3
ܓit @ s6 d dl m Z d dlmZmZmZ G dd deeZdS ) )glob)Plugin RedHatPlugin SoSPredicatec @ sh e Zd ZdZdZdZdZdZdZdZ d Z
d Z d Z d Z
d d
Zdd Zdd Zdd Zdd Zdd Zd S )IpazIdentity, policy, auditZipaidentityapacheF/etc/ipa
ipa-server
ipa-clientfreeipa-serverfreeipa-clientNc C s> | j ds | jds | jdr"dS | j ds6| jdr:dS dS ) z Get IPA server version z
pki-serverz /var/lib/pkiz /usr/share/doc/ipa-server-4.2.0v4z
pki-commonz/var/lib/pki-ca/v3N) is_installed path_exists)self r /usr/lib/python3.6/ipa.pycheck_ipa_server_version! s
z Ipa.check_ipa_server_versionc s* t fdd j d j dgD S )z Check if any CA is installed c 3 s | ]} j |V qd S )N)r ).0path)r r r 0 s z#Ipa.ca_installed..z/conf/ca/CS.cfgz /conf/CS.cfg)anypki_tomcat_dir_v4pki_tomcat_dir_v3)r r )r r ca_installed, s
zIpa.ca_installedc s t fdddD S )z" Check if IPA server is installed c 3 s | ]} j |V qd S )N)r )r Zpkg)r r r r 9 s z+Ipa.ipa_server_installed..
ipa-serverfreeipa-server)r r )r )r r )r r ipa_server_installed6 s zIpa.ipa_server_installedc C sJ |dkr(| j dddddddd d
d g
n |d krF| j d
dddddg dS )z Collect PKI logs r z!/var/log/pki/pki-tomcat/ca/debug*z!/var/log/pki/pki-tomcat/ca/systemz'/var/log/pki/pki-tomcat/ca/transactionsz(/var/log/pki/pki-tomcat/ca/selftests.logz"/var/log/pki/pki-tomcat/catalina.*z/var/log/pki/pki-ca-spawn.*z"/var/log/pki/pki-tomcat/kra/debug*z"/var/log/pki/pki-tomcat/kra/systemz(/var/log/pki/pki-tomcat/kra/transactionsz /var/log/pki/pki-kra-spawn.*r z/var/log/pki-ca/debugz/var/log/pki-ca/systemz /var/log/pki-ca/transactionsz /var/log/pki-ca/selftests.logz/var/log/pki-ca/catalina.*N)
add_copy_spec)r ipa_versionr r r collect_pki_logs< s(
zIpa.collect_pki_logsc C s d| _ d| _d| _d| _| j }| j rZ| jd | jd| d | jdd d
d d d
g | j rv| jd | j | | jdddddddddddddd d d d d d!d"d#d$d%d&d'g |d(kr| j }| j}n | j}| j}| j
d)| d* | j| d+ | j d,d-d.d/d0d1d2d3d4| d5| d6| d7g | j
d8d9d:d;d t
| d?gd@}| j
dA|dBdC x"tdDD ]}| j
d)| qrW | jdEdFi d S )GNz/var/lib/pki/pki-tomcatz/var/lib/pki-caz/etc/pki/pki-tomcat/caz /etc/pki-cazIPA server install detectedzIPA version is []z /var/log/ipaserver-install.logz"/var/log/ipaserver-kra-install.logz!/var/log/ipaserver-enable-sid.logz /var/log/ipareplica-install.logz"/var/log/ipareplica-ca-install.logz /var/log/ipa-custodia.audit.logz$CA is installed: retrieving PKI logsz /etc/dirsrv/slapd-*/dse.ldifz&/etc/dirsrv/slapd-*/schema/99user.ldifz
/etc/hostsz/etc/httpd/alias/*z/etc/ipa/ca.crtz/etc/ipa/default.confz/etc/ipa/kdcproxy.confz$/etc/ipa/kdcproxy/ipa-kdc-proxy.confz /etc/ipa/kdcproxy/kdcproxy.confz /etc/named.*z/root/.ipa/log/cli.logz /var/kerberos/krb5kdc/kdc.crtz /var/lib/certmonger/cas/[0-9]*z#/var/lib/certmonger/requests/[0-9]*z /var/lib/ipa/certs/httpd.crtz/var/lib/ipa/ra-agent.pemz(/var/lib/ipa/sysrestore/sysrestore.statez#/var/log/dirsrv/slapd-*/logs/accessz#/var/log/dirsrv/slapd-*/logs/errorsz/var/log/ipa-migrate.logz)/var/log/ipa/healthcheck/healthcheck.log*z /var/log/ipaclient-install.logz/var/log/ipaepn.log*z/var/log/ipaupgrade.logz/var/log/krb5kdc.logr zcertutil -L -d z/aliasz/CS.cfgz/etc/pki/nssdb/key*z/etc/dirsrv/slapd-*/key*z/etc/dirsrv/slapd-*/pin.txtz /etc/dirsrv/slapd-*/pwdfile.txtz /etc/httpd/alias/ipasession.keyz/etc/httpd/alias/key*z/etc/httpd/alias/pin.txtz /etc/httpd/alias/pwdfile.txtz/etc/named.keytabz /alias/key*z
/flatfile.txtz/password.confz certutil -L -d /etc/httpd/alias/z pki-server cert-find --show-allz%pki-server subsystem-cert-validate caz klist -ket /etc/dirsrv/ds.keytabz%klist -ket /etc/httpd/conf/ipa.keytabz,klist -ket /var/lib/ipa/gssproxy/http.keytabz/etc/dirsrv/slapd-*/schema/Z
certmonger)Zservicesz getcert listZ getcert_list)ZpredZtagsz/etc/dirsrv/slapd-*/z(/var/log/ipa/healthcheck/healthcheck.logZfreeipa_healthcheck_log)r r pki_tomcat_conf_dir_v4pki_tomcat_conf_dir_v3r r Z
_log_debugr r r" Zadd_cmd_outputZadd_forbidden_pathZadd_dir_listingr r Z
add_file_tags)r r! Zpki_tomcat_dirZpki_tomcat_conf_dirZ getcert_predZcertdb_directoryr r r setupU s
z Ipa.setupc C sL d}d}| j d|| | jddd d}x t|D ]}| j |dd q2W d S )
Nz(\s*arg \"password )[^\"]*z
\1********z/etc/named.confz getcert listz
(pin=)'(\d+)'z\1'***'z#/var/lib/certmonger/requests/[0-9]*z(key_pin=)(\d+)z\1***)Z do_file_subZdo_cmd_output_subr )r matchZsubstZ request_logsZ request_logr r r postproc s z Ipa.postproc)r r )r )r
r r r
)__name__
__module__ __qualname__Z
short_descZ plugin_nameZprofilesZ
ipa_serverZ
ipa_clientfilesZpackagesr r r$ r% r r r r" r& r( r r r r r s"
kr N)r Zsos.report.pluginsr r r r r r r r s