* ud-generate: The ssh authorized_keys file for the sshdist user now wraps
the rsync call in an flock wrapper that acquires a shared lock on
ud-generate's lock. This prevents syncing while ud-generate runs.
+ * ud-lock: support supplying a status to set instead of 'retiring'.
+ * ud-generate: Also rebuild if one of our keyrings has changed, even if
+ ldap has not.
+ * userdir-ldap-slapd.conf.in: explicitly list readable attributes.
+ End with 'by * none'.
+
[ Stephen Gran ]
* Fix deprecation warnings for sha module by using hashlib module instead
[ Martin Zobel-Helas ]
* ud-generate: generate webPasswords
+ * ud-generate: generate voipPasswords
* ud-replicate: set correct permissions for web-passwords
+ * ud-replicate: set correct permissions for voip-passwords
* add freecdb to depends
* userdir-ldap.schema
- add webPasswords
- add mailPreserveSuffixSeperator
+ - add voipPasswords
+
- -- Martin Zobel-Helas <zobel@debian.org> Fri, 23 Mar 2012 19:19:16 +0100
+ -- Peter Palfrader <weasel@debian.org> Mon, 14 May 2012 18:45:07 +0200
userdir-ldap (0.3.79) unstable; urgency=low
from userdir_ldap import *
from userdir_exceptions import *
import UDLdap
+from xml.etree.ElementTree import Element, SubElement, Comment
+from xml.etree import ElementTree
+from xml.dom import minidom
try:
from cStringIO import StringIO
except ImportError:
Keyrings = ConfModule.sync_keyrings.split(":")
GitoliteSSHRestrictions = getattr(ConfModule, "gitolitesshrestrictions", None)
+def prettify(elem):
+ """Return a pretty-printed XML string for the Element.
+ """
+ rough_string = ElementTree.tostring(elem, 'utf-8')
+ reparsed = minidom.parseString(rough_string)
+ return reparsed.toprettyxml(indent=" ")
def safe_makedirs(dir):
try:
F = open(File, "w", 0600)
os.umask(OldMask)
+ root = Element('domain')
+ root.attrib['name'] = "$${sip_profile}"
+
for a in accounts:
if not 'voipPassword' in a: continue
if not a.pw_active(): continue
Pass = str(a['voipPassword'])
- Line = "<user id=\"%s\">\n <params>\n <param name=\"password\" value=\"%s\"/>\n <params />\n</user>" % (a['uid'], Pass)
- Line = Sanitize(Line) + "\n"
- F.write("%s" % (Line))
+ user = Element('user')
+ user.attrib['id'] = "%s" % (a['uid'])
+ root.append(user)
+ params = Element('params')
+ user.append(params)
+ param = Element('param')
+ params.append(param)
+ param.attrib['name'] = "a1-hash"
+ param.attrib['value'] = "%s" % (Pass)
+
+ F.write("%s" % (prettify(root)))
+
except:
Die(File, None, F)
if 'WEB-PASSWORDS' in ExtraList:
DoLink(global_dir, OutDir, "web-passwords")
+ if 'VOIP-PASSWORDS' in ExtraList:
+ DoLink(global_dir, OutDir, "voip-passwords")
+
if 'KEYRING' in ExtraList:
for k in Keyrings:
bn = os.path.basename(k)
return last
+def getLastKeyringChangeTime():
+ krmod = 0
+ for k in Keyrings:
+ mt = os.path.getmtime(k)
+ if mt > krmod:
+ krmod = mt
+
+ return krmod
+
def getLastBuildTime(gdir):
- cache_last_mod = 0
+ cache_last_ldap_mod = 0
+ cache_last_unix_mod = 0
try:
fd = open(os.path.join(gdir, "last_update.trace"), "r")
cache_last_mod=fd.read().split()
try:
- cache_last_mod = cache_last_mod[0]
- except IndexError:
+ cache_last_ldap_mod = cache_last_mod[0]
+ cache_last_unix_mod = int(cache_last_mod[1])
+ except IndexError, ValueError:
pass
fd.close()
except IOError, e:
else:
raise e
- return cache_last_mod
-
+ return (cache_last_ldap_mod, cache_last_unix_mod)
def ud_generate():
parser = optparse.OptionParser()
l = make_ldap_conn()
+ time_started = int(time.time())
ldap_last_mod = getLastLDAPChangeTime(l)
- cache_last_mod = getLastBuildTime(generate_dir)
- need_update = ldap_last_mod > cache_last_mod
+ unix_last_mod = getLastKeyringChangeTime()
+ cache_last_ldap_mod, cache_last_unix_mod = getLastBuildTime(generate_dir)
+
+ need_update = (ldap_last_mod > cache_last_ldap_mod) or (unix_last_mod > cache_last_unix_mod)
if not options.force and not need_update:
fd = open(os.path.join(generate_dir, "last_update.trace"), "w")
- fd.write("%s\n%s\n" % (ldap_last_mod, int(time.time())))
+ fd.write("%s\n%s\n" % (ldap_last_mod, time_started))
fd.close()
sys.exit(0)
tracefd = open(os.path.join(generate_dir, "last_update.trace"), "w")
generate_all(generate_dir, l)
- tracefd.write("%s\n%s\n" % (ldap_last_mod, int(time.time())))
+ tracefd.write("%s\n%s\n" % (ldap_last_mod, time_started))
tracefd.close()
sys.exit(1)
return l
-def do_one_user(lc, user, ticket):
+def do_one_user(lc, user, ticket, status):
try:
u = UDLdap.Account.from_search(lc, BaseDn, user)
except IndexError, e:
sys.stderr.write('%s: Account is not active, skipping. (details: %s)\n'%(user, u.verbose_status()))
return
- print '%s: Setting to retiring:'%(user)
+ print '%s: Setting to %s:'%(user, status)
set = {}
set['userPassword'] = '{crypt}*LK*'
set['shadowLastChange'] = str(int(time.time()/24/60/60))
set['shadowExpire'] = '1'
- set['accountStatus'] = 'retiring %s'%(time.strftime('%Y-%m-%d'))
+ set['accountStatus'] = '%s %s'%(status, time.strftime('%Y-%m-%d'))
if not ticket is None:
set['accountComment'] = "RT#%s"%(ticket)
help="Do not actually change anything.")
parser.add_option("-r", "--rt-ticket", dest="ticket", metavar="ticket#",
help="Ticket number for accountComment.")
+parser.add_option("-s", "--status", dest="status", metavar="status",
+ default='retiring',
+ help="Set status to <status> (default: retiring).")
(options, args) = parser.parse_args()
lc = connect(options.admin)
for user in args:
- do_one_user(lc, user, options.ticket)
+ do_one_user(lc, user, options.ticket, options.status)
# vim:set et:
by dn.regex="uid=.*,ou=users,@@DN@@" read
by * none
-
# rest is globally readable
-access to *
+access to attrs=access,accountComment,accountStatus,admin,allowedGroups,allowedHost,architecture,bandwidth,cn,comment,dc,description,disk,distribution,dnsTTL,dnsZoneEntry,exportOptions,gecos,gid,gidNumber,homeDirectory,host,hostname,icqUin,ipHostNumber,ircNick,jabberJID,keyFingerPrint,labeledURI,mXRecord,machine,member,memory,mn,objectClass,ou,physicalHost,purpose,shadowExpire,shadowLastChange,shadowMax,shadowMin,shadowWarning,sn,sponsor,sponsor-admin,sshRSAHostKey,status,subGroup,supplementaryGid,uid,uidNumber
by * read
+access to *
+ by * none
+
database hdb
directory "/var/lib/ldap-log"
projects / mirror / userdir-ldap.git / commitdiff