Rob Crittenden wrote:
Here is a tool that can be used to configure automount in an IPA client. It can use either SSSD or autofs for automount. It also configures NFSv4 on the client so secure maps will work.
rebased patch
>From b4bc62c59e073f72c8abb45550d092953820a954 Mon Sep 17 00:00:00 2001 From: Rob Crittenden <rcrit...@redhat.com> Date: Tue, 29 May 2012 14:20:38 -0400 Subject: [PATCH] Configure automount using autofs or sssd. This script edits nsswitch.conf to use either ldap (autofs) or sss (sssd) to find automount maps. NFSv4 services are started so Kerberos encryption and/or integrity can be used on the maps. https://fedorahosted.org/freeipa/ticket/1233 --- freeipa.spec.in | 10 + ipa-client/ipa-install/Makefile.am | 1 + ipa-client/ipa-install/ipa-configure-automount | 437 ++++++++++++++++++++++++ ipa-client/man/Makefile.am | 1 + ipa-client/man/ipa-configure-automount.1 | 88 +++++ ipapython/platform/base.py | 3 +- ipapython/platform/fedora16.py | 3 + 7 files changed, 542 insertions(+), 1 deletion(-) create mode 100755 ipa-client/ipa-install/ipa-configure-automount create mode 100644 ipa-client/man/ipa-configure-automount.1 diff --git a/freeipa.spec.in b/freeipa.spec.in index 987ba90..797e060 100644 --- a/freeipa.spec.in +++ b/freeipa.spec.in @@ -237,6 +237,10 @@ Requires: bind-utils Requires: oddjob-mkhomedir Requires: python-krbV Requires: python-dns +Requires: libsss_autofs +Requires: autofs +Requires: libnfsidmap +Requires: nfs-utils Obsoletes: ipa-client >= 1.0 @@ -656,6 +660,7 @@ fi %defattr(-,root,root,-) %doc COPYING README Contributors.txt %{_sbindir}/ipa-client-install +%{_sbindir}/ipa-configure-automount %{_sbindir}/ipa-getkeytab %{_sbindir}/ipa-rmkeytab %{_sbindir}/ipa-join @@ -670,6 +675,7 @@ fi %{_mandir}/man1/ipa-getkeytab.1.gz %{_mandir}/man1/ipa-rmkeytab.1.gz %{_mandir}/man1/ipa-client-install.1.gz +%{_mandir}/man1/ipa-configure-automount.1.gz %{_mandir}/man1/ipa-join.1.gz %{_mandir}/man5/default.conf.5.gz @@ -701,6 +707,10 @@ fi %ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/ipa/ca.crt %changelog +* Thu Jun 7 2012 Rob Crittenden <rcrit...@redhat.com> - 2.99.0-32 +- Add client requires on libsss-autofs, autofs, libnfsidmap and nfs-utils + for configuring automount and NFS. + * Mon Jun 4 2012 Alexander Bokovoy <aboko...@redhat.com> - 2.99.0-31 - Add python-crypto to build dependencies for AD server-side code diff --git a/ipa-client/ipa-install/Makefile.am b/ipa-client/ipa-install/Makefile.am index ad0c4e0..0fa94c1 100644 --- a/ipa-client/ipa-install/Makefile.am +++ b/ipa-client/ipa-install/Makefile.am @@ -2,6 +2,7 @@ NULL = sbin_SCRIPTS = \ ipa-client-install \ + ipa-configure-automount \ $(NULL) EXTRA_DIST = \ diff --git a/ipa-client/ipa-install/ipa-configure-automount b/ipa-client/ipa-install/ipa-configure-automount new file mode 100755 index 0000000..57e4180 --- /dev/null +++ b/ipa-client/ipa-install/ipa-configure-automount @@ -0,0 +1,437 @@ +#!/usr/bin/env python +# +# Authors: +# Rob Crittenden <rcrit...@redhat.com> +# +# Copyright (C) 2012 Red Hat +# see file 'COPYING' for use and warranty information +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. +# +# Configure the automount client for ldap. + +import sys +import os +import urlparse +import time + +import SSSDConfig + +from optparse import OptionParser +from ipalib import api +from ipalib.dn import DN +from ipapython import sysrestore +from ipapython import ipautil +from ipaclient import ipadiscovery +from ipaclient import ipachangeconf +from ipapython.ipa_log_manager import * +from ipapython import services as ipaservices + +AUTOFS_CONF = '/etc/sysconfig/autofs' +NSSWITCH_CONF = '/etc/nsswitch.conf' +AUTOFS_LDAP_AUTH = '/etc/autofs_ldap_auth.conf' +NFS_CONF = '/etc/sysconfig/nfs' +IDMAPD_CONF = '/etc/idmapd.conf' + +def parse_options(): + usage = "%prog [options]\n" + parser = OptionParser(usage=usage) + parser.add_option("--server", dest="server", help="IPA server") + parser.add_option("--location", dest="location", help="Automount location", + default="default") + parser.add_option("-S", "--no-sssd", dest="sssd", + action="store_false", default=True, + help="Do not configure the client to use SSSD for automount") + parser.add_option("--debug", dest="debug", action="store_true", + default=False, help="enable debugging") + parser.add_option("-U", "--unattended", dest="unattended", + action="store_true", default=False, + help="unattended installation never prompts the user") + parser.add_option("--uninstall", dest="uninstall", action="store_true", + default=False, help="Unconfigure automount") + + options, args = parser.parse_args() + return options, args + +def wait_for_sssd(): + """ + It takes a bit for sssd to get going, lets loop until it is + serving data. + + This function returns nothing. + """ + n = 0 + found = False + time.sleep(1) + while n < 10 and not found: + try: + ipautil.run(["getent", "passwd", "admin"]) + found = True + except Exception, e: + time.sleep(1) + n = n + 1 + + # This should never happen but if it does, may as well warn the user + if not found: + root_logger.debug("Unable to find 'admin' user with 'getent passwd admin'!") + print "Unable to find 'admin' user with 'getent passwd admin'!" + print "This may mean that sssd didn't re-start properly after the configuration changes." + +def configure_xml(fstore): + from lxml import etree + + fstore.backup_file(AUTOFS_LDAP_AUTH) + + try: + f = open(AUTOFS_LDAP_AUTH, 'r') + lines = f.read() + f.close() + + saslconf = etree.fromstring(lines) + element = saslconf.xpath('//autofs_ldap_sasl_conf') + root = saslconf.getroottree() + except IOError, e: + root_logger.debug('Unable to open file %s' % e) + root_logger.debug('Creating new from template') + element = [etree.Element('autofs_ldap_sasl_conf')] + root = element[0].getroottree() + + if len(element) != 1: + raise RuntimeError('Unable to parse %s' % AUTOFS_LDAP_AUTH) + + element[0].set('usetls', 'no') + element[0].set('tlsrequired', 'no') + element[0].set('authrequired', 'yes') + element[0].set('authtype', 'GSSAPI') + element[0].set('clientprinc', 'host/%s@%s' % (api.env.host, api.env.realm)) + + newconf = open(AUTOFS_LDAP_AUTH, 'w') + try: + root.write(newconf, pretty_print=True, xml_declaration=True, encoding='UTF-8') + newconf.close() + except IOError, e: + print "Unable to write %s: %s" % (AUTOFS_LDAP_AUTH, e) + print "Configured %s" % AUTOFS_LDAP_AUTH + +def configure_nsswitch(fstore, options): + """ + Point automount to ldap in nsswitch.conf + """ + fstore.backup_file(NSSWITCH_CONF) + + conf = ipachangeconf.IPAChangeConf("IPA Installer") + conf.setOptionAssignment(':') + + if options.sssd: + nss_value = ' sss files' + else: + nss_value = ' ldap files' + + opts = [{'name':'automount', 'type':'option', 'action':'set', 'value':nss_value}, + {'name':'empty', 'type':'empty'}] + + conf.changeConf(NSSWITCH_CONF, opts) + + print "Configured %s" % NSSWITCH_CONF + +def configure_autofs_sssd(fstore, statestore, autodiscover, options): + try: + sssdconfig = SSSDConfig.SSSDConfig() + sssdconfig.import_config() + domains = sssdconfig.list_active_domains() + except Exception, e: + sys.exit(e) + + try: + sssdconfig.activate_service('autofs') + except SSSDConfig.NoServiceError: + print "Unable to activate the autofs service in SSSD config." + root_logger.debug("Unable to activate the autofs service in SSSD config.") + + domain = None + for name in domains: + domain = sssdconfig.get_domain(name) + try: + provider = domain.get_option('id_provider') + except SSSDConfig.NoOptionError: + continue + if provider == "ipa": + domain.add_provider('ipa', 'autofs') + try: + location = domain.get_option('ipa_automount_location') + sys.exit('An automount location is already configured') + except SSSDConfig.NoOptionError: + domain.set_option('ipa_automount_location', options.location) + break + + if domain is None: + sys.exit('SSSD is not configured.') + + sssdconfig.save_domain(domain) + sssdconfig.write("/etc/sssd/sssd.conf") + statestore.backup_state('autofs', 'sssd', True) + + sssd = ipaservices.service('sssd') + sssd.restart() + print "Restarting sssd, waiting for it to become available." + wait_for_sssd() + +def configure_autofs(fstore, statestore, autodiscover, server, options): + """ + fstore: the FileStore to back up files in + options.server: the IPA server to use + options.location: the Automount location to use + """ + if not autodiscover: + ldap_uri = "ldap://%s"; % server + else: + ldap_uri = "ldap:///%s"; % api.env.basedn + + search_base = str(DN(('cn', options.location), api.env.container_automount, api.env.basedn)) + replacevars = { + 'MAP_OBJECT_CLASS': 'automountMap', + 'ENTRY_OBJECT_CLASS': 'automount', + 'MAP_ATTRIBUTE': 'automountMapName', + 'ENTRY_ATTRIBUTE': 'automountKey', + 'VALUE_ATTRIBUTE': 'automountInformation', + 'SEARCH_BASE': search_base, + 'LDAP_URI': ldap_uri, + } + + ipautil.backup_config_and_replace_variables(fstore, + AUTOFS_CONF, replacevars=replacevars) + ipaservices.restore_context(AUTOFS_CONF) + statestore.backup_state('autofs', 'sssd', False) + + print "Configured %s" % AUTOFS_CONF + +def configure_autofs_common(fstore, statestore, options): + autofs = ipaservices.knownservices.autofs + statestore.backup_state('autofs', 'enabled', autofs.is_enabled()) + statestore.backup_state('autofs', 'running', autofs.is_running()) + try: + autofs.restart() + print "Started %s" % autofs.service_name + except Exception, e: + root_logger.error("%s failed to restart: %s", autofs.service_name, e) + try: + autofs.enable() + except Exception, e: + print "Failed to configure automatic startup of the %s daemon" % (autofs.service_name) + root_logger.error("Failed to enable automatic startup of the %s daemon: %s" % (autofs.service_name, str(e))) + +def uninstall(fstore, statestore): + print "Restoring configuration" + if fstore.has_file(AUTOFS_CONF): + fstore.restore_file(AUTOFS_CONF) + if fstore.has_file(NSSWITCH_CONF): + fstore.restore_file(NSSWITCH_CONF) + if fstore.has_file(AUTOFS_LDAP_AUTH): + fstore.restore_file(AUTOFS_LDAP_AUTH) + if fstore.has_file(NFS_CONF): + fstore.restore_file(NFS_CONF) + if fstore.has_file(IDMAPD_CONF): + fstore.restore_file(IDMAPD_CONF) + if statestore.has_state('autofs'): + enabled = statestore.restore_state('autofs', 'enabled') + running = statestore.restore_state('autofs', 'running') + sssd = statestore.restore_state('autofs', 'sssd') + autofs = ipaservices.knownservices.autofs + if not enabled: + autofs.disable() + if not running: + autofs.stop() + if sssd: + try: + sssdconfig = SSSDConfig.SSSDConfig() + sssdconfig.import_config() + sssdconfig.deactivate_service('autofs') + domains = sssdconfig.list_active_domains() + for name in domains: + domain = sssdconfig.get_domain(name) + try: + provider = domain.get_option('id_provider') + except SSSDConfig.NoOptionError: + continue + if provider == "ipa": + domain.remove_option('ipa_automount_location') + break + sssdconfig.save_domain(domain) + sssdconfig.write("/etc/sssd/sssd.conf") + sssd = ipaservices.service('sssd') + sssd.restart() + wait_for_sssd() + except Exception, e: + print 'Unable to restore SSSD configuration: %s' % str(e) + root_logger.debug('Unable to restore SSSD configuration: %s' % str(e)) + if statestore.has_state('rpcidmapd'): + enabled = statestore.restore_state('rpcidmapd', 'enabled') + running = statestore.restore_state('rpcidmapd', 'running') + rpcidmapd = ipaservices.knownservices.rpcidmapd + if not enabled: + rpcidmapd.disable() + if not running: + rpcidmapd.stop() + if statestore.has_state('rpcgssd'): + enabled = statestore.restore_state('rpcgssd', 'enabled') + running = statestore.restore_state('rpcgssd', 'running') + rpcgssd = ipaservices.knownservices.rpcgssd + if not enabled: + rpcgssd.disable() + if not running: + rpcgssd.stop() + + return 0 + +def configure_nfs(fstore, statestore): + """ + Configure secure NFS + """ + replacevars = { + 'SECURE_NFS': 'YES', + } + ipautil.backup_config_and_replace_variables(fstore, + NFS_CONF, replacevars=replacevars) + ipaservices.restore_context(NFS_CONF) + + print "Configured %s" % NFS_CONF + + replacevars = { + 'Domain': api.env.domain, + } + ipautil.backup_config_and_replace_variables(fstore, + IDMAPD_CONF, replacevars=replacevars) + ipaservices.restore_context(IDMAPD_CONF) + + print "Configured %s" % IDMAPD_CONF + + rpcidmapd = ipaservices.knownservices.rpcidmapd + statestore.backup_state('rpcidmapd', 'enabled', rpcidmapd.is_enabled()) + statestore.backup_state('rpcidmapd', 'running', rpcidmapd.is_running()) + try: + rpcidmapd.restart() + print "Started %s" % rpcidmapd.service_name + except Exception, e: + root_logger.error("%s failed to restart: %s", rpcidmapd.service_name, e) + try: + rpcidmapd.enable() + except Exception, e: + print "Failed to configure automatic startup of the %s daemon" % (rpcidmapd.service_name) + root_logger.error("Failed to enable automatic startup of the %s daemon: %s" % (rpcidmapd.service_name, str(e))) + + rpcgssd = ipaservices.knownservices.rpcgssd + statestore.backup_state('rpcgssd', 'enabled', rpcgssd.is_enabled()) + statestore.backup_state('rpcgssd', 'running', rpcgssd.is_running()) + try: + rpcgssd.restart() + print "Started %s" % rpcgssd.service_name + except Exception, e: + root_logger.error("%s failed to restart: %s", rpcgssd.service_name, e) + try: + rpcgssd.enable() + except Exception, e: + print "Failed to configure automatic startup of the %s daemon" % (rpcgssd.service_name) + root_logger.error("Failed to enable automatic startup of the %s daemon: %s" % (rpcgssd.service_name, str(e))) + +def main(): + + fstore = sysrestore.FileStore('/var/lib/ipa-client/sysrestore') + statestore = sysrestore.StateFile('/var/lib/ipa-client/sysrestore') + if not fstore.has_files(): + sys.exit('IPA client is not configured on this system.\n') + + options, args = parse_options() + + cfg = dict( + context='cli', + in_server=False, + debug=options.debug, + verbose=0, + ) + + api.bootstrap(**cfg) + api.finalize() + + if options.uninstall: + return uninstall(fstore, statestore) + + if statestore.has_state('autofs'): + sys.exit('automount is already configured on this system.\n') + + print "Searching for IPA server..." + autodiscover = False + server = options.server + ds = ipadiscovery.IPADiscovery() + ret = ds.search() + root_logger.debug('Executing DNS discovery') + if ret == ipadiscovery.NO_LDAP_SERVER: + root_logger.debug('Autodiscovery did not find LDAP server') + if not server: + s = urlparse.urlsplit(api.env.xmlrpc_uri) + server = s.netloc + root_logger.debug('Setting server to %s' % s.netloc) + else: + autodiscover = True + server = ds.getServerName() + if not server: + sys.exit('Autodiscovery was successful but didn\'t return a server') + root_logger.debug('Autodiscovery success, setting server to %s' % server) + + # Now confirm that our server is an IPA server + root_logger.debug("Verifying that %s is an IPA server" % server) + ldapret = ds.ipacheckldap(server, api.env.realm) + if ldapret[0] != 0: + sys.exit('Unable to confirm that %s is an IPA v2 server' % server) + + if not autodiscover: + print "IPA server: %s" % server + else: + print "IPA server: DNS discovery" + + search_base = str(DN(('cn', options.location), api.env.container_automount, api.env.basedn)) + print "Location: %s" % options.location + + # TODO verify that the location exists. Need a ticket to do this, or + # anonymous LDAP search. Would need to handle those servers with anon + # disabled. + + if not options.unattended and not ipautil.user_input("Continue to configure the system with these values?", False): + sys.exit("Installation aborted") + + try: + configure_nsswitch(fstore, options) + configure_nfs(fstore, statestore) + if options.sssd: + configure_autofs_sssd(fstore, statestore, autodiscover, options) + else: + configure_xml(fstore) + configure_autofs(fstore, statestore, autodiscover, server, options) + configure_autofs_common(fstore, statestore, options) + except Exception, e: + root_logger.debug('Raised exception %s' % e) + print "Installation failed. Rolling back changes." + uninstall(fstore, statestore) + return 1 + + return 0 + +try: + if not os.geteuid()==0: + sys.exit("\nMust be run as root\n") + + sys.exit(main()) +except SystemExit, e: + sys.exit(e) +except RuntimeError, e: + sys.exit(e) diff --git a/ipa-client/man/Makefile.am b/ipa-client/man/Makefile.am index 869b7df..110bfb4 100644 --- a/ipa-client/man/Makefile.am +++ b/ipa-client/man/Makefile.am @@ -8,6 +8,7 @@ man1_MANS = \ ipa-getkeytab.1 \ ipa-rmkeytab.1 \ ipa-client-install.1 \ + ipa-configure-automount.1 \ ipa-join.1 man5_MANS = \ diff --git a/ipa-client/man/ipa-configure-automount.1 b/ipa-client/man/ipa-configure-automount.1 new file mode 100644 index 0000000..b6bdccb --- /dev/null +++ b/ipa-client/man/ipa-configure-automount.1 @@ -0,0 +1,88 @@ +.\" A man page for ipa-configure-automount +.\" Copyright (C) 2012 Red Hat, Inc. +.\" +.\" This program is free software; you can redistribute it and/or modify +.\" it under the terms of the GNU General Public License as published by +.\" the Free Software Foundation, either version 3 of the License, or +.\" (at your option) any later version. +.\" +.\" This program is distributed in the hope that it will be useful, but +.\" WITHOUT ANY WARRANTY; without even the implied warranty of +.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +.\" General Public License for more details. +.\" +.\" You should have received a copy of the GNU General Public License +.\" along with this program. If not, see <http://www.gnu.org/licenses/>. +.\" +.\" Author: Rob Crittenden <rcrit...@redhat.com> +.\" +.TH "ipa-configure-automount" "1" "May 25 2012" "FreeIPA" "FreeIPA Manual Pages" +.SH "NAME" +ipa\-configure\-automount \- Configure automount for IPA +.SH "SYNOPSIS" +ipa\-configure\-automount [\fIOPTION\fR]... <location> +.SH "DESCRIPTION" +Configures automount for IPA. + +The automount configuration consists of three files: +.PP +.IP o +/etc/nsswitch.conf +.IP o +/etc/sysconfig/autofs +.IP o +/etc/autofs_ldap_auth.conf + +.TP +By default this will use DNS discovery to attempt to determine the IPA server(s) to use. If IPA servers are discovered then the automount client will be configured to use DNS discovery. +.TP +If DNS discovery fails or a specific server is desired, use the \-\-server option. +.TP +The default automount location is named default. To specify a different one use the \-\-location option. +.TP +The IPA client must already be configured in order to configure automount. The IPA client is configured as part of a server installation. +.TP +There are two ways to configure automount. The default is to use sssd to manage the automount maps. Alternatively autofs can configured to bind to LDAP over GSSAPI and authenticate using the machine's host principal. +.TP +The nsswitch automount service is configured to use either sss or ldap and files depending on whether SSSD is configured or not. +.TP +NFSv4 is also configured. The rpc.gssd and rpci.dmapd are started on clients to support Kerberos\-secured mounts. +.SH "OPTIONS" +\fB\-\-server\fR=\fISERVER\fR +Set the IPA server to connect to +.TP +\fB\-\-location\fR=<fl>LOCATION\fR +Automount location +.TP +\fB\-S\fR, \fB\-\-no\-sssd\fR +Do not configure the client to use SSSD for automount +.TP +\fB\-d\fR, \fB\-\-debug\fR +Print debugging information to stdout +.TP +\fB\-U\fR, \fB\-\-unattended\fR +Unattended installation. The user will not be prompted +.TP +\fB\-\-uninstall\fR +Restore the automount configuration files + +.SH "FILES" +.TP +Files that will be always be configured: + +/etc/nsswitch.conf + +Files that will be configured when SSSD is the automount client (default): + +/etc/sssd/sssd.conf + +Files that will be configured when using the ldap automount client: + +/etc/sysconfig/autofs + +/etc/autofs_ldap_auth.conf + +.SH "EXIT STATUS" +0 if the installation was successful + +1 if an error occurred diff --git a/ipapython/platform/base.py b/ipapython/platform/base.py index 35326d8..83508f3 100644 --- a/ipapython/platform/base.py +++ b/ipapython/platform/base.py @@ -24,7 +24,8 @@ from ipalib.plugable import MagicDict # re-mapping internally, if needed wellknownservices = ['certmonger', 'dirsrv', 'httpd', 'ipa', 'krb5kdc', 'messagebus', 'nslcd', 'nscd', 'ntpd', 'portmap', - 'rpcbind', 'kadmin', 'sshd'] + 'rpcbind', 'kadmin', 'sshd', 'autofs', 'rpcgssd', + 'rpcidmapd'] # The common ports for these services. This is used to wait for the # service to become available. diff --git a/ipapython/platform/fedora16.py b/ipapython/platform/fedora16.py index a5e235c..422cc68 100644 --- a/ipapython/platform/fedora16.py +++ b/ipapython/platform/fedora16.py @@ -43,6 +43,9 @@ __all__ = ['authconfig', 'service', 'knownservices', 'backup_and_replace_hostnam # mapping will be kept in this dictionary system_units = dict(map(lambda x: (x, "%s.service" % (x)), base.wellknownservices)) +system_units['rpcgssd'] = 'nfs-secure.service' +system_units['rpcidmapd'] = 'nfs-server.service' + # Rewrite dirsrv and pki-cad services as they support instances via separate # service generator. To make this working, one needs to have both foo@.servic # and foo.target -- the latter is used when request should be coming for -- 1.7.10.1
_______________________________________________ Freeipa-devel mailing list Freeipa-devel@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-devel
