[Da-tools-commits] ./debian/userdir-ldap r452: Store a mac with confirmed sudo passwords, so that they cannot be modified by editing ldap directly
Peter Palfrader
peter at palfrader.org
Sun Sep 14 19:20:14 UTC 2008
------------------------------------------------------------
revno: 452
committer: Peter Palfrader <peter at palfrader.org>
branch nick: userdir-ldap
timestamp: Sun 2008-09-14 21:20:14 +0200
message:
Store a mac with confirmed sudo passwords, so that they cannot be modified by editing ldap directly
modified:
ud-generate
ud-mailgate
userdir_ldap.py
-------------- next part --------------
=== modified file 'ud-generate'
--- a/ud-generate 2008-09-13 18:16:16 +0000
+++ b/ud-generate 2008-09-14 19:20:14 +0000
@@ -223,14 +223,15 @@
Pass = None
for entry in x[1]['sudoPassword']:
- Match = re.compile('^('+UUID_FORMAT+') (confirmed|unconfirmed) ([a-z0-9.,*]+) ([^ ]+)$').match(entry.lower())
+ Match = re.compile('^('+UUID_FORMAT+') (confirmed:[0-9a-f]{40}|unconfirmed) ([a-z0-9.,*]+) ([^ ]+)$').match(entry.lower())
if Match == None:
continue
+ uuid = Match.group(1)
status = Match.group(2)
hosts = Match.group(3)
cryptedpass = Match.group(4)
- if status != 'confirmed':
+ if status != 'confirmed:'+make_sudopasswd_hmac('password-is-confirmed', uuid, hosts, cryptedpass):
continue
for_all = hosts == "*"
for_this_host = CurrentHost in hosts.split(',')
=== modified file 'ud-mailgate'
--- a/ud-mailgate 2008-09-13 18:16:16 +0000
+++ b/ud-mailgate 2008-09-14 19:20:14 +0000
@@ -95,14 +95,6 @@
"VoIP": None,
};
-def make_hmac(str):
- F = open(PassDir+"/key-hmac-"+pwd.getpwuid(os.getuid())[0],"r");
- key = F.readline().strip()
- F.close();
-
- return hmac.new(key, str, sha1_module).hexdigest()
-
-
# Decode a GPS location from some common forms
def LocDecode(Str,Dir):
@@ -489,7 +481,7 @@
newldap = []
for entry in inldap:
- Match = re.compile('^('+UUID_FORMAT+') (confirmed|unconfirmed) ([a-z0-9.,*]+) ([^ ]+)$').match(entry.lower())
+ Match = re.compile('^('+UUID_FORMAT+') (confirmed:[0-9a-f]{40}|unconfirmed) ([a-z0-9.,*]+) ([^ ]+)$').match(entry.lower())
if Match == None:
raise Error, "Could not parse existing sudopasswd entry"
uuid = Match.group(1)
@@ -500,13 +492,16 @@
if SudoPasswd.has_key(uuid):
confirmedHosts = SudoPasswd[uuid][0]
confirmedHmac = SudoPasswd[uuid][1]
- if status == "confirmed":
- result = result + "Entry %s for sudo password on hosts %s already confirmed.\n"%(uuid, hosts)
+ if status.startswith('confirmed:'):
+ if status == 'confirmed:'+make_sudopasswd_hmac('password-is-confirmed', uuid, hosts, cryptedpass):
+ result = result + "Entry %s for sudo password on hosts %s already confirmed.\n"%(uuid, hosts)
+ else:
+ result = result + "Entry %s for sudo password on hosts %s is listed as confirmed, but HMAC does not verify.\n"%(uuid, hosts)
elif confirmedHosts != hosts:
result = result + "Entry %s hostlist mismatch (%s vs. %s).\n"%(uuid, hosts, confirmedHosts)
- elif make_hmac(':'.join([uuid, hosts, cryptedpass])) == confirmedHmac:
+ elif make_sudopasswd_hmac('confirm-new-password', uuid, hosts, cryptedpass) == confirmedHmac:
result = result + "Entry %s for sudo password on hosts %s now confirmed.\n"%(uuid, hosts)
- status = 'confirmed'
+ status = 'confirmed:'+make_sudopasswd_hmac('password-is-confirmed', uuid, hosts, cryptedpass)
else:
result = result + "Entry %s for sudo password on hosts %s HMAC verify failed.\n"%(uuid, hosts)
del SudoPasswd[uuid]
=== modified file 'userdir_ldap.py'
--- a/userdir_ldap.py 2008-05-23 21:52:29 +0000
+++ b/userdir_ldap.py 2008-09-14 19:20:14 +0000
@@ -27,6 +27,10 @@
ConfModule = imp.load_source("userdir_config","/etc/userdir-ldap.conf",File);
File.close();
+File = open(PassDir+"/key-hmac-"+pwd.getpwuid(os.getuid())[0],"r");
+HmacKey = F.readline().strip()
+File.close();
+
# Cheap hack
BaseDn = ConfModule.basedn;
HostBaseDn = ConfModule.hostbasedn;
@@ -450,3 +454,9 @@
return int(GetAttr(res[0], "gidNumber"))
return -1
+
+def make_hmac(str):
+ return hmac.new(HmacKey, str, sha1_module).hexdigest()
+
+def make_sudopasswd_hmac(purpose, uuid, hosts, cryptedpass):
+ return make_hmac(':'.join([purpose, uuid, hosts, cryptedpass]))
More information about the Da-tools-commits
mailing list