On 10/29/2013 12:46 PM, Martin Kosek wrote: > On 10/25/2013 05:03 PM, Ana Krivokapic wrote: >> Hello, >> >> This patch addresses ticket https://fedorahosted.org/freeipa/ticket/3967. >> > NACK. I do not think this will work well with the case when DNS is not used. > As > bind-dyndb-ldap is not required component, FreeIPA could be installed on a > machine without bind installed. And in that case, /var/named/ won't be there. > > I think that this directory will follow similar pattern as > %{_localstatedir}/lib/ipa/pki-ca/publish > and be just %ghost and be created in when bind-dyndb-ldap is being configured > in bindinstance.py. > > Martin
Fixed, updated patch attached. -- Regards, Ana Krivokapic Associate Software Engineer FreeIPA team Red Hat Inc.
From 238f5fb8e878f0a4437b23e38ba6ca8cb5efc89e Mon Sep 17 00:00:00 2001 From: Ana Krivokapic <[email protected]> Date: Fri, 25 Oct 2013 12:41:25 +0200 Subject: [PATCH] Enable Retro Changelog and Content Synchronization DS plugins Enable Retro Changelog and Content Synchronization DS plugins which are required for SyncRepl support. Create a working directory /var/named/ipa required by bind-dyndb-ldap v4+. https://fedorahosted.org/freeipa/ticket/3967 --- freeipa.spec.in | 4 ++++ install/tools/ipa-upgradeconfig | 5 ++++- install/updates/20-syncrepl.update | 9 +++++++++ install/updates/Makefile.am | 1 + ipaserver/install/bindinstance.py | 13 +++++++++++++ 5 files changed, 31 insertions(+), 1 deletion(-) create mode 100644 install/updates/20-syncrepl.update diff --git a/freeipa.spec.in b/freeipa.spec.in index 11ae934d928370eb13f45162a13f40a9acd64b74..30f85dd2fd425b4f4d9fd787a1457087011723a3 100644 --- a/freeipa.spec.in +++ b/freeipa.spec.in @@ -737,6 +737,7 @@ fi %{_mandir}/man1/ipa-backup.1.gz %{_mandir}/man1/ipa-restore.1.gz %{_mandir}/man1/ipa-advise.1.gz +%ghost %{_localstatedir}/named/ipa %files server-trust-ad %{_sbindir}/ipa-adtrust-install @@ -832,6 +833,9 @@ fi %endif # ONLY_CLIENT %changelog +* Tue Oct 29 2013 Ana Krivokapic <[email protected]> - 3.3.90-5 +- Create ghost entry for /var/named/ipa needed for SyncRepl support + * Fri Oct 25 2013 Martin Kosek <[email protected]> - 3.3.90-4 - Remove mod_ssl conflict, it can now live with mod_nss installed diff --git a/install/tools/ipa-upgradeconfig b/install/tools/ipa-upgradeconfig index 41c51263d5fc8b3a0e2f28bab89fc9d2d184fdca..865f5cd57322e10a95a94801eecf467890030bb7 100644 --- a/install/tools/ipa-upgradeconfig +++ b/install/tools/ipa-upgradeconfig @@ -1079,6 +1079,10 @@ def main(): setup_firefox_extension(fstore) add_ca_dns_records() + bind = bindinstance.BindInstance(fstore) + if bind.is_configured(): + bind.create_dir('/var/named/ipa', 0700) + # Any of the following functions returns True iff the named.conf file # has been altered named_conf_changes = ( @@ -1092,7 +1096,6 @@ def main(): if any(named_conf_changes): # configuration has changed, restart the name server root_logger.info('Changes to named.conf have been made, restart named') - bind = bindinstance.BindInstance(fstore) try: bind.restart() except ipautil.CalledProcessError, e: diff --git a/install/updates/20-syncrepl.update b/install/updates/20-syncrepl.update new file mode 100644 index 0000000000000000000000000000000000000000..6901370f9cb302ff2c0c8bcc3f7b51aadef83e8e --- /dev/null +++ b/install/updates/20-syncrepl.update @@ -0,0 +1,9 @@ +# Enable Retro changelog +dn: cn=Retro Changelog Plugin,cn=plugins,cn=config +only:nsslapd-pluginEnabled: on +add:nsslapd-attribute: nsuniqueid:targetUniqueId +add:nsslapd-changelogmaxage: nsslapd-changelogmaxage: 2d + +# Enable SyncRepl +dn: cn=Content Synchronization,cn=plugins,cn=config +only:nsslapd-pluginEnabled: on diff --git a/install/updates/Makefile.am b/install/updates/Makefile.am index 40c3b3c8916faa267254a29d0f458ca53201950c..09965ff9885fce93f3d15dc73b11fa210f68b163 100644 --- a/install/updates/Makefile.am +++ b/install/updates/Makefile.am @@ -22,6 +22,7 @@ app_DATA = \ 20-indices.update \ 20-nss_ldap.update \ 20-replication.update \ + 20-syncrepl.update \ 20-user_private_groups.update \ 20-winsync_index.update \ 21-replicas_container.update \ diff --git a/ipaserver/install/bindinstance.py b/ipaserver/install/bindinstance.py index 6d5a1d44d30c89278c24fe7ab5278355cb65b0b4..4baeb4e077c64a7abebd1c071012f6c1e02dc1ae 100644 --- a/ipaserver/install/bindinstance.py +++ b/ipaserver/install/bindinstance.py @@ -22,6 +22,7 @@ import pwd import netaddr import re +import errno import ldap @@ -509,6 +510,16 @@ def create_sample_bind_zone(self): os.close(bind_fd) print "Sample zone file for bind has been created in "+bind_name + def create_dir(self, path, mode): + try: + os.makedirs(path, mode) + except OSError as e: + if e.errno != errno.EEXIST: + raise e + + pent = pwd.getpwnam(self.named_user or 'named') + os.chown(path, pent.pw_uid, pent.pw_gid) + def create_instance(self): try: @@ -519,6 +530,8 @@ def create_instance(self): # get a connection to the DS self.ldap_connect() + self.create_dir('/var/named/ipa', 0700) + if installutils.record_in_hosts(self.ip_address, self.fqdn) is None: installutils.add_record_to_hosts(self.ip_address, self.fqdn) -- 1.8.3.1
_______________________________________________ Freeipa-devel mailing list [email protected] https://www.redhat.com/mailman/listinfo/freeipa-devel
