# Copyright (c) 2000-2001 Jason Gunthorpe <jgg@debian.org>
# Copyright (c) 2003-2004 James Troup <troup@debian.org>
-# Copyright (c) 2004-2005 Joey Schulze <joey@infodrom.org>
+# Copyright (c) 2004-2005,7 Joey Schulze <joey@infodrom.org>
# Copyright (c) 2001-2007 Ryan Murray <rmurray@debian.org>
#
# This program is free software; you can redistribute it and/or modify
# If the account is locked, do not write it.
# This is a partial stop-gap. The ssh also needs to change this
# to ignore ~/.ssh/authorized* files.
- if (string.find(GetAttr(x,"userPassword"),"*LK*") != -1):
+ if (string.find(GetAttr(x,"userPassword"),"*LK*") != -1) \
+ or GetAttr(x,"userPassword").startswith("!"):
continue;
if x[1].has_key("uidNumber") == 0 or \
continue;
# If the account is locked, do not write it
- if (string.find(GetAttr(x,"userPassword"),"*LK*") != -1):
+ if (string.find(GetAttr(x,"userPassword"),"*LK*") != -1) \
+ or GetAttr(x,"userPassword").startswith("!"):
continue;
# If the account has no PGP key, do not write it
raise;
Done(File,F,None);
+# Generate a list of locked accounts
+def GenDisabledAccounts(l,File):
+ F = None;
+ try:
+ F = open(File + ".tmp","w");
+
+ # Fetch all the users
+ global PasswdAttrs;
+ if PasswdAttrs == None:
+ raise "No Users";
+
+ I = 0;
+ for x in PasswdAttrs:
+ if x[1].has_key("uidNumber") == 0:
+ continue;
+
+ Pass = GetAttr(x,"userPassword");
+ Line = ""
+ # *LK* is the reference value for a locked account
+ # password starting with ! is also a locked account
+ if string.find(Pass,"*LK*") != -1 or Pass.startswith("!"):
+ # Format is <login>:<reason>
+ Line = "%s:%s" % (GetAttr(x,"uid"), "Account is locked")
+
+ if Line != "":
+ F.write(Sanitize(Line) + "\n")
+
+ # Oops, something unspeakable happened.
+ except:
+ Die(File,F,None);
+ raise;
+ Done(File,F,None);
+
# Generate the list of local addresses that refuse all mail
def GenMailDisable(l,File):
F = None;
# If the account is locked, disable incoming mail
if (string.find(GetAttr(x,"userPassword"),"*LK*") != -1):
- Reason = "user account locked"
+ if GetAttr(x,"uid") == "luther":
+ continue
+ else:
+ Reason = "user account locked"
else:
if x[1].has_key("mailDisableMessage"):
Reason = GetAttr(x,"mailDisableMessage")
GenAllForward(l,GlobalDir+"mail-forward.cdb");
GenMarkers(l,GlobalDir+"markers");
GenPrivate(l,GlobalDir+"debian-private");
+GenDisabledAccounts(l,GlobalDir+"disabled-accounts");
GenSSHKnown(l,GlobalDir+"ssh_known_hosts");
GenHosts(l,GlobalDir+"debianhosts");
GenMailDisable(l,GlobalDir+"mail-disable");
Allowed = None
CurrentHost = Split[0];
+ DoLink(GlobalDir,OutDir,"ssh-rsa-shadow");
+ DoLink(GlobalDir,OutDir,"debianhosts");
+ DoLink(GlobalDir,OutDir,"ssh_known_hosts");
+ DoLink(GlobalDir,OutDir,"disabled-accounts")
+
sys.stdout.flush();
GenPasswd(l,OutDir+"passwd",Split[1]);
sys.stdout.flush();
GenGroup(l,OutDir+"group");
if ExtraList.has_key("[UNTRUSTED]"):
continue;
- GenShadow(l,OutDir+"shadow");
+ if not ExtraList.has_key("[NOPASSWD]"):
+ GenShadow(l,OutDir+"shadow");
# Link in global things
- DoLink(GlobalDir,OutDir,"ssh-rsa-shadow");
DoLink(GlobalDir,OutDir,"markers");
DoLink(GlobalDir,OutDir,"mail-forward.cdb");
- DoLink(GlobalDir,OutDir,"debianhosts");
- DoLink(GlobalDir,OutDir,"ssh_known_hosts");
DoLink(GlobalDir,OutDir,"mail-disable");
DoLink(GlobalDir,OutDir,"mail-greylist");
DoLink(GlobalDir,OutDir,"mail-callout");