File: //usr/lib/python3.9/site-packages/ipaclient/install/__pycache__/client.cpython-39.opt-1.pyc
a
�N(iG � @ s: d Z ddlmZmZ ddlZddlZddlZddlZddlZddl Z ddl
Z
ddl Z ddl Z ddl
Z
ddlZddlZddlZddlZddlZddlZddlmZ ddlmZmZ ddlmZmZm Z ddlm Z ddl m Z m Z m!Z! dd l"m#Z#m$Z$m%Z% dd
l"m&Z' dd l(m)Z)m*Z* dd l+m,Z,m-Z-m.Z. dd
l/m0Z0m1Z1 ddl2m3Z3 ddl4m5Z5m6Z6m7Z7m8Z8 ddl9m:Z: ddl;m<Z< ddl=m>Z> ddl?m@Z@ ddlAmBZBmCZCmDZDmEZEmFZF ddlGmHZH ddlImJZJ ddlKmLZL ddlMmNZNmOZOmPZP ddlQmRZR ddlSmTZTmUZUmVZVmWZW ddlXmYZY dd lAmZZZ dd l[m\Z\ d d l]m^Z^m_Z_m`Z` dd lambZb dd!lcmdZd eed�Zfe�geh�ZidZjd Zkd"Zld#Zmd$Znd%Zoda&dapdaqd&ardasdatdaudavdawdaxdaydazd'd(� Z{d)d*� Z|d+d,� Z}d-d.� Z~d/d0� Zd1d2� Z�d3d4� Z�e>j�ekfd5d6�Z�d7d8� Z�d�d9d:�Z�d�d=d>�Z�d?d@� Z�dAdB� Z�dCdD� Z�dEdF� Z�dGdH� Z�dIdJ� Z�dKdL� Z�d�dMdN�Z�dOdP� Z�dQdR� Z�dSdT� Z�d�dUdV�Z�dWdX� Z�dYdZ� Z�d[d\� Z�d]d^� Z�d_d`� Z�dadb� Z�dcdd� Z�dedf� Z�dgdh� Z�didj� Z�dkdl� Z�d�dmdn�Z�dodp� Z�dqZ�drZ�dsZ�dtZ�e>j�Z�e>j�Z�dudv� Z�dwdx� Z�dydz� Z�d{d|� Z�d}d~� Z�dd�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�Z�d�Z�d�Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�e{d�d�� �Z�d�d�� Z�d�d�� Z�d�d�� Z�eNG d�d�� d�e'j�e%j�e`jȃ�Z�eNG d�d�� d�e%jʃ�Z�G d�d�� d�e�e�e^j̃Z�dS )�z\
IPA client install module
Provides methods for installation, uninstallation of IPA client
� )�print_function�absolute_importN)�RawConfigParser)�urlparse�
urlunparse)�api�errors�x509)�
sysrestore)�FQDN� IPAAPI_USER�MAXHOSTNAMELEN)�
certmonger� certstore�service)�hostname)�is_ipa_client_configured�is_ipa_configured)� kinit_keytab�kinit_password� kinit_pkinit)� enroll_only� prepare_only)�%delete_persistent_client_session_data)�normalize_hostname�,no_matching_interface_for_ip_address_warning�validate_hostname�verify_host_resolvable)�services)� constants)�paths)�tasks)�certdb�kernel_keyring�ipaldap�ipautil�dnsutil)� ScriptError)�DN)�typing)�group�knob� extend_knob)�step)�CalledProcessError�realm_to_suffix�run�
user_input)� SSHPublicKey��version)�SetseboolError� )� automount�timeconf�sssd)� discovery)�
IPAChangeConf� � � zB/bin:/sbin:/usr/kerberos/bin:/usr/kerberos/sbin:/usr/bin:/usr/sbinFc s � fdd�}|S )Nc s� t �� \}}t�|� t jdd�}||d< ||d< � | |� tj�dd � zt�|� W n tyv t �
d|� Y n0 zt� |� W n ty� Y n0 t |d � d S )NZkrbcc)�prefix�krb_name�
ccache_dir� KRB5_CONFIGzCould not remove %s�.ipabkp)
�tempfileZmkstemp�os�closeZmkdtemp�environ�pop�remove�OSError�logger�error�rmdir� remove_file)�options�tdict�fdr@ rA ��func� �</usr/lib/python3.9/site-packages/ipaclient/install/client.py�innerk s
zcleanup.<locals>.innerrT )rS rV rT rR rU �cleanupj s rW c
C sj zt �| � W nV tyd } z>|jdkr6W Y d}~dS t�d| |� t�d| � W Y d}~n
d}~0 0 dS )z�
Deletes a file. If the file does not exist (OSError 2) does nothing.
Otherwise logs an error message and instructs the user to remove the
offending file manually
:param filename: name of the file to be removed
r< Nz Failed to remove file %s: %szKPlease remove %s manually, as it can cause subsequent installation to fail.)rE rI rJ �errnorK rL )�filename�erT rT rU rN � s
�rN c C s t �d| |t|�� d S )Nz%s failed to %s: %s)rK rL �str)�name�actionrL rT rT rU �log_service_error� s r^ c C s6 | dur | S t j�tj�r2t �tj�jdkr2tjS dS )z�
If a CA certificate is passed in on the command line, use that.
Else if a CA file exists in paths.IPA_CA_CRT then use that.
Otherwise return None.
Nr )rE �path�existsr �
IPA_CA_CRT�stat�st_size)Z cert_pathrT rT rU �
get_cert_path� s �rd c C s< | � � }| �� }|s|r8|�| jd|� |�| jd|� d S )N�enabled�running)�
is_enabled�
is_running� backup_state� service_name�r �
statestorere rf rT rT rU �
save_state� s
rm c C s� |� | jd�}|� | jd�}|rNz | �� W n tyL t�d| j� Y n0 |r�z | �� W n ty~ t�d| j� Y n0 d S )Nre rf �6Failed to configure automatic startup of the %s daemonz Failed to restart the %s daemon)�
restore_staterj �enable� ExceptionrK �warning�startrk rT rT rU ro � s$ �
�ro c
C s� dt jt jt jgt jgd�dt jgd�g} i }d}| D ]j}g ||d < dD ]T}z<|| D ].}tj�|�rX||d � |� |dkrXd }qXW qJ t
y� Y qJ0 qJq6||fS )
z�Checks whether nss_ldap or nss-pam-ldapd is installed.
If anyone of mandatory files was found returns True and list of all files
found.
�configure_ldap_conf)�function� mandatory�optional�configure_nslcd_conf)ru rv Fru )rv rw rv T) r � LDAP_CONFZ
NSS_LDAP_CONFZLIBNSS_LDAP_CONFZ
PAM_LDAP_CONFZ
NSLCD_CONFrE r_ �isfile�append�KeyError)Zfiles_to_checkZ files_foundZretvalru Z file_typerY rT rT rU �nssldap_exists� s2 �� ��
r} c C s� t j�| �sdS t�d�}t� }t| ��<}|D ]&}|�|�}|d ur.|�|� d�� q.W d � n1 sj0 Y |r�t
d� | d� t
|���|d��ndS d S )NFz^\s*(PORT|HOST).*r6 z4'{}' contains deprecated and unsupported entries: {}�, ��rvalT)rE r_ rz �re�compile�set�open�match�addr* r' �format�join�sorted)�confZ
error_rval�patZ unsupported�f�line�morT rT rU �check_ldap_conf� s"
0��r� c C s� z�t � � } | �� | �� }d}|D ]H}| �|�}z |�d�}|dkrN|}W qlW q" t jyh Y q"Y q"0 q"|dur�| �|� | �� n
t� d� W n t
y� t� d� Y n0 dS )zIHelper function for uninstall.
Deletes IPA domain from sssd.conf
N� id_provider�ipazNIPA domain could not be found in /etc/sssd/sssd.conf and therefore not deletedzKIPA domain could not be deleted. No access to the /etc/sssd/sssd.conf file.) �
SSSDConfig�
import_config�list_active_domains�
get_domain�
get_option�
NoOptionErrorZ
delete_domain�writerK rr �IOError)�
sssdconfig�domainsZipa_domain_namer\ �domain�providerrT rT rU �delete_ipa_domain s0
� �r� c C s t jdtdd� t| �S )a
Consider IPA client not installed if nothing is backed up
and default.conf file does not exist. If on_master is set to True,
the existence of default.conf file is not taken into consideration,
since it has been already created by ipa-server-install.
z+Use 'ipalib.facts.is_ipa_client_configured'r< ��
stacklevel)�warnings�warn�DeprecationWarningr �� on_masterrT rT rU �is_ipa_client_installed0 s �r� TrT c C s$ t jdtdd� t�| |||||�S )a:
This function was deprecated. Use ipaplatform.tasks.
Edits the specified nsswitch.conf database (e.g. passwd, group, sudoers)
to use the specified service(s).
Arguments:
fstore - FileStore to backup the nsswitch.conf
database - database configuration that should be ammended,
e.g. 'sudoers'
service - list of services that should be added, e.g. ['sss']
preserve - if True, the already configured services will be preserved
The next arguments modify the behaviour if preserve=True:
append - if True, the services will be appended, if False, prepended
default_value - list of services that are considered as default (if
the database is not mentioned in nsswitch.conf), e.g.
['files']
z7Use ipaplatform.tasks.tasks.configure_nsswitch_databaser< r� )r� r� r� r! �configure_nsswitch_database)�fstoreZdatabaser Zpreserver{ Z
default_valuerT rT rU r� ? s �
�r� c
C s� t d�}|�d� |�d� dddd�|�� g}|�d|�|�d|�|�d |�|�d
|d �|�d |�|�d
d�t�|d ���|�dd�g}|�|� d|�|�� g� t
j } | � | � |�
| |� t�| d� d S )N�
IPA Installer� = ��[�]�comment�#File modified by ipa-client-install�r\ �type�value�basedn�realmr� �serverr �hostZ
xmlrpc_urizhttps://{}/ipa/xml� enable_ra�True�global� )r; �setOptionAssignment�setSectionNameDelimiters� emptyLine� setOptionr� r% �
format_netloc�extend�
setSectionr �IPA_DEFAULT_CONF� backup_file�newConfrE �chmod)
r� �
cli_basedn� cli_realm�
cli_domain�
cli_serverr Zipaconf�optsZdefopts� target_fnamerT rT rU �configure_ipa_conf] s:
��
��
�
�
r� c C sB t � } | �tj� | �ddd� ttjd�}| �|� |�� dS )z�Set the enable_ra option in /etc/ipa/default.conf to False
Note that api.env will retain the old value (it is readonly).
r� r� �False�wN)r �readr r� r� r� r� rF )�parser�fprT rT rU �
disable_ra� s
r� c C s� t d�}|�d� dddd�|�� |�dd�|�d|�|�� |�d d
jtd d |�d
d��|�dd
jtdd |�d
d��|�dd�|�dd�|�dd�|�� |�dd�|�dd�|�dd �|�d d �|�� g} |r�|js�|j�r|jr�| �|�d d �� n"| �|�d d!�t �
|d" ���� n| �|�d#|�� | �|�� � |D ]h}
z| � |
� |� |
| � W nF t
�y� } z,t�d$|
t| �� d%d&|
fW Y d } ~ S d } ~ 0 0 �q>|�r�d"d&d'�|�fS d(S ))Nr� � r� r� r� � ldap_version�3�baseZnss_base_passwdz {dn}{suffix}��cnZusers�r� Zaccountsz?sub)Zdn�suffixZnss_base_group�r� �groupsZ
nss_schemaZ
rfc2307bisZnss_map_attributezuniqueMember memberZnss_initgroups_ignoreusersz root,dirsrvZnss_reconnect_maxsleeptime�8Znss_reconnect_sleeptime�1Zbind_timelimit�5� timelimit�15�uri�ldap://localhost� ldap://{}r Znss_srv_domain�Creation of %s failed: %sr6 �LDAPr~ �r NN)r; r� r� r� r� r( �forcer� r{ r% r� r� r� rq rK rL r[ r� ) r� r� r� r� r� �dnsokrO �files�ldapconfr� rY rZ rT rT rU rt � sd
�
��
��
� �
(rt c
C s t d�}|�d� dddd�|�� |�dd�|�d|�|�� |�d ttd
d |���|�d ttd
d |���|�dd�|�� g } |r�|js�|jr�|jr�| �|�dd�� q�| �|�dd� t
� |d ���� n| �|�dd�� | �|�� � |D ]\}
z| � |
� |�
|
| � W q� t�yH } z"t�d|
t| �� W Y d } ~ dS d } ~ 0 0 q�tjj} | �� �r�z | �� W n4 t�y� } zt| jd| � W Y d } ~ n
d } ~ 0 0 z | �� W n: t�y� } z t�d| jt| �� W Y d } ~ n
d } ~ 0 0 nt�d| j� dS ddd �|�fS ) Nr� r� r� r� r� r� r� r� z base passwdr� r� z
base groupr� r� r� r� r� r� r ZDNSr� )r6 NN�restartz7Failed to enable automatic startup of the %s daemon: %s�.%s daemon is not installed, skip configurationr� ZNSLCDr~ )r; r� r� r� r[ r( r� r� r{ r� r% r� r� r� rq rK rL r �
knownservices�nslcd� is_installedr� r^ rj rp �debugr� )
r� r� r� r� r� r� rO r� Z nslcdconfr� rY rZ r� rT rT rU rx � sj
�
�
�
� �
$
� �rx c C s� t d�}|�d� dddd�|�� dddd�dddd�dddd�ddd d�ddd
d�ddd d�ddd d�ddd
d�|�� |�� dddd�|d �d�dddt|�d�ddddd�g}tj}| �|� d}z|�||� W n� t �y& } z4t
� d|� t
� d|j|t|�d�� W Y d }~dS d }~0 t
�yr } z4t
� d |� t
� d|j|t|�d�� W Y d }~dS d }~0 t�y� } z(t
� d|j|t|�d�� W Y d }~dS d }~0 0 t�|d � d S ) Nr� )r� � r� z$ File modified by ipa-client-installr� z< We do not want to break your existing configuration, hence:z URI, BASE, and SASL_MECHz( have been added if they were not set.z@ In case any of them were set, a comment has been inserted andz9 "# CONF_NAME modified by IPA" added to the line above.z? To use IPA server with openLDAP tools, please comment out yourz; existing configuration for these options and uncomment thez& corresponding lines generated by IPA.Z addifnotsetZURI�optionz
ldaps://{}r )r] r\ r� r� ZBASEZ SASL_MECHZGSSAPIz%Configuring {path} failed with: {err}zCould not parse %s�%s)r_ �errFz%s does not exist.r� T)r; r� r� r� r[ r �OPENLDAP_LDAP_CONFr� �
changeConf� SyntaxErrorrK �infor� r� rq rE r� )r� r� r� r� r� r� Z error_msgrZ rT rT rU �configure_openldap_conf s�
��������� ����K
r� c C sj t j�tj�sdS td�}|�d� |�dd�t �
| d ���|� � g}|� tj|� t
�d| d � dS )ze
DNS Discovery didn't return a valid IPA server, hardcode a value into
the file instead.
Nr� r� r� r� r zHChanged configuration of /etc/ldap.conf to use hardcoded server name: %s)rE r_ rz r ry r; r� r� r� r% r� r� r� rK r� )r� r� r� rT rT rU �hardcode_ldap_server{ s
���r� c C sJ t j�tjt j�tj�d �} t�| tj� t � tjd� t
� tj� d S )Nz .templater� ) rE r_ r� r ZUSR_SHARE_IPA_CLIENT_DIR�basenameZ KRB5_FREEIPA�shutil�copyr� r! Zrestore_context)�templaterT rT rU �configure_krb5_snippet� s �r c
C s� t � td�}
|
�d� |
�d� |
�d� |
�d� dddd�|
�� g} tj� t
j �rp| � d d
t
j d d �g� |
�
d
| �g} |r�|r�|r�| � |
�
dd�g� n| � |
�
dd�g� | � |
�
dd�|
�
dd�|
�
dd�|
�
dd�|
�
dd�|
�
dd�g� t�� �r t�d� | �|
�
dd�� | � |
�d | �|
�� g� g }
|�rP|�rP|�r�|D ]X}|
� |
�
d t�|d ��|
�
d t�|d ��|
�
d t�|d!��|
�
d"t�|d#��g� �qT|
�|
�
d$|�� |
�|
�
d%d&t
j �� |
�|
�
d'd&t
j �� | d(|
d�g}| �|
�d)|�� | �|
�� � |
�
d*�|�| �|
�
|| �|
�
|| �g}||k�rt|� |
�
d*�|�| �|
�
|| �g� | � |
�d+|�|
�� g� t�d,|� t�d-|
�| �� |
�|| � t�|d.� d S )/Nr� )r� r� r� )�{�})� z � r� r� r� Z
includedirr� r� )r\ r� r� �delimZ
default_realmZdns_lookup_realmZfalse�trueZrdnsZdns_canonicalize_hostnameZdns_lookup_kdcZticket_lifetimeZ24hZ forwardableZudp_preference_limit�0z"Enabling persistent keyring CCACHEZdefault_ccache_namezKEYRING:persistent:%{uid}Z libdefaults�kdc�X Z
master_kdcZ admin_serveri� Zkpasswd_serveri� Zdefault_domain�pkinit_anchorszFILE:%sZ pkinit_poolZ
subsectionZrealmsz.{}Z domain_realmz%Writing Kerberos configuration to %s:r� r� ) r r; r� r� ZsetSubSectionDelimitersZ setIndentr� rE r_ r` r ZCOMMON_KRB5_CONF_DIRr� r� r# Z is_persistent_keyring_supportedrK r� r{ r� r% r� �KDC_CA_BUNDLE_PEM�
CA_BUNDLE_PEMr� �dumpr� r� )r� r� r� �cli_kdcr� rY �
client_domain�client_hostnamer� �configure_sssdZkrbconfr� ZliboptsZkroptsr� ZroptsZdroptsrT rT rU �configure_krb5_conf� s�
�� ��
�
�
�
�
�
�
�
�
��
�����
�
�
� r c
C sn t jj}|jsXz |�� W n8 tyR } z t�d|jt |�� W Y d }~n
d }~0 0 d S |sjt�
d� d S d||f }|j r�t� |� z|�
� |�� W nB ty� } z*t�d|jt |�� t�
d� W Y d }~n
d }~0 0 t td|f|��} tj�tjd�}
z"tjtjdd | |g||
d
d � W nF t�yh } z,t�d � td
�|j|�td��W Y d }~n
d }~0 0 d S )Nz1Failed to conditionally restart the %s daemon: %szGAn RA is not configured on the server. Not requesting host certificate.�
host/%s@%sz:Failed to configure automatic startup of the %s daemon: %sz6Automatic certificate management will not be available�CNz pwdfile.txtZNSSDB�Local IPA host�x )ZcertpathZstorage�nickname�subject�dns� principal� passwd_fnameZresubmit_timeoutzcertmonger request failedz*{} request for host certificate failed: {}r )r r� r � request_certZ try_restartrq rK rL rj r[ rr r Zadd_principal_to_casrp rs r( rE r_ r� r �
IPA_NSSDB_DIRZrequest_and_wait_for_cert� exceptionr' r� �CLIENT_INSTALL_ERROR) r� � subject_baser� r rO �
ca_enabled�cmongerrZ r r r rT rT rU �configure_certmonger s`
�
���
��r# c
C s> zt � � }|�� W n� ty� } z�tj�tj�rj|jrjt �
dt |�� t �
d� t � d� W Y d }~dS t
|t�rvnt �
d� t � d� t �d� t � � }|�� W Y d }~n
d }~0 0 z|�|�} W nF t j�y t � d|� t � d� t � � }|�� |�|�} Y n0 |j�r t|� |j�r8tj�tj��sP|j�r�tj�tj��r�z|�d � W nH t j�yt Y n4 t j �y� t �
d
� t � d � t � d � Y n0 |� d � |j �rz|�d
� W n4 t j�y� Y n t j �y� t �
d� Y n0 |� d
� t � | � | �!dd� |j�s<||k�r<| �"d|� |j�sx|j#�r`| �"dd�$|�� n| �"ddd�$|� � nb| �"dd� | �"d|d � z|�%d�}
W n t j&�y� |�d�}
Y n0 |
�"dd� |�'|
� t(|d� t(|d� |j�r t(|d � | �"d |� | �"d |� |�)� |�)� k�r6| �"d |� | �!dd � | �!dd � |j*�sd| �!dd!� n | �!d"d!� | �"d#d$� | �"d%tj+� |j,�r| �"d&d$� |j-�r�t t.t/�0|d ��d �} | �"d'd(�1| |d �� |j2�r�| �"d)d*� nt3|d �} | �"d)| � |j4�r| �"d+d$� | �5d$� |�6| � |�7tj� dS ),Nz+SSSD config exists but cannot be parsed: %sz/Was instructed to preserve existing SSSD configz=Correct errors in /etc/sssd/sssd.conf and re-run installationr6 zxUnable to parse existing SSSD config. As option --preserve-sssd was not specified, new config will override the old one.zOThe old /etc/sssd/sssd.conf is backed up and will be restored during uninstall.z New SSSD config will be createdzLDomain %s is already configured in existing SSSD config, creating a new one.Zsshz2Unable to activate the SSH service in SSSD config.z@Please make sure you have SSSD built with SSH support installed.z6Configure SSH support manually in /etc/sssd/sssd.conf.�sudoz3Unable to activate the SUDO service in SSSD config.r� �idZdns_discovery_domainZ
ipa_serverr~ z _srv_, %sZipa_server_moder� r ZnssZmemcache_timeoutiX Zpam�
ipa_domain� ipa_hostnameZ
krb5_realmZauthZchpass�access�permitZcache_credentialsTZldap_tls_cacert�
dyndns_updateZ
dyndns_serverzdns+tls://{}:853#{}Z dyndns_iface�*Z krb5_store_password_if_offline)8r� r� rq rE r_ r` r � SSSD_CONFZ
preserve_sssdrK rL r[ r� �
isinstancer� r� Z
new_configZ
new_domainZDomainAlreadyExistsErrorr� �sssd_enable_ifp�conf_sshrz �
SSH_CONFIG� conf_sshd� SSHD_CONFIG� new_service�ServiceAlreadyExists�ServiceNotRecognizedError�activate_service� conf_sudor! Zenable_sssd_sudoZ add_provider�
set_option�primaryr� � get_serviceZNoServiceError� save_service�sssd_enable_service�lowerr) ra � dns_updates� dns_over_tls�listr& �resolve_ip_addressesr� �all_ip_addresses� get_server_connection_interface�krb5_offline_passwordsZ
set_active� save_domainr� )
r� r� r� r� rO r r r� rZ r� Z nss_service� server_ip�ifacerT rT rU �configure_sssd_confX s ���
��
��� �� ����
�
�
��
�
rH c C sp z| � |� W nL tjy" Y n: tjyZ t�d|� t�d|� t�d|� Y d S 0 | �|� | �|�S )Nz3Unable to activate the '%s' service in SSSD config.z?Please make sure you have SSSD built with %s support installed.z5Configure %s support manually in /etc/sssd/sssd.conf.) r3 r� r4 r5 rK rL r� r6 r: )r� r\ rT rT rU r< s$ ���
r< c C s� t | d�}|du rdS z|�d�}W n tjy> t� }Y n0 dd� |�d�D �}|�ddh�rl|�d� |�t� |r�|�t j
� |� dd � t
|��� | �|� dS )
a Enable and configure libsss_simpleifp plugin
Allow the ``ipaapi`` user to access IFP. In case allow_httpd is true,
the Apache HTTPd user is also allowed to access IFP. For smart card
authentication, mod_lookup_identity must be allowed to access user
information.
ZifpNZ allowed_uidsc S s h | ]}|� � r|� � �qS rT )�strip)�.0�srT rT rU � <setcomp>' � z"sssd_enable_ifp.<locals>.<setcomp>�,r �rootr~ )r< r� r� r� r� �split�
isdisjointr� r r Z
HTTPD_USERr8 r� r� r; )r� Z allow_httpdr ZuidsrT rT rU r. s
r. c
C s� |sdS zt | d�}W n8 tyN } z t�d| t|�� W Y d }~dS d }~0 0 tdd� |D ��}tdd� |D ��}g }d}|D ]j} | �d�} | �� }
|
r�|
�d �r�|� | � q�|
�
� d
� � } | |v r�d} q�| |v r�d | } |� | � q�|� � D ]&\} } | d u� r�|� d | | f � � q�|�r6|� d � |� | � |D ]} | �d�} |� | � �q:|� d � |�
� zt | d
�}W n: t�y� } z t�d| t|�� W Y d }~dS d }~0 0 |�d�|�� |�
� dS )NT�r�Failed to open '%s': %sFc s s | ]}|� � V qd S �N�r= �rJ �keyrT rT rU � <genexpr>> rM z$change_ssh_config.<locals>.<genexpr>c s s | ]}|� � V qd S rT rU rV rT rT rU rX ? rM �
�#r z%s %sr r� )r� r� rK rL r[ �tuple�rstriprI �
startswithr{ rP r= �itemsrF r� r� )
rY �changesZsectionsr� rZ Z change_keysZ section_keys�linesZ
in_sectionr� Zpliner� r� rT rT rU �change_ssh_config4 sV
ra c C s^ t j�tj�s t�dtj� d S | �tj� dd� }|� rDt|� nt |� t�dtj� d S )N�$%s not found, skipping configurationc S sX t tjd��8} | D ]"}t�d|�r W d � dS qW d � n1 sJ0 Y dS �NrR z
^Include\sTF)r� r r0 r� r� �r� r� rT rT rU � ssh_version_supports_includeq s
2z:configure_ssh_config.<locals>.ssh_version_supports_include�
Configured %s)
rE r_ rz r r0 rK r� r� �create_ssh_ipa_config�modify_ssh_config)r� rO re rT rT rU �configure_ssh_configj s
ri c C s� ddi}t | jo tj�tj��}t | jo:tj�tj�o:| �}| jrV|rVdtj |d< | jrx|rxdtj |d< tj|d< | j r�d|d< t
tj |d d
g� d S ) N�PubkeyAuthentication�yesz%s %%HZKnownHostsCommandz
%s -p %%p %%hZ ProxyCommandZGlobalKnownHostsFileZVerifyHostKeyDNSZHost�Match) �boolr9 rE r_ rz r �SSS_SSH_KNOWNHOSTS�SSS_SSH_KNOWNHOSTSPROXY�SSSD_PUBCONF_KNOWN_HOSTS� trust_sshfpra r0 )rO r_ �enableknownhosts� enableproxyrT rT rU rh � s, ��
��
��
rh c C s� t | jotj�tj��}t | jo2tj�tj�o2| �}t� tj�
tj �tj t
|rTdndtj|rbdndtjtj| jrvdndd�� t�tj d� dS )zAdd the IPA snippet for sshr rZ )ZENABLEKNOWNHOSTSZKNOWNHOSTSCOMMANDZ ENABLEPROXYZKNOWNHOSTSPROXYZ
KNOWNHOSTSZVERIFYHOSTKEYDNSr� N)rm r9 rE r_ rz r rn ro r% �copy_template_filer� ZSSH_IPA_CONFIG_TEMPLATE�SSH_IPA_CONFIG�dictrp rq r� )rO rr rs rT rT rU rg � s( ��
�� rg c
C s� t jj}tj�tj�s(t� dtj� d S | �
tj� dd� }|� rLt |� nt |� |�
� r�z |�� W n2 ty� } zt|jd|� W Y d }~n
d }~0 0 d S )Nrb c S sX t tjd��8} | D ]"}t�d|�r W d � dS qW d � n1 sJ0 Y dS rc )r� r r2 r� r� rd rT rT rU � sshd_version_supports_include� s
2z<configure_sshd_config.<locals>.sshd_version_supports_includer� )r r� �sshdrE r_ rz r r2 rK r� r� �create_sshd_ipa_config�modify_sshd_configrh r� rq r^ rj )r� rO rx rw rZ rT rT rU �configure_sshd_config� s
r{ c C s� dddddd�}| j r�tj�tj�r�d }tjdd�tjdd�dtj dd�f}|D ]Z}tjd d
tjg}|�� D ] }|� d � |� d | � qnt
j |d
d�}|j dkrR|} q�qR|d ur�|�
|� n
t�d� ttj|dg� t�dtj� d S )Nrk �no)rj ZKerberosAuthenticationZGSSAPIAuthenticationZUsePAMZ ChallengeResponseAuthenticationZnobody)�AuthorizedKeysCommandZAuthorizedKeysCommandUser)r} ZAuthorizedKeysCommandRunAsz%s %%u)Z PubKeyAgentZPubKeyAgentRunAsz-t�-f�-oz%s=%sF)�
raiseonerrr z�Installed OpenSSH server does not support dynamically loading authorized user keys. Public key authentication of IPA users will not be available.rl rf )r9 rE r_ rz r �SSS_SSH_AUTHORIZEDKEYSZSSHD�devnullr^ r{ r% r0 �
returncode�updaterK rr ra r2 r� )rO r_ Zauthorized_keys_changesZ
candidates� candidate�args�item�resultrT rT rU rz � sD �����
�rz c C s\ d}| j r*tj�tj�r*t�d��tj�}t �
tj� tj �tj
t|d�� t�dtj
� dS )z Add the IPA snippet for sshdr zZ AuthorizedKeysCommand {}
AuthorizedKeysCommandUser nobody
)ZSSSD_SSHD_OPTIONSrf N)r9 rE r_ rz r r� �textwrap�dedentr� r% rt r� ZSSHD_IPA_CONFIG_TEMPLATE�SSHD_IPA_CONFIGrv rK r� )rO Zsssd_sshd_optionsrT rT rU ry s
� ��ry c
C s� t �d� tjddd| jg}| jr6|�d| jd g� | jsF|�d� |� dd d
� z`z t
|�}W n4 t y� } z t � d t
|�� W Y d }~nd }~0 0 t �d |j� W |�dd � n|�dd � 0 d S )
Nz
Configuring automount:�--debugz-Uz
--locationz--serverr z --no-sssd� installationr7 Tz"Automount configuration failed: %sr� )rK r� r �IPA_CLIENT_AUTOMOUNT�locationr� r� r9 r{ ri r0 rq rL r[ Z
output_log� delete_state)rO rl r� r� rZ rT rT rU �configure_automount s
�
&r� c C s� | j p|}t�d|� d}tj�tj�rXztj tjgdd�}W n t
yP Y n0 |j }|� dd|� |� ddt
jj�� � t�|� t
jj�� t
jj�� d S ) Nz Configuring %s as NIS domain.r T�Zcapture_output�network� nisdomain�
domainnamere )r� rK r� rE r_ r` r ZBIN_NISDOMAINNAMEr% r0 r. �outputri r r� r� rg r! �
set_nisdomainrp r� )rO r� rl Znis_domain_namer� rT rT rU �configure_nisdomain3 s(
�
�
r� c C s` | � d�r@| �dd�pd}|r,t�d|� n
t�d� t�|� | �dd�}|s\tjj� � d S )Nr� r� r zRestoring %s as NIS domain.z Unconfiguring the NIS domain.r� re )
� has_statero rK r� r! r� r r� r� �disable)rl Z
old_nisdomainre rT rT rU �unconfigure_nisdomainU s
r� c C sh t �� D ]N}t �|�}t jt jfD ]2}|�|g �D ] }|d | kr2| S q2q"qtd| ��d S )N�addrz$IP %s not assigned to any interface.)� netifaces�
interfaces� ifaddresses�AF_INET�AF_INET6�get� RuntimeError)Zip_addr� interface�if_addrs�family�iprT rT rU �get_iface_from_ipg s
r� c
C s� | r | g}nt �� }g }|D ]�}t �|�}t jt jfD ]p}|�|g �D ]^}z(|�t�|d �� t �
d|d � W qF t y� } zt �
d|� W Y d }~qFd }~0 0 qFq6q |S )Nr� zIP check successful: %szIP check failed: %s) r� r� r� r� r� r� r{ r% �CheckedIPAddressrK r� �
ValueError)rG r� �ipsr� r� r� r� rZ rT rT rU �get_local_ipaddressesq s
(r� c
C s~ t �dt� t �d| � ttd��}|�| � W d � n1 sB0 Y d}z@|jrvt�tj dddd|d tg� nt�tj d tg� d
}W �n� t
�yT } �z�t �d t |�� �zR|jr�t�tj dddd|d tg� nt�tj tg� z�t � � }|�
� |�� }|D ]�}|�|�} z| �d �}
W n t j�yB Y �q
Y n0 |tjjk�r
|
d
k�r
z>| �d�d
u �r�| �dd� |�| � |�tj� W �q�W n t j�y� Y �q�Y n0 �q
W n@ t�y } z&t �dt |�� t �d� W Y d }~n
d }~0 0 d
}W n6 t
�y> } z t �dt |�� W Y d }~n
d }~0 0 W Y d }~n
d }~0 0 zt�t� W n t�yx Y n0 |S )Nz Writing nsupdate commands to %s:r� r� Fz-pZ853z-Sz-Hz-gTz nsupdate (GSS-TSIG) failed: %sr� r� r* Z dyndns_authZnonez'Unable to update SSSD configuration: %sz{Failed to configure SSSD for unauthenticated DNS dynamic updates. SSSD might be unable to update DNS entries for this host.z#Unauthenticated nsupdate failed: %s) rK r� � UPDATE_FILEr� r� r? r% r0 r ZNSUPDATEr. r[ r� r� r� r� r� r� r �envr� r8 rE r, rq r� rE rI ) �
update_txtrO r� r� r� rZ r� r� r\ r� r� rT rT rU � do_nsupdate� sh (�
�
�<r� z)
update delete $HOSTNAME. IN A
show
send
z,
update delete $HOSTNAME. IN AAAA
show
send
z6
update add $HOSTNAME. $TTL IN A $IPADDRESS
show
send
z9
update add $HOSTNAME. $TTL IN AAAA $IPADDRESS
show
send
c
C s� z
t � }W n4 ty> } z t�d|� d }W Y d }~n
d }~0 0 |jr\|d u rVtd��|}n�|jr�g }|jD ]}|�t� |�� qln�z t
| �}W n2 ty� } zt�d|� W Y d }~d S d }~0 0 z t |�}W n4 t�y } zt�d|� W Y d }~d S d }~0 0 |�st� d� d S t |� d}|j
�r:|d| 7 }|t�tt|d��7 }|t�tt|d��7 }|D ]F}t||dd�} |jd k�r�t}
n|jd
k�r�t}
|t�|
| �7 }�qjt||| ��s�t�d � t||� d S ) Nz Cannot update DNS records. %sz!Unable to get local IP addresses.z2Failed to determine this machine's ip address(es).�debug
�server %s 853
)�HOSTNAME� )r� Z IPADDRESSZTTLr> � z Failed to update DNS records.)r� r. rK rL rB r� � ip_addressesr{ r% r� rC r� r r? � template_str�DELETE_TEMPLATE_Arv �DELETE_TEMPLATE_AAAAr4 �ADD_TEMPLATE_A�ADD_TEMPLATE_AAAAr� �verify_dns_update) r� r rO r� rZ Z
update_ipsr� rG r� Zsub_dictr� rT rT rU �
update_dns� s\
��
r� c
C sl dd� |D �}g }t jjt jjfD ]�}t�d| t j�|�� zt�| |�}W nd t j j
t j j fyt t�d� Y q" t j j y� t�d� Y q" t j
jy� t�d� Y q"0 |D ]4}z|�|j� W q� ty� |�|j� Y q�0 q�q"t j�| �}i }dd� |D �} |D ]�}
t|
�} t�d| � zt�| �}W nj t j j
t j j f�y` t�d� Y nx t j j �y� t�d � Y nX t j
j�y� t�d� Y n80 | �| � |D ]&}|j|k�s�|�| g ��|j� �q��q|�r�t�d
| d �|�� |�rt�d | d �|�� | �r(t�d
d �| �� |�rht�d� |�� D ]&\}
} | D ]}
t�d|
|
|� �qL�q@dS )zz
Verify that the fqdn resolves to all IP addresses and
that there's matching PTR record for every IP address.
c S s g | ] }t |��qS rT �r[ �rJ r� rT rT rU �
<listcomp> rM z%verify_dns_update.<locals>.<listcomp>z DNS resolver: Query: %s IN %szDNS resolver: No record.z0DNS resolver: No nameservers answered the query.zDNS resolver error.c S s g | ] }t |��qS rT r� r� rT rT rU r� 2 rM z DNS resolver: Query: %s IN PTRz/DNS resolver: No nameservers answered thequery.z)Missing A/AAAA record(s) for host %s: %s.r~ z'Extra A/AAAA record(s) for host %s: %s.z.Missing reverse record(s) for address(es): %s.z Incorrect reverse record(s):z"%s is pointing to %s instead of %sN) r Z rdatatype�AZAAAArK r� Zto_textr& �resolveZresolverZNoAnswerZNXDOMAINZ
NoNameserversr Z DNSExceptionrI �addressr� r{ r\ Z from_textr[ Zresolve_address�target�
setdefaultrr r� r^ )Zfqdnr� Z missing_ipsZ extra_ipsZ record_typeZanswersZrdataZ fqdn_nameZ
wrong_reverseZmissing_reverser� �ip_str�targetsr� rT rT rU r� sp �
�
��
�r� c
C s\ d}t �| dt jt j�D �] }|\}}}}}zt � |||�}W n6 t jyt } z | }W Y d} ~ qW Y d} ~ n
d} ~ 0 0 ztz |�|� |�� }
|
d } W nD t jy� } z*| }W Y d} ~ W |r|�� qW Y d} ~ n
d} ~ 0 0 W |r�|�� n|r�|�� 0 zt| �W S t t
f�y6 } z| }W Y d} ~ qd} ~ 0 0 qd} |�rP| d| 7 } t
| ��dS )zMConnect to IPA server, get all ip addresses of interface used to connect
Ni� r z&Cannot get server connection interfacez: %s) �socketZ getaddrinfoZ AF_UNSPECZ SOCK_STREAMrL �connectZ getsocknamerF r� r. r� )
r� Z
last_error�res�afZsocktype�protoZ
_canonnameZsarK rZ Zsocknamer� �msgrT rT rU rC U s@ �
"
�
�
rC c
C sl zt |� d}W nZ tjy4 t�d|� d}Y n8 tjyj } z t�d||� d}W Y d }~n
d }~0 0 |j�r>t�t j
�}|� ddd� t t
jd |� ttt�| ��d �}d || f }|jr�d
nd } t�t j�D ]2}
tj�t j|
�} | t jkr�q�|�| � t| � q�t � t j t jt tj�t j d �|| d
�� t
jd } | �!� �rZ| �"� | �#� t
jd }
|
�$� �r�t%t j&d��(}g d�}|�'d�|�� W d � n1 �s�0 Y |
�(� g d�}|�t j)� t%t j)d��.}|�'d�|�� t�*t j)d� W d � n1 �s0 Y t
jj+�,� t
jj+�-� t�.d� |j/�s\|j0�s\|j1�s\|�sht2| ||� d S )NTz*Hostname (%s) does not have A/AAAA record.Fz)DNS resolution for hostname %s failed: %sr? re �unboundr zforward-addr: %s#%sr z# z
ca-bundle.crt)ZTLS_CERT_BUNDLE_PATHZ
FORWARD_ADDRSZMODULE_CONFIG_ITERATORzsystemd-resolvedZNetworkManagerr� )�!# auto-generated by IPA installerz[main]z dns=none
rY )r� zsearch .znameserver 127.0.0.55
r� zyDNS encryption support was enabled. Unbound is configured to listen on 127.0.0.55:53 and forward to upstream DoT servers.)3r r ZDNSNotARecordErrorrK rr ZDNSResolverErrorr? r
� FileStorer �IPA_CLIENT_SYSRESTOREri rm r r� r[ r@ r& rA �no_dnssec_validationrE �listdir�UNBOUND_CONFIG_DIRr_ r� � UNBOUND_CONFr� rN r% rt ZUNBOUND_CONF_SRCrv ZOPENSSL_CERTS_DIRrh �stopr� rg r� ZNETWORK_MANAGER_IPA_CONFr� Zreload_or_restartZ RESOLV_CONFr� r� rp r� r� r> rB r� r� )r� r rO rl Zdns_ok�exr� rF Z forward_addrZmodule_config_iteratorrY �filepath�srZnmr� Zdns_noneZcfgrT rT rU �
client_dnsv s� ��
���
0 .
����r� c C sZ | j rV| j D ]H}zt�|� W q tyR } z t�d|� W Y d }~ dS d }~0 0 q dS )Nr� FT)r� r% r� r� rK rL )rO r� rZ rT rT rU �check_ip_addresses� s
r� c C sN t j�|�sd S g }t �|�D �] }|�d�s0q t j�||�}zt|d�}W nB ty� } z*t� d|t
|�� W Y d }~q W Y d }~n
d }~0 0 |D ]�} | � � } | r�| � d�r�q�z t
| �}
W nB ttfy� } z&t�d| |� W Y d }~q�W Y d }~n
d }~0 0 t�d|� |�|
� q�|�� q z,tjjjdt�| �dd � |D �d
d d � W nV tj�yd Y nB t �y� } z(t�d
t
|�� t� d� W Y d }~d S d }~0 0 |j �rJd} d} |j �r�| d| 7 } | d| 7 } |D ]N}
|
� � }
|
d u�r| d| | |
f 7 } |
� � }
|
d u�r�| d| | |
f 7 } �q�| d7 } t!| ||��sJt� d� d S )Nz.pubrR rS rZ z Decoding line '%s' failed: %sz Adding SSH public key from %sZhost_modc S s g | ] }|� � �qS rT )Zopenssh)rJ ZpkrT rT rU r� � rM z#update_ssh_keys.<locals>.<listcomp>Fz2.26)Z ipasshpubkeyZ updatednsr4 z host_mod: %sz&Failed to upload host SSH public keys.r� r� r� z%update delete %s. IN SSHFP
show
send
z update add %s. %s IN SSHFP %s
z
show
send
z#Could not update DNS SSHFP records.)"rE r_ �isdirr� �endswithr� r� r� rK rr r[ rI r] r2 r� �UnicodeDecodeErrorr� r� r{ rF r �Backend� rpcclient�forwardr% �fsdecoder Z EmptyModlistrq � create_sshfpr? Zfingerprint_dns_sha1Zfingerprint_dns_sha256r� )r Zssh_dirrO r� Zpubkeysr� rY r� rZ r� ZpubkeyZttlr� ZsshfprT rT rU �update_ssh_keys� st
" "
�
�
� r� c C s t �d� d S )Na/ Please make sure the following ports are opened in the firewall settings:
TCP: 80, 88, 389
UDP: 88 (at least one of TCP/UDP ports 88 has to be open)
Also note that following ports are necessary for ipa-client working properly after enrollment:
TCP: 464
UDP: 464, 123 (if NTP enabled))rK r� rT rT rT rU �print_port_conf_info s �r� r c C s� | rd| }nd}|D ]\}|d|t |j�f 7 }|d|t |j�f 7 }|d||jf 7 }|d||jf 7 }|d7 }q|d d� }|S ) Nz%s
r z%sSubject: %s
z%sIssuer: %s
z%sValid From: %s
z%sValid Until: %s
rY ���)r( r ZissuerZnot_valid_before_utcZnot_valid_after_utc)r� �certs�indentrK �certrT rT rU � cert_summary$ s
r� c
C s� t j�| �}z�z |�� t�||||�}W n� tjyJ tj| d��Y nj tj y� } z tj |j
t |�d��W Y d }~n:d }~0 t y� } zt�
t |���W Y d }~n
d }~0 0 W |�� n
|�� 0 |S )N��entry)r� rL )r$ Z
LDAPClientZfrom_hostname_plainZ gssapi_bindr � get_ca_certsr ZNotFound�NoCertificateError� NetworkErrorZldap_urir[ rq � LDAPErrorZunbind)r� Zbase_dnr� r! Zconnr� rZ rT rT rU �get_certs_from_ldap4 s (&r� c C s� zt | d�}W n" ty0 tjd| d��Y n0 |jdkrLtjd| d��|j}tj�|�sntjd| d��tj�|�s�tjd| d��t �
d|� zt � |�}W n ty� tj
|d��Y n0 |S ) z�
Get the CA cert from a user supplied file and write it into the
paths.IPA_CA_CRT file.
Raises errors.NoCertificateError if unable to read cert.
Raises errors.FileError if unable to write cert.
�filez unable to parse file url '%s'��reasonz url is not a file scheme '%s'zfile '%s' does not existzfile '%s' is not a filez'trying to retrieve CA cert from file %sr� )r rq r � FileError�schemer_ rE r` rz rK r� r � load_certificate_list_from_filer� )�url�parsedrY r� rT rT rU �get_ca_certs_from_fileE s"
r� c C s� |rt �d� t �d| � zttjdd| gdd�}W n tyR tj| d��Y n0 |j }zt
� |�}W n t y� tj| d��Y n0 |S )z�
Use HTTP to retrieve the CA cert and write it into the paths.IPA_CA_CRT
file. This is insecure and should be avoided.
Raises errors.NoCertificateError if unable to retrieve and write cert.
z9Downloading the CA certificate via HTTP, this is INSECUREz+trying to retrieve CA cert via HTTP from %sr �-Tr� r� )
rK rr r� r0 r ZBIN_CURLr. r r� Z
raw_outputr Zload_certificate_listrq )r� r� r� �stdoutr� rT rT rU �get_ca_certs_from_httpg s
r� c
C sd t �d| � zt| ||d�}W n2 tyP } zt �d|� � W Y d}~n
d}~0 0 dd� |D �}|S )a�
Retrieve th CA cert from the LDAP server by binding to the
server with GSSAPI using the current Kerberos credentials.
Write the retrieved cert into the paths.IPA_CA_CRT file.
Raises errors.NoCertificateError if cert is not found.
Raises errors.NetworkError if LDAP connection can't be established.
Raises errors.LDAPError for any other generic LDAP error.
Raises errors.OnlyOneValueAllowed if more than one cert is found.
Raises errors.FileError if unable to write cert.
z+trying to retrieve CA cert via LDAP from %sFz"get_ca_certs_from_ldap() error: %sNc S s g | ]}|d dur|d �qS )r< Fr rT )rJ �crT rT rU r� � rM z*get_ca_certs_from_ldap.<locals>.<listcomp>)rK r� r� rq )r� r� r� r� rZ rT rT rU �get_ca_certs_from_ldap� s
r� c C s� | d u r t �dtd|�� d S t| �} t|�}| |kr�t �dtj� t �dtd| �� t �dtd|�� |rxt �d� q�|r�tdd�s�tj d d
��n
t �
d � d S ) Nr� z Successfully retrieved CA certz^The CA cert available from the IPA server does not match the
local certificate available at %szExisting CA cert:zRetrieved CA cert:z Overriding existing CA cert
zcDo you want to replace the local certificate with the CA
certificate retrieved from the IPA server?Tz Retrieved CA)r\ z4Existing CA cert and Retrieved CA cert are identical) rK r� r� r� rr r ra r1 r ZCertificateInvalidErrorr� )�existing_ca_certsZ new_ca_certsZask�overriderT rT rU �validate_new_ca_certs� s> ���� ��r c
s� t jd }�fdd�}� fdd�}�fdd�}� j } � jdu oH� jdu}
d} d} � jr�|� }
z t|
�} W nn tjy� } zt �
d |� � W Y d}~nDd}~0 t y� } z$t �
d |� tj |
d
��W Y d}~n
d}~0 0 t �
d � �n�t
j�t j��rnt
j�t j��rXzt�t j�} W n< t �yT } z"tjd t j|f d
��W Y d}~n
d}~0 0 ntjdt j� d�d
��|
�r| �r�t �d� n�|� }
| }| �r�td|
d d��s�tj dd��zt|
|�} W n> t �y } z$t �
d |� tj |
d
��W Y d}~n
d}~0 0 t| | d|� �n�|� }
z t�||�} t| | | � W �nr tj�yt } z t �
d |� � W Y d}~�nDd}~0 tj tjf�yn } z�t �
d t|�� |� }
| �r�t �d� n�| �r�td|
d d��s�tj dd��n~| �s� j�st � d� tj dd��nXz t|
�} W n> t �yL } z$t �
d |� tj |
d
��W Y d}~n
d}~0 0 t| | | � W Y d}~nJd}~0 t �y� } z(t �
d t|�� tj |
d
��W Y d}~n
d}~0 0 | du �r�| du �r�t� d| ��| du�r�ztj | |d d � W n� t �y| } zrt
j�|��rTzt
� |� W n4 t �yR } zt � d ||� W Y d}~n
d}~0 0 tjd ||f d
��W Y d}~n
d}~0 0 t
�!|t j� zt
�"t jd � W n< t �y� } z"tjd t j|f d
��W Y d}~n
d}~0 0 dS )!a}
Examine the different options and determine a method for obtaining
the CA cert.
If successful the CA cert will have been written into paths.IPA_CA_CRT.
Raises errors.NoCertificateError if not successful.
The logic for determining how to load the CA cert is as follow:
In the OTP case (not -p and -w):
1. load from user supplied cert file
2. else load from HTTP
In the 'user_auth' case ((-p and -w) or interactive):
1. load from user supplied cert file
2. load from LDAP using SASL/GSS/Krb5 auth
(provides mutual authentication, integrity and security)
3. if LDAP failed and interactive ask for permission to
use insecure HTTP (default: No)
In the unattended case:
1. load from user supplied cert file
2. load from HTTP if --force specified else fail
In all cases if HTTP is used emit warning message
z.newc s t dt�� �ddddf�S )NZldapr �r r% r� rT �r� rT rU �ldap_url� s �z get_ca_certs.<locals>.ldap_urlc s t dd� jdddf�S )Nr� r )r � ca_cert_filerT )rO rT rU �file_url� s
�z get_ca_certs.<locals>.file_urlc s t dt�� �ddddf�S )N�httpz/ipa/config/ca.crtr r rT r rT rU �http_url� s �z get_ca_certs.<locals>.http_urlNr� r� z!CA cert provided by user, use it!z(Unable to load existing CA cert '%s': %sr� zExisting ca cert 'z' is not a plain filez$OTP case, CA cert preexisted, use itz)Do you want to download the CA cert from z ?
(this is INSECURE)Fz*HTTP certificate download declined by user)�messagezKUnable to download CA cert from LDAP
but found preexisting cert, using it.
zOUnable to download CA cert from LDAP.
Do you want to download the CA cert from z?
(this is INSECURE)z�In unattended mode without a One Time Password (OTP) or without --ca-cert-file
You must specify --force to retrieve the CA cert using HTTPz*HTTP certificate download requires --forcez4expected CA cert file '%s' to exist, but it's absentr� ��modezFailed to remove '%s': %sz&cannot write certificate file '%s': %sz*Unable set permissions on ca cert '%s': %s)#r ra �
unattendedr �passwordr r� r r� rK r� rq r� rE r_ r` rz r r� r� r1 r� r r� r� r[ rr r� rL Z
InternalError�write_certificate_list�unlinkrJ �renamer� )r� rO r� r� r� Zca_filer r r � interactiveZotp_authr �ca_certsr� rZ r �e2rT )rO r� rU r� � s�
"��� �
�� "� ������� "�"�
��� �r� a
/* Kerberos SSO configuration */
pref("network.negotiate-auth.trusted-uris", ".$DOMAIN");
/* These are the defaults */
pref("network.negotiate-auth.gsslib", "");
pref("network.negotiate-auth.using-native-gsslib", true);
pref("network.negotiate-auth.allow-proxies", true);
z
all-ipa.jsz browser/defaults/preferencesc
C s� �z�t �d� d }| jd urLtj�| jt�}tj�|�r>|}q�t �d|� nTtj� t
j �r�t
j t
j
fD ]&}tj�|t�}tj�|�rf|} q�qfnt �d� W d S |d u�r�tj�|�}t �d|� tj�|t�}t�tt|d��}t �d|� t �d|� zRt|d��}|�|� W d � n1 �s(0 Y t �d � |�d
d |� W n< t�y� } z"t �d | � t �d
� W Y d } ~ n
d } ~ 0 0 nt �d� t �d
� W n@ t�y� } z&t �dt| �� t �d
� W Y d } ~ n
d } ~ 0 0 d S )Nz!Setting up Firefox configuration.z Directory '%s' does not exists.z2Firefox configuration skipped (Firefox not found).z)Firefox preferences directory found '%s'.)ZDOMAINz1Firefox trusted uris will be set as '.%s' domain.z2Firefox configuration will be stored in '%s' file.r� z Firefox sucessfully configured.�firefox�preferences_fnamez6An error occured during creating preferences file: %s.z Firefox configuration failed.z(Firefox preferences directory not found.r� )rK r� � firefox_dirrE r_ r� � FIREFOX_PREFERENCES_REL_PATHr� rL rz r ZFIREFOXZ LIB_FIREFOXZ
LIB64_FIREFOX�abspath� FIREFOX_PREFERENCES_FILENAMEr% r� �FIREFOX_CONFIG_TEMPLATErv r� r� r� ri rq r[ )
rO rl r� Zpreferences_dirZ pref_pathr_ r r� r� rZ rT rT rU �configure_firefoxw st
� � �
��
��� *
��"
r c
C sn z t �tjdtjd| g� W n< tyX } z$|jdvrDt�d|j� W Y d }~nd }~0 0 t� d| tj� d S )N�-k�-r)r= � � z@Error trying to clean keytab: /usr/sbin/ipa-rmkeytab returned %sz%Removed old keys for realm %s from %s)
r% r0 r � IPA_RMKEYTAB� KRB5_KEYTABr. r� rK rL r� )r� rZ rT rT rU �purge_host_keytab� s
�
��r# c
C s`
t d� t d�tj�� t d� d}d}t�� dks@tdtd��t� � a
t | j d�rrt
�d � t
�d
� ttd��t� | jr�z t�� W nH tjy� } z t d �|j�� W Y d }~n d }~0 tjy� Y n0 | j�r,| jd u �r,| jd u �r,| jd u �r,| j d u �r,| j d u �r,| j �s,td
td��| j d u�r\| jd u�sP| jd u�r\tdtd��| j �rp| j a da nt a da t t �!� k�r�td�t �td��t dv �r�td�t �td��zt"t t#d� W n8 t$�y� } z td�|�td��W Y d }~n
d }~0 0 t�%� �s | j&�s tdtd��t�%� �s:| j'�r:tdtd��t�(� �sX| j)�rXtdtd��| j*�r�zt+�,ddg� W n t-�y� t
�d� Y n0 | j&�s�tj.�/t0j1��s�td td��t2� \}a3|�s�td td��| j�r�| j�r�td td��| j�r| j4�rt
�5d � zt6j7d t0j8id!d"� W n0 t6j9j:�yP t
�;d#t0j8� t<t0j8� Y n0 | j=�szt>| j=�t0j?k�rzt
�5d$t0j?� t@| ��s�ttd��| jA�r�tBjCd% �D� �s�td&��| jE�r�| jA�s�td'��tF�G� }|jH| jI| jJ| jKt t>| j=�d(�}| jJ�r.|dk�r.t
�d)d*�L| jJ�� t
�d+� tM� ttd��|tFjNk�rXt
�d,� t
�d-� ttd��|tFjOk�rvtd.�t �td��|tFjPtFjQfv �s�|jI�sd|tFjPk�r�|jJ�r�t
�;d/|jJ� n
t
�;d0� n:|tFjQk�r�|jJ�r�t
�;d1|jJ� n
t
�;d2� n
t
�;d3� | jI�r| jIaRd}n<| j�r$td4td��n&t
�d5� tSd6d d7�aRd8}t
�;d9tR� |jHtR| jJt t>| j=�d:�}tR�s�|jI�r�|jIaR|jT}t
�;d;tR� t t �Ud<�d= d � aV|tFjPtFjQfv �s�|jJ�s4t
�;d>� | jJ�r�| jJaWd}nB| j�r�td?td��n,t
�;d@� tSdAd d7�gaWd8}t
�;dBtWd � |jHtRtWt t>| j=�d:�}nP| jJ�sz|�X|jItY� dC�\}}|�rn|�rnt
�;dD� dEaZn
t
�;dF� n
t
�;dG� tW�s�| jJ�r�|j[aWd}t
�;dHd*�L| jJ�� n$|jJ�r�|j[aW|j\}t
�;dItWd � |tFjQk�rt
�dJtWd � tM� t
�;dKtWd |� ttd��|tFj]k�rBt
�5dL� t
�dM� t
�dN� d}|tFj^k�rft
�5dO� t
�dM� d}|dk�r�t
�d)tWd � t
�d+� tM� t
�;dKtWd |� ttd��|j_a`tZ�r�t`�s�t
�dP|ja�!� � t
�;dK|ja|jb� t
�dQ� tZ�r�t
�dR� nD| j�sB| jJ�st
�5dS� t
�dT� t
�dU� tSdVd ��sBttd��| j�rz| j �sz| j�sz| jc�sz| jd�szt�e� \| _c| _d|jaaf|jb} t
�;dWtf� | jK�r�| jKtfk�r�t
�dX| jKtf� t
�;dKtf| � ttd��|jgah|ji}
t
�;dYth� tjdZtff�akt
�d[t � t
�;d\t � t
�d]tf� t
�;d^| � t
�d_tR� t
�;d`|� t
�dad*�LtW�� t
�;db|� t
�dcth� t
�;dd|
� | j � s�| jc� r�| jcD ]}t
�de|� � q�| jd� r�t
�df| jd� tWD ]�} ztl�mtljn| � dE} W nH tlj�
y ztl�mtljo| � dE} W n tlj�
y d } Y n0 Y n0 | � r�t � t
�5dg� �
q8� q�t � | j�
s\tSdhd ��
s\ttd��d S )iNz$This program will set up IPA client.z
Version {}r zUnknown sourcer z+You must be root to run ipa-client-install.r r� z0IPA client is already configured on this system.zcIf you want to reinstall the IPA client, uninstall it first using 'ipa-client-install --uninstall'.zaWARNING: conflicting time&date synchronization service '{}' will be disabled in favor of chronyd
Fz1One of password / principal / keytab is required.z=pkinit_identity is mutually exclusive with password / keytab.zProvided as optionzMachine's FQDNz*Invalid hostname '{}', must be lower-case.)Z localhostzlocalhost.localdomainz(Invalid hostname, '{}' must not be used.)�maxlenzinvalid hostname: {}z�Option '--no-sssd' is incompatible with the 'authselect' tool provided by this distribution for configuring system authentication resourcesz�Option '--noac' is incompatible with the 'authselect' tool provided by this distribution for configuring system authentication resourcesz�Option '--mkhomedir' is incompatible with the 'authselect' tool provided by this distribution for configuring system authentication resourcesr$ z-VzhThe sudo binary does not seem to be present on this system. Please consider installing sudo if required.z&The pam_krb5 package must be installedzBOne of these packages must be installed: nss_ldap or nss-pam-ldapdz9Options 'principal' and 'keytab' cannot be used together.zZOption 'force-join' has no additional effect when used with together with option 'keytab'.�keytabZaccept)�store�usagez Deleting invalid keytab: '%s'.z Using existing certificate '%s'.r� zKTo enable DNS over TLS, package ipa-client-encrypted-dns must be installed.zSYou can not specify --no-dnssec-validation option without the--dns-over-tls option.)r� �serversr� r � ca_cert_pathz*Failed to verify that %s is an IPA Server.r~ zgThis may mean that the remote server is not up or is not reachable due to network or firewall settings.z/Can't get the fully qualified name of this hostz,Check that the client is properly configuredz${} is not a fully-qualified hostnamez%s is not an LDAP serverzNo LDAP server foundz%s is not an IPA serverzNo IPA server foundzDomain not foundz7Unable to discover domain, not provided on command linez1DNS discovery failed to determine your DNS domainz<Provide the domain name of your IPA server (ex: example.com)�Z allow_emptyzProvided interactivelyz*will use interactively provided domain: %s)r� r( r r) z will use discovered domain: %s�.r6 zIPA Server not foundz!Unable to find IPA Server to joinz+DNS discovery failed to find the IPA Serverz2Provide your IPA server name (ex: ipa.example.com)z*will use interactively provided server: %szValidating DNS Discoveryz!DNS validated, enabling discoveryTz)DNS discovery failed, disabling discoveryz8Using servers from command line, disabling DNS discoveryz will use provided server: %sz will use discovered server: %sz%s is not an IPA v2 Server.z(%s: %s)z0Anonymous access to the LDAP server is disabled.z'Proceeding without strict verification.zNNote: This is not an error if anonymous access has been explicitly restricted.z:The LDAP server requires TLS is but we do not have the CA.zCDNS domain '%s' is not configured for automatic KDC address lookup.z'KDC address will be set to fixed value.zDiscovery was successful!zoThe failure to use DNS to find your IPA server indicates that your resolv.conf file is not properly configured.zJAutodiscovery of servers for failover cannot work with this configuration.z�If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure.z/Proceed with fixed values and no DNS discovery?z will use discovered realm: %sz?The provided realm name [%s] does not match discovered one [%s]z will use discovered basedn: %s�OzClient hostname: %szHostname source: %sz Realm: %szRealm source: %szDNS Domain: %szDNS Domain source: %szIPA Server: %szIPA Server source: %sz
BaseDN: %szBaseDN source: %szNTP server: %sz NTP pool: %szpIt seems that you are using an IP address instead of FQDN as an argument to --server. The installation may fail.z3Continue to configure the system with these values?)p�printr� r4 ZVERSIONrE �getegidr' r r! �check_selinux_status�
selinux_worksr r� rK rL r� �CLIENT_ALREADY_CONFIGUREDr� �conf_ntpr8 Zcheck_timedate_servicesZNTPConflictingServiceZconflicting_serviceZNTPConfigurationErrorr
r r r% �pkinit_identity�prompt_passwordr �hostname_sourcer r= r r
r� Zis_nosssd_supportedr9 �no_acZis_mkhomedir_supported� mkhomedirr7 r% r0 �FileNotFoundErrorr_ r` r Z PAM_KRB5_SOr} � nosssd_files�
force_joinrr �gssapiZ Credentialsr" �
exceptions�GSSErrorr� rN r rd ra r� r? r r� r� r� r: � IPADiscovery�searchr� r� �
realm_namer� r� ZBAD_HOST_CONFIGZNOT_FQDNZNO_LDAP_SERVERZNOT_IPA_SERVERr� r1 Z
domain_source�findr r� Z check_domainr� r� r( Z
server_sourceZNO_ACCESS_TO_LDAPZ NO_TLS_LDAPr r r� Z realm_source� ntp_servers�ntp_poolZget_time_sourcer� r� r� Z
basedn_sourcer( r r� Z inet_ptonr� r� )
rO Zcli_domain_sourceZcli_server_sourcerZ Znssldap_installed�ds�retr� r� Zcli_realm_sourceZcli_basedn_sourceZsrvZ is_ipaddrrT rT rU �
install_check� s� �
�
��������� ����
�� ����
�
��
�
��
����
��
��
����� �
�
����
�
� �
� �
��
�
����
�� �
�
�rF c C s4 | d u rt �tj�} | jddd� t�| jd� d S )Ni� T)r Zbackupi� )r" � NSSDatabaser r � create_dbrE r� Zpwd_file)ZdbrT rT rU �create_ipa_nssdb�
s rI c C s> t �tj�} t �tj�}| �� s(t| � | jdkr>| jdd� dt j fdt j
ffD ]|\}}z|� |�}W n t y~ Y qRY n0 z| �
|||� W qR tjy� } z t d|| j|f ��W Y d }~qRd }~0 0 qR| �� D ]`\}}|�|�r�z|�|� W q� tj�y4 } z t d||j|f ��W Y d }~q�d }~0 0 q�q�d S )NZdbmF)Z
rename_oldzIPA CAzExternal CA certzFailed to add %s to %s: %sz Failed to remove %s from %s: %s)r" rG r r �
NSS_DB_DIRr` rI ZdbtypeZ
convert_dbZIPA_CA_TRUST_FLAGS�EXTERNAL_CA_TRUST_FLAGSZget_certr� �add_certr% r. �secdirZ
list_certs� has_nicknameZ delete_cert)�ipa_db�sys_dbr � trust_flagsr� rZ rT rT rU �update_ipa_nssdb�
s6
�
�
�rR c C s� t �|� | sF|sFt�� }|jtdddd�} | rF| D ]}t�d|� q4t�d� d}| s\|rnt � | |||�}n
t�
d� |s�t d� t � � S ) z�
Will disable any other time synchronization service and configure chrony
with given ntp(chrony) server and/or pool using Augeas.
If there is no option --ntp-server set IPADiscovery will try to find ntp
server in DNS records.
z _ntp._udpNF)Zbreak_on_firstz$Found DNS record for NTP server: %szSynchronizing timezSNo SRV records of NTP servers found and no NTP server or pool address was provided.z#Using default chrony configuration.)
r8 Z force_chronyr: r> Zipadns_search_srvr� rK r� r� Zconfigure_chronyrr r- Z sync_chrony)rB rC r� rl rD r� Z
configuredrT rT rU � sync_time�
s&
�
�
rS c
C s� | � d�rz| �dd�}d}z|�tj�}W n tyJ t�dtj� Y n0 |sjtj j
� � tj j
� � n|rztj j
�
� zt�| � W n0 ty� } zt�d|� W Y d }~n
d }~0 0 d S )NZchronyre Fz'Configuration file %s was not restored.z2Failed to restore time synchronization service: %s)r� ro � restore_filer Z CHRONY_CONFr� rK r� r r� Zchronydr� r� r� r8 Zrestore_forced_timeservicesr. rL )rl r� Zchrony_enabled�restoredrZ rT rT rU �restore_time_sync�
s$
�
rV c
sj � fdd�}zt �tj|� W nF tyd } z.tjD ]}||jv r4t�d|� q4W Y d }~n
d }~0 0 d S )Nc s � � d| |� d S )N�selinux)ri )rW r� �rl rT rU ri �
s z2configure_selinux_for_client.<locals>.backup_statez2SELinux does not support SSSD boolean %s, ignoring)r! �set_selinux_booleansr �SELINUX_BOOLEAN_SSSDr5 ZfailedrK rr )rl ri rZ r� rT rX rU � configure_selinux_for_client�
s �
�r[ c C s z�zt | t� � W n� ty� } z�|jtkr�| jr>t�d� np| jrPt�d� n^t� d� d| _
z t | � W n@ t y� } z(t�
dt�� � t� d|� W Y d }~n
d }~0 0 � W Y d }~n
d }~0 0 W zt�t� W n t y� Y n0 n&zt�t� W n t �y Y n0 0 d S )Nz;Installation failed. Force set so not rolling back changes.zLInstallation failed. As this is IPA server, changes will not be rolled back.z*Installation failed. Rolling back changes.Tr� )�_installrv r' r� r r� rK rr r� rL r
� uninstallrq r� � traceback�
format_excrE rI � CCACHE_FILE)rO rZ r� rT rT rU �install�
s8
��
" �ra c - C s6 dt i}t�tj�}t�tj�}|�ddd� |d }|d }| jsLtt � | j
rp| jspt � ||� t �
| j
� | jr�t| j| j||� n | jr�t�d� n
t�d� | js�| jd u r�| jd u r�| jdu r�| jd u r�| jd u r�td dd
�| _t�d | j� d t
t f }| j�stt � }t t t t t d|t!t
| j"| j#d
�
||d< t$j%�&|d�} tj'dt d dt(t)t ��dt
dtj*g }
| j�r�|
�+d� d|d< | j,�r�|
�+d� | jd u�r�d } | j} | �-d�dk�r�d| t f } | jd u�r�| j} n�| j�s0zt.�.d | �} W n t/�y d } Y n0 | �sft0d �1| �t2d ��n6t3j4�5� �r\t�6d � t�d � t0t2d ��n
t3j4�7� } zt8| | | |d!� W n> t9�y� }
z$t:� t0d"�1|
�t2d ��W Y d }
~
n
d }
~
0 0 �n| j�rX|
�+d� t$j%�;| j��r@zt<|| j| || j=d#� W nB t>j?j@�y< }
z$t:� t0d"�1|
�t2d ��W Y d }
~
n
d }
~
0 0 nt0d$�1| j�t2d ���nh| j�r(|
�+d� tAtjBd%�� W d � n1 �s�0 Y | jd u �r�|}n| j}zhztC|| j| || jDd&� W n> tE�y
}
z$t:� t0d'|
� �t2d ��W Y d }
~
n
d }
~
0 0 W tFtjB� n tFtjB� 0 n�| j�rP| jf}|
�+d(� |
�+| j� np| j�r�| j�rlt0d)t2d ��zt.�.d*�}W n t/�y� d }Y n0 |�s�t0d+t2d ��|
�+d(� |
�+|� |f}| |d,< t$jGd,< z&|d t$jGd< tH|| t d tIt � W nx tJjK�y6 }
z"t�6d-|
� t0t2d ��W Y d }
~
nDd }
~
0 tL�yp }
z"t�6d.|
� t0t2d ��W Y d }
~
n
d }
~
0 0 tM|
d||d/d0�}|jN}|jOdk�r�t�6d1|� | j#�s�|jOd2k�r�t�d3� t0t2d ��t�d4� n t�d5t � | jd u�r tMtjPgd|d6� z,t<|tj*tQ|| j=d#� tQ |d,< t$jGd,< W nF t>j?j@�yr }
z(t:� t�6d7|
� t0t2d ��W Y d }
~
n
d }
~
0 0 | j�s�tR|tIt t t t
� t�d8� tS�T� ���}tUjVd9tjW| jd|jXd:� d;tUjYv�r�t0d<t2d ��|�Ztj[� | j"�rt\|t t t | t!t
��r
t0t2d ��t�d=� | j�r�z"t<|tj*tQ| j=d>� tQt$jGd,< W n@ t>j?j@�y~ }
z"t�6d7|
� t0t2d ��W Y d }
~
n
d }
~
0 0 z t]|� W n t^�y� Y n0 t_�`tja�}z8|�b� tc|�D ]"\}}|�d|d?|d@ tSje� �q�W n tE�y t0dAt2d ��Y n0 tU�f� d}z.tUjgjh�i� d/}t�dB� tUjgjh�jdC� W �n tJjk� y }
z�|�rhtUjgjh�l� t�dD|
� zJtUjgjhjid/dE� t�dB� tUjgjh�jdC� t�dF� t�mdG� t�mdH� W nD tJjn� y } z(t�mdI|� t0dJ| t2d ��W Y d }~n
d }~0 0 W Y d }
~
n@d }
~
0 tJjn� yN }
z t0dK|
t2d ��W Y d }
~
n
d }
~
0 0 W d � n1 � sf0 Y z tUjgjhjjdLdMdN�}|dO }W n< tJjotJjpf� y� tUjgjhjjdPd/dQdR�}|dO dS }Y n0 |� s�tq� ztUjgjhjjdTd/dQdU�}W nH tL�
y8 }
z.tjdV|
d/dW� t0dX�1|
�t2d ��W Y d }
~
n d }
~
0 0 tr|dO dY d �}z
ts� W n8 ttjE�
y� }
z t0dZ|
t2d ��W Y d }
~
n
d }
~
0 0 ztut d tIt |�}W n: tJjv�
y� |�
r�trd[|�}nd }tw�x|t |�}Y n0 d\d]� |D �}t_jyd^d]� |D �tjzd_d`� t_jydad]� |D �tjBd_d`� t�db� tS�Ttj{�} |D ]V\}} } z| �d|| | � W n6 tE� y� }
z t0dc| t2d ��W Y d }
~
n
d }
~
0 0 � qDt �||� | j� s�t}t d t
| |� t~t
tj| t d � zt$��tQ� W n tL� y� Y n0 t�j�j�} | ��� � r�t�| |� d } z&| j"� r0dd} | ��� n de} | ��� W n6 tL� yt t�mdf| | j�� | j"� spt�mdg� Y n0 z | j"� r�| ��� n| ��� W nD tL� y� | j"� s�t�mdh| j�� t�di� nt�mdj| j�� Y n0 n| j"� s�t�dk| j�� t�j�j�}!|!��� �
rt�|!|� dl\}"}#| j��sJt j�| j"| j�|| j�| j�dm� | j��
r�t���dntU�}$|$��� }%|$��� }&|�dndo|%� |�dndp|&� z |&�
s�|$��� |%�
s�|$��� W n6 tL�
y� }
z t��dqt(|
�� W Y d }
~
n
d }
~
0 0 t�dr| j"�
r�dsndt� | j"�rxt��r t�|� t���dutU�}'z |'��� W n tE�y6 t�mdv� Y n0 z |'��� W n2 tE�yv }
zt�mdw|
� W Y d }
~
n
d }
~
0 0 | j"�s�t ��|� t�dx� | j"�s�t�t�fD ]L}(|(|tIt t t t�| t�|(j� �\}"}#})|"�r�t0t2d ��|#�r�t�dy|#|)� �q�t�|tIt ��r t�dz� n
t�d{� | j�sJ| j}*|*d u �rDd|t }*t�d}|*� nd|*v�rZd|*t f }*d}+d},|+d~k �r�|,�s�ztt�Mtj�d|*g� d/},W n8 tL�y� }
z t���d@� |+d@ }+W Y d }
~
n
d }
~
0 0 �qb|,�sJt�6d�|*��d�d |*� |#�r�t�d�|#� n
t�6d�� z t�t � W n6 tL�yH }
z t�6d�t(|
�� W Y d }
~
n
d }
~
0 0 | j��r\t�|| � | j��rnt�|| � | j��r�t�| |� |��� |��� | j��r�t�| |t � | j��s�t�| t |d�� | j�s|�Ztj�� t t t t t t�tj�t!t
| j"| j#d
�
t�d�t � t�||t t
| |� |��dd� |�ddd/� t�d�� d S )�N�PATHr� �completeFr@ rA zlSkipping attempt to configure and synchronize time with chrony server as it has been already done on master.z Skipping chrony configurationz#User authorized to enroll computersr* z)will use principal provided as option: %sr )
r� r� r� r r� rY r r r r� rB Zccachez-sr z-b�-hr �-drk �XMLRPC_TRACE_CURLr~ �@r� z%s@%szPassword for %s: z!Password must be provided for {}.r z2Password must be provided in non-interactive mode.zRThis can be done via echo password | ipa-client-install ... or with the -w option.)�configz"Kerberos authentication failed: {})rh �attemptsz"Keytab file could not be found: {}r� )� ccache_namerh r
z'Kerberos PKINIT authentication failed: z-wz1Password must be provided in non-interactive modez
Password: zPassword must be provided.Z
KRB5CCNAMEr� z Cannot obtain CA certificate
%sT)r� r� �nologZ
capture_errorzJoining realm failed: %s�
z]Use --force-join option to override the host entry on the server and force client enrollment.z=Use ipa-getkeytab to obtain a host principal for this server.zEnrolled in IPA realm %s�r� r� z Failed to obtain host TGT: %sz Created /etc/ipa/default.confZ
cli_installer)�contextZconfdirr� �delegateZnss_dirZ
config_loadedz Failed to initialize IPA API.z Configured /etc/sssd/sssd.conf)ri zCA certificate %dr6 z+Failed to add CA to temporary NSS database.zTry RPC connectionZpingzQCannot connect to the server due to Kerberos error: %s. Trying with delegate=True)ro z(Connection with delegate=True successfulz>Target IPA server has a lower version than the enrolled clientzKSome capabilities including the ipa command capability may not be availablez1Second connect with delegate=True also failed: %sz2Cannot connect to the IPA server RPC interface: %sz5Cannot connect to the server due to generic error: %sZ
ca_is_enabledz2.107r3 r� r� z2.0)r� r4 r� Z config_show)�rawr4 zconfig_show failed %s)�exc_infoz2Failed to retrieve CA certificate subject base: {}Zipacertificatesubjectbasez%Failed to create IPA NSS database: %s)r zCertificate Authorityc S s* g | ]"\}}}}}||t �|d |�f�qS )T)r Zkey_policy_to_trust_flags�rJ r� �n�t�urK rT rT rU r� � s �z _install.<locals>.<listcomp>c S s" g | ]\}}}}}|d ur|�qS �FrT rr rT rT rU r� � rM r� r c S s" g | ]\}}}}}|d ur|�qS rv rT rr rT rT rU r� � rM z/Adding CA certificates to the IPA NSS database.z)Failed to add %s to the IPA NSS database.r� r� zFailed to %s the %s daemonz-Caching of users/groups will not be availablern z:Caching of users/groups will not be available after rebootz1Failed to disable %s daemon. Disable it manually.r� )r N)r9 r7 rl r$ �subid�oddjobdrf re zUnable to start oddjobd: %sz
%s enabledZSSSDr� r9 �&SSSD service restart was unsuccessful.z9Failed to enable automatic startup of the SSSD daemon: %szKerberos 5 enabledz,%s configured using configuration file(s) %sz"Configured /etc/openldap/ldap.confz+Failed to configure /etc/openldap/ldap.confzadmin@%szaPrincipal is not set when enrolling with OTP or PKINIT; using principal '%s' for 'getent passwd'.�
�passwdz1Unable to find '%s' user with 'getent passwd %s'!z Recognized configuration: %szBUnable to reliably detect configuration. Check NSS setup manually.z9Adding hardcoded server name to /etc/ldap.conf failed: %s)rO r� rl z*Configured /etc/krb5.conf for IPA realm %sz Client configuration complete.)�� SECURE_PATHr
r� r r� � StateFileri r� r# r� r r! Zbackup_hostnameZ set_hostnamer2 rS rB rC rK r� r� r
r r r4 r% r3 r1 r[ r r� r� r r r9 r� rE r_ r� �
SBIN_IPA_JOINr[ r/ r" r{ r: rA �getpass�EOFErrorr' r� r �sys�stdin�isattyrL �readliner r� r� r` r �kinit_attemptsr; r< r= r� r r r
r. rN rG r� r� r r� rq r0 Z error_outputr� ZKDESTROYr` r� r" rG r Z bootstrapZETC_IPArM r� r� r, rH r r� r r� ra rH � enumeraterL rK �finalizer� r� r� r� Z
KerberosErrorZ
disconnectrr Z PublicErrorZ CommandErrorr� r� r( rI r% r� r� r Zmake_compat_ca_certsr r r Z(insert_ca_certs_into_systemwide_ca_storer� r� ZSSH_CONFIG_DIRrI r r� �nscdr� rm r� r� rj r� rp r� r6 Zmodify_nsswitch_pam_stackr7 r7 rw r rh rg rs Zcriticalr0 r[ Zmodify_pam_to_use_krb5rt rx r� r9 �__name__r� ZGETENT�time�sleeprP r� r/ ri r1 r{ r� r� �_loadr � no_nisdomainr� Z KRB5_CONFr# r� )-rO rP r� r� rl r@ rA Zhost_principalrk rj � join_argsr� r rZ Zpkinit_principalr r� �stderrZtmp_dbr �ir� Z connectedr r! r Z
ca_subjectZca_certs_trustrO r rQ r� Znscd_service_actionr� Zretcoder� rx rf re r9 Z
configurer� filenames�userrs �foundrT rT rU r\ s<
����� � �
�
�� ��
�
�
�
� ��
�
�
�
�
� � �
�
�
�
� �
�
�
� �
�
����0�<� ��
�
� � �
� � �
�
��
��� �
� & �
�
�
�
"�� �
� �
� r\ c C sX t � s"| jrt}nt}td|d��t� rL| jsLt�d� t�d� ttd��t �
� a d S )Nz,IPA client is not configured on this system.r z@IPA client is configured as a part of IPA server on this system.z/Refer to ipa-server-install for uninstallation.) r r� �SUCCESS�CLIENT_NOT_CONFIGUREDr' r rK rL r� r! r/ r0 )rO r� rT rT rU �uninstall_check�
s � �
r� c 0
s� dt i}t�tj�}t�tj�� � �ddd� zdzttjddg� W n> t y� } z&|j
t krnt �
dt|�� W Y d }~n
d }~0 0 W � �dd� n� �dd� 0 |�� � �� d }d }d}z�t�� }|�� |�� }|�� } t| �d kr�d}|D ]�}
|�|
�} z| �d
�} W n tj�y* Y q�Y n0 | d kr�z| �d �}W n tj�y\ Y q�Y n0 z| �d
�}W q� tj�y� Y q�0 q�W n t�y� g } Y n0 |d u �r�t}t� tj �}
t� tj �}t j j!}|
�"d��r(zt!j#tj dd� W n6 t$�y& } z t �
d|j%|� W Y d }~n
d }~0 0 d| }|�"|��r�zt!j#tj |d� W n6 t$�y� } z t �
d|j%|� W Y d }~n
d }~0 0 tj&D ]}t't(j)�*|
j+|�� �q�t!�,� z |�-� W n4 t�y� } zt.|j%d|� W Y d }~n
d }~0 0 z |�/� W n: t�y: } z t �
d|j%t|�� W Y d }~n
d }~0 0 | j0�s�t(j)�1tj2��r�t �3d� tj4dd|dtj5g}| j6�r�|�7d� d|d< t|d|d�}|j
d k�r�t �
d |j8� t(j)�1tj2��r�t(j)�1tj5��r�t �3d � z8t9� }|�:tj2� |�;d d �}ttj<dtj5d!|g� W nv t �yX } z(|j
d"k�rDt �
d#t|�� W Y d }~n>d }~0 t�y� } z t �
d#t|�� W Y d }~n
d }~0 0 t �=d$t>�}� �?d$d%��s�z |�-� W n t�y� Y n0 � �?d$d&��s�z |�/� W n t�y� Y n0 � �?d'd&��r�t j d( }� �?d(d%��s(|�-� � �?d(d&��s>|�/� t'tj@� |jA�B� D ],\}}tjC|v �rR|�Dt(j)�*tjC|�� �qRt �3d)� d}d}|�E� �r�|�FtjG�}|�FtjH�}ztI�J|� ||� W n8 t�y } z tKd*�L|�tMd+��W Y d }~n
d }~0 0 t'tjN� t'tjO� t'tjP� t'tjQ� t(�RtjS�D ]*\} } } | D ]} t't(j)�*| | �� �qD�q6| D ]>} d,| �Td-d.�� �}
t(j)�*tjU|
�}t(j)�1|��rft'|� �qf|�r�zttjVd/d0d1d2g� W n t�y� t �3d3� Y n0 |�r�d4| d5 } t(j)�*tjW| �}!t'|!� d6|�X� }"t(j)�*tjW|"�}#t'|#� t'tjY� t'tjZ� zt �=d7t>��-� W n2 t�y� } zt �[d8|� W Y d }~n
d }~0 0 t'tj\� d9| d5 }$t(j)�*tjW|$�}%t'|%� |�rf|�rft �3d:� t]� d}&z|�DtjGtj^�}&W n t_�y t �6d;� Y n0 |&�r t �3d<� t �3d=� t �=d>t>�}'z |'�`� W n t �y` t �[d?� Y n0 �n,|�s�|�r�t]� t �3d@� t �=d>t>�}'z |'�`� W n t �y� t �[d?� Y n0 n�|� s�|� s�t(j)�1tjG�� r�zt(�atjGtjb� W n" t_� y t �6dAtjb� Y n0 t �3dB� t �=d>t>�}'z |'�-� W n t � yP t �[dC� Y n0 z |'�/� W n2 t � y� } zt �[dD|� W Y d }~n
d }~0 0 � �cdE�� r�� fdFdG�tdjeD �}(ztI�f|(� W n6 tg� y� } z t �[dHt|�� W Y d }~n
d }~0 0 tI�h|� � |�E� �
r t �3dI� |�i� tj� � t j jk})t j jl}*|)|*fD ]*}+|+�m� �
rZt?|+� � nt �3dJ|+j%� �
q@tn� |� |�
r�t j jo�p� �
r�t'tjq� t'tjr� t j jo�`� � �cdK�� r8t �3dL� � �?dKdM�},|,d u� r8t(j)�s|,�� r8zt(�t|,� W nD t� y6 } z*t �[dN|,t|�� t �[dO|,� W Y d }~n
d }~0 0 tu}-|�E� � rTt �
dPtjv� � �ddQ� d}.� jwD ]}/t �
dR|/� d}.tx}-� qj|.� r�t �[dSt(j)�*tjtjy�� t'tj2� t'tj2dT � t'tjzdT � t'tj{dT � tI�|� t'tj}� t'tj~� t'tj� t �3dU� | j�� s�t �3dV� t �3dW� | j0� s�t�dXd�� r�zttj�g� W n8 t� y� } z tKdY�L|�txd+��W Y d }~n
d }~0 0 |-� r�tK|-d+��d S )ZNrb r� r7 Tz --uninstallr� z(Unconfigured automount client failed: %sFr6 r� r� r' r& r )r z*%s failed to stop tracking certificate: %sz IPA Machine Certificate - %sr� z9Failed to disable automatic startup of the %s service: %sz"Unenrolling client from IPA serverz
--unenrollrd r re rk rf rm r zUnenrolling host failed: %sz:Removing Kerberos service principals from /etc/krb5.keytabr� r� r r z0Failed to remove Kerberos service principals: %srx rf re r? r� z1Disabling client Kerberos and LDAP configurationsz,Failed to remove krb5/LDAP configuration: {}r Z
domain_realm_r+ �_z cache-remover z--stopz--startzsAn error occurred while removing SSSD's cache.Please remove the cache manually by executing sssctl cache-remove -o.Zcache_z.ldbZccache_zsssd-kcmzFailed to stop sssd-kcm: %sZ timestamps_zQThe original configuration of SSSD included other domains than the IPA-based one.z2Error while restoring pre-IPA /etc/sssd/sssd.conf.zQOriginal pre-IPA SSSD configuration file was restored to /etc/sssd/sssd.conf.bkp.z<IPA domain removed from current one, restarting SSSD servicer9 ry zUOther domains than IPA domain found, IPA domain was removed from /etc/sssd/sssd.conf.z,Error while moving /etc/sssd/sssd.conf to %sz^Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deletedz!SSSD service could not be stoppedz:Failed to disable automatic startup of the SSSD daemon: %srW c s i | ]}|� � d |��qS )rW )ro )rJ r\ rX rT rU �
<dictcomp>� s �z uninstall.<locals>.<dictcomp>z$Unable to reset SELinux variable: %sz$Restoring client configuration filesr� r z Removing Firefox configuration.r z '%s' could not be removed: %s.z!Please remove file '%s' manually.z)Some files have not been restored, see %src zbSome installation state for %s has not been restored, see /var/lib/ipa/sysrestore/sysrestore.statez�Some installation state has not been restored.
This may cause re-installation to fail.
It should be safe to remove %s but it may
mean your system hasn't been restored to its pre-installation state.rC zClient uninstall complete.z;The original nsswitch.conf configuration has been restored.z7You may need to restart services or reboot the machine.z"Do you want to reboot the machine?z$Reboot command failed to execute: {})�r| r
r� r r� r} ri r0 r� r. r� r� rK rL r[ r� r� r� r� r� Z list_domains�lenr� r� r� rq r r" rG r rJ r r� r rN Z
stop_trackingr� rj Z NSS_FILESrN rE r_ r� rM Zremove_principal_from_casr� r^ r� r� r` r� r� r~ r" r� r{ Z error_logr r� r� r! r r ro r� r� r^ r� rT Z has_filesZhas_filer, r2 r! Z$restore_pre_ipa_client_configurationr' r� r Z
SSSD_MC_GROUPZSSSD_MC_PASSWDZSSSD_MC_INITGROUPSZ SSSD_MC_SID�walkZ
SSSD_PIPES�replaceZ SSSD_PUBCONF_KRB5_INCLUDE_D_DIRZSSSCTLZSSSD_DB�upperZSSSD_LDBZSSSD_CONFIG_LDBrr Z SSSD_SECRETSr� Z
SSSD_CONF_BKPrJ r� r ZSSSD_CONF_DELETEDr� r rZ rY r5 Zrestore_hostnameZrestore_all_filesr� r� r� r� rV rx rh r� ru rz rI r� ZSYSRESTORE_INDEX�modules�CLIENT_UNINSTALL_ERRORZSYSRESTORE_STATEFILEr� Z
NSSWITCH_CONFZ(remove_ca_certs_from_systemwide_ca_storera r r r
r1 Z SBIN_REBOOT)0rO r� r� rZ r r& Zwas_sssd_configuredr� r� Z all_domainsr\ r� r� rO rP r" Zclient_nss_nicknamerY r� r� r� r� r� rx r� ZfileinfoZwas_sssd_installedZwas_sshd_configuredrO Z_dirsr� r� Zsssd_domain_ldbZ
sssd_ldb_fileZsssd_domain_ccacheZsssd_ccache_fileZsssd_timestampsZsssd_timestamps_filerU r9 Zboolean_statesr� r� r r �rvr� �modulerT rX rU r] �
s�
�
�
� �
�
$
�
�
�� ��
�
��
�
"
���
�� � ��
� �
�&
�
�
��
�
�
��
�� � r] c C s t �� }|jD ].}t|t j�r|jtju r|jt j k| _
qDqd| _
| j | _ | j
rbt| j
�| _nd | _| j| _| j| _| j| _| jr�| j| _n| j| _| j| _| j | _ | j | _ | j | _!| j" | _#| j$ | _%| j& | _'| j(r�| j(d | _)nd | _)| j*| _+| j,| _-| j. | _/| j0 | _1d S )NTr� )2�logging� getLogger�handlersr- Z
StreamHandler�streamr� r� �level�DEBUGr� r r
� domain_namer r� r( r� r@ r� Z
fixed_primaryr9 r Zadmin_passwordr �
host_passwordZ host_namer �no_ntpr2 �
ssh_trust_dnsrq �no_sshr/ �no_sshdr1 �no_sudor7 � no_dns_sshfpr� �
ca_cert_filesr Zautomount_locationr� �enable_dns_updatesr> Zno_krb5_offline_passwordsrD Zno_sssdr9 )Z installerZ root_loggerZhandlerrT rT rU �initL s@
�
r� c s e Zd ZdZdZeejjdd�Ze e�Ze
e ddd�Z e e �Z e
e dddd gd
�Z
e e
�Z
e
dd d�Ze e�Ze
dd d�Ze e�Ze
eje dd
ddd�Ze e�Ze
e ddd�Ze e�Ze
ddddgd
�Ze e�Ze
ddddd�Ze e�Ze
e ddd�Ze e�Ze
ddd�Ze e�Ze
ddd�Ze e�Ze
ddd�Ze e�Ze
ddd�Ze e�Ze
dd d�Ze e�Ze
dd d�Z e e �Z e
dd d�Z e e �Z e
e d d d�Z e e �Z e j d!d"� �Z e
dd#d�Z!e e!�Z!e
dd$d�Z"e e"�Z"e
ddd%d�Z#e$e#�Z#� fd&d'�Z%� Z&S )(�ClientInstallInterfacez�
Interface of the client installer
Knobs defined here will be available in:
* ipa-client-install
* ipa-server-install
* ipa-replica-prepare
* ipa-replica-install
ZClientz&principal to use to join the IPA realm�� descriptionNT)Z sensitivez1path to backed up keytab from previous enrollmentr �r� � cli_namesz6create home directories for users on their first loginz0Force client enrollment even if already enrolledz9ntp server to use. This option can be used multiple timesz --ntp-serverZ
NTP_SERVER)r� r� � cli_metavarzntp server pool to usezdo not configure ntpz-NFzeStop and disable any time&date synchronization services besides ntpd. This option has been deprecated)Z
deprecatedr� zNIS domain namez do not configure NIS domain namez3configure OpenSSH client to trust DNS SSHFP recordsz do not configure OpenSSH clientz do not configure OpenSSH serverz-do not configure SSSD as data source for sudoz'configure SSSD as data source for subidz-do not automatically create DNS SSHFP recordsr z6number of attempts to obtain host TGT (defaults to 5).c C s |dk rt d��d S )Nr6 z"expects an integer greater than 0.)r� ��selfr� rT rT rU r� � s z%ClientInstallInterface.kinit_attemptszConfigure DNS over TLSz*Disable DNSSEC validation for DNS over TLSz#request certificate for the machinec s� t t| �jf i |�� | jr*| js*td��| jr:t�d� | j rN| j
rNtd��| j rb| j
rbtd��| j rrt�d� | j
r�| jr�td��| jr�| jr�td��| jr�td��d S ) Nz2--server cannot be used without providing --domainzPOption --force-ntpd has been deprecated and will be removed in a future release.z2--ntp-server cannot be used together with --no-ntpz0--ntp-pool cannot be used together with --no-ntpzROption --request-cert has been deprecated and will be removed in a future release.z7--no-nisdomain cannot be used together with --nisdomainz>--ip-address cannot be used together with --enable-dns-updatesz;--ip-address cannot be used together with--all-ip-addresses)�superr� �__init__r( r� r� �
force_ntpdrK rr rB r� rC r r� r� r� r� rB �r� �kwargs�� __class__rT rU r�
sD �� � �� ���z ClientInstallInterface.__init__)'r� �
__module__� __qualname__�__doc__r� r, r � ServiceAdminInstallInterfacer r r+ r[ r� r% r7 r: r) �ListrB rC r� r� r� r� r� r� r� r� rw r� �intr� � validatorr? r� r r r� �
__classcell__rT rT r� rU r� s s� �����
�������������
���r� c @ sT e Zd ZdZeedddd�Zejdd� �Zeej e ddd d
d �Z
e
jd d
� �Z
dS )�PKINITInstallInterfaceZPKINITNzQPKINIT identity information (for example FILE:/path/to/cert.pem,/path/to/key.pem)ZIDENTITY)r� �defaultr� r� c C s |� d�std��d S )N)zFILE:zPKCS11:zPKCS12:zDIR:�ENV:z?identity must start with FILE:, PKCS11:, PKCS12:, DIR:, or ENV:)r] r� r� rT rT rU r3 F s ��z&PKINITInstallInterface.pkinit_identityz�PKINIT trust anchors, prefixed with FILE: for CA PEM bundle file or DIR: for an OpenSSL hash dir. The option can be used used multiple times.z--pkinit-anchorZFILEDIR)r� r� r� r� r� c C sz |D ]p}|� d�\}}}|r$|dvr,td��|dkrPtj�|�sPtd|� d���|dkrtj�|�std|� d���qd S )N�:> �DIRr� �FILEzBInvalid pkinit_anchor '{part}' is not prefixed with FILE: or DIR:.r� zpkinit anchor path 'z"' does not exist or is not a file.r� )� partitionr� rE r_ rz r� )r� r� �partr? �sepr_ rT rT rU r
^ s �
�
�z%PKINITInstallInterface.pkinit_anchors) r� r� r� r� r+ r[ r3 r� r) r� r
rT rT rT rU r� 8 s$ �
� r� c s� e Zd ZdZdZeej�Zejdd� �Ze dd� �Z
dZ e dddd gd
�Z
dZe dd d �Ze edd
d �Z� fdd�Ze� dd� �Zejdd� �Z� ZS )�
ClientInstallz
Client installer
Nc C s� t |t�std�|���|d }tj�|�s8td| ��tj�|�sPtd| ��tj�|�shtd| ��zt �
|� W n t y� td| ��Y n0 d S )NzExpected list, got {!r}r� z'%s' does not existz'%s' is not a filez!'%s' is not an absolute file pathz$'%s' is not a valid certificate file) r- r@ r� r� rE r_ r` rz �isabsr Zload_certificate_from_filerq r� rT rT rU r� � s
zClientInstall.ca_cert_filesc C s | j S rT )r �r� rT rT rU r4 � s z ClientInstall.prompt_passwordFz#force setting of LDAP/Kerberos confr~ r� z/configure Firefox to use IPA domain credentialsr� zNspecify directory where Firefox is installed (for example: '/usr/lib/firefox')c s. t t| �jf i |�� | jr*| js*td��d S )Nz?--firefox-dir cannot be used without --configure-firefox option)r� r� r� r r r� r� r� rT rU r� � s
�zClientInstall.__init__c c s" t | � t| � d V t| � d S rT )r� rF ra r� rT rT rU �main� s zClientInstall.mainc c s" t | � t| � d V t| � d S rT )r� r� r] r� rT rT rU r� � s )r� r� r� r� Z dm_passwordr, r� r� r� �propertyr4 r6 r+ r� r� r r[ r r� r- r� Z uninstallerr� rT rT r� rU r� s s: �
���
r� )F)TTrT )FT)F)N)r )T)F)N)�r� Z
__future__r r r� r r r; r� rE r� r� r� r� r� rD r� r� r^ r� Z configparserr � urllib.parser r Zipalibr r r r
Zipalib.constantsr r r
Zipalib.installr r r r Z hostname_Z ipalib.factsr r Z ipalib.kinitr r r Zipalib.install.servicer r Z
ipalib.rpcr Z ipalib.utilr r r r Z ipaplatformr Zipaplatform.constantsr Zipaplatform.pathsr Zipaplatform.tasksr! Z ipapythonr" r# r$ r% r& Zipapython.admintoolr' Z ipapython.dnr( Zipapython.installr) Zipapython.install.corer* r+ r, Zipapython.install.commonr- Zipapython.ipautilr. r/ r0 r1 Z
ipapython.sshr2 r4 Zipapython.errorsr5 r r7 r8 r9 Z ipaclientr: Zipapython.ipachangeconfr; r� ZNoneTyper� r� rK r� r r� r1 r� r| r5 r9 r� r� r� r r� r r r� r0 rW rN r^ rd rm ro r} r� r� r� r� r� r� r� rt rx r� r� r r r# rH r< r. ra ri rh rg r{ rz ry r� r� r� r� r� r� r� r� r� r� ZIPA_DNS_UPDATE_TXTr� ZIPA_DNS_CCACHEr` r� r� rC r� r� r� r� r� r� r� r� r� r r� r r r r r# rF rI rR rS rV r[ ra r\ r� r] r� ZHostNameInstallInterfacer� ZSSSDInstallInterfacer� ZServiceInstallInterfacer� ZAutomountInstallInterfacer� rT rT rT rU �<module> sV
� %�
"
�
(
@Cf
�
{= +
6 2"
>7@!S D
"
�
. C 9
)
t /'� E: �