X-Git-Url: https://git.adam-barratt.org.uk/?p=mirror%2Fuserdir-ldap.git;a=blobdiff_plain;f=userdir_ldap.py;h=0ef10996c91bb95d05045d9822707ce94729b7b7;hp=a0de8424643888bc841ff2a7c5664efe55ea9136;hb=a6fb69805c3999a85c064a96c93417bb1c284c5c;hpb=e923fdd150d0f756679eb222e70b058645c2792a diff --git a/userdir_ldap.py b/userdir_ldap.py index a0de842..0ef1099 100644 --- a/userdir_ldap.py +++ b/userdir_ldap.py @@ -1,5 +1,23 @@ +# Copyright (c) 1999-2000 Jason Gunthorpe +# Copyright (c) 2001-2003 Ryan Murray +# Copyright (c) 2004-2005 Joey Schulze +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + # Some routines and configuration that are used by the ldap progams -import termios, TERMIOS, re, string, imp, ldap, sys, whrandom, crypt, rfc822; +import termios, re, imp, ldap, sys, crypt, rfc822; import userdir_gpg try: @@ -11,7 +29,7 @@ File.close(); # Cheap hack BaseDn = ConfModule.basedn; -BaseDn = ConfModule.basedn; +HostBaseDn = ConfModule.hostbasedn; LDAPServer = ConfModule.ldaphost; EmailAppend = ConfModule.emailappend; AdminUser = ConfModule.adminuser; @@ -24,14 +42,27 @@ Ech_ErrorLog = ConfModule.ech_errorlog; Ech_MainLog = ConfModule.ech_mainlog; # Break up the keyring list -userdir_gpg.SetKeyrings(string.split(ConfModule.keyrings,":")); +userdir_gpg.SetKeyrings(ConfModule.keyrings.split(":")) # This is a list of common last-name prefixes -LastNamesPre = {"van": None, "le": None, "de": None, "di": None}; +LastNamesPre = {"van": None, "von": None, "le": None, "de": None, "di": None}; + +# This is a list of common groups on Debian hosts +DebianGroups = { + "Debian": 800, + "guest": 60000, + "nogroup": 65534 + } + +# ObjectClasses for different object types +UserObjectClasses = ("top", "inetOrgPerson", "debianAccount", "shadowAccount", "debianDeveloper") +RoleObjectClasses = ("top", "debianAccount", "shadowAccount", "debianRoleAccount") +GroupObjectClasses = ("top", "debianGroup") # SSH Key splitting. The result is: # (options,size,modulous,exponent,comment) SSHAuthSplit = re.compile('^(.* )?(\d+) (\d+) (\d+) ?(.+)$'); +SSH2AuthSplit = re.compile('^(.* )?ssh-(dss|rsa) ([a-zA-Z0-9=/+]+) ?(.+)$'); #'^([^\d](?:[^ "]+(?:".*")?)*)? ?(\d+) (\d+) (\d+) (.+)$'); AddressSplit = re.compile("(.*).*<([^@]*)@([^>]*)>"); @@ -69,23 +100,53 @@ def PrettyShow(DnRecord): # Function to prompt for a password def getpass(prompt = "Password: "): - import termios, TERMIOS, sys; + import termios, sys; fd = sys.stdin.fileno(); old = termios.tcgetattr(fd); new = termios.tcgetattr(fd); - new[3] = new[3] & ~TERMIOS.ECHO; # lflags + new[3] = new[3] & ~termios.ECHO; # lflags try: - termios.tcsetattr(fd, TERMIOS.TCSADRAIN, new); - passwd = raw_input(prompt); + termios.tcsetattr(fd, termios.TCSADRAIN, new); + try: + passwd = raw_input(prompt); + except KeyboardInterrupt: + termios.tcsetattr(fd, termios.TCSADRAIN, old); + print + sys.exit(0) + except EOFError: + passwd = "" finally: - termios.tcsetattr(fd, TERMIOS.TCSADRAIN, old); + termios.tcsetattr(fd, termios.TCSADRAIN, old); print; return passwd; +def passwdAccessLDAP(LDAPServer, BaseDn, AdminUser): + """ + Ask for the AdminUser's password and connect to the LDAP server. + Returns the connection handle. + """ + print "Accessing LDAP directory as '" + AdminUser + "'"; + while (1): + Password = getpass(AdminUser + "'s password: "); + + if len(Password) == 0: + sys.exit(0) + + l = ldap.open(LDAPServer); + UserDn = "uid=" + AdminUser + "," + BaseDn; + + # Connect to the ldap server + try: + l.simple_bind_s(UserDn,Password); + except ldap.INVALID_CREDENTIALS: + continue + break + return l + # Split up a name into multiple components. This tries to best guess how # to split up a name def NameSplit(Name): - Words = re.split(" ",string.strip(Name)); + Words = re.split(" ", Name.strip()) # Insert an empty middle name if (len(Words) == 2): @@ -115,7 +176,7 @@ def NameSplit(Name): Words.append(''); # Merge any of the last name prefixes into one big last name - while LastNamesPre.has_key(string.lower(Words[-2])): + while LastNamesPre.has_key(Words[-2].lower()): Words[-1] = Words[-2] + " " + Words[-1]; del Words[-2]; @@ -126,10 +187,10 @@ def NameSplit(Name): # If the name is multi-word then we glob them all into the last name and # do not worry about a middle name if (len(Words) > 3): - Words[2] = string.join(Words[1:]); + Words[2] = " ".join(Words[1:]) Words[1] = ""; - return (string.strip(Words[0]),string.strip(Words[1]),string.strip(Words[2])); + return (Words[0].strip(), Words[1].strip(), Words[2].strip()); # Compute a random password using /dev/urandom def GenPass(): @@ -145,7 +206,7 @@ def GenPass(): def HashPass(Password): # Hash it telling glibc to use the MD5 algorithm - if you dont have # glibc then just change Salt = "$1$" to Salt = ""; - SaltVals = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/."; + SaltVals = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789/."; Salt = "$1$"; Rand = open("/dev/urandom"); for x in range(0,10): @@ -185,8 +246,8 @@ def FlushOutstanding(l,Outstanding,Fast=0): # Convert a lat/long attribute into Decimal degrees def DecDegree(Posn,Anon=0): - Parts = re.match('[+-]?(\d*)\\.?(\d*)?',Posn).groups(); - Val = string.atof(Posn); + Parts = re.match('[-+]?(\d*)\\.?(\d*)',Posn).groups(); + Val = float(Posn); if (abs(Val) >= 1806060.0): raise ValueError,"Too Big"; @@ -213,10 +274,20 @@ def DecDegree(Posn,Anon=0): return "+" + Str; return Str; +def FormatSSH2Auth(Str): + Match = SSH2AuthSplit.match(Str); + if Match == None: + return ""; + G = Match.groups(); + + if G[0] == None: + return "ssh-%s %s..%s %s"%(G[1],G[2][:8],G[2][-8:],G[3]); + return "%s ssh-%s %s..%s %s"%(G[0],G[1],G[2][:8],G[2][-8:],G[3]); + def FormatSSHAuth(Str): Match = SSHAuthSplit.match(Str); if Match == None: - return ""; + return FormatSSH2Auth(Str); G = Match.groups(); # No options @@ -247,12 +318,12 @@ def FormatPGPKey(Str): I = I + 4; else: Res = Str; - return string.strip(Res); + return Res.strip() # Take an email address and split it into 3 parts, (Name,UID,Domain) def SplitEmail(Addr): # Is not an email address at all - if string.find(Addr,'@') == -1: + if Addr.find('@') == -1: return (Addr,"",""); Res1 = rfc822.AddrlistClass(Addr).getaddress(); @@ -264,7 +335,7 @@ def SplitEmail(Addr): # If there is no @ then the address was not parsed well. Try the alternate # Parsing scheme. This is particularly important when scanning PGP keys. - Res2 = string.split(Res1[1],"@"); + Res2 = Res1[1].split("@"); if len(Res2) != 2: Match = AddressSplit.match(Addr); if Match == None: @@ -325,8 +396,8 @@ def GetUID(l,Name,UnknownMap = {}): # deals with special purpose keys like 'James Troup (Alternate Debian key)' # Some people put their names backwards on their key too.. check that as well if len(Attrs) == 1 and \ - (string.find(string.lower(sn),string.lower(Attrs[0][1]["sn"][0])) != -1 or \ - string.find(string.lower(cn),string.lower(Attrs[0][1]["sn"][0])) != -1): + ( sn.lower().find(Attrs[0][1]["sn"][0].lower()) != -1 or \ + cn.lower().find(Attrs[0][1]["sn"][0].lower()) != -1 ): Stat = EmailAppend+" hit for "+str(Name); return (Name[1],[Stat]); @@ -345,4 +416,18 @@ def GetUID(l,Name,UnknownMap = {}): return (None,None); - +def Group2GID(l, name): + """ + Returns the numerical id of a common group + on error returns -1 + """ + for g in DebianGroups.keys(): + if name == g: + return DebianGroups[g] + + filter = "(gid=%s)" % name + res = l.search_s(BaseDn,ldap.SCOPE_ONELEVEL,filter,["gidNumber"]); + if res: + return int(GetAttr(res[0], "gidNumber")) + + return -1