def check_for_supported_domain_level(self): """ check if we are in 0-level topology. If not, raise an error pointing the user to the replica promotion pathway """ domain_level = dsinstance.get_domain_level(api) if domain_level > DOMAIN_LEVEL_0: self.log.error( UNSUPPORTED_DOMAIN_LEVEL_TEMPLATE.format( command_name=self.command_name, domain_level=DOMAIN_LEVEL_0, curr_domain_level=domain_level)) raise errors.InvalidDomainLevelError( reason="'{command}' is allowed only in domain level " "{prep_domain_level}".format(command=self.command_name, prep_domain_level=DOMAIN_LEVEL_0))
def check_for_supported_domain_level(self): """ check if we are in 0-level topology. If not, raise an error pointing the user to the replica promotion pathway """ domain_level = dsinstance.get_domain_level(api) if domain_level > DOMAIN_LEVEL_0: self.log.error( UNSUPPORTED_DOMAIN_LEVEL_TEMPLATE.format( command_name=self.command_name, domain_level=DOMAIN_LEVEL_0, curr_domain_level=domain_level ) ) raise errors.InvalidDomainLevelError( reason="'{command}' is allowed only in domain level " "{prep_domain_level}".format( command=self.command_name, prep_domain_level=DOMAIN_LEVEL_0 ) )
def uninstall_check(installer): options = installer tasks.check_selinux_status() installer._installation_cleanup = False if not is_ipa_configured(): print("WARNING:\nIPA server is not configured on this system. " "If you want to install the\nIPA server, please install " "it using 'ipa-server-install'.") fstore = sysrestore.FileStore(SYSRESTORE_DIR_PATH) sstore = sysrestore.StateFile(SYSRESTORE_DIR_PATH) # Configuration for ipalib, we will bootstrap and finalize later, after # we are sure we have the configuration file ready. cfg = dict( context='installer', confdir=paths.ETC_IPA, in_server=True, ) # We will need at least api.env, finalize api now. This system is # already installed, so the configuration file is there. api.bootstrap(**cfg) api.finalize() if installer.interactive: print("\nThis is a NON REVERSIBLE operation and will delete all data " "and configuration!\nIt is highly recommended to take a backup of " "existing data and configuration using ipa-backup utility " "before proceeding.\n") if not user_input("Are you sure you want to continue with the " "uninstall procedure?", False): raise ScriptError("Aborting uninstall operation.") try: api.Backend.ldap2.connect(autobind=True) domain_level = dsinstance.get_domain_level(api) except Exception: msg = ("\nWARNING: Failed to connect to Directory Server to find " "information about replication agreements. Uninstallation " "will continue despite the possible existing replication " "agreements.\n\n" "If this server is the last instance of CA, KRA, or DNSSEC " "master, uninstallation may result in data loss.\n\n" ) print(textwrap.fill(msg, width=80, replace_whitespace=False)) if (installer.interactive and not user_input( "Are you sure you want to continue with the uninstall " "procedure?", False)): raise ScriptError("Aborting uninstall operation.") else: dns.uninstall_check(options) ca.uninstall_check(options) if domain_level == DOMAIN_LEVEL_0: rm = replication.ReplicationManager( realm=api.env.realm, hostname=api.env.host, dirman_passwd=None, conn=api.Backend.ldap2 ) agreements = rm.find_ipa_replication_agreements() if agreements: other_masters = [a.get('cn')[0][4:] for a in agreements] msg = ( "\nReplication agreements with the following IPA masters " "found: %s. Removing any replication agreements before " "uninstalling the server is strongly recommended. You can " "remove replication agreements by running the following " "command on any other IPA master:\n" % ", ".join( other_masters) ) cmd = "$ ipa-replica-manage del %s\n" % api.env.host print(textwrap.fill(msg, width=80, replace_whitespace=False)) print(cmd) if (installer.interactive and not user_input("Are you sure you want to continue with" " the uninstall procedure?", False)): raise ScriptError("Aborting uninstall operation.") else: remove_master_from_managed_topology(api, options) api.Backend.ldap2.disconnect() installer._fstore = fstore installer._sstore = sstore
def uninstall_check(installer): options = installer tasks.check_selinux_status() installer._installation_cleanup = False if not is_ipa_configured(): print("WARNING:\nIPA server is not configured on this system. " "If you want to install the\nIPA server, please install " "it using 'ipa-server-install'.") fstore = sysrestore.FileStore(SYSRESTORE_DIR_PATH) sstore = sysrestore.StateFile(SYSRESTORE_DIR_PATH) # Configuration for ipalib, we will bootstrap and finalize later, after # we are sure we have the configuration file ready. cfg = dict( context='installer', confdir=paths.ETC_IPA, in_server=True, ) # We will need at least api.env, finalize api now. This system is # already installed, so the configuration file is there. api.bootstrap(**cfg) api.finalize() if installer.interactive: print( "\nThis is a NON REVERSIBLE operation and will delete all data " "and configuration!\nIt is highly recommended to take a backup of " "existing data and configuration using ipa-backup utility " "before proceeding.\n") if not user_input( "Are you sure you want to continue with the " "uninstall procedure?", False): raise ScriptError("Aborting uninstall operation.") try: api.Backend.ldap2.connect(autobind=True) domain_level = dsinstance.get_domain_level(api) except Exception: msg = ("\nWARNING: Failed to connect to Directory Server to find " "information about replication agreements. Uninstallation " "will continue despite the possible existing replication " "agreements.\n\n" "If this server is the last instance of CA, KRA, or DNSSEC " "master, uninstallation may result in data loss.\n\n") print(textwrap.fill(msg, width=80, replace_whitespace=False)) if (installer.interactive and not user_input( "Are you sure you want to continue with the uninstall " "procedure?", False)): raise ScriptError("Aborting uninstall operation.") else: dns.uninstall_check(options) if domain_level == DOMAIN_LEVEL_0: rm = replication.ReplicationManager(realm=api.env.realm, hostname=api.env.host, dirman_passwd=None, conn=api.Backend.ldap2) agreements = rm.find_ipa_replication_agreements() if agreements: other_masters = [a.get('cn')[0][4:] for a in agreements] msg = ( "\nReplication agreements with the following IPA masters " "found: %s. Removing any replication agreements before " "uninstalling the server is strongly recommended. You can " "remove replication agreements by running the following " "command on any other IPA master:\n" % ", ".join(other_masters)) cmd = "$ ipa-replica-manage del %s\n" % api.env.host print(textwrap.fill(msg, width=80, replace_whitespace=False)) print(cmd) if (installer.interactive and not user_input( "Are you sure you want to continue with" " the uninstall procedure?", False)): raise ScriptError("Aborting uninstall operation.") else: remove_master_from_managed_topology(api, options) api.Backend.ldap2.disconnect() installer._fstore = fstore installer._sstore = sstore
def run(self): super(KRAInstaller, self).run() # Verify DM password. This has to be called after ask_for_options(), # so it can't be placed in validate_options(). try: installutils.validate_dm_password_ldap(self.options.password) except ValueError: raise admintool.ScriptError( "Directory Manager password is invalid") if not cainstance.is_ca_installed_locally(): raise RuntimeError("Dogtag CA is not installed. " "Please install the CA first") # check if KRA is not already installed _kra = krainstance.KRAInstance(api) if _kra.is_installed(): raise admintool.ScriptError("KRA already installed") # this check can be done only when CA is installed self.installing_replica = dogtaginstance.is_installing_replica("KRA") self.options.promote = False if self.installing_replica: domain_level = dsinstance.get_domain_level(api) if domain_level > DOMAIN_LEVEL_0: self.options.promote = True elif not self.args: raise RuntimeError("A replica file is required.") if self.args and (not self.installing_replica or self.options.promote): raise RuntimeError("Too many parameters provided. " "No replica file is required.") self.options.dm_password = self.options.password self.options.setup_ca = False self.options.setup_kra = True api.Backend.ldap2.connect() config = None if self.installing_replica: if self.options.promote: config = ReplicaConfig() config.kra_host_name = None config.realm_name = api.env.realm config.host_name = api.env.host config.domain_name = api.env.domain config.dirman_password = self.options.password config.ca_ds_port = 389 config.top_dir = tempfile.mkdtemp("ipa") config.dir = config.top_dir else: config = create_replica_config( self.options.password, self.replica_file, self.options) config.kra_host_name = config.master_host_name config.setup_kra = True if config.subject_base is None: attrs = api.Backend.ldap2.get_ipa_config() config.subject_base = attrs.get('ipacertificatesubjectbase')[0] if config.kra_host_name is None: config.kra_host_name = service.find_providing_server( 'KRA', api.Backend.ldap2, api.env.ca_host) try: kra.install_check(api, config, self.options) except RuntimeError as e: raise admintool.ScriptError(str(e)) print(dedent(self.INSTALLER_START_MESSAGE)) try: kra.install(api, config, self.options) except: self.log.error(dedent(self.FAIL_MESSAGE)) raise api.Backend.ldap2.disconnect()
def run(self): super(KRAInstaller, self).run() # Verify DM password. This has to be called after ask_for_options(), # so it can't be placed in validate_options(). try: installutils.validate_dm_password_ldap(self.options.password) except ValueError: raise admintool.ScriptError( "Directory Manager password is invalid") if not cainstance.is_ca_installed_locally(): raise RuntimeError("Dogtag CA is not installed. " "Please install a CA first with the " "`ipa-ca-install` command.") # check if KRA is not already installed _kra = krainstance.KRAInstance(api) if _kra.is_installed(): raise admintool.ScriptError("KRA already installed") # this check can be done only when CA is installed self.installing_replica = dogtaginstance.is_installing_replica("KRA") if self.installing_replica: domain_level = dsinstance.get_domain_level(api) if domain_level < DOMAIN_LEVEL_1: raise RuntimeError( "Unsupported domain level %d." % domain_level) if self.args: raise RuntimeError("Too many parameters provided.") self.options.dm_password = self.options.password self.options.setup_ca = False self.options.setup_kra = True api.Backend.ldap2.connect() if self.installing_replica: config = ReplicaConfig() config.kra_host_name = None config.realm_name = api.env.realm config.host_name = api.env.host config.domain_name = api.env.domain config.dirman_password = self.options.password config.ca_ds_port = 389 config.top_dir = tempfile.mkdtemp("ipa") config.dir = config.top_dir config.setup_kra = True if config.subject_base is None: attrs = api.Backend.ldap2.get_ipa_config() config.subject_base = attrs.get('ipacertificatesubjectbase')[0] if config.kra_host_name is None: config.kra_host_name = find_providing_server( 'KRA', api.Backend.ldap2, [api.env.ca_host] ) if config.kra_host_name is None: # all CA/KRA servers are down or unreachable. raise admintool.ScriptError( "Failed to find an active KRA server!" ) custodia = custodiainstance.get_custodia_instance( config, custodiainstance.CustodiaModes.KRA_PEER) else: config = None custodia = None try: kra.install_check(api, config, self.options) except RuntimeError as e: raise admintool.ScriptError(str(e)) print(dedent(self.INSTALLER_START_MESSAGE)) try: kra.install(api, config, self.options, custodia=custodia) except: logger.error('%s', dedent(self.FAIL_MESSAGE)) raise # pki-spawn restarts 389-DS, reconnect api.Backend.ldap2.close() api.Backend.ldap2.connect() # Enable configured services and update DNS SRV records service.sync_services_state(api.env.host) api.Command.dns_update_system_records() api.Backend.ldap2.disconnect()
def run(self): super(KRAInstaller, self).run() # Verify DM password. This has to be called after ask_for_options(), # so it can't be placed in validate_options(). try: installutils.validate_dm_password_ldap(self.options.password) except ValueError: raise admintool.ScriptError( "Directory Manager password is invalid") if not cainstance.is_ca_installed_locally(): raise RuntimeError("Dogtag CA is not installed. " "Please install a CA first with the " "`ipa-ca-install` command.") # check if KRA is not already installed _kra = krainstance.KRAInstance(api) if _kra.is_installed(): raise admintool.ScriptError("KRA already installed") # this check can be done only when CA is installed self.installing_replica = dogtaginstance.is_installing_replica("KRA") self.options.promote = False if self.installing_replica: domain_level = dsinstance.get_domain_level(api) if domain_level > DOMAIN_LEVEL_0: self.options.promote = True elif not self.args: raise RuntimeError("A replica file is required.") if self.args and (not self.installing_replica or self.options.promote): raise RuntimeError("Too many parameters provided. " "No replica file is required.") self.options.dm_password = self.options.password self.options.setup_ca = False self.options.setup_kra = True api.Backend.ldap2.connect() config = None if self.installing_replica: if self.options.promote: config = ReplicaConfig() config.kra_host_name = None config.realm_name = api.env.realm config.host_name = api.env.host config.domain_name = api.env.domain config.dirman_password = self.options.password config.ca_ds_port = 389 config.top_dir = tempfile.mkdtemp("ipa") config.dir = config.top_dir else: config = create_replica_config( self.options.password, self.replica_file, self.options) config.kra_host_name = config.master_host_name config.setup_kra = True if config.subject_base is None: attrs = api.Backend.ldap2.get_ipa_config() config.subject_base = attrs.get('ipacertificatesubjectbase')[0] if config.kra_host_name is None: config.kra_host_name = service.find_providing_server( 'KRA', api.Backend.ldap2, api.env.ca_host) try: kra.install_check(api, config, self.options) except RuntimeError as e: raise admintool.ScriptError(str(e)) print(dedent(self.INSTALLER_START_MESSAGE)) try: kra.install(api, config, self.options) except: logger.error('%s', dedent(self.FAIL_MESSAGE)) raise api.Backend.ldap2.disconnect()
def run(self): super(KRAInstaller, self).run() if not cainstance.is_ca_installed_locally(): raise RuntimeError("Dogtag CA is not installed. " "Please install the CA first") # check if KRA is not already installed _kra = krainstance.KRAInstance(api) if _kra.is_installed(): raise admintool.ScriptError("KRA already installed") # this check can be done only when CA is installed self.installing_replica = dogtaginstance.is_installing_replica("KRA") self.options.promote = False if self.installing_replica: domain_level = dsinstance.get_domain_level(api) if domain_level > DOMAIN_LEVEL_0: self.options.promote = True elif not self.args: raise RuntimeError("A replica file is required.") if self.args and (not self.installing_replica or self.options.promote): raise RuntimeError("Too many parameters provided. " "No replica file is required.") self.options.dm_password = self.options.password self.options.setup_ca = False conn = api.Backend.ldap2 conn.connect(bind_dn=DN(("cn", "Directory Manager")), bind_pw=self.options.password) config = None if self.installing_replica: if self.options.promote: config = ReplicaConfig() config.master_host_name = None config.realm_name = api.env.realm config.host_name = api.env.host config.domain_name = api.env.domain config.dirman_password = self.options.password config.ca_ds_port = 389 config.top_dir = tempfile.mkdtemp("ipa") config.dir = config.top_dir else: config = create_replica_config(self.options.password, self.replica_file, self.options) if config.subject_base is None: attrs = conn.get_ipa_config() config.subject_base = attrs.get("ipacertificatesubjectbase")[0] if config.master_host_name is None: config.kra_host_name = service.find_providing_server("KRA", conn, api.env.ca_host) config.master_host_name = config.kra_host_name else: config.kra_host_name = config.master_host_name try: kra.install_check(api, config, self.options) except RuntimeError as e: raise admintool.ScriptError(str(e)) print(dedent(self.INSTALLER_START_MESSAGE)) try: kra.install(api, config, self.options) except: self.log.error(dedent(self.FAIL_MESSAGE)) raise
def run(self): super(KRAInstaller, self).run() # Verify DM password. This has to be called after ask_for_options(), # so it can't be placed in validate_options(). try: installutils.validate_dm_password_ldap(self.options.password) except ValueError: raise admintool.ScriptError( "Directory Manager password is invalid") if not cainstance.is_ca_installed_locally(): raise RuntimeError("Dogtag CA is not installed. " "Please install a CA first with the " "`ipa-ca-install` command.") # check if KRA is not already installed _kra = krainstance.KRAInstance(api) if _kra.is_installed(): raise admintool.ScriptError("KRA already installed") # this check can be done only when CA is installed self.installing_replica = dogtaginstance.is_installing_replica("KRA") if self.installing_replica: domain_level = dsinstance.get_domain_level(api) if domain_level < DOMAIN_LEVEL_1: raise RuntimeError("Unsupported domain level %d." % domain_level) if self.args: raise RuntimeError("Too many parameters provided.") self.options.dm_password = self.options.password self.options.setup_ca = False self.options.setup_kra = True api.Backend.ldap2.connect() if self.installing_replica: config = ReplicaConfig() config.kra_host_name = None config.realm_name = api.env.realm config.host_name = api.env.host config.domain_name = api.env.domain config.dirman_password = self.options.password config.ca_ds_port = 389 config.top_dir = tempfile.mkdtemp("ipa") config.dir = config.top_dir config.setup_kra = True if config.subject_base is None: attrs = api.Backend.ldap2.get_ipa_config() config.subject_base = attrs.get('ipacertificatesubjectbase')[0] if config.kra_host_name is None: config.kra_host_name = find_providing_server( 'KRA', api.Backend.ldap2, [api.env.ca_host]) if config.kra_host_name is None: # all CA/KRA servers are down or unreachable. raise admintool.ScriptError( "Failed to find an active KRA server!") custodia = custodiainstance.get_custodia_instance( config, custodiainstance.CustodiaModes.KRA_PEER) else: config = None custodia = None try: kra.install_check(api, config, self.options) except RuntimeError as e: raise admintool.ScriptError(str(e)) print(dedent(self.INSTALLER_START_MESSAGE)) try: kra.install(api, config, self.options, custodia=custodia) except: logger.error('%s', dedent(self.FAIL_MESSAGE)) raise # pki-spawn restarts 389-DS, reconnect api.Backend.ldap2.close() api.Backend.ldap2.connect() # Enable configured services and update DNS SRV records service.sync_services_state(api.env.host) api.Command.dns_update_system_records() api.Backend.ldap2.disconnect()