X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=ud-mailgate;h=a3a21a829d8a95fd68c1f6ef5cfd146625449578;hb=00994f78b1ff7fcd9481a3fd1559f1a77157adbb;hp=c01513c1b3c95b611253c8f05d3c6ffe20faf1c0;hpb=4767c94f71bc35ba279bc53ae0649702e940eb38;p=mirror%2Fuserdir-ldap.git diff --git a/ud-mailgate b/ud-mailgate index c01513c..a3a21a8 100755 --- a/ud-mailgate +++ b/ud-mailgate @@ -7,8 +7,6 @@ import userdir_gpg, userdir_ldap, sys, traceback, time, ldap, os, commands import pwd, tempfile -import hmac -import sha as sha1_module from userdir_gpg import * from userdir_ldap import * @@ -84,7 +82,6 @@ DelItems = {"c": None, "jpegPhoto": None, "dnsZoneEntry": None, "sshRSAAuthKey": None, - "sshDSAAuthKey": None, "birthDate" : None, "mailGreylisting": None, "mailCallout": None, @@ -95,14 +92,6 @@ DelItems = {"c": None, "VoIP": None, }; -def make_hmac(str): - F = open(PassDir+"/key-hmac-"+pwd.getpwuid(os.getuid())[0],"r"); - key = F.readline().strip() - F.close(); - - return hmac.new(key, str, sha1_module).hexdigest() - - # Decode a GPS location from some common forms def LocDecode(Str,Dir): @@ -463,7 +452,7 @@ def DoRBL(Str,Attrs): # Handle a ConfirmSudoPassword request def DoConfirmSudopassword(Str): - Match = re.compile('^confirm sudopassword ('+UUID_FORMAT+') ([a-z0-9,*]+) ([0-9a-f]{40})$').match(Str.lower()) + Match = re.compile('^confirm sudopassword ('+UUID_FORMAT+') ([a-z0-9.,*]+) ([0-9a-f]{40})$').match(Str) if Match == None: return None @@ -489,7 +478,7 @@ def FinishConfirmSudopassword(l, uid, Attrs): newldap = [] for entry in inldap: - Match = re.compile('^('+UUID_FORMAT+') (confirmed|unconfirmed) ([a-z0-9,*]+) ([^ ]+)$').match(entry.lower()) + Match = re.compile('^('+UUID_FORMAT+') (confirmed:[0-9a-f]{40}|unconfirmed) ([a-z0-9.,*]+) ([^ ]+)$').match(entry) if Match == None: raise Error, "Could not parse existing sudopasswd entry" uuid = Match.group(1) @@ -500,13 +489,16 @@ def FinishConfirmSudopassword(l, uid, Attrs): if SudoPasswd.has_key(uuid): confirmedHosts = SudoPasswd[uuid][0] confirmedHmac = SudoPasswd[uuid][1] - if status == "confirmed": - result = result + "Entry %s for sudo password on hosts %s already confirmed.\n"%(uuid, hosts) + if status.startswith('confirmed:'): + if status == 'confirmed:'+make_passwd_hmac('password-is-confirmed', 'sudo', uid, uuid, hosts, cryptedpass): + result = result + "Entry %s for sudo password on hosts %s already confirmed.\n"%(uuid, hosts) + else: + result = result + "Entry %s for sudo password on hosts %s is listed as confirmed, but HMAC does not verify.\n"%(uuid, hosts) elif confirmedHosts != hosts: result = result + "Entry %s hostlist mismatch (%s vs. %s).\n"%(uuid, hosts, confirmedHosts) - elif make_hmac(':'.join([uuid, hosts, cryptedpass])) == confirmedHmac: + elif make_passwd_hmac('confirm-new-password', 'sudo', uid, uuid, hosts, cryptedpass) == confirmedHmac: result = result + "Entry %s for sudo password on hosts %s now confirmed.\n"%(uuid, hosts) - status = 'confirmed' + status = 'confirmed:'+make_passwd_hmac('password-is-confirmed', 'sudo', uid, uuid, hosts, cryptedpass) else: result = result + "Entry %s for sudo password on hosts %s HMAC verify failed.\n"%(uuid, hosts) del SudoPasswd[uuid] @@ -573,15 +565,18 @@ def HandleChange(Reply,DnRecord,Key): if ((GetAttr(oldAttrs[0],"userPassword").find("*LK*") != -1) or GetAttr(oldAttrs[0],"userPassword").startswith("!")): raise Error, "This account is locked"; - try: - Res = FinishConfirmSudopassword(l, GetAttr(DnRecord,"uid"), Attrs) - Result = Result + Res + "\n"; - except Error, e: - CommitChanges = 0 - Result = Result + "FinishConfirmSudopassword raised an error (%s) - no changes committed\n"%(e); + + if CommitChanges == 1: # only if we are still good to go + try: + Res = FinishConfirmSudopassword(l, GetAttr(DnRecord,"uid"), Attrs) + Result = Result + Res + "\n"; + except Error, e: + CommitChanges = 0 + Result = Result + "FinishConfirmSudopassword raised an error (%s) - no changes committed\n"%(e); + # Modify the record - Dn = "uid=" + GetAttr(DnRecord,"uid") + "," + BaseDn; if CommitChanges == 1: + Dn = "uid=" + GetAttr(DnRecord,"uid") + "," + BaseDn; l.modify_s(Dn,Attrs); Attribs = ""; @@ -590,7 +585,7 @@ def HandleChange(Reply,DnRecord,Key): if len(Attrs) == 0: raise Error, "User not found" Attribs = GPGEncrypt(PrettyShow(Attrs[0])+"\n","0x"+Key[1],Key[4]); - + Subst = {}; Subst["__FROM__"] = ChangeFrom; Subst["__EMAIL__"] = EmailAddress(DnRecord); @@ -673,8 +668,6 @@ try: # Startup the replay cache ErrType = EX_TEMPFAIL; ErrMsg = "Failed to initialize the replay cache:"; - RC = ReplayCache(ReplayCacheFile); - RC.Clean(); # Get the email ErrType = EX_PERMFAIL; @@ -709,12 +702,6 @@ try: else: PlainText = Res[3]; - # Check the signature against the replay cache - ErrMsg = "The replay cache rejected your message. Check your clock!"; - Rply = RC.Check(Res[1]); - if Rply != None: - raise Error, Rply; - # Connect to the ldap server ErrType = EX_TEMPFAIL; ErrMsg = "An error occured while performing the LDAP lookup"; @@ -731,7 +718,17 @@ try: if len(Attrs) != 1: raise Error, "Oddly your key fingerprint is assigned to more than one account.." + + # Check the signature against the replay cache + RC = ReplayCache(ReplayCacheFile); + RC.Clean(); + ErrMsg = "The replay cache rejected your message. Check your clock!"; + Rply = RC.Check(Res[1]); + if Rply != None: + RC.close() + raise Error, Rply; RC.Add(Res[1]); + RC.close() # Determine the sender address ErrMsg = "A problem occured while trying to formulate the reply"; @@ -800,4 +797,7 @@ except: if ErrType != EX_PERMFAIL: sys.exit(ErrType); sys.exit(0); - + +# vim:set et: +# vim:set ts=3: +# vim:set shiftwidth=3: