Update to 4.2.3

1 files changed, 60 insertions, 0 deletions

diff --git a/freeipa-client.install b/freeipa-client.install
new file mode 100644
index 000000000000..07a72603e788
--- /dev/null
+++ b/freeipa-client.install
@@ -0,0 +1,60 @@
+post_upgrade() {
+    # Has the client been configured?
+    restore=0
+    test -f '/var/lib/ipa-client/sysrestore/sysrestore.index' && restore=$(wc -l '/var/lib/ipa-client/sysrestore/sysrestore.index' | awk '{print $1}')
+
+    if [ -f '/etc/sssd/sssd.conf' -a $restore -ge 2 ]; then
+        if ! grep -E -q '/var/lib/sss/pubconf/krb5.include.d/' /etc/krb5.conf  2>/dev/null ; then
+            echo "includedir /var/lib/sss/pubconf/krb5.include.d/" > /etc/krb5.conf.ipanew
+            cat /etc/krb5.conf >> /etc/krb5.conf.ipanew
+            mv -Z /etc/krb5.conf.ipanew /etc/krb5.conf
+        fi
+    fi
+
+    if [ -f '/etc/sysconfig/ntpd' -a $restore -ge 2 ]; then
+        if grep -E -q 'OPTIONS=.*-u ntp:ntp' /etc/sysconfig/ntpd 2>/dev/null; then
+            sed -r '/OPTIONS=/ { s/\s+-u ntp:ntp\s+/ /; s/\s*-u ntp:ntp\s*// }' /etc/sysconfig/ntpd >/etc/sysconfig/ntpd.ipanew
+            mv -Z /etc/sysconfig/ntpd.ipanew /etc/sysconfig/ntpd
+
+            /bin/systemctl condrestart ntpd.service 2>&1 || :
+        fi
+    fi
+
+    if [ ! -f '/etc/ipa/nssdb/cert8.db' -a $restore -ge 2 ]; then
+        python2 -c 'from ipapython.certdb import create_ipa_nssdb; create_ipa_nssdb()' >/dev/null 2>&1
+    fi
+
+    # Has the client been configured?
+    restore=0
+    test -f '/var/lib/ipa-client/sysrestore/sysrestore.index' && restore=$(wc -l '/var/lib/ipa-client/sysrestore/sysrestore.index' | awk '{print $1}')
+
+    if [ -f '/etc/ssh/sshd_config' -a $restore -ge 2 ]; then
+        if grep -E -q '^(AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys|PubKeyAgent /usr/bin/sss_ssh_authorizedkeys %u)$' /etc/ssh/sshd_config 2>/dev/null; then
+            sed -r '
+                /^(AuthorizedKeysCommand(User|RunAs)|PubKeyAgentRunAs)[ \t]/ d
+            ' /etc/ssh/sshd_config >/etc/ssh/sshd_config.ipanew
+
+            if /usr/sbin/sshd -t -f /dev/null -o 'AuthorizedKeysCommand=/usr/bin/sss_ssh_authorizedkeys' -o 'AuthorizedKeysCommandUser=nobody'; then
+                sed -ri '
+                    s/^PubKeyAgent (.+) %u$/AuthorizedKeysCommand \1/
+                    s/^AuthorizedKeysCommand .*$/\0\nAuthorizedKeysCommandUser nobody/
+                ' /etc/ssh/sshd_config.ipanew
+            elif /usr/sbin/sshd -t -f /dev/null -o 'AuthorizedKeysCommand=/usr/bin/sss_ssh_authorizedkeys' -o 'AuthorizedKeysCommandRunAs=nobody'; then
+                sed -ri '
+                    s/^PubKeyAgent (.+) %u$/AuthorizedKeysCommand \1/
+                    s/^AuthorizedKeysCommand .*$/\0\nAuthorizedKeysCommandRunAs nobody/
+                ' /etc/ssh/sshd_config.ipanew
+            elif /usr/sbin/sshd -t -f /dev/null -o 'PubKeyAgent=/usr/bin/sss_ssh_authorizedkeys %u' -o 'PubKeyAgentRunAs=nobody'; then
+                sed -ri '
+                    s/^AuthorizedKeysCommand (.+)$/PubKeyAgent \1 %u/
+                    s/^PubKeyAgent .*$/\0\nPubKeyAgentRunAs nobody/
+                ' /etc/ssh/sshd_config.ipanew
+            fi
+
+            mv -Z /etc/ssh/sshd_config.ipanew /etc/ssh/sshd_config
+            chmod 600 /etc/ssh/sshd_config
+
+            /bin/systemctl condrestart sshd.service 2>&1 || :
+        fi
+    fi
+}