Add new certificate updater daemon

Move core code to libtdeldap

1 files changed, 74 insertions, 190 deletions

diff --git a/src/ldapbonding.cpp b/src/ldapbonding.cpp
index b7e1c23..f8b16c0 100644
--- a/src/ldapbonding.cpp
+++ b/src/ldapbonding.cpp
@@ -1,5 +1,5 @@
 /***************************************************************************
- *   Copyright (C) 2012 by Timothy Pearson                                 *
+ *   Copyright (C) 2012-2013 by Timothy Pearson                            *
  *   kb9vqf@pearsoncomputing.net                                           *
  *                                                                         *
  *   This program is free software; you can redistribute it and/or modify  *
@@ -18,6 +18,9 @@
  *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
  ***************************************************************************/
 
+#include <sys/types.h>
+#include <signal.h>
+
 #include <tqlayout.h>
 
 #include <tdelocale.h>
@@ -49,11 +52,6 @@
 // FIXME
 // Connect this to CMake/Automake
 #define KDE_CONFDIR "/etc/trinity"
-#define KRB5_FILE "/etc/krb5.conf"
-#define NSSWITCH_FILE "/etc/nsswitch.conf"
-#define PAMD_DIRECTORY "/etc/pam.d/"
-#define PAMD_COMMON_ACCOUNT "common-account"
-#define PAMD_COMMON_AUTH "common-auth"
 
 typedef KGenericFactory<LDAPConfig, TQWidget> ldapFactory;
 
@@ -71,7 +69,7 @@ LDAPConfig::LDAPConfig(TQWidget *parent, const char *name, const TQStringList&)
 	TDEAboutData* about = new TDEAboutData("ldap", I18N_NOOP("TDE LDAP Manager"), "0.1",
 		I18N_NOOP("TDE LDAP Manager Control Panel Module"),
 		TDEAboutData::License_GPL,
-		I18N_NOOP("(c) 2012 Timothy Pearson"), 0, 0);
+		I18N_NOOP("(c) 2012-2013 Timothy Pearson"), 0, 0);
 	
 	about->addAuthor("Timothy Pearson", 0, "kb9vqf@pearsoncomputing.net");
 	setAboutData( about );
@@ -103,17 +101,16 @@ LDAPConfig::LDAPConfig(TQWidget *parent, const char *name, const TQStringList&)
 	connect(base->passwordHash, TQT_SIGNAL(activated(int)), this, TQT_SLOT(changed()));
 	connect(base->ignoredUsers, TQT_SIGNAL(textChanged(const TQString&)), this, TQT_SLOT(changed()));
 
-	m_fqdn = LDAPManager::getMachineFQDN();
+	hostFQDN = LDAPManager::getMachineFQDN();
 	base->hostFQDN->setEnabled(false);
 	base->hostFQDN->clear();
-	base->hostFQDN->insertItem(m_fqdn);
+	base->hostFQDN->insertItem(hostFQDN);
 
 	load();
 
 	systemconfig->setGroup(NULL);
-	TQString ldapRole = systemconfig->readEntry("LDAPRole", "Workstation");
 
-	if ((getuid() != 0) || (!systemconfig->checkConfigFilesWritable( true )) || (ldapRole != "Workstation")) {
+	if ((getuid() != 0) || (!systemconfig->checkConfigFilesWritable( true )) || (m_clientRealmConfig.ldapRole != "Workstation")) {
 		base->systemEnableSupport->setEnabled(false);
 	}
 
@@ -133,51 +130,33 @@ void LDAPConfig::load() {
 void LDAPConfig::load(bool useDefaults )
 {
 	int i;
-	bool thisIsMyMachine;
 
-	//Update the toggle buttons with the current configuration
-	systemconfig->setReadDefaults( useDefaults );
-	
-	systemconfig->setGroup(NULL);
-	base->systemEnableSupport->setChecked(systemconfig->readBoolEntry("EnableLDAP", false));
-	m_defaultRealm = systemconfig->readEntry("DefaultRealm", TQString::null);
-	m_ticketLifetime = systemconfig->readNumEntry("TicketLifetime", 86400);
-	if (m_fqdn == systemconfig->readEntry("HostFQDN", "")) {
-		thisIsMyMachine = true;
-	}
-	else {
-		thisIsMyMachine = false;
-	}
+	m_clientRealmConfig = LDAPManager::loadClientRealmConfig(systemconfig, useDefaults);
 
-	m_ldapVersion = systemconfig->readNumEntry("ConnectionLDAPVersion", 3);
-	m_ldapTimeout = systemconfig->readNumEntry("ConnectionLDAPTimeout", 2);
-	m_bindPolicy = systemconfig->readEntry("ConnectionBindPolicy", "soft");
-	m_ldapBindTimeout = systemconfig->readNumEntry("ConnectionBindTimeout", 2);
-	m_passwordHash = systemconfig->readEntry("ConnectionPasswordHash", "exop");
-	m_ignoredUsers = systemconfig->readEntry("ConnectionIgnoredUsers", DEFAULT_IGNORED_USERS_LIST);
+	base->systemEnableSupport->setChecked(m_clientRealmConfig.enable_bonding);
 	
 	// Load realms
 	m_realms.clear();
-	m_realms = LDAPManager::readTDERealmList(systemconfig, !thisIsMyMachine);
+	m_realms = LDAPManager::readTDERealmList(systemconfig, !m_clientRealmConfig.configurationVerifiedForLocalMachine);
 
-	base->ticketLifetime->setValue(m_ticketLifetime);
+	base->ticketLifetime->setValue(m_clientRealmConfig.ticketLifetime);
 
-	base->ldapVersion->setValue(m_ldapVersion);
-	base->ldapTimeout->setValue(m_ldapTimeout);
+	base->ldapVersion->setValue(m_clientRealmConfig.ldapVersion);
+	base->ldapTimeout->setValue(m_clientRealmConfig.ldapTimeout);
 	for (i=0; i<base->bindPolicy->count(); i++) {
-		if (base->bindPolicy->text(i).lower() == m_defaultRealm.lower()) {
+		if (base->bindPolicy->text(i).lower() == m_clientRealmConfig.defaultRealm.lower()) {
 			base->bindPolicy->setCurrentItem(i);
 			break;
 		}
 	}
-	base->ldapBindTimeout->setValue(m_ldapBindTimeout);
+	base->ldapBindTimeout->setValue(m_clientRealmConfig.ldapBindTimeout);
 	for (i=0; i<base->passwordHash->count(); i++) {
-		if (base->passwordHash->text(i).lower() == m_passwordHash.lower()) {
+		if (base->passwordHash->text(i).lower() == m_clientRealmConfig.passwordHash.lower()) {
 			base->passwordHash->setCurrentItem(i);
 			break;
 		}
 	}
-	base->ignoredUsers->setText(m_ignoredUsers);
+	base->ignoredUsers->setText(m_clientRealmConfig.ignoredUsers);
 
 	updateRealmList();
 
@@ -195,9 +174,9 @@ void LDAPConfig::updateRealmList() {
 		(void)new TQListViewItem(base->ldapRealmList, ((realmcfg.bonded)?i18n("Bonded"):i18n("Deactivated")), realmcfg.name);
 		base->defaultRealm->insertItem(realmcfg.name);
 	}
-	if (m_defaultRealm != "") {
+	if (m_clientRealmConfig.defaultRealm != "") {
 		for (int i=0; i<base->defaultRealm->count(); i++) {
-			if (base->defaultRealm->text(i) == m_defaultRealm) {
+			if (base->defaultRealm->text(i) == m_clientRealmConfig.defaultRealm) {
 				base->defaultRealm->setCurrentItem(i);
 				break;
 			}
@@ -213,71 +192,87 @@ void LDAPConfig::defaults() {
 void LDAPConfig::save() {
 	TQString errorstring;
 
+	m_clientRealmConfig.hostFQDN = hostFQDN;
+
+	m_clientRealmConfig.enable_bonding = base->systemEnableSupport->isChecked();
+	m_clientRealmConfig.defaultRealm = base->defaultRealm->currentText();
+	m_clientRealmConfig.ticketLifetime = base->ticketLifetime->value();
+
+	m_clientRealmConfig.ldapVersion = base->ldapVersion->value();
+	m_clientRealmConfig.ldapTimeout = base->ldapTimeout->value();
+	m_clientRealmConfig.bindPolicy = base->bindPolicy->currentText();
+	m_clientRealmConfig.ldapBindTimeout = base->ldapBindTimeout->value();
+	m_clientRealmConfig.passwordHash = base->passwordHash->currentText();
+	m_clientRealmConfig.ignoredUsers = base->ignoredUsers->text();
+
 	// Write system configuration
-	systemconfig->setGroup(NULL);
-	systemconfig->writeEntry("EnableLDAP", base->systemEnableSupport->isChecked());
-	systemconfig->writeEntry("HostFQDN", m_fqdn);
-	m_defaultRealm = base->defaultRealm->currentText();
-	m_ticketLifetime = base->ticketLifetime->value();
-
-	m_ldapVersion = base->ldapVersion->value();
-	m_ldapTimeout = base->ldapTimeout->value();
-	m_bindPolicy = base->bindPolicy->currentText();
-	m_ldapBindTimeout = base->ldapBindTimeout->value();
-	m_passwordHash = base->passwordHash->currentText();
-	m_ignoredUsers = base->ignoredUsers->text();
-
-	if (m_defaultRealm != "") {
-		systemconfig->writeEntry("DefaultRealm", m_defaultRealm);
-	}
-	else {
-		systemconfig->deleteEntry("DefaultRealm");
+	if (LDAPManager::saveClientRealmConfig(m_clientRealmConfig, systemconfig, &errorstring) != 0) {
+		KMessageBox::error(this, i18n("<qt><b>Unable to save configuration!</b><p>Details: %2</qt>").arg(errorstring), i18n("Unable to Save Configuration"));
+		return;
 	}
-	systemconfig->writeEntry("TicketLifetime", m_ticketLifetime);
-
-	systemconfig->writeEntry("ConnectionLDAPVersion", m_ldapVersion);
-	systemconfig->writeEntry("ConnectionLDAPTimeout", m_ldapTimeout);
-	systemconfig->writeEntry("ConnectionBindPolicy", m_bindPolicy);
-	systemconfig->writeEntry("ConnectionBindTimeout", m_ldapBindTimeout);
-	systemconfig->writeEntry("ConnectionPasswordHash", m_passwordHash);
-	systemconfig->writeEntry("ConnectionIgnoredUsers", m_ignoredUsers);
 
 	LDAPManager::writeTDERealmList(m_realms, systemconfig);
 	systemconfig->sync();
 
-	if (base->systemEnableSupport->isChecked()) {
+	if (m_clientRealmConfig.enable_bonding) {
 		// Write the Kerberos5 configuration file
-		writeKrb5ConfFile();
+		if (LDAPManager::writeClientKrb5ConfFile(m_clientRealmConfig, m_realms, &errorstring) != 0) {
+			KMessageBox::error(this, i18n("<qt><b>Unable to save configuration!</b><p>Details: %2</qt>").arg(errorstring), i18n("Unable to Save Configuration"));
+			return;
+		}
 		// Write the LDAP configuration file
-		writeLDAPConfFile();
+		if (LDAPManager::writeLDAPConfFile(m_realms[m_clientRealmConfig.defaultRealm], &errorstring) != 0) {
+			KMessageBox::error(this, i18n("<qt><b>Unable to save configuration!</b><p>Details: %2</qt>").arg(errorstring), i18n("Unable to Save Configuration"));
+			return;
+		}
 		// Write the NSSwitch configuration file
-		writeNSSwitchFile();
+		if (LDAPManager::writeNSSwitchFile(&errorstring) != 0) {
+			KMessageBox::error(this, i18n("<qt><b>Unable to save configuration!</b><p>Details: %2</qt>").arg(errorstring), i18n("Unable to Save Configuration"));
+			return;
+		}
 		// Write the PAM configuration files
-		writePAMFiles();
+		if (LDAPManager::writePAMFiles(&errorstring) != 0) {
+			KMessageBox::error(this, i18n("<qt><b>Unable to save configuration!</b><p>Details: %2</qt>").arg(errorstring), i18n("Unable to Save Configuration"));
+			return;
+		}
 		// Write the cron files
-		LDAPManager::writeCronFiles();
+		if (LDAPManager::writeClientCronFiles() != 0) {
+			KMessageBox::error(this, i18n("<qt><b>Unable to save configuration!</b><p>Details: %2</qt>").arg(errorstring), i18n("Unable to Save Configuration"));
+			return;
+		}
 
-		if (m_defaultRealm != "") {
+		if (m_clientRealmConfig.defaultRealm != "") {
 			// Bind anonymously to LDAP
 			LDAPCredentials* credentials = new LDAPCredentials;
 			credentials->username = "";
 			credentials->password = "";
-			credentials->realm = m_defaultRealm.upper();
+			credentials->realm = m_clientRealmConfig.defaultRealm.upper();
 			credentials->use_tls = false;
-			LDAPManager* ldap_mgr = new LDAPManager(m_defaultRealm.upper(), TQString("ldap://%1").arg(m_realms[m_defaultRealm].admin_server).ascii(), credentials);
+			LDAPManager* ldap_mgr = new LDAPManager(m_clientRealmConfig.defaultRealm.upper(), TQString("ldap://%1").arg(m_realms[m_clientRealmConfig.defaultRealm].admin_server).ascii(), credentials);
 	
 			// Add the domain-wide computer local admin group to local sudoers
 			ldap_mgr->writeSudoersConfFile(&errorstring);
+
 			// Get and install the CA root certificate from LDAP
 			mkdir(TDE_CERTIFICATE_DIR, S_IRUSR|S_IWUSR|S_IXUSR|S_IRGRP|S_IXGRP|S_IROTH|S_IXOTH);
 			mkdir(KERBEROS_PKI_PUBLICDIR, S_IRUSR|S_IWUSR|S_IXUSR|S_IRGRP|S_IXGRP|S_IROTH|S_IXOTH);
-			if (ldap_mgr->getTDECertificate("publicRootCertificate", KERBEROS_PKI_PUBLICDIR + m_realms[m_defaultRealm].admin_server + ".ldap.crt", &errorstring) != 0) {
-				KMessageBox::sorry(this, i18n("<qt><b>Unable to obtain root certificate for realm %1!</b><p>Details: %2</qt>").arg(m_defaultRealm.upper()).arg(errorstring), i18n("Unable to Obtain Certificate"));
+			if (ldap_mgr->getTDECertificate("publicRootCertificate", KERBEROS_PKI_PUBLICDIR + m_realms[m_clientRealmConfig.defaultRealm].admin_server + ".ldap.crt", &errorstring) != 0) {
+				KMessageBox::sorry(this, i18n("<qt><b>Unable to obtain root certificate for realm %1!</b><p>Details: %2</qt>").arg(m_clientRealmConfig.defaultRealm.upper()).arg(errorstring), i18n("Unable to Obtain Certificate"));
 			}
 	
 			delete ldap_mgr;
 			delete credentials;
 		}
+
+		// Certificates may have changed; force the certificate update daemon to reload its configuration
+		pid_t certUpdaterPID;
+		TQFile pidFile(TDE_LDAP_CERT_UPDATER_PID_FILE);
+		if (pidFile.open(IO_ReadOnly)) {
+			TQTextStream stream(&pidFile);
+			stream >> certUpdaterPID;
+			pidFile.close();
+			kill(certUpdaterPID, SIGHUP);
+		}
 	}
 
 	load();
@@ -339,7 +334,7 @@ void LDAPConfig::reBondToRealm() {
 		passdlg.m_base->ldapAdminRealm->setText(realmName);
 		if (passdlg.exec() == TQDialog::Accepted) {
 			setEnabled(false);
-			if (LDAPManager::bondRealm(m_realms[realmName], passdlg.m_base->ldapAdminUsername->text(), passdlg.m_base->ldapAdminPassword->password(), passdlg.m_base->ldapAdminRealm->text(), &errorString) == 0) {
+			if (LDAPManager::bondRealm(passdlg.m_base->ldapAdminUsername->text(), passdlg.m_base->ldapAdminPassword->password(), passdlg.m_base->ldapAdminRealm->text(), &errorString) == 0) {
 				// Success!
 				realmcfg.bonded = true;
 				m_realms.remove(realmName);
@@ -406,117 +401,6 @@ void LDAPConfig::realmProperties() {
 	}
 }
 
-void LDAPConfig::writeKrb5ConfFile() {
-	TQFile file(KRB5_FILE);
-	if (file.open(IO_WriteOnly)) {
-		TQTextStream stream( &file );
-
-		stream << "# This file was automatically generated by TDE\n";
-		stream << "# All changes will be lost!\n";
-		stream << "\n";
-
-		// Defaults
-		stream << "[libdefaults]\n";
-		stream << "    ticket_lifetime = " << m_ticketLifetime << "\n";
-		if (m_defaultRealm != "") {
-			stream << "    default_realm = " << m_defaultRealm << "\n";
-		}
-		stream << "\n";
-
-		// Realms
-		stream << "[realms]\n";
-		LDAPRealmConfigList::Iterator it;
-		for (it = m_realms.begin(); it != m_realms.end(); ++it) {
-			LDAPRealmConfig realmcfg = it.data();
-			stream << "   " << realmcfg.name << " = {\n";
-			stream << "        kdc = " << realmcfg.kdc << ":" << realmcfg.kdc_port << "\n";
-			stream << "        admin_server = " << realmcfg.admin_server << ":" << realmcfg.admin_server_port << "\n";
-			stream << "        pkinit_require_eku = " << (realmcfg.pkinit_require_eku?"true":"false") << "\n";
-			stream << "        pkinit_require_krbtgt_otherName = " << (realmcfg.pkinit_require_krbtgt_otherName?"true":"false") << "\n";
-			stream << "        win2k_pkinit = " << (realmcfg.win2k_pkinit?"yes":"no") << "\n";
-			stream << "        win2k_pkinit_require_binding = " << (realmcfg.win2k_pkinit_require_binding?"yes":"no") << "\n";
-			stream << "   }\n";
-		}
-		stream << "\n";
-
-		// Domain aliases
-		stream << "[domain_realm]\n";
-		LDAPRealmConfigList::Iterator it2;
-		for (it2 = m_realms.begin(); it2 != m_realms.end(); ++it2) {
-			LDAPRealmConfig realmcfg = it2.data();
-			TQStringList domains = realmcfg.domain_mappings;
-			for (TQStringList::Iterator it3 = domains.begin(); it3 != domains.end(); ++it3 ) {
-				stream << "    " << *it3 << " = " << realmcfg.name << "\n";
-			}
-		}
-
-		file.close();
-	}
-}
-
-void LDAPConfig::writeLDAPConfFile() {
-	LDAPManager::writeLDAPConfFile(m_realms[m_defaultRealm]);
-}
-
-void LDAPConfig::writeNSSwitchFile() {
-	TQFile file(NSSWITCH_FILE);
-	if (file.open(IO_WriteOnly)) {
-		TQTextStream stream( &file );
-
-		stream << "# This file was automatically generated by TDE\n";
-		stream << "# All changes will be lost!\n";
-		stream << "\n";
-		stream << "passwd:         files ldap [NOTFOUND=return] db" << "\n";
-		stream << "group:          files ldap [NOTFOUND=return] db" << "\n";
-		stream << "shadow:         files ldap [NOTFOUND=return] db" << "\n";
-		stream << "\n";
-		stream << "hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4" << "\n";
-		stream << "networks:       files" << "\n";
-		stream << "\n";
-		stream << "protocols:      db files" << "\n";
-		stream << "services:       db files" << "\n";
-		stream << "ethers:         db files" << "\n";
-		stream << "rpc:            db files" << "\n";
-		stream << "\n";
-		stream << "netgroup:       nis" << "\n";
-
-		file.close();
-	}
-}
-
-void LDAPConfig::writePAMFiles() {
-	TQFile file(PAMD_DIRECTORY PAMD_COMMON_ACCOUNT);
-	if (file.open(IO_WriteOnly)) {
-		TQTextStream stream( &file );
-
-		stream << "# This file was automatically generated by TDE\n";
-		stream << "# All changes will be lost!\n";
-		stream << "\n";
-		stream << "account sufficient pam_unix.so nullok_secure" << "\n";
-		stream << "account sufficient pam_ldap.so" << "\n";
-		stream << "account required pam_permit.so" << "\n";
-
-		file.close();
-	}
-
-	TQFile file2(PAMD_DIRECTORY PAMD_COMMON_AUTH);
-	if (file2.open(IO_WriteOnly)) {
-		TQTextStream stream( &file2 );
-
-		stream << "# This file was automatically generated by TDE\n";
-		stream << "# All changes will be lost!\n";
-		stream << "\n";
-		stream << "auth [default=ignore success=ignore] pam_mount.so" << "\n";
-		stream << "auth sufficient pam_unix.so nullok try_first_pass" << "\n";
-		stream << "auth [default=ignore success=1 service_err=reset] pam_krb5.so ccache=/tmp/krb5cc_%u use_first_pass" << "\n";
-		stream << "auth [default=die success=done] pam_ccreds.so action=validate use_first_pass" << "\n";
-		stream << "auth sufficient pam_ccreds.so action=store use_first_pass" << "\n";
-		stream << "auth required pam_deny.so" << "\n";
-
-		file2.close();
-	}
-}
-
 int LDAPConfig::buttons() {
 	return TDECModule::Apply|TDECModule::Help;
 }