X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=ud-generate;h=6be531dd746e700dcf2ab758b08004ffdca7fe35;hb=566b90f55eb6ebbede83ae9ac8ed6d466bc19ec3;hp=27c1565fb3c3ab2ad954013bbd0d1e84b4a40faf;hpb=55004c1aa2b0c0e1dde3014f9b2535904e57adc4;p=mirror%2Fuserdir-ldap.git diff --git a/ud-generate b/ud-generate index 27c1565..6be531d 100755 --- a/ud-generate +++ b/ud-generate @@ -2,41 +2,74 @@ # -*- mode: python -*- # Generates passwd, shadow and group files from the ldap directory. -import string, re, time, ldap, getopt, sys, os, posix, pwd; +# Copyright (c) 2000-2001 Jason Gunthorpe +# Copyright (c) 2001-2003 Ryan Murray +# Copyright (c) 2003-2004 James Troup +# Copyright (c) 2004-2005 Joey Schulze +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + +import string, re, time, ldap, getopt, sys, os, pwd, posix, socket; from userdir_ldap import *; +global Allowed; +global CurrentHost; + PasswdAttrs = None; GroupIDMap = {}; Allowed = None; CurrentHost = ""; +EmailCheck = re.compile("^([^ <>@]+@[^ ,<>@]+)?$"); +BSMTPCheck = re.compile(".*mx 0 (klecker|gluck)\.debian\.org\..*",re.DOTALL); +DNSZone = ".debian.net" + +def Sanitize(Str): + return string.translate(Str,string.maketrans("\n\r\t","$$$")); + +def DoLink(From,To,File): + try: posix.remove(To+File); + except: pass; + posix.link(From+File,To+File); + # See if this user is in the group list def IsInGroup(DnRecord): - global Allowed,CurrentHost; if Allowed == None: return 1; # See if the primary group is in the list - if Allowed.has_key(GetAttr(DnRecord,"gidnumber")) != 0: + if Allowed.has_key(GetAttr(DnRecord,"gidNumber")) != 0: return 1; # Check the host based ACL - if DnRecord[1].has_key("allowedhosts") != 0: - for I in DnRecord[1]["allowedhosts"]: + if DnRecord[1].has_key("allowedHost") != 0: + for I in DnRecord[1]["allowedHost"]: if CurrentHost == I: return 1; # See if there are supplementary groups - if DnRecord[1].has_key("supplementarygid") == 0: + if DnRecord[1].has_key("supplementaryGid") == 0: return 0; # Check the supplementary groups - for I in DnRecord[1]["supplementarygid"]: + for I in DnRecord[1]["supplementaryGid"]: if Allowed.has_key(I): return 1; return 0; -def Die(F,Fdb): +def Die(File,F,Fdb): if F != None: F.close(); if Fdb != None: @@ -57,10 +90,8 @@ def Done(File,F,Fdb): # Generate the password list def GenPasswd(l,File,HomePrefix): F = None; - Fdb = None; try: - F = open(File + ".tmp","w"); - Fdb = open(File + ".tdb.tmp","w"); + F = open(File + ".tdb.tmp","w"); # Fetch all the users global PasswdAttrs; @@ -69,33 +100,36 @@ def GenPasswd(l,File,HomePrefix): I = 0; for x in PasswdAttrs: - if x[1].has_key("uidnumber") == 0 or IsInGroup(x) == 0: + if x[1].has_key("uidNumber") == 0 or IsInGroup(x) == 0: continue; - - Line = "%s:x:%s:%s:%s:%s%s:%s\n" % (GetAttr(x,"uid"),\ - GetAttr(x,"uidnumber"),GetAttr(x,"gidnumber"),\ + + # Do not let people try to buffer overflow some busted passwd parser. + if len(GetAttr(x,"gecos")) > 100 or len(GetAttr(x,"loginShell")) > 50: + continue; + + Line = "%s:x:%s:%s:%s:%s%s:%s" % (GetAttr(x,"uid"),\ + GetAttr(x,"uidNumber"),GetAttr(x,"gidNumber"),\ GetAttr(x,"gecos"),HomePrefix,GetAttr(x,"uid"),\ - GetAttr(x,"loginshell")); - F.write(Line); - Fdb.write("0%u %s" % (I,Line)); - Fdb.write(".%s %s" % (GetAttr(x,"uid"),Line)); - Fdb.write("=%s %s" % (GetAttr(x,"uidnumber"),Line)); + GetAttr(x,"loginShell")); + + Line = Sanitize(Line) + "\n"; + F.write("0%u %s" % (I,Line)); + F.write(".%s %s" % (GetAttr(x,"uid"),Line)); + F.write("=%s %s" % (GetAttr(x,"uidNumber"),Line)); I = I + 1; # Oops, something unspeakable happened. except: - Die(F,Fdb); + Die(File,None,F); raise; - Done(File,F,Fdb); + Done(File,None,F); # Generate the shadow list def GenShadow(l,File): F = None; - Fdb = None; try: OldMask = os.umask(0077); - F = open(File + ".tmp","w",0600); - Fdb = open(File + ".tdb.tmp","w",0600); + F = open(File + ".tdb.tmp","w",0600); os.umask(OldMask); # Fetch all the users @@ -105,37 +139,69 @@ def GenShadow(l,File): I = 0; for x in PasswdAttrs: - if x[1].has_key("uidnumber") == 0 or IsInGroup(x) == 0: + if x[1].has_key("uidNumber") == 0 or IsInGroup(x) == 0: continue; - Pass = GetAttr(x,"userpassword"); - if Pass[0:7] != "{crypt}": + Pass = GetAttr(x,"userPassword"); + if Pass[0:7] != "{crypt}" or len(Pass) > 50: Pass = '*'; else: Pass = Pass[7:]; - Line = "%s:%s:%s:%s:%s:%s:%s:%s:\n" % (GetAttr(x,"uid"),\ - Pass,GetAttr(x,"shadowlastchange"),\ - GetAttr(x,"shadowmin"),GetAttr(x,"shadowmax"),\ - GetAttr(x,"shadowwarning"),GetAttr(x,"shadowinactive"),\ + Line = "%s:%s:%s:%s:%s:%s:%s:%s:" % (GetAttr(x,"uid"),\ + Pass,GetAttr(x,"shadowLastChange"),\ + GetAttr(x,"shadowMin"),GetAttr(x,"shadowMax"),\ + GetAttr(x,"shadowWarning"),GetAttr(x,"shadowinactive"),\ GetAttr(x,"shadowexpire")); - F.write(Line); - Fdb.write("0%u %s" % (I,Line)); - Fdb.write(".%s %s" % (GetAttr(x,"uid"),Line)); + Line = Sanitize(Line) + "\n"; + F.write("0%u %s" % (I,Line)); + F.write(".%s %s" % (GetAttr(x,"uid"),Line)); I = I + 1; # Oops, something unspeakable happened. except: - Die(F,Fdb); + Die(File,None,F); raise; - Done(File,F,Fdb); + Done(File,None,F); + +# Generate the shadow list +def GenSSHShadow(l,File): + F = None; + try: + OldMask = os.umask(0077); + F = open(File + ".tmp","w",0600); + os.umask(OldMask); + + # Fetch all the users + global PasswdAttrs; + if PasswdAttrs == None: + raise "No Users"; + + for x in PasswdAttrs: + # If the account is locked, do not write it. + # This is a partial stop-gap. The ssh also needs to change this + # to ignore ~/.ssh/authorized* files. + if (string.find(GetAttr(x,"userPassword"),"*LK*") != -1): + continue; + + if x[1].has_key("uidNumber") == 0 or \ + x[1].has_key("sshRSAAuthKey") == 0: + continue; + for I in x[1]["sshRSAAuthKey"]: + User = GetAttr(x,"uid"); + Line = "%s: %s" %(User,I); + Line = Sanitize(Line) + "\n"; + F.write(Line); + # Oops, something unspeakable happened. + except: + Die(File,F,None); + raise; + Done(File,F,None); # Generate the group list def GenGroup(l,File): F = None; - Fdb = None; try: - F = open(File + ".tmp","w"); - Fdb = open(File + ".tdb.tmp","w"); + F = open(File + ".tdb.tmp","w"); # Generate the GroupMap GroupMap = {}; @@ -149,37 +215,38 @@ def GenGroup(l,File): # Sort them into a list of groups having a set of users for x in PasswdAttrs: - if x[1].has_key("uidnumber") == 0 or IsInGroup(x) == 0: + if x[1].has_key("uidNumber") == 0 or IsInGroup(x) == 0: continue; - if x[1].has_key("supplementarygid") == 0: + if x[1].has_key("supplementaryGid") == 0: continue; - for I in x[1]["supplementarygid"]: + for I in x[1]["supplementaryGid"]: if GroupMap.has_key(I): GroupMap[I].append(GetAttr(x,"uid")); else: print "Group does not exist ",I,"but",GetAttr(x,"uid"),"is in it"; # Output the group file. - Counter = 0; + J = 0; for x in GroupMap.keys(): + if GroupIDMap.has_key(x) == 0: + continue; Line = "%s:x:%u:" % (x,GroupIDMap[x]); Comma = ''; for I in GroupMap[x]: Line = Line + ("%s%s" % (Comma,I)); Comma = ','; - Line = Line + '\n'; - F.write(Line); - Fdb.write("0%u %s" % (Counter,Line)); - Fdb.write(".%s %s" % (x,Line)); - Fdb.write("=%u %s" % (GroupIDMap[x],Line)); - Counter = Counter + 1; + Line = Sanitize(Line) + "\n"; + F.write("0%u %s" % (J,Line)); + F.write(".%s %s" % (x,Line)); + F.write("=%u %s" % (GroupIDMap[x],Line)); + J = J + 1; # Oops, something unspeakable happened. except: - Die(F,Fdb); + Die(File,None,F); raise; - Done(File,F,Fdb); + Done(File,None,F); # Generate the email forwarding list def GenForward(l,File): @@ -188,7 +255,6 @@ def GenForward(l,File): try: OldMask = os.umask(0022); F = open(File + ".tmp","w",0644); - Fdb = None; os.umask(OldMask); # Fetch all the users @@ -198,17 +264,62 @@ def GenForward(l,File): # Write out the email address for each user for x in PasswdAttrs: - if x[1].has_key("emailforward") == 0 or IsInGroup(x) == 0: + if x[1].has_key("emailForward") == 0 or IsInGroup(x) == 0: continue; - Line = "%s: %s\n" % (GetAttr(x,"uid"),GetAttr(x,"emailforward")); + + # Do not allow people to try to buffer overflow busted parsers + if len(GetAttr(x,"emailForward")) > 200: + continue; + + # Check the forwarding address + if EmailCheck.match(GetAttr(x,"emailForward")) == None: + continue; + Line = "%s: %s" % (GetAttr(x,"uid"),GetAttr(x,"emailForward")); + Line = Sanitize(Line) + "\n"; F.write(Line); # Oops, something unspeakable happened. except: - Die(F,Fdb); + Die(File,F,Fdb); raise; Done(File,F,Fdb); +def GenAllForward(l,File): + Fdb = None; + try: + OldMask = os.umask(0022); + Fdb = os.popen("cdbmake %s %s.tmp"%(File,File),"w"); + os.umask(OldMask); + + # Fetch all the users + global PasswdAttrs; + if PasswdAttrs == None: + raise "No Users"; + + # Write out the email address for each user + for x in PasswdAttrs: + if x[1].has_key("emailForward") == 0: + continue; + + # Do not allow people to try to buffer overflow busted parsers + Forward = GetAttr(x,"emailForward"); + if len(Forward) > 200: + continue; + + # Check the forwarding address + if EmailCheck.match(Forward) == None: + continue; + + User = GetAttr(x,"uid"); + Fdb.write("+%d,%d:%s->%s\n"%(len(User),len(Forward),User,Forward)); + Fdb.write("\n"); + # Oops, something unspeakable happened. + except: + Fdb.close(); + raise; + if Fdb.close() != None: + raise "cdbmake gave an error"; + # Generate the anon XEarth marker file def GenMarkers(l,File): F = None; @@ -222,24 +333,194 @@ def GenMarkers(l,File): if PasswdAttrs == None: raise "No Users"; - # Write out the email address for each user + # Write out the position for each user for x in PasswdAttrs: if x[1].has_key("latitude") == 0 or x[1].has_key("longitude") == 0: continue; try: - F.write("%8s %8s \"\"\n"%(DecDegree(x,"latitude",1),DecDegree(x,"longitude",1))); + Line = "%8s %8s \"\""%(DecDegree(GetAttr(x,"latitude"),1),DecDegree(GetAttr(x,"longitude"),1)); + Line = Sanitize(Line) + "\n"; + F.write(Line); except: pass; # Oops, something unspeakable happened. except: - Die(F,Fdb); + Die(File,F,Fdb); raise; Done(File,F,Fdb); - + +# Generate the debian-private subscription list +def GenPrivate(l,File): + F = None; + Fdb = None; + try: + F = open(File + ".tmp","w"); + Fdb = None; + + # Fetch all the users + global PasswdAttrs; + if PasswdAttrs == None: + raise "No Users"; + + # Write out the position for each user + for x in PasswdAttrs: + if x[1].has_key("privateSub") == 0: + continue; + + # If the account is locked, do not write it + if (string.find(GetAttr(x,"userPassword"),"*LK*") != -1): + continue; + + # If the account has no PGP key, do not write it + if x[1].has_key("keyFingerPrint") == 0: + continue; + + # Must be in the Debian group (yuk, hard coded for now) + if GetAttr(x,"gidNumber") != "800": + continue; + + try: + Line = "%s"%(GetAttr(x,"privateSub")); + Line = Sanitize(Line) + "\n"; + F.write(Line); + except: + pass; + + # Oops, something unspeakable happened. + except: + Die(File,F,Fdb); + raise; + Done(File,F,Fdb); + +# Generate the DNS Zone file +def GenDNS(l,File,HomePrefix): + F = None; + try: + F = open(File + ".tmp","w"); + + # Fetch all the users + global PasswdAttrs; + if PasswdAttrs == None: + raise "No Users"; + + # Write out the zone file entry for each user + for x in PasswdAttrs: + if x[1].has_key("dnsZoneEntry") == 0: + continue; + try: + F.write("; %s\n"%(EmailAddress(x))); + for z in x[1]["dnsZoneEntry"]: + Split = string.split(string.lower(z)); + if string.lower(Split[1]) == 'in': + for y in range(0,len(Split)): + if Split[y] == "$": + Split[y] = "\n\t"; + Line = string.join(Split," ") + "\n"; + F.write(Line); + + Host = Split[0] + DNSZone; + if BSMTPCheck.match(Line) != None: + F.write("; Has BSMTP\n"); + + # Write some identification information + if string.lower(Split[2]) == "a": + Line = "%s IN TXT \"%s\"\n"%(Split[0],EmailAddress(x)); + for y in x[1]["keyFingerPrint"]: + Line = Line + "%s IN TXT \"PGP %s\"\n"%(Split[0],FormatPGPKey(y)); + F.write(Line); + else: + Line = "; Err %s"%(str(Split)); + F.write(Line); + + F.write("\n"); + except: + F.write("; Errors\n"); + pass; + + # Oops, something unspeakable happened. + except: + Die(File,F,None); + raise; + Done(File,F,None); + +# Generate the BSMTP file +def GenBSMTP(l,File,HomePrefix): + F = None; + try: + F = open(File + ".tmp","w"); + + # Fetch all the users + global PasswdAttrs; + if PasswdAttrs == None: + raise "No Users"; + + # Write out the zone file entry for each user + for x in PasswdAttrs: + if x[1].has_key("dnsZoneEntry") == 0: + continue; + try: + for z in x[1]["dnsZoneEntry"]: + Split = string.split(string.lower(z)); + if string.lower(Split[1]) == 'in': + for y in range(0,len(Split)): + if Split[y] == "$": + Split[y] = "\n\t"; + Line = string.join(Split," ") + "\n"; + + Host = Split[0] + DNSZone; + if BSMTPCheck.match(Line) != None: + F.write("%s: user=%s group=Debian file=%s%s/bsmtp/%s\n"%(Host, + GetAttr(x,"uid"),HomePrefix,GetAttr(x,"uid"),Host)); + + except: + F.write("; Errors\n"); + pass; + + # Oops, something unspeakable happened. + except: + Die(File,F,None); + raise; + Done(File,F,None); + +# Generate the shadow list +def GenSSHKnown(l,File): + F = None; + try: + OldMask = os.umask(0022); + F = open(File + ".tmp","w",0644); + os.umask(OldMask); + + # Fetch all the hosts + HostKeys = l.search_s(HostBaseDn,ldap.SCOPE_ONELEVEL,"sshRSAHostKey=*",\ + ["hostname","sshRSAHostKey"]); + + if HostKeys == None: + raise "No Hosts"; + + for x in HostKeys: + if x[1].has_key("hostname") == 0 or \ + x[1].has_key("sshRSAHostKey") == 0: + continue; + Host = GetAttr(x,"hostname"); + SHost = string.find(Host,"."); + for I in x[1]["sshRSAHostKey"]: + if SHost == None: + Line = "%s,%s %s" %(Host,socket.gethostbyname(Host),I); + else: + Line = "%s,%s,%s %s" %(Host,Host[0:SHost],socket.gethostbyname(Host),I); + Line = Sanitize(Line) + "\n"; + F.write(Line); + # Oops, something unspeakable happened. + except: + Die(File,F,None); + raise; + Done(File,F,None); + + # Connect to the ldap server l = ldap.open(LDAPServer); -F = open(PassDir+"/pass-"+pwd.getpwuid(posix.getuid())[0],"r"); +F = open(PassDir+"/pass-"+pwd.getpwuid(os.getuid())[0],"r"); Pass = string.split(string.strip(F.readline())," "); F.close(); l.simple_bind_s("uid="+Pass[0]+","+BaseDn,Pass[1]); @@ -247,27 +528,40 @@ l.simple_bind_s("uid="+Pass[0]+","+BaseDn,Pass[1]); # Fetch all the groups GroupIDMap = {}; Attrs = l.search_s(BaseDn,ldap.SCOPE_ONELEVEL,"gid=*",\ - ["gid","gidnumber"]); + ["gid","gidNumber"]); # Generate the GroupMap and GroupIDMap for x in Attrs: - if x[1].has_key("gidnumber") == 0: + if x[1].has_key("gidNumber") == 0: continue; - GroupIDMap[x[1]["gid"][0]] = int(x[1]["gidnumber"][0]); + GroupIDMap[x[1]["gid"][0]] = int(x[1]["gidNumber"][0]); # Fetch all the users PasswdAttrs = l.search_s(BaseDn,ldap.SCOPE_ONELEVEL,"uid=*",\ - ["uid","uidnumber","gidnumber","supplementarygid",\ - "gecos","loginshell","userpassword","shadowlastchange",\ - "shadowmin","shadowmax","shadowwarning","shadowinactive", - "shadowexpire","emailforward","latitude","longitude",\ - "allowedhosts"]); + ["uid","uidNumber","gidNumber","supplementaryGid",\ + "gecos","loginShell","userPassword","shadowLastChange",\ + "shadowMin","shadowMax","shadowWarning","shadowinactive", + "shadowexpire","emailForward","latitude","longitude",\ + "allowedHost","sshRSAAuthKey","dnsZoneEntry","cn","sn",\ + "keyFingerPrint","privateSub"]); # Open the control file if len(sys.argv) == 1: F = open(GenerateConf,"r"); else: F = open(sys.argv[1],"r") + +# Generate global things +GlobalDir = GenerateDir+"/"; +GenSSHShadow(l,GlobalDir+"ssh-rsa-shadow"); +GenAllForward(l,GlobalDir+"mail-forward.cdb"); +GenMarkers(l,GlobalDir+"markers"); +GenPrivate(l,GlobalDir+"debian-private"); +GenSSHKnown(l,GlobalDir+"ssh_known_hosts"); + +# Compatibility. +GenForward(l,GlobalDir+"forward-alias"); + while(1): Line = F.readline(); if Line == "": @@ -285,18 +579,43 @@ while(1): # Get the group list and convert any named groups to numerics GroupList = {}; + ExtraList = {}; for I in Split[2:]: + if I[0] == '[': + ExtraList[I] = None; + continue; GroupList[I] = None; if GroupIDMap.has_key(I): GroupList[str(GroupIDMap[I])] = None; - global Allowed,CurrentHost; Allowed = GroupList; + if Allowed == {}: + Allowed = None CurrentHost = Split[0]; + sys.stdout.flush(); GenPasswd(l,OutDir+"passwd",Split[1]); + sys.stdout.flush(); GenGroup(l,OutDir+"group"); + if ExtraList.has_key("[UNTRUSTED]"): + continue; GenShadow(l,OutDir+"shadow"); - GenForward(l,OutDir+"forward-alias"); - GenMarkers(l,OutDir+"markers"); + + # Link in global things + DoLink(GlobalDir,OutDir,"ssh-rsa-shadow"); + DoLink(GlobalDir,OutDir,"markers"); + DoLink(GlobalDir,OutDir,"mail-forward.cdb"); + DoLink(GlobalDir,OutDir,"ssh_known_hosts"); + + # Compatibility. + DoLink(GlobalDir,OutDir,"forward-alias"); + + if ExtraList.has_key("[DNS]"): + GenDNS(l,OutDir+"dns-zone",Split[1]); + + if ExtraList.has_key("[BSMTP]"): + GenBSMTP(l,OutDir+"bsmtp",Split[1]); + + if ExtraList.has_key("[PRIVATE]"): + DoLink(GlobalDir,OutDir,"debian-private");