File: //lib/python3.6/site-packages/ipaclient/install/__pycache__/client.cpython-36.pyc
3
�d[ew% � @ s( d Z ddlmZmZ ddlZddlZddlZddlZddlZddl Z ddl
Z
ddl Z ddl Z ddl
Z
ddlZddlZddlZddlZddlZddlZddlmZ ddlmZmZ ddlmZmZm Z ddlm Z ddl m Z m Z m!Z! dd l"m#Z#m$Z$m%Z% dd
l"m&Z' dd l(m)Z)m*Z* dd l+m,Z,m-Z-m.Z. dd
l/m0Z0m1Z1 ddl2m3Z3 ddl4m5Z5m6Z6m7Z7m8Z8 ddl9m:Z: ddl;m<Z< ddl=m>Z> ddl?m@Z@ ddlAmBZBmCZCmDZDmEZEmFZF ddlGmHZH ddlImJZJ ddlKmLZL ddlMmNZNmOZOmPZP ddlQmRZR ddlSmTZTmUZUmVZVmWZW ddlXmYZY dd lAmZZZ d d l[m\Z\m]Z]m^Z^ dd l_m`Z` dd lambZb ecd�Zdejeef�ZgdZhd Zid!Zjd"Zkd#Zld$Zmda&dandaod%apdaqdardasdatdaudavdawd&d'� Zxd(d)� Zyd*d+� Zzd,d-� Z{d.d/� Z|d0d1� Z}d2d3� Z~e>jeifd4d5�Z�d6d7� Z�d�d8d9�Z�d:d:f fd;d<�Z�d=d>� Z�d?d@� Z�dAdB� Z�dCdD� Z�dEdF� Z�dGdH� Z�dIdJ� Z�d�dKdL�Z�dMdN� Z�dOdP� Z�dQdR� Z�d�dSdT�Z�dUdV� Z�dWdX� Z�dYdZ� Z�d[d\� Z�d]d^� Z�d_d`� Z�dadb� Z�dcdd� Z�dedf� Z�dgdh� Z�didj� Z�d�dkdl�Z�dmdn� Z�doZ�dpZ�dqZ�drZ�e>j�Z�e>j�Z�dsdt� Z�dudv� Z�dwdx� Z�dydz� Z�d{d|� Z�d}d~� Z�dd�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�Z�d�Z�d�Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�exd�d�� �Z�d�d�� Z�d�d�� Z�d�d�� Z�eNG d�d�� d�e'j�e%j�e^jă�Z�eNG d�d�� d�e%jƃ�Z�G d�d�� d�e�e�e\jȃZ�dS )�z\
IPA client install module
Provides methods for installation, uninstallation of IPA client
� )�print_function�absolute_importN)�RawConfigParser)�urlparse�
urlunparse)�api�errors�x509)�
sysrestore)�FQDN� IPAAPI_USER�MAXHOSTNAMELEN)�
certmonger� certstore�service)�hostname)�is_ipa_client_configured�is_ipa_configured)� kinit_keytab�kinit_password� kinit_pkinit)� enroll_only� prepare_only)�%delete_persistent_client_session_data)�normalize_hostname�,no_matching_interface_for_ip_address_warning�validate_hostname�verify_host_resolvable)�services)� constants)�paths)�tasks)�certdb�kernel_keyring�ipaldap�ipautil�dnsutil)� ScriptError)�DN)�typing)�group�knob� extend_knob)�step)�CalledProcessError�realm_to_suffix�run�
user_input)� SSHPublicKey)�version� )� automount�timeconf�sssd)� discovery)�
IPAChangeConf� � � zB/bin:/sbin:/usr/kerberos/bin:/usr/kerberos/sbin:/usr/bin:/usr/sbinFc s � fdd�}|S )Nc s� t j� \}}tj|� t jdd�}||d< ||d< � | |� tjjdd � ytj|� W n tk
rx t j
d|� Y nX ytj |� W n tk
r� Y nX t |d � d S )NZkrbcc)�prefix�krb_name�
ccache_dir� KRB5_CONFIGzCould not remove %sz.ipabkp)
�tempfileZmkstemp�os�closeZmkdtemp�environ�pop�remove�OSError�logger�error�rmdir� remove_file)�options�tdict�fdr> r? )�func� � /usr/lib/python3.6/client.py�inneri s
zcleanup.<locals>.innerrP )rO rR rP )rO rQ �cleanuph s rS c C s^ yt j| � W nJ tk
rX } z.|jdkr.dS tjd| |� tjd| � W Y dd}~X nX dS )z�
Deletes a file. If the file does not exist (OSError 2) does nothing.
Otherwise logs an error message and instructs the user to remove the
offending file manually
:param filename: name of the file to be removed
r: Nz Failed to remove file %s: %szKPlease remove %s manually, as it can cause subsequent installation to fail.)rB rF rG �errnorH rI )�filename�erP rP rQ rK � s
rK c C s t jd| |t|�� d S )Nz%s failed to %s: %s)rH rI �str)�name�actionrI rP rP rQ �log_service_error� s rZ c C s$ | dk r | S t jjtj�r tjS dS )z�
If a CA certificate is passed in on the command line, use that.
Else if a CA file exists in paths.IPA_CA_CRT then use that.
Otherwise return None.
N)rB �path�existsr �
IPA_CA_CRT)Z cert_pathrP rP rQ �
get_cert_path� s
r^ c C s< | j � }| j� }|s|r8|j| jd|� |j| jd|� d S )N�enabled�running)�
is_enabled�
is_running� backup_state� service_name)r �
statestorer_ r` rP rP rQ �
save_state� s
rf c C s� |j | jd�}|j | jd�}|rPy | j� W n" tk
rN tjd| j� Y nX |r�y | j� W n" tk
r� tjd| j� Y nX d S )Nr_ r` z6Failed to configure automatic startup of the %s daemonz Failed to restart the %s daemon)�
restore_staterd �enable� ExceptionrH �warning�start)r re r_ r` rP rP rQ rg � s rg c
C s� dt jt jt jgt jgd�dt jgd�g} i }d}x|| D ]t}g ||d < xbd
D ]Z}y@x:|| D ].}tjj|�r^||d j |� |dkr^d }q^W W qN t
k
r� Y qNX qNW q8W ||fS ) z�Checks whether nss_ldap or nss-pam-ldapd is installed.
If anyone of mandatory files was found returns True and list of all files
found.
�configure_ldap_conf)�function� mandatory�optional�configure_nslcd_conf)rm rn Frm rn ro T)rn ro ) r � LDAP_CONFZ
NSS_LDAP_CONFZLIBNSS_LDAP_CONFZ
PAM_LDAP_CONFZ
NSLCD_CONFrB r[ �isfile�append�KeyError)Zfiles_to_checkZ files_foundZretvalrm Z file_typerU rP rP rQ �nssldap_exists� s*
ru c
C s� t jj| �sdS tjd�}t� }t| ��6}x.|D ]&}|j|�}|d k r0|j|j d�� q0W W d Q R X |r�t
dj | dj t
|���|d��ndS d S )NFz^\s*(PORT|HOST).*r4 z4'{}' contains deprecated and unsupported entries: {}z, )�rvalT)rB r[ rr �re�compile�set�open�match�addr* r' �format�join�sorted)�confZ
error_rvalZpatZ unsupported�f�line�morP rP rQ �check_ldap_conf� s
r� c C s� y�t j � } | j� | j� }d}xL|D ]D}| j|�}y |jd�}|dkrL|}P W q$ t jk
rf w$Y q$X q$W |dk r�| j|� | j� n
tj d� W n t
k
r� tj d� Y nX dS )zIHelper function for uninstall.
Deletes IPA domain from sssd.conf
N� id_provider�ipazNIPA domain could not be found in /etc/sssd/sssd.conf and therefore not deletedzKIPA domain could not be deleted. No access to the /etc/sssd/sssd.conf file.) �
SSSDConfig�
import_config�list_active_domains�
get_domain�
get_option�
NoOptionErrorZ
delete_domain�writerH rj �IOError)�
sssdconfig�domainsZipa_domain_namerX �domain�providerrP rP rQ �delete_ipa_domain s,
r� c C s t jdtdd� t| �S )a
Consider IPA client not installed if nothing is backed up
and default.conf file does not exist. If on_master is set to True,
the existence of default.conf file is not taken into consideration,
since it has been already created by ipa-server-install.
z+Use 'ipalib.facts.is_ipa_client_configured'r: )�
stacklevel)�warnings�warn�DeprecationWarningr )� on_masterrP rP rQ �is_ipa_client_installed- s
r� Tc C s$ t jdtdd� tj| |||||�S )a:
This function was deprecated. Use ipaplatform.tasks.
Edits the specified nsswitch.conf database (e.g. passwd, group, sudoers)
to use the specified service(s).
Arguments:
fstore - FileStore to backup the nsswitch.conf
database - database configuration that should be ammended,
e.g. 'sudoers'
service - list of services that should be added, e.g. ['sss']
preserve - if True, the already configured services will be preserved
The next arguments modify the behaviour if preserve=True:
append - if True, the services will be appended, if False, prepended
default_value - list of services that are considered as default (if
the database is not mentioned in nsswitch.conf), e.g.
['files']
z7Use ipaplatform.tasks.tasks.configure_nsswitch_databaser: )r� )r� r� r� r! �configure_nsswitch_database)�fstoreZdatabaser Zpreservers Z
default_valuerP rP rQ r� < s
r� c
C s� t d�}|jd� |jd� dddd�|j� g}|jd|�|jd |�|jd
|�|jd |d �|jd
|�|jddjtj|d ���|jdd�g}|j|j d|�|j� g� t
j } | j | � |j
| |� tj| d� d S )Nz
IPA Installerz = �[�]�commentz#File modified by ipa-client-install)rX �type�value�basedn�realmr� �serverr �hostZ
xmlrpc_urizhttps://{}/ipa/xml� enable_ra�True�globali� )r� r� )r9 �setOptionAssignment�setSectionNameDelimiters� emptyLine� setOptionr} r% �
format_netloc�extend�
setSectionr �IPA_DEFAULT_CONF� backup_file�newConfrB �chmod)
r� �
cli_basedn� cli_realm�
cli_domain�
cli_serverr Zipaconf�optsZdefopts� target_fnamerP rP rQ �configure_ipa_confZ s.
r� c C sB t � } | jtj� | jddd� ttjd�}| j|� |j� dS )z�Set the enable_ra option in /etc/ipa/default.conf to False
Note that api.env will retain the old value (it is readonly).
r� r� �False�wN)r �readr r� ry rz r� rC )�parser�fprP rP rQ �
disable_ra� s
r� c C s� t d�}|jd� dddd�|j� |jdd�|jd|�|j� |jd d
jtd)d*|�dd��|jdd
jtd+d,|�dd��|jdd�|jdd�|jdd�|j� |jdd�|jdd�|jd d �|jd d �|j� g} | s�|js�|j�r |j� r�| j|jd d!�� n"| j|jd d"jt j
|d# ���� n| j|jd$|�� | j|j� � xd|D ]\}
y| j |
� |j |
| � W n: t
k
�r� } z tjd%|
t| �� d&d'|
fS d } ~ X nX �qDW |�r�d#d'd(j|�fS d-S ).Nz
IPA Installer� r� z#File modified by ipa-client-install)rX r� r� � ldap_version�3�baseZnss_base_passwdz {dn}{suffix}�cn�users�accountsz?sub)Zdn�suffixZnss_base_group�groupsZ
nss_schemaZ
rfc2307bisZnss_map_attributezuniqueMember memberZnss_initgroups_ignoreusersz root,dirsrvZnss_reconnect_maxsleeptime�8Znss_reconnect_sleeptime�1Zbind_timelimit�5� timelimit�15�urizldap://localhostz ldap://{}r Znss_srv_domainzCreation of %s failed: %sr4 �LDAPz, )r� r� )r� r� )r� r� )r� r� )r NN)r9 r� r� r� r} r( �forcer� rs r% r� r� r� ri rH rI rW r~ ) r� r� r� r� r� �dnsokrL �files�ldapconfr� rU rV rP rP rQ rl � sV
rl c
C s t d�}|jd� dddd�|j� |jdd�|jd|�|j� |jd ttd d |���|jd
ttd d |���|jdd�|j� g } | s�|js�|jr�|jr�| j|jdd�� q�| j|jddj t
j |d ���� n| j|jdd�� | j|j� � x^|D ]V}
y| j |
� |j
|
| � W n4 tk
�rD } ztjd|
t| �� d!S d } ~ X nX � q�W tjj} | j� �r�y | j� W n2 tk
�r� } zt| jd| � W Y d d } ~ X nX y | j� W n8 tk
�r� } ztjd| jt| �� W Y d d } ~ X nX ntjd| j� d"S ddd j|�fS )#Nz
IPA Installerr� r� z#File modified by ipa-client-install)rX r� r� r� r� r� z base passwdr� r� r� z
base groupr� r� r� r� zldap://localhostz ldap://{}r ZDNSzCreation of %s failed: %sr4 �restartz7Failed to enable automatic startup of the %s daemon: %sz.%s daemon is not installed, skip configurationZNSLCDz, )r� r� )r� r� )r� r� )r� r� )r4 NN)r NN)r9 r� r� r� rW r( r� r� rs r} r% r� r� r� ri rH rI r �
knownservices�nslcd� is_installedr� rZ rd rh �debugr~ )
r� r� r� r� r� r� rL r� Z nslcdconfr� rU rV r� rP rP rQ rp � s\
"rp c C s� t d�}|jd � dddd�|j� dddd�dddd�ddd d�ddd
d�ddd d�ddd d�ddd
d�dddd�|j� |j� ddddj|d �d�dddt|�d�ddddd�g}tj}| j|� d}y|j||� W n� t k
�r } z*t
j d|� t
j d|j|t|�d�� d S d }~X n� t
k
�rf } z*t
j d |� t
j d|j|t|�d�� d S d }~X n< tk
�r� } z t
j d|j|t|�d�� d S d }~X nX tj|d � d S )!Nz
IPA Installerr� � r� z$ File modified by ipa-client-install)rX r� r� z< We do not want to break your existing configuration, hence:z URI, BASE, and SASL_MECHz( have been added if they were not set.z@ In case any of them were set, a comment has been inserted andz9 "# CONF_NAME modified by IPA" added to the line above.z? To use IPA server with openLDAP tools, please comment out yourz; existing configuration for these options and uncomment thez& corresponding lines generated by IPA.Z addifnotsetZURI�optionz
ldaps://{}r )rY rX r� r� ZBASEZ SASL_MECHZGSSAPIz%Configuring {path} failed with: {err}zCould not parse %sz%s)r[ �errFz%s does not exist.i� T)r� r� )r9 r� r� r} rW r �OPENLDAP_LDAP_CONFr� �
changeConf� SyntaxErrorrH �infor� r� ri rB r� )r� r� r� r� r� r� Z error_msgrV rP rP rQ �configure_openldap_conf s|
r� c C sj t jjtj�sdS td�}|jd� |jddjt j
| d ���|j � g}|j tj|� t
jd| d � dS )ze
DNS Discovery didn't return a valid IPA server, hardcode a value into
the file instead.
Nz
IPA Installerr� r� z ldap://{}r zHChanged configuration of /etc/ldap.conf to use hardcoded server name: %s)rB r[ rr r rq r9 r� r� r} r% r� r� r� rH r� )r� r� r� rP rP rQ �hardcode_ldap_serverx s
r� c C sJ t jjtjt jjtj�d �} tj| tj� t j tjd� t
j tj� d S )Nz .templatei� ) rB r[ r~ r ZUSR_SHARE_IPA_CLIENT_DIR�basenameZ KRB5_FREEIPA�shutil�copyr� r! Zrestore_context)�templaterP rP rQ �configure_krb5_snippet� s r� c
C s� t � td�}
|
jd3� |
jd4� |
jd5� |
jd6� d d d d
�|
j� g} tjj t
j �rp| j ddt
j dd�g� |
j
d| �g} | s�| s�|r�| j |
j
dd�g� n| j |
j
dd�g� | j |
j
dd�|
j
dd�|
j
dd�|
j
dd�|
j
dd�|
j
dd �g� tj� �r$tjd � | j|
j
d d �� | j |
jd | �|
j� g� g }
| �sX| �sX|�r�x`|D ]X}|
j |
j
d!tj|d"��|
j
d#tj|d"��|
j
d$tj|d%��|
j
d&tj|d'��g� �q^W |
j|
j
d(|�� |
j|
j
d)d*t
j �� |
j|
j
d+d*t
j �� | d,|
d
�g}| j|
jd-|�� | j|
j� � |
j
d.j|�| �|
j
|| �|
j
|| �g}||k�r�|j |
j
d.j|�| �|
j
|| �g� | j |
jd/|�|
j� g� tjd0|� tjd1|
j| �� |
j|| � tj|d2� d S )7Nz
IPA Installer� = r� r� r� �{�}� � � r� z#File modified by ipa-client-install)rX r� r� Z
includedirr� )rX r� r� ZdelimZ
default_realmZdns_lookup_realmZfalse�trueZrdnsZdns_canonicalize_hostnameZdns_lookup_kdcZticket_lifetimeZ24hZ forwardableZudp_preference_limit�0z"Enabling persistent keyring CCACHEZdefault_ccache_namezKEYRING:persistent:%{uid}Z libdefaults�kdc�X Z
master_kdcZ admin_serveri� Zkpasswd_serveri� Zdefault_domain�pkinit_anchorszFILE:%sZ pkinit_poolZ
subsectionZrealmsz.{}Z domain_realmz%Writing Kerberos configuration to %s:z%si� )r� r� )r� r� )r� r� )r� r� r� ) r� r9 r� r� ZsetSubSectionDelimitersZ setIndentr� rB r[ r\ r ZCOMMON_KRB5_CONF_DIRr� r� r# Z is_persistent_keyring_supportedrH r� rs r� r% r� �KDC_CA_BUNDLE_PEM�
CA_BUNDLE_PEMr} �dumpr� r� )r� r� r� �cli_kdcr� rU �
client_domain�client_hostnamer� �configure_sssdZkrbconfr� ZliboptsZkroptsr� ZroptsZdroptsrP rP rQ �configure_krb5_conf� s�
r� c , C sh t jj}|jsVy |j� W n6 tk
rP } ztjd|jt |�� W Y d d }~X nX d S |shtj
d� d S d||f }|j r�tj |� y|j
� |j� W n@ tk
r� } z$tjd|jt |�� tj
d� W Y d d }~X nX t td|f|��} tjjtjd�}
y"tjtjdd | |g||
d
d � W nD tk
�rb } z&tjd � td
j|j|�td��W Y d d }~X nX d S )Nz1Failed to conditionally restart the %s daemon: %szGAn RA is not configured on the server. Not requesting host certificate.z
host/%s@%sz:Failed to configure automatic startup of the %s daemon: %sz6Automatic certificate management will not be available�CNz pwdfile.txtZNSSDBzLocal IPA host�x )ZcertpathZstorage�nickname�subject�dns� principal� passwd_fnameZresubmit_timeoutzcertmonger request failedz*{} request for host certificate failed: {})rv )r r� r � request_certZ try_restartri rH rI rd rW rj r Zadd_principal_to_casrh rk r( rB r[ r~ r �
IPA_NSSDB_DIRZrequest_and_wait_for_cert� exceptionr' r} �CLIENT_INSTALL_ERROR) r� � subject_baser� r rL �
ca_enabled�cmongerrV r� r� r rP rP rQ �configure_certmonger sT
r c 1 C s� yt j � }|j� W n� tk
r� } z|tjjtj�rb|jrbt j
dt |�� t j
d� t j d� dS t
|t�rnnt j
d� t j d� t jd� t j � }|j� W Y d d }~X nX y|j|�} W nH t jk
�r t j d|� t j d� t j � }|j� |j|�} Y nX |j�rt|� |j�r.tjjtj��sF|j�r�tjjtj��r�y|jd � W nL t jk
�rl Y n6 t j k
�r� t j
d
� t j d � t j d � Y nX |j d � |j �ry|jd
� W n8 t jk
�r� Y n" t j k
�r� t j
d� Y nX |j d
� t j | � | j!dd� |j �r<||k�r<| j"d|� |j�sx|j#�r`| j"ddj$|�� n| j"dddj$|� � nd| j"dd� | j"d|d � y|j%d�}
W n" t j&k
�r� |jd�}
Y nX |
j"dd� |j'|
� t(|d� t(|d� | j"d |� | j"d |� |j)� |j)� k�r&| j"d |� | j!dd � | j!dd � |j*�sT| j!dd!� n | j!d"d!� | j"d#d$� | j"d%tj+� |j,�r�| j"d&d$� |j-�r�| j"d'd(� nt.|d �} | j"d'| � |j/�r�| j"d)d$� | j0d$� |j1| � |j2tj� dS )*Nz+SSSD config exists but cannot be parsed: %sz/Was instructed to preserve existing SSSD configz=Correct errors in /etc/sssd/sssd.conf and re-run installationr4 zxUnable to parse existing SSSD config. As option --preserve-sssd was not specified, new config will override the old one.zOThe old /etc/sssd/sssd.conf is backed up and will be restored during uninstall.z New SSSD config will be createdzLDomain %s is already configured in existing SSSD config, creating a new one.Zsshz2Unable to activate the SSH service in SSSD config.z@Please make sure you have SSSD built with SSH support installed.z6Configure SSH support manually in /etc/sssd/sssd.conf.�sudoz3Unable to activate the SUDO service in SSSD config.r� �idZdns_discovery_domainZ
ipa_serverz, z _srv_, %sZipa_server_moder� r ZnssZmemcache_timeoutiX Zpam�
ipa_domain� ipa_hostnameZ
krb5_realmZauthZchpass�access�permitZcache_credentialsTZldap_tls_cacert�
dyndns_updateZ dyndns_iface�*Z krb5_store_password_if_offline)3r� r� ri rB r[ r\ r � SSSD_CONFZ
preserve_sssdrH rI rW r� �
isinstancer� r� Z
new_configZ
new_domainZDomainAlreadyExistsErrorr� �sssd_enable_ifp�conf_sshrr �
SSH_CONFIG� conf_sshd� SSHD_CONFIG� new_service�ServiceAlreadyExists�ServiceNotRecognizedError�activate_service� conf_sudor! Zenable_sssd_sudoZ add_provider�
set_option�primaryr~ � get_serviceZNoServiceError� save_service�sssd_enable_service�lowerr r] � dns_updates�all_ip_addresses� get_server_connection_interface�krb5_offline_passwordsZ
set_active� save_domainr� ) r� r� r� r� rL r� r� r� rV r� Z nss_service�ifacerP rP rQ �configure_sssd_confU s�
r) c C sr y| j |� W nN tjk
r$ Y n: tjk
r\ tjd|� tjd|� tjd|� d S X | j|� | j|�S )Nz3Unable to activate the '%s' service in SSSD config.z?Please make sure you have SSSD built with %s support installed.z5Configure %s support manually in /etc/sssd/sssd.conf.) r r� r r rH rI r� r r )r� rX rP rP rQ r! � s
r! c
C s� t | d�}|dkrdS y|jd�}W n tjk
r@ t� }Y nX dd� |jd�D �}|jddh�rn|jd� |jt� |r�|jt j
� |j dd j t
|��� | j|� dS )
a Enable and configure libsss_simpleifp plugin
Allow the ``ipaapi`` user to access IFP. In case allow_httpd is true,
the Apache HTTPd user is also allowed to access IFP. For smart card
authentication, mod_lookup_identity must be allowed to access user
information.
ZifpNZ allowed_uidsc S s h | ]}|j � r|j � �qS rP )�strip)�.0�srP rP rQ � <setcomp> s z"sssd_enable_ifp.<locals>.<setcomp>�,r� �rootz, )r! r� r� r� ry �split�
isdisjointr| r r Z
HTTPD_USERr r~ r r )r� Z allow_httpdr ZuidsrP rP rQ r s
r c
C s� |sdS yt | d�}W n2 tk
rH } ztjd| t|�� dS d }~X nX tdd� |D ��}tdd� |D ��}g }d}xr|D ]j} | jd�} | j� }
|
s�|
jd �r�|j | � q||
j
� d
j � } | |kr�d}P | |kr�d | } |j | � q|W x.|j � D ]"\} } | d k r�|j d | | f � q�W |�r4|j d � |j | � x"|D ]} | jd�} |j | � �q:W |j d � |j
� yt | d
�}W n4 tk
�r� } ztjd| t|�� dS d }~X nX |jdj|�� |j
� dS )NT�rzFailed to open '%s': %sFc s s | ]}|j � V qd S )N)r" )r+ �keyrP rP rQ � <genexpr>4 s z$change_ssh_config.<locals>.<genexpr>c s s | ]}|j � V qd S )N)r" )r+ r3 rP rP rQ r4 5 s �
�#r z%s %sr� r� )rz r� rH rI rW �tuple�rstripr* �
startswithrs r0 r" �itemsrC r� r~ )
rU �changesZsectionsr� rV Z change_keysZ section_keys�linesZ
in_sectionr� Zpliner� r� rP rP rQ �change_ssh_config* sV
r= c C s^ t jjtj�s tjdtj� d S | jtj� dd� }|� rDt|� nt |� tjdtj� d S )Nz$%s not found, skipping configurationc S s: t tjd��$} x | D ]}tjd|�rdS qW W d Q R X dS )Nr2 z
^Include\sTF)rz r r rw r{ )r� r� rP rP rQ � ssh_version_supports_includeg s
z:configure_ssh_config.<locals>.ssh_version_supports_includez
Configured %s)
rB r[ rr r r rH r� r� �create_ssh_ipa_config�modify_ssh_config)r� rL r> rP rP rQ �configure_ssh_config` s
rA c C sX ddi}| j r4tjjtj�r4dtj |d< tj|d< | jrBd|d< ttj |ddg� d S ) N�PubkeyAuthentication�yesz
%s -p %%p %%hZ ProxyCommandZGlobalKnownHostsFileZVerifyHostKeyDNSZHost�Match)
r7 rB r[ rr r �SSS_SSH_KNOWNHOSTSPROXY�SSSD_PUBCONF_KNOWN_HOSTS� trust_sshfpr= r )rL r; rP rP rQ r@ v s
r@ c C sf t | jotjjtj��}tjtjj tj
�tj t |r6dndtjtj
| jrJdndd�� tjtj d� dS )zAdd the IPA snippet for sshr� r6 )Z ENABLEPROXYZKNOWNHOSTSPROXYZ
KNOWNHOSTSZVERIFYHOSTKEYDNSi� N)�boolr7 rB r[ rr r rE r% �copy_template_filer~ ZSSH_IPA_CONFIG_TEMPLATE�SSH_IPA_CONFIG�dictrF rG r� )rL Z enableproxyrP rP rQ r? � s
r? c C s� t jj}tjjtj�s(tj dtj� d S | j
tj� dd� }|� rLt |� nt |� |j
� r�y |j� W n0 tk
r� } zt|jd|� W Y d d }~X nX d S )Nz$%s not found, skipping configurationc S s: t tjd��$} x | D ]}tjd|�rdS qW W d Q R X dS )Nr2 z
^Include\sTF)rz r r rw r{ )r� r� rP rP rQ � sshd_version_supports_include� s
z<configure_sshd_config.<locals>.sshd_version_supports_includer� )r r� �sshdrB r[ rr r r rH r� r� �create_sshd_ipa_config�modify_sshd_configrb r� ri rZ rd )r� rL rM rL rV rP rP rQ �configure_sshd_config� s
rP c C s� dddddd�}| j r�tjjtj�r�d }tjdd�tjdd�dtj dd�f}xd|D ]\}tjd d
tjg}x(|j� D ] }|j d � |j d | � qrW t
j |d
d�}|j dkrT|}P qTW |d k r�|j
|� n
tjd� ttj|dg� tjdtj� d S )NrC �no)rB ZKerberosAuthenticationZGSSAPIAuthenticationZUsePAMZ ChallengeResponseAuthenticationZnobody)�AuthorizedKeysCommandZAuthorizedKeysCommandUser)rR ZAuthorizedKeysCommandRunAsz%s %%u)Z PubKeyAgentZPubKeyAgentRunAsz-tz-fz-oz%s=%sF)�
raiseonerrr z�Installed OpenSSH server does not support dynamically loading authorized user keys. Public key authentication of IPA users will not be available.rD z
Configured %s)r7 rB r[ rr r �SSS_SSH_AUTHORIZEDKEYSZSSHD�devnullr: rs r% r0 �
returncode�updaterH rj r= r r� )rL r; Zauthorized_keys_changesZ
candidates� candidate�args�item�resultrP rP rQ rO � s8
rO c C s\ d}| j r*tjjtj�r*tjd�jtj�}t j
tjj tj �tj
t|d�� tjdtj
� dS )z Add the IPA snippet for sshdr� zZ AuthorizedKeysCommand {}
AuthorizedKeysCommandUser nobody
)ZSSSD_SSHD_OPTIONSz
Configured %sN)r7 rB r[ rr r rT �textwrap�dedentr} r% rI r~ ZSSHD_IPA_CONFIG_TEMPLATE�SSHD_IPA_CONFIGrK rH r� )rL Zsssd_sshd_optionsrP rP rQ rN � s
rN c C s� t jd� tjddd| jg}| jr6|jd| jd g� | jsF|jd� y t |�}W n2 t
k
r� } zt j dt |�� W Y d d }~X nX t jd |j
� d S )
Nz
Configuring automount:z--debugz-Uz
--locationz--serverr z --no-sssdz"Automount configuration failed: %sz%s)rH r� r �IPA_CLIENT_AUTOMOUNT�locationr� r� r7 rs r0 ri rI rW Z
output_log)rL rY r[ rV rP rP rQ �configure_automount� s
"ra c C s� | j p|}tjd|� d}tjjtj�rZytj tjgdd�}W n t
k
rR Y nX |j }|j dd|� |j ddt
jjj� � tj|� t
jjj� t
jjj� d S ) Nz Configuring %s as NIS domain.r� T)�capture_output�network� nisdomain�
domainnamer_ )rd rH r� rB r[ r\ r ZBIN_NISDOMAINNAMEr% r0 r. �outputrc r r� re ra r! �
set_nisdomainrh r� )rL r� re Znis_domain_namer[ rP rP rQ �configure_nisdomain s$
rh c C s` | j d�r@| jdd�pd}|r,tjd|� n
tjd� tj|� | jdd�}|s\tjjj � d S )Nrc rd r� zRestoring %s as NIS domain.z Unconfiguring the NIS domain.re r_ )
� has_staterg rH r� r! rg r r� re �disable)re Z
old_nisdomainr_ rP rP rQ �unconfigure_nisdomain1 s
rk c C sh xVt j� D ]J}t j|�}x:t jt jgD ]*}x$|j|g �D ]}|d | kr8|S q8W q&W q
W td| ��d S )N�addrz$IP %s not assigned to any interface.)� netifaces�
interfaces� ifaddresses�AF_INET�AF_INET6�get� RuntimeError)Zip_addr� interface�if_addrs�family�iprP rP rQ �get_iface_from_ipC s
rx c C s� | r | g}nt j� }g }x�|D ]�}t j|�}x�t jt jgD ]r}xl|j|g �D ]\}y(|jtj|d �� t j
d|d � W qL t k
r� } zt j
d|� W Y d d }~X qLX qLW q:W q W |S )Nrl zIP check successful: %szIP check failed: %s) rm rn ro rp rq rr rs r% �CheckedIPAddressrH r� �
ValueError)r( rn �ipsrt ru rv rw rV rP rP rQ �get_local_ipaddressesM s
*r| c 3 C s t jdt� t jd| � ttd��}|j| � W d Q R X d}y tjtjdtg� d}W �n� t k
�r� } �zjt jdt
|�� �y tjtjtg� y�t j � }|j � |j
� }x�|D ]�}|j|�}y|jd�}W n t jk
r� w�Y nX |tjjko�|d kr�y8|jd
�dk�r2|jd d � |j|� |jtj� P W q� t jk
�rN P Y q�X q�W W n> tk
�r� } z t jd
t
|�� t jd� W Y d d }~X nX d}W n4 t k
�r� } zt jdt
|�� W Y d d }~X nX W Y d d }~X nX ytjt� W n tk
�r Y nX |S )Nz Writing nsupdate commands to %s:z%sr� Fz-gTz nsupdate (GSS-TSIG) failed: %sr� r� r Z dyndns_authZnonez'Unable to update SSSD configuration: %sz{Failed to configure SSSD for unauthenticated DNS dynamic updates. SSSD might be unable to update DNS entries for this host.z#Unauthenticated nsupdate failed: %s)rH r� � UPDATE_FILErz r� r% r0 r ZNSUPDATEr. rW r� r� r� r� r� r� r �envr� r r' r ri r� rB rF ) �
update_txtr� r[ rV r� r� rX r� r� rP rP rQ � do_nsupdate` sV
4r� z)
update delete $HOSTNAME. IN A
show
send
z,
update delete $HOSTNAME. IN AAAA
show
send
z6
update add $HOSTNAME. $TTL IN A $IPADDRESS
show
send
z9
update add $HOSTNAME. $TTL IN AAAA $IPADDRESS
show
send
c 0 C s� y
t � }W n2 tk
r< } ztjd|� d }W Y d d }~X nX |jrZ|d krTtd��|}n�|jr�g }x�|jD ]}|jtj |�� qlW nvy t
| �}W n, tk
r� } ztjd|� d S d }~X nX y t |�}W n. tk
� r� } ztjd|� d S d }~X nX |�stj d� d S t |� d}|tj
tt|d��7 }|tj
tt|d��7 }xN|D ]F}t||dd�} |jdk�rrt}
n|jd k�r�t}
|tj
|
| �7 }�qNW t|��s�tjd
� t||� d S ) Nz Cannot update DNS records. %sz!Unable to get local IP addresses.z2Failed to determine this machine's ip address(es).zdebug
)�HOSTNAMEi� )r� Z IPADDRESSZTTLr< � z Failed to update DNS records.)r| r. rH rI r$ rs � ip_addressesrs r% ry r% r� r � template_str�DELETE_TEMPLATE_ArK �DELETE_TEMPLATE_AAAAr3 �ADD_TEMPLATE_A�ADD_TEMPLATE_AAAAr� �verify_dns_update) r� r rL r{ rV Z
update_ipsrw r( r Zsub_dictr� rP rP rQ �
update_dns� sT
r� c C s� dd� |D �}g }x�t jjt jjgD ]�}tjd| t jj|�� ytj| |�}W nj t j j
t j j fk
rx tjd� Y q$ t j j k
r� tjd� Y q$ t j
jk
r� tjd� Y q$X x>|D ]6}y|j|j� W q� tk
r� |j|j� Y q�X q�W q$W t jj| �}i }dd� |D �} x�|D ]�}
t|
�} tjd| � ytj| �}W np t j j
t j j fk
�rt tjd� Y n� t j j k
�r� tjd � Y n^ t j
jk
�r� tjd� Y n<X | j| � x.|D ]&}|j|k�s�|j| g �j|j� �q�W �q"W |�rtjd
| d j|�� |�r.tjd | d j|�� | �rFtjd
d j| �� |�r�tjd� x6|j� D ]*\}
} x | D ]}
tjd|
|
|� �qnW �q`W dS )zz
Verify that the fqdn resolves to all IP addresses and
that there's matching PTR record for every IP address.
c S s g | ] }t |��qS rP )rW )r+ rw rP rP rQ �
<listcomp>� s z%verify_dns_update.<locals>.<listcomp>z DNS resolver: Query: %s IN %szDNS resolver: No record.z0DNS resolver: No nameservers answered the query.zDNS resolver error.c S s g | ] }t |��qS rP )rW )r+ rw rP rP rQ r� s z DNS resolver: Query: %s IN PTRz/DNS resolver: No nameservers answered thequery.z)Missing A/AAAA record(s) for host %s: %s.z, z'Extra A/AAAA record(s) for host %s: %s.z.Missing reverse record(s) for address(es): %s.z Incorrect reverse record(s):z"%s is pointing to %s instead of %sN) r� Z rdatatype�AZAAAArH r� Zto_textr& ZresolveZresolverZNoAnswerZNXDOMAINZ
NoNameserversr Z DNSExceptionrF Zaddressrz rs rX Z from_textrW Zresolve_address�target�
setdefaultrj r~ r: )Zfqdnr{ Z missing_ipsZ extra_ipsZ record_typeZanswersZrdataZ fqdn_nameZ
wrong_reverseZmissing_reverserw Zip_strZtargetsr� rP rP rQ r� � sf
r� c
3 C s" d}x�t j| dt jt j�D ]�}|\}}}}}yt j |||�}W n* t jk
rh } z | }wW Y dd} ~ X nX zNy |j|� |j� }
|
d } W n* t jk
r� } z | }wW Y dd} ~ X nX W d|r�|j� X yt| �S t t
fk
r� } z
| }W Y dd} ~ X qX qW d} |�r| d| 7 } t
| ��dS )zMConnect to IPA server, get all ip addresses of interface used to connect
Ni� r z&Cannot get server connection interfacez: %s) �socketZ getaddrinfoZ AF_UNSPECZ SOCK_STREAMrI �connectZ getsocknamerC rx r. rs )
r� Z
last_error�resZafZsocktype�protoZ
_canonnameZsar, rV Zsocknamerw �msgrP rP rQ r% & s4
r% c C s� yt |� d}W nZ tjk
r6 tjd|� d}Y n6 tjk
rj } ztjd||� d}W Y d d }~X nX |js�|js�|js�| r�t | ||� d S )NTz*Hostname (%s) does not have A/AAAA record.Fz)DNS resolution for hostname %s failed: %s)
r r ZDNSNotARecordErrorrH rj ZDNSResolverErrorr# r$ r� r� )r� r rL Zdns_ok�exrP rP rQ �
client_dnsG s r� c C sV | j rRxJ| j D ]@}ytj|� W q tk
rL } ztjd|� dS d }~X qX qW dS )Nz%sFT)r� r% ry rz rH rI )rL rw rV rP rP rQ �check_ip_addresses\ s r� c
! C s$ t jj|�sd S g }x�t j|�D ]�}|jd�s0q t jj||�}yt|d�}W n6 tk
r� } ztj d|t
|�� w W Y d d }~X nX x�|D ]x}|j � }| s�|j d�r�q�y t
|�} W n6 ttfk
r� } ztjd||� w�W Y d d }~X nX tjd|� |j| � q�W |j� q W y,tjjjdtj| �dd � |D �d
d d � W nR tjk
�rV Y n< t k
�r� } z tjd
t
|�� tj d� d S d }~X nX |�r d}
d} | d| 7 } xV|D ]N} | j � } | d k �r�| d| |
| f 7 } | j � } | d k �r�| d| |
| f 7 } �q�W | d7 } t | ��s tj d� d S )Nz.pubr2 zFailed to open '%s': %sr6 z Decoding line '%s' failed: %sz Adding SSH public key from %sZhost_modc S s g | ] }|j � �qS rP )Zopenssh)r+ ZpkrP rP rQ r� � s z#update_ssh_keys.<locals>.<listcomp>Fz2.26)Z ipasshpubkeyZ updatednsr3 z host_mod: %sz&Failed to upload host SSH public keys.i� zdebug
z%update delete %s. IN SSHFP
show
send
z update add %s. %s IN SSHFP %s
z
show
send
z#Could not update DNS SSHFP records.) rB r[ �isdir�listdir�endswithr~ rz r� rH rj rW r* r9 r2 rz �UnicodeDecodeErrorr� r� rs rC r �Backend� rpcclient�forwardr% �fsdecoder Z EmptyModlistri Zfingerprint_dns_sha1Zfingerprint_dns_sha256r� )
r Zssh_dir� create_sshfpZpubkeysr� rU r� rV r� ZpubkeyZttlr ZsshfprP rP rQ �update_ssh_keysg sj
r� c C s t jd� d S )Na/ Please make sure the following ports are opened in the firewall settings:
TCP: 80, 88, 389
UDP: 88 (at least one of TCP/UDP ports 88 has to be open)
Also note that following ports are necessary for ipa-client working properly after enrollment:
TCP: 464
UDP: 464, 123 (if NTP enabled))rH r� rP rP rP rQ �print_port_conf_info� s r� � c C s� | rd| }nd}xd|D ]\}|d|t |j�f 7 }|d|t |j�f 7 }|d||jf 7 }|d||jf 7 }|d7 }qW |d d � }|S )
Nz%s
r� z%sSubject: %s
z%sIssuer: %s
z%sValid From: %s
z%sValid Until: %s
r5 r4 ���)r( r� ZissuerZnot_valid_beforeZnot_valid_after)r� �certs�indentr, �certrP rP rQ � cert_summary� s
r� c C s� t jj| �}z�y |j� tj||||�}W n� tjk
rL tj| d��Y nf tj k
r� } ztj |j
t |�d��W Y d d }~X n0 t k
r� } ztj
t |���W Y d d }~X nX W d |j� X |S )N)�entry)r� rI )r$ Z
LDAPClientZfrom_hostname_plainZ gssapi_bindr � get_ca_certsr ZNotFound�NoCertificateError� NetworkErrorZldap_urirW ri � LDAPErrorZunbind)r� Zbase_dnr� r Zconnr� rV rP rP rQ �get_certs_from_ldap� s $$
r� c C s� yt | d�}W n$ tk
r2 tjd| d��Y nX |jdkrNtjd| d��|j}tjj|�sptjd| d��tjj|�s�tjd| d��t j
d|� yt j |�}W n tk
r� tj
|d��Y nX |S ) z�
Get the CA cert from a user supplied file and write it into the
paths.IPA_CA_CRT file.
Raises errors.NoCertificateError if unable to read cert.
Raises errors.FileError if unable to write cert.
�filez unable to parse file url '%s')�reasonz url is not a file scheme '%s'zfile '%s' does not existzfile '%s' is not a filez'trying to retrieve CA cert from file %s)r� )r ri r � FileError�schemer[ rB r\ rr rH r� r � load_certificate_list_from_filer� )�urlZparsedrU r� rP rP rQ �get_ca_certs_from_file� s"
r� c C s� |rt jd� t jd| � yttjdd| gdd�}W n tk
rT tj| d��Y nX |j }yt
j |�}W n t k
r� tj| d��Y nX |S )z�
Use HTTP to retrieve the CA cert and write it into the paths.IPA_CA_CRT
file. This is insecure and should be avoided.
Raises errors.NoCertificateError if unable to retrieve and write cert.
z9Downloading the CA certificate via HTTP, this is INSECUREz+trying to retrieve CA cert via HTTP from %sz-o�-T)rb )r� )
rH rj r� r0 r ZBIN_CURLr. r r� Z
raw_outputr Zload_certificate_listri )r� r� r[ �stdoutr� rP rP rQ �get_ca_certs_from_http� s
r� c C sb t jd| � yt| ||d�}W n0 tk
rN } zt jd|� � W Y dd}~X nX dd� |D �}|S )a�
Retrieve th CA cert from the LDAP server by binding to the
server with GSSAPI using the current Kerberos credentials.
Write the retrieved cert into the paths.IPA_CA_CRT file.
Raises errors.NoCertificateError if cert is not found.
Raises errors.NetworkError if LDAP connection can't be established.
Raises errors.LDAPError for any other generic LDAP error.
Raises errors.OnlyOneValueAllowed if more than one cert is found.
Raises errors.FileError if unable to write cert.
z+trying to retrieve CA cert via LDAP from %sFz"get_ca_certs_from_ldap() error: %sNc S s g | ]}|d dk r|d �qS )r: Fr rP )r+ �crP rP rQ r� ) s z*get_ca_certs_from_ldap.<locals>.<listcomp>)rH r� r� ri )r� r� r� r� rV rP rP rQ �get_ca_certs_from_ldap s
r� c C s� | d kr t jdtd|�� d S t| �} t|�}| |kr�t jdtj� t jdtd| �� t jdtd|�� |rxt jd� q�| s�tdd� r�tj d d
��n
t j
d � d S ) Nz%sz Successfully retrieved CA certz^The CA cert available from the IPA server does not match the
local certificate available at %szExisting CA cert:zRetrieved CA cert:z Overriding existing CA cert
zcDo you want to replace the local certificate with the CA
certificate retrieved from the IPA server?Tz Retrieved CA)rX z4Existing CA cert and Retrieved CA cert are identical) rH r� r� ry rj r r] r1 r ZCertificateInvalidErrorr� )�existing_ca_certsZ new_ca_certsZask�overriderP rP rQ �validate_new_ca_certs- s2 r� c R s� t jd }�fdd�}� fdd�}�fdd�}� j } � jdkoH� jdk }
d} d} � jr�|� }
y t|
�} W nj tjk
r� } zt j
d |� � W Y dd}~X n: t k
r� } z t j
d |� tj |
d
��W Y dd}~X nX t j
d � �n�t
jjt j��rht
jjt j��rRytjt j�} W n: t k
�rN } z tjd t j|f d
��W Y dd}~X nX ntjdt j� d�d
��|
�r| �r�t jd� n�|� }
| }| �r�td|
d d� �r�tj dd��yt|
|�} W n< t k
�r� } z t j
d |� tj |
d
��W Y dd}~X nX t| | d|� �n�|� }
y t�||�} t| | | � W �np tjk
�rl } zt j
d |� � W Y dd}~X �n< tj tjfk
�rh } z�t j
d t|�� |� }
| �r�t jd� n�| �r�td|
d d� �r�tj dd��n�| �r� j �rt j d� tj dd��nVy t|
�} W n< t k
�rJ } z t j
d |� tj |
d
��W Y dd}~X nX t| | | � W Y dd}~X n@ t k
�r� } z"t j
d t|�� tj |
d
��W Y dd}~X nX | dk�r�| dk�r�tj d| ��| dk �r�ytj | |d d � W n� t k
�rp } zjt
jj|��rLyt
j |� W n2 t k
�rJ } zt j d ||� W Y dd}~X nX tjd ||f d
��W Y dd}~X nX t
j!|t j� yt
j"t jd � W n: t k
�r� } z tjd t j|f d
��W Y dd}~X nX dS )!a}
Examine the different options and determine a method for obtaining
the CA cert.
If successful the CA cert will have been written into paths.IPA_CA_CRT.
Raises errors.NoCertificateError if not successful.
The logic for determining how to load the CA cert is as follow:
In the OTP case (not -p and -w):
1. load from user supplied cert file
2. else load from HTTP
In the 'user_auth' case ((-p and -w) or interactive):
1. load from user supplied cert file
2. load from LDAP using SASL/GSS/Krb5 auth
(provides mutual authentication, integrity and security)
3. if LDAP failed and interactive ask for permission to
use insecure HTTP (default: No)
In the unattended case:
1. load from user supplied cert file
2. load from HTTP if --force specified else fail
In all cases if HTTP is used emit warning message
z.newc s t dtj� �ddddf�S )NZldapr� )r r% r� rP )r� rP rQ �ldap_urln s z get_ca_certs.<locals>.ldap_urlc s t dd� jdddf�S )Nr� r� )r � ca_cert_filerP )rL rP rQ �file_urlr s
z get_ca_certs.<locals>.file_urlc s t dtj� �ddddf�S )NZhttpz/ipa/config/ca.crtr� )r r% r� rP )r� rP rQ �http_urlv s z get_ca_certs.<locals>.http_urlNz%s)r� z!CA cert provided by user, use it!z(Unable to load existing CA cert '%s': %s)r� zExisting ca cert 'z' is not a plain filez$OTP case, CA cert preexisted, use itz)Do you want to download the CA cert from z ?
(this is INSECURE)Fz*HTTP certificate download declined by user)�messagezKUnable to download CA cert from LDAP
but found preexisting cert, using it.
zOUnable to download CA cert from LDAP.
Do you want to download the CA cert from z?
(this is INSECURE)z�In unattended mode without a One Time Password (OTP) or without --ca-cert-file
You must specify --force to retrieve the CA cert using HTTPz*HTTP certificate download requires --forcez4expected CA cert file '%s' to exist, but it's absenti� )�modezFailed to remove '%s': %sz&cannot write certificate file '%s': %sz*Unable set permissions on ca cert '%s': %s)#r r] �
unattendedr� �passwordr� r� r r� rH r� ri r� rB r[ r\ rr r r� r� r1 r� r� r� r� rW rj r� rI Z
InternalError�write_certificate_list�unlinkrG �renamer� )r� rL r� r� r� Zca_filer� r� r� � interactiveZotp_authr� �ca_certsr� rV r� �e2rP )rL r� rQ r� L s�
$
r� a
/* Kerberos SSO configuration */
pref("network.negotiate-auth.trusted-uris", ".$DOMAIN");
/* These are the defaults */
pref("network.negotiate-auth.gsslib", "");
pref("network.negotiate-auth.using-native-gsslib", true);
pref("network.negotiate-auth.allow-proxies", true);
z
all-ipa.jsz browser/defaults/preferencesc
C s� �y�t jd� d }| jd k rLtjj| jt�}tjj|�r>|}q�t jd|� nTtjj t
j �r�xDt
j t
j
gD ]$}tjj|t�}tjj|�rh|}P qhW nt jd� d S |d k �rttjj|�}t jd|� tjj|t�}tjtt|d��}t jd|� t jd|� y<t|d��}|j|� W d Q R X t jd � |jd
d |� W n: tk
�rp } z t jd | � t jd
� W Y d d } ~ X nX nt jd� t jd
� W n> tk
�r� } z t jdt| �� t jd
� W Y d d } ~ X nX d S )Nz!Setting up Firefox configuration.z Directory '%s' does not exists.z2Firefox configuration skipped (Firefox not found).z)Firefox preferences directory found '%s'.)ZDOMAINz1Firefox trusted uris will be set as '.%s' domain.z2Firefox configuration will be stored in '%s' file.r� z Firefox sucessfully configured.�firefox�preferences_fnamez6An error occured during creating preferences file: %s.z Firefox configuration failed.z(Firefox preferences directory not found.z%s)rH r� � firefox_dirrB r[ r~ � FIREFOX_PREFERENCES_REL_PATHr� rI rr r ZFIREFOXZ LIB_FIREFOXZ
LIB64_FIREFOX�abspath� FIREFOX_PREFERENCES_FILENAMEr% r� �FIREFOX_CONFIG_TEMPLATErK rz r� r� rc ri rW )
rL re r� Zpreferences_dirZ pref_pathr[ r� r r� rV rP rP rQ �configure_firefox s`
r� c C sl y t jtjdtjd| g� W n: tk
rV } z |jdkrFtjd|j� W Y d d }~X nX tj d| tj� d S ) Nz-kz-rr; � � z@Error trying to clean keytab: /usr/sbin/ipa-rmkeytab returned %sz%Removed old keys for realm %s from %s)r; r� r� )
r% r0 r � IPA_RMKEYTAB� KRB5_KEYTABr. rV rH rI r� )r� rV rP rP rQ �purge_host_keytabK s
r� c
> C sN
t d� t djtj�� t d� d}d}tj� dks@tdtd��tj � t
| j d�rrt j
d � t jd
� ttd��t� | jr�y tj� W nH tjk
r� } zt d j|j�� W Y d d }~X n tjk
r� Y nX | j�r.| jd k�r.| jd k�r.| jd k�r.| jd k�r.| j d k�r.| j �r.td
td��| jd k �r^| jd k �sR| jd k �r^tdtd��| j �rr| j a da nt a da t t j � k�r�tdjt �td��t dgk�r�tdjt �td��yt!t t"d� W n6 t#k
�r� } ztdj|�td��W Y d d }~X nX tj$� �r | j% �r tdtd��tj$� �r@| j&�r@tdtd��tj'� �r`| j(�r`tdtd��| j)�r�yt*j+ddg� W n t,k
�r� t jd � Y nX | j%�s�tj-j.t/j0��s�td td��t1� \}a2|�s�td td��| j�r�| j�r�td td��| j�r| j3�rt j4d � yt5j6d!t/j7id"d#� W n2 t5j8j9k
�r\ t j:d$t/j7� t;t/j7� Y nX | j< �r�t=| j<�t/j>k�r�t j4d%t/j>� t?| ��s�ttd��t@jA� }|jB| jC| jD| jEt t=| j<�d&�}| jD�r|dk�rt j
d'd(jF| jD�� t j
d)� tG� ttd��|t@jHk�r.t j
d*� t jd+� ttd��|t@jIk�rLtd,jt �td��|t@jJt@jKfk�sh|jC �r<|t@jJk�r�|jD�r�t j:d-|jD� n
t j:d.� n:|t@jKk�r�|jD�r�t j:d/|jD� n
t j:d0� n
t j:d1� | jC�r�| jCaLd}n<| j�r�td2td��n&t jd3� tMd4d d5�aLd6}t j:d7tL� |jBtL| jDt t=| j<�d8�}tL�sb|jC�rb|jCaL|jN}t j:d9tL� t t jOd:�d; d � aP|t@jJt@jKfk�s�|jD �rt j:d<� | jD�r�| jDaQd}nB| j�r�td=td��n,t j:d>� tMd?d d5�gaQd6}t j:d@tQd � |jBtLtQt t=| j<�d8�}nP| jD�sT|jR|jCtS� dA�\}}|�rH|�rHt j:dB� dCaTn
t j:dD� n
t j:dE� tQ�s�| jD�r�|jUaQd}t j:dFd(jF| jD�� n$|jD�r�|jUaQ|jV}t j:dGtQd � |t@jKk�r�t j
dHtQd � tG� t j:dItQd |� ttd��|t@jWk�r t j4dJ� t jdK� t jdL� d}|t@jXk�r@t j4dM� t jdK� d}|dk�r�t j
d'tQd � t j
d)� tG� t j:dItQd |� ttd��|jYaZtT�r�tZ �r�t j
dN|j[j � � t j:dI|j[|j\� t j
dO� tT�r�t jdP� nD| j�s | jD�s�t j4dQ� t jdR� t jdS� tMdTd ��s ttd��| j�r\| j �r\| j �r\| j]�pF| j^ �r\tj_� \| _]| _^|j[a`|j\} t j:dUt`� | jE�r�| jEt`k�r�t j
dV| jEt`� t j:dIt`| � ttd��|jaab|jc}
t j:dWtb� tddXt`f�aet jdYt � t j:dZt � t jd[t`� t j:d\| � t jd]tL� t j:d^|� t jd_d(jFtQ�� t j:d`|� t jdatb� t j:db|
� | j � s�| j]� r�x | j]D ]}t jdc|� � qjW | j^� r�t jdd| j^� x�tQD ]�} ytfjgtfjh| � dC} W nL tfj
k
�
r ytfjgtfji| � dC} W n tfj
k
� r� d } Y nX Y nX | � r�t � t j4de� P � q�W t � | j �
rJtMdfd � �
rJttd��d S )hNz$This program will set up IPA client.z
Version {}r� zUnknown sourcer z+You must be root to run ipa-client-install.)rv )r� z0IPA client is already configured on this system.zcIf you want to reinstall the IPA client, uninstall it first using 'ipa-client-install --uninstall'.zaWARNING: conflicting time&date synchronization service '{}' will be disabled in favor of chronyd
Fz1One of password / principal / keytab is required.z=pkinit_identity is mutually exclusive with password / keytab.zProvided as optionzMachine's FQDNz*Invalid hostname '{}', must be lower-case.� localhost�localhost.localdomainz(Invalid hostname, '{}' must not be used.)�maxlenzinvalid hostname: {}z�Option '--no-sssd' is incompatible with the 'authselect' tool provided by this distribution for configuring system authentication resourcesz�Option '--noac' is incompatible with the 'authselect' tool provided by this distribution for configuring system authentication resourcesz�Option '--mkhomedir' is incompatible with the 'authselect' tool provided by this distribution for configuring system authentication resourcesr z-VzhThe sudo binary does not seem to be present on this system. Please consider installing sudo if required.z&The pam_krb5 package must be installedzBOne of these packages must be installed: nss_ldap or nss-pam-ldapdz9Options 'principal' and 'keytab' cannot be used together.zZOption 'force-join' has no additional effect when used with together with option 'keytab'.�keytabZaccept)ZstoreZusagez Deleting invalid keytab: '%s'.z Using existing certificate '%s'.)r� �serversr� r � ca_cert_pathz*Failed to verify that %s is an IPA Server.z, zgThis may mean that the remote server is not up or is not reachable due to network or firewall settings.z/Can't get the fully qualified name of this hostz,Check that the client is properly configuredz${} is not a fully-qualified hostnamez%s is not an LDAP serverzNo LDAP server foundz%s is not an IPA serverzNo IPA server foundzDomain not foundz7Unable to discover domain, not provided on command linez1DNS discovery failed to determine your DNS domainz<Provide the domain name of your IPA server (ex: example.com))� allow_emptyzProvided interactivelyz*will use interactively provided domain: %s)r� r� r r� z will use discovered domain: %s�.r4 zIPA Server not foundz!Unable to find IPA Server to joinz+DNS discovery failed to find the IPA Serverz2Provide your IPA server name (ex: ipa.example.com)z*will use interactively provided server: %szValidating DNS Discoveryz!DNS validated, enabling discoveryTz)DNS discovery failed, disabling discoveryz8Using servers from command line, disabling DNS discoveryz will use provided server: %sz will use discovered server: %sz%s is not an IPA v2 Server.z(%s: %s)z0Anonymous access to the LDAP server is disabled.z'Proceeding without strict verification.zNNote: This is not an error if anonymous access has been explicitly restricted.z:The LDAP server requires TLS is but we do not have the CA.zCDNS domain '%s' is not configured for automatic KDC address lookup.z'KDC address will be set to fixed value.zDiscovery was successful!zoThe failure to use DNS to find your IPA server indicates that your resolv.conf file is not properly configured.zJAutodiscovery of servers for failover cannot work with this configuration.z�If you proceed with the installation, services will be configured to always access the discovered server for all operations and will not fail over to other servers in case of failure.z/Proceed with fixed values and no DNS discovery?z will use discovered realm: %sz?The provided realm name [%s] does not match discovered one [%s]z will use discovered basedn: %s�OzClient hostname: %szHostname source: %sz Realm: %szRealm source: %szDNS Domain: %szDNS Domain source: %szIPA Server: %szIPA Server source: %sz
BaseDN: %szBaseDN source: %szNTP server: %sz NTP pool: %szpIt seems that you are using an IP address instead of FQDN as an argument to --server. The installation may fail.z3Continue to configure the system with these values?)r� r� )j�printr} r3 �VERSIONrB �getegidr' r r! Zcheck_selinux_statusr r� rH rI r� �CLIENT_ALREADY_CONFIGUREDr� �conf_ntpr6 Zcheck_timedate_servicesZNTPConflictingServiceZconflicting_serviceZNTPConfigurationErrorr� r� r� r� �pkinit_identity�prompt_passwordr �hostname_sourcer r" r r
rz Zis_nosssd_supportedr7 �no_acZis_mkhomedir_supported� mkhomedirr r% r0 �FileNotFoundErrorr[ r\ r Z PAM_KRB5_SOru � nosssd_files�
force_joinrj �gssapiZ Credentialsr� �
exceptions�GSSErrorr� rK r� r^ r] r� r8 � IPADiscovery�searchr� r� �
realm_namer~ r� ZBAD_HOST_CONFIGZNOT_FQDNZNO_LDAP_SERVERZNOT_IPA_SERVERr� r1 Z
domain_source�findr� r� Z check_domainry r� r� Z
server_sourceZNO_ACCESS_TO_LDAPZ NO_TLS_LDAPr� r� r� Z realm_source� ntp_servers�ntp_poolZget_time_sourcer� r� r� Z
basedn_sourcer( r r� Z inet_ptonrp rq )
rL Zcli_domain_sourceZcli_server_sourcerV Znssldap_installed�ds�retr� r� Zcli_realm_sourceZcli_basedn_sourceZsrvZ is_ipaddrrP rP rQ �
install_check` s`
r� c C s4 | d krt jtj�} | jddd� tj| jd� d S )Ni� T)r� Zbackupi� )r" � NSSDatabaser r � create_dbrB r� Zpwd_file)ZdbrP rP rQ �create_ipa_nssdb
s r� c C sH t jtj�} t jtj�}| j� s(t| � | jdkr>| jdd� x�dt j fdt j
ffD ]z\}}y|j |�}W n t k
r� wTY nX y| j
|||� W qT tjk
r� } zt d|| j|f ��W Y d d }~X qTX qTW xp| j� D ]d\}}xZ|j|��r>y|j|� W q� tjk
�r: } zt d||j|f ��W Y d d }~X q�X q�W q�W d S )NZdbmF)Z
rename_oldzIPA CAzExternal CA certzFailed to add %s to %s: %sz Failed to remove %s from %s: %s)r" r� r r �
NSS_DB_DIRr\ r� ZdbtypeZ
convert_dbZIPA_CA_TRUST_FLAGS�EXTERNAL_CA_TRUST_FLAGSZget_certrs �add_certr% r. �secdirZ
list_certs� has_nicknameZ delete_cert)�ipa_db�sys_dbr� � trust_flagsr� rV rP rP rQ �update_ipa_nssdb
s2
&r c C s� t j|� | rN| rNtj� }|jtdddd�} | rNx| D ]}tjd|� q:W tjd� d}| sd|rvt j | |||�}n
tj
d� |s�t d� t j � S ) z�
Will disable any other time synchronization service and configure chrony
with given ntp(chrony) server and/or pool using Augeas.
If there is no option --ntp-server set IPADiscovery will try to find ntp
server in DNS records.
z _ntp._udpNF)Zbreak_on_firstz$Found DNS record for NTP server: %szSynchronizing timezSNo SRV records of NTP servers found and no NTP server or pool address was provided.z#Using default chrony configuration.)
r6 Z force_chronyr8 r� Zipadns_search_srvr� rH r� r� Zconfigure_chronyrj r� Z sync_chrony)r� r� r� re r� r� Z
configuredrP rP rQ � sync_time2
s"
r c C s� | j d�r|| jdd�}d}y|jtj�}W n" tk
rL tjdtj� Y nX |sltj j
j � tj j
j � n|r|tj j
j
� ytj| � W n. tk
r� } ztjd|� W Y d d }~X nX d S )NZchronyr_ Fz'Configuration file %s was not restored.z2Failed to restore time synchronization service: %s)ri rg � restore_filer Z CHRONY_CONFrz rH r� r r� Zchronyd�stoprj r� r6 Zrestore_forced_timeservicesr. rI )re r� Zchrony_enabled�restoredrV rP rP rQ �restore_time_sync[
s"
r
c , C s� z�yt | t� � W n� tk
r� } z�|jtkr�| jr@tjd� nn| jrRtjd� n\tj d� d| _
y t | � W n> t k
r� } z"tj
dtj� � tj d|� W Y d d }~X nX � W Y d d }~X nX W d ytjt� W n t k
r� Y nX X d S )Nz;Installation failed. Force set so not rolling back changes.zLInstallation failed. As this is IPA server, changes will not be rolled back.z*Installation failed. Rolling back changes.Tz%s)�_installrK r' rv r r� rH rj r� rI r� � uninstallri r� � traceback�
format_excrB rF � CCACHE_FILE)rL rV r� rP rP rQ �installu
s,
r c - � C s� dt i}tjtj�}tjtj�}|jddd� |d }|d }| jsLtt � | j
rr| j rrt j ||� t j
| j
� | jr�t| j| j||� n | jr�tjd� n
tjd� | j�s | jd ko�| jd ko�| jdko�| jd ko�| jd k�r td dd
�| _tjd | j� d t
t f }| j�sRt � }t t t t t d|t!t
| j"| j#d
�
||d< t$j%j&|d�} tj'dt d dt(t)t ��dt
dtj*g }
| j�r�|
j+d� d|d< | j,�r�|
j+d� | jd k �r�d } | j} | j-d�d�k�r�d| t f } | jd k �r�| j} n�| j�s8yt.j.d | �} W n t/k
�r d } Y nX | �snt0d j1| �t2d ��n6t3j4j5� �rdtj6d � tjd � t0t2d ��n
t3j4j7� } yt8| | | |d!� W n< t9k
�r� }
z t:� t0d"j1|
�t2d ��W Y d d }
~
X nX �n�| j�r\|
j+d� t$j%j;| j��rDyt<|| j| || j=d#� W n@ t>j?j@k
�r@ }
z t:� t0d"j1|
�t2d ��W Y d d }
~
X nX nt0d$j1| j�t2d ���nH| j�r
|
j+d� tAtjBd%�� W d Q R X | jd k�r�|}n| j}z\ytC|| j| || jDd&� W n< tEk
�r� }
z t:� t0d'|
� �t2d ��W Y d d }
~
X nX W d tFtjB� X n�| j�r2| jf}|
j+d(� |
j+| j� nr| j�r�| j�rNt0d)t2d ��yt.j.d*�}W n t/k
�rv d }Y nX |�s�t0d+t2d ��|
j+d(� |
j+|� |f}| |d,< t$jGd,< y&|d t$jGd< tH|| t d tIt � W nt tJjKk
�r }
z tj6d-|
� t0t2d ��W Y d d }
~
X n: tLk
�rP }
z tj6d.|
� t0t2d ��W Y d d }
~
X nX tM|
d||d/d0�}|jN}|jOdk�r�tj6d1|� | j#�s�|jOd2k�r�tjd3� t0t2d ��tjd4� n tjd5t � | jd k �r�tMtjPgd|d6� y,t<|tj*tQ|| j=d#� tQ |d,< t$jGd,< W nD t>j?j@k
�rP }
z"t:� tj6d7|
� t0t2d ��W Y d d }
~
X nX | j�svtR|tIt t t t
� tjd8� tSjT� ���}tUjVd9tjW| jd|jXd:� d;tUjYk�r�t0d<t2d ��|jZtj[� | j"�r�t\|t t t | t!t
��r�t0t2d ��tjd=� | j�r\y"t<|tj*tQ| j=d>� tQt$jGd,< W n> t>j?j@k
�rZ }
z tj6d7|
� t0t2d ��W Y d d }
~
X nX y t]|� W n t^k
�r~ Y nX t_j`tja�}y<|jb� x.tc|�D ]"\}}|jd|d?|d tSje� �q�W W n" tEk
�r� t0d@t2d ��Y nX tUjf� d}y.tUjgjhji� d/}tjdA� tUjgjhjjdB� W �n tJjkk
�r� }
z�|�rNtUjgjhjl� tjdC|
� yJtUjgjhjid/dD� tjdA� tUjgjhjjdB� tjdE� tjmdF� tjmdG� W nB tJjnk
�r� } z"tjmdH|� t0dI| t2d ��W Y d d }~X nX W Y d d }
~
X n6 tJjnk
� r, }
zt0dJ|
t2d ��W Y d d }
~
X nX W d Q R X y tUjgjhjjdKdLdM�}|dN }W n> tJjotJjpfk
� r� tUjgjhjjdOd/dPdQ�}|dN dR }Y nX |� s�tq� ytUjgjhjjdSd/dPdT�}W nF tLk
�
r }
z(tjdU|
d/dV� t0dWj1|
�t2d ��W Y d d }
~
X nX tr|dN dX d �}y
ts� W n6 ttjEk
�
rV }
zt0dY|
t2d ��W Y d d }
~
X nX ytut d tIt |�}W n< tJjvk
�
r� |�
r�trd�|�}nd }twjx|t |�}Y nX d\d]� |D �}t_jyd^d]� |D �tjzd_d`� t_jydad]� |D �tjBd_d`� tjdb� tSjTtj{�} x\|D ]T\}} } y| jd|| | � W n4 tEk
� r^ }
zt0dc| t2d ��W Y d d }
~
X nX � qW t j||� | j� s�t}t d t
| � t~t
tj| j�� yt$j�tQ� W n tLk
� r� Y nX t�j�j�} | j�� � r�t�| |� d } y&| j"� r�dd} | j�� n de} | j�� W n8 tLk
� r< tjmdf| | j�� | j"� s8tjmdg� Y nX y | j"� rR| j�� n| j�� W nF tLk
� r� | j"� s�tjmdh| j�� tjdi� ntjmdj| j�� Y nX n| j"� s�tjdk| j�� t�j�j�}!|!j�� � r�t�|!|� d�\}"}#| j��s
t j�| j"| j�|| j�| j�dl� | j��
r�t�j�dmtU�}$|$j�� }%|$j�� }&|jdmdn|%� |jdmdo|&� y |&�
sT|$j�� |%�
sb|$j�� W n4 tLk
�
r� }
ztj�dpt(|
�� W Y d d }
~
X nX tjdq| j"�
r�drnds� | j"�r2t�j�dttU�}'y |'j�� W n tEk
�
r� tjmdu� Y nX y |'j�� W n0 tEk
�r0 }
ztjmdv|
� W Y d d }
~
X nX | j"�sNt j�|� tjdw� | j"�s�xXt�t�gD ]L}(|(|tIt t t t�| t�|(j� �\}"}#})|"�r�t0t2d ��|#�r`tjdx|#|)� �q`W t�|tIt ��r�tjdy� n
tjdz� | j�s
| j}*|*d k�rd{t }*tjd||*� nd|*k�rd|*t f }*d}+d},xj|+d}k �r�|, �r�yttjMtj�d~|*g� d/},W n6 tLk
�r� }
zt�j�d� |+d }+W Y d d }
~
X nX �q"W |,�s
tj6d|*j�d�d |*� |#�r�tjd�|#� n
tj6d�� y t�t � W n4 tLk
�r }
ztj6d�t(|
�� W Y d d }
~
X nX | j��r t�|| � | j��r.t�|| � | j��r>t�| � | j��rRt�| |t � | j��sht�| t |d�� | j�s�|jZtj�� t t t t t t�tj�t!t
| j"| j#d
�
tjd�t � t�||t t
| |� |j�dd� |jddd/� tjd�� d S )�N�PATH� installation�completeFr> r? zlSkipping attempt to configure and synchronize time with chrony server as it has been already done on master.z Skipping chrony configurationz#User authorized to enroll computers)r� z)will use principal provided as option: %sz
host/%s@%s)
r� r� r� r� r� rU r� r� r� r� r@ Zccachez-sr z-bz-hz-kz-drC �XMLRPC_TRACE_CURLz-f�@r4 z%s@%szPassword for %s: z!Password must be provided for {}.)rv z2Password must be provided in non-interactive mode.zRThis can be done via echo password | ipa-client-install ... or with the -w option.)�configz"Kerberos authentication failed: {})r �attemptsz"Keytab file could not be found: {}r� )� ccache_namer r� z'Kerberos PKINIT authentication failed: z-wz1Password must be provided in non-interactive modez
Password: zPassword must be provided.Z
KRB5CCNAMEz%sz Cannot obtain CA certificate
%sT)rS r~ �nologZ
capture_errorzJoining realm failed: %s�
z]Use --force-join option to override the host entry on the server and force client enrollment.z=Use ipa-getkeytab to obtain a host principal for this server.zEnrolled in IPA realm %s)rS r~ z Failed to obtain host TGT: %sz Created /etc/ipa/default.confZ
cli_installer)�contextZconfdirr� �delegateZnss_dirZ
config_loadedz Failed to initialize IPA API.z Configured /etc/sssd/sssd.conf)r zCA certificate %dz+Failed to add CA to temporary NSS database.zTry RPC connectionZpingzQCannot connect to the server due to Kerberos error: %s. Trying with delegate=True)r z(Connection with delegate=True successfulz>Target IPA server has a lower version than the enrolled clientzKSome capabilities including the ipa command capability may not be availablez1Second connect with delegate=True also failed: %sz2Cannot connect to the IPA server RPC interface: %sz5Cannot connect to the server due to generic error: %sZ
ca_is_enabledz2.107)r3 r[ r~ z2.0)r� r3 r� Z config_show)�rawr3 zconfig_show failed %s)�exc_infoz2Failed to retrieve CA certificate subject base: {}Zipacertificatesubjectbasez%Failed to create IPA NSS database: %sr� �Certificate Authorityc S s( g | ] \}}}}||t j|d |�f�qS )T)r Zkey_policy_to_trust_flags)r+ r� �n�t�urP rP rQ r� s z _install.<locals>.<listcomp>c S s g | ]\}}}}|d k r|�qS )FrP )r+ r� r r! r" rP rP rQ r� s i� )r� c S s g | ]\}}}}|d k r|�qS )FrP )r+ r� r r! r" rP rP rQ r� s z/Adding CA certificates to the IPA NSS database.z)Failed to add %s to the IPA NSS database.r r� zFailed to %s the %s daemonz-Caching of users/groups will not be availablez6Failed to configure automatic startup of the %s daemonz:Caching of users/groups will not be available after rebootz1Failed to disable %s daemon. Disable it manually.z.%s daemon is not installed, skip configuration)r7 r� re r �subid�oddjobdr` r_ zUnable to start oddjobd: %sz
%s enabledZSSSDr� r7 z&SSSD service restart was unsuccessful.z9Failed to enable automatic startup of the SSSD daemon: %szKerberos 5 enabledz,%s configured using configuration file(s) %sz"Configured /etc/openldap/ldap.confz+Failed to configure /etc/openldap/ldap.confzadmin@%szaPrincipal is not set when enrolling with OTP or PKINIT; using principal '%s' for 'getent passwd'.�
Zpasswdz1Unable to find '%s' user with 'getent passwd %s'!z Recognized configuration: %szBUnable to reliably detect configuration. Check NSS setup manually.z9Adding hardcoded server name to /etc/ldap.conf failed: %s)rL r� re z*Configured /etc/krb5.conf for IPA realm %sz Client configuration complete.r� )r� r )r N)�� SECURE_PATHr
� FileStorer �IPA_CLIENT_SYSRESTORE� StateFilerc r� r� r� r r! Zbackup_hostnameZ set_hostnamer� r r� r� rH r� r� r� r� r� r� r� r� r1 r7 r� r� r� r� r� r7 r� rB r[ r~ �
SBIN_IPA_JOINrW r/ r� rs r� r� �getpass�EOFErrorr' r} r �sys�stdin�isattyrI �readliner rs r� r\ r �kinit_attemptsr� r� r� rz r� r r� r. rK rD r� r� r r� ri r0 Z error_outputrV ZKDESTROYr r� r" r� r Z bootstrapZETC_IPAr r~ r� r r) r rz r r� r] r� � enumerater� r� �finalizer� r� r� r� Z
KerberosErrorZ
disconnectrj Z PublicErrorZ CommandErrorr� r� r( r� r% r� r� r Zmake_compat_ca_certsr� r� r Z(insert_ca_certs_into_systemwide_ca_storer� r� ZSSH_CONFIG_DIRr� rF r r� �nscdr� rf r r� rd rj rh r� r� Zmodify_nsswitch_pam_stackr� r r# r rb ra rk ZcriticalZmodify_pam_to_use_krb5rl rp r� r� �__name__r� ZGETENT�timeZsleepr0 r� r rA r rP r` ra r� � no_nisdomainrh Z KRB5_CONFr � delete_state)-rL rM r~ r� re r> r? Zhost_principalr r � join_argsr. r� rV Zpkinit_principalr� r[ �stderrZtmp_dbr� �ir� Z connectedr� r r Z
ca_subjectZca_certs_trustr r� r r4 Znscd_service_actionr� Zretcoder� r$ r` r_ r7 Z
configurer� filenames�userr �foundrP rP rQ r �
s�
*$
"
r c C sR t � s"| jrt}nt}td|d��t� rN| j rNtjd� tjd� ttd��d S )Nz,IPA client is not configured on this system.)rv z@IPA client is configured as a part of IPA server on this system.z/Refer to ipa-server-install for uninstallation.) r r� �SUCCESS�CLIENT_NOT_CONFIGUREDr' r rH rI r� )rL rv rP rP rQ �uninstall_check� s
rA c ( � C sF
dt i}tjtj�}tjtj�}yttjddg� W n< tk
rp } z |j t
kr`t j dt
|�� W Y d d }~X nX |j� |j� d }d }d}y�tj� }|j� |j� } |j� }
t|
�dkr�d}x�| D ]�} |j| �} y| jd�}
W n tjk
r� w�Y nX |
d kr�y| jd
�}W n tjk
�r, w�Y nX y| jd �}W q� tjk
�rT Y q�X q�W W n tk
�rr Y nX |d k�r�t}tjtj�}tjtj �}t j j }|j d ��r�yt j!tjd d
� W n4 t"k
�r� } zt j d|j#|� W Y d d }~X nX d| }|j |��rVyt j!tj |d
� W n4 t"k
�rT } zt j d|j#|� W Y d d }~X nX x$tj$D ]}t%t&j'j(|j)|�� �q^W t j*� y |j+� W n2 tk
�r� } zt,|j#d|� W Y d d }~X nX y |j-� W n8 tk
�r } zt j d|j#t
|�� W Y d d }~X nX | j. �r�t&j'j/tj0��r�t j1d� tj2dd|dtj3g}| j4�r\|j5d� d|d< t|d|d�}|j dk�r�t j d|j6� t&j'j/tj0��rJt j1d � y8t7� }|j8tj0� |j9d d �}ttj:dtj3d |g� W nr tk
�r } z"|j d k�rt j d!t
|�� W Y d d }~X n4 tk
�rH } zt j d!t
|�� W Y d d }~X nX t j;d"t<�}|j=d"d#��s�y |j+� W n tk
�r� Y nX |j=d"d$��s�y |j-� W n tk
�r� Y nX t j1d%� d}d}|j>� �r�|j?tj@�}|j?tjA�}ytBjC||||� W n6 tk
�r8 } ztDd&jE|�tFd'��W Y d d }~X nX t%tjG� t%tjH� |�r�yttjId(d)d*d+g� W n tk
�r� t j1d,� Y nX |�r�d-| d. }t&j'j(tjJ|�} t%| � d/|jK� } t&j'j(tjJ| �} t%| � |�r�|�r�t j1d0� tL� d} y|jMtj@tjN�} W n tOk
�r0 t j4d1� Y nX | �rBt j1d2� t j1d3� t j;d4t<�} y | jP� W n tk
�r� t jQd5� Y nX �n6| �r�|�r�tL� t j1d6� t j;d4t<�} y | jP� W n tk
�r� t jQd5� Y nX n�| �r�| �r�t&j'j/tj@��r�yt&jRtj@tjS� W n$ tOk
�r< t j4d7tjS� Y nX t j1d8� t j;d4t<�} y | j+� W n tk
�r� t jQd9� Y nX y | j-� W n0 tk
�r� } zt jQd:|� W Y d d }~X nX tBjT||� |j>� �r�t j1d;� |jU� tV|� t j jW}!t j jX}"x6|!|"fD ]*}#|#jY� �r$t=|#|� nt j1d<|#j#� �q
W tZ||� |�rvt j j[j\� �rvt%tj]� t%tj^� t j j[jP� |j_d=�� rt j1d>� |j=d=d?�}$|$d k � rt&j'j`|$�� ryt&ja|$� W nB tk
� r } z$t jQd@|$t
|�� t jQdA|$� W Y d d }~X nX tb}%|j>� � r t j dBtjc� |jddCdD� d}&x$|jeD ]}'t j dE|'� d}&tf}%� q6W |&� rdt jQdF� t%tj0� t%tjgdG � t%tjhdG � tBji� t%tjj� t%tjk� t%tjl� t j1dH� | jm�
s2t j1dI� t j1dJ� | j.�
s2tndKd��
r2yttjog� W n6 tk
�
r0 } ztDdLjE|�tfd'��W Y d d }~X nX |%�
rBtD|%d'��d S )MNr z --uninstallz--debugz(Unconfigured automount client failed: %sFr4 Tr� r� r r zLocal IPA host)r� z*%s failed to stop tracking certificate: %sz IPA Machine Certificate - %sr z9Failed to disable automatic startup of the %s service: %sz"Unenrolling client from IPA serverz
--unenrollz-hz-kz-drC r )rS r~ r zUnenrolling host failed: %sz:Removing Kerberos service principals from /etc/krb5.keytabr� r� z-rr� z0Failed to remove Kerberos service principals: %sr$ r` r_ z1Disabling client Kerberos and LDAP configurationsz,Failed to remove krb5/LDAP configuration: {})rv z cache-removez-oz--stopz--startzsAn error occurred while removing SSSD's cache.Please remove the cache manually by executing sssctl cache-remove -o.Zcache_z.ldbZccache_zQThe original configuration of SSSD included other domains than the IPA-based one.z2Error while restoring pre-IPA /etc/sssd/sssd.conf.zQOriginal pre-IPA SSSD configuration file was restored to /etc/sssd/sssd.conf.bkp.z<IPA domain removed from current one, restarting SSSD servicer7 z&SSSD service restart was unsuccessful.zUOther domains than IPA domain found, IPA domain was removed from /etc/sssd/sssd.conf.z,Error while moving /etc/sssd/sssd.conf to %sz^Redundant SSSD configuration file /etc/sssd/sssd.conf was moved to /etc/sssd/sssd.conf.deletedz!SSSD service could not be stoppedz:Failed to disable automatic startup of the SSSD daemon: %sz$Restoring client configuration filesz.%s daemon is not installed, skip configurationr� z Removing Firefox configuration.r� z '%s' could not be removed: %s.z!Please remove file '%s' manually.z)Some files have not been restored, see %sr r zbSome installation state for %s has not been restored, see /var/lib/ipa/sysrestore/sysrestore.statez�Some installation state has not been restored.
This may cause re-installation to fail.
It should be safe to remove /var/lib/ipa-client/sysrestore.state but it may
mean your system hasn't been restored to its pre-installation state.z.ipabkpzClient uninstall complete.z;The original nsswitch.conf configuration has been restored.z7You may need to restart services or reboot the machine.z"Do you want to reboot the machine?z$Reboot command failed to execute: {})pr& r
r' r r( r) r0 r_ r. rV r@ rH rI rW �_loadr� r� r� Z list_domains�lenr� r� r� ri r r" r� r r� r r� r r Z
stop_trackingrs rd Z NSS_FILESrK rB r[ r~ r Zremove_principal_from_casr rZ rj r� r\ r� r� r* r� r� rs Z error_logr r� rr r� r r rg Z has_filesZhas_filer r r! Z$restore_pre_ipa_client_configurationr' r} r Z
SSSD_MC_GROUPZSSSD_MC_PASSWDZSSSCTLZSSSD_DB�upperr� r Z
SSSD_CONF_BKPrG r� rj r� ZSSSD_CONF_DELETEDZrestore_hostnameZrestore_all_filesrk r4 r� r� r
rM rb r^ rJ ri rr rF r? ZSYSRESTORE_INDEXr8 �modules�CLIENT_UNINSTALL_ERRORr� Z
NSSWITCH_CONFZ(remove_ca_certs_from_systemwide_ca_storer] r� r� r� r1 Z SBIN_REBOOT)(rL r~ r� re rV r r Zwas_sssd_configuredr� r� Z all_domainsrX r� r� r r r Zclient_nss_nicknamerU r9 r[ r� r� r� r$ Zwas_sssd_installedZwas_sshd_configuredZsssd_domain_ldbZ
sssd_ldb_fileZsssd_domain_ccacheZsssd_ccache_filer r7 r4 r� r r� �rvri �modulerP rP rQ r
s
r c C s t j� }x<|jD ],}t|t j�r|jtjkr|jt j k| _
P qW d| _
| j | _ | j
rdt| j
�| _nd | _| j| _| j| _| j| _| jr�| j| _n| j| _| j| _| j | _ | j | _ | j | _!| j" | _#| j$ | _%| j& | _'| j(r�| j(d | _)nd | _)| j*| _+| j,| _-| j. | _/| j0 | _1d S )NTr4 r� )2�logging� getLoggerZhandlersr Z
StreamHandler�streamr- r: �level�DEBUGr� r� r� � domain_namer r� r� r� r� r� Z
fixed_primaryr r� Zadmin_passwordr� �
host_passwordZ host_namer �no_ntpr� �
ssh_trust_dnsrG �no_sshr �no_sshdr �no_sudor � no_dns_sshfpr� �
ca_cert_filesr� Zautomount_locationr` �enable_dns_updatesr# Zno_krb5_offline_passwordsr& Zno_sssdr7 )Z installerZ root_loggerZhandlerrP rP rQ �init s>
rX c s� e Zd ZdZdZeejjdd�Ze e�Ze
e ddd�Z e e �Z e
e dddd gd
�Z
e e
�Z
e
dd d�Ze e�Ze
dd d�Ze e�Ze
eje dd
ddd�Ze e�Ze
e ddd�Ze e�Ze
ddddgd
�Ze e�Ze
ddddd�Ze e�Ze
e ddd�Ze e�Ze
ddd�Ze e�Ze
ddd�Ze e�Ze
ddd�Ze e�Ze
ddd�Ze e�Ze
dd d�Ze e�Ze
dd d�Z e e �Z e
dd d�Z e e �Z e
e d d d�Z e e �Z e j d!d"� �Z e
ddd#d�Z!e"e!�Z!� fd$d%�Z#� Z$S )&�ClientInstallInterfacez�
Interface of the client installer
Knobs defined here will be available in:
* ipa-client-install
* ipa-server-install
* ipa-replica-prepare
* ipa-replica-install
ZClientz&principal to use to join the IPA realm)� descriptionNT)Z sensitivez1path to backed up keytab from previous enrollmentz-k)rZ � cli_namesz6create home directories for users on their first loginz0Force client enrollment even if already enrolledz9ntp server to use. This option can be used multiple timesz --ntp-serverZ
NTP_SERVER)rZ r[ � cli_metavarzntp server pool to usezdo not configure ntpz-NFzeStop and disable any time&date synchronization services besides ntpd. This option has been deprecated)Z
deprecatedrZ zNIS domain namez do not configure NIS domain namez3configure OpenSSH client to trust DNS SSHFP recordsz do not configure OpenSSH clientz do not configure OpenSSH serverz-do not configure SSSD as data source for sudoz'configure SSSD as data source for subidz-do not automatically create DNS SSHFP recordsr� z6number of attempts to obtain host TGT (defaults to 5).c C s |dk rt d��d S )Nr4 z"expects an integer greater than 0.)rz )�selfr� rP rP rQ r1 ( s z%ClientInstallInterface.kinit_attemptsz#request certificate for the machinec s� t t| �jf |� | jr(| j r(td��| jr8tjd� | j rL| j
rLtd��| j r`| j
r`td��| j rptjd� | j
r�| jr�td��| jr�| jr�td��| jr�td��d S ) Nz2--server cannot be used without providing --domainzPOption --force-ntpd has been deprecated and will be removed in a future release.z2--ntp-server cannot be used together with --no-ntpz0--ntp-pool cannot be used together with --no-ntpzROption --request-cert has been deprecated and will be removed in a future release.z7--no-nisdomain cannot be used together with --nisdomainz>--ip-address cannot be used together with --enable-dns-updatesz;--ip-address cannot be used together with--all-ip-addresses)�superrY �__init__r� rN rs �
force_ntpdrH rj r� rP r� r r7 rd r� rW r$ )r] �kwargs)� __class__rP rQ r_ 4 s4 z ClientInstallInterface.__init__)%r5 �
__module__� __qualname__�__doc__rZ r, r � ServiceAdminInstallInterfacer� r r+ rW rO r� r� r� r) �Listr� r� rP r` rd r7 rQ rR rS rT r# rU �intr1 � validatorr r r_ �
__classcell__rP rP )rb rQ rY � s�
rY c @ sT e Zd ZdZeedddd�Zejdd� �Zeej e ddd d
d �Z
e
jd d
� �Z
dS )�PKINITInstallInterfaceZPKINITNzQPKINIT identity information (for example FILE:/path/to/cert.pem,/path/to/key.pem)ZIDENTITY)r� �defaultrZ r\ c C s |j d�std��d S )N�FILE:�PKCS11:�PKCS12:�DIR:�ENV:z?identity must start with FILE:, PKCS11:, PKCS12:, DIR:, or ENV:)rm rn ro rp rq )r9 rz )r] r� rP rP rQ r� m s z&PKINITInstallInterface.pkinit_identityz�PKINIT trust anchors, prefixed with FILE: for CA PEM bundle file or DIR: for an OpenSSL hash dir. The option can be used used multiple times.z--pkinit-anchorZFILEDIR)r� rl rZ r[ r\ c C s� x~|D ]v}|j d�\}}}| s(|dkr0td��|dkrVtjj|� rVtd|� d���|dkrtjj|� rtd|� d���qW d S ) N�:�FILE�DIR�ENV:zBInvalid pkinit_anchor '{part}' is not prefixed with FILE: or DIR:.zpkinit anchor path 'z"' does not exist or is not a file.> rs ru rt )� partitionrz rB r[ rr r� )r] r� �partr= �sepr[ rP rP rQ r� � s
z%PKINITInstallInterface.pkinit_anchors) r5 rc rd rZ r+ rW r� ri r) rg r� rP rP rP rQ rk _ s rk c s� e Zd ZdZdZeej�Zejdd� �Ze dd� �Z
dZ e dddd gd
�Z
dZe dd d �Ze edd
d �Z� fdd�Ze� dd� �Zejdd� �Z� ZS )�
ClientInstallz
Client installer
Nc C s� t |t�stdj|���|d }tjj|�s8td| ��tjj|�sPtd| ��tjj|�shtd| ��yt j
|� W n t k
r� td| ��Y nX d S )NzExpected list, got {!r}r4 z'%s' does not existz'%s' is not a filez!'%s' is not an absolute file pathz$'%s' is not a valid certificate filer� ) r �listrz r} rB r[ r\ rr �isabsr Zload_certificate_from_fileri )r] r� rP rP rQ rV � s
zClientInstall.ca_cert_filesc C s | j S )N)r� )r] rP rP rQ r� � s z ClientInstall.prompt_passwordFz#force setting of LDAP/Kerberos confz-f)rZ r[ z/configure Firefox to use IPA domain credentials)rZ zNspecify directory where Firefox is installed (for example: '/usr/lib/firefox')c s, t t| �jf |� | jr(| j r(td��d S )Nz?--firefox-dir cannot be used without --configure-firefox option)r^ ry r_ r� r� rs )r] ra )rb rP rQ r_ � s zClientInstall.__init__c c s" t | � t| � d V t| � d S )N)rX r� r )r] rP rP rQ �main� s zClientInstall.mainc c s" t | � t| � d V t| � d S )N)rX rA r )r] rP rP rQ r| � s )r5 rc rd re Z dm_passwordr, rY rV ri �propertyr� r� r+ r� r� r� rW r� r_ r- r| Z uninstallerrj rP rP )rb rQ ry � s* ry )F)FT)F)N)r� )T)F)N)�re Z
__future__r r rI r� r+ r� rm rB rw r� r� r� r- rA r\ r6 r
r� Z configparserr Z urllib.parser r Zipalibr r r r
Zipalib.constantsr r r
Zipalib.installr r r r Z hostname_Z ipalib.factsr r Zipalib.install.kinitr r r Zipalib.install.servicer r Z
ipalib.rpcr Z ipalib.utilr r r r Z ipaplatformr Zipaplatform.constantsr Zipaplatform.pathsr Zipaplatform.tasksr! Z ipapythonr" r# r$ r% r& Zipapython.admintoolr' Z ipapython.dnr( Zipapython.installr) Zipapython.install.corer* r+ r, Zipapython.install.commonr- Zipapython.ipautilr. r/ r0 r1 Z
ipapython.sshr2 r3 r� r5 r6 r7 Z ipaclientr8 Zipapython.ipachangeconfr9 r� ZNoneTyperJ r5 rH r? r r@ r� rF r& r� r� r� r� r� r r� r� r� r� rS rK rZ r^ rf rg ru r� r� r� r� r� r� r� rl rp r� r� r� r� r r) r! r r= rA r@ r? rP rO rN ra rh rk rx r| r� r� r� r� r� ZIPA_DNS_UPDATE_TXTr} ZIPA_DNS_CCACHEr r� r� r% r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r
r r rA r rX ZHostNameInstallInterfacerf ZSSSDInstallInterfacerY ZServiceInstallInterfacerk ZAutomountInstallInterfacery rP rP rP rQ �<module> s>
% "
(
@Cf
x= $
6
2"
95@! B
"
7C .
) n t'
7
: