Pass = '*';
else:
Pass = Pass[7:];
+
+ # If the account is locked, mark it as such in shadow
+ # See Debian Bug #308229 for why we set it to 1 instead of 0
+ if (string.find(GetAttr(x,"userPassword"),"*LK*") != -1) \
+ or GetAttr(x,"userPassword").startswith("!"):
+ ShadowExpire = '1'
+ else:
+ ShadowExpire = GetAttr(x,"shadowexpire")
+
Line = "%s:%s:%s:%s:%s:%s:%s:%s:" % (GetAttr(x,"uid"),\
Pass,GetAttr(x,"shadowLastChange"),\
GetAttr(x,"shadowMin"),GetAttr(x,"shadowMax"),\
GetAttr(x,"shadowWarning"),GetAttr(x,"shadowinactive"),\
- GetAttr(x,"shadowexpire"));
+ ShadowExpire);
Line = Sanitize(Line) + "\n";
F.write("0%u %s" % (I,Line));
F.write(".%s %s" % (GetAttr(x,"uid"),Line));
# If the account is locked, do not write it.
# This is a partial stop-gap. The ssh also needs to change this
# to ignore ~/.ssh/authorized* files.
- if (string.find(GetAttr(x,"userPassword"),"*LK*") != -1):
+ if (string.find(GetAttr(x,"userPassword"),"*LK*") != -1) \
+ or GetAttr(x,"userPassword").startswith("!"):
continue;
if x[1].has_key("uidNumber") == 0 or \
# If the account is locked, do not write it
if (string.find(GetAttr(x,"userPassword"),"*LK*") != -1) \
- or (string.find(GetAttr(x,"userPassword"),"*PK*") != -1):
+ or GetAttr(x,"userPassword").startswith("!"):
continue;
# If the account has no PGP key, do not write it
raise;
Done(File,F,None);
+# Generate a list of locked accounts
+def GenDisabledAccounts(l,File):
+ F = None;
+ try:
+ F = open(File + ".tmp","w");
+
+ # Fetch all the users
+ global PasswdAttrs;
+ if PasswdAttrs == None:
+ raise "No Users";
+
+ I = 0;
+ for x in PasswdAttrs:
+ if x[1].has_key("uidNumber") == 0:
+ continue;
+
+ Pass = GetAttr(x,"userPassword");
+ Line = ""
+ # *LK* is the reference value for a locked account
+ # password starting with ! is also a locked account
+ if string.find(Pass,"*LK*") != -1 or Pass.startswith("!"):
+ # Format is <login>:<reason>
+ Line = "%s:%s" % (GetAttr(x,"uid"), "Account is locked")
+
+ if Line != "":
+ F.write(Sanitize(Line) + "\n")
+
+ # Oops, something unspeakable happened.
+ except:
+ Die(File,F,None);
+ raise;
+ Done(File,F,None);
+
# Generate the list of local addresses that refuse all mail
def GenMailDisable(l,File):
F = None;
# If the account is locked, disable incoming mail
if (string.find(GetAttr(x,"userPassword"),"*LK*") != -1):
- Reason = "user account locked"
+ if GetAttr(x,"uid") == "luther":
+ continue
+ else:
+ Reason = "user account locked"
else:
if x[1].has_key("mailDisableMessage"):
Reason = GetAttr(x,"mailDisableMessage")
GenAllForward(l,GlobalDir+"mail-forward.cdb");
GenMarkers(l,GlobalDir+"markers");
GenPrivate(l,GlobalDir+"debian-private");
+GenDisabledAccounts(l,GlobalDir+"disabled-accounts");
GenSSHKnown(l,GlobalDir+"ssh_known_hosts");
GenHosts(l,GlobalDir+"debianhosts");
GenMailDisable(l,GlobalDir+"mail-disable");
DoLink(GlobalDir,OutDir,"ssh-rsa-shadow");
DoLink(GlobalDir,OutDir,"debianhosts");
DoLink(GlobalDir,OutDir,"ssh_known_hosts");
+ DoLink(GlobalDir,OutDir,"disabled-accounts")
sys.stdout.flush();
GenPasswd(l,OutDir+"passwd",Split[1]);
GenGroup(l,OutDir+"group");
if ExtraList.has_key("[UNTRUSTED]"):
continue;
- GenShadow(l,OutDir+"shadow");
+ if not ExtraList.has_key("[NOPASSWD]"):
+ GenShadow(l,OutDir+"shadow");
# Link in global things
DoLink(GlobalDir,OutDir,"markers");