public/freeipa
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8,349 Commits 9 Branches 0 Tags
14992a07fc7ea6bb5c028e5fefaf7394af00a555
Commit Graph
276 Commits
Author SHA1 Message Date
Martin Basti 6fa123447f FIX: Clear SSSD caches when uninstalling the client 
https://fedorahosted.org/freeipa/ticket/5049

Reviewed-By: Simo Sorce <ssorce@redhat.com>
 2015-07-07 16:27:24 +02:00
Gabe 37729936dd Clear SSSD caches when uninstalling the client 
https://fedorahosted.org/freeipa/ticket/5049

Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
 2015-06-30 12:59:19 +02:00
Martin Babinsky 90788a25d6 increase NSS memcache timeout for IPA server 
Increasing memcache timeout to 600 seconds when configuring sssd on IPA server
should improve performance when dealing with large groups in trusts.

https://fedorahosted.org/freeipa/ticket/4964

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-06-30 12:50:00 +02:00
Petr Spacek 13700d9d3f Clarify host name output in ipa-client-install 
Proposed by Tomas Capek

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-06-05 19:25:56 +02:00
Jan Cholasta 454e8691cf client-install: Fix kinits with non-default Kerberos config file 
https://fedorahosted.org/freeipa/ticket/4808

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-05-21 07:42:24 +00:00
Martin Babinsky 98376589de suppress errors arising from deleting non-existent files during client uninstall 
When rolling back partially configured IPA client a number of OSErrors pop up
due to uninstaller trying to remove files that do not exist anymore. This
patch supresses these errors while keeping them in log as debug messages.

https://fedorahosted.org/freeipa/ticket/4966

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2015-04-29 05:24:58 +00:00
Martin Basti 2c8c4b8c88 ipa client: use NTP servers specified by user 
NTP servers specified by user should be used to synchronize time.

https://fedorahosted.org/freeipa/ticket/4983

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-04-24 15:39:08 +02:00
Martin Basti e55d8ee5d4 ipa client: use NTP servers detected from SRV 
Detected NTP servers from SRV records should be used in NTP client
configuration.

https://fedorahosted.org/freeipa/ticket/4981

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-04-24 15:36:07 +02:00
Martin Basti e395bdb911 ipa client: make --ntp-server option multivalued 
There can be more ntp servers in ntp.conf

Required for ticket: https://fedorahosted.org/freeipa/ticket/4981

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-04-24 15:36:07 +02:00
Martin Babinsky a8e30e9671 ipa-client-install: try to get host TGT several times before giving up 
New option '--kinit-attempts' enables the host to make multiple attempts to
obtain host TGT from master before giving up and aborting client installation.

In addition, all kinit attempts were replaced by calls to
'ipautil.kinit_keytab' and 'ipautil.kinit_password'.

https://fedorahosted.org/freeipa/ticket/4808

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Reviewed-By: Simo Sorce <ssorce@redhat.com>
Reviewed-By: Petr Spacek <pspacek@redhat.com>
 2015-04-20 08:27:35 +00:00
Gabe e537fd202e Add message for skipping NTP configuration during client install 
https://fedorahosted.org/freeipa/ticket/3092

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2015-04-14 19:12:47 +02:00
Nathan Kinder f0c1daf7a2 Skip time sync during client install when using --no-ntp 
When --no-ntp is specified during ipa-client-install, we still
attempt to perform a time sync before obtaining a TGT from the
KDC.  We should not be attempting to sync time with the KDC if
we are explicitly told to not configure ntp.

Ticket: https://fedorahosted.org/freeipa/ticket/4842
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-03-26 18:30:19 +01:00
Jan Cholasta 572d68b539 client: Fix ca_is_enabled calls 
The command was added in API version 2.107. Old IPA servers may crash with
NetworkError on ca_is_enabled, handle this case gracefully.

https://fedorahosted.org/freeipa/ticket/4565

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 14:38:34 +00:00
Jan Cholasta 95a628cfb9 client-install: Do not crash on invalid CA certificate in LDAP 
When CA certificates in LDAP are corrupted, use the otherwise acquired CA
certificates from before.

https://fedorahosted.org/freeipa/ticket/4565

Reviewed-By: David Kupka <dkupka@redhat.com>
 2015-03-19 14:38:34 +00:00
Martin Basti e29f9280fd Use dyndns_update instead of deprecated sssd option 
ipa_dyndns_update is deprecated in SSSD, dyndns_update should be used
instead.

https://fedorahosted.org/freeipa/ticket/4849

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
 2015-01-28 14:28:33 +01:00
Nathaniel McCallum 7ad9f5d3d5 Prefer TCP connections to UDP in krb5 clients 
In general, TCP is a better fit for FreeIPA due to large packet sizes.

However, there is also a specific need for TCP when using OTP. If a UDP
packet is delivered to the server and the server takes longer to process
it than the client timeout (likely), the OTP value will be resent.
Unfortunately, this will cause failures or even lockouts. Switching to
TCP avoids this problem altogether.

https://fedorahosted.org/freeipa/ticket/4725

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-12-08 10:56:06 +01:00
Jan Pazdziora bea417828d No explicit zone specification. 
https://fedorahosted.org/freeipa/ticket/4780

Reviewed-By: Martin Basti <mbasti@redhat.com>
 2014-12-05 09:46:56 +01:00
Gabe 7eca640ffa Remove trivial path constants from modules 
https://fedorahosted.org/freeipa/ticket/4399

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-11-04 12:57:01 +01:00
Jan Cholasta 608851d3f8 Check LDAP instead of local configuration to see if IPA CA is enabled 
The check is done using a new hidden command ca_is_enabled.

https://fedorahosted.org/freeipa/ticket/4621

Reviewed-By: David Kupka <dkupka@redhat.com>
 2014-10-17 12:53:11 +02:00
Jan Cholasta ca7e0c270f Add ipa-client-install switch --request-cert to request cert for the host 
The certificate is stored in /etc/ipa/nssdb under the nickname
"Local IPA host".

https://fedorahosted.org/freeipa/ticket/4550

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
 2014-10-16 19:11:52 +02:00
Jan Cholasta f40a0ad325 Use /etc/ipa/nssdb to get nicknames of IPA certs installed in /etc/pki/nssdb 
Previously a list of nicknames was kept in /etc/pki/nssdb/ipa.txt. The file
is removed now.

https://fedorahosted.org/freeipa/ticket/3259

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-09-30 10:01:38 +02:00
Jan Cholasta bbf962299d Use NSSDatabase instead of direct certutil calls in client code 
https://fedorahosted.org/freeipa/ticket/4416

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-09-30 10:01:38 +02:00
Jan Cholasta 231f57cedb Introduce NSS database /etc/ipa/nssdb 
This is the new default NSS database for IPA.

/etc/pki/nssdb is still maintained for backward compatibility.

https://fedorahosted.org/freeipa/ticket/3259

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-09-30 10:01:38 +02:00
David Kupka 89c4f12425 Add 'host' setting into default.conf configuration file on client. Fix description in man page. 
'host' setting specifies local hostname not the hostname of IPA server.

https://fedorahosted.org/freeipa/ticket/4481

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-09-26 13:38:57 +02:00
Rob Crittenden c1bf520393 No longer generate a machine certificate on client installs 
https://fedorahosted.org/freeipa/ticket/4449

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-09-05 17:50:59 +02:00
David Kupka dc4bdd327f Allow user to force Kerberos realm during installation. 
User can set realm not matching one resolved from DNS. This is useful especially
when DNS is missconfigured.

https://fedorahosted.org/freeipa/ticket/4444

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
 2014-09-05 14:50:36 +02:00
Tomas Babej fd26560a16 ipa-client-install: Do not add already configured sources to nsswitch.conf entries 
Makes sure that any new sources added are not already present
in the entry.

https://fedorahosted.org/freeipa/ticket/4508

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-09-04 13:39:13 +02:00
Jan Cholasta 55d3bab57b Get CA certs for system-wide store from cert store in ipa-client-install. 
All of the certificates and associated key policy are now stored in
/etc/pki/ca-trust/source/ipa.p11-kit.

Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta b5471a9f3e Get CA certs for /etc/pki/nssdb from certificate store in ipa-client-install. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 459d6cff4e Get CA certs for /etc/ipa/ca.crt from certificate store in ipa-client-install. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta fd400588d7 Support multiple CA certificates in /etc/ipa/ca.crt in ipa-client-install. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta 29f42cbec1 Refactor CA certificate fetching code in ipa-client-install. 
Part of https://fedorahosted.org/freeipa/ticket/3259
Part of https://fedorahosted.org/freeipa/ticket/3520

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
Jan Cholasta a8a44c1c71 Remove certificate "External CA cert" from /etc/pki/nssdb on client uninstall. 
This is a no longer used nickname for CA certificate on CA-less server
installs.

Reviewed-By: Rob Crittenden <rcritten@redhat.com>
 2014-07-30 16:04:21 +02:00
David Kupka 2ff14607b1 Fix ipa-client-install --uninstall crash 
Fix ipa-client-install crash when chronyd service fails to start.

https://fedorahosted.org/freeipa/ticket/4273

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-07-08 10:29:13 +02:00
Tomas Babej ffab09a7ef ipa-client-install: Restart nisdomain service instead of starting 
To ensure new NIS domain name is loaded after ipa-client-install
even in case when nisdomainname service is already running, we
need to restart the service rather than starting it.

https://fedorahosted.org/freeipa/ticket/4393

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-06-30 13:58:29 +02:00
Jan Cholasta 3e0245f28f Do not corrupt sshd_config in client install when trailing newline is missing. 
https://fedorahosted.org/freeipa/ticket/4373

Reviewed-By: Martin Kosek <mkosek@redhat.com>
 2014-06-26 12:00:29 +02:00
Tomas Babej e5e42fc83a ipaplatform: Move paths from installers to paths module 
Part of: https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-26 09:22:21 +02:00
Tomas Babej c011bccf45 ipaplatform: Change paths dependant on ipaservices to use ipaplatform.paths 
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-16 19:48:19 +02:00
Tomas Babej 49fcd42f8f ipaplatform: Change service code in freeipa to use ipaplatform services 
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-16 19:48:19 +02:00
Tomas Babej 926f8647d2 ipaplatform: Change platform dependant code in freeipa to use ipaplatform tasks 
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-16 19:48:19 +02:00
Tomas Babej 5f31f2d35f ipaplatform: Do not require custom Authconfig implementations from platform modules 
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-16 19:48:18 +02:00
Tomas Babej c465eb842f ipaplatform: Moved Fedora 16 service implementations and refactored them as base Fedora module service implementations 
https://fedorahosted.org/freeipa/ticket/4052

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-06-16 19:48:17 +02:00
Petr Viktorin d6a4da30de admin tools: Log IPA version 
Add the IPA version, and vendor version if applicable, to the beginning
of admintool logs -- both framework and indivitual tools that don't yet
use the framework.
This will make debugging easier.

https://fedorahosted.org/freeipa/ticket/4219

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-05-27 12:08:55 +02:00
Tomas Babej ef3c9d3bb0 ipa-client-install: Configure sudo to use SSSD as data source 
Makes ipa-client-install configure SSSD as the data provider
for the sudo service by default. This behaviour can be disabled
by using --no-sudo flag.

https://fedorahosted.org/freeipa/ticket/3358

Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-05-09 13:57:04 +03:00
Tomas Babej d90eb46cce ipa-client: Set NIS domain name in the installer 
Provides two new options for the ipa-client-install:
    --nisdomain: specifies the NIS domain name
    --no_nisdomain: flag to aviod setting the NIS domain name

In case no --nisdomain is specified and --no_nisdomain flag was
not set, the IPA domain is used.

Manual pages updated.

http://fedorahosted.org/freeipa/ticket/3202

Reviewed-By: Jakub Hrozek <jhrozek@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
 2014-05-09 13:57:04 +03:00
Jan Cholasta fea7163e87 Move CACERT definition to a single place. 
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-25 16:54:54 +01:00
Gabe 1f4869a3fa Fix order of synchronizing time when running ipa-client-install 
When running ipa-client-install, it asks for user name, synchronizes time, then asks for user password
which the order could be confusing to some users. This changes ipa-client-install to synchronize time
before prompting for user kerberos authentication.

https://fedorahosted.org/freeipa/ticket/3957

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-03-20 10:58:09 +01:00
Ana Krivokapic f67268db68 Improve error message on failed Kerberos authentication 
When ipa client installation fails due to failed Kerberos authentication,
make sure that the message about the failed authentication is displayed last.
This makes it clear to the user that this was the reason for failed
installation.

https://fedorahosted.org/freeipa/ticket/3573

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
 2014-02-18 16:37:07 +01:00
Ana Krivokapic 367c130185 Make sure state of services is preserved after client uninstall 
IPA client installation did not preserve the status of nscd and nslcd services
correctly. E.g. nscd would be started after uninstallation, even though it
wasn't running before client installation. Make sure the state of services is
saved before installation and correctly restored after uninstallation.

https://fedorahosted.org/freeipa/ticket/3790
 2014-01-14 09:28:39 +01:00
Xiao-Long Chen 5e96fbc22a Use /usr/bin/python2 
Part of the effort to port FreeIPA to Arch Linux,
where Python 3 is the default.

FreeIPA hasn't been ported to Python 3, so the code must be modified to
run /usr/bin/python2

https://fedorahosted.org/freeipa/ticket/3438

Updated by pviktori@redhat.com
 2014-01-03 09:46:05 +01:00