puppet 0.24.9 → 0.25.0

data/bin/puppetca

@@ -1,363 +0,0 @@
-#!/usr/bin/env ruby
-
-#
-# = Synopsis
-#
-# Stand-alone certificate authority.  Capable of generating certificates
-# but mostly meant for signing certificate requests from puppet clients.
-#
-# = Usage
-#
-#   puppetca [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose]
-#               [-g|--generate] [-l|--list] [-s|--sign] [-r|--revoke]
-#               [-p|--print] [-c|--clean] [--verify] [host]
-#
-# = Description
-#
-# Because the puppetmasterd daemon defaults to not signing client certificate
-# requests, this script is available for signing outstanding requests.  It
-# can be used to list outstanding requests and then either sign them individually
-# or sign all of them.
-#
-# = Options
-#
-# Note that any configuration parameter that's valid in the configuration file
-# is also a valid long argument.  For example, 'ssldir' is a valid configuration
-# parameter, so you can specify '--ssldir <directory>' as an argument.
-#
-# See the configuration file documentation at
-# http://reductivelabs.com/projects/puppet/reference/configref.html for
-# the full list of acceptable parameters. A commented list of all
-# configuration options can also be generated by running puppetca with
-# '--genconfig'.
-#
-# all::
-#   Operate on all items.  Currently only makes sense with '--sign',
-#   '--clean', or '--list'.
-#
-# clean::
-#    Remove all files related to a host from puppetca's storage. This is 
-#    useful when rebuilding hosts, since new certificate signing requests
-#    will only be honored if puppetca does not have a copy of a signed
-#    certificate for that host. The certificate of the host remains valid.
-#    If '--all' is specified then all host certificates, both signed and
-#    unsigned, will be removed.
-#
-# debug::
-#   Enable full debugging.
-#
-# generate::
-#   Generate a certificate for a named client.  A certificate/keypair will be
-#   generated for each client named on the command line.
-#
-# help::
-#   Print this help message
-#
-# list::
-#   List outstanding certificate requests.  If '--all' is specified, 
-#   signed certificates are also listed, prefixed by '+'.
-#
-# print::
-#   Print the full-text version of a host's certificate.
-#
-# revoke::
-#   Revoke the certificate of a client. The certificate can be specified
-#   either by its serial number, given as a decimal number or a hexadecimal
-#   number prefixed by '0x', or by its hostname. The certificate is revoked
-#   by adding it to the Certificate Revocation List given by the 'cacrl'
-#   config parameter. Note that the puppetmasterd needs to be restarted
-#   after revoking certificates.
-#
-# sign::
-#   Sign an outstanding certificate request.  Unless '--all' is specified,
-#   hosts must be listed after all flags.
-#
-# verbose::
-#   Enable verbosity.
-#
-# version::
-#   Print the puppet version number and exit.
-#
-# verify::
-#   Verify the named certificate against the local CA certificate.
-#
-# = Example
-#
-#   $ puppetca -l
-#   culain.madstop.com
-#   $ puppetca -s culain.madstop.com
-#
-# = Author
-#
-# Luke Kanies
-#
-# = Copyright
-#
-# Copyright (c) 2005 Reductive Labs, LLC
-# Licensed under the GNU Public License
-
-require 'puppet'
-require 'puppet/sslcertificates'
-require 'getoptlong'
-
-options = [
-    [ "--all",      "-a",  GetoptLong::NO_ARGUMENT ],
-    [ "--clean",    "-c",  GetoptLong::NO_ARGUMENT ],
-    [ "--debug",    "-d",  GetoptLong::NO_ARGUMENT ],
-    [ "--generate", "-g",  GetoptLong::NO_ARGUMENT ],
-    [ "--help",     "-h",  GetoptLong::NO_ARGUMENT ],
-    [ "--list",     "-l",  GetoptLong::NO_ARGUMENT ],
-    [ "--print",    "-p",  GetoptLong::NO_ARGUMENT ],
-    [ "--revoke",   "-r",  GetoptLong::NO_ARGUMENT ],
-    [ "--sign",     "-s",  GetoptLong::NO_ARGUMENT ],
-    [ "--verify",          GetoptLong::NO_ARGUMENT ],
-	[ "--version",	"-V",  GetoptLong::NO_ARGUMENT ],
-    [ "--verbose",  "-v",  GetoptLong::NO_ARGUMENT ]
-]
-
-# Add all of the config parameters as valid options.
-Puppet.settings.addargs(options)
-
-result = GetoptLong.new(*options)
-
-mode = nil
-all = false
-generate = nil
-
-modes = [:clean, :list, :revoke, :generate, :sign, :print, :verify]
-
-begin
-    result.each { |opt,arg|
-        case opt
-            when "--all"
-                all = true
-            when "--debug"
-                Puppet::Util::Log.level = :debug
-            when "--generate"
-                generate = arg
-                mode = :generate
-            when "--help"
-                if Puppet.features.usage?
-                    RDoc::usage && exit
-                else
-                    puts "No help available unless you have RDoc::usage installed"
-                    exit
-                end
-            when "--list"
-                mode = :list
-            when "--revoke"
-                mode = :revoke
-            when "--sign"
-                mode = :sign
-            when "--version"
-                puts "%s" % Puppet.version
-                exit
-            when "--verbose"
-                Puppet::Util::Log.level = :info
-            else
-                tmp = opt.sub("--", '').to_sym
-                if modes.include?(tmp)
-                    mode = tmp
-                else
-                    Puppet.settings.handlearg(opt, arg)
-                end
-        end
-    }
-rescue GetoptLong::InvalidOption => detail
-    $stderr.puts "Try '#{$0} --help'"
-    exit(1)
-end
-
-# Now parse the config
-Puppet.parse_config
-
-if Puppet.settings.print_configs?
-    exit(Puppet.settings.print_configs ? 0 : 1)
-end
-
-begin
-    ca = Puppet::SSLCertificates::CA.new()
-rescue => detail
-    if Puppet[:debug]
-        puts detail.backtrace
-    end
-    puts detail.to_s
-    exit(23)
-end
-
-unless mode
-    $stderr.puts "You must specify a mode; see the output from --help"
-    exit(12)
-end
-
-if [:verify, :print, :generate, :clean, :revoke, :list].include?(mode)
-    hosts = ARGV.collect { |h| h.downcase }
-end
-
-if [:sign, :list].include?(mode)
-    waiting = ca.list
-    unless waiting.length > 0 or (mode == :list and all)
-        puts "No certificates to sign"
-        if ARGV.length > 0
-            exit(17)
-        else
-            exit(0)
-        end
-    end
-end
-
-case mode
-when :list
-    waiting = ca.list
-    if waiting.length > 0
-        puts waiting.join("\n")
-    end
-    if all
-        puts ca.list_signed.collect { |cert | cert.sub(/^/,"+ ") }.join("\n")
-    end
-when :clean
-    if hosts.empty? and all == false
-        $stderr.puts "You must specify one or more hosts to clean or --all to clean all host certificates"
-        exit(24)
-    end
-
-    cleaned = false
-
-    if all
-        certs = ca.list
-        certs |= ca.list_signed
-            if certs.empty?
-                $stderr.puts "No certificates to clean"
-                exit(24)
-            end
-            certs.each do |c|
-                ca.clean(c)
-            end
-        cleaned = true
-    else
-        hosts.each do |host|
-          
-            unless cert = ca.getclientcert(host)[0] || ca.getclientcsr(host)
-                $stderr.puts "Could not find client certificate or request for %s" % host
-                next
-            end           
-            
-            ca.clean(host)
-            cleaned = true
-        end
-    end
- 
-    unless cleaned
-        exit(27)
-    end
-when :sign
-    to_sign = ARGV.collect { |h| h.downcase }
-    unless to_sign.length > 0 or all
-        $stderr.puts(
-            "You must specify one or more hosts to sign certificates for or --all to sign all certificates"
-        )
-        exit(24)
-    end
-
-    unless all
-        to_sign.each { |host|
-            unless waiting.include?(host)
-                $stderr.puts "No waiting request for %s" % host
-            end
-        }
-        waiting = waiting.find_all { |host|
-            to_sign.include?(host)
-        }
-    end
-
-    waiting.each { |host|
-        begin
-            csr = ca.getclientcsr(host)
-        rescue => detail
-            $stderr.puts "Could not retrieve request for %s: %s" % [host, detail]
-        end
-
-        begin
-            ca.sign(csr)
-            $stderr.puts "Signed %s" % host
-        rescue => detail
-            $stderr.puts "Could not sign request for %s: %s" % [host, detail]
-        end
-
-        begin
-            ca.removeclientcsr(host)
-        rescue => detail
-            $stderr.puts "Could not remove request for %s: %s" % [host, detail]
-        end
-    }
-when :generate
-    # we need to generate a certificate for a host
-    hosts.each { |host|
-        puts "Generating certificate for %s" % host
-        cert = Puppet::SSLCertificates::Certificate.new(
-            :name => host
-        )
-        cert.mkcsr
-        signedcert, cacert = ca.sign(cert.csr)
-
-        cert.cert = signedcert
-        cert.cacert = cacert
-        cert.write
-    }
-when :print
-    hosts.each { |h|
-        cert = ca.getclientcert(h)[0]
-        puts cert.to_text
-    }
-when :revoke
-    hosts.each { |h|
-        serial = nil
-        if h =~ /^0x[0-9a-f]+$/
-            serial = h.to_i(16)
-        elsif h =~ /^[0-9]+$/
-            serial = h.to_i
-        else
-            cert = ca.getclientcert(h)[0]
-            if cert.nil?
-                $stderr.puts "Could not find client certificate for %s" % h
-            else
-                serial = cert.serial
-            end
-        end
-        unless serial.nil?
-            ca.revoke(serial)
-            puts "Revoked certificate with serial #{serial}"
-        end
-    }
-when :verify
-    unless ssl = %x{which openssl}.chomp
-        raise "Can't verify certificates without the openssl binary and could not find one"
-    end
-    success = true
-
-    cacert = Puppet[:localcacert]
-
-    hosts.each do |host|
-        print "%s: " % host
-        file = ca.host2certfile(host)
-        unless FileTest.exist?(file)
-            puts "no certificate found"
-            success = false
-            next
-        end
-
-
-        command = %{#{ssl} verify -CAfile #{cacert} #{file}}
-        output = %x{#{command}}
-        if $? == 0
-            puts "valid"
-        else
-            puts output
-            success = false
-        end
-    end
-else
-    $stderr.puts "Invalid mode %s" % mode
-    exit(42)
-end
-

data/bin/puppetd

@@ -1,439 +0,0 @@
-#!/usr/bin/env ruby
-# == Synopsis 
-#
-# Retrieve the client configuration from the central puppet server and apply
-# it to the local host.
-#
-# Currently must be run out periodically, using cron or something similar.
-#
-# = Usage
-#
-#   puppetd  [-D|--daemonize|--no-daemonize] [-d|--debug] [--disable] [--enable]
-#       [-h|--help] [--fqdn <host name>] [-l|--logdest syslog|<file>|console]
-#       [-o|--onetime] [--serve <handler>] [-t|--test] [--noop]
-#       [-V|--version] [-v|--verbose] [-w|--waitforcert <seconds>]
-#
-# = Description
-#
-# This is the main puppet client.  Its job is to retrieve the local machine's
-# configuration from a remote server and apply it.  In order to successfully
-# communicate with the remote server, the client must have a certificate signed
-# by a certificate authority that the server trusts; the recommended method
-# for this, at the moment, is to run a certificate authority as part of the
-# puppet server (which is the default).  The client will connect and request
-# a signed certificate, and will continue connecting until it receives one.
-#
-# Once the client has a signed certificate, it will retrieve its configuration
-# and apply it.
-#
-# = Usage Notes
-#
-# +puppetd+ does its best to find a compromise between interactive use and
-# daemon use.  Run with no arguments and no configuration, it will go into the
-# backgroun, attempt to get a signed certificate, and retrieve and apply its
-# configuration every 30 minutes.
-#
-# Some flags are meant specifically for interactive use -- in particular,
-# +test+ and +tags+ are useful.  +test+ enables verbose logging, causes
-# the daemon to stay in the foreground, exits if the server's configuration is
-# invalid (this happens if, for instance, you've left a syntax error on the
-# server), and exits after running the configuration once (rather than hanging
-# around as a long-running process).
-#
-# +tags+ allows you to specify what portions of a configuration you want to apply.
-# Puppet elements are tagged with all of the class or definition names that
-# contain them, and you can use the +tags+ flag to specify one of these names,
-# causing only configuration elements contained within that class or definition
-# to be applied.  This is very useful when you are testing new configurations --
-# for instance, if you are just starting to manage +ntpd+, you would put all of
-# the new elements into an +ntpd+ class, and call puppet with +--tags ntpd+,
-# which would only apply that small portion of the configuration during your
-# testing, rather than applying the whole thing.
-#
-# = Options
-#
-# Note that any configuration parameter that's valid in the configuration file
-# is also a valid long argument.  For example, 'server' is a valid configuration
-# parameter, so you can specify '--server <servername>' as an argument.
-#
-# See the configuration file documentation at
-# http://reductivelabs.com/trac/puppet/wiki/ConfigurationReference for
-# the full list of acceptable parameters. A commented list of all
-# configuration options can also be generated by running puppetd with
-# '--genconfig'.
-#
-# daemonize::
-#   Send the process into the background.  This is the default.
-#
-# no-daemonize::
-#   Do not send the process into the background.
-#
-# debug::
-#   Enable full debugging.
-#
-# disable::
-#   Disable working on the local system.  This puts a lock file in place,
-#   causing +puppetd+ not to work on the system until the lock file is removed.
-#   This is useful if you are testing a configuration and do not want the central
-#   configuration to override the local state until everything is tested and
-#   committed.
-#
-#   +puppetd+ uses the same lock file while it is running, so no more than one
-#   +puppetd+ process is working at a time.
-#
-#   +puppetd+ exits after executing this.
-#
-# enable::
-#   Enable working on the local system.  This removes any lock file, causing
-#   +puppetd+ to start managing the local system again (although it will continue
-#   to use its normal scheduling, so it might not start for another half hour).
-#
-#   +puppetd+ exits after executing this.
-#
-# fqdn::
-#   Set the fully-qualified domain name of the client.  This is only used for
-#   certificate purposes, but can be used to override the discovered hostname.
-#   If you need to use this flag, it is generally an indication of a setup problem.
-#
-# help::
-#   Print this help message
-#
-# logdest::
-#   Where to send messages.  Choose between syslog, the console, and a log file.
-#   Defaults to sending messages to syslog, or the console if debugging or
-#   verbosity is enabled.
-#
-# no-client::
-#   Do not create a config client.  This will cause the daemon to run
-#   without ever checking for its configuration automatically, and only
-#   makes sense when used in conjunction with --listen.
-#
-# onetime::
-#   Run the configuration once, rather than as a long-running daemon.  This is
-#   useful for interactively running puppetd.
-#
-# serve::
-#   Start another type of server.  By default, +puppetd+ will start
-#   a service handler that allows authenticated and authorized remote nodes to
-#   trigger the configuration to be pulled down and applied.  You can specify
-#   any handler here that does not require configuration, e.g., filebucket, ca,
-#   or resource.  The handlers are in +lib/puppet/network/handler+, and the names
-#   must match exactly, both in the call to +serve+ and in +namespaceauth.conf+.
-#
-# test::
-#   Enable the most common options used for testing.  These are +onetime+,
-#   +verbose+, +ignorecache, and +no-usecacheonfailure+.
-#
-# noop::
-#   Use +noop+ mode where the daemon runs in a no-op or dry-run mode.  This is useful
-#   for seeing what changes Puppet will make without actually executing the changes.
-#
-# verbose::
-#   Turn on verbose reporting.
-#
-# version::
-#   Print the puppet version number and exit.
-#
-# waitforcert::
-#   This option only matters for daemons that do not yet have certificates
-#   and it is enabled by default, with a value of 120 (seconds).  This causes
-#   +puppetd+ to connect to the server every 2 minutes and ask it to sign a
-#   certificate request.  This is useful for the initial setup of a puppet
-#   client.  You can turn off waiting for certificates by specifying a time
-#   of 0.
-#
-# = Example
-#
-#   puppetd --server puppet.domain.com
-#
-# = Author
-#
-# Luke Kanies
-#
-# = Copyright
-#
-# Copyright (c) 2005, 2006 Reductive Labs, LLC
-# Licensed under the GNU Public License
-
-# Do an initial trap, so that cancels don't get a stack trace.
-trap(:INT) do
-    $stderr.puts "Cancelling startup"
-    exit(0)
-end
-
-require 'puppet'
-require 'puppet/executables/client/certhandler'
-require 'puppet/network/client'
-require 'getoptlong'
-
-options = [
-	[ "--centrallogging",			GetoptLong::NO_ARGUMENT ],
-	[ "--disable",	    			GetoptLong::NO_ARGUMENT ],
-	[ "--debug",	"-d",			GetoptLong::NO_ARGUMENT ],
-	[ "--enable",	    			GetoptLong::NO_ARGUMENT ],
-	[ "--fqdn",     "-f",			GetoptLong::REQUIRED_ARGUMENT ],
-	[ "--help",		"-h",			GetoptLong::NO_ARGUMENT ],
-	[ "--logdest",	"-l",			GetoptLong::REQUIRED_ARGUMENT ],
-	[ "--onetime",  "-o",			GetoptLong::NO_ARGUMENT ],
-	[ "--test",	    "-t",			GetoptLong::NO_ARGUMENT ],
-	[ "--serve",    "-s",			GetoptLong::REQUIRED_ARGUMENT ],
-	[ "--no-client",       			GetoptLong::NO_ARGUMENT ],
-	[ "--verbose",	"-v",			GetoptLong::NO_ARGUMENT ],
-	[ "--version",	"-V",			GetoptLong::NO_ARGUMENT ],
-	[ "--waitforcert",	"-w",		GetoptLong::REQUIRED_ARGUMENT ]
-]
-
-# Add all of the config parameters as valid options.
-Puppet.settings.addargs(options)
-
-result = GetoptLong.new(*options)
-
-args = {}
-
-options = {
-    :waitforcert => 120,  # Default to checking for certs every 5 minutes
-    :onetime => false,
-    :verbose => false,
-    :debug => false,
-    :centrallogs => false,
-    :setdest => false,
-    :enable => false,
-    :disable => false,
-    :client => true,
-    :fqdn => nil,
-    :serve => {}
-}
-
-begin
-    explicit_waitforcert = false
-    result.each { |opt,arg|
-        case opt
-            # First check to see if the argument is a valid configuration parameter;
-            # if so, set it. NOTE: there is a catch-all at the bottom for defaults.rb
-            when "--disable"
-                options[:disable] = true
-            when "--serve"
-                if Puppet::Network::Handler.handler(arg)
-                    options[:serve][arg.to_sym] = {}
-                else
-                    raise "Could not find handler for %s" % arg
-                end
-            when "--enable"
-                options[:enable] = true
-            when "--test"
-                options[:test] = true
-            when "--centrallogging"
-                options[:centrallogs] = true
-            when "--help"
-                if Puppet.features.usage?
-                    RDoc::usage && exit
-                else
-                    puts "No help available unless you have RDoc::usage installed"
-                    exit
-                end
-            when "--version"
-                puts "%s" % Puppet.version
-                exit
-            when "--verbose"
-                options[:verbose] = true
-            when "--debug"
-                options[:debug] = true
-            when "--fqdn"
-                options[:fqdn] = arg
-            when "--no-client"
-                options[:client] = false
-            when "--onetime"
-                options[:onetime] = true
-                options[:waitforcert] = 0 unless explicit_waitforcert
-            when "--port"
-                args[:Port] = arg
-            when "--logdest"
-                begin
-                    Puppet::Util::Log.newdestination(arg)
-                    options[:setdest] = true
-                rescue => detail
-                    if Puppet[:debug]
-                        puts detail.backtrace
-                    end
-                    $stderr.puts detail.to_s
-                end
-            when "--waitforcert"
-                options[:waitforcert] = arg.to_i
-                explicit_waitforcert = true
-            else
-                Puppet.settings.handlearg(opt, arg)
-        end
-    }
-rescue GetoptLong::InvalidOption => detail
-    $stderr.puts detail
-    $stderr.puts "Try '#{$0} --help'"
-    exit(1)
-end
-
-# Now parse the config
-Puppet.parse_config
-
-if options[:test]
-    # Enable all of the most common test options.
-    Puppet.settings.handlearg("--ignorecache")
-    Puppet.settings.handlearg("--no-usecacheonfailure")
-    Puppet.settings.handlearg("--no-splay")
-    Puppet.settings.handlearg("--show_diff")
-    Puppet.settings.handlearg("--no-daemonize")
-    options[:verbose] = true
-    options[:onetime] = true
-    options[:waitforcert] = 0
-end
-
-# Handle the logging settings.
-if options[:debug] or options[:verbose]
-    Puppet::Util::Log.newdestination(:console)
-    if options[:debug]
-        Puppet::Util::Log.level = :debug
-    else
-        Puppet::Util::Log.level = :info
-    end
-end
-
-unless options[:setdest]
-    Puppet::Util::Log.newdestination(:syslog)
-end
-
-if Puppet.settings.print_configs?
-    exit(Puppet.settings.print_configs ? 0 : 1)
-end
-
-# If noop is set, then also enable diffs
-if Puppet[:noop]
-    Puppet[:show_diff] = true
-end
-
-args[:Server] = Puppet[:server]
-if options[:fqdn]
-    args[:FQDN] = options[:fqdn]
-    Puppet[:certname] = options[:fqdn] 
-end
-
-if options[:centrallogs]
-    logdest = args[:Server]
-
-    if args.include?(:Port)
-        logdest += ":" + args[:Port]
-    end
-    Puppet::Util::Log.newdestination(logdest)
-end
-
-# We need tomake the client either way, we just don't start it
-# if --no-client is set.
-client = Puppet::Network::Client.master.new(args)
-if options[:enable]
-    client.enable
-elsif options[:disable]
-    client.disable
-end
-
-if options[:enable] or options[:disable]
-    exit(0)
-end
-
-server = nil
-
-# It'd be nice to daemonize later, but we have to daemonize before the
-# waitforcert happens.
-if Puppet[:daemonize]
-    client.daemonize
-end
-
-unless Puppet::Executables::Client::CertHandler.new(options[:waitforcert], options[:onetime]).read_retrieve
-    client.recycle_connection
-end
-
-objects = []
-
-# This has to go after the certs are dealt with.
-if Puppet[:listen] and ! options[:onetime]
-    unless FileTest.exists?(Puppet[:authconfig])
-        Puppet.err "Will not start without authorization file %s" %
-            Puppet[:authconfig]
-        exit(14)
-    end
-
-    # FIXME: we should really figure out how to distribute the CRL
-    # to clients. In the meantime, we just disable CRL checking if
-    # the CRL file doesn't exist
-    unless File::exist?(Puppet[:cacrl])
-        Puppet[:cacrl] = 'false' 
-    end
-
-    handlers = nil
-
-    if options[:serve].empty?
-        handlers = {:Runner => {}}
-    else
-        handlers = options[:serve]
-    end
-
-    handlers.each do |name, hash|
-        Puppet.info "Starting handler for %s" % name
-    end
-
-    args[:Handlers] = handlers
-    args[:Port] = Puppet[:puppetport]
-
-    require 'puppet/network/http_server/webrick'
-
-    begin
-        server = Puppet::Network::HTTPServer::WEBrick.new(args)
-    rescue => detail
-        $stderr.puts detail
-        puts detail.backtrace
-        exit(1)
-    end
-
-    objects << server
-elsif options[:onetime] and Puppet[:listen]
-    Puppet.notice "Ignoring --listen on onetime run"
-end
-
-if options[:client]
-    objects << client
-end
-
-# Set traps for INT and TERM
-Puppet.settraps
-
-# If --onetime is specified, we don't run 'start', which means we don't
-# create a pidfile.
-if options[:onetime]
-    unless options[:client]
-        $stderr.puts "onetime is specified but there is no client"
-        exit(43)
-    end
-
-    # Add the service, so the traps work correctly.
-    Puppet.newservice(client)
-
-    begin
-        client.run
-    rescue => detail
-        if Puppet[:trace]
-            puts detail.backtrace
-        end
-        Puppet.err detail.to_s
-    end
-    exit(0)
-else
-    if server
-        Puppet.newservice(server)
-    end
-
-    if options[:client]
-        Puppet.notice "Starting Puppet client version %s" % [Puppet.version]
-        Puppet.newservice(client)
-    end
-
-    Puppet.settraps
-
-    Puppet.start
-end
-