# Copyright (c) 2004-2005,7 Joey Schulze <joey@infodrom.org>
# Copyright (c) 2001-2007 Ryan Murray <rmurray@debian.org>
# Copyright (c) 2008 Peter Palfrader <peter@palfrader.org>
+# Copyright (c) 2008 Andreas Barth <aba@not.so.argh.org>
# Copyright (c) 2008 Mark Hymers <mhy@debian.org>
#
# This program is free software; you can redistribute it and/or modify
if len(GetAttr(x,"gecos")) > 100 or len(GetAttr(x,"loginShell")) > 50:
continue;
- userlist[GetAttr(x, "uid")] = GetAttr(x, "gidNumber")
+ userlist[GetAttr(x, "uid")] = int(GetAttr(x, "gidNumber"))
Line = "%s:%s:%s:%s:%s:%s%s:%s" % (GetAttr(x,"uid"),\
PwdMarker,\
GetAttr(x,"uidNumber"),GetAttr(x,"gidNumber"),\
raise;
Done(File,F,None);
+# cache IP adresses
+HostToIPCache = {}
+def HostToIP(Host):
+ global HostToIPCache
+ if not Host in HostToIPCache:
+ IPAdressesT = None
+ try:
+ IPAdressesT = list(set([ (a[0],a[4][0]) for a in socket.getaddrinfo(Host, None)]))
+ except socket.gaierror, (code):
+ if code[0] != -2: raise
+ IPAdresses = []
+ for addr in IPAdressesT:
+ if addr[0] == socket.AF_INET: IPAdresses += [addr[1], "::ffff:"+addr[1]]
+ else: IPAdresses += [addr[1]]
+ HostToIPCache[Host] = IPAdresses
+ return HostToIPCache[Host]
+
+
# Generate the ssh known hosts file
-def GenSSHKnown(l,File):
+def GenSSHKnown(l,File,mode=None):
F = None;
try:
OldMask = os.umask(0022);
SHost = Host.find(".")
if SHost != None: HostNames += [Host[0:SHost]]
- IPAdressesT = None
- IPAdresses = []
- # get IP adresses back as "proto adress" to distinguish between v4 and v6
- try:
- IPAdressesT = set([ (a[0],a[4][0]) for a in socket.getaddrinfo(Host, None)])
- except:
- if code[0] != -2: raise
- for addr in IPAdressesT:
- if addr[0] == socket.AF_INET: IPAdresses += [addr[1], "::ffff:"+addr[1]]
- else: IPAdresses += [addr[1]]
-
for I in x[1]["sshRSAHostKey"]:
- Line = "%s %s" %(",".join(HostNames + IPAdresses), I);
+ if mode and mode == 'authorized_keys':
+ #Line = 'command="rsync --server --sender -pr . /var/cache/userdir-ldap/hosts/%s",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,from="%s" %s' % (Host, ",".join(HNames + HostToIP(Host)), I)
+ Line = 'command="rsync --server --sender -pr . /var/cache/userdir-ldap/hosts/%s",no-port-forwarding,no-X11-forwarding,no-agent-forwarding %s' % (Host,I)
+ else:
+ Line = "%s %s" %(",".join(HostNames + HostToIP(Host)), I);
Line = Sanitize(Line) + "\n";
F.write(Line);
# Oops, something unspeakable happened.
GenPrivate(l,GlobalDir+"debian-private");
GenDisabledAccounts(l,GlobalDir+"disabled-accounts");
GenSSHKnown(l,GlobalDir+"ssh_known_hosts");
+#GenSSHKnown(l,GlobalDir+"authorized_keys", 'authorized_keys');
GenHosts(l,GlobalDir+"debianhosts");
GenMailDisable(l,GlobalDir+"mail-disable");
GenMailBool(l,GlobalDir+"mail-greylist","mailGreylisting");
userlist = GenPasswd(l,OutDir+"passwd",Split[1], "x");
sys.stdout.flush();
grouprevmap = GenGroup(l,OutDir+"group");
- if ExtraList.has_key("[UNTRUSTED]"):
- continue;
- if not ExtraList.has_key("[NOPASSWD]"):
- GenShadow(l,OutDir+"shadow");
# Now we know who we're allowing on the machine, export
# the relevant ssh keys
if MultipleSSHFiles:
+ OldMask = os.umask(0077);
tf = tarfile.open(name=os.path.join(GlobalDir, 'ssh-keys-%s.tar.gz' % CurrentHost), mode='w:gz')
+ os.umask(OldMask);
for f in userlist.keys():
if f not in SSHFiles:
continue
# In these cases, look it up in the normal way so we
# deal with cases where, for instance, users are in group
# users as their primary group.
- grname = grp.getgrgid(int(userlist[f]))[0]
+ grname = grp.getgrgid(userlist[f])[0]
except Exception, e:
pass
if grname is None:
- print "User %s is supposed to have their key exported to host %s but their primary group (gid: %s) isn't in LDAP" % (f, CurrentHost, userlist[f])
+ print "User %s is supposed to have their key exported to host %s but their primary group (gid: %d) isn't in LDAP" % (f, CurrentHost, userlist[f])
continue
to = tf.gettarinfo(os.path.join(GlobalDir, 'userkeys', f), f)
# to give a shit^W^W^Wcare about the UIDoffset stuff.
to.uname = f
to.gname = grname
- to.mode = 0600
+ to.mode = 0400
tf.addfile(to, file(os.path.join(GlobalDir, 'userkeys', f)))
tf.close()
os.rename(os.path.join(GlobalDir, 'ssh-keys-%s.tar.gz' % CurrentHost),
os.path.join(OutDir, 'ssh-keys.tar.gz'))
+ if ExtraList.has_key("[UNTRUSTED]"):
+ continue;
+ if not ExtraList.has_key("[NOPASSWD]"):
+ GenShadow(l,OutDir+"shadow");
+
# Link in global things
DoLink(GlobalDir,OutDir,"markers");
DoLink(GlobalDir,OutDir,"mail-forward.cdb");