Attachment #5694 for bug #28562

View | Details | Raw Unified | Return to bug 28562
Collapse All | Expand All




	echo -n "Download host certificate "
	local HOSTPWD="/etc/machine.secret"
	local HOSTACCOUNT="$hostname\$"
	local i delay=20
	for ((i=0;i<300;i+=delay)) # max 5 minutes
	do
		univention-scp "$HOSTPWD" -q -r \
			"$HOSTACCOUNT@$DCNAME:/etc/univention/ssl/$hostname" \
			"$HOSTACCOUNT@$DCNAME:/etc/univention/ssl/$hostname.$domainname" \
			/etc/univention/ssl/ >>/var/log/univention/join.log 2>&1
		if [ -d "/etc/univention/ssl/$hostname" ] && [ -d "/etc/univention/ssl/$hostname.$domainname" ]
		then
			echo -e "\033[60Gdone"
			return
		fi
		echo -n "."
		sleep $delay
	done

	echo "failed"
	failed_message "failed to get host certificate"
}


check_ldap_tls_connection () {
	echo -n "Check TLS connection "



	download_host_certificate

	if [ ! -d "/etc/univention/ssl/$hostname" ] &&  [ ! -d "/etc/univention/ssl/$hostname.$domainname" ]; then
		echo "failed to get host certificate"
		failed_message "failed to get host certificate"
	fi

	echo -n "Sync SSL settings: "
	eval "$(univention-ssh --no-split "$DCPWD" "${DCACCOUNT}@${DCNAME}" /usr/sbin/univention-config-registry shell ssl/country ssl/state ssl/locality ssl/organization ssl/organizationalunit ssl/common ssl/email)"
	univention-config-registry set \


	download_host_certificate

	if [ ! -d "/etc/univention/ssl/$hostname" ] &&  [ ! -d "/etc/univention/ssl/$hostname.$domainname" ]; then
		failed_message "failed to get host certificate"
	fi

	echo -n "Restart LDAP Server: "
	/etc/init.d/slapd restart >>/var/log/univention/join.log 2>&1
	echo -e "\033[60Gdone"
- 
--
.../ucs-3.2/ucs-3.2-0/management/univention-join/univention-join     | 5 +++--
.../ucs-3.2-0/management/univention-join/univention-server-join      | 3 ++-
2 files changed, 5 insertions(+), 3 deletions(-)

(-)a/branches/ucs-3.2/ucs-3.2-0/management/univention-join/univention-join (-2 / +3 lines)

Lines 873-880 if [ -d /etc/runit/univention-directory-listener ]; then	Link Here

873

	/etc/init.d/univention-directory-listener restart >>/var/log/univention/join.log 2>&1

873

	/etc/init.d/univention-directory-listener restart >>/var/log/univention/join.log 2>&1

874

fi

874

fi

875

876

if [ "$interfaces_${interfaces_primary:-eth0}_type" != "dhcp" ]; then

876

varname="interfaces_${interfaces_primary:-eth0}_type"

877

	univention-config-registry commit /etc/resolv.conf >>/var/log/univention/join.log 2>&1

877

if [ "${!varname}" != "dhcp" ]; then

878

	univention-config-registry commit /etc/resolv.conf >>"$LOGFILE" 2>&1

878

fi

879

fi

879

880

exit 0

881

exit 0




		subnet="$(univention-ipcalc6 --ip "$IP" --netmask "$NETMASK" --output reverse --calcdns)"
	else
		# Fallback
		varname="interfaces_${interfaces_primary:-eth0}_netmask"
		subnet="$(univention-ipcalc6 --ip "$IP" --netmask "${!varname}" --output reverse --calcdns)"
	fi
	log 0 "	Calculated subnet = $subnet"

The return status of a pipeline is the exit status of the last
command, unless the pipefail option is enabled.
--
.../ucs-3.2-0/management/univention-join/univention-server-join       | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)




	local group="$5"
	log 0 "Join $desc"

	if ! old_dn="$(set -o pipefail ; univention-directory-manager "$module" list --filter name="$NEWHOSTNAME" "${ADMINOPTIONS[@]}" | sed -ne "s|^DN: ||p")"
	then
		log 1 "E: failed search $desc [$old_dn]"
		exit 1
	fi
- 
--
.../management/univention-join/univention-join     | 24 ++----
.../univention-join/univention-server-join         | 97 +++++++++-------------
2 files changed, 49 insertions(+), 72 deletions(-)




	args+=(-binddn "$binddn")
fi

for ip in $(ip addr show scope global | sed -rne '/\<scope global\>/s|.*\<inet6? ([0-9a-f.:/]+)\>.*|\1|p')
do
	args+=(-ip "$ip")
done
for iface in /sys/class/net/*
do
	[ -L "${iface}/device" ] || continue
	args+=(-mac "$(cat "${iface}/address")")
done
	fi
fi
mac_addr="$(LC_ALL=C ip link show | sed -rne 's|.*link/ether ([0-9a-fA-F:]+) brd .*|\1|p' | head -n1)"
if [ -n "$mac_addr" ]; then
	args+=(-mac "$mac_addr")
fi

# invalidate the nscd hosts cache
#  https://forge.univention.org/bugzilla/show_bug.cgi?id=30886




	fi
}

MAC=()
IP=()
BINDDN=""
BINDPWFILE=""
DOMAINNAME=""

			shift 2 || exit 2
			;;
		"-ip")
			IP+=("${2:?missing IP address}")
			shift 2 || exit 2
			;;
		"-netmask")

			shift 2 || exit 2
			;;
		"-mac")
			MAC+=("${2:?missing ethernet MAC address}")
			shift 2 || exit 2
			;;
		"-bindaccount")

	local primaryGroup="$4"
	local group="$5"
	log 0 "Join $desc"
	local mac ip

	if ! old_dn="$(set -o pipefail ; univention-directory-manager "$module" list --filter name="$NEWHOSTNAME" "${ADMINOPTIONS[@]}" | sed -ne "s|^DN: ||p")"
	then

		exit 1
	fi

	declare -a args=()

	for mac in "${MAC[@]}"
	do
		args+=(--set mac="$MAC")
	done

	for ip in "${IP[@]}"
	do
		args+=(--set ip="${ip%/*}")
	done

	# DNS
	if [ -n "$IP" ]
	then
		forwardZone="$(univention-directory-manager dns/forward_zone list \
			--filter zone="$DOMAINNAME" \
			"${ADMINOPTIONS[@]}" | sed -ne 's/^DN: //p')"
		log 0 "	forwardZone $forwardZone"
	fi
	for addr in "${IP[@]}"
	do
		local ip="${addr%/*}" prefix="${addr#*/}"
		: "${prefix:=NETMASK}"
		: "${prefix:=$(. /usr/share/univention-lib/base.sh && get_default_netmask)}"
		local subnet="$(univention-ipcalc6 --ip "$ip" --netmask "$prefix" --calcdns --output reverse)"
		local reverseZone="$(univention-directory-manager dns/reverse_zone list \
			--filter subnet="$subnet" \
			"${ADMINOPTIONS[@]}" | sed -ne 's/^DN: //p')"
		log 0 "	reverseZone $reverseZone"
		# UDM BUG: multiple --set don't work; --apend only prints a warning for modify; ignore old entries for now
		[ -n "$reverseZone" ] && args+=(--append dnsEntryZoneReverse="$reverseZone $ip")
		[ -n "$forwardZone" ] && args+=(--append dnsEntryZoneForward="$forwardZone $ip")
	done

	if [ -z "$old_dn" ]; then
		log 0 "	Create new $desc "

		if [ -n "$IP" ]; then
			args+=(--set ip="$IP")
			# DNS
			if [ -n "$forwardZone" ]; then
				args+=(--set dnsEntryZoneForward="$forwardZone")
				if [ -n "$reverseZone" ]; then
					args+=(--set dnsEntryZoneReverse="$reverseZone")
				fi
			fi
		fi
		if [ -n "$MAC" ]; then
			args+=(--set mac="$MAC")
		fi
		# DHCP
		case "$module" in
		computers/managedclient|computers/mobileclient)
			if [ -n "$dhcpEntry" ] && [ -n "$IP" ] && [ -n "$MAC" ]; then
				args+=(--set dhcpEntryZone="$dhcpEntry $IP $MAC")
			fi
			;;
		esac

		cmd=(univention-directory-manager "$module" create \
			--position "$position" \
			--set name="$NEWHOSTNAME" \

	else
		log 0 "Modify $desc [$old_dn]"

		if [ -n "$MAC" ]; then
			args+=(--set mac="$MAC")
		fi
		if [ -n "$IP" ]; then
			args+=(--set ip="$IP")
		fi
		rc="$(univention-directory-manager "$module" modify \
			--dn "$old_dn" \
			--set password="$computerPassword" \

	fi
}

if [ -n "$IP" ]; then
	if [ -n "$NETMASK" ]; then
		subnet="$(univention-ipcalc6 --ip "$IP" --netmask "$NETMASK" --output reverse --calcdns)"
	else
		# Fallback
		varname="interfaces_${interfaces_primary:-eth0}_netmask"
		subnet="$(univention-ipcalc6 --ip "$IP" --netmask "${!varname}" --output reverse --calcdns)"
	fi
	log 0 "	Calculated subnet = $subnet"

	forwardZone="$(univention-directory-manager dns/forward_zone list \
		--filter zone="$DOMAINNAME" \
		"${ADMINOPTIONS[@]}" | sed -ne 's/^DN: //p')"
	reverseZone="$(univention-directory-manager dns/reverse_zone list \
		--filter subnet="$subnet" \
		"${ADMINOPTIONS[@]}" | sed -ne 's/^DN: //p')"
	dhcpEntry="$(univention-directory-manager dhcp/service list \
		--filter name="$DOMAINNAME" \
		"${ADMINOPTIONS[@]}" | sed -ne 's/^DN: //p')"

	log 0 "	forwardZone $forwardZone"
	log 0 "	reverseZone $reverseZone"
	log 0 "	dhcpEntry $dhcpEntry"
fi

computerPassword="$(create_machine_password)"

case "$ROLE" in
- 
--
.../management/univention-join/univention-join     | 127 +++++++++++----------
.../univention-join/univention-run-join-scripts    |  15 ++-
2 files changed, 78 insertions(+), 64 deletions(-)




VERSION_CHECK=true
VERBOSE=false

LOGFILE="/var/log/univention/join.log"
log () {
	echo "$(LC_ALL=C date): $*" >>"$LOGFILE"
}
echo_right () {
	local text="$*"
	echo -e "\033[$((${COLUMNS:-80}-${#text}))G${text}"
}

trapOnExit() {
	rm -rf "$USERTMP"
	if [ -n "$VERBOSE" -a "$VERBOSE" = "true" ]; then
		if [ -n "$old_listener_debug_level" ]; then
			ucr set listener/debug/level="$old_listener_debug_level" >>"$LOGFILE" 2>&1
		fi
	fi
	log "finish $0"
}

trap trapOnExit EXIT

	  -realm <kerberos realm>:       Kerberos realm, e.g. TEST.LOCAL
	  -windom <windows domain name>: Name of the windows (samba) domain
	  -disableVersionCheck           Disable version check against _dcname_
	  -verbose                       Enable verbose logging ($LOGFILE)

	  -h | --help | -?:              Print this usage message and exit program
	  --version:                     Print version information and exit program

		univention-scp "$HOSTPWD" -q -r \
			"$HOSTACCOUNT@$DCNAME:/etc/univention/ssl/$hostname" \
			"$HOSTACCOUNT@$DCNAME:/etc/univention/ssl/$hostname.$domainname" \
			/etc/univention/ssl/ >>"$LOGFILE" 2>&1
		if [ -d "/etc/univention/ssl/$hostname" ] && [ -d "/etc/univention/ssl/$hostname.$domainname" ]
		then
			echo_right "done"
			return
		fi
		echo -n "."
		sleep $delay
	done

	echo_right "failed"
	failed_message "failed to get host certificate"
}


 		failed_message "Establishing a TLS connection with $DCNAME failed. Maybe you didn't specify a FQDN."
	fi

	echo_right "done"
}

run_join_scripts () {

			test -e "$i" || continue
			echo -n "Configure $(basename "$i") "
			[ -n "$SIMPLEGUI" ] && echo
			log "Configure $(basename "$i")"
			bashVerbose=""
			if [ -n "$VERBOSE" -a "$VERBOSE" = "true" ]; then
				bashVerbose="bash -x"
			fi
			$bashVerbose "$i" --binddn "$binddn" --bindpwd "$(<"$DCPWD")" >>"$LOGFILE" 2>&1
			if [ $? -ne 0 ]; then
				echo_right "failed"
				failed_message "FAILED: $(basename "$i")"
			else
				echo_right "done"
				delete_unjoinscript "$(basename "$i")"
			fi
			if [ "$server_role" = "domaincontroller_slave" -o "$server_role" = "domaincontroller_backup" ]; then

}

# log univention-join call
log "starting $0 $*"

while [ $# -gt 0 ]
do


# verbose logging for univention-join and listener
if [ -n "$VERBOSE" -a "$VERBOSE" = "true" ]; then
	exec 2>>"$LOGFILE"
	set -x
	if [ -n "$listener_debug_level" ]; then
		old_listener_debug_level="$listener_debug_level"
	else
		old_listener_debug_level="2"
	fi
	ucr set listener/debug/level=4 >&2
	listener_debug_level=4
fi


	echo -n "Search DC Master: "
	DCNAME="$(host -t SRV "_domaincontroller_master._tcp.$domainname" | sed -ne '$s/.* \([^ ]\+\)\.$/\1/p')"
	if [ -n "$DCNAME" ]; then
		echo_right "done"
	else
		for i in "$nameserver" "$nameserver1" "$nameserver2" "$nameserver3" "$dns_forwarder1" "$dns_forwarder2" "$dns_forwarder3"; do
			if [ -z "$i" ]; then continue; fi
			DCNAME="$(host -t SRV "_domaincontroller_master._tcp.$domainname" "$i" | sed -ne '$s/.* \([^ ]\+\)\.$/\1/p')"
			if [ -n "$DCNAME" ]; then
				echo_right "done"
				echo "domain $domainname" >/etc/resolv.conf
				echo "nameserver $i" >>/etc/resolv.conf
				test -x /etc/init.d/nscd && /etc/init.d/nscd restart >>/var/log/univention/join.log 2>&1

	failed_message "ping to $DCNAME failed"
fi

if ! univention-ssh "$DCPWD" "${DCACCOUNT}@${DCNAME}" echo ssh-check 2>>"$LOGFILE" | grep -qs ssh-check
then
	failed_message "ssh-login for ${DCACCOUNT}@${DCNAME} failed. Maybe you entered a wrong password."
fi

IFS=$OLDIFS

# check join constraints
log "running version check"

mystatus="no"
if [ -n "$master_version" -a -n "$master_patchlevel" ]; then

	if $VERSION_CHECK; then
		failed_message "$vmsg"
	else
		log "$vmsg Continuing anyway as requested with option (-disableVersionCheck)."
	fi
else
	log "OK: UCS version on ${DCNAME} is higher or equal ($vmaster) to the local version ($vmyself)."
fi

echo_right "done"

if [ -x /etc/init.d/slapd ]; then
	echo -n "Stop LDAP Server: "
	/etc/init.d/slapd stop >>"$LOGFILE" 2>&1
	echo_right "done"
fi

if [ -x /etc/init.d/samba4 ]; then
	echo -n "Stop Samba 4 Server: "
	if [ "$dns_backend" = "samba4" ]; then
		ucr set dns/backend=ldap >>"$LOGFILE" 2>&1
		/etc/init.d/bind9 restart >>"$LOGFILE" 2>&1
	fi
	/etc/init.d/samba4 stop >>"$LOGFILE" 2>&1
	echo_right "done"
fi

if [ -z "$LDAPBASE" ]; then


if [ -n "$ldap_base" ]; then
	univention-config-registry set ldap/base="$ldap_base" >/dev/null 2>&1
	echo_right "done"
else
	failed_message "Failed to determine ldap/base."
fi

if [ -x /etc/init.d/slapd ]; then
	echo -n "Start LDAP Server: "
	/etc/init.d/slapd start >>"$LOGFILE" 2>&1
	echo_right "done"
fi

echo -n "Search LDAP binddn "

if [ -z "$binddn" ]; then
	failed_message "binddn for user $DCACCOUNT not found. "
else
	echo_right "done"
fi

if [ $server_role != "domaincontroller_master" -a "$server_role" != "domaincontroller_backup" -a -z "$binddn" ]; then

if [ -x /usr/bin/rdate ]; then
	echo -n "Sync time "
	/usr/bin/rdate "$DCNAME" >/dev/null 2>&1
	echo_right "done"
fi

args=()

# Copy local $DCPWD to remote $DCPWD' and invoke univention-join remotely
univention-ssh --no-split "$DCPWD" "${DCACCOUNT}@${DCNAME}" \
	'DCPWD=$(mktemp) && trap "rm -f \"$DCPWD\"" EXIT && cat >"$DCPWD" && /usr/share/univention-join/univention-server-join -bindpwfile "$DCPWD"' \
	"$(bashquote "${args[@]}")" <"$DCPWD" 2>&1 | tee "$USERTMP/log" >>"$LOGFILE"
res_message="$(sed -n '/^E:/ { s/^E:\s*// p }' "$USERTMP/log")"
if [ -z "$res_message" ]; then
	echo_right "done"
fi

if [ -s "$USERTMP/log" ]
then
	echo "Join result = [$(<"$USERTMP/log")]" | sed -e 's/KerberosPasswd="[^"]*"//' | fromdos -fa >>"$LOGFILE"

	#try to get password
	kpwd="$(sed -ne 's|^KerberosPasswd="\(.*\)" *|\1|p' <"$USERTMP/log")"


	ldap_dn="$(sed -ne 's|^ldap_dn="\(.*\)" *|\1|p' <"$USERTMP/log")"
	if [ -n "$ldap_dn" ]; then
		univention-config-registry set ldap/hostdn="$ldap_dn" >>"$LOGFILE" 2>&1
	else
		failed_message "No LDAP Host DN returned"
	fi

	local DCNAME="$3"
	local realm="$4"
	if [ -z "$realm" ]; then
		realm="$(univention-ssh "$DCPWD" "${DCACCOUNT}@${DCNAME}" '/usr/sbin/univention-config-registry get kerberos/realm')" >>"$LOGFILE" 2>&1
		if [ $? != 0 -o -z "$realm" ]; then
			echo "Unable to retrieve the kerberos realm. Try to use option -realm <kerberos/realm>"
			exit 1
		fi
	fi
	univention-config-registry set kerberos/realm="$realm" >>"$LOGFILE" 2>&1
}

set_windows_domain () {

	local windom="$4"

	if [ -z "$windom" ]; then
		windom="$(univention-ssh "$dcpwd" "${dcaccount}@${dcname}" '/usr/sbin/univention-config-registry get windows/domain')" >>"$LOGFILE" 2>&1
		if [ $? != 0 -o -z "$windom" ]; then
			echo "Unable to retrieve the windows/domain. Try to use option -windom <windows/domain>"
			exit 1
		fi
	fi
	univention-config-registry set windows/domain="$windom" >>"$LOGFILE" 2>&1
}

if [ "$server_role" = "domaincontroller_backup" ]; then

	if [ ! -e "/etc/ldap.secret" ]; then
		failed_message "/etc/ldap.secret not found"
	fi
	echo_right "done"

	echo -n "Sync ldap-backup.secret: "
	univention-scp "$DCPWD" -q "${DCACCOUNT}@${DCNAME}:/etc/ldap-backup.secret" /etc/ldap-backup.secret >>/var/log/univention/join.log 2>&1
	if [ ! -e "/etc/ldap-backup.secret" ]; then
		failed_message "/etc/ldap-backup.secret not found"
	fi
	echo_right "done"

	univention-config-registry set \
		ldap/server/name="$hostname.$domainname" \

		ldap/master="$DCNAME" \
		ldap/master/port?7389 \
		ldap/server/type=slave \
		>>"$LOGFILE" 2>&1

	echo -n "Sync SSL directory: "
	univention-ssh-rsync "$DCPWD" -az "${DCACCOUNT}@${DCNAME}:/etc/univention/ssl/*" /etc/univention/ssl/ >>"$LOGFILE" 2>&1
	echo_right "done"

	# prevent join from failing if umask is modified (Bug #21587)
	chmod 755 /etc/univention/ssl

		ssl/organizationalunit="$ssl_organizationalunit" \
		ssl/common="$ssl_common" \
		ssl/email="$ssl_email" \
		>>"$LOGFILE" 2>&1
	echo_right "done"

	echo -n "Restart LDAP Server: "
	/etc/init.d/slapd restart >>/var/log/univention/join.log 2>&1
	echo_right "done"

	#TODO: implement a real sync
	echo -n "Sync Kerberos settings: "
	univention-scp "$DCPWD" -r "${DCACCOUNT}@${DCNAME}:/var/lib/heimdal-kdc/*" /var/lib/heimdal-kdc/ >>/var/log/univention/join.log 2>&1
	echo_right "done"


	# invalidate the nscd hosts cache

		ldap/server/name?"$DCNAME" \
		ldap/master?"$DCNAME" \
		kerberos/adminserver?"$DCNAME" \
		>>"$LOGFILE" 2>&1
	set_kerberos_realm "$DCPWD" "$DCACCOUNT" "$DCNAME" "$REALM"
	set_windows_domain "$DCPWD" "$DCACCOUNT" "$DCNAME" "$WINDOM"
	eval "$(univention-config-registry shell)"


	univention-scp "$DCPWD" "${DCACCOUNT}@${DCNAME}:/etc/ldap-backup.secret /etc/ldap-backup.secret" >/var/log/univention/join.log 2>&1

	echo_right "done"

	univention-config-registry set \
		ldap/server/name="$hostname.$domainname" \

		ldap/master="$DCNAME" \
		ldap/master/port?7389 \
		ldap/server/type=slave \
		>>"$LOGFILE" 2>&1

	mkdir -p /etc/univention/ssl/ucsCA
	univention-scp "$DCPWD" -q "${DCACCOUNT}@${DCNAME}:/etc/univention/ssl/ucsCA/CAcert.pem" /etc/univention/ssl/ucsCA/ >>/var/log/univention/join.log 2>&1


	echo -n "Restart LDAP Server: "
	/etc/init.d/slapd restart >>/var/log/univention/join.log 2>&1
	echo_right "done"

	echo -n "Sync Kerberos settings: "
	univention-scp "$DCPWD" -q -r "${DCACCOUNT}@${DCNAME}:/var/lib/heimdal-kdc/*" /var/lib/heimdal-kdc/ >>/var/log/univention/join.log 2>&1
	echo_right "done"

	mkdir -p /var/lib/univention-ldap/notify/


		ldap/server/name?"$DCNAME" \
		ldap/master?"$DCNAME" \
		kerberos/adminserver?"$DCNAME" \
		>>"$LOGFILE" 2>&1
	set_kerberos_realm "$DCPWD" "$DCACCOUNT" "$DCNAME" "$REALM"
	set_windows_domain "$DCPWD" "$DCACCOUNT" "$DCNAME" "$WINDOM"
	echo -n "0" >/var/lib/univention-ldap/schema/id/id

		ldap/master?"$DCNAME" \
		ldap/master/port?7389 \
		kerberos/adminserver?"$DCNAME" \
		>>"$LOGFILE" 2>&1
	set_kerberos_realm "$DCPWD" "$DCACCOUNT" "$DCNAME" "$REALM"
	set_windows_domain "$DCPWD" "$DCACCOUNT" "$DCNAME" "$WINDOM"
	touch /var/univention-join/joined

		ldap/master/port?7389 \
		kerberos/adminserver="$DCNAME" \
		nsswitch/ldap=yes \
		>>"$LOGFILE" 2>&1
	set_kerberos_realm "$DCPWD" "$DCACCOUNT" "$DCNAME" "$REALM"
	set_windows_domain "$DCPWD" "$DCACCOUNT" "$DCNAME" "$WINDOM"
	grep -q '^TLS_CACERT' /etc/ldap/ldap.conf || echo "TLS_CACERT /etc/univention/ssl/ucsCA/CAcert.pem" >>/etc/ldap/ldap.conf

fi

if [ -d /etc/runit/univention-directory-notifier ]; then
	/etc/init.d/univention-directory-notifier restart >>"$LOGFILE" 2>&1
	sleep 3
fi

if [ -d /etc/runit/univention-directory-listener ]; then
	/etc/init.d/univention-directory-listener restart >>"$LOGFILE" 2>&1
fi

varname="interfaces_${interfaces_primary:-eth0}_type"

(-)a/branches/ucs-3.2/ucs-3.2-0/management/univention-join/univention-run-join-scripts (-7 / +10 lines)

Lines 79-84 failed_message () {	Link Here

	exit 1

	exit 1

echo_right () {

	local text="$*"

	echo -e "\033[$((${COLUMNS:-80}-${#text}))G${text}"

while [ $# -gt 0 ]

while [ $# -gt 0 ]

do

do

	case "$1" in

	case "$1" in

Lines 177-183 if [ ! "$server_role" = "domaincontroller_master" ] \|\| [ -n "$ASK_PASS" ] ; then	Link Here

177

		then

182

		then

178

			failed_message "Invalid credentials"

183

			failed_message "Invalid credentials"

179

		else

184

		else

180

			echo -e "\033[60Gdone"

185

			echo_right "done"

181

fi

186

fi

182

fi

187

fi

183

fi

188

fi

Lines 222-233 then	Link Here

222

		echo "RUNNING $(basename "$i")"

227

		echo "RUNNING $(basename "$i")"

223

228

224

		if ! joinscript_extern_init "$i"; then

229

		if ! joinscript_extern_init "$i"; then

225

			echo -e "\033[60Gskipped (invalid joinscript)" >&3

230

			echo_right "skipped (invalid joinscript)" >&3

226

			echo "EXITCODE=invalid_joinscript"

231

			echo "EXITCODE=invalid_joinscript"

227

			continue

232

			continue

228

fi

233

fi

229

		if joinscript_check_already_executed && [ -z "$JOIN_FORCE" ]; then

234

		if joinscript_check_already_executed && [ -z "$JOIN_FORCE" ]; then

230

			echo -e "\033[60Gskipped (already executed)" >&3

235

			echo_right "skipped (already executed)" >&3

231

			echo "EXITCODE=already_executed"

236

			echo "EXITCODE=already_executed"

232

			continue

237

			continue

233

fi

238

fi

Lines 240-248 then	Link Here

240

		RET=$?

245

		RET=$?

241

		echo "EXITCODE=$RET"

246

		echo "EXITCODE=$RET"

242

		if [ $RET != 0 ]; then

247

		if [ $RET != 0 ]; then

243

			echo -e "\033[60Gfailed (exitcode: $RET)" >&3

248

			echo_right "failed (exitcode: $RET)" >&3

244

		else

249

		else

245

			echo -e "\033[60Gdone" >&3

250

			echo_right "done" >&3

246

			delete_unjoinscript "$(basename "$i")"

251

			delete_unjoinscript "$(basename "$i")"

247

fi

252

fi

248

	done

253

	done

249

250

--

251

.../management/univention-join/univention-join     | 26 +++++-----------------

254

.../management/univention-join/univention-join     | 26 +++++-----------------

252

1 file changed, 5 insertions(+), 21 deletions(-)

255

1 file changed, 5 insertions(+), 21 deletions(-)




fi


get_master_version () {
	local version_version version_patchlevel
	eval "$(univention-ssh "$DCPWD" "${DCACCOUNT}@${DCNAME}" /usr/sbin/ucr shell version/version version/patchlevel)"
	echo "${version_version}.${version_patchlevel}"
}
	key=${i%%: *}
	value=${i#*: }
	case "$key" in
		"version/version")
			master_version="$value"
			;;
		"version/patchlevel")
			master_patchlevel="$value"
			;;
		"version/releasename")
			master_releasename="$value"
			;;
	esac
done
IFS=$OLDIFS

# check join constraints
log "running version check"

- 
--
.../management/univention-join/univention-join     | 28 ++++++++--------------
1 file changed, 10 insertions(+), 18 deletions(-)




	failed_message "failed to get host certificate"
}

invalidate_nscd_cache () {
	# <https://forge.univention.org/bugzilla/show_bug.cgi?id=30886>
	nscd -i hosts
}


check_ldap_tls_connection () {
	echo -n "Check TLS connection "

	args+=(-mac "$(cat "${iface}/address")")
done

# invalidate the nscd hosts cache
#  https://forge.univention.org/bugzilla/show_bug.cgi?id=30886
nscd -i hosts

echo -n "Join Computer Account: "
args+=(-role "$server_role" -hostname "$hostname" -domainname "$domainname")
# Copy local $DCPWD to remote $DCPWD' and invoke univention-join remotely
invalidate_nscd_cache
univention-ssh --no-split "$DCPWD" "${DCACCOUNT}@${DCNAME}" \
	'DCPWD=$(mktemp) && trap "rm -f \"$DCPWD\"" EXIT && cat >"$DCPWD" && /usr/share/univention-join/univention-server-join -bindpwfile "$DCPWD"' \
	"$(bashquote "${args[@]}")" <"$DCPWD" 2>&1 | tee "$USERTMP/log" >>"$LOGFILE"

	univention-scp "$DCPWD" -r "${DCACCOUNT}@${DCNAME}:/var/lib/heimdal-kdc/*" /var/lib/heimdal-kdc/ >>/var/log/univention/join.log 2>&1
	echo_right "done"

	invalidate_nscd_cache
	# invalidate the nscd hosts cache
	nscd -i hosts

	univention-config-registry set \
		ldap/server/name?"$DCNAME" \
		ldap/master?"$DCNAME" \


	mkdir -p /var/lib/univention-ldap/notify/

	invalidate_nscd_cache
	nscd -i hosts

	univention-config-registry set \
		ldap/server/name?"$DCNAME" \
		ldap/master?"$DCNAME" \

		>>/var/log/univention/join.log 2>&1
	grep -q '^TLS_CACERT' /etc/ldap/ldap.conf || echo "TLS_CACERT /etc/univention/ssl/ucsCA/CAcert.pem" >>/etc/ldap/ldap.conf

	invalidate_nscd_cache
	nscd -i hosts

	univention-config-registry set \
		ldap/server/name?"$DCNAME" \
		ldap/server/port?7389 \

	check_ldap_tls_connection

	download_host_certificate
	invalidate_nscd_cache
	# invalidate the nscd hosts cache
	nscd -i hosts

	univention-config-registry set \
		ldap/server/name="$DCNAME" \
		ldap/server/port?7389 \
- 
--
.../management/univention-join/univention-join     | 60 ++++++++++------------
1 file changed, 26 insertions(+), 34 deletions(-)




	echo -n "${escaped[@]}"
}

fetch_secret () {
	local name="/etc/${1}.secret"
	backup_secret "$1"
	echo -n "Sync ${name}: "
	if univention-scp "$DCPWD" "${DCACCOUNT}@${DCNAME}:${name} ${name}" >>"$LOGIFLE" 2>&1 &&
		[ -s "${name}" ]
	then
		echo_right "done"
	else
		echo_right "failed"
		failed_message "${name} not found"
	fi
}
backup_secret () {
	local name="/etc/${1}.secret"
	if [ -e "${name}" ]
	then
		cat "${name}" >>"${name}.SAVE"
		chmod 0600 "${name}.SAVE"
	fi
}

download_host_certificate () {
	echo -n "Download host certificate "
	local HOSTPWD="/etc/machine.secret"

	kpwd="$(sed -ne 's|^KerberosPasswd="\(.*\)" *|\1|p' <"$USERTMP/log")"

	if [ -n "$kpwd" ]; then
		backup_secret "machine"
			cat /etc/machine.secret >>/etc/machine.secret.SAVE
		fi

		echo -n "$kpwd" >/etc/machine.secret
		fromdos /etc/machine.secret
		chmod 600 /etc/machine.secret
		if [ -e /etc/machine.secret.SAVE ]; then
			chmod 600 /etc/machine.secret.SAVE
		fi
	else
		if [ -n "$res_message" ]; then
			failed_message "$res_message"

}

if [ "$server_role" = "domaincontroller_backup" ]; then
	fetch_secret "ldap"
	fetch_secret "ldap-backup"
	if [ -e "/etc/ldap-backup.secret" ]; then cat /etc/ldap-backup.secret >>/etc/ldap-backup.secret.SAVE; fi

	echo -n "Sync ldap.secret: "
	univention-scp "$DCPWD" -q "${DCACCOUNT}@${DCNAME}:/etc/ldap.secret" /etc/ldap.secret >>/var/log/univention/join.log 2>&1
	if [ ! -e "/etc/ldap.secret" ]; then
		failed_message "/etc/ldap.secret not found"
	fi
	echo_right "done"

	echo -n "Sync ldap-backup.secret: "
	univention-scp "$DCPWD" -q "${DCACCOUNT}@${DCNAME}:/etc/ldap-backup.secret" /etc/ldap-backup.secret >>/var/log/univention/join.log 2>&1
	if [ ! -e "/etc/ldap-backup.secret" ]; then
		failed_message "/etc/ldap-backup.secret not found"
	fi
	echo_right "done"

	univention-config-registry set \
		ldap/server/name="$hostname.$domainname" \
		ldap/server/ip="$IP" \

	run_join_scripts

elif [ "$server_role" = "domaincontroller_slave" ]; then
	fetch_secret "ldap-backup"
	echo -n "Sync ldap-backup.secret: "

	if [ -e "/etc/ldap-backup.secret" ]; then cat /etc/ldap-backup.secret >>/etc/ldap-backup.secret.SAVE; fi

	univention-scp "$DCPWD" "${DCACCOUNT}@${DCNAME}:/etc/ldap-backup.secret /etc/ldap-backup.secret" >/var/log/univention/join.log 2>&1

	echo_right "done"

	univention-config-registry set \
		ldap/server/name="$hostname.$domainname" \
		ldap/server/ip="$IP" \
- 
--
.../management/univention-join/univention-join     | 22 ++++------------------
1 file changed, 4 insertions(+), 18 deletions(-)

(-)a/branches/ucs-3.2/ucs-3.2-0/management/univention-join/univention-join (-20 / +4 lines)

Lines 192-197 check_ldap_tls_connection () {	Link Here

192

193

194

run_join_scripts () {

194

run_join_scripts () {

195

	eval "$(univention-config-registry shell)"

196

197

	: > /var/univention-join/joined

198

	ln -sf /var/univention-join/joined /usr/share/univention-join/.joined

195

199

196

	LC_COLLATE="C"

200

	LC_COLLATE="C"

197

	if test -d "/usr/lib/univention-install/"; then

201

	if test -d "/usr/lib/univention-install/"; then

Lines 694-706 if [ "$server_role" = "domaincontroller_backup" ]; then	Link Here

694

		>>"$LOGFILE" 2>&1

698

		>>"$LOGFILE" 2>&1

695

	set_kerberos_realm "$DCPWD" "$DCACCOUNT" "$DCNAME" "$REALM"

699

	set_kerberos_realm "$DCPWD" "$DCACCOUNT" "$DCNAME" "$REALM"

696

	set_windows_domain "$DCPWD" "$DCACCOUNT" "$DCNAME" "$WINDOM"

700

	set_windows_domain "$DCPWD" "$DCACCOUNT" "$DCNAME" "$WINDOM"

697

	eval "$(univention-config-registry shell)"

698

699

	mkdir -p /var/lib/univention-ldap/notify/

701

	mkdir -p /var/lib/univention-ldap/notify/

700

702

701

	touch /var/univention-join/joined

702

	ln -sf /var/univention-join/joined /usr/share/univention-join/.joined

703

704

	echo -n "0" >/var/lib/univention-ldap/schema/id/id

703

	echo -n "0" >/var/lib/univention-ldap/schema/id/id

705

	chown listener /var/lib/univention-ldap/schema/id/id

704

	chown listener /var/lib/univention-ldap/schema/id/id

706

705

Lines 752-761 elif [ "$server_role" = "domaincontroller_slave" ]; then	Link Here

752

	set_windows_domain "$DCPWD" "$DCACCOUNT" "$DCNAME" "$WINDOM"

751

	set_windows_domain "$DCPWD" "$DCACCOUNT" "$DCNAME" "$WINDOM"

753

	echo -n "0" >/var/lib/univention-ldap/schema/id/id

752

	echo -n "0" >/var/lib/univention-ldap/schema/id/id

754

	chown listener /var/lib/univention-ldap/schema/id/id

753

	chown listener /var/lib/univention-ldap/schema/id/id

755

756

	touch /var/univention-join/joined

757

	ln -sf /var/univention-join/joined /usr/share/univention-join/.joined

758

759

	run_join_scripts

754

	run_join_scripts

760

755

761

elif [ "$server_role" = "memberserver" ]; then

756

elif [ "$server_role" = "memberserver" ]; then

Lines 790-798 elif [ "$server_role" = "memberserver" ]; then	Link Here

790

		>>"$LOGFILE" 2>&1

785

		>>"$LOGFILE" 2>&1

791

	set_kerberos_realm "$DCPWD" "$DCACCOUNT" "$DCNAME" "$REALM"

786

	set_kerberos_realm "$DCPWD" "$DCACCOUNT" "$DCNAME" "$REALM"

792

	set_windows_domain "$DCPWD" "$DCACCOUNT" "$DCNAME" "$WINDOM"

787

	set_windows_domain "$DCPWD" "$DCACCOUNT" "$DCNAME" "$WINDOM"

793

	touch /var/univention-join/joined

794

	ln -sf /var/univention-join/joined /usr/share/univention-join/.joined

795

796

	run_join_scripts

788

	run_join_scripts

797

789

798

else

790

else

Lines 826-837 else	Link Here

826

	set_kerberos_realm "$DCPWD" "$DCACCOUNT" "$DCNAME" "$REALM"

818

	set_kerberos_realm "$DCPWD" "$DCACCOUNT" "$DCNAME" "$REALM"

827

	set_windows_domain "$DCPWD" "$DCACCOUNT" "$DCNAME" "$WINDOM"

819

	set_windows_domain "$DCPWD" "$DCACCOUNT" "$DCNAME" "$WINDOM"

828

	grep -q '^TLS_CACERT' /etc/ldap/ldap.conf || echo "TLS_CACERT /etc/univention/ssl/ucsCA/CAcert.pem" >>/etc/ldap/ldap.conf

820

	grep -q '^TLS_CACERT' /etc/ldap/ldap.conf || echo "TLS_CACERT /etc/univention/ssl/ucsCA/CAcert.pem" >>/etc/ldap/ldap.conf

829

830

	touch /var/univention-join/joined

831

	ln -sf /var/univention-join/joined /usr/share/univention-join/.joined

832

833

	eval "$(univention-config-registry shell)"

834

835

	run_join_scripts

821

	run_join_scripts

836

fi

822

fi

837

823

838

839

--

840

.../ucs-3.2-0/management/univention-join/univention-join | 16 +++++++---------

824

.../ucs-3.2-0/management/univention-join/univention-join | 16 +++++++---------

841

1 file changed, 7 insertions(+), 9 deletions(-)

825

1 file changed, 7 insertions(+), 9 deletions(-)

(-)a/branches/ucs-3.2/ucs-3.2-0/management/univention-join/univention-join (-11 / +7 lines)

Lines 177-182 invalidate_nscd_cache () {	Link Here

177

	nscd -i hosts

177

	nscd -i hosts

178

179

180

reset_listener_schema () {

181

	mkdir -p /var/lib/univention-ldap/notify/

182

	echo -n "0" >/var/lib/univention-ldap/schema/id/id

183

	chown listener /var/lib/univention-ldap/schema/id/id

184

180

185

181

check_ldap_tls_connection () {

186

check_ldap_tls_connection () {

182

	echo -n "Check TLS connection "

187

	echo -n "Check TLS connection "

Lines 698-708 if [ "$server_role" = "domaincontroller_backup" ]; then	Link Here

698

		>>"$LOGFILE" 2>&1

703

		>>"$LOGFILE" 2>&1

699

	set_kerberos_realm "$DCPWD" "$DCACCOUNT" "$DCNAME" "$REALM"

704

	set_kerberos_realm "$DCPWD" "$DCACCOUNT" "$DCNAME" "$REALM"

700

	set_windows_domain "$DCPWD" "$DCACCOUNT" "$DCNAME" "$WINDOM"

705

	set_windows_domain "$DCPWD" "$DCACCOUNT" "$DCNAME" "$WINDOM"

701

	mkdir -p /var/lib/univention-ldap/notify/

706

	reset_listener_schema

702

703

	echo -n "0" >/var/lib/univention-ldap/schema/id/id

704

	chown listener /var/lib/univention-ldap/schema/id/id

705

706

	run_join_scripts

707

	run_join_scripts

707

708

elif [ "$server_role" = "domaincontroller_slave" ]; then

709

elif [ "$server_role" = "domaincontroller_slave" ]; then

Lines 739-746 elif [ "$server_role" = "domaincontroller_slave" ]; then	Link Here

739

	univention-scp "$DCPWD" -q -r "${DCACCOUNT}@${DCNAME}:/var/lib/heimdal-kdc/*" /var/lib/heimdal-kdc/ >>/var/log/univention/join.log 2>&1

740

	univention-scp "$DCPWD" -q -r "${DCACCOUNT}@${DCNAME}:/var/lib/heimdal-kdc/*" /var/lib/heimdal-kdc/ >>/var/log/univention/join.log 2>&1

740

	echo_right "done"

741

	echo_right "done"

741

742

	mkdir -p /var/lib/univention-ldap/notify/

743

744

	invalidate_nscd_cache

743

	invalidate_nscd_cache

745

	univention-config-registry set \

744

	univention-config-registry set \

746

		ldap/server/name?"$DCNAME" \

745

		ldap/server/name?"$DCNAME" \

Lines 749-756 elif [ "$server_role" = "domaincontroller_slave" ]; then	Link Here

749

		>>"$LOGFILE" 2>&1

748

		>>"$LOGFILE" 2>&1

750

	set_kerberos_realm "$DCPWD" "$DCACCOUNT" "$DCNAME" "$REALM"

749

	set_kerberos_realm "$DCPWD" "$DCACCOUNT" "$DCNAME" "$REALM"

751

	set_windows_domain "$DCPWD" "$DCACCOUNT" "$DCNAME" "$WINDOM"

750

	set_windows_domain "$DCPWD" "$DCACCOUNT" "$DCNAME" "$WINDOM"

752

	echo -n "0" >/var/lib/univention-ldap/schema/id/id

751

	reset_listener_schema

753

	chown listener /var/lib/univention-ldap/schema/id/id

754

	run_join_scripts

752

	run_join_scripts

755

753

756

elif [ "$server_role" = "memberserver" ]; then

754

elif [ "$server_role" = "memberserver" ]; then

757

758

--

759

.../management/univention-join/univention-join     | 63 ++++++++--------------

755

.../management/univention-join/univention-join     | 63 ++++++++--------------

760

1 file changed, 21 insertions(+), 42 deletions(-)

756

1 file changed, 21 insertions(+), 42 deletions(-)




	univention-config-registry set windows/domain="$windom" >>"$LOGFILE" 2>&1
}

copy_ucs_ca () {
	mkdir -p /etc/univention/ssl/ucsCA

	univention-scp "$DCPWD" -q "${DCACCOUNT}@${DCNAME}:/etc/univention/ssl/ucsCA/CAcert.pem" /etc/univention/ssl/ucsCA/ >>"$LOGFILE" 2>&1
	if [ ! -e /etc/univention/ssl/ucsCA/CAcert.pem ]; then
		univention-scp "$DCPWD" -q "${DCACCOUNT}@${DCNAME}:/etc/univention/ssl/udsCA/CAcert.pem" /etc/univention/ssl/ucsCA/ >>"$LOGFILE" 2>&1
	fi
	fix_ssl_permissions
}

fix_ssl_permissions () {
	# prevent join from failing if umask is modified (Bug #21587)
	chmod 755 /etc/univention/ssl
	chmod 755 /etc/univention/ssl/ucsCA
	chmod 644 /etc/univention/ssl/ucsCA/CAcert.pem
}

if [ "$server_role" = "domaincontroller_backup" ]; then
	fetch_secret "ldap"
	fetch_secret "ldap-backup"

	univention-ssh-rsync "$DCPWD" -az "${DCACCOUNT}@${DCNAME}:/etc/univention/ssl/*" /etc/univention/ssl/ >>"$LOGFILE" 2>&1
	echo_right "done"

	fix_ssl_permissions
	chmod 755 /etc/univention/ssl
	chmod 755 /etc/univention/ssl/ucsCA
	chmod 644 /etc/univention/ssl/ucsCA/CAcert.pem

	check_ldap_tls_connection

	download_host_certificate

		ldap/master/port?7389 \
		ldap/server/type=slave \
		>>"$LOGFILE" 2>&1
	copy_ucs_ca
	mkdir -p /etc/univention/ssl/ucsCA
	univention-scp "$DCPWD" -q "${DCACCOUNT}@${DCNAME}:/etc/univention/ssl/ucsCA/CAcert.pem" /etc/univention/ssl/ucsCA/ >>/var/log/univention/join.log 2>&1
	if [ ! -e /etc/univention/ssl/ucsCA/CAcert.pem ]; then
		univention-scp "$DCPWD" -q "${DCACCOUNT}@${DCNAME}:/etc/univention/ssl/udsCA/CAcert.pem" /etc/univention/ssl/ucsCA/ >>/var/log/univention/join.log 2>&1
	fi

	# prevent join from failing if umask is modified (Bug #21587)
	chmod 755 /etc/univention/ssl
	chmod 755 /etc/univention/ssl/ucsCA
	chmod 644 /etc/univention/ssl/ucsCA/CAcert.pem

	check_ldap_tls_connection

	download_host_certificate

	run_join_scripts

elif [ "$server_role" = "memberserver" ]; then
	copy_ucs_ca
	univention-scp "$DCPWD" -q "${DCACCOUNT}@${DCNAME}:/etc/univention/ssl/ucsCA/CAcert.pem" /etc/univention/ssl/ucsCA/ >>/var/log/univention/join.log 2>&1
	if [ ! -e /etc/univention/ssl/ucsCA/CAcert.pem ]; then
		univention-scp "$DCPWD" -q "${DCACCOUNT}@${DCNAME}:/etc/univention/ssl/udsCA/CAcert.pem" /etc/univention/ssl/ucsCA/ >>/var/log/univention/join.log 2>&1
	fi

	# prevent join from failing if umask is modified (Bug #21587)
	chmod 755 /etc/univention/ssl
	chmod 755 /etc/univention/ssl/ucsCA
	chmod 644 /etc/univention/ssl/ucsCA/CAcert.pem

	check_ldap_tls_connection

	download_host_certificate


else
# Client and Mobile Client
	copy_ucs_ca

	mkdir -p /etc/univention/ssl/ucsCA

	univention-scp "$DCPWD" -q "${DCACCOUNT}@${DCNAME}:/etc/univention/ssl/ucsCA/CAcert.pem" /etc/univention/ssl/ucsCA/ >>/var/log/univention/join.log 2>&1
	if [ ! -e /etc/univention/ssl/ucsCA/CAcert.pem ]; then
		univention-scp "$DCPWD" -q "${DCACCOUNT}@${DCNAME}:/etc/univention/ssl/udsCA/CAcert.pem" /etc/univention/ssl/ucsCA/ >>/var/log/univention/join.log 2>&1
	fi

	# prevent join from failing if umask is modified (Bug #21587)
	chmod 755 /etc/univention/ssl
	chmod 755 /etc/univention/ssl/ucsCA
	chmod 644 /etc/univention/ssl/ucsCA/CAcert.pem

	check_ldap_tls_connection

	download_host_certificate
- 
--
.../ucs-3.2-0/management/univention-join/univention-join  | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)

(-)a/branches/ucs-3.2/ucs-3.2-0/management/univention-join/univention-join (-9 / +8 lines)

Lines 665-670 fix_ssl_permissions () {	Link Here

665

	chmod 644 /etc/univention/ssl/ucsCA/CAcert.pem

665

	chmod 644 /etc/univention/ssl/ucsCA/CAcert.pem

666

667

668

restart_ldap_server () {

669

	echo -n "Restart LDAP Server: "

670

	/etc/init.d/slapd restart >>"$LOGFILE" 2>&1

671

	echo_right "done"

672

673

668

if [ "$server_role" = "domaincontroller_backup" ]; then

674

if [ "$server_role" = "domaincontroller_backup" ]; then

669

	fetch_secret "ldap"

675

	fetch_secret "ldap"

670

	fetch_secret "ldap-backup"

676

	fetch_secret "ldap-backup"

Lines 699-707 if [ "$server_role" = "domaincontroller_backup" ]; then	Link Here

699

		>>"$LOGFILE" 2>&1

705

		>>"$LOGFILE" 2>&1

700

	echo_right "done"

706

	echo_right "done"

701

707

702

	echo -n "Restart LDAP Server: "

708

	restart_ldap_server

703

	/etc/init.d/slapd restart >>/var/log/univention/join.log 2>&1

704

	echo_right "done"

705

709

706

	#TODO: implement a real sync

710

	#TODO: implement a real sync

707

	echo -n "Sync Kerberos settings: "

711

	echo -n "Sync Kerberos settings: "

Lines 733-742 elif [ "$server_role" = "domaincontroller_slave" ]; then	Link Here

733

	check_ldap_tls_connection

737

	check_ldap_tls_connection

734

738

735

	download_host_certificate

739

	download_host_certificate

736

740

	restart_ldap_server

737

	echo -n "Restart LDAP Server: "

738

	/etc/init.d/slapd restart >>/var/log/univention/join.log 2>&1

739

	echo_right "done"

740

741

	echo -n "Sync Kerberos settings: "

742

	echo -n "Sync Kerberos settings: "

742

	univention-scp "$DCPWD" -q -r "${DCACCOUNT}@${DCNAME}:/var/lib/heimdal-kdc/*" /var/lib/heimdal-kdc/ >>/var/log/univention/join.log 2>&1

743

	univention-scp "$DCPWD" -q -r "${DCACCOUNT}@${DCNAME}:/var/lib/heimdal-kdc/*" /var/lib/heimdal-kdc/ >>/var/log/univention/join.log 2>&1

743

744

--

745

.../management/univention-join/univention-join       | 20 +++++++++-----------

744

.../management/univention-join/univention-join       | 20 +++++++++-----------

746

1 file changed, 9 insertions(+), 11 deletions(-)

745

1 file changed, 9 insertions(+), 11 deletions(-)




	echo_right "done"
}

sync_kerberos_setting () {
	#TODO: implement a real sync
	echo -n "Sync Kerberos settings: "
	univention-scp "$DCPWD" -q -r "${DCACCOUNT}@${DCNAME}:/var/lib/heimdal-kdc/*" /var/lib/heimdal-kdc/ >>"$LOGFILE" 2>&1
	echo_right "done"
}

if [ "$server_role" = "domaincontroller_backup" ]; then
	fetch_secret "ldap"
	fetch_secret "ldap-backup"

	echo_right "done"

	restart_ldap_server
	sync_kerberos_setting
	#TODO: implement a real sync
	echo -n "Sync Kerberos settings: "
	univention-scp "$DCPWD" -r "${DCACCOUNT}@${DCNAME}:/var/lib/heimdal-kdc/*" /var/lib/heimdal-kdc/ >>/var/log/univention/join.log 2>&1
	echo_right "done"

	invalidate_nscd_cache
	univention-config-registry set \
		ldap/server/name?"$DCNAME" \


	download_host_certificate
	restart_ldap_server
	sync_kerberos_setting
	echo -n "Sync Kerberos settings: "
	univention-scp "$DCPWD" -q -r "${DCACCOUNT}@${DCNAME}:/var/lib/heimdal-kdc/*" /var/lib/heimdal-kdc/ >>/var/log/univention/join.log 2>&1
	echo_right "done"

	invalidate_nscd_cache
	univention-config-registry set \
		ldap/server/name?"$DCNAME" \
- 
--
.../management/univention-join/univention-join     | 42 ++++++++++++----------
1 file changed, 24 insertions(+), 18 deletions(-)




fi


find_dc () {
	[ -n "$DCNAME" ] && return

	echo -n "Search DC Master: "
	DCNAME="$(lookup_dns_srv)"
	if [ -n "$DCNAME" ]; then
		echo_right "done"
		return
		for i in "$nameserver" "$nameserver1" "$nameserver2" "$nameserver3" "$dns_forwarder1" "$dns_forwarder2" "$dns_forwarder3"; do
			if [ -z "$i" ]; then continue; fi
			DCNAME="$(host -t SRV "_domaincontroller_master._tcp.$domainname" "$i" | sed -ne '$s/.* \([^ ]\+\)\.$/\1/p')"
			if [ -n "$DCNAME" ]; then
				echo_right "done"
				echo "domain $domainname" >/etc/resolv.conf
				echo "nameserver $i" >>/etc/resolv.conf
				test -x /etc/init.d/nscd && /etc/init.d/nscd restart >>/var/log/univention/join.log 2>&1
				break
			fi
		done
	fi
fi

	for ns in "$nameserver" "$nameserver1" "$nameserver2" "$nameserver3" "$dns_forwarder1" "$dns_forwarder2" "$dns_forwarder3"
	do
		[ -n "$i" ] || continue
		DCNAME="$(lookup_dns_srv "$ns")"
		[ -n "$DCNAME" ] || continue

		echo_right "done"
		echo "domain $domainname" >/etc/resolv.conf
		echo "nameserver $ns" >>/etc/resolv.conf
		[ -x /etc/init.d/nscd ] && /etc/init.d/nscd restart >>"$LOGFILE" 2>&1
		return
	done

	failed_message "missing dns service record for _domaincontroller_master._tcp.$domainname"
}
lookup_dns_srv () {
	host -t SRV "_domaincontroller_master._tcp.$domainname" ${1:+"$1"} |
		sed -ne '$s/.* \([^ ]\+\)\.$/\1/p'
}
find_dc

echo -n "Check DC Master: "

- 
--
.../management/univention-join/univention-join     | 101 +++++++++------------
1 file changed, 45 insertions(+), 56 deletions(-)





. /usr/share/univention-lib/all.sh

SIMPLEGUI="-n"
TYPE=
USERTMP="$(mktemp -d)"
DCPWD="$USERTMP/dcpwd"
VERSION_CHECK=true
VERBOSE=

LOGFILE="/var/log/univention/join.log"
log () {


trapOnExit() {
	rm -rf "$USERTMP"
	if [ "$VERBOSE" = "true" ]; then
		if [ -n "$old_listener_debug_level" ]; then
			ucr set listener/debug/level="$old_listener_debug_level" >>"$LOGFILE" 2>&1
		fi

	: > /var/univention-join/joined
	ln -sf /var/univention-join/joined /usr/share/univention-join/.joined

	[ -d "/usr/lib/univention-install/" ] || return
	LC_COLLATE="C"
	for i in /usr/lib/univention-install/*.{inst,uinst}; do
		[ -e "$i" ] || continue
		local basename="$(basename "${i%.*}")"
		echo $SIMPLEGUI "Configure $basename "
		log "Configure $basename"
		if ! ${VERBOSE+bash -x} "$i" --binddn "$binddn" --bindpwd "$(<"$DCPWD")" >>"$LOGFILE" 2>&1
		then
			echo_right "failed"
			failed_message "FAILED: $basename"
		else
			echo_right "done"
			delete_unjoinscript "$basename"
		fi
		if [ "$basename" = "03univention-directory-listener.inst" ]; then
			# check failed.ldif
			if [ -e /var/lib/univention-directory-replication/failed.ldif ]; then
				failed_message "FAILED: failed.ldif exists."
			fi
			case "$server_role" in
			domaincontroller_backup)
				copy_transaction_log
				;;
			domaincontroller_slave)
				if [ "$listener_supply_notifier" = "yes" ]; then
					copy_transaction_log

					# backup
					if [ "$server_role" = "domaincontroller_backup" ]; then
						univention-scp "$DCPWD" -r \
							"${DCACCOUNT}@${DCNAME}:/var/lib/univention-ldap/notify/transaction" \
							"$USERTMP/tlog" >/dev/null 2>&1
						if [ ! -e "$USERTMP/tlog" ]; then
							failed_message " FAILED: failed do copy /var/lib/univention-ldap/notify/transaction from the dc master. Please try again."
						fi

						id="$(</var/lib/univention-directory-listener/notifier_id)"
						awk -F ' ' '{ if ( $1 <= '$id') print }' "$USERTMP/tlog" >/var/lib/univention-ldap/notify/transaction
					fi

					# slave 
					if [ "$server_role" = "domaincontroller_slave" ]; then
						if [ -n "$listener_supply_notifier" -a "$listener_supply_notifier" = "yes" ]; then
							univention-scp "$DCPWD" -q \
								"${DCACCOUNT}@${DCNAME}:/var/lib/univention-ldap/notify/transaction" \
								"$USERTMP/tlog" >/dev/null 2>&1
							id="$(</var/lib/univention-directory-listener/notifier_id)"
							awk -F ' ' '{ if ( $1 <= '$id') print }' "$USERTMP/tlog" >/var/lib/univention-ldap/notify/transaction
						fi

					fi
				fi
				;;
			esac
		fi
	done
}

copy_transaction_log () {
	univention-scp "$DCPWD" -r \
		"${DCACCOUNT}@${DCNAME}:/var/lib/univention-ldap/notify/transaction" \
		"$USERTMP/tlog" >/dev/null 2>&1
	if [ ! -e "$USERTMP/tlog" ]; then
		failed_message " FAILED: failed do copy /var/lib/univention-ldap/notify/transaction from the dc master. Please try again."
	fi

	local id
	read id </var/lib/univention-directory-listener/notifier_id
	awk -F ' ' '{ if ( $1 <= '$id') print }' "$USERTMP/tlog" >/var/lib/univention-ldap/notify/transaction
}

# log univention-join call

		"-simplegui")
			# output simpler gui for univention-installer to be able to parse output
			shift
			SIMPLEGUI=
			;;
		"-disableVersionCheck")
			shift

done

# verbose logging for univention-join and listener
if [ "$VERBOSE" = "true" ]; then
	exec 2>>"$LOGFILE"
	set -x
	if [ -n "$listener_debug_level" ]; then
- 
--
.../ucs-3.2-0/management/univention-join/univention-server-join   | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)




	else
		log 0 "Modify $desc [$old_dn]"

		cmd=(univention-directory-manager "$module" modify \
			--dn "$old_dn" \
			--set password="$computerPassword" \
			--set domain="$DOMAINNAME" \
			"${args[@]}" "${ADMINOPTIONS[@]}")
		#log 0 "${cmd[@]}"
		if ! rc="$("${cmd[@]}")"
		then
			log 1 "E: failed to modify $desc $old_dn [$rc]"
			exit 1
		fi
- 
--
branches/ucs-3.2/ucs-3.2-0/management/univention-join/univention-join | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)





if [ -z "$LDAPBASE" ]; then
	echo -n "Search ldap/base"
	ldap_base="$(univention-ssh "$DCPWD" "${DCACCOUNT}@${DCNAME}" /usr/sbin/ucr get ldap/base)"
else
	ldap_base="$LDAPBASE"
fi
- 
--
branches/ucs-3.2/ucs-3.2-0/management/univention-join/univention-join | 4 ++--
.../ucs-3.2-0/management/univention-join/univention-server-join       | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)

(-)a/branches/ucs-3.2/ucs-3.2-0/management/univention-join/univention-join (-2 / +2 lines)

Lines 188-195 check_ldap_tls_connection () {	Link Here

188

189

	eval "$(ucr shell ldap/master/port)"

189

	eval "$(ucr shell ldap/master/port)"

190

191

	ldapsearch -x -ZZ -p "$ldap_master_port" -s base -h "$DCNAME" -D "$binddn" -w "$(<"$DCPWD")" dn >/dev/null

191

	if ! ldapsearch -x -ZZ -p "$ldap_master_port" -s base -h "$DCNAME" -D "$binddn" -w "$(<"$DCPWD")" dn >/dev/null

192

	if  [ $? != 0 ]; then

192

	then

193

 		failed_message "Establishing a TLS connection with $DCNAME failed. Maybe you didn't specify a FQDN."

193

 		failed_message "Establishing a TLS connection with $DCNAME failed. Maybe you didn't specify a FQDN."

194

fi

194

fi

195




		echo "ldap_dn=\"$ldap_dn\""

		if [ -n "$group" ]; then
			if ! rc="$(univention-directory-manager groups/group modify \
				--dn="$group" \
				--append users="$ldap_dn" \
				"${ADMINOPTIONS[@]}")"
			then
				log 1 "E: failed to modify groups/group for $desc [$rc]"
				exit 1
			fi
- 
--
branches/ucs-3.2/ucs-3.2-0/management/univention-join/univention-join | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)




if [ -z "$binddn" ]; then
	# Next check is the local ldapi interface
	binddn="$(univention-ssh "$DCPWD" "${DCACCOUNT}@${DCNAME}" \
		ldapsearch -x -LLL -H ldapi:/// "\'(&(uid=$DCACCOUNT)(objectClass=person))\'" dn | ldapsearch-wrapper | ldapsearch-decode64 | sed -ne 's|^dn: ||p')"
fi

if [ -z "$binddn" ]; then
	# Check with anonymous bind
	binddn="$(univention-ssh "$DCPWD" "${DCACCOUNT}@${DCNAME}" \
		ldapsearch -x -LLL "\'(&(uid=$DCACCOUNT)(objectClass=person))\'" dn | ldapsearch-wrapper | ldapsearch-decode64 | sed -ne 's|^dn: ||p')"
fi

if [ -z "$binddn" ]; then
- 
--
.../ucs-3.2/ucs-3.2-0/management/univention-join/univention-join  | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)




	check_ldap_tls_connection

	download_host_certificate

	univention-config-registry set \
		ldap/master="$DCNAME" \
		ldap/master/port?7389 \
		>>/var/log/univention/join.log 2>&1
	grep -q '^TLS_CACERT' /etc/ldap/ldap.conf || echo "TLS_CACERT /etc/univention/ssl/ucsCA/CAcert.pem" >>/etc/ldap/ldap.conf

	invalidate_nscd_cache
	univention-config-registry set \
		ldap/server/name?"$DCNAME" \

		>>"$LOGFILE" 2>&1
	set_kerberos_realm "$DCPWD" "$DCACCOUNT" "$DCNAME" "$REALM"
	set_windows_domain "$DCPWD" "$DCACCOUNT" "$DCNAME" "$WINDOM"
	grep -q '^TLS_CACERT' /etc/ldap/ldap.conf || echo "TLS_CACERT /etc/univention/ssl/ucsCA/CAcert.pem" >>/etc/ldap/ldap.conf
	run_join_scripts

else
- 
--
.../ucs-3.2/ucs-3.2-0/management/univention-join/univention-join | 9 +--------
.../ucs-3.2-0/management/univention-join/univention-server-join  | 2 +-
2 files changed, 2 insertions(+), 9 deletions(-)




if [ -n "$ldap_position" ]; then
	args+=(-position "$ldap_position")
fi
args+=(-binddn "$binddn")

if [ "${master_version:0:1}" -lt 3 ]; then
	# UCS 2.x does not support the -binddn parameter
	args+=(-bindaccount "$DCACCOUNT")
else
	args+=(-binddn "$binddn")
fi

for ip in $(ip addr show scope global | sed -rne '/\<scope global\>/s|.*\<inet6? ([0-9a-f.:/]+)\>.*|\1|p')
do




	ADMINOPTIONS+=(--binddn "$BINDDN")
fi
if [ -n "$BINDPWFILE" ]; then
	ADMINOPTIONS+=(--bindpwdfile "$BINDPWFILE")
fi


- 
--
.../management/univention-join/univention-join     | 27 +++++++++++-----------
.../univention-join/univention-server-join         |  2 +-
2 files changed, 14 insertions(+), 15 deletions(-)




	args+=(-mac "$(cat "${iface}/address")")
done

echo -n "Join Computer Account: "
args+=(-role "$server_role" -hostname "$hostname" -domainname "$domainname")

echo -n "Join Computer Account: "
# Copy local $DCPWD to remote $DCPWD' and invoke univention-join remotely
invalidate_nscd_cache
univention-ssh --no-split "$DCPWD" "${DCACCOUNT}@${DCNAME}" \


	if [ -n "$kpwd" ]; then
		backup_secret "machine"
		printf "%s" "$kpwd" >/etc/machine.secret
		fromdos /etc/machine.secret
		chmod 600 /etc/machine.secret
	else
		if [ -n "$res_message" ]; then

}

set_windows_domain () {

	local dcpwd="$1"
	local dcaccount="$2"
	local dcname="$3"

	echo_right "done"
}

case "$server_role" in
domaincontroller_backup)
	fetch_secret "ldap"
	fetch_secret "ldap-backup"
	univention-config-registry set \


	fix_ssl_permissions
	check_ldap_tls_connection

	download_host_certificate

	echo -n "Sync SSL settings: "

	set_windows_domain "$DCPWD" "$DCACCOUNT" "$DCNAME" "$WINDOM"
	reset_listener_schema
	run_join_scripts
	;;

domaincontroller_slave)
	fetch_secret "ldap-backup"
	univention-config-registry set \
		ldap/server/name="$hostname.$domainname" \

		>>"$LOGFILE" 2>&1
	copy_ucs_ca
	check_ldap_tls_connection

	download_host_certificate
	restart_ldap_server
	sync_kerberos_setting

	set_windows_domain "$DCPWD" "$DCACCOUNT" "$DCNAME" "$WINDOM"
	reset_listener_schema
	run_join_scripts
	;;

memberserver)
	copy_ucs_ca
	check_ldap_tls_connection

	download_host_certificate
	invalidate_nscd_cache
	univention-config-registry set \

	set_windows_domain "$DCPWD" "$DCACCOUNT" "$DCNAME" "$WINDOM"
	grep -q '^TLS_CACERT' /etc/ldap/ldap.conf || echo "TLS_CACERT /etc/univention/ssl/ucsCA/CAcert.pem" >>/etc/ldap/ldap.conf
	run_join_scripts
	;;

*) # Client and Mobile Client
# Client and Mobile Client
	copy_ucs_ca
	check_ldap_tls_connection

	download_host_certificate
	invalidate_nscd_cache
	univention-config-registry set \

	set_windows_domain "$DCPWD" "$DCACCOUNT" "$DCNAME" "$WINDOM"
	grep -q '^TLS_CACERT' /etc/ldap/ldap.conf || echo "TLS_CACERT /etc/univention/ssl/ucsCA/CAcert.pem" >>/etc/ldap/ldap.conf
	run_join_scripts
	;;
esac

if [ -d /etc/runit/univention-directory-notifier ]; then
	/etc/init.d/univention-directory-notifier restart >>"$LOGFILE" 2>&1

(-)a/branches/ucs-3.2/ucs-3.2-0/management/univention-join/univention-server-join (-2 / +1 lines)

Lines 286-292 create_entry () {	Link Here

286

287

		if [ -n "$group" ]; then

287

		if [ -n "$group" ]; then

288

			if ! rc="$(univention-directory-manager groups/group modify \

288

			if ! rc="$(univention-directory-manager groups/group modify \

289

				--dn="$group" \

289

				--dn "$group" \

290

				--append users="$ldap_dn" \

290

				--append users="$ldap_dn" \

291

				"${ADMINOPTIONS[@]}")"

291

				"${ADMINOPTIONS[@]}")"

292

			then

292

			then

293

Return to bug 28562