From e33a5c3b993e0111617e1c15bed374f6ce426b2d Mon Sep 17 00:00:00 2001 From: Martin Kosek Date: Fri, 5 Sep 2014 11:24:27 +0200 Subject: [PATCH] Hide pkinit functionality from production version Rebased from original patch from Jan Zeleny and Rob Crittenden. https://fedorahosted.org/freeipa/ticket/616 --- install/tools/ipa-replica-install | 5 +++-- install/tools/ipa-server-install | 20 ++++---------------- ipaserver/install/ipa_replica_prepare.py | 20 +++----------------- 3 files changed, 10 insertions(+), 35 deletions(-) diff --git a/install/tools/ipa-replica-install b/install/tools/ipa-replica-install index 75bbe981b96cf17950fe73d92d39ca3030f548f9..d3b520abf635ccc324b74bca31f241960a33d950 100755 --- a/install/tools/ipa-replica-install +++ b/install/tools/ipa-replica-install @@ -97,8 +97,6 @@ def parse_options(): parser.add_option_group(basic_group) cert_group = OptionGroup(parser, "certificate system options") - cert_group.add_option("--no-pkinit", dest="setup_pkinit", action="store_false", - default=True, help="disables pkinit setup steps") cert_group.add_option("--skip-schema-check", dest="skip_schema_check", action="store_true", default=False, help="skip check for updated CA DS schema on the remote master") parser.add_option_group(cert_group) @@ -126,6 +124,9 @@ def parse_options(): options, args = parser.parse_args() safe_options = parser.get_safe_opts(options) + # pkinit is disabled in production version + options.setup_pkinit = False + if len(args) != 1: parser.error("you must provide a file generated by ipa-replica-prepare") diff --git a/install/tools/ipa-server-install b/install/tools/ipa-server-install index 0394314ee99817f221536136ae1432cc8e92220a..a5df3e9971a5ae128ebfa4c542dcad7cc3626276 100755 --- a/install/tools/ipa-server-install +++ b/install/tools/ipa-server-install @@ -218,8 +218,6 @@ def parse_options(): cert_group.add_option("--external_ca_file", dest="external_cert_files", action="append", help=SUPPRESS_HELP) - cert_group.add_option("--no-pkinit", dest="setup_pkinit", action="store_false", - default=True, help="disables pkinit setup steps") cert_group.add_option("--dirsrv-cert-file", dest="dirsrv_cert_files", action="append", metavar="FILE", help="File containing the Directory Server SSL certificate and private key") @@ -232,12 +230,6 @@ def parse_options(): cert_group.add_option("--http_pkcs12", dest="http_cert_files", action="append", help=SUPPRESS_HELP) - cert_group.add_option("--pkinit-cert-file", dest="pkinit_cert_files", - action="append", metavar="FILE", - help="File containing the Kerberos KDC SSL certificate and private key") - cert_group.add_option("--pkinit_pkcs12", dest="pkinit_cert_files", - action="append", - help=SUPPRESS_HELP) cert_group.add_option("--dirsrv-pin", dest="dirsrv_pin", sensitive=True, metavar="PIN", help="The password to unlock the Directory Server private key") @@ -248,20 +240,12 @@ def parse_options(): help="The password to unlock the Apache Server private key") cert_group.add_option("--http_pin", dest="http_pin", sensitive=True, help=SUPPRESS_HELP) - cert_group.add_option("--pkinit-pin", dest="pkinit_pin", sensitive=True, - metavar="PIN", - help="The password to unlock the Kerberos KDC private key") - cert_group.add_option("--pkinit_pin", dest="pkinit_pin", sensitive=True, - help=SUPPRESS_HELP) cert_group.add_option("--dirsrv-cert-name", dest="dirsrv_cert_name", metavar="NAME", help="Name of the Directory Server SSL certificate to install") cert_group.add_option("--http-cert-name", dest="http_cert_name", metavar="NAME", help="Name of the Apache Server SSL certificate to install") - cert_group.add_option("--pkinit-cert-name", dest="pkinit_cert_name", - metavar="NAME", - help="Name of the Kerberos KDC SSL certificate to install") cert_group.add_option("--ca-cert-file", dest="ca_cert_files", action="append", metavar="FILE", help="File containing CA certificates for the service certificate files") @@ -309,6 +293,10 @@ def parse_options(): options, args = parser.parse_args() safe_options = parser.get_safe_opts(options) + # pkinit is disabled in production version + options.pkinit_pin = False + options.pkinit_cert_files = False + if options.dm_password is not None: try: validate_dm_password(options.dm_password) diff --git a/ipaserver/install/ipa_replica_prepare.py b/ipaserver/install/ipa_replica_prepare.py index 3762f32700aa899541883d3af72b160c4c42ba7c..1d34aa26b49be0c5df8e7d315a45cd6d180e6da9 100644 --- a/ipaserver/install/ipa_replica_prepare.py +++ b/ipaserver/install/ipa_replica_prepare.py @@ -63,9 +63,6 @@ class ReplicaPrepare(admintool.AdminTool): parser.add_option("--no-reverse", dest="no_reverse", action="store_true", default=False, help="do not create reverse DNS zone") - parser.add_option("--no-pkinit", dest="setup_pkinit", - action="store_false", default=True, - help="disables pkinit setup steps") parser.add_option("--ca", dest="ca_file", default=paths.CACERT_P12, metavar="FILE", help="location of CA PKCS#12 file, default /root/cacert.p12") @@ -87,12 +84,6 @@ class ReplicaPrepare(admintool.AdminTool): group.add_option("--http_pkcs12", dest="http_cert_files", action="append", help=SUPPRESS_HELP) - group.add_option("--pkinit-cert-file", dest="pkinit_cert_files", - action="append", metavar="FILE", - help="File containing the Kerberos KDC SSL certificate and private key") - group.add_option("--pkinit_pkcs12", dest="pkinit_cert_files", - action="append", - help=SUPPRESS_HELP) group.add_option("--dirsrv-pin", dest="dirsrv_pin", sensitive=True, metavar="PIN", help="The password to unlock the Directory Server private key") @@ -103,20 +94,12 @@ class ReplicaPrepare(admintool.AdminTool): help="The password to unlock the Apache Server private key") group.add_option("--http_pin", dest="http_pin", sensitive=True, help=SUPPRESS_HELP) - group.add_option("--pkinit-pin", dest="pkinit_pin", sensitive=True, - metavar="PIN", - help="The password to unlock the Kerberos KDC private key") - group.add_option("--pkinit_pin", dest="pkinit_pin", sensitive=True, - help=SUPPRESS_HELP) group.add_option("--dirsrv-cert-name", dest="dirsrv_cert_name", metavar="NAME", help="Name of the Directory Server SSL certificate to install") group.add_option("--http-cert-name", dest="http_cert_name", metavar="NAME", help="Name of the Apache Server SSL certificate to install") - group.add_option("--pkinit-cert-name", dest="pkinit_cert_name", - metavar="NAME", - help="Name of the Kerberos KDC SSL certificate to install") parser.add_option_group(group) def validate_options(self): @@ -136,7 +119,10 @@ class ReplicaPrepare(admintool.AdminTool): "option together with --no-reverse") #Automatically disable pkinit w/ dogtag until that is supported + # pkinit is disabled in production version options.setup_pkinit = False + options.pkinit_pin = False + options.pkinit_cert_files = False # If any of the PKCS#12 options are selected, all are required. cert_file_req = (options.dirsrv_cert_files, options.http_cert_files) -- 1.9.3