o

-�_gK�@s6dd
lmZ
ddl
mZmZmZ
Gdd�dee�ZdS)�)
�glob)�Plugin�RedHatPlugin�SoSPredicatec@sheZ
dZd
ZdZdZdZdZdZdZ	dZ
dZdZdZ
dd	�Zd
d�Zdd
�Zdd�Zdd�Zdd�ZdS)�IpazIdentity, policy, audit�ipa)�identity�apacheF)
z/etc/ipa)�
ipa-serverz
ipa-client�freeipa-serverzfreeipa-clientNc

Cs>|�d
�
s|�
d�
s|�
d�
rdS|�d�
s|�
d�
rdSdS)	z Get IPA server version z
pki-serverz/var/lib/pkiz/usr/share/doc/ipa-server-4.2.0�v4z
pki-commonz/var/lib/pki-ca/�v3N)�is_installed�path_exists�
�self�r�8/usr/lib/python3/dist-packages/sos/report/plugins/ipa.py�check_ipa_server_version!s

��


�
zIpa.check_ipa_server_versionc

s*t�f
d
d��j
�d��j�d�fD�
�
S)z Check if any CA is installed c
3��|]}
��|
�
V
qdS�
N)
r)�.0�pathrrr�	<genexpr>/��


�z#Ipa.ca_installed.<locals>.<genexpr>z/conf/ca/CS.cfgz/conf/CS.cfg)�any�pki_tomcat_dir_v4�pki_tomcat_dir_v3rrrr�ca_installed,s



��zIpa.ca_installedc

st�f
d
d�dD�
�
S)z" Check if IPA server is installed c
3rr)
r)r�pkgrrrr8rz+Ipa.ipa_server_installed.<locals>.<genexpr>)r
r)
rrrrr�ipa_server_installed6s
�zIpa.ipa_server_installedcCs8|
d
kr
|�gd�
�

dS|
dkr|�gd�
�

dSdS)z Collect PKI logs r)
z!/var/log/pki/pki-tomcat/ca/debug*z!/var/log/pki/pki-tomcat/ca/systemz'/var/log/pki/pki-tomcat/ca/transactionsz(/var/log/pki/pki-tomcat/ca/selftests.logz"/var/log/pki/pki-tomcat/catalina.*�/var/log/pki/pki-ca-spawn.*z"/var/log/pki/pki-tomcat/kra/debug*z"/var/log/pki/pki-tomcat/kra/systemz(/var/log/pki/pki-tomcat/kra/transactionsz/var/log/pki/pki-kra-spawn.*r
)z/var/log/pki-ca/debugz/var/log/pki-ca/systemz/var/log/pki-ca/transactionsz/var/log/pki-ca/selftests.logz/var/log/pki-ca/catalina.*r!N)
�
add_copy_spec)r�ipa_versionrrr�collect_pki_logs<s


�zIpa.collect_pki_logsc
CsZ
d
|_d|_
d|_d|_|��}
|��r)|�d�

|�d|
�d��

|�gd�
�

|��r7|�d	�

|�	|
�

|�gd
�
�

|
dkrI|j}|j}n|j
}|j}|�
d|�d
��

|�|�d��

|�ddddddddd|�d�|�d�|�d�g�

|�
gd�
�

|�d�

t
|dg
d�}|j
d|d d!�
td"�
D]
}|�
d|���

q�|�d#d$i
�

dS)%Nz/var/lib/pki/pki-tomcatz/var/lib/pki-caz/etc/pki/pki-tomcat/caz/etc/pki-cazIPA server install detectedzIPA version is [�
])z/var/log/ipaserver-install.logz"/var/log/ipaserver-kra-install.logz!/var/log/ipaserver-enable-sid.logz/var/log/ipareplica-install.logz"/var/log/ipareplica-ca-install.logz/var/log/ipa-custodia.audit.logz$CA is installed: retrieving PKI logs)z/var/log/ipaclient-install.logz/var/log/ipaupgrade.logz/var/log/krb5kdc.logz#/var/log/dirsrv/slapd-*/logs/accessz#/var/log/dirsrv/slapd-*/logs/errorsz/etc/dirsrv/slapd-*/dse.ldifz&/etc/dirsrv/slapd-*/schema/99user.ldifz
/etc/hostsz/etc/httpd/alias/*z/etc/named.*z/etc/ipa/ca.crtz/etc/ipa/default.confz/etc/ipa/kdcproxy/kdcproxy.confz$/etc/ipa/kdcproxy/ipa-kdc-proxy.confz/etc/ipa/kdcproxy.confz/root/.ipa/log/cli.log�#/var/lib/certmonger/requests/[0-9]*z/var/lib/certmonger/cas/[0-9]*z/var/lib/ipa/ra-agent.pemz/var/lib/ipa/certs/httpd.crtz/var/kerberos/krb5kdc/kdc.crtz(/var/lib/ipa/sysrestore/sysrestore.statez)/var/log/ipa/healthcheck/healthcheck.log*z/var/log/ipaepn.log*rzcertutil -L -d z/aliasz/CS.cfgz/etc/pki/nssdb/key*z/etc/dirsrv/slapd-*/key*z/etc/dirsrv/slapd-*/pin.txtz/etc/dirsrv/slapd-*/pwdfile.txtz/etc/httpd/alias/ipasession.keyz/etc/httpd/alias/key*z/etc/httpd/alias/pin.txtz/etc/httpd/alias/pwdfile.txtz/etc/named.keytabz/alias/key*z
/flatfile.txtz/password.conf)z certutil -L -d /etc/httpd/alias/zpki-server cert-find --show-allz%pki-server subsystem-cert-validate caz klist -ket /etc/dirsrv/ds.keytabz%klist -ket /etc/httpd/conf/ipa.keytabz,klist -ket /var/lib/ipa/gssproxy/http.keytabz/etc/dirsrv/slapd-*/schema/�
certmonger)
�services�getcert list�getcert_list)�pred�tagsz/etc/dirsrv/slapd-*/z(/var/log/ipa/healthcheck/healthcheck.log�freeipa_healthcheck_log)rr�pki_tomcat_conf_dir_v4�pki_tomcat_conf_dir_v3rr �
_log_debugr"rr$�add_cmd_output�add_forbidden_path�add_dir_listingrr�
add_file_tags)rr#�pki_tomcat_dir�pki_tomcat_conf_dir�getcert_pred�certdb_directoryrrr�setupUs`




	



















�
	
�
�



�z	Ipa.setupc
CsHd
}
d}|�d|
|�
|�
ddd�
d}t|�
D]	}|�|dd	�
qdS)
Nz(\s*arg \"password )[^\"]*z
\1********z/etc/named.confr)z
(pin=)'(\d+)'z\1'***'r&z(key_pin=)(\d+)z\1***)�do_file_sub�do_cmd_output_subr)r�match�subst�request_logs�request_logrrr�postproc�s




�



��zIpa.postproc)�__name__�
__module__�__qualname__�
short_desc�plugin_name�profiles�
ipa_server�
ipa_client�files�packagesrrr.r/rrr r$r9r@rrrrrs$






jrN)r�sos.report.pluginsrrrrrrrr�<module>
s