[Da-tools-commits] ./da-tools/userdir-ldap-sshkeys r394: make fallbacks and group resolution more sane
Mark Hymers
mhy at debian.org
Wed May 14 21:56:59 UTC 2008
------------------------------------------------------------
revno: 394
committer: Mark Hymers <mhy at debian.org>
branch nick: userdir-ldap-sshkeys
timestamp: Wed 2008-05-14 22:56:59 +0100
message:
make fallbacks and group resolution more sane
modified:
debian/changelog
ud-generate
-------------- next part --------------
=== modified file 'debian/changelog'
--- a/debian/changelog 2008-05-14 21:10:08 +0000
+++ b/debian/changelog 2008-05-14 21:56:59 +0000
@@ -1,4 +1,4 @@
-userdir-ldap (0.3.24) unstable; urgency=low
+userdir-ldap (0.3.23+common1) unstable; urgency=low
[ Stephen Gran ]
* ud-replicate: handle individual ssh keys
=== modified file 'ud-generate'
--- a/ud-generate 2008-05-14 21:05:26 +0000
+++ b/ud-generate 2008-05-14 21:56:59 +0000
@@ -7,6 +7,7 @@
# Copyright (c) 2004-2005,7 Joey Schulze <joey at infodrom.org>
# Copyright (c) 2001-2007 Ryan Murray <rmurray at debian.org>
# Copyright (c) 2008 Peter Palfrader <peter at palfrader.org>
+# Copyright (c) 2008 Mark Hymers <mhy at debian.org>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -22,7 +23,7 @@
# along with this program; if not, write to the Free Software
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-import string, re, time, ldap, getopt, sys, os, pwd, posix, socket, base64, sha, shutil, errno, tarfile
+import string, re, time, ldap, getopt, sys, os, pwd, posix, socket, base64, sha, shutil, errno, tarfile, grp
from userdir_ldap import *;
global Allowed;
@@ -114,7 +115,7 @@
try:
F = open(File + ".tdb.tmp","w");
- userlist = []
+ userlist = {}
# Fetch all the users
global PasswdAttrs;
if PasswdAttrs == None:
@@ -129,7 +130,7 @@
if len(GetAttr(x,"gecos")) > 100 or len(GetAttr(x,"loginShell")) > 50:
continue;
- userlist.append(GetAttr(x, "uid"))
+ userlist[GetAttr(x, "uid")] = GetAttr(x, "gidNumber")
Line = "%s:%s:%s:%s:%s:%s%s:%s" % (GetAttr(x,"uid"),\
PwdMarker,\
GetAttr(x,"uidNumber"),GetAttr(x,"gidNumber"),\
@@ -274,6 +275,7 @@
# Generate the group list
def GenGroup(l,File):
+ grouprevmap = {}
F = None;
try:
F = open(File + ".tdb.tmp","w");
@@ -304,6 +306,7 @@
# Output the group file.
J = 0;
for x in GroupMap.keys():
+ grouprevmap[GroupIDMap[x]] = x
if GroupIDMap.has_key(x) == 0:
continue;
Line = "%s:x:%u:" % (x,GroupIDMap[x]);
@@ -323,6 +326,8 @@
raise;
Done(File,None,F);
+ return grouprevmap
+
# Generate the email forwarding list
def GenForward(l,File):
F = None;
@@ -941,7 +946,7 @@
else:
userlist = GenPasswd(l,OutDir+"passwd",Split[1], "x");
sys.stdout.flush();
- GenGroup(l,OutDir+"group");
+ grouprevmap = GenGroup(l,OutDir+"group");
if ExtraList.has_key("[UNTRUSTED]"):
continue;
if not ExtraList.has_key("[NOPASSWD]"):
@@ -951,20 +956,43 @@
# the relevant ssh keys
if MultipleSSHFiles:
tf = tarfile.open(name=os.path.join(GlobalDir, 'ssh-keys-%s.tar.gz' % CurrentHost), mode='w:gz')
- for f in userlist:
+ for f in userlist.keys():
if f not in SSHFiles:
continue
+ # If we're not exporting their primary group, don't export
+ # the key and warn
+ grname = None
+ if userlist[f] in grouprevmap.keys():
+ grname = grouprevmap[userlist[f]]
+ else:
+ try:
+ if int(userlist[f]) <= 100:
+ # In these cases, look it up in the normal way so we
+ # deal with cases where, for instance, users are in group
+ # users as their primary group.
+ grname = grp.getgrgid(int(userlist[f]))[0]
+ except Exception, e:
+ pass
+
+ if grname is None:
+ print "User %s is supposed to have their key exported to host %s but their primary group (gid: %s) isn't in LDAP" % (f, CurrentHost, userlist[f])
+ continue
+
to = tf.gettarinfo(os.path.join(GlobalDir, 'userkeys', f), f)
# These will only be used where the username doesn't
# exist on the target system for some reason; hence,
# in those cases, the safest thing is for the file to
- # be owned by root.
+ # be owned by root but group nobody. This deals with
+ # the bloody obscure case where the group fails to exist
+ # whilst the user does (in which case we want to avoid
+ # ending up with a file which is owned user:root to avoid
+ # a fairly obvious attack vector)
to.uid = 0
- to.gid = 0
+ to.gid = 65534
# Using the username / groupname fields avoids any need
# to give a shit^W^W^Wcare about the UIDoffset stuff.
to.uname = f
- to.gname = "nobody"
+ to.gname = grname
to.mode = 0600
tf.addfile(to, file(os.path.join(GlobalDir, 'userkeys', f)))
More information about the Da-tools-commits
mailing list