Infrastructure/fedora-infrastructure
1
0
Fork 0
Code Issues 70 Pull requests Projects Releases Packages Wiki Activity Actions

the client now works with group types properly, also seems to produce identical results when tested against hosted1.

Browse source
This commit is contained in:
Michael McGrath 2008-03-10 15:45:30 -05:00
parent c753fd8879
commit 2a63a0ff1e
1 changed files with 54 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

68
fas/client/fasClient
View file

@ -127,6 +127,7 @@ class MakeShellAccounts(BaseClient):
memberships = None
emails = None
group_mapping = {}
valid_groups = {}
def mk_tempdir(self):
self.temp = tempfile.mkdtemp('-tmp', 'fas-', config.get('global', 'temp').strip('"'))
@ -134,12 +135,39 @@ class MakeShellAccounts(BaseClient):
def rm_tempdir(self):
rmtree(self.temp)
def valid_groups(self):
''' Create a dict of valid groups, including that of group_type '''
if not self.groups:
self.group_list()
valid_groups = {'groups':[], 'restricted_groups':[], 'ssh_restricted_groups': []}
for restriction in valid_groups:
for group in config.get('host', restriction).strip('"').split(','):
if group == '':
continue
if group.startswith('@'):
for grp in self.groups:
if grp['group_type'] == group[1:]:
valid_groups[restriction].append(grp['name'])
else:
valid_groups[restriction].append(group)
self.valid_groups = valid_groups
def valid_group(self, name, restriction=None):
''' Determine if group is valid on the system '''
if restriction:
return name in self.valid_groups[restriction]
else:
for restrict_key in self.valid_groups:
if name in self.valid_groups[restrict_key]:
return True
return False
def valid_user(self, username):
valid_groups = config.get('host', 'groups').strip('"').split(',') + \
config.get('host', 'restricted_groups').strip('"').split(',') + \
config.get('host', 'ssh_restricted_groups').strip('"').split(',')
''' Is the user valid on this system '''
try:
for group in valid_groups:
for restriction in self.valid_groups:
for group in self.valid_groups[restriction]:
if username in self.group_mapping[group]:
return True
except KeyError:
@ -148,53 +176,54 @@ class MakeShellAccounts(BaseClient):
def ssh_key(self, person):
''' determine what ssh key a user should have '''
for group in config.get('host', 'groups').strip('"').split(','):
for group in self.valid_groups['groups']:
try:
if person['username'] in self.group_mapping[group]:
return person['ssh_key']
except KeyError:
print >> sys.stderr, '%s is could not be found in fas but was in your config under "groups"!' % group
print >> sys.stderr, '%s could not be found in fas but was in your config under "groups"!' % group
continue
for group in config.get('host', 'restricted_groups').strip('"').split(','):
for group in self.valid_groups['restricted_groups']:
try:
if person['username'] in self.group_mapping[group]:
return person['ssh_key']
except KeyError:
print >> sys.stderr, '%s is could not be found in fas but was in your config under "restricted_groups"!' % group
print >> sys.stderr, '%s could not be found in fas but was in your config under "restricted_groups"!' % group
continue
for group in config.get('host', 'ssh_restricted_groups').strip('"').split(','):
for group in self.valid_groups['ssh_restricted_groups']:
try:
if person['username'] in self.group_mapping[group]:
command = config.get('users', 'ssh_restricted_app').strip('"')
options = config.get('users', 'ssh_key_options').strip('"')
key = 'command="%s",%s %s' % (command, options, person['ssh_key'])
return key
except KeyError:
print >> sys.stderr, '%s is could not be found in fas but was in your config under "ssh_restricted_groups"!' % group
except TypeError:
print >> sys.stderr, '%s could not be found in fas but was in your config under "ssh_restricted_groups"!' % group
continue
return 'INVALID\n'
def shell(self, username):
''' Determine what shell username should have '''
for group in config.get('host', 'groups').strip('"').split(','):
for group in self.valid_groups['groups']:
try:
if username in self.group_mapping[group]:
return config.get('users', 'shell').strip('"')
except KeyError:
print >> sys.stderr, '%s is could not be found in fas but was in your config under "groups"!' % group
print >> sys.stderr, '%s could not be found in fas but was in your config under "groups"!' % group
continue
for group in config.get('host', 'restricted_groups').strip('"').split(','):
for group in self.valid_groups['restricted_groups']:
try:
if username in self.group_mapping[group]:
return config.get('users', 'restricted_shell').strip('"')
except KeyError:
print >> sys.stderr, '%s is could not be found in fas but was in your config under "restricted_groups"!' % group
print >> sys.stderr, '%s could not be found in fas but was in your config under "restricted_groups"!' % group
continue
for group in config.get('host', 'ssh_restricted_groups').strip('"').split(','):
for group in self.valid_groups['ssh_restricted_groups']:
try:
if username in self.group_mapping[group]:
return config.get('users', 'ssh_restricted_shell').strip('"')
except KeyError:
print >> sys.stderr, '%s is could not be found in fas but was in your config under "restricted_groups"!' % group
print >> sys.stderr, '%s could not be found in fas but was in your config under "ssh_restricted_groups"!' % group
continue
print >> sys.stderr, 'Could not determine shell for %s. Defaulting to /sbin/nologin' % username
@ -293,6 +322,7 @@ class MakeShellAccounts(BaseClient):
request = self.send_request('group/list', auth=True, input=params)
self.groups = request['groups']
self.memberships = request['memberships']
self.valid_groups()
return self.groups
def people_list(self, search='*'):
@ -372,8 +402,8 @@ class MakeShellAccounts(BaseClient):
key = self.ssh_key(person)
if not os.path.exists(ssh_dir):
os.makedirs(ssh_dir, mode=0700)
f = open(os.path.join(ssh_dir, 'authorized_keys'), 'w')
f.write(key)
f = codecs.open(os.path.join(ssh_dir, 'authorized_keys'), mode='w', encoding='utf-8')
f.write(key + '\n')
f.close()
os.chmod(os.path.join(ssh_dir, 'authorized_keys'), 0600)
os.path.walk(ssh_dir, _chown, [person['id'], person['id']])