* ud-generate: Remove support for single ssh key shadow file.

* ud-generate: Make ssh key tarballs the default.
* ud-generate: Move ssh tarball generation into its own function.  Currently it's part of the main loop.

diff --git a/debian/changelog b/debian/changelog
index baca0e5..50b13ee 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+userdir-ldap (0.3.48) unstable; urgency=low
+
+  * ud-generate: Remove support for single ssh key shadow file.
+  * ud-generate: Make ssh key tarballs the default.
+  * ud-generate: Move ssh tarball generation into its own function.
+    Currently it's part of the main loop.
+
+ -- Peter Palfrader <weasel@debian.org>  Fri, 14 Nov 2008 23:04:21 +0100
+
 userdir-ldap (0.3.47) unstable; urgency=low
 
   * Fix a typo on ud-mailgate.

diff --git a/ud-generate b/ud-generate
index 1a3d3f6..d209700 100755 (executable)
--- a/ud-generate
+++ b/ud-generate
@@ -256,30 +256,17 @@ def GenShadowSudo(l,File, untrusted):
   Done(File,F,None);
 
 # Generate the shadow list
-def GenSSHShadow(l,masterFileName):
+def GenSSHShadow(l):
    # Fetch all the users
    singlefile = None
    userfiles = []
-   # Depending on config, we write out either a single file,
-   # multiple files, or both
-   if SingleSSHFile:
-       try:
-           OldMask = os.umask(0077);
-           masterFile = open(masterFileName + ".tmp","w",0600);
-           os.umask(OldMask);
-       except IOError:
-           Die(masterFileName,masterFile,None)
-           raise
 
    global PasswdAttrs;
    if PasswdAttrs == None:
       raise "No Users";
 
-   # If we're going to be dealing with multiple keys, empty the
-   # directory before we start to avoid old keys hanging around
-   if MultipleSSHFiles:
-      safe_rmtree(os.path.join(GlobalDir, 'userkeys'))
-      safe_makedirs(os.path.join(GlobalDir, 'userkeys'))
+   safe_rmtree(os.path.join(GlobalDir, 'userkeys'))
+   safe_makedirs(os.path.join(GlobalDir, 'userkeys'))
 
    for x in PasswdAttrs:
       # If the account is locked, do not write it.
@@ -296,25 +283,18 @@ def GenSSHShadow(l,masterFileName):
       F = None;
 
       try:
-         if MultipleSSHFiles:
-             OldMask = os.umask(0077);
-             File = os.path.join(GlobalDir, 'userkeys', User)
-             F = open(File + ".tmp","w",0600);
-             os.umask(OldMask);
+         OldMask = os.umask(0077);
+         File = os.path.join(GlobalDir, 'userkeys', User)
+         F = open(File + ".tmp","w",0600);
+         os.umask(OldMask);
 
          for I in x[1]["sshRSAAuthKey"]:
-             if MultipleSSHFiles:
-                 MultipleLine = "%s" % I
-                 MultipleLine = Sanitize(MultipleLine) + "\n"
-                 F.write(MultipleLine)
-             if SingleSSHFile:
-                 SingleLine = "%s: %s" % (User, I)
-                 SingleLine = Sanitize(SingleLine) + "\n"
-                 masterFile.write(SingleLine)
-
-         if MultipleSSHFiles:
-             Done(File,F,None);
-             userfiles.append(os.path.basename(File))
+            MultipleLine = "%s" % I
+            MultipleLine = Sanitize(MultipleLine) + "\n"
+            F.write(MultipleLine)
+
+         Done(File,F,None);
+         userfiles.append(os.path.basename(File))
 
       # Oops, something unspeakable happened.
       except IOError:
@@ -322,11 +302,54 @@ def GenSSHShadow(l,masterFileName):
           Die(masterFileName,masterFile,None)
           raise;
 
-   if SingleSSHFile:
-       Done(masterFileName,masterFile,None)
-       singlefile = os.path.basename(masterFileName)
+   return userfiles
+
+def GenSSHtarballs(userlist, SSHFiles, grouprevmap, target):
+   OldMask = os.umask(0077);
+   tf = tarfile.open(name=os.path.join(GlobalDir, 'ssh-keys-%s.tar.gz' % CurrentHost), mode='w:gz')
+   os.umask(OldMask);
+   for f in userlist.keys():
+      if f not in SSHFiles:
+         continue
+      # If we're not exporting their primary group, don't export
+      # the key and warn
+      grname = None
+      if userlist[f] in grouprevmap.keys():
+         grname = grouprevmap[userlist[f]]
+      else:
+         try:
+            if int(userlist[f]) <= 100:
+               # In these cases, look it up in the normal way so we
+               # deal with cases where, for instance, users are in group
+               # users as their primary group.
+               grname = grp.getgrgid(userlist[f])[0]
+         except Exception, e:
+            pass
 
-   return singlefile, userfiles
+      if grname is None:
+         print "User %s is supposed to have their key exported to host %s but their primary group (gid: %d) isn't in LDAP" % (f, CurrentHost, userlist[f])
+         continue
+
+      to = tf.gettarinfo(os.path.join(GlobalDir, 'userkeys', f), f)
+      # These will only be used where the username doesn't
+      # exist on the target system for some reason; hence,
+      # in those cases, the safest thing is for the file to
+      # be owned by root but group nobody.  This deals with
+      # the bloody obscure case where the group fails to exist
+      # whilst the user does (in which case we want to avoid
+      # ending up with a file which is owned user:root to avoid
+      # a fairly obvious attack vector)
+      to.uid = 0
+      to.gid = 65534
+      # Using the username / groupname fields avoids any need
+      # to give a shit^W^W^Wcare about the UIDoffset stuff.
+      to.uname = f
+      to.gname = grname
+      to.mode  = 0400
+      tf.addfile(to, file(os.path.join(GlobalDir, 'userkeys', f)))
+
+   tf.close()
+   os.rename(os.path.join(GlobalDir, 'ssh-keys-%s.tar.gz' % CurrentHost), target)
 
 # Generate the group list
 def GenGroup(l,File):
@@ -902,6 +925,7 @@ def GenKeyrings(l,OutDir):
   for k in Keyrings:
     shutil.copy(k, OutDir)
 
+
 # Connect to the ldap server
 l = connectLDAP()
 F = open(PassDir+"/pass-"+pwd.getpwuid(os.getuid())[0],"r");
@@ -942,7 +966,7 @@ else:
 
 # Generate global things
 GlobalDir = GenerateDir+"/";
-SSHGlobal, SSHFiles = GenSSHShadow(l,GlobalDir+"ssh-rsa-shadow");
+SSHFiles = GenSSHShadow(l);
 GenAllForward(l,GlobalDir+"mail-forward.cdb");
 GenMarkers(l,GlobalDir+"markers");
 GenPrivate(l,GlobalDir+"debian-private");
@@ -992,10 +1016,6 @@ while(1):
      Allowed = None
    CurrentHost = Split[0];
 
-   # If we're using a single SSH file, deal with it
-   if SSHGlobal is not None:
-      DoLink(GlobalDir, OutDir, SSHGlobal)
-
    DoLink(GlobalDir,OutDir,"debianhosts");
    DoLink(GlobalDir,OutDir,"ssh_known_hosts");
    DoLink(GlobalDir,OutDir,"disabled-accounts")
@@ -1011,53 +1031,7 @@ while(1):
 
    # Now we know who we're allowing on the machine, export
    # the relevant ssh keys
-   if MultipleSSHFiles:
-      OldMask = os.umask(0077);
-      tf = tarfile.open(name=os.path.join(GlobalDir, 'ssh-keys-%s.tar.gz' % CurrentHost), mode='w:gz')
-      os.umask(OldMask);
-      for f in userlist.keys():
-        if f not in SSHFiles:
-            continue
-        # If we're not exporting their primary group, don't export
-        # the key and warn
-        grname = None
-        if userlist[f] in grouprevmap.keys():
-            grname = grouprevmap[userlist[f]]
-        else:
-            try:
-                if int(userlist[f]) <= 100:
-                    # In these cases, look it up in the normal way so we
-                    # deal with cases where, for instance, users are in group
-                    # users as their primary group.
-                    grname = grp.getgrgid(userlist[f])[0]
-            except Exception, e:
-                pass
-
-        if grname is None:
-            print "User %s is supposed to have their key exported to host %s but their primary group (gid: %d) isn't in LDAP" % (f, CurrentHost, userlist[f])
-            continue
-
-        to = tf.gettarinfo(os.path.join(GlobalDir, 'userkeys', f), f)
-        # These will only be used where the username doesn't
-        # exist on the target system for some reason; hence,
-        # in those cases, the safest thing is for the file to
-        # be owned by root but group nobody.  This deals with
-        # the bloody obscure case where the group fails to exist
-        # whilst the user does (in which case we want to avoid
-        # ending up with a file which is owned user:root to avoid
-        # a fairly obvious attack vector)
-        to.uid = 0
-        to.gid = 65534
-        # Using the username / groupname fields avoids any need
-        # to give a shit^W^W^Wcare about the UIDoffset stuff.
-        to.uname = f
-        to.gname = grname
-        to.mode  = 0400
-        tf.addfile(to, file(os.path.join(GlobalDir, 'userkeys', f)))
-
-      tf.close()
-      os.rename(os.path.join(GlobalDir, 'ssh-keys-%s.tar.gz' % CurrentHost),
-                os.path.join(OutDir, 'ssh-keys.tar.gz'))
+   GenSSHtarballs(userlist, SSHFiles, grouprevmap, os.path.join(OutDir, 'ssh-keys.tar.gz'))
 
    if ExtraList.has_key("[UNTRUSTED]"):
      print "[UNTRUSTED] tag is obsolete and may be removed in the future."

diff --git a/userdir-ldap.conf b/userdir-ldap.conf
index ad37d9d..975f341 100644 (file)
--- a/userdir-ldap.conf
+++ b/userdir-ldap.conf
@@ -37,8 +37,6 @@ defaultgid = 800;
 # For the output generator
 generateconf = "/etc/userdir-ldap/generate.conf"
 generatedir = "/var/cache/userdir-ldap/hosts/";
-singlesshfile = True
-multiplesshfiles = False
 passdir = "/etc/userdir-ldap/";
 
 # GPG Things

diff --git a/userdir_ldap.py b/userdir_ldap.py
index c84a655..4477232 100644 (file)
--- a/userdir_ldap.py
+++ b/userdir_ldap.py
@@ -1,6 +1,7 @@
 #   Copyright (c) 1999-2000  Jason Gunthorpe <jgg@debian.org>
 #   Copyright (c) 2001-2003  Ryan Murray <rmurray@debian.org>
 #   Copyright (c) 2004-2005  Joey Schulze <joey@infodrom.org>
+#   Copyright (c) 2008 Peter Palfrader <peter@palfrader.org>
 #
 #   This program is free software; you can redistribute it and/or modify
 #   it under the terms of the GNU General Public License as published by
@@ -43,10 +44,6 @@ PassDir = ConfModule.passdir;
 Ech_ErrorLog = ConfModule.ech_errorlog;
 Ech_MainLog = ConfModule.ech_mainlog;
 
-# For backwards compatibility, we default to the old behaviour
-MultipleSSHFiles = getattr(ConfModule, 'multiplesshfiles', False)
-SingleSSHFile = getattr(ConfModule, 'singlesshfile', True)
-
 try:
    UseSSL = ConfModule.usessl;
 except AttributeError: