Exemplo n.º 1
0
    def configure_httpd_wsgi_conf(self):
        """Configure WSGI for correct Python version (Fedora)

        See https://pagure.io/freeipa/issue/7394
        """
        conf = paths.HTTPD_IPA_WSGI_MODULES_CONF
        if sys.version_info.major == 2:
            wsgi_module = constants.MOD_WSGI_PYTHON2
        else:
            wsgi_module = constants.MOD_WSGI_PYTHON3

        if conf is None or wsgi_module is None:
            logger.info("Nothing to do for configure_httpd_wsgi_conf")
            return

        confdir = os.path.dirname(conf)
        if not os.path.isdir(confdir):
            os.makedirs(confdir)

        ipautil.copy_template_file(
            os.path.join(paths.USR_SHARE_IPA_DIR,
                         'ipa-httpd-wsgi.conf.template'), conf,
            dict(WSGI_MODULE=wsgi_module))

        os.chmod(conf, 0o644)
        self.restore_context(conf)
Exemplo n.º 2
0
    def setup_firefox_extension(self, realm, domain):
        """Set up the signed browser configuration extension
        """

        target_fname = paths.KRB_JS
        sub_dict = dict(REALM=realm, DOMAIN=domain)
        db = certs.CertDB(realm)
        with open(db.passwd_fname) as pwdfile:
            pwd = pwdfile.read()

        ipautil.copy_template_file(ipautil.SHARE_DIR + "krb.js.template",
            target_fname, sub_dict)
        os.chmod(target_fname, 0o644)

        # Setup extension
        tmpdir = tempfile.mkdtemp(prefix="tmp-")
        extdir = tmpdir + "/ext"
        target_fname = paths.KERBEROSAUTH_XPI
        shutil.copytree(paths.FFEXTENSION, extdir)
        if db.has_nickname('Signing-Cert'):
            db.run_signtool(["-k", "Signing-Cert",
                                "-p", pwd,
                                "-X", "-Z", target_fname,
                                extdir])
        else:
            root_logger.warning('Object-signing certificate was not found. '
                'Creating unsigned Firefox configuration extension.')
            filenames = os.listdir(extdir)
            ipautil.run([paths.ZIP, '-r', target_fname] + filenames,
                cwd=extdir)
        shutil.rmtree(tmpdir)
        os.chmod(target_fname, 0o644)
Exemplo n.º 3
0
    def setup_firefox_extension(self, realm, domain):
        """Set up the signed browser configuration extension
        """

        target_fname = paths.KRB_JS
        sub_dict = dict(REALM=realm, DOMAIN=domain)
        db = certs.CertDB(realm)
        with open(db.passwd_fname) as pwdfile:
            pwd = pwdfile.read()

        ipautil.copy_template_file(ipautil.SHARE_DIR + "krb.js.template",
            target_fname, sub_dict)
        os.chmod(target_fname, 0644)

        # Setup extension
        tmpdir = tempfile.mkdtemp(prefix="tmp-")
        extdir = tmpdir + "/ext"
        target_fname = paths.KERBEROSAUTH_XPI
        shutil.copytree(paths.FFEXTENSION, extdir)
        if db.has_nickname('Signing-Cert'):
            db.run_signtool(["-k", "Signing-Cert",
                                "-p", pwd,
                                "-X", "-Z", target_fname,
                                extdir])
        else:
            root_logger.warning('Object-signing certificate was not found. '
                'Creating unsigned Firefox configuration extension.')
            filenames = os.listdir(extdir)
            ipautil.run([paths.ZIP, '-r', target_fname] + filenames,
                cwd=extdir)
        shutil.rmtree(tmpdir)
        os.chmod(target_fname, 0644)
Exemplo n.º 4
0
    def __setup_autoconfig(self):
        target_fname = paths.PREFERENCES_HTML
        ipautil.copy_template_file(
            ipautil.SHARE_DIR + "preferences.html.template",
            target_fname, self.sub_dict)
        os.chmod(target_fname, 0o644)

        # The signing cert is generated in __setup_ssl
        db = certs.CertDB(self.realm, subject_base=self.subject_base)
        with open(db.passwd_fname) as pwdfile:
            pwd = pwdfile.read()

        # Setup configure.jar
        if db.has_nickname('Signing-Cert'):
            tmpdir = tempfile.mkdtemp(prefix="tmp-")
            target_fname = paths.CONFIGURE_JAR
            shutil.copy(paths.PREFERENCES_HTML, tmpdir)
            db.run_signtool(["-k", "Signing-Cert",
                            "-Z", target_fname,
                            "-e", ".html", "-p", pwd,
                            tmpdir])
            shutil.rmtree(tmpdir)
            os.chmod(target_fname, 0o644)
        else:
            root_logger.warning('Object-signing certificate was not found; '
                'therefore, configure.jar was not created.')

        self.setup_firefox_extension(self.realm, self.domain)
Exemplo n.º 5
0
    def configure_httpd_wsgi_conf(self):
        """Configure WSGI for correct Python version (Fedora)

        See https://pagure.io/freeipa/issue/7394
        """
        conf = paths.HTTPD_IPA_WSGI_MODULES_CONF
        if sys.version_info.major == 2:
            wsgi_module = constants.MOD_WSGI_PYTHON2
        else:
            wsgi_module = constants.MOD_WSGI_PYTHON3

        if conf is None or wsgi_module is None:
            logger.info("Nothing to do for configure_httpd_wsgi_conf")
            return

        confdir = os.path.dirname(conf)
        if not os.path.isdir(confdir):
            os.makedirs(confdir)

        ipautil.copy_template_file(
            os.path.join(
                paths.USR_SHARE_IPA_DIR, 'ipa-httpd-wsgi.conf.template'
            ),
            conf,
            dict(WSGI_MODULE=wsgi_module)
        )

        os.chmod(conf, 0o644)
        self.restore_context(conf)
Exemplo n.º 6
0
    def __setup_autoconfig(self):
        target_fname = paths.PREFERENCES_HTML
        ipautil.copy_template_file(
            ipautil.SHARE_DIR + "preferences.html.template",
            target_fname, self.sub_dict)
        os.chmod(target_fname, 0644)

        # The signing cert is generated in __setup_ssl
        db = certs.CertDB(self.realm, subject_base=self.subject_base)
        with open(db.passwd_fname) as pwdfile:
            pwd = pwdfile.read()

        # Setup configure.jar
        if db.has_nickname('Signing-Cert'):
            tmpdir = tempfile.mkdtemp(prefix="tmp-")
            target_fname = paths.CONFIGURE_JAR
            shutil.copy(paths.PREFERENCES_HTML, tmpdir)
            db.run_signtool(["-k", "Signing-Cert",
                            "-Z", target_fname,
                            "-e", ".html", "-p", pwd,
                            tmpdir])
            shutil.rmtree(tmpdir)
            os.chmod(target_fname, 0644)
        else:
            root_logger.warning('Object-signing certificate was not found; '
                'therefore, configure.jar was not created.')

        self.setup_firefox_extension(self.realm, self.domain)
Exemplo n.º 7
0
    def configure_http_gssproxy_conf(self, ipauser):
        ipautil.copy_template_file(
            os.path.join(paths.USR_SHARE_IPA_DIR, 'gssproxy.conf.template'),
            paths.GSSPROXY_CONF,
            dict(
                HTTP_KEYTAB=paths.HTTP_KEYTAB,
                HTTPD_USER=constants.HTTPD_USER,
                IPAAPI_USER=ipauser,
                SWEEPER_SOCKET=paths.IPA_CCACHE_SWEEPER_GSSPROXY_SOCK,
            ))

        os.chmod(paths.GSSPROXY_CONF, 0o600)
        self.restore_context(paths.GSSPROXY_CONF)
Exemplo n.º 8
0
    def configure_http_gssproxy_conf(self):
        ipautil.copy_template_file(
            os.path.join(paths.USR_SHARE_IPA_DIR, 'gssproxy.conf.template'),
            paths.GSSPROXY_CONF,
            dict(
                HTTP_KEYTAB=paths.HTTP_KEYTAB,
                HTTP_CCACHE=paths.HTTP_CCACHE,
                HTTPD_USER=constants.HTTPD_USER,
                IPAAPI_USER=IPAAPI_USER,
            )
        )

        os.chmod(paths.GSSPROXY_CONF, 0o600)
        self.restore_context(paths.GSSPROXY_CONF)
Exemplo n.º 9
0
    def configure_httpd_service_ipa_conf(self):
        """Create systemd config for httpd service to work with IPA
        """
        if not os.path.exists(paths.SYSTEMD_SYSTEM_HTTPD_D_DIR):
            os.mkdir(paths.SYSTEMD_SYSTEM_HTTPD_D_DIR, 0o755)

        ipautil.copy_template_file(
            os.path.join(ipautil.SHARE_DIR, 'ipa-httpd.conf.template'),
            paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF,
            dict(KRB5CC_HTTPD=paths.KRB5CC_HTTPD,
                 KDCPROXY_CONFIG=paths.KDCPROXY_CONFIG,
                 IPA_HTTPD_KDCPROXY=paths.IPA_HTTPD_KDCPROXY,
                 POST='-{kdestroy} -A'.format(kdestroy=paths.KDESTROY)))

        os.chmod(paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF, 0o644)
        self.restore_context(paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF)
Exemplo n.º 10
0
    def configure_httpd_service_ipa_conf(self):
        """Create systemd config for httpd service to work with IPA
        """
        if not os.path.exists(paths.SYSTEMD_SYSTEM_HTTPD_D_DIR):
            os.mkdir(paths.SYSTEMD_SYSTEM_HTTPD_D_DIR, 0o755)

        ipautil.copy_template_file(
            os.path.join(paths.USR_SHARE_IPA_DIR, 'ipa-httpd.conf.template'),
            paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF,
            dict(
                KDCPROXY_CONFIG=paths.KDCPROXY_CONFIG,
                IPA_HTTPD_KDCPROXY=paths.IPA_HTTPD_KDCPROXY,
                KRB5CC_HTTPD=paths.KRB5CC_HTTPD,
            ))

        os.chmod(paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF, 0o644)
        self.restore_context(paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF)
        self.systemd_daemon_reload()
Exemplo n.º 11
0
    def configure_httpd_service_ipa_conf(self):
        """Create systemd config for httpd service to work with IPA
        """
        if not os.path.exists(paths.SYSTEMD_SYSTEM_HTTPD_D_DIR):
            os.mkdir(paths.SYSTEMD_SYSTEM_HTTPD_D_DIR, 0o755)

        ipautil.copy_template_file(
            os.path.join(ipautil.SHARE_DIR, 'ipa-httpd.conf.template'),
            paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF,
            dict(
                KRB5CC_HTTPD=paths.KRB5CC_HTTPD,
                KDCPROXY_CONFIG=paths.KDCPROXY_CONFIG,
                IPA_HTTPD_KDCPROXY=paths.IPA_HTTPD_KDCPROXY,
                POST='-{kdestroy} -A'.format(kdestroy=paths.KDESTROY)
            )
        )

        os.chmod(paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF, 0o644)
        self.restore_context(paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF)
Exemplo n.º 12
0
    def configure_httpd_service_ipa_conf(self):
        """Create systemd config for httpd service to work with IPA
        """
        if not os.path.exists(paths.SYSTEMD_SYSTEM_HTTPD_D_DIR):
            os.mkdir(paths.SYSTEMD_SYSTEM_HTTPD_D_DIR, 0o755)

        ipautil.copy_template_file(
            os.path.join(paths.USR_SHARE_IPA_DIR, 'ipa-httpd.conf.template'),
            paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF,
            dict(
                KDCPROXY_CONFIG=paths.KDCPROXY_CONFIG,
                IPA_HTTPD_KDCPROXY=paths.IPA_HTTPD_KDCPROXY,
                KRB5CC_HTTPD=paths.KRB5CC_HTTPD,
            )
        )

        os.chmod(paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF, 0o644)
        self.restore_context(paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF)
        self.systemd_daemon_reload()
Exemplo n.º 13
0
    def setup_firefox_extension(self, realm, domain, force=False):
        """Set up the signed browser configuration extension

        If the extension is already set up, skip the installation unless
        ``force`` is true.
        """

        target_fname = '/usr/share/ipa/html/krb.js'
        if os.path.exists(target_fname) and not force:
            root_logger.info(
                '%s exists, skipping install of Firefox extension',
                target_fname)
            return

        sub_dict = dict(REALM=realm, DOMAIN=domain)
        db = certs.CertDB(realm)
        with open(db.passwd_fname) as pwdfile:
            pwd = pwdfile.read()

        ipautil.copy_template_file(ipautil.SHARE_DIR + "krb.js.template",
                                   target_fname, sub_dict)
        os.chmod(target_fname, 0644)

        # Setup extension
        tmpdir = tempfile.mkdtemp(prefix="tmp-")
        extdir = tmpdir + "/ext"
        target_fname = "/usr/share/ipa/html/kerberosauth.xpi"
        shutil.copytree("/usr/share/ipa/ffextension", extdir)
        if db.has_nickname('Signing-Cert'):
            db.run_signtool([
                "-k", "Signing-Cert", "-p", pwd, "-X", "-Z", target_fname,
                extdir
            ])
        else:
            root_logger.warning(
                'Object-signing certificate was not found. '
                'Creating unsigned Firefox configuration extension.')
            filenames = os.listdir(extdir)
            ipautil.run(['/usr/bin/zip', '-r', target_fname] + filenames,
                        cwd=extdir)
        shutil.rmtree(tmpdir)
        os.chmod(target_fname, 0644)
Exemplo n.º 14
0
    def setup_firefox_extension(self, realm, domain, force=False):
        """Set up the signed browser configuration extension

        If the extension is already set up, skip the installation unless
        ``force`` is true.
        """

        target_fname = '/usr/share/ipa/html/krb.js'
        if os.path.exists(target_fname) and not force:
            root_logger.info(
                '%s exists, skipping install of Firefox extension',
                    target_fname)
            return

        sub_dict = dict(REALM=realm, DOMAIN=domain)
        db = certs.CertDB(realm)
        with open(db.passwd_fname) as pwdfile:
            pwd = pwdfile.read()

        ipautil.copy_template_file(ipautil.SHARE_DIR + "krb.js.template",
            target_fname, sub_dict)
        os.chmod(target_fname, 0644)

        # Setup extension
        tmpdir = tempfile.mkdtemp(prefix="tmp-")
        extdir = tmpdir + "/ext"
        target_fname = "/usr/share/ipa/html/kerberosauth.xpi"
        shutil.copytree("/usr/share/ipa/ffextension", extdir)
        if db.has_nickname('Signing-Cert'):
            db.run_signtool(["-k", "Signing-Cert",
                                "-p", pwd,
                                "-X", "-Z", target_fname,
                                extdir])
        else:
            root_logger.warning('Object-signing certificate was not found. '
                'Creating unsigned Firefox configuration extension.')
            filenames = os.listdir(extdir)
            ipautil.run(['/usr/bin/zip', '-r', target_fname] + filenames,
                cwd=extdir)
        shutil.rmtree(tmpdir)
        os.chmod(target_fname, 0644)
Exemplo n.º 15
0
    def __setup_autoconfig(self):
        target_fname = '/usr/share/ipa/html/preferences.html'
        ipautil.copy_template_file(
            ipautil.SHARE_DIR + "preferences.html.template", target_fname,
            self.sub_dict)
        os.chmod(target_fname, 0644)

        # The signing cert is generated in __setup_ssl
        db = certs.CertDB(self.realm, subject_base=self.subject_base)
        with open(db.passwd_fname) as pwdfile:
            pwd = pwdfile.read()

        # Setup configure.jar
        tmpdir = tempfile.mkdtemp(prefix="tmp-")
        target_fname = '/usr/share/ipa/html/configure.jar'
        shutil.copy("/usr/share/ipa/html/preferences.html", tmpdir)
        db.run_signtool([
            "-k", "Signing-Cert", "-Z", target_fname, "-e", ".html", "-p", pwd,
            tmpdir
        ])
        shutil.rmtree(tmpdir)
        os.chmod(target_fname, 0644)

        self.setup_firefox_extension(self.realm, self.domain, force=True)
Exemplo n.º 16
0
    def __setup_autoconfig(self):
        target_fname = '/usr/share/ipa/html/preferences.html'
        ipautil.copy_template_file(
            ipautil.SHARE_DIR + "preferences.html.template",
            target_fname, self.sub_dict)
        os.chmod(target_fname, 0644)

        # The signing cert is generated in __setup_ssl
        db = certs.CertDB(self.realm, subject_base=self.subject_base)
        with open(db.passwd_fname) as pwdfile:
            pwd = pwdfile.read()

        # Setup configure.jar
        tmpdir = tempfile.mkdtemp(prefix="tmp-")
        target_fname = '/usr/share/ipa/html/configure.jar'
        shutil.copy("/usr/share/ipa/html/preferences.html", tmpdir)
        db.run_signtool(["-k", "Signing-Cert",
                         "-Z", target_fname,
                         "-e", ".html", "-p", pwd,
                         tmpdir])
        shutil.rmtree(tmpdir)
        os.chmod(target_fname, 0644)

        self.setup_firefox_extension(self.realm, self.domain, force=True)