Your IP : 216.73.217.30
U
�Ad�R � @ sL d dl Z d dlZd dlmZmZmZ d dlmZ d dlm Z e�
e �Z dZ
dZdZdee� d ZG d
d � d �ZG d d
� d
�Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Ze
fdd�Zd3d d �ZG d d � d �Z ee d �d!d"�Z ee d �d#d$�Z d%d&� Z ee d'�d(d)�Z!d*d+� Z"e
fd,d-�Z#d.d/� Z$e
feeeef d0�d1d2�Z%dS )4� N)�List�Sequence�Tuple)�log)�utilz/etc/ssh/sshd_config)ZdsaZrsaZecdsaZed25519z(ecdsa-sha2-nistp256-cert-v01@openssh.comzecdsa-sha2-nistp256z(ecdsa-sha2-nistp384-cert-v01@openssh.comzecdsa-sha2-nistp384z(ecdsa-sha2-nistp521-cert-v01@openssh.comzecdsa-sha2-nistp521z+sk-ecdsa-sha2-nistp256-cert-v01@openssh.comz"sk-ecdsa-sha2-nistp256@openssh.comz#sk-ssh-ed25519-cert-v01@openssh.comzsk-ssh-ed25519@openssh.comz ssh-dss-cert-v01@openssh.comzssh-dssz ssh-ed25519-cert-v01@openssh.comz ssh-ed25519z ssh-rsa-cert-v01@openssh.comzssh-rsaz ssh-xmss-cert-v01@openssh.comzssh-xmss@openssh.com� z�no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="echo 'Please login as the user \"$USER\" rather than the user \"$DISABLE_USER\".';echo;sleep 10;exit �"c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) � AuthKeyLineNc C s" || _ || _|| _|| _|| _d S �N)�base64�comment�options�keytype�source)�selfr r r r r
� r �4/usr/lib/python3/dist-packages/cloudinit/ssh_util.py�__init__G s
zAuthKeyLine.__init__c C s | j o
| jS r
)r r �r r r r �validP s zAuthKeyLine.validc C sd g }| j r|�| j � | jr(|�| j� | jr:|�| j� | jrL|�| j� |sV| jS d�|�S d S �N� )r
�appendr r r r �join)r �toksr r r �__str__S s zAuthKeyLine.__str__)NNNN)�__name__�
__module__� __qualname__r r r r r r r r F s �
r c @ s" e Zd ZdZdd� Zddd�ZdS )�AuthKeyLineParsera�
AUTHORIZED_KEYS FILE FORMAT
AuthorizedKeysFile specifies the file containing public keys for public
key authentication; if none is specified, the default is
~/.ssh/authorized_keys. Each line of the file contains one key (empty
(because of the size of the public key encoding) up to a limit of 8 kilo-
bytes, which permits DSA keys up to 8 kilobits and RSA keys up to 16
kilobits. You don't want to type them in; instead, copy the
identity.pub, id_dsa.pub, or the id_rsa.pub file and edit it.
sshd enforces a minimum RSA key modulus size for protocol 1 and protocol
2 keys of 768 bits.
The options (if present) consist of comma-separated option specifica-
tions. No spaces are permitted, except within double quotes. The fol-
lowing option specifications are supported (note that option keywords are
case-insensitive):
c C s� d}d}|t |�k r�|s$|| dkr�|| }|d t |�krF|d }q�||d }|dkrl|dkrl|d }n|dkrz| }|d }q|d|� }||d� �� }||fS )z�
The options (if present) consist of comma-separated option specifica-
tions. No spaces are permitted, except within double quotes.
Note that option keywords are case-insensitive.
Fr )r � � �\r N)�len�lstrip)r �entZquoted�iZcurcZnextcr
�remainr r r �_extract_optionsw s
z"AuthKeyLineParser._extract_optionsNc C s� |� d�}|�d�s |�� dkr(t|�S dd� }|�� }z||�\}}}W nb tk
r� | �|�\} }
|d krt| }z||
�\}}}W n tk
r� t|� Y Y S X Y nX t|||||d�S )Nz
�#� c S s^ | � d d�}t|�dk r(tdt|� ��|d tkrDtd|d ��t|�dkrZ|�d� |S )N� zTo few fields: %sr zInvalid keytype %sr* )�splitr# � TypeError�VALID_KEY_TYPESr )r% r r r r �
parse_ssh_key� s
z.AuthKeyLineParser.parse.<locals>.parse_ssh_key)r r r r
)�rstrip�
startswith�stripr r- r( ) r Zsrc_liner
�liner/ r% r r r Zkeyoptsr' r r r �parse� s,
�zAuthKeyLineParser.parse)N)r r r �__doc__r( r4 r r r r r c s r c
C s| g }t � }g }| D ]d}z8tj�|�rLt�|��� }|D ]}|�|�|�� q6W q t t
fk
rt t� t d|� Y qX q|S )NzError reading lines from %s)
r �os�path�isfiler � load_file�
splitlinesr r4 �IOError�OSError�logexc�LOG)�fnames�lines�parser�contents�fnamer3 r r r �parse_authorized_keys� s rD c C s� t dd� |D ��}tdt| ��D ]J}| | }|�� s6q |D ]&}|j|jkr:|}||kr:|�|� q:|| |< q |D ]}| �|� qpdd� | D �}|�d� d�|�S )Nc S s g | ]}|� � r|�qS r )r ��.0�kr r r �
<listcomp>� s z*update_authorized_keys.<locals>.<listcomp>r c S s g | ] }t |��qS r ��str)rF �br r r rH � s r* �
)�list�ranger# r r �remover r )Z old_entries�keysZto_addr& r% rG �keyr@ r r r �update_authorized_keys� s
rR c C s4 t �| �}|r|js td| ��tj�|jd�|fS )Nz"Unable to get SSH info for user %rz.ssh)�pwd�getpwnam�pw_dir� RuntimeErrorr6 r7 r )�username�pw_entr r r �users_ssh_info� s
rY c C sp d|fd|fdf}| sd} | � � }g }|D ]@}|D ]\}}|�||�}q2|�d�s`tj�||�}|�|� q*|S )N�%h�%u)z%%�%�%h/.ssh/authorized_keys�/)r, �replacer1 r6 r7 r r ) �valueZhomedirrW Zmacros�pathsZrenderedr7 ZmacroZfieldr r r � render_authorizedkeysfile_paths� s
rb c
C s� d}|r d}t �|�}|r@|| kr@|dkr@t�d||| |� dS t �|�}|| kr\|dM }n.t �|�}t �| �} || kr�|dM }n|dM }||@ d kr�t�d
||| � dS |r�|d @ d kr�t�d ||� dS d
S )aV Check if the file/folder in @current_path has the right permissions.
We need to check that:
1. If StrictMode is enabled, the owner is either root or the user
2. the user can access the file/folder, otherwise ssh won't use it
3. If StrictMode is enabled, no write permission is given to group
and world users (022)
i� i� �rootzXPath %s in %s must be own by user %s or by root, but instead is own by %s. Ignoring key.F� �8 � r zBPath %s in %s must be accessible by user %s, check its permissions� zRPath %s in %s must not give writepermission to group or world users. Ignoring key.T)r Z get_ownerr> �debugZget_permissionsZ get_groupZget_user_groups)
rW Z current_path� full_path�is_file� strictmodesZminimal_permissions�ownerZparent_permissionZ group_ownerZ user_groupsr r r �check_permissions sJ
�
��rm c
C s� t | �d }t d�d }�z�|�d�dd� }d}tj�|j�}|D ]�}|d| 7 }tj�|�rtt�d|� W dS tj� |�r�t�d|� W dS |�
|�sD||jkr�qDtj� |��st �
|��P d } |j}
|j} |�
|j�r�d
} |j}
|j} tj|| d d � t �||
| � W 5 Q R X t| ||d|�} | sD W dS qDtj�|��sRtj�|��rdt�d
|� W dS tj� |��s�t j|ddd d� t �||j|j� t| ||d |�} | �s�W dS W n> ttfk
�r� }
zt �tt|
�� W Y �dS d }
~
X Y nX d S )Nr! rc r^ ���r* z-Invalid directory. Symlink exists in path: %sFz*Invalid directory. File exists in path: %s�� rd T)�mode�exist_okz%s is not a file!� )rp Zensure_dir_exists)rY r, r6 r7 �dirnamerU �islinkr> rh r8 r1 �existsr � SeLinuxGuard�pw_uid�pw_gid�makedirsZ chownbyidrm �isdir�
write_filer; r< r= rJ )rW �filenamerk Z
user_pwentZ
root_pwentZ directoriesZ
parent_folderZ home_folderZ directoryrp Zuid�gidZ permissions�er r r �check_create_pathI s� � ��� �
�
r c
C s t | �\}}tj�|d�}|}g }tj|dd��n z2t|�}|�dd�}|�dd�} t||j | �}W n4 t
t fk
r� ||d< t� t
d t|d � Y nX W 5 Q R X t|�� |�D ]H\}
} td
|
kd |
k| �d �|j ��g�r�t| | | dk�} | r�| } q�q�||k�rt
�d
|� |t|g�fS )NZauthorized_keysT�� recursiveZauthorizedkeysfiler] rk Zyesr zhFailed extracting 'AuthorizedKeysFile' in SSH config from %r, using 'AuthorizedKeysFile' file %r insteadr[ rZ z{}/zAAuthorizedKeysFile has an user-specific authorized_keys, using %s)rY r6 r7 r r rv �parse_ssh_config_map�getrb rU r; r< r= r> � DEF_SSHD_CFG�zipr, �anyr1 �formatr rh rD )
rW Z
sshd_cfg_file�ssh_dirrX Zdefault_authorizedkeys_fileZuser_authorizedkeys_fileZ auth_key_fnsZssh_cfgZ key_pathsrk Zkey_path� auth_key_fnZpermissions_okr r r �extract_authorized_keys� s` � ��
�� �
��r� c
C s| t � }g }| D ] }|�|jt|�|d�� qt|�\}}tj�|�}tj |dd�� t
||�} tj || dd� W 5 Q R X d S )N)r
Tr� ��
preserve_mode) r r r4 rJ r� r6 r7 rs r rv rR r{ )
rP rW r
rA Z key_entriesrG r� Zauth_key_entriesr� �contentr r r �setup_user_keys� s
r� c @ s* e Zd Zddd�Zedd� �Zdd� ZdS ) �SshdConfigLineNc C s || _ || _|| _d S r
)r3 �_keyr` )r r3 rG �vr r r r � s zSshdConfigLine.__init__c C s | j d krd S | j �� S r
)r� �lowerr r r r rQ � s
zSshdConfigLine.keyc C s> | j d krt| j�S t| j �}| jr6|dt| j� 7 }|S d S r )r� rJ r3 r` )r r� r r r r � s
zSshdConfigLine.__str__)NN)r r r r �propertyrQ r r r r r r� � s
r� )�returnc C s" t j�| �sg S tt�| ��� �S r
)r6 r7 r8 �parse_ssh_config_linesr r9 r: �rC r r r �parse_ssh_config� s r� c C s� g }| D ]�}|� � }|r"|�d�r2|�t|�� qz|�d d�\}}W nP tk
r� z|�dd�\}}W n& tk
r� t�d|� Y Y qY nX Y nX |�t|||�� q|S )Nr) r! �=z;sshd_config: option "%s" has no key/value pair, skipping it)r2 r1 r r� r, �
ValueErrorr> rh )r@ �retr3 rQ �valr r r r� � s& �r� c C s6 t | �}|si S i }|D ]}|js$q|j||j< q|S r
)r� rQ r` )rC r@ r� r3 r r r r� s r� )rC r� c C sV t j�| �sdS t| d��2}|D ]&}|�d| � d��r W 5 Q R � dS q W 5 Q R X dS )NF�rzInclude z .d/*.confT)r6 r7 r8 �openr1 )rC �fr3 r r r �_includes_dconf$ s r� c C s^ t | �rZtj�| � d��s.tj| � d�dd� tj�| � d�d�} tj�| �sZt�| d� | S )Nz.dro )rp z50-cloud-init.confrr ) r� r6 r7 rz r Z
ensure_dirr r8 Z ensure_filer� r r r �"_ensure_cloud_init_ssh_config_file. s r� c C sP t |�}t|�}t|| d�}|rDtj|d�dd� |D ��d dd� t|�dkS )z�Read fname, and update if changes are necessary.
@param updates: dictionary of desired values {Option: value}
@return: boolean indicating if an update was done.)r@ �updatesrL c S s g | ] }t |��qS r rI )rF r3 r r r rH D s z%update_ssh_config.<locals>.<listcomp>Tr� r )r� r� �update_ssh_config_linesr r{ r r# )r� rC r@ �changedr r r �update_ssh_config9 s �r� c C s t � }g }tdd� |�� D ��}t| dd�D ]v\}}|js<q,|j|kr,||j }|| }|�|� |j|kr~t�d|||� q,|� |� t�d|||j|� ||_q,t
|�t
|�k�r|� � D ]B\}}||kr�q�|� |� | � t d||�� t�dt
| �||� q�|S ) z�Update the SSH config lines per updates.
@param lines: array of SshdConfigLine. This array is updated in place.
@param updates: dictionary of desired values {Option: value}
@return: A list of keys in updates that were changed.c S s g | ]}|� � |f�qS r )r� rE r r r rH T s z+update_ssh_config_lines.<locals>.<listcomp>r! )�startz$line %d: option %s already set to %sz#line %d: option %s updated %s -> %sr* z line %d: option %s added with %s)
�set�dictrP � enumeraterQ �addr` r> rh r r# �itemsr� ) r@ r� �foundr� Zcasemapr& r3 rQ r` r r r r� J sN
�
�
�r� )r@ c C s> | sd S t |�}dd� | D �}tj|d�|�d ddd� d S )Nc s s | ]\}}|� d |� �V qdS )r Nr )rF rG r� r r r � <genexpr>| s z$append_ssh_config.<locals>.<genexpr>rL ZabT)Zomoder� )r� r r{ r )r@ rC r� r r r �append_ssh_configx s �r� )N)&r6 rS �typingr r r Z cloudinitr Zloggingr Z getLoggerr r> r� r. Z_DISABLE_USER_SSH_EXITrJ ZDISABLE_USER_OPTSr r rD rR rY rb rm r r� r� r� r� r� r� �boolr� r� r� r� r� r r r r �<module> sB
��� Y EO 9
.