|
 |
590d18 |
From 61d06ac1701a6a3a4afe75bcff64f271991a82ec Mon Sep 17 00:00:00 2001
|
|
|
590d18 |
From: Martin Babinsky <mbabinsk@redhat.com>
|
|
|
590d18 |
Date: Tue, 18 Aug 2015 18:33:37 +0200
|
|
|
590d18 |
Subject: [PATCH] improve the handling of krb5-related errors in dnssec daemons
|
|
|
590d18 |
|
|
|
590d18 |
ipa-dnskeysync* and ipa-ods-exporter handle kerberos errors more gracefully
|
|
|
590d18 |
instead of crashing with tracebacks.
|
|
|
590d18 |
|
|
|
590d18 |
https://fedorahosted.org/freeipa/ticket/5229
|
|
|
590d18 |
|
|
|
590d18 |
Reviewed-By: Martin Basti <mbasti@redhat.com>
|
|
|
590d18 |
---
|
|
|
590d18 |
daemons/dnssec/ipa-dnskeysync-replica | 10 +++++++++-
|
|
|
590d18 |
daemons/dnssec/ipa-dnskeysyncd | 4 ++--
|
|
|
590d18 |
daemons/dnssec/ipa-ods-exporter | 10 +++++++++-
|
|
|
590d18 |
3 files changed, 20 insertions(+), 4 deletions(-)
|
|
|
590d18 |
|
|
|
590d18 |
diff --git a/daemons/dnssec/ipa-dnskeysync-replica b/daemons/dnssec/ipa-dnskeysync-replica
|
|
|
590d18 |
index 551c2f21d5b85b76a7281f719ce722a6c5830cf7..b80b38962957f922cc871ead471f8da0831bec4d 100755
|
|
|
590d18 |
--- a/daemons/dnssec/ipa-dnskeysync-replica
|
|
|
590d18 |
+++ b/daemons/dnssec/ipa-dnskeysync-replica
|
|
|
590d18 |
@@ -12,6 +12,7 @@ from binascii import hexlify
|
|
|
590d18 |
from datetime import datetime
|
|
|
590d18 |
import dns.dnssec
|
|
|
590d18 |
import fcntl
|
|
|
590d18 |
+from krbV import Krb5Error
|
|
|
590d18 |
import logging
|
|
|
590d18 |
import os
|
|
|
590d18 |
from pprint import pprint
|
|
|
590d18 |
@@ -141,7 +142,14 @@ log.setLevel(level=logging.DEBUG)
|
|
|
590d18 |
PRINCIPAL = str('%s/%s' % (DAEMONNAME, ipalib.api.env.host))
|
|
|
590d18 |
log.debug('Kerberos principal: %s', PRINCIPAL)
|
|
|
590d18 |
ccache_filename = os.path.join(WORKDIR, 'ipa-dnskeysync-replica.ccache')
|
|
|
590d18 |
-ipautil.kinit_keytab(PRINCIPAL, paths.IPA_DNSKEYSYNCD_KEYTAB, ccache_filename)
|
|
|
590d18 |
+
|
|
|
590d18 |
+try:
|
|
|
590d18 |
+ ipautil.kinit_keytab(PRINCIPAL, paths.IPA_DNSKEYSYNCD_KEYTAB,
|
|
|
590d18 |
+ ccache_filename, attempts=5)
|
|
|
590d18 |
+except Krb5Error as e:
|
|
|
590d18 |
+ log.critical('Kerberos authentication failed: %s', e)
|
|
|
590d18 |
+ sys.exit(1)
|
|
|
590d18 |
+
|
|
|
590d18 |
os.environ['KRB5CCNAME'] = ccache_filename
|
|
|
590d18 |
log.debug('Got TGT')
|
|
|
590d18 |
|
|
|
590d18 |
diff --git a/daemons/dnssec/ipa-dnskeysyncd b/daemons/dnssec/ipa-dnskeysyncd
|
|
|
590d18 |
index a0fcf8b4b2f27627f3ebcb089e212eefda2adbd3..660e34b45084dd5a31967e9493f488632ec00932 100755
|
|
|
590d18 |
--- a/daemons/dnssec/ipa-dnskeysyncd
|
|
|
590d18 |
+++ b/daemons/dnssec/ipa-dnskeysyncd
|
|
|
590d18 |
@@ -66,9 +66,9 @@ PRINCIPAL = str('%s/%s' % (DAEMONNAME, api.env.host))
|
|
|
590d18 |
log.debug('Kerberos principal: %s', PRINCIPAL)
|
|
|
590d18 |
ccache_filename = os.path.join(WORKDIR, 'ipa-dnskeysyncd.ccache')
|
|
|
590d18 |
try:
|
|
|
590d18 |
- ipautil.kinit_keytab(PRINCIPAL, KEYTAB_FB, ccache_filename)
|
|
|
590d18 |
+ ipautil.kinit_keytab(PRINCIPAL, KEYTAB_FB, ccache_filename, attempts=5)
|
|
|
590d18 |
except Exception as ex:
|
|
|
590d18 |
- log.critical(ex)
|
|
|
590d18 |
+ log.critical("Kerberos authentication failed: %s", ex)
|
|
|
590d18 |
# signal failure and let init system to restart the daemon
|
|
|
590d18 |
sys.exit(1)
|
|
|
590d18 |
os.environ['KRB5CCNAME'] = ccache_filename
|
|
|
590d18 |
diff --git a/daemons/dnssec/ipa-ods-exporter b/daemons/dnssec/ipa-ods-exporter
|
|
|
590d18 |
index 4c6649c2fbfe77e563ab70276a92b59201fcbace..4d5423797fc9d4bdd0a432bac96b8209bb98c6d8 100755
|
|
|
590d18 |
--- a/daemons/dnssec/ipa-ods-exporter
|
|
|
590d18 |
+++ b/daemons/dnssec/ipa-ods-exporter
|
|
|
590d18 |
@@ -20,6 +20,7 @@ from datetime import datetime
|
|
|
590d18 |
import dateutil.tz
|
|
|
590d18 |
import dns.dnssec
|
|
|
590d18 |
import fcntl
|
|
|
590d18 |
+from krbV import Krb5Error
|
|
|
590d18 |
import logging
|
|
|
590d18 |
import os
|
|
|
590d18 |
import subprocess
|
|
|
590d18 |
@@ -482,7 +483,14 @@ ipalib.api.finalize()
|
|
|
590d18 |
PRINCIPAL = str('%s/%s' % (DAEMONNAME, ipalib.api.env.host))
|
|
|
590d18 |
log.debug('Kerberos principal: %s', PRINCIPAL)
|
|
|
590d18 |
ccache_name = os.path.join(WORKDIR, 'ipa-ods-exporter.ccache')
|
|
|
590d18 |
-ipautil.kinit_keytab(PRINCIPAL, paths.IPA_ODS_EXPORTER_KEYTAB, ccache_name)
|
|
|
590d18 |
+
|
|
|
590d18 |
+try:
|
|
|
590d18 |
+ ipautil.kinit_keytab(PRINCIPAL, paths.IPA_ODS_EXPORTER_KEYTAB, ccache_name,
|
|
|
590d18 |
+ attempts=5)
|
|
|
590d18 |
+except Krb5Error as e:
|
|
|
590d18 |
+ log.critical('Kerberos authentication failed: %s', e)
|
|
|
590d18 |
+ sys.exit(1)
|
|
|
590d18 |
+
|
|
|
590d18 |
os.environ['KRB5CCNAME'] = ccache_name
|
|
|
590d18 |
log.debug('Got TGT')
|
|
|
590d18 |
|
|
|
590d18 |
--
|
|
|
590d18 |
2.4.3
|
|
|
590d18 |
|