public/freeipa
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8,349 Commits 9 Branches 0 Tags
14992a07fc7ea6bb5c028e5fefaf7394af00a555
Commit Graph
290 Commits
Author SHA1 Message Date
Martin Basti 6fa123447f FIX: Clear SSSD caches when uninstalling the client 
https://fedorahosted.org/freeipa/ticket/5049

Reviewed-By: Simo Sorce <ssorce@redhat.com>
 2015-07-07 16:27:24 +02:00
Gabe 37729936dd Clear SSSD caches when uninstalling the client 
https://fedorahosted.org/freeipa/ticket/5049

Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
 2015-06-30 12:59:19 +02:00
Martin Babinsky 90788a25d6 increase NSS memcache timeout for IPA server 
Increasing memcache timeout to 600 seconds when configuring sssd on IPA server
should improve performance when dealing with large groups in trusts.

https://fedorahosted.org/freeipa/ticket/4964

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-06-30 12:50:00 +02:00
Petr Spacek 13700d9d3f Clarify host name output in ipa-client-install 
Proposed by Tomas Capek

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-06-05 19:25:56 +02:00
Jan Cholasta 454e8691cf client-install: Fix kinits with non-default Kerberos config file 
https://fedorahosted.org/freeipa/ticket/4808

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-05-21 07:42:24 +00:00
Martin Babinsky 98376589de suppress errors arising from deleting non-existent files during client uninstall 
When rolling back partially configured IPA client a number of OSErrors pop up
due to uninstaller trying to remove files that do not exist anymore. This
patch supresses these errors while keeping them in log as debug messages.

https://fedorahosted.org/freeipa/ticket/4966

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-04-29 05:24:58 +00:00
Martin Basti 2c8c4b8c88 ipa client: use NTP servers specified by user 
NTP servers specified by user should be used to synchronize time.

https://fedorahosted.org/freeipa/ticket/4983

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-04-24 15:39:08 +02:00
Martin Basti e55d8ee5d4 ipa client: use NTP servers detected from SRV 
Detected NTP servers from SRV records should be used in NTP client
configuration.

https://fedorahosted.org/freeipa/ticket/4981

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-04-24 15:36:07 +02:00
Martin Basti e395bdb911 ipa client: make --ntp-server option multivalued 
There can be more ntp servers in ntp.conf

Required for ticket: https://fedorahosted.org/freeipa/ticket/4981

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-04-24 15:36:07 +02:00
Martin Babinsky 3d2feac0e4 Adopted kinit_keytab and kinit_password for kerberos auth 
Calls to ipautil.run using kinit were replaced with calls
kinit_keytab/kinit_password functions implemented in the PATCH 0015.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-04-20 08:27:35 +00:00
Martin Babinsky a8e30e9671 ipa-client-install: try to get host TGT several times before giving up 
New option '--kinit-attempts' enables the host to make multiple attempts to
obtain host TGT from master before giving up and aborting client installation.

In addition, all kinit attempts were replaced by calls to
'ipautil.kinit_keytab' and 'ipautil.kinit_password'.

https://fedorahosted.org/freeipa/ticket/4808

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-04-20 08:27:35 +00:00
Gabe e537fd202e Add message for skipping NTP configuration during client install 
https://fedorahosted.org/freeipa/ticket/3092

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-04-14 19:12:47 +02:00
Nathan Kinder f0c1daf7a2 Skip time sync during client install when using --no-ntp 
When --no-ntp is specified during ipa-client-install, we still
attempt to perform a time sync before obtaining a TGT from the
KDC.  We should not be attempting to sync time with the KDC if
we are explicitly told to not configure ntp.

Ticket: https://fedorahosted.org/freeipa/ticket/4842
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-03-26 18:30:19 +01:00
Jan Cholasta 572d68b539 client: Fix ca_is_enabled calls 
The command was added in API version 2.107. Old IPA servers may crash with
NetworkError on ca_is_enabled, handle this case gracefully.

https://fedorahosted.org/freeipa/ticket/4565

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 14:38:34 +00:00
Jan Cholasta 95a628cfb9 client-install: Do not crash on invalid CA certificate in LDAP 
When CA certificates in LDAP are corrupted, use the otherwise acquired CA
certificates from before.

https://fedorahosted.org/freeipa/ticket/4565

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 14:38:34 +00:00
David Kupka aa745b31d3 Use IPA CA certificate when available and ignore NO_TLS_LDAP when not. 
ipa-client-automount is run after ipa-client-install so the CA certificate
should be available. If the certificate is not available and ipadiscovery.ipacheckldap
returns NO_TLS_LDAP warn user and try to continue.

https://fedorahosted.org/freeipa/ticket/4902

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2015-03-05 10:59:01 +01:00
Martin Basti e29f9280fd Use dyndns_update instead of deprecated sssd option 
ipa_dyndns_update is deprecated in SSSD, dyndns_update should be used
instead.

https://fedorahosted.org/freeipa/ticket/4849

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-01-28 14:28:33 +01:00
Nathaniel McCallum 7ad9f5d3d5 Prefer TCP connections to UDP in krb5 clients 
In general, TCP is a better fit for FreeIPA due to large packet sizes.

However, there is also a specific need for TCP when using OTP. If a UDP
packet is delivered to the server and the server takes longer to process
it than the client timeout (likely), the OTP value will be resent.
Unfortunately, this will cause failures or even lockouts. Switching to
TCP avoids this problem altogether.

https://fedorahosted.org/freeipa/ticket/4725

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-12-08 10:56:06 +01:00
Jan Pazdziora bea417828d No explicit zone specification. 
https://fedorahosted.org/freeipa/ticket/4780

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2014-12-05 09:46:56 +01:00
Gabe 7eca640ffa Remove trivial path constants from modules 
https://fedorahosted.org/freeipa/ticket/4399

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-11-04 12:57:01 +01:00
Jan Cholasta 608851d3f8 Check LDAP instead of local configuration to see if IPA CA is enabled 
The check is done using a new hidden command ca_is_enabled.

https://fedorahosted.org/freeipa/ticket/4621

Reviewed-By: David Kupka <dkupka@redhat.com>
 2014-10-17 12:53:11 +02:00
Jan Cholasta ca7e0c270f Add ipa-client-install switch --request-cert to request cert for the host 
The certificate is stored in /etc/ipa/nssdb under the nickname
"Local IPA host".

https://fedorahosted.org/freeipa/ticket/4550

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-10-16 19:11:52 +02:00
Jan Cholasta f40a0ad325 Use /etc/ipa/nssdb to get nicknames of IPA certs installed in /etc/pki/nssdb 
Previously a list of nicknames was kept in /etc/pki/nssdb/ipa.txt. The file
is removed now.

https://fedorahosted.org/freeipa/ticket/3259

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-09-30 10:01:38 +02:00
Jan Cholasta bbf962299d Use NSSDatabase instead of direct certutil calls in client code 
https://fedorahosted.org/freeipa/ticket/4416

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-09-30 10:01:38 +02:00
Jan Cholasta 231f57cedb Introduce NSS database /etc/ipa/nssdb 
This is the new default NSS database for IPA.

/etc/pki/nssdb is still maintained for backward compatibility.

https://fedorahosted.org/freeipa/ticket/3259

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-09-30 10:01:38 +02:00
David Kupka 89c4f12425 Add 'host' setting into default.conf configuration file on client. Fix description in man page. 
'host' setting specifies local hostname not the hostname of IPA server.

https://fedorahosted.org/freeipa/ticket/4481

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-09-26 13:38:57 +02:00
Rob Crittenden c1bf520393 No longer generate a machine certificate on client installs 
https://fedorahosted.org/freeipa/ticket/4449

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-09-05 17:50:59 +02:00
David Kupka dc4bdd327f Allow user to force Kerberos realm during installation. 
User can set realm not matching one resolved from DNS. This is useful especially
when DNS is missconfigured.

https://fedorahosted.org/freeipa/ticket/4444

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-09-05 14:50:36 +02:00
Tomas Babej fd26560a16 ipa-client-install: Do not add already configured sources to nsswitch.conf entries 
Makes sure that any new sources added are not already present
in the entry.

https://fedorahosted.org/freeipa/ticket/4508

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-09-04 13:39:13 +02:00
Jan Cholasta 60e19b585c Add client certificate update tool ipa-certupdate. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 55d3bab57b Get CA certs for system-wide store from cert store in ipa-client-install. 
All of the certificates and associated key policy are now stored in
/etc/pki/ca-trust/source/ipa.p11-kit.

Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta b5471a9f3e Get CA certs for /etc/pki/nssdb from certificate store in ipa-client-install. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 459d6cff4e Get CA certs for /etc/ipa/ca.crt from certificate store in ipa-client-install. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta fd400588d7 Support multiple CA certificates in /etc/ipa/ca.crt in ipa-client-install. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 29f42cbec1 Refactor CA certificate fetching code in ipa-client-install. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta a8a44c1c71 Remove certificate "External CA cert" from /etc/pki/nssdb on client uninstall. 
This is a no longer used nickname for CA certificate on CA-less server
installs.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
David Kupka 2ff14607b1 Fix ipa-client-install --uninstall crash 
Fix ipa-client-install crash when chronyd service fails to start.

https://fedorahosted.org/freeipa/ticket/4273

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-08 10:29:13 +02:00
Tomas Babej ffab09a7ef ipa-client-install: Restart nisdomain service instead of starting 
To ensure new NIS domain name is loaded after ipa-client-install
even in case when nisdomainname service is already running, we
need to restart the service rather than starting it.

https://fedorahosted.org/freeipa/ticket/4393

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-06-30 13:58:29 +02:00
Jan Cholasta 3e0245f28f Do not corrupt sshd_config in client install when trailing newline is missing. 
https://fedorahosted.org/freeipa/ticket/4373

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-26 12:00:29 +02:00
Tomas Babej e5e42fc83a ipaplatform: Move paths from installers to paths module 
Part of: https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-26 09:22:21 +02:00
Tomas Babej c7edd7b68c ipaplatform: Remove redundant imports of ipaservices 
Also fixes few incorrect imports.

https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-16 19:48:20 +02:00
Tomas Babej c011bccf45 ipaplatform: Change paths dependant on ipaservices to use ipaplatform.paths 
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-16 19:48:19 +02:00
Tomas Babej 49fcd42f8f ipaplatform: Change service code in freeipa to use ipaplatform services 
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-16 19:48:19 +02:00
Tomas Babej 926f8647d2 ipaplatform: Change platform dependant code in freeipa to use ipaplatform tasks 
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-16 19:48:19 +02:00
Tomas Babej 5f31f2d35f ipaplatform: Do not require custom Authconfig implementations from platform modules 
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-16 19:48:18 +02:00
Tomas Babej c465eb842f ipaplatform: Moved Fedora 16 service implementations and refactored them as base Fedora module service implementations 
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-16 19:48:17 +02:00
Petr Viktorin d6a4da30de admin tools: Log IPA version 
Add the IPA version, and vendor version if applicable, to the beginning
of admintool logs -- both framework and indivitual tools that don't yet
use the framework.
This will make debugging easier.

https://fedorahosted.org/freeipa/ticket/4219

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-05-27 12:08:55 +02:00
Gabe 9810283278 ipa-client-automount should not configure nsswitch.conf manually 
https://fedorahosted.org/freeipa/ticket/3733

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-05-16 11:13:54 +02:00
Petr Viktorin 2478aa42a0 ipa-client-automount: Use rpcclient, not xmlclient, for automountlocation_show 
Fix for a regression in 66fb4d5e84
https://fedorahosted.org/freeipa/ticket/4290
 2014-05-14 13:04:30 +02:00
Tomas Babej ef3c9d3bb0 ipa-client-install: Configure sudo to use SSSD as data source 
Makes ipa-client-install configure SSSD as the data provider
for the sudo service by default. This behaviour can be disabled
by using --no-sudo flag.

https://fedorahosted.org/freeipa/ticket/3358

Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-05-09 13:57:04 +03:00