- # Startup the replay cache
- ErrType = EX_TEMPFAIL
- ErrMsg = "Failed to initialize the replay cache:"
-
- # Get the email
- ErrType = EX_PERMFAIL
- ErrMsg = "Failed to understand the email or find a signature:"
- mail = email.parser.Parser().parse(sys.stdin)
- Msg = GetClearSig(mail)
-
- ErrMsg = "Message is not PGP signed:"
- if Msg[0].find("-----BEGIN PGP SIGNED MESSAGE-----") == -1 and \
- Msg[0].find("-----BEGIN PGP MESSAGE-----") == -1:
- raise UDFormatError("No PGP signature")
-
- # Check the signature
- ErrMsg = "Unable to check the signature or the signature was invalid:"
- pgp = GPGCheckSig2(Msg[0])
-
- if not pgp.ok:
- raise UDFormatError(pgp.why)
-
- if pgp.text is None:
- raise UDFormatError("Null signature text")
-
- # Extract the plain message text in the event of mime encoding
- global PlainText
- ErrMsg = "Problem stripping MIME headers from the decoded message"
- if Msg[1] == 1:
- e = email.parser.Parser().parsestr(pgp.text)
- PlainText = e.get_payload(decode=True)
- else:
- PlainText = pgp.text
-
- # Connect to the ldap server
- ErrType = EX_TEMPFAIL
- ErrMsg = "An error occured while performing the LDAP lookup"
- global lc
- lc = connectLDAP()
- lc.simple_bind_s("", "")
-
- # Search for the matching key fingerprint
- Attrs = lc.search_s(BaseDn, ldap.SCOPE_ONELEVEL, "keyFingerPrint={}".format(pgp.key_fpr))
-
- ErrType = EX_PERMFAIL
- if len(Attrs) == 0:
- raise UDFormatError("Key not found")
- if len(Attrs) != 1:
- raise UDFormatError("Oddly your key fingerprint is assigned to more than one account..")
-
- # Check the signature against the replay cache
- RC = ReplayCache(ReplayCacheFile)
- RC.process(pgp.sig_info)
-
- # Determine the sender address
- ErrMsg = "A problem occured while trying to formulate the reply"
- Sender = mail.get('Reply-To', mail.get('From'))
- if not Sender:
- raise UDFormatError("Unable to determine the sender's address")
-
- # Formulate a reply
- Date = time.strftime("%a, %d %b %Y %H:%M:%S +0000", time.gmtime(time.time()))
- Reply = "To: %s\nReply-To: %s\nDate: %s\n" % (Sender, ReplyTo, Date)
-
- Res = lc.search_s(HostBaseDn, ldap.SCOPE_SUBTREE, '(objectClass=debianServer)', ['hostname'])
- # Res is a list of tuples.
- # The tuples contain a dn (str) and a dictionary.
- # The dictionaries map the key "hostname" to a list.
- # These lists contain a single hostname (str).
- ValidHostNames = reduce(lambda a, b: a + b, [value.get("hostname", []) for (dn, value) in Res], [])
-
- # Dispatch
- if sys.argv[1] == "ping":
- Reply = HandlePing(Reply, Attrs[0], pgp.key_info)
- elif sys.argv[1] == "chpass":
- if PlainText.strip().find("Please change my Debian password") >= 0:
- Reply = HandleChPass(Reply, Attrs[0], pgp.key_info)
- elif PlainText.strip().find("Please change my Kerberos password") >= 0:
- Reply = HandleChKrbPass(Reply, Attrs[0], pgp.key_info)
- elif PlainText.strip().find("Please change my TOTP seed") >= 0:
- Reply = HandleChTOTPSeed(Reply, Attrs[0], pgp.key_info)
- else:
- raise UDFormatError("Please send a signed message where the first line of text is the string 'Please change my Debian password' or some other string we accept here.")
- elif sys.argv[1] == "change":
- Reply = HandleChange(Reply, Attrs[0], pgp.key_info)
- else:
- print sys.argv
- raise UDFormatError("Incorrect Invokation")
-
- # Send the message through sendmail
- ErrMsg = "A problem occured while trying to send the reply"
- Child = os.popen("/usr/sbin/sendmail -t", "w")
-# Child = os.popen("cat","w")
- Child.write(Reply)
- if Child.close() is not None:
+ # Startup the replay cache
+ ErrType = EX_TEMPFAIL
+ ErrMsg = "Failed to initialize the replay cache:"
+
+ # Get the email
+ ErrType = EX_PERMFAIL
+ ErrMsg = "Failed to understand the email or find a signature:"
+ mail = email.parser.Parser().parse(sys.stdin)
+ Msg = GetClearSig(mail)
+
+ ErrMsg = "Message is not PGP signed:"
+ if Msg[0].find("-----BEGIN PGP SIGNED MESSAGE-----") == -1 and \
+ Msg[0].find("-----BEGIN PGP MESSAGE-----") == -1:
+ raise UDFormatError("No PGP signature")
+
+ # Check the signature
+ ErrMsg = "Unable to check the signature or the signature was invalid:"
+ pgp = GPGCheckSig2(Msg[0])
+
+ if not pgp.ok:
+ raise UDFormatError(pgp.why)
+
+ if pgp.text is None:
+ raise UDFormatError("Null signature text")
+
+ # Extract the plain message text in the event of mime encoding
+ global PlainText
+ ErrMsg = "Problem stripping MIME headers from the decoded message"
+ if Msg[1] == 1:
+ e = email.parser.Parser().parsestr(pgp.text)
+ PlainText = e.get_payload(decode=True)
+ else:
+ PlainText = pgp.text
+
+ # Connect to the ldap server
+ ErrType = EX_TEMPFAIL
+ ErrMsg = "An error occured while performing the LDAP lookup"
+ global lc
+ lc = connectLDAP()
+ lc.simple_bind_s("", "")
+
+ # Search for the matching key fingerprint
+ Attrs = lc.search_s(BaseDn, ldap.SCOPE_ONELEVEL, "keyFingerPrint={}".format(pgp.key_fpr))
+
+ ErrType = EX_PERMFAIL
+ if len(Attrs) == 0:
+ raise UDFormatError("Key not found")
+ if len(Attrs) != 1:
+ raise UDFormatError("Oddly your key fingerprint is assigned to more than one account..")
+
+ # Check the signature against the replay cache
+ RC = ReplayCache(ReplayCacheFile)
+ RC.process(pgp.sig_info)
+
+ # Determine the sender address
+ ErrMsg = "A problem occured while trying to formulate the reply"
+ Sender = mail.get('Reply-To', mail.get('From'))
+ if not Sender:
+ raise UDFormatError("Unable to determine the sender's address")
+
+ # Formulate a reply
+ Date = time.strftime("%a, %d %b %Y %H:%M:%S +0000", time.gmtime(time.time()))
+ Reply = "To: %s\nReply-To: %s\nDate: %s\n" % (Sender, ReplyTo, Date)
+
+ Res = lc.search_s(HostBaseDn, ldap.SCOPE_SUBTREE, '(objectClass=debianServer)', ['hostname'])
+ # Res is a list of tuples.
+ # The tuples contain a dn (str) and a dictionary.
+ # The dictionaries map the key "hostname" to a list.
+ # These lists contain a single hostname (str).
+ ValidHostNames = reduce(lambda a, b: a + b, [value.get("hostname", []) for (dn, value) in Res], [])
+
+ # Dispatch
+ if sys.argv[1] == "ping":
+ Reply = HandlePing(Reply, Attrs[0], pgp.key_info)
+ elif sys.argv[1] == "chpass":
+ if PlainText.strip().find("Please change my Debian password") >= 0:
+ Reply = HandleChPass(Reply, Attrs[0], pgp.key_info)
+ elif PlainText.strip().find("Please change my Kerberos password") >= 0:
+ Reply = HandleChKrbPass(Reply, Attrs[0], pgp.key_info)
+ elif PlainText.strip().find("Please change my TOTP seed") >= 0:
+ Reply = HandleChTOTPSeed(Reply, Attrs[0], pgp.key_info)
+ else:
+ raise UDFormatError("Please send a signed message where the first line of text is the string 'Please change my Debian password' or some other string we accept here.")
+ elif sys.argv[1] == "change":
+ Reply = HandleChange(Reply, Attrs[0], pgp.key_info)
+ else:
+ print sys.argv
+ raise UDFormatError("Incorrect Invokation")
+
+ # Send the message through sendmail
+ ErrMsg = "A problem occured while trying to send the reply"
+ Child = os.popen("/usr/sbin/sendmail -t", "w")
+ # Child = os.popen("cat","w")
+ Child.write(Reply)
+ if Child.close() is not None: