From 391fe8e9d0587ad44a92c320a8d1c9de2c9b980a Mon Sep 17 00:00:00 2001 From: Tomas Krizek Date: Wed, 3 May 2017 10:16:13 +0200 Subject: [PATCH] ca, kra install: validate DM password Before proceeding with installation, validate DM password. If the provided DM password is invalid, abort the installation. Fixes https://pagure.io/freeipa/issue/6892 Signed-off-by: Tomas Krizek Reviewed-By: Martin Basti Reviewed-By: Christian Heimes Reviewed-By: Stanislav Laznicka --- install/tools/ipa-ca-install | 18 ++++++++++-------- ipaserver/install/ipa_kra_install.py | 8 ++++++++ 2 files changed, 18 insertions(+), 8 deletions(-) diff --git a/install/tools/ipa-ca-install b/install/tools/ipa-ca-install index 4bcb59a29d5a64c118649374104ae8f1cd451ea4..f84b4749a3e2a80aca002a2aa057b200e6187f18 100755 --- a/install/tools/ipa-ca-install +++ b/install/tools/ipa-ca-install @@ -117,17 +117,19 @@ def parse_options(): def _get_dirman_password(password=None, unattended=False): + # sys.exit() is used on purpose, because otherwise user is advised to + # uninstall the component, even though it is not needed if not password: if unattended: sys.exit('Directory Manager password required') - try: - password = installutils.read_password( - "Directory Manager (existing master)", confirm=False, - validate=False) - except KeyboardInterrupt: - sys.exit(0) - if password is None: - sys.exit("Directory Manager password required") + password = installutils.read_password( + "Directory Manager (existing master)", confirm=False, + validate=False) + try: + installutils.validate_dm_password_ldap(password) + except ValueError: + sys.exit("Directory Manager password is invalid") + return password diff --git a/ipaserver/install/ipa_kra_install.py b/ipaserver/install/ipa_kra_install.py index b06d49c834d0ffa4f2e35c3241a83e42c4c9c337..8369d2f4082d35b453487ee0f17c9ce050188daf 100644 --- a/ipaserver/install/ipa_kra_install.py +++ b/ipaserver/install/ipa_kra_install.py @@ -137,6 +137,14 @@ class KRAInstaller(KRAInstall): def run(self): super(KRAInstaller, self).run() + # Verify DM password. This has to be called after ask_for_options(), + # so it can't be placed in validate_options(). + try: + installutils.validate_dm_password_ldap(self.options.password) + except ValueError: + raise admintool.ScriptError( + "Directory Manager password is invalid") + if not cainstance.is_ca_installed_locally(): raise RuntimeError("Dogtag CA is not installed. " "Please install the CA first") -- 2.9.4