X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=ud-generate;h=10a124d257018716522c5464dc889e64f73bd056;hb=25dbd296540b9f652ababe6c5fdb0a7cf7b4c197;hp=8a4588c76f78f126cd400f441deac51783771de7;hpb=438086d0c6f7a393820a6bf4a0fcd6a98cc40cbf;p=mirror%2Fuserdir-ldap.git

diff --git a/ud-generate b/ud-generate
index 8a4588c..10a124d 100755
--- a/ud-generate
+++ b/ud-generate
@@ -7,6 +7,7 @@
 #   Copyright (c) 2004-2005,7  Joey Schulze <joey@infodrom.org>
 #   Copyright (c) 2001-2007  Ryan Murray <rmurray@debian.org>
 #   Copyright (c) 2008 Peter Palfrader <peter@palfrader.org>
+#   Copyright (c) 2008 Andreas Barth <aba@not.so.argh.org>
 #   Copyright (c) 2008 Mark Hymers <mhy@debian.org>
 #
 #   This program is free software; you can redistribute it and/or modify
@@ -37,8 +38,7 @@ CurrentHost = "";
 EmailCheck = re.compile("^([^ <>@]+@[^ ,<>@]+)?$");
 BSMTPCheck = re.compile(".*mx 0 (gluck)\.debian\.org\..*",re.DOTALL);
 DNSZone = ".debian.net"
-Keyrings = [ "/org/keyring.debian.org/keyrings/debian-keyring.gpg",
-             "/org/keyring.debian.org/keyrings/debian-keyring.pgp" ]
+Keyrings = ConfModule.sync_keyrings.split(":")
 
 def safe_makedirs(dir):
     try:
@@ -130,7 +130,7 @@ def GenPasswd(l,File,HomePrefix,PwdMarker):
       if len(GetAttr(x,"gecos")) > 100 or len(GetAttr(x,"loginShell")) > 50:
          continue;
 
-      userlist[GetAttr(x, "uid")] = GetAttr(x, "gidNumber")
+      userlist[GetAttr(x, "uid")] = int(GetAttr(x, "gidNumber"))
       Line = "%s:%s:%s:%s:%s:%s%s:%s" % (GetAttr(x,"uid"),\
               PwdMarker,\
               GetAttr(x,"uidNumber"),GetAttr(x,"gidNumber"),\
@@ -767,8 +767,26 @@ def GenBSMTP(l,File,HomePrefix):
    raise;
   Done(File,F,None);
 
+# cache IP adresses
+HostToIPCache = {}
+def HostToIP(Host):
+    global HostToIPCache
+    if not Host in HostToIPCache:
+        IPAdressesT = None
+        try:
+            IPAdressesT = list(set([ (a[0],a[4][0]) for a in socket.getaddrinfo(Host, None)]))
+        except socket.gaierror, (code):
+            if code[0] != -2: raise
+        IPAdresses = []
+        for addr in IPAdressesT:
+            if addr[0] == socket.AF_INET: IPAdresses += [addr[1], "::ffff:"+addr[1]]
+            else: IPAdresses += [addr[1]]
+        HostToIPCache[Host] = IPAdresses
+    return HostToIPCache[Host]
+
+
 # Generate the ssh known hosts file
-def GenSSHKnown(l,File):
+def GenSSHKnown(l,File,mode=None):
   F = None;
   try:
    OldMask = os.umask(0022);
@@ -788,19 +806,12 @@ def GenSSHKnown(l,File):
       SHost = Host.find(".")
       if SHost != None: HostNames += [Host[0:SHost]]
 
-      IPAdressesT = None
-      IPAdresses = []
-      # get IP adresses back as "proto adress" to distinguish between v4 and v6
-      try:
-         IPAdressesT = set([ (a[0],a[4][0]) for a in socket.getaddrinfo(Host, None)])
-      except:
-         if code[0] != -2: raise
-      for addr in IPAdressesT:
-         if addr[0] == socket.AF_INET: IPAdresses += [addr[1], "::ffff:"+addr[1]]
-	 else: IPAdresses += [addr[1]]
-
       for I in x[1]["sshRSAHostKey"]:
-         Line = "%s %s" %(",".join(HostNames + IPAdresses), I);
+         if mode and mode == 'authorized_keys':
+            #Line = 'command="rsync --server --sender -pr . /var/cache/userdir-ldap/hosts/%s",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,from="%s" %s' % (Host, ",".join(HNames + HostToIP(Host)), I)
+            Line = 'command="rsync --server --sender -pr . /var/cache/userdir-ldap/hosts/%s",no-port-forwarding,no-X11-forwarding,no-agent-forwarding %s' % (Host,I)
+         else:
+            Line = "%s %s" %(",".join(HostNames + HostToIP(Host)), I);
          Line = Sanitize(Line) + "\n";
          F.write(Line);
   # Oops, something unspeakable happened.
@@ -889,6 +900,7 @@ GenMarkers(l,GlobalDir+"markers");
 GenPrivate(l,GlobalDir+"debian-private");
 GenDisabledAccounts(l,GlobalDir+"disabled-accounts");
 GenSSHKnown(l,GlobalDir+"ssh_known_hosts");
+#GenSSHKnown(l,GlobalDir+"authorized_keys", 'authorized_keys');
 GenHosts(l,GlobalDir+"debianhosts");
 GenMailDisable(l,GlobalDir+"mail-disable");
 GenMailBool(l,GlobalDir+"mail-greylist","mailGreylisting");
@@ -955,7 +967,9 @@ while(1):
    # Now we know who we're allowing on the machine, export
    # the relevant ssh keys
    if MultipleSSHFiles:
+      OldMask = os.umask(0077);
       tf = tarfile.open(name=os.path.join(GlobalDir, 'ssh-keys-%s.tar.gz' % CurrentHost), mode='w:gz')
+      os.umask(OldMask);
       for f in userlist.keys():
         if f not in SSHFiles:
             continue
@@ -970,12 +984,12 @@ while(1):
                     # In these cases, look it up in the normal way so we
                     # deal with cases where, for instance, users are in group
                     # users as their primary group.
-                    grname = grp.getgrgid(int(userlist[f]))[0]
+                    grname = grp.getgrgid(userlist[f])[0]
             except Exception, e:
                 pass
 
         if grname is None:
-            print "User %s is supposed to have their key exported to host %s but their primary group (gid: %s) isn't in LDAP" % (f, CurrentHost, userlist[f])
+            print "User %s is supposed to have their key exported to host %s but their primary group (gid: %d) isn't in LDAP" % (f, CurrentHost, userlist[f])
             continue
 
         to = tf.gettarinfo(os.path.join(GlobalDir, 'userkeys', f), f)