X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=ud-generate;h=0a6e9818f182ad40d1beedc535af67045c7260ef;hb=1bd1a3c991bde81e15d751542676f76f104bd2f8;hp=fd0c53bc842d797bf6a84a9e318ed3b3de37b697;hpb=ce24a42e2c97dc6c463805413ff67f70463d0812;p=mirror%2Fuserdir-ldap.git diff --git a/ud-generate b/ud-generate index fd0c53b..0a6e981 100755 --- a/ud-generate +++ b/ud-generate @@ -6,7 +6,7 @@ # Copyright (c) 2003-2004 James Troup # Copyright (c) 2004-2005,7 Joey Schulze # Copyright (c) 2001-2007 Ryan Murray -# Copyright (c) 2008 Peter Palfrader +# Copyright (c) 2008,2009,2010 Peter Palfrader # Copyright (c) 2008 Andreas Barth # Copyright (c) 2008 Mark Hymers # Copyright (c) 2008 Luk Claes @@ -31,6 +31,7 @@ import string, re, time, ldap, getopt, sys, os, pwd, posix, socket, base64, sha, shutil, errno, tarfile, grp from userdir_ldap import * from userdir_exceptions import * +import UDLdap try: from cStringIO import StringIO except ImportError: @@ -39,6 +40,10 @@ except ImportError: global Allowed global CurrentHost +if os.getuid() == 0: + sys.stderr.write("You should probably not run ud-generate as root.\n") + sys.exit(1) + PasswdAttrs = None DebianUsers = None DisabledUsers = [] @@ -54,6 +59,7 @@ BSMTPCheck = re.compile(".*mx 0 (master)\.debian\.org\..*",re.DOTALL) PurposeHostField = re.compile(r".*\[\[([\*\-]?[a-z0-9.\-]*)(?:\|.*)?\]\]") IsV6Addr = re.compile("^[a-fA-F0-9:]+$") IsDebianHost = re.compile(ConfModule.dns_hostmatch) +isSSHFP = re.compile("^\s*IN\s+SSHFP") DNSZone = ".debian.net" Keyrings = ConfModule.sync_keyrings.split(":") @@ -343,6 +349,8 @@ def GenSSHShadow(): # Oops, something unspeakable happened. except IOError: Die(File, F, None) + # As neither masterFileName nor masterFile are defined at any point + # this will raise a NameError. Die(masterFileName, masterFile, None) raise @@ -401,7 +409,7 @@ def GenSSHtarballs(userlist, SSHFiles, grouprevmap, target): lines.append(line) if not lines: continue # no keys for this host - contents = "\n".join(lines) + contents = "\n".join(lines) + "\n" to.size = len(contents) tf.addfile(to, StringIO(contents)) @@ -539,7 +547,7 @@ def GenForward(File): raise Done(File, F, None) -def GenCDB(File, Users, Key): +def GenCDB(File, Users, key): Fdb = None try: OldMask = os.umask(0022) @@ -548,11 +556,11 @@ def GenCDB(File, Users, Key): # Write out the email address for each user for x in Users: - if not Key in x[1]: - continue - Value = GetAttr(x, Key) - User = GetAttr(x, "uid") - Fdb.write("+%d,%d:%s->%s\n" % (len(User), len(Value), User, Value)) + a = UDLdap.Account(x[0], x[1]) + if not key in a: continue + value = a[key] + user = a['uid'] + Fdb.write("+%d,%d:%s->%s\n" % (len(user), len(value), user, value)) Fdb.write("\n") # Oops, something unspeakable happened. @@ -573,10 +581,10 @@ def GenMarkers(File): # Write out the position for each user for x in PasswdAttrs: - if x[1].has_key("latitude") == 0 or x[1].has_key("longitude") == 0: - continue + a = UDLdap.Account(x[0], x[1]) + if not ('latitude' in a and 'longitude' in a): continue try: - Line = "%8s %8s \"\""%(DecDegree(GetAttr(x, "latitude"), 1), DecDegree(GetAttr(x, "longitude"), 1)) + Line = "%8s %8s \"\""%(a.latitude_dec(True), a.longitude_dec(True)) Line = Sanitize(Line) + "\n" F.write(Line) except: @@ -599,15 +607,11 @@ def GenPrivate(File): # Write out the position for each user for x in DebianDDUsers: - if x[1].has_key("privateSub") == 0: - continue - - # If the account has no PGP key, do not write it - if x[1].has_key("keyFingerPrint") == 0: - continue - + a = UDLdap.Account(x[0], x[1]) + if not a.is_active_user(): continue + if not 'privateSub' in a: continue try: - Line = "%s"%(GetAttr(x, "privateSub")) + Line = "%s"%(a['privateSub']) Line = Sanitize(Line) + "\n" F.write(Line) except: @@ -631,22 +635,12 @@ def GenDisabledAccounts(File): I = 0 for x in PasswdAttrs: - if x[1].has_key("uidNumber") == 0: - continue - - Pass = GetAttr(x, "userPassword") - Line = "" - # *LK* is the reference value for a locked account - # password starting with ! is also a locked account - if Pass.find("*LK*") != -1 or Pass.startswith("!"): - # Format is : - Line = "%s:%s" % (GetAttr(x, "uid"), "Account is locked") - DisabledUsers.append(x) - - if Line != "": - F.write(Sanitize(Line) + "\n") - - + a = UDLdap.Account(x[0], x[1]) + if a.pw_active(): continue + Line = "%s:%s" % (a['uid'], "Account is locked") + DisabledUsers.append(x) + F.write(Sanitize(Line) + "\n") + # Oops, something unspeakable happened. except: Die(File, F, None) @@ -663,19 +657,11 @@ def GenMailDisable(File): global PasswdAttrs for x in PasswdAttrs: - Reason = None - - if x[1].has_key("mailDisableMessage"): - Reason = GetAttr(x, "mailDisableMessage") - else: - continue - - try: - Line = "%s: %s"%(GetAttr(x, "uid"), Reason) - Line = Sanitize(Line) + "\n" - F.write(Line) - except: - pass + a = UDLdap.Account(x[0], x[1]) + if not 'mailDisableMessage' in a: continue + Line = "%s: %s"%(a['uid'], a['mailDisableMessage']) + Line = Sanitize(Line) + "\n" + F.write(Line) # Oops, something unspeakable happened. except: @@ -684,7 +670,7 @@ def GenMailDisable(File): Done(File, F, None) # Generate a list of uids that should have boolean affects applied -def GenMailBool(File, Key): +def GenMailBool(File, key): F = None try: F = open(File + ".tmp", "w") @@ -693,21 +679,13 @@ def GenMailBool(File, Key): global PasswdAttrs for x in PasswdAttrs: - Reason = None - - if x[1].has_key(Key) == 0: - continue - - if GetAttr(x, Key) != "TRUE": - continue - - try: - Line = "%s"%(GetAttr(x, "uid")) - Line = Sanitize(Line) + "\n" - F.write(Line) - except: - pass - + a = UDLdap.Account(x[0], x[1]) + if not key in a: continue + if not a[key] == 'TRUE': continue + Line = "%s"%(a['uid']) + Line = Sanitize(Line) + "\n" + F.write(Line) + # Oops, something unspeakable happened. except: Die(File, F, None) @@ -715,7 +693,7 @@ def GenMailBool(File, Key): Done(File, F, None) # Generate a list of hosts for RBL or whitelist purposes. -def GenMailList(File, Key): +def GenMailList(File, key): F = None try: F = open(File + ".tmp", "w") @@ -723,37 +701,20 @@ def GenMailList(File, Key): # Fetch all the users global PasswdAttrs + if key == "mailWhitelist": validregex = re.compile('^[-\w.]+(/[\d]+)?$') + else: validregex = re.compile('^[-\w.]+$') + for x in PasswdAttrs: - Reason = None - - if x[1].has_key(Key) == 0: - continue - - try: - found = 0 - Line = None - for z in x[1][Key]: - if Key == "mailWhitelist": - if re.match('^[-\w.]+(/[\d]+)?$', z) == None: - continue - else: - if re.match('^[-\w.]+$', z) == None: - continue - if found == 0: - found = 1 - Line = GetAttr(x, "uid") - else: - Line += " " - Line += ": " + z - if Key == "mailRHSBL": - Line += "/$sender_address_domain" - - if Line != None: - Line = Sanitize(Line) + "\n" - F.write(Line) - except: - pass - + a = UDLdap.Account(x[0], x[1]) + if not key in a: continue + + filtered = filter(lambda z: validregex.match(z), a[key]) + if len(filtered) == 0: continue + if key == "mailRHSBL": filtered = map(lambda z: z+"/$sender_address_domain", filtered) + line = a['uid'] + ': ' + ' : '.join(filtered) + line = Sanitize(line) + "\n" + F.write(line) + # Oops, something unspeakable happened. except: Die(File, F, None) @@ -776,29 +737,9 @@ def GenDNS(File): try: F = open(File + ".tmp", "w") -# global HostAttrs -# -# for x in HostAttrs: -# if x[1].has_key("hostname") == 0 or \ -# x[1].has_key("architecture") == 0 or\ -# x[1].has_key("sshRSAHostKey") == 0: -# continue -# -# if IsDebianHost.match(GetAttr(x, "hostname")) is not None: -# continue -# -# DNSInfo = ExtractDNSInfo(x) -# start = True -# for Line in DNSInfo: -# if start == True: -# Line = "%s.\t%s" % (GetAttr(x, "hostname"), Line) -# start = False -# else: -# Line = "\t\t\t%s" % (Line) -# F.write(Line + "\n") - # Fetch all the users global PasswdAttrs + RRs = {} # Write out the zone file entry for each user for x in PasswdAttrs: @@ -824,11 +765,13 @@ def GenDNS(File): F.write("; Has BSMTP\n") # Write some identification information - if Split[2].lower() == "a": - Line = "%s IN TXT \"%s\"\n"%(Split[0], EmailAddress(x)) - for y in x[1]["keyFingerPrint"]: - Line = Line + "%s IN TXT \"PGP %s\"\n"%(Split[0], FormatPGPKey(y)) - F.write(Line) + if not RRs.has_key(Host): + if Split[2].lower() in ["a", "aaaa"]: + Line = "%s IN TXT \"%s\"\n"%(Split[0], EmailAddress(x)) + for y in x[1]["keyFingerPrint"]: + Line = Line + "%s IN TXT \"PGP %s\"\n"%(Split[0], FormatPGPKey(y)) + F.write(Line) + RRs[Host] = 1 else: Line = "; Err %s"%(str(Split)) F.write(Line) @@ -912,6 +855,29 @@ def GenZoneRecords(File): F.write(Line + "\n") + # this would write sshfp lines for services on machines + # but we can't yet, since some are cnames and we'll make + # an invalid zonefile + # + # for i in x[1].get("purpose", []): + # m = PurposeHostField.match(i) + # if m: + # m = m.group(1) + # # we ignore [[*..]] entries + # if m.startswith('*'): + # continue + # if m.startswith('-'): + # m = m[1:] + # if m: + # if not m.endswith(HostDomain): + # continue + # if not m.endswith('.'): + # m = m + "." + # for Line in DNSInfo: + # if isSSHFP.match(Line): + # Line = "%s\t%s" % (m, Line) + # F.write(Line + "\n") + # Oops, something unspeakable happened. except: Die(File, F, None) @@ -1015,7 +981,6 @@ def GenSSHKnown(File, mode=None): if 'sshdistAuthKeysHost' in x[1]: hosts += x[1]['sshdistAuthKeysHost'] Line = 'command="rsync --server --sender -pr . /var/cache/userdir-ldap/hosts/%s",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,from="%s" %s' % (Host, ",".join(hosts), I) - #Line = 'command="rsync --server --sender -pr . /var/cache/userdir-ldap/hosts/%s",no-port-forwarding,no-X11-forwarding,no-agent-forwarding %s' % (Host,I) else: Line = "%s %s" %(",".join(HostNames + HostToIP(x, False)), I) Line = Sanitize(Line) + "\n" @@ -1065,9 +1030,14 @@ def GenKeyrings(OutDir): # Connect to the ldap server l = connectLDAP() -F = open(PassDir + "/pass-" + pwd.getpwuid(os.getuid())[0], "r") -Pass = F.readline().strip().split(" ") -F.close() +# for testing purposes it's sometimes useful to pass username/password +# via the environment +if 'UD_CREDENTIALS' in os.environ: + Pass = os.environ['UD_CREDENTIALS'].split() +else: + F = open(PassDir + "/pass-" + pwd.getpwuid(os.getuid())[0], "r") + Pass = F.readline().strip().split(" ") + F.close() l.simple_bind_s("uid=" + Pass[0] + "," + BaseDn, Pass[1]) # Fetch all the groups @@ -1086,7 +1056,7 @@ for x in Attrs: SubGroupMap.setdefault(x[1]["gid"][0], []).extend(x[1]["subGroup"]) # Fetch all the users -PasswdAttrs = l.search_s(BaseDn, ldap.SCOPE_ONELEVEL, "uid=*",\ +PasswdAttrs = l.search_s(BaseDn, ldap.SCOPE_ONELEVEL, "(&(uid=*)(!(uidNumber=0)))",\ ["uid", "uidNumber", "gidNumber", "supplementaryGid",\ "gecos", "loginShell", "userPassword", "shadowLastChange",\ "shadowMin", "shadowMax", "shadowWarning", "shadowInactive", @@ -1112,6 +1082,10 @@ if HostAttrs == None: HostAttrs.sort(lambda x, y: cmp((GetAttr(x, "hostname")).lower(), (GetAttr(y, "hostname")).lower())) +# override globaldir for testing +if 'UD_GENERATEDIR' in os.environ: + GenerateDir = os.environ['UD_GENERATEDIR'] + # Generate global things GlobalDir = GenerateDir + "/" GenDisabledAccounts(GlobalDir + "disabled-accounts")