#!/usr/bin/env python # -*- mode: python -*- # Generates passwd, shadow and group files from the ldap directory. # Copyright (c) 2000-2001 Jason Gunthorpe # Copyright (c) 2003-2004 James Troup # Copyright (c) 2004-2005,7 Joey Schulze # Copyright (c) 2001-2007 Ryan Murray # Copyright (c) 2008,2009,2010 Peter Palfrader # Copyright (c) 2008 Andreas Barth # Copyright (c) 2008 Mark Hymers # Copyright (c) 2008 Luk Claes # Copyright (c) 2008 Thomas Viehmann # Copyright (c) 2009 Stephen Gran # Copyright (c) 2010 Helmut Grohne # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. import string, re, time, ldap, getopt, sys, os, pwd, posix, socket, base64, sha, shutil, errno, tarfile, grp from userdir_ldap import * from userdir_exceptions import * import UDLdap try: from cStringIO import StringIO except ImportError: from StringIO import StringIO global Allowed global CurrentHost if os.getuid() == 0: sys.stderr.write("You should probably not run ud-generate as root.\n") sys.exit(1) PasswdAttrs = None DebianUsers = None DisabledUsers = [] GroupIDMap = {} SubGroupMap = {} Allowed = None CurrentHost = "" UUID_FORMAT = '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}' EmailCheck = re.compile("^([^ <>@]+@[^ ,<>@]+)?$") BSMTPCheck = re.compile(".*mx 0 (master)\.debian\.org\..*",re.DOTALL) PurposeHostField = re.compile(r".*\[\[([\*\-]?[a-z0-9.\-]*)(?:\|.*)?\]\]") IsV6Addr = re.compile("^[a-fA-F0-9:]+$") IsDebianHost = re.compile(ConfModule.dns_hostmatch) isSSHFP = re.compile("^\s*IN\s+SSHFP") DNSZone = ".debian.net" Keyrings = ConfModule.sync_keyrings.split(":") def safe_makedirs(dir): try: os.makedirs(dir) except OSError, e: if e.errno == errno.EEXIST: pass else: raise e def safe_rmtree(dir): try: shutil.rmtree(dir) except OSError, e: if e.errno == errno.ENOENT: pass else: raise e def Sanitize(Str): return Str.translate(string.maketrans("\n\r\t", "$$$")) def DoLink(From, To, File): try: posix.remove(To + File) except: pass posix.link(From + File, To + File) def IsRetired(DnRecord): """ Looks for accountStatus in the LDAP record and tries to match it against one of the known retired statuses """ status = GetAttr(DnRecord, "accountStatus", None) if status is None: return False line = status.split() status = line[0] if status == "inactive": return True elif status == "memorial": return True elif status == "retiring": # We'll give them a few extra days over what we said age = 6 * 31 * 24 * 60 * 60 try: return (time.time() - time.mktime(time.strptime(line[1], "%Y-%m-%d"))) > age except IndexError: return False except ValueError: return False return False def IsGidDebian(x): try: return int(GetAttr(x, "gidNumber", 0)) == 800 except ValueError: return False # See if this user is in the group list def IsInGroup(DnRecord): if Allowed is None: return True # See if the primary group is in the list if Allowed.has_key(GetAttr(DnRecord, "gidNumber")) != 0: return True # Check the host based ACL if DnRecord[1].has_key("allowedHost") != 0: if CurrentHost in DnRecord[1]["allowedHost"]: return True # See if there are supplementary groups if DnRecord[1].has_key("supplementaryGid") == 0: return False supgroups=[] addGroups(supgroups, DnRecord[1]["supplementaryGid"], GetAttr(DnRecord, "uid")) for g in supgroups: if Allowed.has_key(g): return True return False def Die(File, F, Fdb): if F != None: F.close() if Fdb != None: Fdb.close() try: os.remove(File + ".tmp") except: pass try: os.remove(File + ".tdb.tmp") except: pass def Done(File, F, Fdb): if F != None: F.close() os.rename(File + ".tmp", File) if Fdb != None: Fdb.close() os.rename(File + ".tdb.tmp", File + ".tdb") # Generate the password list def GenPasswd(File, HomePrefix, PwdMarker): F = None try: F = open(File + ".tdb.tmp", "w") userlist = {} # Fetch all the users global PasswdAttrs I = 0 for x in PasswdAttrs: if x[1].has_key("uidNumber") == 0 or not IsInGroup(x): continue # Do not let people try to buffer overflow some busted passwd parser. if len(GetAttr(x, "gecos")) > 100 or len(GetAttr(x, "loginShell")) > 50: continue userlist[GetAttr(x, "uid")] = int(GetAttr(x, "gidNumber")) Line = "%s:%s:%s:%s:%s:%s%s:%s" % (GetAttr(x, "uid"),\ PwdMarker,\ GetAttr(x, "uidNumber"), GetAttr(x, "gidNumber"),\ GetAttr(x, "gecos"), HomePrefix, GetAttr(x, "uid"),\ GetAttr(x, "loginShell")) Line = Sanitize(Line) + "\n" F.write("0%u %s" % (I, Line)) F.write(".%s %s" % (GetAttr(x, "uid"), Line)) F.write("=%s %s" % (GetAttr(x, "uidNumber"), Line)) I = I + 1 # Oops, something unspeakable happened. except: Die(File, None, F) raise Done(File, None, F) # Return the list of users so we know which keys to export return userlist # Generate the shadow list def GenShadow(File): F = None try: OldMask = os.umask(0077) F = open(File + ".tdb.tmp", "w", 0600) os.umask(OldMask) # Fetch all the users global PasswdAttrs I = 0 for x in PasswdAttrs: if x[1].has_key("uidNumber") == 0 or not IsInGroup(x): continue Pass = GetAttr(x, "userPassword") if Pass[0:7] != "{crypt}" or len(Pass) > 50: Pass = '*' else: Pass = Pass[7:] # If the account is locked, mark it as such in shadow # See Debian Bug #308229 for why we set it to 1 instead of 0 if (GetAttr(x, "userPassword").find("*LK*") != -1) \ or GetAttr(x, "userPassword").startswith("!"): ShadowExpire = '1' else: ShadowExpire = GetAttr(x, "shadowExpire") Line = "%s:%s:%s:%s:%s:%s:%s:%s:" % (GetAttr(x, "uid"),\ Pass, GetAttr(x, "shadowLastChange"),\ GetAttr(x, "shadowMin"), GetAttr(x, "shadowMax"),\ GetAttr(x, "shadowWarning"), GetAttr(x, "shadowInactive"),\ ShadowExpire) Line = Sanitize(Line) + "\n" F.write("0%u %s" % (I, Line)) F.write(".%s %s" % (GetAttr(x, "uid"), Line)) I = I + 1 # Oops, something unspeakable happened. except: Die(File, None, F) raise Done(File, None, F) # Generate the sudo passwd file def GenShadowSudo(File, untrusted): F = None try: OldMask = os.umask(0077) F = open(File + ".tmp", "w", 0600) os.umask(OldMask) # Fetch all the users global PasswdAttrs for x in PasswdAttrs: Pass = '*' if x[1].has_key("uidNumber") == 0 or not IsInGroup(x): continue if x[1].has_key('sudoPassword'): for entry in x[1]['sudoPassword']: Match = re.compile('^('+UUID_FORMAT+') (confirmed:[0-9a-f]{40}|unconfirmed) ([a-z0-9.,*]+) ([^ ]+)$').match(entry) if Match == None: continue uuid = Match.group(1) status = Match.group(2) hosts = Match.group(3) cryptedpass = Match.group(4) if status != 'confirmed:'+make_passwd_hmac('password-is-confirmed', 'sudo', x[1]['uid'][0], uuid, hosts, cryptedpass): continue for_all = hosts == "*" for_this_host = CurrentHost in hosts.split(',') if not (for_all or for_this_host): continue # ignore * passwords for untrusted hosts, but copy host specific passwords if for_all and untrusted: continue Pass = cryptedpass if for_this_host: # this makes sure we take a per-host entry over the for-all entry break if len(Pass) > 50: Pass = '*' Line = "%s:%s" % (GetAttr(x, "uid"), Pass) Line = Sanitize(Line) + "\n" F.write("%s" % (Line)) # Oops, something unspeakable happened. except: Die(File, F, None) raise Done(File, F, None) # Generate the shadow list def GenSSHShadow(): # Fetch all the users userfiles = [] global PasswdAttrs safe_rmtree(os.path.join(GlobalDir, 'userkeys')) safe_makedirs(os.path.join(GlobalDir, 'userkeys')) for x in PasswdAttrs: if x[1].has_key("uidNumber") == 0 or \ x[1].has_key("sshRSAAuthKey") == 0: continue User = GetAttr(x, "uid") F = None try: OldMask = os.umask(0077) File = os.path.join(GlobalDir, 'userkeys', User) F = open(File + ".tmp", "w", 0600) os.umask(OldMask) for I in x[1]["sshRSAAuthKey"]: MultipleLine = "%s" % I MultipleLine = Sanitize(MultipleLine) + "\n" F.write(MultipleLine) Done(File, F, None) userfiles.append(os.path.basename(File)) # Oops, something unspeakable happened. except IOError: Die(File, F, None) # As neither masterFileName nor masterFile are defined at any point # this will raise a NameError. Die(masterFileName, masterFile, None) raise return userfiles def GenSSHtarballs(userlist, SSHFiles, grouprevmap, target): OldMask = os.umask(0077) tf = tarfile.open(name=os.path.join(GlobalDir, 'ssh-keys-%s.tar.gz' % CurrentHost), mode='w:gz') os.umask(OldMask) for f in userlist.keys(): if f not in SSHFiles: continue # If we're not exporting their primary group, don't export # the key and warn grname = None if userlist[f] in grouprevmap.keys(): grname = grouprevmap[userlist[f]] else: try: if int(userlist[f]) <= 100: # In these cases, look it up in the normal way so we # deal with cases where, for instance, users are in group # users as their primary group. grname = grp.getgrgid(userlist[f])[0] except Exception, e: pass if grname is None: print "User %s is supposed to have their key exported to host %s but their primary group (gid: %d) isn't in LDAP" % (f, CurrentHost, userlist[f]) continue to = tf.gettarinfo(os.path.join(GlobalDir, 'userkeys', f), f) # These will only be used where the username doesn't # exist on the target system for some reason; hence, # in those cases, the safest thing is for the file to # be owned by root but group nobody. This deals with # the bloody obscure case where the group fails to exist # whilst the user does (in which case we want to avoid # ending up with a file which is owned user:root to avoid # a fairly obvious attack vector) to.uid = 0 to.gid = 65534 # Using the username / groupname fields avoids any need # to give a shit^W^W^Wcare about the UIDoffset stuff. to.uname = f to.gname = grname to.mode = 0400 contents = file(os.path.join(GlobalDir, 'userkeys', f)).read() lines = [] for line in contents.splitlines(): if line.startswith("allowed_hosts=") and ' ' in line: machines, line = line.split('=', 1)[1].split(' ', 1) if CurrentHost not in machines.split(','): continue # skip this key lines.append(line) if not lines: continue # no keys for this host contents = "\n".join(lines) + "\n" to.size = len(contents) tf.addfile(to, StringIO(contents)) tf.close() os.rename(os.path.join(GlobalDir, 'ssh-keys-%s.tar.gz' % CurrentHost), target) # add a list of groups to existing groups, # including all subgroups thereof, recursively. # basically this proceduces the transitive hull of the groups in # addgroups. def addGroups(existingGroups, newGroups, uid): for group in newGroups: # if it's a @host, split it and verify it's on the current host. s = group.split('@', 1) if len(s) == 2 and s[1] != CurrentHost: continue group = s[0] # let's see if we handled this group already if group in existingGroups: continue if not GroupIDMap.has_key(group): print "Group", group, "does not exist but", uid, "is in it" continue existingGroups.append(group) if SubGroupMap.has_key(group): addGroups(existingGroups, SubGroupMap[group], uid) # Generate the group list def GenGroup(File): grouprevmap = {} F = None try: F = open(File + ".tdb.tmp", "w") # Generate the GroupMap GroupMap = {} for x in GroupIDMap.keys(): GroupMap[x] = [] GroupHasPrimaryMembers = {} # Fetch all the users global PasswdAttrs # Sort them into a list of groups having a set of users for x in PasswdAttrs: uid = GetAttr(x, "uid") if 'gidNumber' in x[1]: GroupHasPrimaryMembers[ int(x[1]["gidNumber"][0]) ] = True if x[1].has_key("uidNumber") == 0 or not IsInGroup(x): continue if x[1].has_key("supplementaryGid") == 0: continue supgroups=[] addGroups(supgroups, x[1]["supplementaryGid"], uid) for g in supgroups: GroupMap[g].append(uid) # Output the group file. J = 0 for x in GroupMap.keys(): if GroupIDMap.has_key(x) == 0: continue if len(GroupMap[x]) == 0 and GroupIDMap[x] not in GroupHasPrimaryMembers: continue grouprevmap[GroupIDMap[x]] = x Line = "%s:x:%u:" % (x, GroupIDMap[x]) Comma = '' for I in GroupMap[x]: Line = Line + ("%s%s" % (Comma, I)) Comma = ',' Line = Sanitize(Line) + "\n" F.write("0%u %s" % (J, Line)) F.write(".%s %s" % (x, Line)) F.write("=%u %s" % (GroupIDMap[x], Line)) J = J + 1 # Oops, something unspeakable happened. except: Die(File, None, F) raise Done(File, None, F) return grouprevmap def CheckForward(): global PasswdAttrs for x in PasswdAttrs: if x[1].has_key("emailForward") == 0: continue if not IsInGroup(x): x[1].pop("emailForward") continue # Do not allow people to try to buffer overflow busted parsers if len(GetAttr(x, "emailForward")) > 200: x[1].pop("emailForward") continue # Check the forwarding address if EmailCheck.match(GetAttr(x, "emailForward")) == None: x[1].pop("emailForward") # Generate the email forwarding list def GenForward(File): F = None try: OldMask = os.umask(0022) F = open(File + ".tmp", "w", 0644) os.umask(OldMask) # Fetch all the users global PasswdAttrs # Write out the email address for each user for x in PasswdAttrs: a = UDLdap.Account(x[0], x[1]) if not 'emailForward' in a: continue Line = "%s: %s" % (a['uid'], a['emailForward']) Line = Sanitize(Line) + "\n" F.write(Line) # Oops, something unspeakable happened. except: Die(File, F, None) raise Done(File, F, None) def GenCDB(File, Users, key): Fdb = None try: OldMask = os.umask(0022) Fdb = os.popen("cdbmake %s %s.tmp"%(File, File), "w") os.umask(OldMask) # Write out the email address for each user for x in Users: a = UDLdap.Account(x[0], x[1]) if not key in a: continue value = a[key] user = a['uid'] Fdb.write("+%d,%d:%s->%s\n" % (len(user), len(value), user, value)) Fdb.write("\n") # Oops, something unspeakable happened. except: Fdb.close() raise if Fdb.close() != None: raise "cdbmake gave an error" # Generate the anon XEarth marker file def GenMarkers(File): F = None try: F = open(File + ".tmp", "w") # Fetch all the users global PasswdAttrs # Write out the position for each user for x in PasswdAttrs: a = UDLdap.Account(x[0], x[1]) if not ('latitude' in a and 'longitude' in a): continue try: Line = "%8s %8s \"\""%(a.latitude_dec(True), a.longitude_dec(True)) Line = Sanitize(Line) + "\n" F.write(Line) except: pass # Oops, something unspeakable happened. except: Die(File, F, None) raise Done(File, F, None) # Generate the debian-private subscription list def GenPrivate(File): F = None try: F = open(File + ".tmp", "w") # Fetch all the users global DebianDDUsers # Write out the position for each user for x in DebianDDUsers: a = UDLdap.Account(x[0], x[1]) if not a.is_active_user(): continue if not 'privateSub' in a: continue try: Line = "%s"%(a['privateSub']) Line = Sanitize(Line) + "\n" F.write(Line) except: pass # Oops, something unspeakable happened. except: Die(File, F, None) raise Done(File, F, None) # Generate a list of locked accounts def GenDisabledAccounts(File): F = None try: F = open(File + ".tmp", "w") # Fetch all the users global PasswdAttrs global DisabledUsers I = 0 for x in PasswdAttrs: a = UDLdap.Account(x[0], x[1]) if a.pw_active(): continue Line = "%s:%s" % (a['uid'], "Account is locked") DisabledUsers.append(x) F.write(Sanitize(Line) + "\n") # Oops, something unspeakable happened. except: Die(File, F, None) raise Done(File, F, None) # Generate the list of local addresses that refuse all mail def GenMailDisable(File): F = None try: F = open(File + ".tmp", "w") # Fetch all the users global PasswdAttrs for x in PasswdAttrs: a = UDLdap.Account(x[0], x[1]) if not 'mailDisableMessage' in a: continue Line = "%s: %s"%(a['uid'], a['mailDisableMessage']) Line = Sanitize(Line) + "\n" F.write(Line) # Oops, something unspeakable happened. except: Die(File, F, None) raise Done(File, F, None) # Generate a list of uids that should have boolean affects applied def GenMailBool(File, key): F = None try: F = open(File + ".tmp", "w") # Fetch all the users global PasswdAttrs for x in PasswdAttrs: a = UDLdap.Account(x[0], x[1]) if not key in a: continue if not a[key] == 'TRUE': continue Line = "%s"%(a['uid']) Line = Sanitize(Line) + "\n" F.write(Line) # Oops, something unspeakable happened. except: Die(File, F, None) raise Done(File, F, None) # Generate a list of hosts for RBL or whitelist purposes. def GenMailList(File, key): F = None try: F = open(File + ".tmp", "w") # Fetch all the users global PasswdAttrs if key == "mailWhitelist": validregex = re.compile('^[-\w.]+(/[\d]+)?$') else: validregex = re.compile('^[-\w.]+$') for x in PasswdAttrs: a = UDLdap.Account(x[0], x[1]) if not key in a: continue filtered = filter(lambda z: validregex.match(z), a[key]) if len(filtered) == 0: continue if key == "mailRHSBL": filtered = map(lambda z: z+"/$sender_address_domain", filtered) line = a['uid'] + ': ' + ' : '.join(filtered) line = Sanitize(line) + "\n" F.write(line) # Oops, something unspeakable happened. except: Die(File, F, None) raise Done(File, F, None) def isRoleAccount(pwEntry): if not pwEntry.has_key("objectClass"): raise "pwEntry has no objectClass" oc = pwEntry['objectClass'] try: i = oc.index('debianRoleAccount') return True except ValueError: return False # Generate the DNS Zone file def GenDNS(File): F = None try: F = open(File + ".tmp", "w") # Fetch all the users global PasswdAttrs RRs = {} # Write out the zone file entry for each user for x in PasswdAttrs: if x[1].has_key("dnsZoneEntry") == 0: continue # If the account has no PGP key, do not write it if x[1].has_key("keyFingerPrint") == 0 and not isRoleAccount(x[1]): continue try: F.write("; %s\n"%(EmailAddress(x))) for z in x[1]["dnsZoneEntry"]: Split = z.lower().split() if Split[1].lower() == 'in': for y in range(0, len(Split)): if Split[y] == "$": Split[y] = "\n\t" Line = " ".join(Split) + "\n" F.write(Line) Host = Split[0] + DNSZone if BSMTPCheck.match(Line) != None: F.write("; Has BSMTP\n") # Write some identification information if not RRs.has_key(Host): if Split[2].lower() in ["a", "aaaa"]: Line = "%s IN TXT \"%s\"\n"%(Split[0], EmailAddress(x)) for y in x[1]["keyFingerPrint"]: Line = Line + "%s IN TXT \"PGP %s\"\n"%(Split[0], FormatPGPKey(y)) F.write(Line) RRs[Host] = 1 else: Line = "; Err %s"%(str(Split)) F.write(Line) F.write("\n") except: F.write("; Errors\n") pass # Oops, something unspeakable happened. except: Die(File, F, None) raise Done(File, F, None) def ExtractDNSInfo(x): TTLprefix="\t" if 'dnsTTL' in x[1]: TTLprefix="%s\t"%(x[1]["dnsTTL"][0]) DNSInfo = [] if x[1].has_key("ipHostNumber"): for I in x[1]["ipHostNumber"]: if IsV6Addr.match(I) != None: DNSInfo.append("%sIN\tAAAA\t%s" % (TTLprefix, I)) else: DNSInfo.append("%sIN\tA\t%s" % (TTLprefix, I)) Algorithm = None if 'sshRSAHostKey' in x[1]: for I in x[1]["sshRSAHostKey"]: Split = I.split() if Split[0] == 'ssh-rsa': Algorithm = 1 if Split[0] == 'ssh-dss': Algorithm = 2 if Algorithm == None: continue Fingerprint = sha.new(base64.decodestring(Split[1])).hexdigest() DNSInfo.append("%sIN\tSSHFP\t%u 1 %s" % (TTLprefix, Algorithm, Fingerprint)) if 'architecture' in x[1]: Arch = GetAttr(x, "architecture") Mach = "" if x[1].has_key("machine"): Mach = " " + GetAttr(x, "machine") DNSInfo.append("%sIN\tHINFO\t\"%s%s\" \"%s\"" % (TTLprefix, Arch, Mach, "Debian GNU/Linux")) if x[1].has_key("mXRecord"): for I in x[1]["mXRecord"]: DNSInfo.append("%sIN\tMX\t%s" % (TTLprefix, I)) return DNSInfo # Generate the DNS records def GenZoneRecords(File): F = None try: F = open(File + ".tmp", "w") # Fetch all the hosts global HostAttrs for x in HostAttrs: if x[1].has_key("hostname") == 0: continue if IsDebianHost.match(GetAttr(x, "hostname")) is None: continue DNSInfo = ExtractDNSInfo(x) start = True for Line in DNSInfo: if start == True: Line = "%s.\t%s" % (GetAttr(x, "hostname"), Line) start = False else: Line = "\t\t\t%s" % (Line) F.write(Line + "\n") # this would write sshfp lines for services on machines # but we can't yet, since some are cnames and we'll make # an invalid zonefile # # for i in x[1].get("purpose", []): # m = PurposeHostField.match(i) # if m: # m = m.group(1) # # we ignore [[*..]] entries # if m.startswith('*'): # continue # if m.startswith('-'): # m = m[1:] # if m: # if not m.endswith(HostDomain): # continue # if not m.endswith('.'): # m = m + "." # for Line in DNSInfo: # if isSSHFP.match(Line): # Line = "%s\t%s" % (m, Line) # F.write(Line + "\n") # Oops, something unspeakable happened. except: Die(File, F, None) raise Done(File, F, None) # Generate the BSMTP file def GenBSMTP(File, HomePrefix): F = None try: F = open(File + ".tmp", "w") # Fetch all the users global PasswdAttrs # Write out the zone file entry for each user for x in PasswdAttrs: if x[1].has_key("dnsZoneEntry") == 0: continue # If the account has no PGP key, do not write it if x[1].has_key("keyFingerPrint") == 0: continue try: for z in x[1]["dnsZoneEntry"]: Split = z.lower().split() if Split[1].lower() == 'in': for y in range(0, len(Split)): if Split[y] == "$": Split[y] = "\n\t" Line = " ".join(Split) + "\n" Host = Split[0] + DNSZone if BSMTPCheck.match(Line) != None: F.write("%s: user=%s group=Debian file=%s%s/bsmtp/%s\n"%(Host, GetAttr(x, "uid"), HomePrefix, GetAttr(x, "uid"), Host)) except: F.write("; Errors\n") pass # Oops, something unspeakable happened. except: Die(File, F, None) raise Done(File, F, None) def HostToIP(Host, mapped=True): IPAdresses = [] if Host[1].has_key("ipHostNumber"): for addr in Host[1]["ipHostNumber"]: IPAdresses.append(addr) if IsV6Addr.match(addr) is None and mapped == "True": IPAdresses.append("::ffff:"+addr) return IPAdresses # Generate the ssh known hosts file def GenSSHKnown(File, mode=None): F = None try: OldMask = os.umask(0022) F = open(File + ".tmp", "w", 0644) os.umask(OldMask) global HostAttrs for x in HostAttrs: if x[1].has_key("hostname") == 0 or \ x[1].has_key("sshRSAHostKey") == 0: continue Host = GetAttr(x, "hostname") HostNames = [ Host ] if Host.endswith(HostDomain): HostNames.append(Host[:-(len(HostDomain) + 1)]) # in the purpose field [[host|some other text]] (where some other text is optional) # makes a hyperlink on the web thing. we now also add these hosts to the ssh known_hosts # file. But so that we don't have to add everything we link we can add an asterisk # and say [[*... to ignore it. In order to be able to add stuff to ssh without # http linking it we also support [[-hostname]] entries. for i in x[1].get("purpose", []): m = PurposeHostField.match(i) if m: m = m.group(1) # we ignore [[*..]] entries if m.startswith('*'): continue if m.startswith('-'): m = m[1:] if m: HostNames.append(m) if m.endswith(HostDomain): HostNames.append(m[:-(len(HostDomain) + 1)]) for I in x[1]["sshRSAHostKey"]: if mode and mode == 'authorized_keys': hosts = HostToIP(x) if 'sshdistAuthKeysHost' in x[1]: hosts += x[1]['sshdistAuthKeysHost'] Line = 'command="rsync --server --sender -pr . /var/cache/userdir-ldap/hosts/%s",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,from="%s" %s' % (Host, ",".join(hosts), I) else: Line = "%s %s" %(",".join(HostNames + HostToIP(x, False)), I) Line = Sanitize(Line) + "\n" F.write(Line) # Oops, something unspeakable happened. except: Die(File, F, None) raise Done(File, F, None) # Generate the debianhosts file (list of all IP addresses) def GenHosts(File): F = None try: OldMask = os.umask(0022) F = open(File + ".tmp", "w", 0644) os.umask(OldMask) seen = set() global HostAttrs for x in HostAttrs: if IsDebianHost.match(GetAttr(x, "hostname")) is None: continue if not 'ipHostNumber' in x[1]: continue addrs = x[1]["ipHostNumber"] for addr in addrs: if addr not in seen: seen.add(addr) addr = Sanitize(addr) + "\n" F.write(addr) # Oops, something unspeakable happened. except: Die(File, F, None) raise Done(File, F, None) def GenKeyrings(OutDir): for k in Keyrings: shutil.copy(k, OutDir) # Connect to the ldap server l = connectLDAP() # for testing purposes it's sometimes useful to pass username/password # via the environment if 'UD_CREDENTIALS' in os.environ: Pass = os.environ['UD_CREDENTIALS'].split() else: F = open(PassDir + "/pass-" + pwd.getpwuid(os.getuid())[0], "r") Pass = F.readline().strip().split(" ") F.close() l.simple_bind_s("uid=" + Pass[0] + "," + BaseDn, Pass[1]) # Fetch all the groups GroupIDMap = {} Attrs = l.search_s(BaseDn, ldap.SCOPE_ONELEVEL, "gid=*",\ ["gid", "gidNumber", "subGroup"]) # Generate the SubGroupMap and GroupIDMap for x in Attrs: if x[1].has_key("accountStatus") and x[1]['accountStatus'] == "disabled": continue if x[1].has_key("gidNumber") == 0: continue GroupIDMap[x[1]["gid"][0]] = int(x[1]["gidNumber"][0]) if x[1].has_key("subGroup") != 0: SubGroupMap.setdefault(x[1]["gid"][0], []).extend(x[1]["subGroup"]) # Fetch all the users PasswdAttrs = l.search_s(BaseDn, ldap.SCOPE_ONELEVEL, "(&(uid=*)(!(uidNumber=0)))",\ ["uid", "uidNumber", "gidNumber", "supplementaryGid",\ "gecos", "loginShell", "userPassword", "shadowLastChange",\ "shadowMin", "shadowMax", "shadowWarning", "shadowInactive", "shadowExpire", "emailForward", "latitude", "longitude",\ "allowedHost", "sshRSAAuthKey", "dnsZoneEntry", "cn", "sn",\ "keyFingerPrint", "privateSub", "mailDisableMessage",\ "mailGreylisting", "mailCallout", "mailRBL", "mailRHSBL",\ "mailWhitelist", "sudoPassword", "objectClass", "accountStatus",\ "mailContentInspectionAction"]) if PasswdAttrs is None: raise UDEmptyList, "No Users" PasswdAttrs.sort(lambda x, y: cmp((GetAttr(x, "uid")).lower(), (GetAttr(y, "uid")).lower())) # Fetch all the hosts HostAttrs = l.search_s(HostBaseDn, ldap.SCOPE_ONELEVEL, "objectClass=debianServer",\ ["hostname", "sshRSAHostKey", "purpose", "allowedGroups", "exportOptions",\ "mXRecord", "ipHostNumber", "dnsTTL", "machine", "architecture"]) if HostAttrs == None: raise UDEmptyList, "No Hosts" HostAttrs.sort(lambda x, y: cmp((GetAttr(x, "hostname")).lower(), (GetAttr(y, "hostname")).lower())) # override globaldir for testing if 'UD_GENERATEDIR' in os.environ: GenerateDir = os.environ['UD_GENERATEDIR'] # Generate global things GlobalDir = GenerateDir + "/" GenDisabledAccounts(GlobalDir + "disabled-accounts") PasswdAttrs = filter(lambda x: not IsRetired(x), PasswdAttrs) DebianDDUsers = filter(lambda x: IsGidDebian(x), PasswdAttrs) CheckForward() GenMailDisable(GlobalDir + "mail-disable") GenCDB(GlobalDir + "mail-forward.cdb", PasswdAttrs, 'emailForward') GenCDB(GlobalDir + "mail-contentinspectionaction.cdb", PasswdAttrs, 'mailContentInspectionAction') GenPrivate(GlobalDir + "debian-private") GenSSHKnown(GlobalDir+"authorized_keys", 'authorized_keys') GenMailBool(GlobalDir + "mail-greylist", "mailGreylisting") GenMailBool(GlobalDir + "mail-callout", "mailCallout") GenMailList(GlobalDir + "mail-rbl", "mailRBL") GenMailList(GlobalDir + "mail-rhsbl", "mailRHSBL") GenMailList(GlobalDir + "mail-whitelist", "mailWhitelist") GenKeyrings(GlobalDir) # Compatibility. GenForward(GlobalDir + "forward-alias") PasswdAttrs = filter(lambda x: not x in DisabledUsers, PasswdAttrs) SSHFiles = GenSSHShadow() GenMarkers(GlobalDir + "markers") GenSSHKnown(GlobalDir + "ssh_known_hosts") GenHosts(GlobalDir + "debianhosts") for host in HostAttrs: if not "hostname" in host[1]: continue CurrentHost = host[1]['hostname'][0] OutDir = GenerateDir + '/' + CurrentHost + '/' try: os.mkdir(OutDir) except: pass # Get the group list and convert any named groups to numerics GroupList = {} for groupname in AllowedGroupsPreload.strip().split(" "): GroupList[groupname] = True if 'allowedGroups' in host[1]: for groupname in host[1]['allowedGroups']: GroupList[groupname] = True for groupname in GroupList.keys(): if groupname in GroupIDMap: GroupList[str(GroupIDMap[groupname])] = True ExtraList = {} if 'exportOptions' in host[1]: for extra in host[1]['exportOptions']: ExtraList[extra.upper()] = True Allowed = GroupList if Allowed == {}: Allowed = None DoLink(GlobalDir, OutDir, "debianhosts") DoLink(GlobalDir, OutDir, "ssh_known_hosts") DoLink(GlobalDir, OutDir, "disabled-accounts") sys.stdout.flush() if 'NOPASSWD' in ExtraList: userlist = GenPasswd(OutDir + "passwd", HomePrefix, "*") else: userlist = GenPasswd(OutDir + "passwd", HomePrefix, "x") sys.stdout.flush() grouprevmap = GenGroup(OutDir + "group") GenShadowSudo(OutDir + "sudo-passwd", ('UNTRUSTED' in ExtraList) or ('NOPASSWD' in ExtraList)) # Now we know who we're allowing on the machine, export # the relevant ssh keys GenSSHtarballs(userlist, SSHFiles, grouprevmap, os.path.join(OutDir, 'ssh-keys.tar.gz')) if not 'NOPASSWD' in ExtraList: GenShadow(OutDir + "shadow") # Link in global things if not 'NOMARKERS' in ExtraList: DoLink(GlobalDir, OutDir, "markers") DoLink(GlobalDir, OutDir, "mail-forward.cdb") DoLink(GlobalDir, OutDir, "mail-contentinspectionaction.cdb") DoLink(GlobalDir, OutDir, "mail-disable") DoLink(GlobalDir, OutDir, "mail-greylist") DoLink(GlobalDir, OutDir, "mail-callout") DoLink(GlobalDir, OutDir, "mail-rbl") DoLink(GlobalDir, OutDir, "mail-rhsbl") DoLink(GlobalDir, OutDir, "mail-whitelist") GenCDB(OutDir + "user-forward.cdb", filter(lambda x: IsInGroup(x), PasswdAttrs), 'emailForward') GenCDB(OutDir + "batv-tokens.cdb", filter(lambda x: IsInGroup(x), PasswdAttrs), 'bATVToken') GenCDB(OutDir + "default-mail-options.cdb", filter(lambda x: IsInGroup(x), PasswdAttrs), 'mailDefaultOptions') # Compatibility. DoLink(GlobalDir, OutDir, "forward-alias") if 'DNS' in ExtraList: GenDNS(OutDir + "dns-zone") GenZoneRecords(OutDir + "dns-sshfp") if 'AUTHKEYS' in ExtraList: DoLink(GlobalDir, OutDir, "authorized_keys") if 'BSMTP' in ExtraList: GenBSMTP(OutDir + "bsmtp", HomePrefix) if 'PRIVATE' in ExtraList: DoLink(GlobalDir, OutDir, "debian-private") if 'KEYRING' in ExtraList: for k in Keyrings: DoLink(GlobalDir, OutDir, os.path.basename(k)) else: for k in Keyrings: try: posix.remove(OutDir + os.path.basename(k)) except: pass # vim:set et: # vim:set ts=3: # vim:set shiftwidth=3: