import userdir_gpg, userdir_ldap, sys, traceback, time, ldap, os, commands
import pwd, tempfile
-import hmac, haslib
+import hmac
+import sha as sha1_module
+
from userdir_gpg import *
from userdir_ldap import *
};
def make_hmac(str):
- F = open(PassDir+"/key-hmac","r");
- key = F.readline()
+ F = open(PassDir+"/key-hmac-"+pwd.getpwuid(os.getuid())[0],"r");
+ key = F.readline().strip()
F.close();
- return hmac.new(key, str, hashlib.sha1).hexdigest
+ return hmac.new(key, str, sha1_module).hexdigest()
SudoPasswd[uuid] = (hosts, hmac)
return "got confirm for sudo password %s on host(s) %s, auth code %s" % (uuid,hosts, hmac)
-def FinishConfirmSudopassword(l, dn, Attrs):
+def FinishConfirmSudopassword(l, uid, Attrs):
global SudoPasswd
result = "\n"
res = l.search_s(BaseDn,ldap.SCOPE_ONELEVEL,"uid="+uid, ['sudoPassword']);
if len(res) != 1:
raise Error, "Not exactly one hit when searching for user"
- Attrs = res[0][1]
- if Attrs.has_key('sudoPassword'):
- inldap = Attrs['sudoPassword']
+ if res[0][1].has_key('sudoPassword'):
+ inldap = res[0][1]['sudoPassword']
else:
inldap = []
- first_entry = 0
+ newldap = []
for entry in inldap:
- Match = re.compile('^('+UUID_FORMAT+') (confirmed|unconfirmed) ([a-z0-9,*]+) ([^ ]+)$'),match(entry.lower())
+ Match = re.compile('^('+UUID_FORMAT+') (confirmed|unconfirmed) ([a-z0-9,*]+) ([^ ]+)$').match(entry.lower())
if Match == None:
raise Error, "Could not parse existing sudopasswd entry"
uuid = Match.group(1)
del SudoPasswd[uuid]
newentry = " ".join([uuid, status, hosts, cryptedpass])
- if first_entry:
- Attrs.append((ldap.MOD_ADD,"sudoPassword",newentry))
+ if len(newldap) == 0:
+ newldap.append((ldap.MOD_REPLACE,"sudoPassword",newentry))
else:
- Attrs.append((ldap.MOD_REPLACE,"sudoPassword",newentry))
- first_entry = 1
+ newldap.append((ldap.MOD_ADD,"sudoPassword",newentry))
for entry in SudoPasswd:
result = result + "Entry %s that you confirm is not listed in ldap."%(entry)
+ for entry in newldap:
+ Attrs.append(entry)
+
return result
# Handle an [almost] arbitary change
try:
Res = FinishConfirmSudopassword(l, GetAttr(DnRecord,"uid"), Attrs)
Result = Result + Res + "\n";
- except:
+ except Error, e:
CommitChanges = 0
- Result = Result + "ConfirmSudopassword raised an error - no changes committed\n";
+ Result = Result + "FinishConfirmSudopassword raised an error (%s) - no changes committed\n"%(e);
# Modify the record
Dn = "uid=" + GetAttr(DnRecord,"uid") + "," + BaseDn;
if CommitChanges == 1: