Xc ( @ s6 d d k Z d d k Z d d k Z d d k l Z d d k i Z d d k Z d d k Z d d k l
Z
l Z l Z d d k l
Z
l Z l Z d d k Td d k l Z d d k l Z d d k l Z d d k l Z l Z l Z l Z l Z l Z d d
k l Z d d k l Z l Z d d k l Z d d
k l Z d d k! l" Z" l# Z# l$ Z$ d d k% l& Z& l' Z' d d k( l) Z) d d k* l+ Z+ e d Z, e i- e i. d Z/ d Z0 d Z1 e d d e d e
d d d e
d d d e
d d e d e
d d e d e
d! d e d" e
d# d e d$ e
d% d e d& e
d' d e d( e
d) d e d* e
d+ d e d, e
d- d e d. e
d/ d e d0 e
d1 d e d2 f Z2 d3 Z3 d4 Z4 d5 e5 f d6 YZ6 e
i7 e6 d7 e8 f d8 YZ9 e
i7 e9 d9 e: f d: YZ; e
i7 e; d; e< f d< YZ= e
i7 e= d= e> f d> YZ? e
i7 e? d? e@ f d@ YZA e
i7 eA dA eB f dB YZC e
i7 eC dC eD f dD YZE e
i7 eE dE eF f dF YZG e
i7 eG d S(G iN( t NSPRError( t apit errorst util( t Strt Flagt Bytes( t *( t split_principal( t validate_certificate( t set_certificate_attrs( t dns_container_existst
_record_typest add_records_for_host_validationt add_records_for_hostt _hostname_validatort get_reverse_zone( R ( t _t ngettext( t x509( t context( t normalize_sshpubkeyt validate_sshpubkey_no_optionst convert_sshpubkey_post( t ipa_generate_passwordt CheckedIPAddress( t SSHPublicKey( t DNs
Hosts/Machines
A host represents a machine. It can be used in a number of contexts:
- service entries are associated with a host
- a host stores the host/ service principal
- a host can be used in Host-based Access Control (HBAC) rules
- every enrolled client generates a host entry
ENROLLMENT:
There are three enrollment scenarios when enrolling a new client:
1. You are enrolling as a full administrator. The host entry may exist
or not. A full administrator is a member of the hostadmin role
or the admins group.
2. You are enrolling as a limited administrator. The host must already
exist. A limited administrator is a member a role with the
Host Enrollment privilege.
3. The host has been created with a one-time password.
A host can only be enrolled once. If a client has enrolled and needs to
be re-enrolled, the host entry must be removed and re-created. Note that
re-creating the host entry will result in all services for the host being
removed, and all SSL certificates associated with those services being
revoked.
A host can optionally store information such as where it is located,
the OS that it runs, etc.
EXAMPLES:
Add a new host:
ipa host-add --location="3rd floor lab" --locality=Dallas test.example.com
Delete a host:
ipa host-del test.example.com
Add a new host with a one-time password:
ipa host-add --os='Fedora 12' --password=Secret123 test.example.com
Add a new host with a random one-time password:
ipa host-add --os='Fedora 12' --random test.example.com
Modify information about a host:
ipa host-mod --os='Fedora 12' test.example.com
Remove SSH public keys of a host and update DNS to reflect this change:
ipa host-mod --sshpubkey= --updatedns test.example.com
Disable the host Kerberos key, SSL certificate and all of its services:
ipa host-disable test.example.com
Add a host that can manage this host's keytab and certificate:
ipa host-add-managedby --hosts=test2 test
s _,.@+-=c
C s t i i d | yD t | \ } } h d | | f d 6} t i d | | | Wn t i j
o n Xy( h | | 6} t i d | | | Wn t i j
o n Xd S( Ns deleting ipaddr %ss %s.%st ptrrecordt
dnsrecord_del( R t logt debugR t CommandR t NotFound( t ipaddrt hostt domaint
recordtypet revzonet revnamet delkw( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/host.pyt remove_fwd_ptrm s
c
C s d | j o d S| d p d } g } x] | D]U } y t | i } Wn t j
o } q0 n X| d j o | i | q0 q0 Wy t i d | | d | Wn t i j
o n Xd S( Nt ipasshpubkeyt
dnsrecord_modt sshfprecord( ( R t fingerprint_dns_sha1t
ValueErrort Nonet appendR R R t EmptyModlist( t zonet recordt entry_attrst pubkeyst sshfpst pubkeyt sshfpt UnicodeDecodeError( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/host.pyt update_sshfp_record s
t
has_keytabt labelt Keytabt managedby_hosts
Managed byt
managing_hostt Managingt subjectt Subjectt
serial_numbers
Serial Numbert serial_number_hexs Serial Number (hex)t issuert Issuert valid_not_befores
Not Beforet valid_not_afters Not Aftert md5_fingerprints Fingerprint (MD5)t sha1_fingerprints Fingerprint (SHA1)s revocation_reason?s Revocation reasont managedbys Failed managedbys sshpubkeyfp*s SSH public key fingerprintc C s9 y t | d t } Wn t j
o } t | SXd S( s=
Verify that we have either an IPv4 or IPv6 address.
t match_localN( R t Falset Exceptiont unicodeR/ ( t ugettextR" t ipt e( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/host.pyt validate_ipaddr s
c C s. | i d o | d } n | i } | S( s- Use common fqdn form without the trailing dotu .i( t endswitht lower( t hostname( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/host.pyt normalize_hostname s R# c B s e Z d Z e i i Z e d Z e d Z d d d d d g Z
d d d
d d d
d d g Z d d d
d d d
d d d d d d d d g Z d Z
h d g d 6d d d d d g d 6d g d 6d g d 6d d d d d g d 6Z e Z h ds d 6dt d 6du d 6dv d 6Z dw dx g Z e d/ Z e d0 Z e d e d1 d2 d3 e d4 d5 e d6 e e d7 d1 d8 d3 e d9 d: e d; e d< d1 d= d3 e d> d: e d? e d@ d1 dA d3 e dB d: e dC e dD d1 dE d3 e dF d: e dG e dH d1 dI d3 e dJ d: e dK e dL d1 dM d3 e dN d: e dO e dP d: e dQ dR dy dU e e dV d3 e dW dR dz e dZ e d1 d[ d3 e d\ d: e d] e d^ d3 e d_ dR dX dY dS g e d` d6 da db dc dd de df e d3 e dg d: e dh e di e d1 dj d3 e dk d6 e df e dR dS g e dl d1 dm d3 e dn d: e do f Z dp Z dq Z dr Z! RS({ s
Host object.
R# t hostst ipaobjectt nshostt ipahostt pkiusert
ipaservicet fqdnt descriptiont lt nshostlocationt krbprincipalnamet nshardwareplatformt nsosversionRK t usercertificatet memberoft memberindirectt memberofindirectt
macaddresst userclasst ipauniqueidt usert
enrolledbyt hostgroupt netgroupt rolet hbacrulet sudorulet managings Member Oft in_t not_in_s Enrolled byt
enroll_by_t not_enroll_by_s
Managed byt man_by_t not_man_by_R@ t man_t not_man_t userpasswordt has_passwordt krbprincipalkeyR; t Hostst Hostt cli_nameRV R< s Host namet primary_keyt
normalizers description?t desct Descriptiont docs A description of this hosts l?t localityt Localitys$ Host locality (e.g. "Baltimore, MD")s nshostlocation?t locationt Locations Host location (e.g. "Lab 2")s nshardwareplatform?t platformt Platforms* Host hardware platform (e.g. "Lenovo T61")s nsosversion?t oss Operating systems3 Host operating system and version (e.g. "Fedora 9")s
userpassword?t passwords
User passwords Password used in bulk enrollments random?s8 Generate a random password to be used in bulk enrollmentt flagst no_searcht virtual_attributet defaults randompassword?s Random passwordt no_createt no_updates usercertificate?t certificatet Certificates" Base-64 encoded server certificates krbprincipalname?s Principal names macaddress*c C s
| i S( ( t upper( t value( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/host.pyt 3 s t patterns* ^([a-fA-F0-9]{2}[:|\-]?){5}[a-fA-F0-9]{2}$t pattern_errmsgsO Must be of the form HH:HH:HH:HH:HH:HH, where each H is a hexadecimal character.t csvs MAC addresss% Hardware MAC address(es) on this hosts
ipasshpubkey*t sshpubkeys SSH public keys
userclass*t classt ClasssO Host category (semantics placed on this attribute are for local interpretation)c O s | d } t t | i | | } y | i i | d g Wn` t i j
oQ y1 | i i d | | i d g | i \ } } Wq t i j
o q Xn X| S( Nit t serverhostname(
t superR# t get_dnt backendt get_entryR R! t find_entry_by_attrt object_classt container_dn( t selft keyst optionsRV t dnR4 ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/host.pyR I s
c
C s d | } d g } | i i i } g } yM | i d | i d | d | \ } } x | D] } | i | d qY WWn t i j
o g SX| S( Ns managedBy=%sR^ t base_dnt filtert
attrs_listi ( R t Backendt ldap2t find_entriesR R0 R R! ( R R t host_filtert
host_attrst ldapt
managed_hostsRX t truncatedR# ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/host.pyt get_managed_hostsX s
c
C s t t i i t i i } x t | i d g D] } t | } | i | p q4 n | i h d d 6 } y, | i d | d | d | i
d d g Wn t i j
o q4 X| d i
| q4 Wd S(
sp
We don't want to show managed netgroups so remove them from the
memberofindirect list.
Rh t mepmanagedentryt objectclassR R t scopeR R N( R R t envt container_netgroupt basednt listt getRT t make_filterR t
SCOPE_BASER R! t remove( R R R4 t ng_containert membert memberdnR ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/host.pyt suppress_netgroup_memberofi s ( s Member OfRt Ru ( s Enrolled byRv Rw ( s
Managed byRx Ry ( R@ Rz R{ ( R| R} ( R~ R; ( R R ( R R R R (" t __name__t
__module__t __doc__R R t container_hostR R t object_namet object_name_pluralR t search_attributest default_attributest uuid_attributet attribute_memberst Truet bindablet
relationshipst password_attributesR< t label_singularR R RW R RM R R R R t takes_paramsR R R ( ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/host.pyR# s
t host_addc B s e Z e d Z e i e Z e d Z d g Z e i e
d d e d d e d e
d d e d e d
e d e d d e d f Z d
Z
d Z RS( s Add a new host.s Added host "%(value)s"RK t forceR< t ForceR s" force host name even if not in DNSt
no_reverses skip reverse DNS detections ip_address?s( Add the host to DNS with this IP addresss
IP Addressc
O s t | t p t | i d o} t | op | d i d } | d } t d i | d } | i d t }
t d | | | d d t
d |
n | i d t o( d | j o t i | i
| d n d
| j o | d
| d <| d
=n | d | d <| d i d d d | d
| i d t }
t
| | | d d t d |
| d =n t | t | d | Wq t
j
o } | } q Xn | i d t o7 y t t t d
| d
h | | | t | 6} t i d | | d d | qqWPqqWq Wn y | i | d g \ } }
Wn& t i
j
o | i i | n Xd |
j ot i |
i
d d } y t t i | t i } yl t i d t | d } d | j o> y! t i d t | d d Wqt i j
o qXn Wn t i j
o n XWqt! j
o> } | i" d j o | i# i$ d | i% d q| qXn | S( Nit host_showt resultR^ i t service_findR Rb t service_delt updatednsR i t dnszone_showt idnsnamet dnsrecord_findt arecordt
aaaarecords %srecordR Re t cert_showt revocation_reasont cert_revokei i s Problem decoding certificate %s( R R (& R R R R R/ R R t host_is_masterR R R! R RU R RM R R RO R R t handle_not_foundR) R t strt xranget lenRT R R R t get_serial_numbert DERt NotImplementedErrorR t errnoR t infot args( R R R R R t hostentryR^ R t rett servicesR4 t principalt serviceRV R R R R$ R t recordsR3 t _[1]t tt _attribute_typest attrt iR( R t serialt nsprerr( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/host.pyR s
!
1
!
(
R R R R R R R RM R R ( ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/host.pyR s t host_modc B s e Z e d Z e i e Z e d Z d g Z e i e
d d d d e d d e d d
e e d d e d d
e
f Z d Z d Z RS( s Modify information about a host.s Modified host "%(value)s"RK s krbprincipalname?R t
principalnameR< s Principal nameR s% Kerberos principal name for this hostt attributes
updatedns?s Update DNS entriesR c O s t | t p t | i d p | i d oY h } | i i | | | | d o- | d o" t i d d d t d q n d | j o t i d
t d n d | j o | d | d
<| d =n d | j o} | i
| d d g \ } } d | j o d } t i d
| n | d }
d |
j o |
i d |
| d y! t i d t |
d d Wqlt i j
o qlXn Wn t i j
o n XWqt j
o> } | i d j o | i i d | i d q| qXn | | d y! t i d
t | d d WqXt
i j
o qXXn Wn t
i j
o n XWnJ t j
o> } | i d j o | i i d | i d q| n X| i | h d d 6 t
} n | i i | | | | d o | i | t
} n | p t
i n t d t
d | d S( NiR R R^ i Re R
R Rb t service_disableR R R i i s Problem decoding certificate %si R; R (! R R R R/ R R R RM R R R R! R R R RU t AlreadyInactiveR R R RO R R R R R R R R t update_entryR t remove_principal_keyR ( R R R R R R^ t done_workR R4 R R! R" R# R$ RV R R R+ R R, ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/host.pyt executep sv
!
c O s. t | t p t | i i | | | S( N( R R R R R ( R R R R4 R R ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/host.pyR s (
R R R R t outputt standard_valuet
has_outputR Rf R ( ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/host.pyR` j s
Ot host_add_managedbyc B s9 e Z e d Z d g Z e i e Z e Z d Z
RS( s$ Add hosts that can manage this host.RK c O s4 t | t p t | i i | | | | f S( N( R R R R R ( R R t completedt failedR R4 R R ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/host.pyR s ( R R R R R t
LDAPAddMemberR R R t
allow_sameR ( ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/host.pyRj s
t host_remove_managedbyc B s3 e Z e d Z d g Z e i e Z d Z RS( s' Remove hosts that can manage this host.RK c O s4 t | t p t | i i | | | | f S( N( R R R R R ( R R Rk Rl R R4 R R ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/host.pyR s ( R R R R R t LDAPRemoveMemberR R R ( ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/host.pyRo s
(H R R t syst nss.errorR t nss.nsst nsst netaddrt stringt ipalibR R R R R R t ipalib.plugins.baseldapt ipalib.plugins.serviceR R R
t ipalib.plugins.dnsR R R
R R R R R R t ipalib.requestR t ipalib.utilR R R t ipapython.ipautilR R t
ipapython.sshR t ipapython.dnR R t digitst
ascii_lettersR R) R: R RS RW t
LDAPObjectR# t registerR R t
LDAPDeleteR R; R- RW R< R_ R t LDAPQueryR` Rm Rj Rp Ro ( ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/host.pyt s
. 7
n
k
R
,
Z