient.ipachangeconf.IPAChangeConf("IPA Installer")
|
|
nslcdconf.setOptionAssignment(" ")
|
|
|
|
opts = [{'name':'comment', 'type':'comment', 'value':'File modified by ipa-client-install'},
|
|
{'name':'empty', 'type':'empty'},
|
|
{'name':'ldap_version', 'type':'option', 'value':'3'},
|
|
{'name':'base', 'type':'option', 'value':cli_basedn},
|
|
{'name':'empty', 'type':'empty'},
|
|
{'name':'base passwd', 'type':'option', 'value':str(DN(('cn', 'users'), ('cn', 'accounts'), cli_basedn))},
|
|
{'name':'base group', 'type':'option', 'value':str(DN(('cn', 'groups'), ('cn', 'accounts'), cli_basedn))},
|
|
{'name':'timelimit', 'type':'option', 'value':'15'},
|
|
{'name':'empty', 'type':'empty'}]
|
|
if not dnsok or options.force or options.on_master:
|
|
if options.on_master:
|
|
opts.append({'name':'uri', 'type':'option', 'value':'ldap://localhost'})
|
|
else:
|
|
opts.append({'name':'uri', 'type':'option', 'value':'ldap://'+ipautil.format_netloc(cli_server[0])})
|
|
else:
|
|
opts.append({'name':'uri', 'type':'option', 'value':'DNS'})
|
|
|
|
opts.append({'name':'empty', 'type':'empty'})
|
|
|
|
for filename in files:
|
|
try:
|
|
fstore.backup_file(filename)
|
|
nslcdconf.newConf(filename, opts)
|
|
except Exception as e:
|
|
root_logger.error("Creation of %s failed: %s", filename, str(e))
|
|
return (1, None, None)
|
|
|
|
nslcd = services.knownservices.nslcd
|
|
if nslcd.is_installed():
|
|
try:
|
|
nslcd.restart()
|
|
except Exception as e:
|
|
log_service_error(nslcd.service_name, 'restart', e)
|
|
|
|
try:
|
|
nslcd.enable()
|
|
except Exception as e:
|
|
root_logger.error(
|
|
"Failed to enable automatic startup of the %s daemon: %s",
|
|
nslcd.service_name, str(e))
|
|
else:
|
|
root_logger.debug("%s daemon is not installed, skip configuration",
|
|
nslcd.service_name)
|
|
return (0, None, None)
|
|
|
|
return (0, 'NSLCD', ', '.join(files))
|
|
|
|
def configure_openldap_conf(fstore, cli_basedn, cli_server):
|
|
ldapconf = ipaclient.ipachangeconf.IPAChangeConf("IPA Installer")
|
|
ldapconf.setOptionAssignment((" ", "\t"))
|
|
|
|
opts = [{'name':'comment', 'type':'comment',
|
|
'value':' File modified by ipa-client-install'},
|
|
{'name':'empty', 'type':'empty'},
|
|
{'name':'comment', 'type':'comment',
|
|
'value':' We do not want to break your existing configuration, '
|
|
'hence:'},
|
|
# this needs to be kept updated if we change more options
|
|
{'name':'comment', 'type':'comment',
|
|
'value':' URI, BASE and TLS_CACERT have been added if they '
|
|
'were not set.'},
|
|
{'name':'comment', 'type':'comment',
|
|
'value':' In case any of them were set, a comment with '
|
|
'trailing note'},
|
|
{'name':'comment', 'type':'comment',
|
|
'value':' "# modified by IPA" note has been inserted.'},
|
|
{'name':'comment', 'type':'comment',
|
|
'value':' To use IPA server with openLDAP tools, please comment '
|
|
'out your'},
|
|
{'name':'comment', 'type':'comment',
|
|
'value':' existing configuration for these options and '
|
|
'uncomment the'},
|
|
{'name':'comment', 'type':'comment',
|
|
'value':' corresponding lines generated by IPA.'},
|
|
{'name':'empty', 'type':'empty'},
|
|
{'name':'empty', 'type':'empty'},
|
|
{'action':'addifnotset', 'name':'URI', 'type':'option',
|
|
'value':'ldaps://'+ cli_server[0]},
|
|
{'action':'addifnotset', 'name':'BASE', 'type':'option',
|
|
'value':str(cli_basedn)},
|
|
{'action':'addifnotset', 'name':'TLS_CACERT', 'type':'option',
|
|
'value':CACERT},]
|
|
|
|
target_fname = paths.OPENLDAP_LDAP_CONF
|
|
fstore.backup_file(target_fname)
|
|
|
|
error_msg = "Configuring {path} failed with: {err}"
|
|
|
|
try:
|
|
ldapconf.changeConf(target_fname, opts)
|
|
except SyntaxError as e:
|
|
root_logger.info("Could not parse {path}".format(path=target_fname))
|
|
root_logger.debug(error_msg.format(path=target_fname, err=str(e)))
|
|
return False
|
|
except IOError as e :
|
|
root_logger.info("{path} does not exist.".format(path=target_fname))
|
|
root_logger.debug(error_msg.format(path=target_fname, err=str(e)))
|
|
return False
|
|
except Exception as e: # we do not want to fail in an optional step
|
|
root_logger.debug(error_msg.format(path=target_fname, err=str(e)))
|
|
return False
|
|
|
|
os.chmod(target_fname, 0o644)
|
|
return True
|
|
|
|
def hardcode_ldap_server(cli_server):
|
|
"""
|
|
DNS Discovery didn't return a valid IPA server, hardcode a value into
|
|
the file instead.
|
|
"""
|
|
if not file_exists(paths.LDAP_CONF):
|
|
return
|
|
|
|
ldapconf = ipaclient.ipachangeconf.IPAChangeConf("IPA Installer")
|
|
ldapconf.setOptionAssignment(" ")
|
|
|
|
opts = [{'name':'uri', 'type':'option', 'action':'set', 'value':'ldap://'+ipautil.format_netloc(cli_server[0])},
|
|
{'name':'empty', 'type':'empty'}]
|
|
|
|
# Errors raised by this should be caught by the caller
|
|
ldapconf.changeConf(paths.LDAP_CONF, opts)
|
|
root_logger.info("Changed configuration of /etc/ldap.conf to use " +
|
|
"hardcoded server name: %s", cli_server[0])
|
|
|
|
return
|
|
|
|
def configure_krb5_conf(cli_realm, cli_domain, cli_server, cli_kdc, dnsok,
|
|
options, filename, client_domain, client_hostname):
|
|
|
|
krbconf = ipaclient.ipachangeconf.IPAChangeConf("IPA Installer")
|
|
krbconf.setOptionAssignment((" = ", " "))
|
|
krbconf.setSectionNameDelimiters(("[","]"))
|
|
krbconf.setSubSectionDelimiters(("{","}"))
|
|
krbconf.setIndent((""," "," "))
|
|
|
|
opts = [{'name':'comment', 'type':'comment', 'value':'File modified by ipa-client-install'},
|
|
{'name':'empty', 'type':'empty'},
|
|
{'name':'includedir', 'type':'option', 'value':paths.COMMON_KRB5_CONF_DIR, 'delim':' '}]
|
|
|
|
# SSSD include dir
|
|
if options.sssd:
|
|
opts.append({'name':'includedir', 'type':'option', 'value':paths.SSSD_PUBCONF_KRB5_INCLUDE_D_DIR, 'delim':' '})
|
|
opts.append({'name':'empty', 'type':'empty'})
|
|
|
|
#[libdefaults]
|
|
libopts = [{'name':'default_realm', 'type':'option', 'value':cli_realm}]
|
|
if not dnsok or not cli_kdc or options.force:
|
|
libopts.append({'name':'dns_lookup_realm', 'type':'option', 'value':'false'})
|
|
libopts.append({'name':'dns_lookup_kdc', 'type':'option', 'value':'false'})
|
|
else:
|
|
libopts.append({'name':'dns_lookup_realm', 'type':'option', 'value':'true'})
|
|
libopts.append({'name':'dns_lookup_kdc', 'type':'option', 'value':'true'})
|
|
libopts.append({'name':'rdns', 'type':'option', 'value':'false'})
|
|
libopts.append({'name':'ticket_lifetime', 'type':'option', 'value':'24h'})
|
|
libopts.append({'name':'forwardable', 'type':'option', 'value':'true'})
|
|
libopts.append({'name':'udp_preference_limit', 'type':'option', 'value':'0'})
|
|
|
|
# Configure KEYRING CCACHE if supported
|
|
if kernel_keyring.is_persistent_keyring_supported():
|
|
root_logger.debug("Enabling persistent keyring CCACHE")
|
|
libopts.append({'name':'default_ccache_name', 'type':'option',
|
|
'value':'KEYRING:persistent:%{uid}'})
|
|
|
|
opts.append({'name':'libdefaults', 'type':'section', 'value':libopts})
|
|
opts.append({'name':'empty', 'type':'empty'})
|
|
|
|
#the following are necessary only if DNS discovery does not work
|
|
kropts = []
|
|
if not dnsok or not cli_kdc or options.force:
|
|
#[realms]
|
|
for server in cli_server:
|
|
kropts.append({'name':'kdc', 'type':'option', 'value':ipautil.format_netloc(server, 88)})
|
|
kropts.append({'name':'master_kdc', 'type':'option', 'value':ipautil.format_netloc(server, 88)})
|
|
kropts.append({'name':'admin_server', 'type':'option', 'value':ipautil.format_netloc(server, 749)})
|
|
kropts.append({'name': 'kpasswd_server',
|
|
'type': 'option',
|
|
'value': ipautil.format_netloc(server, 464)
|
|
})
|
|
kropts.append({'name':'default_domain', 'type':'option', 'value':cli_domain})
|
|
kropts.append({'name':'pkinit_anchors', 'type':'option', 'value':'FILE:%s' % CACERT})
|
|
ropts = [{'name':cli_realm, 'type':'subsection', 'value':kropts}]
|
|
|
|
opts.append({'name':'realms', 'type':'section', 'value':ropts})
|
|
opts.append({'name':'empty', 'type':'empty'})
|
|
|
|
#[domain_realm]
|
|
dropts = [{'name':'.'+cli_domain, 'type':'option', 'value':cli_realm},
|
|
{'name':cli_domain, 'type':'option', 'value':cli_realm},
|
|
{'name':client_hostname, 'type':'option', 'value':cli_realm}]
|
|
|
|
#add client domain mapping if different from server domain
|
|
if cli_domain != client_domain:
|
|
dropts.append({'name':'.'+client_domain, 'type':'option', 'value':cli_realm})
|
|
dropts.append({'name':client_domain, 'type':'option', 'value':cli_realm})
|
|
|
|
opts.append({'name':'domain_realm', 'type':'section', 'value':dropts})
|
|
opts.append({'name':'empty', 'type':'empty'})
|
|
|
|
root_logger.debug("Writing Kerberos configuration to %s:", filename)
|
|
root_logger.debug("%s", krbconf.dump(opts))
|
|
|
|
krbconf.newConf(filename, opts)
|
|
os.chmod(filename, 0o644)
|
|
|
|
return 0
|
|
|
|
def configure_certmonger(fstore, subject_base, cli_realm, hostname, options,
|
|
ca_enabled):
|
|
if not options.request_cert:
|
|
return
|
|
|
|
if not ca_enabled:
|
|
root_logger.warning(
|
|
"An RA is not configured on the server. "
|
|
"Not requesting host certificate.")
|
|
return
|
|
|
|
principal = 'host/%s@%s' % (hostname, cli_realm)
|
|
|
|
if options.hostname:
|
|
# If the hostname is explicitly set then we need to tell certmonger
|
|
# which principal name to use when requesting certs.
|
|
certmonger.add_principal_to_cas(principal)
|
|
|
|
cmonger = services.knownservices.certmonger
|
|
try:
|
|
cmonger.enable()
|
|
except Exception as e:
|
|
root_logger.error(
|
|
"Failed to configure automatic startup of the %s daemon: %s",
|
|
cmonger.service_name, str(e))
|
|
root_logger.warning(
|
|
"Automatic certificate management will not be available")
|
|
|
|
# Request our host cert
|
|
subject = str(DN(('CN', hostname), subject_base))
|
|
passwd_fname = os.path.join(paths.IPA_NSSDB_DIR, 'pwdfile.txt')
|
|
try:
|
|
certmonger.request_cert(nssdb=paths.IPA_NSSDB_DIR,
|
|
nickname='Local IPA host',
|
|
subject=subject, dns=[hostname],
|
|
principal=principal,
|
|
passwd_fname=passwd_fname)
|
|
except Exception as ex:
|
|
root_logger.error("%s request for host certificate failed: %s",
|
|
cmonger.service_name, ex)
|
|
|
|
def configure_sssd_conf(fstore, cli_realm, cli_domain, cli_server, options, client_domain, client_hostname):
|
|
try:
|
|
sssdconfig = SSSDConfig.SSSDConfig()
|
|
sssdconfig.import_config()
|
|
except Exception as e:
|
|
if os.path.exists(paths.SSSD_CONF) and options.preserve_sssd:
|
|
# SSSD config is in place but we are unable to read it
|
|
# In addition, we are instructed to preserve it
|
|
# This all means we can't use it and have to bail out
|
|
root_logger.error(
|
|
"SSSD config exists but cannot be parsed: %s", str(e))
|
|
root_logger.error(
|
|
"Was instructed to preserve existing SSSD config")
|
|
root_logger.info("Correct errors in /etc/sssd/sssd.conf and " +
|
|
"re-run installation")
|
|
return 1
|
|
|
|
# SSSD configuration does not exist or we are not asked to preserve it, create new one
|
|
# We do make new SSSDConfig instance because IPAChangeConf-derived classes have no
|
|
# means to reset their state and ParseError exception could come due to parsing
|
|
# error from older version which cannot be upgraded anymore, leaving sssdconfig
|
|
# instance practically unusable
|
|
# Note that we already backed up sssd.conf before going into this routine
|
|
if isinstance(e, IOError):
|
|
pass
|
|
else:
|
|
# It was not IOError so it must have been parsing error
|
|
root_logger.error("Unable to parse existing SSSD config. " +
|
|
"As option --preserve-sssd was not specified, new config " +
|
|
"will override the old one.")
|
|
root_logger.info("The old /etc/sssd/sssd.conf is backed up and " +
|
|
"will be restored during uninstall.")
|
|
root_logger.info("New SSSD config will be created")
|
|
sssdconfig = SSSDConfig.SSSDConfig()
|
|
sssdconfig.new_config()
|
|
|
|
try:
|
|
domain = sssdconfig.new_domain(cli_domain)
|
|
except SSSDConfig.DomainAlreadyExistsError:
|
|
root_logger.info("Domain %s is already configured in existing SSSD " +
|
|
"config, creating a new one.", cli_domain)
|
|
root_logger.info("The old /etc/sssd/sssd.conf is backed up and will " +
|
|
"be restored during uninstall.")
|
|
sssdconfig = SSSDConfig.SSSDConfig()
|
|
sssdconfig.new_config()
|
|
domain = sssdconfig.new_domain(cli_domain)
|
|
|
|
ssh_dir = services.knownservices.sshd.get_config_dir()
|
|
ssh_config = os.path.join(ssh_dir, 'ssh_config')
|
|
sshd_config = os.path.join(ssh_dir, 'sshd_config')
|
|
|
|
if (options.conf_ssh and file_exists(ssh_config)) or (options.conf_sshd and file_exists(sshd_config)):
|
|
try:
|
|
sssdconfig.new_service('ssh')
|
|
except SSSDConfig.ServiceAlreadyExists:
|
|
pass
|
|
except SSSDConfig.ServiceNotRecognizedError:
|
|
root_logger.error("Unable to activate the SSH service in SSSD config.")
|
|
root_logger.info(
|
|
"Please make sure you have SSSD built with SSH support installed.")
|
|
root_logger.info(
|
|
"Configure SSH support manually in /etc/sssd/sssd.conf.")
|
|
|
|
sssdconfig.activate_service('ssh')
|
|
|
|
if options.conf_sudo:
|
|
# Activate the service in the SSSD config
|
|
try:
|
|
sssdconfig.new_service('sudo')
|
|
except SSSDConfig.ServiceAlreadyExists:
|
|
pass
|
|
except SSSDConfig.ServiceNotRecognizedError:
|
|
root_logger.error("Unable to activate the SUDO service in "
|
|
"SSSD config.")
|
|
|
|
sssdconfig.activate_service('sudo')
|
|
configure_nsswitch_database(fstore, 'sudoers', ['sss'],
|
|
default_value=['files'])
|
|
|
|
domain.add_provider('ipa', 'id')
|
|
|
|
#add discovery domain if client domain different from server domain
|
|
#do not set this config in server mode (#3947)
|
|
if not options.on_master and cli_domain != client_domain:
|
|
domain.set_option('dns_discovery_domain', cli_domain)
|
|
|
|
if not options.on_master:
|
|
if options.primary:
|
|
domain.set_option('ipa_server', ', '.join(cli_server))
|
|
else:
|
|
domain.set_option('ipa_server', '_srv_, %s' % ', '.join(cli_server))
|
|
else:
|
|
domain.set_option('ipa_server_mode', 'True')
|
|
# the master should only use itself for Kerberos
|
|
domain.set_option('ipa_server', cli_server[0])
|
|
|
|
# increase memcache timeout to 10 minutes when in server mode
|
|
try:
|
|
nss_service = sssdconfig.get_service('nss')
|
|
except SSSDConfig.NoServiceError:
|
|
nss_service = sssdconfig.new_service('nss')
|
|
|
|
nss_service.set_option('memcache_timeout', 600)
|
|
sssdconfig.save_service(nss_service)
|
|
|
|
domain.set_option('ipa_domain', cli_domain)
|
|
domain.set_option('ipa_hostname', client_hostname)
|
|
if cli_domain.lower() != cli_realm.lower():
|
|
domain.set_option('krb5_realm', cli_realm)
|
|
|
|
# Might need this if /bin/hostname doesn't return a FQDN
|
|
#domain.set_option('ipa_hostname', 'client.example.com')
|
|
|
|
domain.add_provider('ipa', 'auth')
|
|
domain.add_provider('ipa', 'chpass')
|
|
if not options.permit:
|
|
domain.add_provider('ipa', 'access')
|
|
else:
|
|
domain.add_provider('permit', 'access')
|
|
|
|
domain.set_option('cache_credentials', True)
|
|
|
|
# SSSD will need TLS for checking if ipaMigrationEnabled attribute is set
|
|
# Note that SSSD will force StartTLS because the channel is later used for
|
|
# authentication as well if password migration is enabled. Thus set the option
|
|
# unconditionally.
|
|
domain.set_option('ldap_tls_cacert', CACERT)
|
|
|
|
if options.dns_updates:
|
|
domain.set_option('dyndns_update', True)
|
|
if options.all_ip_addresses:
|
|
domain.set_option('dyndns_iface', '*')
|
|
else:
|
|
iface = get_server_connection_interface(cli_server[0])
|
|
domain.set_option('dyndns_iface', iface)
|
|
if options.krb5_offline_passwords:
|
|
domain.set_option('krb5_store_password_if_offline', True)
|
|
|
|
domain.set_active(True)
|
|
|
|
sssdconfig.save_domain(domain)
|
|
sssdconfig.write(paths.SSSD_CONF)
|
|
|
|
return 0
|
|
|
|
def change_ssh_config(filename, changes, sections):
|
|
if not changes:
|
|
return True
|
|
|
|
try:
|
|
f = open(filename, 'r')
|
|
except IOError as e:
|
|
root_logger.error("Failed to open '%s': %s", filename, str(e))
|
|
return False
|
|
|
|
change_keys = tuple(key.lower() for key in changes)
|
|
section_keys = tuple(key.lower() for key in sections)
|
|
|
|
lines = []
|
|
in_section = False
|
|
for line in f:
|
|
line = line.rstrip('\n')
|
|
pline = line.strip()
|
|
if not pline or pline.startswith('#'):
|
|
lines.append(line)
|
|
continue
|
|
option = pline.split()[0].lower()
|
|
if option in section_keys:
|
|
in_section = True
|
|
break
|
|
if option in change_keys:
|
|
line = '#' + line
|
|
lines.append(line)
|
|
for option, value in changes.items():
|
|
if value is not None:
|
|
lines.append('%s %s' % (option, value))
|
|
if in_section:
|
|
lines.append('')
|
|
lines.append(line)
|
|
for line in f:
|
|
line = line.rstrip('\n')
|
|
lines.append(line)
|
|
lines.append('')
|
|
|
|
f.close()
|
|
|
|
try:
|
|
f = open(filename, 'w')
|
|
except IOError as e:
|
|
root_logger.error("Failed to open '%s': %s", filename, str(e))
|
|
return False
|
|
|
|
f.write('\n'.join(lines))
|
|
|
|
f.close()
|
|
|
|
return True
|
|
|
|
def configure_ssh_config(fstore, options):
|
|
ssh_dir = services.knownservices.sshd.get_config_dir()
|
|
ssh_config = os.path.join(ssh_dir, 'ssh_config')
|
|
|
|
if not file_exists(ssh_config):
|
|
root_logger.info("%s not found, skipping configuration" % ssh_config)
|
|
return
|
|
|
|
fstore.backup_file(ssh_config)
|
|
|
|
changes = {
|
|
'PubkeyAuthentication': 'yes',
|
|
}
|
|
|
|
if options.sssd and file_exists(paths.SSS_SSH_KNOWNHOSTSPROXY):
|
|
changes['ProxyCommand'] = '%s -p %%p %%h' % paths.SSS_SSH_KNOWNHOSTSPROXY
|
|
changes['GlobalKnownHostsFile'] = paths.SSSD_PUBCONF_KNOWN_HOSTS
|
|
if options.trust_sshfp:
|
|
changes['VerifyHostKeyDNS'] = 'yes'
|
|
changes['HostKeyAlgorithms'] = 'ssh-rsa,ssh-dss'
|
|
|
|
change_ssh_config(ssh_config, changes, ['Host', 'Match'])
|
|
root_logger.info('Configured %s', ssh_config)
|
|
|
|
def configure_sshd_config(fstore, options):
|
|
sshd = services.knownservices.sshd
|
|
ssh_dir = sshd.get_config_dir()
|
|
sshd_config = os.path.join(ssh_dir, 'sshd_config')
|
|
|
|
if not file_exists(sshd_config):
|
|
root_logger.info("%s not found, skipping configuration" % sshd_config)
|
|
return
|
|
|
|
fstore.backup_file(sshd_config)
|
|
|
|
changes = {
|
|
'PubkeyAuthentication': 'yes',
|
|
'KerberosAuthentication': 'no',
|
|
'GSSAPIAuthentication': 'yes',
|
|
'UsePAM': 'yes',
|
|
'ChallengeResponseAuthentication': 'yes',
|
|
}
|
|
|
|
if options.sssd and file_exists(paths.SSS_SSH_AUTHORIZEDKEYS):
|
|
authorized_keys_changes = None
|
|
|
|
candidates = (
|
|
{
|
|
'AuthorizedKeysCommand': paths.SSS_SSH_AUTHORIZEDKEYS,
|
|
'AuthorizedKeysCommandUser': 'nobody',
|
|
},
|
|
{
|
|
'AuthorizedKeysCommand': paths.SSS_SSH_AUTHORIZEDKEYS,
|
|
'AuthorizedKeysCommandRunAs': 'nobody',
|
|
},
|
|
{
|
|
'PubKeyAgent': '%s %%u' % paths.SSS_SSH_AUTHORIZEDKEYS,
|
|
'PubKeyAgentRunAs': 'nobody',
|
|
},
|
|
)
|
|
|
|
for candidate in candidates:
|
|
args = ['sshd', '-t', '-f', paths.DEV_NULL]
|
|
for item in candidate.items():
|
|
args.append('-o')
|
|
args.append('%s=%s' % item)
|
|
|
|
result = ipautil.run(args, raiseonerr=False)
|
|
if result.returncode == 0:
|
|
authorized_keys_changes = candidate
|
|
break
|
|
|
|
if authorized_keys_changes is not None:
|
|
changes.update(authorized_keys_changes)
|
|
else:
|
|
root_logger.warning("Installed OpenSSH server does not "
|
|
"support dynamically loading authorized user keys. "
|
|
"Public key authentication of IPA users will not be "
|
|
"available.")
|
|
|
|
change_ssh_config(sshd_config, changes, ['Match'])
|
|
root_logger.info('Configured %s', sshd_config)
|
|
|
|
if sshd.is_running():
|
|
try:
|
|
sshd.restart()
|
|
except Exception as e:
|
|
log_service_error(sshd.service_name, 'restart', e)
|
|
|
|
|
|
def configure_automount(options):
|
|
root_logger.info('\nConfiguring automount:')
|
|
|
|
args = [
|
|
'ipa-client-automount', '--debug', '-U',
|
|
'--location', options.location
|
|
]
|
|
|
|
if options.server:
|
|
args.extend(['--server', options.server[0]])
|
|
if not options.sssd:
|
|
args.append('--no-sssd')
|
|
|
|
try:
|
|
result = run(args)
|
|
except Exception as e:
|
|
root_logger.error('Automount configuration failed: %s', str(e))
|
|
else:
|
|
root_logger.info(result.output_log)
|
|
|
|
|
|
def configure_nisdomain(options, domain):
|
|
domain = options.nisdomain or domain
|
|
root_logger.info('Configuring %s as NIS domain.' % domain)
|
|
|
|
nis_domain_name = ''
|
|
|
|
# First backup the old NIS domain name
|
|
if os.path.exists(paths.BIN_NISDOMAINNAME):
|
|
try:
|
|
result = ipautil.run([paths.BIN_NISDOMAINNAME],
|
|
capture_output=True)
|
|
except CalledProcessError:
|
|
pass
|
|
else:
|
|
nis_domain_name = result.output
|
|
|
|
statestore.backup_state('network', 'nisdomain', nis_domain_name)
|
|
|
|
# Backup the state of the domainname service
|
|
statestore.backup_state("domainname", "enabled",
|
|
services.knownservices.domainname.is_enabled())
|
|
|
|
# Set the new NIS domain name
|
|
tasks.set_nisdomain(domain)
|
|
|
|
# Enable and start the domainname service
|
|
services.knownservices.domainname.enable()
|
|
# Restart rather than start so that new NIS domain name is loaded
|
|
# if the service is already running
|
|
services.knownservices.domainname.restart()
|
|
|
|
|
|
def unconfigure_nisdomain():
|
|
# Set the nisdomain permanent and current nisdomain configuration as it was
|
|
if statestore.has_state('network'):
|
|
old_nisdomain = statestore.restore_state('network','nisdomain') or ''
|
|
|
|
if old_nisdomain:
|
|
root_logger.info('Restoring %s as NIS domain.' % old_nisdomain)
|
|
else:
|
|
root_logger.info('Unconfiguring the NIS domain.')
|
|
|
|
tasks.set_nisdomain(old_nisdomain)
|
|
|
|
# Restore the configuration of the domainname service
|
|
enabled = statestore.restore_state('domainname', 'enabled')
|
|
if not enabled:
|
|
services.knownservices.domainname.disable()
|
|
|
|
|
|
def get_iface_from_ip(ip_addr):
|
|
for interface in netifaces.interfaces():
|
|
if_addrs = netifaces.ifaddresses(interface)
|
|
for family in [netifaces.AF_INET, netifaces.AF_INET6]:
|
|
for ip in if_addrs.get(family, []):
|
|
if ip['addr'] == ip_addr:
|
|
return interface
|
|
else:
|
|
raise RuntimeError("IP %s not assigned to any interface." % ip_addr)
|
|
|
|
|
|
def get_local_ipaddresses(iface=None):
|
|
if iface:
|
|
interfaces = [iface]
|
|
else:
|
|
interfaces = netifaces.interfaces()
|
|
|
|
ips = []
|
|
for interface in interfaces:
|
|
if_addrs = netifaces.ifaddresses(interface)
|
|
for family in [netifaces.AF_INET, netifaces.AF_INET6]:
|
|
for ip in if_addrs.get(family, []):
|
|
try:
|
|
ips.append(ipautil.CheckedIPAddress(ip['addr']))
|
|
root_logger.debug('IP check successful: %s' % ip['addr'])
|
|
except ValueError as e:
|
|
root_logger.debug('IP check failed: %s' % e)
|
|
return ips
|
|
|
|
|
|
def do_nsupdate(update_txt):
|
|
root_logger.debug("Writing nsupdate commands to %s:", UPDATE_FILE)
|
|
root_logger.debug("%s", update_txt)
|
|
|
|
update_fd = open(UPDATE_FILE, "w")
|
|
update_fd.write(update_txt)
|
|
update_fd.flush()
|
|
update_fd.close()
|
|
|
|
result = False
|
|
try:
|
|
ipautil.run([paths.NSUPDATE, '-g', UPDATE_FILE])
|
|
result = True
|
|
except CalledProcessError as e:
|
|
root_logger.debug('nsupdate failed: %s', str(e))
|
|
|
|
try:
|
|
os.remove(UPDATE_FILE)
|
|
except Exception:
|
|
pass
|
|
|
|
return result
|
|
|
|
DELETE_TEMPLATE_A = """
|
|
update delete $HOSTNAME. IN A
|
|
show
|
|
send
|
|
"""
|
|
|
|
DELETE_TEMPLATE_AAAA = """
|
|
update delete $HOSTNAME. IN AAAA
|
|
show
|
|
send
|
|
"""
|
|
ADD_TEMPLATE_A = """
|
|
update add $HOSTNAME. $TTL IN A $IPADDRESS
|
|
show
|
|
send
|
|
"""
|
|
|
|
ADD_TEMPLATE_AAAA = """
|
|
update add $HOSTNAME. $TTL IN AAAA $IPADDRESS
|
|
show
|
|
send
|
|
"""
|
|
|
|
UPDATE_FILE = paths.IPA_DNS_UPDATE_TXT
|
|
CCACHE_FILE = paths.IPA_DNS_CCACHE
|
|
|
|
def update_dns(server, hostname, options):
|
|
|
|
try:
|
|
ips = get_local_ipaddresses()
|
|
except CalledProcessError as e:
|
|
root_logger.error("Cannot update DNS records. %s" % e)
|
|
root_logger.debug("Unable to get local IP addresses.")
|
|
|
|
if options.all_ip_addresses:
|
|
update_ips = ips
|
|
elif options.ip_addresses:
|
|
update_ips = []
|
|
for ip in options.ip_addresses:
|
|
update_ips.append(ipautil.CheckedIPAddress(ip))
|
|
else:
|
|
try:
|
|
iface = get_server_connection_interface(server)
|
|
except RuntimeError as e:
|
|
root_logger.error("Cannot update DNS records. %s" % e)
|
|
return
|
|
try:
|
|
update_ips = get_local_ipaddresses(iface)
|
|
except CalledProcessError as e:
|
|
root_logger.error("Cannot update DNS records. %s" % e)
|
|
return
|
|
|
|
if not update_ips:
|
|
root_logger.info("Failed to determine this machine's ip address(es).")
|
|
return
|
|
|
|
network_ip_address_warning(update_ips)
|
|
broadcast_ip_address_warning(update_ips)
|
|
|
|
update_txt = "debug\n"
|
|
update_txt += ipautil.template_str(DELETE_TEMPLATE_A,
|
|
dict(HOSTNAME=hostname))
|
|
update_txt += ipautil.template_str(DELETE_TEMPLATE_AAAA,
|
|
dict(HOSTNAME=hostname))
|
|
|
|
for ip in update_ips:
|
|
sub_dict = dict(HOSTNAME=hostname, IPADDRESS=ip, TTL=1200)
|
|
if ip.version == 4:
|
|
template = ADD_TEMPLATE_A
|
|
elif ip.version == 6:
|
|
template = ADD_TEMPLATE_AAAA
|
|
update_txt += ipautil.template_str(template, sub_dict)
|
|
|
|
if not do_nsupdate(update_txt):
|
|
root_logger.error("Failed to update DNS records.")
|
|
verify_dns_update(hostname, update_ips)
|
|
|
|
|
|
def verify_dns_update(fqdn, ips):
|
|
"""
|
|
Verify that the fqdn resolves to all IP addresses and
|
|
that there's matching PTR record for every IP address.
|
|
"""
|
|
# verify A/AAAA records
|
|
missing_ips = [str(ip) for ip in ips]
|
|
extra_ips = []
|
|
for record_type in [dns.rdatatype.A, dns.rdatatype.AAAA]:
|
|
root_logger.debug('DNS resolver: Query: %s IN %s' %
|
|
(fqdn, dns.rdatatype.to_text(record_type)))
|
|
try:
|
|
answers = dns.resolver.query(fqdn, record_type)
|
|
except (dns.resolver.NoAnswer, dns.resolver.NXDOMAIN):
|
|
root_logger.debug('DNS resolver: No record.')
|
|
except dns.resolver.NoNameservers:
|
|
root_logger.debug('DNS resolver: No nameservers answered the'
|
|
'query.')
|
|
except dns.exception.DNSException:
|
|
root_logger.debug('DNS resolver error.')
|
|
else:
|
|
for rdata in answers:
|
|
try:
|
|
missing_ips.remove(rdata.address)
|
|
except ValueError:
|
|
extra_ips.append(rdata.address)
|
|
|
|
# verify PTR records
|
|
fqdn_name = dns.name.from_text(fqdn)
|
|
wrong_reverse = {}
|
|
missing_reverse = [str(ip) for ip in ips]
|
|
for ip in ips:
|
|
ip_str = str(ip)
|
|
addr = dns.reversename.from_address(ip_str)
|
|
root_logger.debug('DNS resolver: Query: %s IN PTR' % addr)
|
|
try:
|
|
answers = dns.resolver.query(addr, dns.rdatatype.PTR)
|
|
except (dns.resolver.NoAnswer, dns.resolver.NXDOMAIN):
|
|
root_logger.debug('DNS resolver: No record.')
|
|
except dns.resolver.NoNameservers:
|
|
root_logger.debug('DNS resolver: No nameservers answered the'
|
|
'query.')
|
|
except dns.exception.DNSException:
|
|
root_logger.debug('DNS resolver error.')
|
|
else:
|
|
missing_reverse.remove(ip_str)
|
|
for rdata in answers:
|
|
if not rdata.target == fqdn_name:
|
|
wrong_reverse.setdefault(ip_str, []).append(rdata.target)
|
|
|
|
if missing_ips:
|
|
root_logger.warning('Missing A/AAAA record(s) for host %s: %s.' %
|
|
(fqdn, ', '.join(missing_ips)))
|
|
if extra_ips:
|
|
root_logger.warning('Extra A/AAAA record(s) for host %s: %s.' %
|
|
(fqdn, ', '.join(extra_ips)))
|
|
if missing_reverse:
|
|
root_logger.warning('Missing reverse record(s) for address(es): %s.' %
|
|
', '.join(missing_reverse))
|
|
if wrong_reverse:
|
|
root_logger.warning('Incorrect reverse record(s):')
|
|
for ip in wrong_reverse:
|
|
for target in wrong_reverse[ip]:
|
|
root_logger.warning('%s is pointing to %s instead of %s' %
|
|
(ip, target, fqdn_name))
|
|
|
|
def get_server_connection_interface(server):
|
|
# connect to IPA server, get all ip addresses of inteface used to connect
|
|
for res in socket.getaddrinfo(server, 389, socket.AF_UNSPEC, socket.SOCK_STREAM):
|
|
af, socktype, proto, _canonname, sa = res
|
|
try:
|
|
s = socket.socket(af, socktype, proto)
|
|
except socket.error as e:
|
|
last_error = e
|
|
s = None
|
|
continue
|
|
try:
|
|
s.connect(sa)
|
|
sockname = s.getsockname()
|
|
ip = sockname[0]
|
|
except socket.error as e:
|
|
last_error = e
|
|
continue
|
|
finally:
|
|
if s:
|
|
s.close()
|
|
try:
|
|
return get_iface_from_ip(ip)
|
|
except (CalledProcessError, RuntimeError) as e:
|
|
last_error = e
|
|
else:
|
|
msg = "Cannot get server connection interface"
|
|
if last_error:
|
|
msg += ": %s" % (last_error)
|
|
raise RuntimeError(msg)
|
|
|
|
|
|
def client_dns(server, hostname, options):
|
|
|
|
try:
|
|
verify_host_resolvable(hostname)
|
|
dns_ok = True
|
|
except errors.DNSNotARecordError:
|
|
root_logger.warning("Hostname (%s) does not have A/AAAA record.",
|
|
hostname)
|
|
dns_ok = False
|
|
except errors.DNSResolverError as ex:
|
|
root_logger.warning("DNS resolution for hostname %s failed: %s",
|
|
hostname, ex)
|
|
dns_ok = False
|
|
|
|
if (options.dns_updates or options.all_ip_addresses or options.ip_addresses
|
|
or not dns_ok):
|
|
update_dns(server, hostname, options)
|
|
|
|
|
|
def check_ip_addresses(options):
|
|
if options.ip_addresses:
|
|
for ip in options.ip_addresses:
|
|
try:
|
|
ipautil.CheckedIPAddress(ip, match_local=True)
|
|
except ValueError as e:
|
|
root_logger.error(e)
|
|
return False
|
|
return True
|
|
|
|
|
|
def update_ssh_keys(hostname, ssh_dir, create_sshfp):
|
|
if not os.path.isdir(ssh_dir):
|
|
return
|
|
|
|
pubkeys = []
|
|
for basename in os.listdir(ssh_dir):
|
|
if not basename.endswith('.pub'):
|
|
continue
|
|
filename = os.path.join(ssh_dir, basename)
|
|
|
|
try:
|
|
f = open(filename, 'r')
|
|
except IOError as e:
|
|
root_logger.warning("Failed to open '%s': %s", filename, str(e))
|
|
continue
|
|
|
|
for line in f:
|
|
line = line[:-1].lstrip()
|
|
if not line or line.startswith('#'):
|
|
continue
|
|
try:
|
|
pubkey = SSHPublicKey(line)
|
|
except (ValueError, UnicodeDecodeError):
|
|
continue
|
|
root_logger.info("Adding SSH public key from %s", filename)
|
|
pubkeys.append(pubkey)
|
|
|
|
f.close()
|
|
|
|
try:
|
|
# Use the RPC directly so older servers are supported
|
|
api.Backend.rpcclient.forward(
|
|
'host_mod',
|
|
ipautil.fsdecode(hostname),
|
|
ipasshpubkey=[pk.openssh() for pk in pubkeys],
|
|
updatedns=False,
|
|
version=u'2.26', # this version adds support for SSH public keys
|
|
)
|
|
except errors.EmptyModlist:
|
|
pass
|
|
except Exception as e:
|
|
root_logger.info("host_mod: %s", str(e))
|
|
root_logger.warning("Failed to upload host SSH public keys.")
|
|
return
|
|
|
|
if create_sshfp:
|
|
ttl = 1200
|
|
|
|
update_txt = 'debug\n'
|
|
update_txt += 'update delete %s. IN SSHFP\nshow\nsend\n' % hostname
|
|
for pubkey in pubkeys:
|
|
sshfp = pubkey.fingerprint_dns_sha1()
|
|
if sshfp is not None:
|
|
update_txt += 'update add %s. %s IN SSHFP %s\n' % (hostname, ttl, sshfp)
|
|
sshfp = pubkey.fingerprint_dns_sha256()
|
|
if sshfp is not None:
|
|
update_txt += 'update add %s. %s IN SSHFP %s\n' % (hostname, ttl, sshfp)
|
|
update_txt += 'show\nsend\n'
|
|
|
|
if not do_nsupdate(update_txt):
|
|
root_logger.warning("Could not update DNS SSHFP records.")
|
|
|
|
def print_port_conf_info():
|
|
root_logger.info(
|
|
"Please make sure the following ports are opened "
|
|
"in the firewall settings:\n"
|
|
" TCP: 80, 88, 389\n"
|
|
" UDP: 88 (at least one of TCP/UDP ports 88 has to be open)\n"
|
|
"Also note that following ports are necessary for ipa-client "
|
|
"working properly after enrollment:\n"
|
|
" TCP: 464\n"
|
|
" UDP: 464, 123 (if NTP enabled)")
|
|
|
|
def get_certs_from_ldap(server, base_dn, realm, ca_enabled):
|
|
conn = ipaldap.IPAdmin(server, sasl_nocanon=True)
|
|
try:
|
|
conn.do_sasl_gssapi_bind()
|
|
certs = certstore.get_ca_certs(conn, base_dn, realm, ca_enabled)
|
|
except errors.NotFound:
|
|
raise errors.NoCertificateError(entry=server)
|
|
except errors.NetworkError as e:
|
|
raise errors.NetworkError(uri=conn.ldap_uri, error=str(e))
|
|
except Exception as e:
|
|
raise errors.LDAPError(str(e))
|
|
finally:
|
|
conn.unbind()
|
|
|
|
return certs
|
|
|
|
def get_ca_certs_from_file(url):
|
|
'''
|
|
Get the CA cert from a user supplied file and write it into the
|
|
CACERT file.
|
|
|
|
Raises errors.NoCertificateError if unable to read cert.
|
|
Raises errors.FileError if unable to write cert.
|
|
'''
|
|
|
|
try:
|
|
parsed = urlparse(url, 'file')
|
|
except Exception:
|
|
raise errors.FileError(reason="unable to parse file url '%s'" % url)
|
|
|
|
if parsed.scheme != 'file':
|
|
raise errors.FileError(reason="url is not a file scheme '%s'" % url)
|
|
|
|
filename = parsed.path
|
|
|
|
if not os.path.exists(filename):
|
|
raise errors.FileError(reason="file '%s' does not exist" % filename)
|
|
|
|
if not os.path.isfile(filename):
|
|
raise errors.FileError(reason="file '%s' is not a file" % filename)
|
|
|
|
root_logger.debug("trying to retrieve CA cert from file %s", filename)
|
|
try:
|
|
certs = x509.load_certificate_list_from_file(filename)
|
|
except Exception:
|
|
raise errors.NoCertificateError(entry=filename)
|
|
|
|
return certs
|
|
|
|
def get_ca_certs_from_http(url, warn=True):
|
|
'''
|
|
Use HTTP to retrieve the CA cert and write it into the CACERT file.
|
|
This is insecure and should be avoided.
|
|
|
|
Raises errors.NoCertificateError if unable to retrieve and write cert.
|
|
'''
|
|
|
|
if warn:
|
|
root_logger.warning("Downloading the CA certificate via HTTP, " +
|
|
"this is INSECURE")
|
|
|
|
root_logger.debug("trying to retrieve CA cert via HTTP from %s", url)
|
|
try:
|
|
|
|
result = run([paths.BIN_CURL, "-o", "-", url], capture_output=True)
|
|
except CalledProcessError:
|
|
raise errors.NoCertificateError(entry=url)
|
|
stdout = result.output
|
|
|
|
try:
|
|
certs = x509.load_certificate_list(stdout)
|
|
except Exception:
|
|
raise errors.NoCertificateError(entry=url)
|
|
|
|
return certs
|
|
|
|
def get_ca_certs_from_ldap(server, basedn, realm):
|
|
'''
|
|
Retrieve th CA cert from the LDAP server by binding to the
|
|
server with GSSAPI using the current Kerberos credentials.
|
|
Write the retrieved cert into the CACERT file.
|
|
|
|
Raises errors.NoCertificateError if cert is not found.
|
|
Raises errors.NetworkError if LDAP connection can't be established.
|
|
Raises errors.LDAPError for any other generic LDAP error.
|
|
Raises errors.OnlyOneValueAllowed if more than one cert is found.
|
|
Raises errors.FileError if unable to write cert.
|
|
'''
|
|
|
|
root_logger.debug("trying to retrieve CA cert via LDAP from %s", server)
|
|
|
|
try:
|
|
certs = get_certs_from_ldap(server, basedn, realm, False)
|
|
except Exception as e:
|
|
root_logger.debug("get_ca_certs_from_ldap() error: %s", e)
|
|
raise
|
|
|
|
certs = [x509.load_certificate(c[0], x509.DER) for c in certs
|
|
if c[2] is not False]
|
|
|
|
return certs
|
|
|
|
def validate_new_ca_certs(existing_ca_certs, new_ca_certs, ask,
|
|
override=False):
|
|
if existing_ca_certs is None:
|
|
root_logger.info(
|
|
cert_summary("Successfully retrieved CA cert", new_ca_certs))
|
|
return
|
|
|
|
existing_ca_certs = set(existing_ca_certs)
|
|
new_ca_certs = set(new_ca_certs)
|
|
if existing_ca_certs > new_ca_certs:
|
|
root_logger.warning(
|
|
"The CA cert available from the IPA server does not match the\n"
|
|
"local certificate available at %s" % CACERT)
|
|
root_logger.warning(
|
|
cert_summary("Existing CA cert:", existing_ca_certs))
|
|
root_logger.warning(
|
|
cert_summary("Retrieved CA cert:", new_ca_certs))
|
|
if override:
|
|
root_logger.warning("Overriding existing CA cert\n")
|
|
elif not ask or not user_input(
|
|
"Do you want to replace the local certificate with the CA\n"
|
|
"certificate retrieved from the IPA server?", True):
|
|
raise errors.CertificateInvalidError(name='Retrieved CA')
|
|
else:
|
|
root_logger.debug(
|
|
"Existing CA cert and Retrieved CA cert are identical")
|
|
|
|
def get_ca_certs(fstore, options, server, basedn, realm):
|
|
'''
|
|
Examine the different options and determine a method for obtaining
|
|
the CA cert.
|
|
|
|
If successful the CA cert will have been written into CACERT.
|
|
|
|
Raises errors.NoCertificateError if not successful.
|
|
|
|
The logic for determining how to load the CA cert is as follow:
|
|
|
|
In the OTP case (not -p and -w):
|
|
|
|
1. load from user supplied cert file
|
|
2. else load from HTTP
|
|
|
|
In the 'user_auth' case ((-p and -w) or interactive):
|
|
|
|
1. load from user supplied cert file
|
|
2. load from LDAP using SASL/GSS/Krb5 auth
|
|
(provides mutual authentication, integrity and security)
|
|
3. if LDAP failed and interactive ask for permission to
|
|
use insecure HTTP (default: No)
|
|
|
|
In the unattended case:
|
|
|
|
1. load from user supplied cert file
|
|
2. load from HTTP if --force specified else fail
|
|
|
|
In all cases if HTTP is used emit warning message
|
|
'''
|
|
|
|
ca_file = CACERT + ".new"
|
|
|
|
def ldap_url():
|
|
return urlunparse(('ldap', ipautil.format_netloc(server),
|
|
'', '', '', ''))
|
|
|
|
def file_url():
|
|
return urlunparse(('file', '', options.ca_cert_file,
|
|
'', '', ''))
|
|
|
|
def http_url():
|
|
return urlunparse(('http', ipautil.format_netloc(server),
|
|
'/ipa/config/ca.crt', '', '', ''))
|
|
|
|
|
|
interactive = not options.unattended
|
|
otp_auth = options.principal is None and options.password is not None
|
|
existing_ca_certs = None
|
|
ca_certs = None
|
|
|
|
if options.ca_cert_file:
|
|
url = file_url()
|
|
try:
|
|
ca_certs = get_ca_certs_from_file(url)
|
|
except errors.FileError as e:
|
|
root_logger.debug(e)
|
|
raise
|
|
except Exception as e:
|
|
root_logger.debug(e)
|
|
raise errors.NoCertificateError(entry=url)
|
|
root_logger.debug("CA cert provided by user, use it!")
|
|
else:
|
|
if os.path.exists(CACERT):
|
|
if os.path.isfile(CACERT):
|
|
try:
|
|
existing_ca_certs = x509.load_certificate_list_from_file(
|
|
CACERT)
|
|
except Exception as e:
|
|
raise errors.FileError(reason=u"Unable to load existing" +
|
|
" CA cert '%s': %s" % (CACERT, e))
|
|
else:
|
|
raise errors.FileError(reason=u"Existing ca cert '%s' is " +
|
|
"not a plain file" % (CACERT))
|
|
|
|
if otp_auth:
|
|
if existing_ca_certs:
|
|
root_logger.info("OTP case, CA cert preexisted, use it")
|
|
else:
|
|
url = http_url()
|
|
override = not interactive
|
|
if interactive and not user_input(
|
|
"Do you want to download the CA cert from " + url + " ?\n"
|
|
"(this is INSECURE)", False):
|
|
raise errors.NoCertificateError(message=u"HTTP certificate"
|
|
" download declined by user")
|
|
try:
|
|
ca_certs = get_ca_certs_from_http(url, override)
|
|
except Exception as e:
|
|
root_logger.debug(e)
|
|
raise errors.NoCertificateError(entry=url)
|
|
|
|
validate_new_ca_certs(existing_ca_certs, ca_certs, False,
|
|
override)
|
|
else:
|
|
# Auth with user credentials
|
|
try:
|
|
url = ldap_url()
|
|
ca_certs = get_ca_certs_from_ldap(server, basedn, realm)
|
|
validate_new_ca_certs(existing_ca_certs, ca_certs, interactive)
|
|
except errors.FileError as e:
|
|
root_logger.debug(e)
|
|
raise
|
|
except (errors.NoCertificateError, errors.LDAPError) as e:
|
|
root_logger.debug(str(e))
|
|
url = http_url()
|
|
if existing_ca_certs:
|
|
root_logger.warning(
|
|
"Unable to download CA cert from LDAP\n"
|
|
"but found preexisting cert, using it.\n")
|
|
elif interactive and not user_input(
|
|
"Unable to download CA cert from LDAP.\n"
|
|
"Do you want to download the CA cert from " + url + "?\n"
|
|
"(this is INSECURE)", False):
|
|
raise errors.NoCertificateError(message=u"HTTP "
|
|
"certificate download declined by user")
|
|
elif not interactive and not options.force:
|
|
root_logger.error(
|
|
"In unattended mode without a One Time Password "
|
|
"(OTP) or without --ca-cert-file\nYou must specify"
|
|
" --force to retrieve the CA cert using HTTP")
|
|
raise errors.NoCertificateError(message=u"HTTP "
|
|
"certificate download requires --force")
|
|
else:
|
|
try:
|
|
ca_certs = get_ca_certs_from_http(url)
|
|
except Exception as e:
|
|
root_logger.debug(e)
|
|
raise errors.NoCertificateError(entry=url)
|
|
validate_new_ca_certs(existing_ca_certs, ca_certs,
|
|
interactive)
|
|
except Exception as e:
|
|
root_logger.debug(str(e))
|
|
raise errors.NoCertificateError(entry=url)
|
|
|
|
if ca_certs is None and existing_ca_certs is None:
|
|
raise errors.InternalError(u"expected CA cert file '%s' to "
|
|
u"exist, but it's absent" % (ca_file))
|
|
|
|
if ca_certs is not None:
|
|
try:
|
|
ca_certs = [cert.der_data for cert in ca_certs]
|
|
x509.write_certificate_list(ca_certs, ca_file)
|
|
except Exception as e:
|
|
if os.path.exists(ca_file):
|
|
try:
|
|
os.unlink(ca_file)
|
|
except OSError as e:
|
|
root_logger.error(
|
|
"Failed to remove '%s': %s", ca_file, e)
|
|
raise errors.FileError(reason =
|
|
u"cannot write certificate file '%s': %s" % (ca_file, e))
|
|
|
|
os.rename(ca_file, CACERT)
|
|
|
|
# Make sure the file permissions are correct
|
|
try:
|
|
os.chmod(CACERT, 0o644)
|
|
except Exception as e:
|
|
raise errors.FileError(reason=u"Unable set permissions on ca "
|
|
u"cert '%s': %s" % (CACERT, e))
|
|
|
|
#IMPORTANT First line of FF config file is ignored
|
|
FIREFOX_CONFIG_TEMPLATE = """
|
|
|
|
/* Kerberos SSO configuration */
|
|
pref("network.negotiate-auth.trusted-uris", ".$DOMAIN");
|
|
|
|
/* These are the defaults */
|
|
pref("network.negotiate-auth.gsslib", "");
|
|
pref("network.negotiate-auth.using-native-gsslib", true);
|
|
pref("network.negotiate-auth.allow-proxies", true);
|
|
"""
|
|
|
|
FIREFOX_PREFERENCES_FILENAME = "all-ipa.js"
|
|
FIREFOX_PREFERENCES_REL_PATH = "browser/defaults/preferences"
|
|
|
|
def configure_firefox(options, statestore, domain):
|
|
try:
|
|
root_logger.debug("Setting up Firefox configuration.")
|
|
|
|
preferences_dir = None
|
|
|
|
# Check user specified location of firefox install directory
|
|
if options.firefox_dir is not None:
|
|
pref_path = os.path.join(options.firefox_dir,
|
|
FIREFOX_PREFERENCES_REL_PATH)
|
|
if dir_exists(pref_path):
|
|
preferences_dir = pref_path
|
|
else:
|
|
root_logger.error("Directory '%s' does not exists." % pref_path)
|
|
else:
|
|
# test if firefox is installed
|
|
if file_exists(paths.FIREFOX):
|
|
|
|
# find valid preferences path
|
|
for path in [paths.LIB_FIREFOX, paths.LIB64_FIREFOX]:
|
|
pref_path = os.path.join(path,
|
|
FIREFOX_PREFERENCES_REL_PATH)
|
|
if dir_exists(pref_path):
|
|
preferences_dir = pref_path
|
|
break
|
|
else:
|
|
root_logger.error("Firefox configuration skipped (Firefox not found).")
|
|
return
|
|
|
|
# setting up firefox
|
|
if preferences_dir is not None:
|
|
|
|
# user could specify relative path, we need to store absolute
|
|
preferences_dir = os.path.abspath(preferences_dir)
|
|
root_logger.debug("Firefox preferences directory found '%s'." % preferences_dir)
|
|
preferences_fname = os.path.join(preferences_dir, FIREFOX_PREFERENCES_FILENAME)
|
|
update_txt = ipautil.template_str(FIREFOX_CONFIG_TEMPLATE, dict(DOMAIN=domain))
|
|
root_logger.debug("Firefox trusted uris will be set as '.%s' domain." % domain)
|
|
root_logger.debug("Firefox configuration will be stored in '%s' file." % preferences_fname)
|
|
|
|
try:
|
|
with open(preferences_fname, 'w') as f:
|
|
f.write(update_txt)
|
|
root_logger.info("Firefox sucessfully configured.")
|
|
statestore.backup_state('firefox', 'preferences_fname', preferences_fname)
|
|
except Exception as e:
|
|
root_logger.debug("An error occured during creating preferences file: %s." % str(e))
|
|
root_logger.error("Firefox configuration failed.")
|
|
else:
|
|
root_logger.debug("Firefox preferences directory not found.")
|
|
root_logger.error("Firefox configuration failed.")
|
|
|
|
except Exception as e:
|
|
root_logger.debug(str(e))
|
|
root_logger.error("Firefox configuration failed.")
|
|
|
|
|
|
def install(options, env, fstore, statestore):
|
|
dnsok = False
|
|
|
|
cli_domain = None
|
|
cli_server = None
|
|
subject_base = None
|
|
|
|
cli_domain_source = 'Unknown source'
|
|
cli_server_source = 'Unknown source'
|
|
|
|
if options.conf_ntp and not options.on_master and not options.force_ntpd:
|
|
try:
|
|
ipaclient.ntpconf.check_timedate_services()
|
|
except ipaclient.ntpconf.NTPConflictingService as e:
|
|
print("WARNING: ntpd time&date synchronization service will not" \
|
|
" be configured as")
|
|
print("conflicting service (%s) is enabled" % e.conflicting_service)
|
|
print("Use --force-ntpd option to disable it and force configuration" \
|
|
" of ntpd")
|
|
print("")
|
|
|
|
# configuration of ntpd is disabled in this case
|
|
options.conf_ntp = False
|
|
except ipaclient.ntpconf.NTPConfigurationError:
|
|
pass
|
|
|
|
if options.unattended and (options.password is None and
|
|
options.principal is None and
|
|
options.keytab is None and
|
|
options.prompt_password is False and
|
|
not options.on_master):
|
|
root_logger.error("One of password / principal / keytab is required.")
|
|
return CLIENT_INSTALL_ERROR
|
|
|
|
if options.hostname:
|
|
hostname = options.hostname
|
|
hostname_source = 'Provided as option'
|
|
else:
|
|
hostname = socket.getfqdn()
|
|
hostname_source = "Machine's FQDN"
|
|
if hostname != hostname.lower():
|
|
root_logger.error(
|
|
"Invalid hostname '%s', must be lower-case.", hostname)
|
|
return CLIENT_INSTALL_ERROR
|
|
if (hostname == 'localhost') or (hostname == 'localhost.localdomain'):
|
|
root_logger.error("Invalid hostname, '%s' must not be used.", hostname)
|
|
return CLIENT_INSTALL_ERROR
|
|
|
|
# when installing with '--no-sssd' option, check whether nss-ldap is installed
|
|
if not options.sssd:
|
|
if not os.path.exists(paths.PAM_KRB5_SO):
|
|
root_logger.error("The pam_krb5 package must be installed")
|
|
return CLIENT_INSTALL_ERROR
|
|
|
|
(nssldap_installed, nosssd_files) = nssldap_exists()
|
|
if not nssldap_installed:
|
|
root_logger.error("One of these packages must be installed: " +
|
|
"nss_ldap or nss-pam-ldapd")
|
|
return CLIENT_INSTALL_ERROR
|
|
|
|
if options.keytab and options.principal:
|
|
root_logger.error("Options 'principal' and 'keytab' cannot be used "
|
|
"together.")
|
|
return CLIENT_INSTALL_ERROR
|
|
|
|
if options.keytab and options.force_join:
|
|
root_logger.warning("Option 'force-join' has no additional effect "
|
|
"when used with together with option 'keytab'.")
|
|
|
|
# Check if old certificate exist and show warning
|
|
if not options.ca_cert_file and get_cert_path(options.ca_cert_file) == CACERT:
|
|
root_logger.warning("Using existing certificate '%s'.", CACERT)
|
|
|
|
if not check_ip_addresses(options):
|
|
return CLIENT_INSTALL_ERROR
|
|
|
|
# Create the discovery instance
|
|
ds = ipadiscovery.IPADiscovery()
|
|
|
|
ret = ds.search(domain=options.domain, servers=options.server, realm=options.realm_name, hostname=hostname, ca_cert_path=get_cert_path(options.ca_cert_file))
|
|
|
|
if options.server and ret != 0:
|
|
# There is no point to continue with installation as server list was
|
|
# passed as a fixed list of server and thus we cannot discover any
|
|
# better result
|
|
root_logger.error("Failed to verify that %s is an IPA Server.",
|
|
', '.join(options.server))
|
|
root_logger.error("This may mean that the remote server is not up "
|
|
"or is not reachable due to network or firewall settings.")
|
|
print_port_conf_info()
|
|
return CLIENT_INSTALL_ERROR
|
|
|
|
if ret == ipadiscovery.BAD_HOST_CONFIG:
|
|
root_logger.error("Can't get the fully qualified name of this host")
|
|
root_logger.info("Check that the client is properly configured")
|
|
return CLIENT_INSTALL_ERROR
|
|
if ret == ipadiscovery.NOT_FQDN:
|
|
root_logger.error("%s is not a fully-qualified hostname", hostname)
|
|
return CLIENT_INSTALL_ERROR
|
|
if ret in (ipadiscovery.NO_LDAP_SERVER, ipadiscovery.NOT_IPA_SERVER) \
|
|
or not ds.domain:
|
|
if ret == ipadiscovery.NO_LDAP_SERVER:
|
|
if ds.server:
|
|
root_logger.debug("%s is not an LDAP server" % ds.server)
|
|
else:
|
|
root_logger.debug("No LDAP server found")
|
|
elif ret == ipadiscovery.NOT_IPA_SERVER:
|
|
if ds.server:
|
|
root_logger.debug("%s is not an IPA server" % ds.server)
|
|
else:
|
|
root_logger.debug("No IPA server found")
|
|
else:
|
|
root_logger.debug("Domain not found")
|
|
if options.domain:
|
|
cli_domain = options.domain
|
|
cli_domain_source = 'Provided as option'
|
|
elif options.unattended:
|
|
root_logger.error(
|
|
"Unable to discover domain, not provided on command line")
|
|
return CLIENT_INSTALL_ERROR
|
|
else:
|
|
root_logger.info(
|
|
"DNS discovery failed to determine your DNS domain")
|
|
cli_domain = user_input("Provide the domain name of your IPA server (ex: example.com)", allow_empty = False)
|
|
cli_domain_source = 'Provided interactively'
|
|
root_logger.debug(
|
|
"will use interactively provided domain: %s", cli_domain)
|
|
ret = ds.search(domain=cli_domain, servers=options.server, hostname=hostname, ca_cert_path=get_cert_path(options.ca_cert_file))
|
|
|
|
if not cli_domain:
|
|
if ds.domain:
|
|
cli_domain = ds.domain
|
|
cli_domain_source = ds.domain_source
|
|
root_logger.debug("will use discovered domain: %s", cli_domain)
|
|
|
|
client_domain = hostname[hostname.find(".")+1:]
|
|
|
|
if ret in (ipadiscovery.NO_LDAP_SERVER, ipadiscovery.NOT_IPA_SERVER) \
|
|
or not ds.server:
|
|
root_logger.debug("IPA Server not found")
|
|
if options.server:
|
|
cli_server = options.server
|
|
cli_server_source = 'Provided as option'
|
|
elif options.unattended:
|
|
root_logger.error("Unable to find IPA Server to join")
|
|
return CLIENT_INSTALL_ERROR
|
|
else:
|
|
root_logger.debug("DNS discovery failed to find the IPA Server")
|
|
cli_server = [user_input("Provide your IPA server name (ex: ipa.example.com)", allow_empty = False)]
|
|
cli_server_source = 'Provided interactively'
|
|
root_logger.debug("will use interactively provided server: %s", cli_server[0])
|
|
ret = ds.search(domain=cli_domain, servers=cli_server, hostname=hostname, ca_cert_path=get_cert_path(options.ca_cert_file))
|
|
|
|
else:
|
|
# Only set dnsok to True if we were not passed in one or more servers
|
|
# and if DNS discovery actually worked.
|
|
if not options.server:
|
|
(server, domain) = ds.check_domain(ds.domain, set(), "Validating DNS Discovery")
|
|
if server and domain:
|
|
root_logger.debug("DNS validated, enabling discovery")
|
|
dnsok = True
|
|
else:
|
|
root_logger.debug("DNS discovery failed, disabling discovery")
|
|
else:
|
|
root_logger.debug("Using servers from command line, disabling DNS discovery")
|
|
|
|
if not cli_server:
|
|
if options.server:
|
|
cli_server = ds.servers
|
|
cli_server_source = 'Provided as option'
|
|
root_logger.debug("will use provided server: %s", ', '.join(options.server))
|
|
elif ds.server:
|
|
cli_server = ds.servers
|
|
cli_server_source = ds.server_source
|
|
root_logger.debug("will use discovered server: %s", cli_server[0])
|
|
|
|
if ret == ipadiscovery.NOT_IPA_SERVER:
|
|
root_logger.error("%s is not an IPA v2 Server.", cli_server[0])
|
|
print_port_conf_info()
|
|
root_logger.debug("(%s: %s)", cli_server[0], cli_server_source)
|
|
return CLIENT_INSTALL_ERROR
|
|
|
|
if ret == ipadiscovery.NO_ACCESS_TO_LDAP:
|
|
root_logger.warning("Anonymous access to the LDAP server is disabled.")
|
|
root_logger.info("Proceeding without strict verification.")
|
|
root_logger.info("Note: This is not an error if anonymous access " +
|
|
"has been explicitly restricted.")
|
|
ret = 0
|
|
|
|
if ret == ipadiscovery.NO_TLS_LDAP:
|
|
root_logger.warning("The LDAP server requires TLS is but we do not " +
|
|
"have the CA.")
|
|
root_logger.info("Proceeding without strict verification.")
|
|
ret = 0
|
|
|
|
if ret != 0:
|
|
root_logger.error("Failed to verify that %s is an IPA Server.",
|
|
cli_server[0])
|
|
root_logger.error("This may mean that the remote server is not up "
|
|
"or is not reachable due to network or firewall settings.")
|
|
print_port_conf_info()
|
|
root_logger.debug("(%s: %s)", cli_server[0], cli_server_source)
|
|
return CLIENT_INSTALL_ERROR
|
|
|
|
cli_kdc = ds.kdc
|
|
if dnsok and not cli_kdc:
|
|
root_logger.error("DNS domain '%s' is not configured for automatic " +
|
|
"KDC address lookup.", ds.realm.lower())
|
|
root_logger.debug("(%s: %s)", ds.realm, ds.realm_source)
|
|
root_logger.error("KDC address will be set to fixed value.")
|
|
|
|
if dnsok:
|
|
root_logger.info("Discovery was successful!")
|
|
elif not options.unattended:
|
|
if not options.server:
|
|
root_logger.warning("The failure to use DNS to find your IPA" +
|
|
" server indicates that your resolv.conf file is not properly" +
|
|
" configured.")
|
|
root_logger.info("Autodiscovery of servers for failover cannot work " +
|
|
"with this configuration.")
|
|
root_logger.info("If you proceed with the installation, services " +
|
|
"will be configured to always access the discovered server for " +
|
|
"all operations and will not fail over to other servers in case " +
|
|
"of failure.")
|
|
if not user_input("Proceed with fixed values and no DNS discovery?", False):
|
|
return CLIENT_INSTALL_ERROR
|
|
|
|
cli_realm = ds.realm
|
|
cli_realm_source = ds.realm_source
|
|
root_logger.debug("will use discovered realm: %s", cli_realm)
|
|
|
|
if options.realm_name and options.realm_name != cli_realm:
|
|
root_logger.error(
|
|
"The provided realm name [%s] does not match discovered one [%s]",
|
|
options.realm_name, cli_realm)
|
|
root_logger.debug("(%s: %s)", cli_realm, cli_realm_source)
|
|
return CLIENT_INSTALL_ERROR
|
|
|
|
cli_basedn = ds.basedn
|
|
cli_basedn_source = ds.basedn_source
|
|
root_logger.debug("will use discovered basedn: %s", cli_basedn)
|
|
subject_base = DN(('O', cli_realm))
|
|
|
|
root_logger.info("Client hostname: %s", hostname)
|
|
root_logger.debug("Hostname source: %s", hostname_source)
|
|
root_logger.info("Realm: %s", cli_realm)
|
|
root_logger.debug("Realm source: %s", cli_realm_source)
|
|
root_logger.info("DNS Domain: %s", cli_domain)
|
|
root_logger.debug("DNS Domain source: %s", cli_domain_source)
|
|
root_logger.info("IPA Server: %s", ', '.join(cli_server))
|
|
root_logger.debug("IPA Server source: %s", cli_server_source)
|
|
root_logger.info("BaseDN: %s", cli_basedn)
|
|
root_logger.debug("BaseDN source: %s", cli_basedn_source)
|
|
|
|
# ipa-join would fail with IP address instead of a FQDN
|
|
for srv in cli_server:
|
|
try:
|
|
socket.inet_pton(socket.AF_INET, srv)
|
|
is_ipaddr = True
|
|
except socket.error:
|
|
try:
|
|
socket.inet_pton(socket.AF_INET6, srv)
|
|
is_ipaddr = True
|
|
except socket.error:
|
|
is_ipaddr = False
|
|
|
|
if is_ipaddr:
|
|
print()
|
|
root_logger.warning("It seems that you are using an IP address "
|
|
"instead of FQDN as an argument to --server. The "
|
|
"installation may fail.")
|
|
break
|
|
|
|
print()
|
|
if not options.unattended and not user_input("Continue to configure the system with these values?", False):
|
|
return CLIENT_INSTALL_ERROR
|
|
|
|
if not options.on_master:
|
|
# Try removing old principals from the keytab
|
|
try:
|
|
ipautil.run([paths.IPA_RMKEYTAB,
|
|
'-k', paths.KRB5_KEYTAB, '-r', cli_realm])
|
|
except CalledProcessError as e:
|
|
if e.returncode not in (3, 5):
|
|
# 3 - Unable to open keytab
|
|
# 5 - Principal name or realm not found in keytab
|
|
root_logger.error("Error trying to clean keytab: " +
|
|
"/usr/sbin/ipa-rmkeytab returned %s" % e.returncode)
|
|
else:
|
|
root_logger.info("Removed old keys for realm %s from %s" % (
|
|
cli_realm, paths.KRB5_KEYTAB))
|
|
|
|
if options.hostname and not options.on_master:
|
|
# skip this step when run by ipa-server-install as it always configures
|
|
# hostname
|
|
tasks.backup_hostname(fstore, statestore)
|
|
tasks.set_hostname(options.hostname)
|
|
|
|
ntp_srv_servers = []
|
|
if not options.on_master and options.conf_ntp:
|
|
# Attempt to sync time with IPA server.
|
|
# If we're skipping NTP configuration, we also skip the time sync here.
|
|
# We assume that NTP servers are discoverable through SRV records in the DNS
|
|
# If that fails, we try to sync directly with IPA server, assuming it runs NTP
|
|
root_logger.info('Synchronizing time with KDC...')
|
|
ntp_srv_servers = ds.ipadns_search_srv(cli_domain, '_ntp._udp',
|
|
None, break_on_first=False)
|
|
synced_ntp = False
|
|
ntp_servers = ntp_srv_servers
|
|
|
|
# use user specified NTP servers if there are any
|
|
if options.ntp_servers:
|
|
ntp_servers = options.ntp_servers
|
|
|
|
for s in ntp_servers:
|
|
synced_ntp = ipaclient.ntpconf.synconce_ntp(s, options.debug)
|
|
if synced_ntp:
|
|
break
|
|
|
|
if not synced_ntp and not options.ntp_servers:
|
|
synced_ntp = ipaclient.ntpconf.synconce_ntp(cli_server[0],
|
|
options.debug)
|
|
if not synced_ntp:
|
|
root_logger.warning("Unable to sync time with NTP " +
|
|
"server, assuming the time is in sync. Please check " +
|
|
"that 123 UDP port is opened.")
|
|
else:
|
|
root_logger.info('Skipping synchronizing time with NTP server.')
|
|
|
|
if not options.unattended:
|
|
if (options.principal is None and options.password is None and
|
|
options.prompt_password is False and options.keytab is None):
|
|
options.principal = user_input("User authorized to enroll "
|
|
"computers", allow_empty=False)
|
|
root_logger.debug(
|
|
"will use principal provided as option: %s", options.principal)
|
|
|
|
host_principal = 'host/%s@%s' % (hostname, cli_realm)
|
|
if not options.on_master:
|
|
nolog = tuple()
|
|
# First test out the kerberos configuration
|
|
try:
|
|
(krb_fd, krb_name) = tempfile.mkstemp()
|
|
os.close(krb_fd)
|
|
if configure_krb5_conf(
|
|
cli_realm=cli_realm,
|
|
cli_domain=cli_domain,
|
|
cli_server=cli_server,
|
|
cli_kdc=cli_kdc,
|
|
dnsok=False,
|
|
options=options,
|
|
filename=krb_name,
|
|
client_domain=client_domain,
|
|
client_hostname=hostname):
|
|
root_logger.error("Test kerberos configuration failed")
|
|
return CLIENT_INSTALL_ERROR
|
|
env['KRB5_CONFIG'] = krb_name
|
|
ccache_dir = tempfile.mkdtemp(prefix='krbcc')
|
|
ccache_name = os.path.join(ccache_dir, 'ccache')
|
|
join_args = [paths.SBIN_IPA_JOIN,
|
|
"-s", cli_server[0],
|
|
"-b", str(realm_to_suffix(cli_realm)),
|
|
"-h", hostname]
|
|
if options.debug:
|
|
join_args.append("-d")
|
|
env['XMLRPC_TRACE_CURL'] = 'yes'
|
|
if options.force_join:
|
|
join_args.append("-f")
|
|
if options.principal is not None:
|
|
stdin = None
|
|
principal = options.principal
|
|
if principal.find('@') == -1:
|
|
principal = '%s@%s' % (principal, cli_realm)
|
|
if options.password is not None:
|
|
stdin = options.password
|
|
else:
|
|
if not options.unattended:
|
|
try:
|
|
stdin = getpass.getpass("Password for %s: " % principal)
|
|
except EOFError:
|
|
stdin = None
|
|
if not stdin:
|
|
root_logger.error(
|
|
"Password must be provided for %s.", principal)
|
|
return CLIENT_INSTALL_ERROR
|
|
else:
|
|
if sys.stdin.isatty():
|
|
root_logger.error("Password must be provided in " +
|
|
"non-interactive mode.")
|
|
root_logger.info("This can be done via " +
|
|
"echo password | ipa-client-install ... " +
|
|
"or with the -w option.")
|
|
return CLIENT_INSTALL_ERROR
|
|
else:
|
|
stdin = sys.stdin.readline()
|
|
|
|
try:
|
|
ipautil.kinit_password(principal, stdin, ccache_name,
|
|
config=krb_name)
|
|
except RuntimeError as e:
|
|
print_port_conf_info()
|
|
root_logger.error("Kerberos authentication failed: %s" % e)
|
|
return CLIENT_INSTALL_ERROR
|
|
elif options.keytab:
|
|
join_args.append("-f")
|
|
if os.path.exists(options.keytab):
|
|
try:
|
|
ipautil.kinit_keytab(host_principal, options.keytab,
|
|
ccache_name,
|
|
config=krb_name,
|
|
attempts=options.kinit_attempts)
|
|
except gssapi.exceptions.GSSError as e:
|
|
print_port_conf_info()
|
|
root_logger.error("Kerberos authentication failed: %s"
|
|
% e)
|
|
return CLIENT_INSTALL_ERROR
|
|
else:
|
|
root_logger.error("Keytab file could not be found: %s"
|
|
% options.keytab)
|
|
return CLIENT_INSTALL_ERROR
|
|
elif options.password:
|
|
nolog = (options.password,)
|
|
join_args.append("-w")
|
|
join_args.append(options.password)
|
|
elif options.prompt_password:
|
|
if options.unattended:
|
|
root_logger.error(
|
|
"Password must be provided in non-interactive mode")
|
|
return CLIENT_INSTALL_ERROR
|
|
try:
|
|
password = getpass.getpass("Password: ")
|
|
except EOFError:
|
|
password = None
|
|
if not password:
|
|
root_logger.error("Password must be provided.")
|
|
return CLIENT_INSTALL_ERROR
|
|
join_args.append("-w")
|
|
join_args.append(password)
|
|
nolog = (password,)
|
|
|
|
env['KRB5CCNAME'] = os.environ['KRB5CCNAME'] = ccache_name
|
|
# Get the CA certificate
|
|
try:
|
|
os.environ['KRB5_CONFIG'] = env['KRB5_CONFIG']
|
|
get_ca_certs(fstore, options, cli_server[0], cli_basedn,
|
|
cli_realm)
|
|
del os.environ['KRB5_CONFIG']
|
|
except errors.FileError as e:
|
|
root_logger.error(e)
|
|
return CLIENT_INSTALL_ERROR
|
|
except Exception as e:
|
|
root_logger.error("Cannot obtain CA certificate\n%s", e)
|
|
return CLIENT_INSTALL_ERROR
|
|
|
|
# Now join the domain
|
|
result = run(
|
|
join_args, raiseonerr=False, env=env, nolog=nolog,
|
|
capture_error=True)
|
|
stderr = result.error_output
|
|
|
|
if result.returncode != 0:
|
|
root_logger.error("Joining realm failed: %s", stderr)
|
|
if not options.force:
|
|
if result.returncode == 13:
|
|
root_logger.info("Use --force-join option to override "
|
|
"the host entry on the server "
|
|
"and force client enrollment.")
|
|
return CLIENT_INSTALL_ERROR
|
|
root_logger.info("Use ipa-getkeytab to obtain a host " +
|
|
"principal for this server.")
|
|
else:
|
|
root_logger.info("Enrolled in IPA realm %s", cli_realm)
|
|
|
|
start = stderr.find('Certificate subject base is: ')
|
|
if start >= 0:
|
|
start = start + 29
|
|
subject_base = stderr[start:]
|
|
subject_base = subject_base.strip()
|
|
subject_base = DN(subject_base)
|
|
|
|
if options.principal is not None:
|
|
run(["kdestroy"], raiseonerr=False, env=env)
|
|
|
|
# Obtain the TGT. We do it with the temporary krb5.conf, so that
|
|
# only the KDC we're installing under is contacted.
|
|
# Other KDCs might not have replicated the principal yet.
|
|
# Once we have the TGT, it's usable on any server.
|
|
try:
|
|
ipautil.kinit_keytab(host_principal, paths.KRB5_KEYTAB,
|
|
CCACHE_FILE,
|
|
config=krb_name,
|
|
attempts=options.kinit_attempts)
|
|
env['KRB5CCNAME'] = os.environ['KRB5CCNAME'] = CCACHE_FILE
|
|
except gssapi.exceptions.GSSError as e:
|
|
print_port_conf_info()
|
|
root_logger.error("Failed to obtain host TGT: %s" % e)
|
|
# failure to get ticket makes it impossible to login and bind
|
|
# from sssd to LDAP, abort installation and rollback changes
|
|
return CLIENT_INSTALL_ERROR
|
|
|
|
finally:
|
|
try:
|
|
os.remove(krb_name)
|
|
except OSError:
|
|
root_logger.error("Could not remove %s", krb_name)
|
|
try:
|
|
os.rmdir(ccache_dir)
|
|
except OSError:
|
|
pass
|
|
try:
|
|
os.remove(krb_name + ".ipabkp")
|
|
except OSError:
|
|
root_logger.error("Could not remove %s.ipabkp", krb_name)
|
|
|
|
# Configure ipa.conf
|
|
if not options.on_master:
|
|
configure_ipa_conf(fstore, cli_basedn, cli_realm, cli_domain,
|
|
cli_server, hostname)
|
|
root_logger.info("Created /etc/ipa/default.conf")
|
|
|
|
with certdb.NSSDatabase() as tmp_db:
|
|
api.bootstrap(context='cli_installer',
|
|
debug=options.debug,
|
|
delegate=False,
|
|
nss_dir=tmp_db.secdir)
|
|
if 'config_loaded' not in api.env:
|
|
root_logger.error("Failed to initialize IPA API.")
|
|
return CLIENT_INSTALL_ERROR
|
|
|
|
# Always back up sssd.conf. It gets updated by authconfig --enablekrb5.
|
|
fstore.backup_file(paths.SSSD_CONF)
|
|
if options.sssd:
|
|
if configure_sssd_conf(fstore, cli_realm, cli_domain, cli_server,
|
|
options, client_domain, hostname):
|
|
return CLIENT_INSTALL_ERROR
|
|
root_logger.info("Configured /etc/sssd/sssd.conf")
|
|
|
|
if options.on_master:
|
|
# If on master assume kerberos is already configured properly.
|
|
# Get the host TGT.
|
|
try:
|
|
ipautil.kinit_keytab(host_principal, paths.KRB5_KEYTAB,
|
|
CCACHE_FILE,
|
|
attempts=options.kinit_attempts)
|
|
os.environ['KRB5CCNAME'] = CCACHE_FILE
|
|
except gssapi.exceptions.GSSError as e:
|
|
root_logger.error("Failed to obtain host TGT: %s" % e)
|
|
return CLIENT_INSTALL_ERROR
|
|
else:
|
|
# Configure krb5.conf
|
|
fstore.backup_file(paths.KRB5_CONF)
|
|
if configure_krb5_conf(
|
|
cli_realm=cli_realm,
|
|
cli_domain=cli_domain,
|
|
cli_server=cli_server,
|
|
cli_kdc=cli_kdc,
|
|
dnsok=dnsok,
|
|
options=options,
|
|
filename=paths.KRB5_CONF,
|
|
client_domain=client_domain,
|
|
client_hostname=hostname):
|
|
return CLIENT_INSTALL_ERROR
|
|
|
|
root_logger.info(
|
|
"Configured /etc/krb5.conf for IPA realm %s", cli_realm)
|
|
|
|
# Clear out any current session keyring information
|
|
try:
|
|
delete_persistent_client_session_data(host_principal)
|
|
except ValueError:
|
|
pass
|
|
|
|
# Add CA certs to a temporary NSS database
|
|
ca_certs = x509.load_certificate_list_from_file(CACERT)
|
|
ca_certs = [cert.der_data for cert in ca_certs]
|
|
try:
|
|
pwd_file = ipautil.write_tmp_file(ipautil.ipa_generate_password())
|
|
tmp_db.create_db(pwd_file.name)
|
|
|
|
for i, cert in enumerate(ca_certs):
|
|
tmp_db.add_cert(cert, 'CA certificate %d' % (i + 1), 'C,,')
|
|
except CalledProcessError as e:
|
|
root_logger.info("Failed to add CA to temporary NSS database.")
|
|
return CLIENT_INSTALL_ERROR
|
|
|
|
api.finalize()
|
|
|
|
# Now, let's try to connect to the server's RPC interface
|
|
connected = False
|
|
try:
|
|
api.Backend.rpcclient.connect()
|
|
connected = True
|
|
root_logger.debug("Try RPC connection")
|
|
api.Backend.rpcclient.forward('ping')
|
|
except errors.KerberosError as e:
|
|
if connected:
|
|
api.Backend.rpcclient.disconnect()
|
|
root_logger.info(
|
|
"Cannot connect to the server due to Kerberos error: %s. "
|
|
"Trying with delegate=True", e)
|
|
try:
|
|
api.Backend.rpcclient.connect(delegate=True)
|
|
root_logger.debug("Try RPC connection")
|
|
api.Backend.rpcclient.forward('ping')
|
|
|
|
root_logger.info("Connection with delegate=True successful")
|
|
|
|
# The remote server is not capable of Kerberos S4U2Proxy
|
|
# delegation. This features is implemented in IPA server
|
|
# version 2.2 and higher
|
|
root_logger.warning(
|
|
"Target IPA server has a lower version than the enrolled "
|
|
"client")
|
|
root_logger.warning(
|
|
"Some capabilities including the ipa command capability "
|
|
"may not be available")
|
|
except errors.PublicError as e2:
|
|
root_logger.warning(
|
|
"Second connect with delegate=True also failed: %s", e2)
|
|
root_logger.error(
|
|
"Cannot connect to the IPA server RPC interface: %s", e2)
|
|
return CLIENT_INSTALL_ERROR
|
|
except errors.PublicError as e:
|
|
root_logger.error(
|
|
"Cannot connect to the server due to generic error: %s", e)
|
|
return CLIENT_INSTALL_ERROR
|
|
|
|
# Use the RPC directly so older servers are supported
|
|
try:
|
|
result = api.Backend.rpcclient.forward(
|
|
'ca_is_enabled',
|
|
version=u'2.107',
|
|
)
|
|
ca_enabled = result['result']
|
|
except (errors.CommandError, errors.NetworkError):
|
|
result = api.Backend.rpcclient.forward(
|
|
'env',
|
|
server=True,
|
|
version=u'2.0',
|
|
)
|
|
ca_enabled = result['result']['enable_ra']
|
|
if not ca_enabled:
|
|
disable_ra()
|
|
|
|
# Create IPA NSS database
|
|
try:
|
|
certdb.create_ipa_nssdb()
|
|
except ipautil.CalledProcessError as e:
|
|
root_logger.error("Failed to create IPA NSS database: %s", e)
|
|
return CLIENT_INSTALL_ERROR
|
|
|
|
# Get CA certificates from the certificate store
|
|
try:
|
|
ca_certs = get_certs_from_ldap(cli_server[0], cli_basedn, cli_realm,
|
|
ca_enabled)
|
|
except errors.NoCertificateError:
|
|
if ca_enabled:
|
|
ca_subject = DN(('CN', 'Certificate Authority'), subject_base)
|
|
else:
|
|
ca_subject = None
|
|
ca_certs = certstore.make_compat_ca_certs(ca_certs, cli_realm,
|
|
ca_subject)
|
|
ca_certs_trust = [(c, n, certstore.key_policy_to_trust_flags(t, True, u))
|
|
for (c, n, t, u) in ca_certs]
|
|
|
|
# Add the CA certificates to the IPA NSS database
|
|
root_logger.debug("Adding CA certificates to the IPA NSS database.")
|
|
ipa_db = certdb.NSSDatabase(paths.IPA_NSSDB_DIR)
|
|
for cert, nickname, trust_flags in ca_certs_trust:
|
|
try:
|
|
ipa_db.add_cert(cert, nickname, trust_flags)
|
|
except CalledProcessError as e:
|
|
root_logger.error(
|
|
"Failed to add %s to the IPA NSS database.", nickname)
|
|
return CLIENT_INSTALL_ERROR
|
|
|
|
# Add the CA certificates to the platform-dependant systemwide CA store
|
|
tasks.insert_ca_certs_into_systemwide_ca_store(ca_certs)
|
|
|
|
if not options.on_master:
|
|
client_dns(cli_server[0], hostname, options)
|
|
configure_certmonger(fstore, subject_base, cli_realm, hostname,
|
|
options, ca_enabled)
|
|
|
|
update_ssh_keys(hostname, services.knownservices.sshd.get_config_dir(),
|
|
options.create_sshfp)
|
|
|
|
try:
|
|
os.remove(CCACHE_FILE)
|
|
except Exception:
|
|
pass
|
|
|
|
#Name Server Caching Daemon. Disable for SSSD, use otherwise (if installed)
|
|
nscd = services.knownservices.nscd
|
|
if nscd.is_installed():
|
|
save_state(nscd)
|
|
|
|
try:
|
|
if options.sssd:
|
|
nscd_service_action = 'stop'
|
|
nscd.stop()
|
|
else:
|
|
nscd_service_action = 'restart'
|
|
nscd.restart()
|
|
except Exception:
|
|
root_logger.warning("Failed to %s the %s daemon",
|
|
nscd_service_action, nscd.service_name)
|
|
if not options.sssd:
|
|
root_logger.warning(
|
|
"Caching of users/groups will not be available")
|
|
|
|
try:
|
|
if options.sssd:
|
|
nscd.disable()
|
|
else:
|
|
nscd.enable()
|
|
except Exception:
|
|
if not options.sssd:
|
|
root_logger.warning(
|
|
"Failed to configure automatic startup of the %s daemon",
|
|
nscd.service_name)
|
|
root_logger.info("Caching of users/groups will not be " +
|
|
"available after reboot")
|
|
else:
|
|
root_logger.warning(
|
|
"Failed to disable %s daemon. Disable it manually.",
|
|
nscd.service_name)
|
|
|
|
else:
|
|
# this is optional service, just log
|
|
if not options.sssd:
|
|
root_logger.info("%s daemon is not installed, skip configuration",
|
|
nscd.service_name)
|
|
|
|
nslcd = services.knownservices.nslcd
|
|
if nslcd.is_installed():
|
|
save_state(nslcd)
|
|
|
|
retcode, conf = (0, None)
|
|
|
|
if not options.no_ac:
|
|
# Modify nsswitch/pam stack
|
|
tasks.modify_nsswitch_pam_stack(sssd=options.sssd,
|
|
mkhomedir=options.mkhomedir,
|
|
statestore=statestore)
|
|
|
|
root_logger.info("%s enabled", "SSSD" if options.sssd else "LDAP")
|
|
|
|
if options.sssd:
|
|
sssd = services.service('sssd')
|
|
try:
|
|
sssd.restart()
|
|
except CalledProcessError:
|
|
root_logger.warning("SSSD service restart was unsuccessful.")
|
|
|
|
try:
|
|
sssd.enable()
|
|
except CalledProcessError as e:
|
|
root_logger.warning(
|
|
"Failed to enable automatic startup of the SSSD daemon: %s", e)
|
|
|
|
if not options.sssd:
|
|
tasks.modify_pam_to_use_krb5(statestore)
|
|
root_logger.info("Kerberos 5 enabled")
|
|
|
|
# Update non-SSSD LDAP configuration after authconfig calls as it would
|
|
# change its configuration otherways
|
|
if not options.sssd:
|
|
for configurer in [configure_ldap_conf, configure_nslcd_conf]:
|
|
(retcode, conf, filenames) = configurer(fstore, cli_basedn, cli_realm, cli_domain, cli_server, dnsok, options, nosssd_files[configurer.__name__])
|
|
if retcode:
|
|
return CLIENT_INSTALL_ERROR
|
|
if conf:
|
|
root_logger.info(
|
|
"%s configured using configuration file(s) %s",
|
|
conf, filenames)
|
|
|
|
if configure_openldap_conf(fstore, cli_basedn, cli_server):
|
|
root_logger.info("Configured /etc/openldap/ldap.conf")
|
|
else:
|
|
root_logger.info("Failed to configure /etc/openldap/ldap.conf")
|
|
|
|
#Check that nss is working properly
|
|
if not options.on_master:
|
|
n = 0
|
|
found = False
|
|
# Loop for up to 10 seconds to see if nss is working properly.
|
|
# It can sometimes take a few seconds to connect to the remote provider.
|
|
# Particulary, SSSD might take longer than 6-8 seconds.
|
|
while n < 10 and not found:
|
|
try:
|
|
ipautil.run(["getent", "passwd", "admin@%s" % cli_domain])
|
|
found = True
|
|
except Exception as e:
|
|
time.sleep(1)
|
|
n = n + 1
|
|
|
|
if not found:
|
|
root_logger.error(
|
|
"Unable to find 'admin' user with "
|
|
"'getent passwd admin@%s'!" % cli_domain)
|
|
if conf:
|
|
root_logger.info("Recognized configuration: %s", conf)
|
|
else:
|
|
root_logger.error("Unable to reliably detect " +
|
|
"configuration. Check NSS setup manually.")
|
|
|
|
try:
|
|
hardcode_ldap_server(cli_server)
|
|
except Exception as e:
|
|
root_logger.error("Adding hardcoded server name to " +
|
|
"/etc/ldap.conf failed: %s", str(e))
|
|
|
|
if options.conf_ntp and not options.on_master:
|
|
# disable other time&date services first
|
|
if options.force_ntpd:
|
|
ipaclient.ntpconf.force_ntpd(statestore)
|
|
|
|
if options.ntp_servers:
|
|
ntp_servers = options.ntp_servers
|
|
elif ntp_srv_servers:
|
|
ntp_servers = ntp_srv_servers
|
|
else:
|
|
root_logger.warning("No SRV records of NTP servers found. IPA "
|
|
"server address will be used")
|
|
ntp_servers = cli_server
|
|
|
|
ipaclient.ntpconf.config_ntp(ntp_servers, fstore, statestore)
|
|
root_logger.info("NTP enabled")
|
|
|
|
if options.conf_ssh:
|
|
configure_ssh_config(fstore, options)
|
|
|
|
if options.conf_sshd:
|
|
configure_sshd_config(fstore, options)
|
|
|
|
if options.location:
|
|
configure_automount(options)
|
|
|
|
if options.configure_firefox:
|
|
configure_firefox(options, statestore, cli_domain)
|
|
|
|
if not options.no_nisdomain:
|
|
configure_nisdomain(options=options, domain=cli_domain)
|
|
|
|
root_logger.info('Client configuration complete.')
|
|
|
|
return 0
|
|
|
|
def main():
|
|
safe_options, options = parse_options()
|
|
|
|
if not os.getegid() == 0:
|
|
sys.exit("\nYou must be root to run ipa-client-install.\n")
|
|
if is_fips_enabled():
|
|
sys.exit("Installing IPA client in FIPS mode is not supported")
|
|
|
|
tasks.check_selinux_status()
|
|
logging_setup(options)
|
|
root_logger.debug(
|
|
'%s was invoked with options: %s', sys.argv[0], safe_options)
|
|
root_logger.debug("missing options might be asked for interactively later")
|
|
root_logger.debug('IPA version %s' % version.VENDOR_VERSION)
|
|
|
|
env={"PATH":"/bin:/sbin:/usr/kerberos/bin:/usr/kerberos/sbin:/usr/bin:/usr/sbin"}
|
|
|
|
if options.uninstall:
|
|
return uninstall(options, env)
|
|
|
|
if is_ipa_client_installed(on_master=options.on_master):
|
|
root_logger.error("IPA client is already configured on this system.")
|
|
root_logger.info(
|
|
"If you want to reinstall the IPA client, uninstall it first " +
|
|
"using 'ipa-client-install --uninstall'.")
|
|
return CLIENT_ALREADY_CONFIGURED
|
|
|
|
rval = install(options, env, fstore, statestore)
|
|
if rval == CLIENT_INSTALL_ERROR:
|
|
if options.force:
|
|
root_logger.warning(
|
|
"Installation failed. Force set so not rolling back changes.")
|
|
elif options.on_master:
|
|
root_logger.warning(
|
|
"Installation failed. As this is IPA server, changes will not "
|
|
"be rolled back."
|
|
)
|
|
else:
|
|
root_logger.error("Installation failed. Rolling back changes.")
|
|
options.unattended = True
|
|
uninstall(options, env)
|
|
|
|
return rval
|
|
|
|
try:
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|
|
except SystemExit as e:
|
|
sys.exit(e)
|
|
except KeyboardInterrupt:
|
|
sys.exit(1)
|
|
except RuntimeError as e:
|
|
sys.exit(e)
|
|
finally:
|
|
try:
|
|
os.remove(CCACHE_FILE)
|
|
except Exception:
|
|
pass
|