3
cjY @ sh d dl Z d dlZd dlZd dlmZ d dlmZmZmZ d dl m
Z
m Z e j e
ZdZdLZd Zd ee d ZG d d d ZG d!d" d"Zd#d$ Zd%d& Zd'd( Zd)d* Zd+d, Zd-d. Zefd/d0Z dMd1d2Z G d3d4 d4Z ee d5d6d7Z ee d5d8d9Z d:d; Z!ee"d<d=d>Z#d?d@ Z$efdAdBZ%dCdD Z&efeeeef dEdFdGZ'dHdI Z(dJdK Z)dS )N N)suppress)ListSequenceTuple)subputilz/etc/ssh/sshd_configdsarsaecdsaed25519(ecdsa-sha2-nistp256-cert-v01@openssh.comecdsa-sha2-nistp256(ecdsa-sha2-nistp384-cert-v01@openssh.comecdsa-sha2-nistp384(ecdsa-sha2-nistp521-cert-v01@openssh.comecdsa-sha2-nistp521+sk-ecdsa-sha2-nistp256-cert-v01@openssh.com"sk-ecdsa-sha2-nistp256@openssh.com#sk-ssh-ed25519-cert-v01@openssh.comsk-ssh-ed25519@openssh.com ssh-dss-cert-v01@openssh.comssh-dss ssh-ed25519-cert-v01@openssh.com ssh-ed25519 ssh-rsa-cert-v01@openssh.comssh-rsa ssh-xmss-cert-v01@openssh.comssh-xmss@openssh.com zno-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="echo 'Please login as the user \"$USER\" rather than the user \"$DISABLE_USER\".';echo;sleep 10;exit "c @ s& e Zd ZdddZdd Zdd ZdS ) AuthKeyLineNc C s" || _ || _|| _|| _|| _d S )N)base64commentoptionskeytypesource)selfr% r$ r! r" r# r' /usr/lib/python3.6/ssh_util.py__init__H s
zAuthKeyLine.__init__c C s | j o
| jS )N)r! r$ )r& r' r' r( validQ s zAuthKeyLine.validc C sd g }| j r|j| j | jr(|j| j | jr:|j| j | jrL|j| j |sV| jS dj|S d S )N )r# appendr$ r! r" r% join)r& toksr' r' r( __str__T s zAuthKeyLine.__str__)NNNN)__name__
__module__ __qualname__r) r* r/ r' r' r' r( r G s
r c @ s" e Zd ZdZdd ZdddZdS )AuthKeyLineParsera
AUTHORIZED_KEYS FILE FORMAT
AuthorizedKeysFile specifies the file containing public keys for public
key authentication; if none is specified, the default is
~/.ssh/authorized_keys. Each line of the file contains one key (empty
(because of the size of the public key encoding) up to a limit of 8 kilo-
bytes, which permits DSA keys up to 8 kilobits and RSA keys up to 16
kilobits. You don't want to type them in; instead, copy the
identity.pub, id_dsa.pub, or the id_rsa.pub file and edit it.
sshd enforces a minimum RSA key modulus size for protocol 1 and protocol
2 keys of 768 bits.
The options (if present) consist of comma-separated option specifica-
tions. No spaces are permitted, except within double quotes. The fol-
lowing option specifications are supported (note that option keywords are
case-insensitive):
c C s d}d}x~|t |k r|s&|| d kr|| }|d t |krH|d }P ||d }|dkrn|dkrn|d }n|dkr|| }|d }q
W |d| }||d j }||fS )
z
The options (if present) consist of comma-separated option specifica-
tions. No spaces are permitted, except within double quotes.
Note that option keywords are case-insensitive.
Fr r+ \r N)r+ r4 )lenlstrip)r& entZquotediZcurcZnextcr# remainr' r' r( _extract_optionsx s
z"AuthKeyLineParser._extract_optionsNc C s |j d}|jds |j dkr(t|S dd }|j }y||\}}}W nZ tk
r | j|\} }
|d krt| }y||
\}}}W n tk
r t|S X Y nX t|||||dS )Nz
# c S s^ | j d d}t|dk r(tdt| |d tkrDtd|d t|dkrZ|jd |S )N zTo few fields: %sr zInvalid keytype %sr> )splitr7 TypeErrorVALID_KEY_TYPESr, )r9 r. r' r' r(
parse_ssh_key s
z.AuthKeyLineParser.parse..parse_ssh_key)r$ r! r" r# )rstrip
startswithstripr rA r< ) r& Zsrc_liner# linerC r9 r$ r! r" Zkeyoptsr; r' r' r( parse s*
zAuthKeyLineParser.parse)N)r0 r1 r2 __doc__r< rH r' r' r' r( r3 d s r3 c
C s g }t }g }xp| D ]h}y|}||kr>|j| q>W || |< q"W x|D ]}| j| qzW dd | D }|jd dj|S )Nc S s g | ]}|j r|qS r' )r* ).0kr' r' r(
s z*update_authorized_keys..r c S s g | ] }t |qS r' )str)rY br' r' r( r[ s r>
)listranger7 r* r! remover, r- )Z old_entrieskeysZto_addr: r9 rZ keyrT r' r' r( update_authorized_keys s
rd c C s8 t j| }| s|j r$td| tjj|jd|fS )Nz"Unable to get SSH info for user %rz.ssh)pwdgetpwnampw_dir RuntimeErrorrJ rK r- )usernamepw_entr' r' r( users_ssh_info s
rk c C sx d|fd|fdf}| sd} | j }g }xL|D ]D}x |D ]\}}|j||}q6W |jdsftjj||}|j| q,W |S )Nz%hz%u%%%z%h/.ssh/authorized_keys/)rl rm )r@ replacerE rJ rK r- r, ) valueZhomedirri ZmacrospathsZrenderedrK ZmacroZfieldr' r' r( render_authorizedkeysfile_paths s
rr c
C s d}|r d}t j|}|r@|| kr@|dkr@tjd||| | dS t j|}|| kr\|dM }n.t j|}t j| } || kr|dM }n|dM }||@ d krtjd
||| dS |r|d @ d krtjd || dS d
S )aV Check if the file/folder in @current_path has the right permissions.
We need to check that:
1. If StrictMode is enabled, the owner is either root or the user
2. the user can access the file/folder, otherwise ssh won't use it
3. If StrictMode is enabled, no write permission is given to group
and world users (022)
i i rootzXPath %s in %s must be own by user %s or by root, but instead is own by %s. Ignoring key.Fi 8 r zBPath %s in %s must be accessible by user %s, check its permissions zRPath %s in %s must not give writepermission to group or world users. Ignoring key.T)r Z get_ownerrR debugZget_permissionsZ get_groupZget_user_groups)
ri Z current_path full_pathis_file strictmodesZminimal_permissionsownerZparent_permissionZ group_ownerZ user_groupsr' r' r( check_permissions sD
r| c C s t | d }t dd }y|jddd }d}tjj|j}x|D ]}|d| 7 }tjj|rrtjd| dS tjj |rtjd| dS |j
|sF||jkrqFtjj |st j
|P d} |j}
|j} |j
|jrd } |j}
|j} tj|| d
d t j||
| W d Q R X t| ||d|} | sFdS qFW tjj|sJtjj|rZtjd | dS tjj |st j|dd
d
d t j||j|j t| ||d
|} | sdS W n6 ttfk
r }
zt jtt|
dS d }
~
X nX d
S )Nr5 rs rn r> z-Invalid directory. Symlink exists in path: %sFz*Invalid directory. File exists in path: %si i T)modeexist_okz%s is not a file!i )r} Zensure_dir_exists)rk r@ rJ rK dirnamerg islinkrR rw rL rE existsr SeLinuxGuardZpw_uidZpw_gidmakedirsZ chownbyidr| isdir
write_filerO rP rQ r\ )ri filenamerz Z
user_pwentZ
root_pwentZ directoriesZ
parent_folderZ home_folderZ directoryr} ZuidgidZ permissionser' r' r( check_create_pathJ sb
r c
C s" t | \}}tjj|d}|}g }tj|ddn y2t|}|jdd}|jdd} t||j | }W n4 t
t fk
r ||d< tj t
d t|d Y nX W d Q R X xXt|j |D ]F\}
} td
|
kd |
k| jd j|j grt| | | dk} | r| }P qW ||krt
jd
| |t|gfS )NZauthorized_keysT) recursiveZauthorizedkeysfilez%h/.ssh/authorized_keysrz yesr zhFailed extracting 'AuthorizedKeysFile' in SSH config from %r, using 'AuthorizedKeysFile' file %r insteadz%uz%hz{}/zAAuthorizedKeysFile has an user-specific authorized_keys, using %s)rk rJ rK r- r r parse_ssh_config_mapgetrr rg rO rP rQ rR DEF_SSHD_CFGzipr@ anyrE formatr rw rX )
ri Z
sshd_cfg_filessh_dirrj Zdefault_authorizedkeys_fileZuser_authorizedkeys_fileZ auth_key_fnsZssh_cfgZ key_pathsrz Zkey_path auth_key_fnZpermissions_okr' r' r( extract_authorized_keys sF
r c
C s t }g }x$| D ] }|j|jt||d qW t|\}}tjj|}tj |dd t
||} tj || dd W d Q R X d S )N)r# T)r )
preserve_mode) r3 r, rH r\ r rJ rK r r r rd r )
rb ri r# rU Z key_entriesrZ r Zauth_key_entriesr contentr' r' r( setup_user_keys s
r c @ s* e Zd ZdddZedd Zdd ZdS ) SshdConfigLineNc C s || _ || _|| _d S )N)rG _keyrp )r& rG rZ vr' r' r( r) s zSshdConfigLine.__init__c C s | j d krd S | j j S )N)r lower)r& r' r' r( rc s
zSshdConfigLine.keyc C s> | j d krt| jS t| j }| jr6|dt| j 7 }|S d S )Nr+ )r r\ rG rp )r& r r' r' r( r/ s
zSshdConfigLine.__str__)NN)r0 r1 r2 r) propertyrc r/ r' r' r' r( r s
r )returnc C s" t jj| sg S ttj| j S )N)rJ rK rL parse_ssh_config_linesr rM rN )rW r' r' r( parse_ssh_config s r c C s g }x| D ]}|j }| s&|jdr6|jt| q
y|jd d\}}W nL tk
r y|jdd\}}W n" tk
r tjd| w
Y nX Y nX |jt||| q
W |S )Nr= r5 =z;sshd_config: option "%s" has no key/value pair, skipping it)rF rE r, r r@
ValueErrorrR rw )rT retrG rc valr' r' r( r s$
r c C s: t | }|si S i }x |D ]}|js&q|j||j< qW |S )N)r rc rp )rW rT r rG r' r' r( r s
r )rW r c C sN t jj| sdS t| d*}x"|D ]}|jd| dr"dS q"W W d Q R X dS )NFrzInclude z .d/*.confT)rJ rK rL openrE )rW frG r' r' r( _includes_dconf% s
r c C s^ t | rZtjj| ds.tj| ddd tjj| dd} tjj| sZtj| d | S )Nz.di )r} z50-cloud-init.confi ) r rJ rK r r Z
ensure_dirr- rL Z ensure_file)rW r' r' r( "_ensure_cloud_init_ssh_config_file/ s r c C sP t |}t|}t|| d}|rDtj|djdd |D d dd t|dkS )zRead fname, and update if changes are necessary.
@param updates: dictionary of desired values {Option: value}
@return: boolean indicating if an update was done.)rT updatesr^ c S s g | ] }t |qS r' )r\ )rY rG r' r' r( r[ E s z%update_ssh_config..T)r r )r r update_ssh_config_linesr r r- r7 )r rW rT changedr' r' r( update_ssh_config: s r c C s t }g }tdd |j D }xt| ddD ]v\}}|js>q.|j|kr.||j }|| }|j| |j|krtjd||| q.|j | tjd|||j| ||_q.W t
|t
|kr
xN|j D ]B\}}||krq|j | | j t d|| tjdt
| || qW |S ) zUpdate the SSH config lines per updates.
@param lines: array of SshdConfigLine. This array is updated in place.
@param updates: dictionary of desired values {Option: value}
@return: A list of keys in updates that were changed.c S s g | ]}|j |fqS r' )r )rY rZ r' r' r( r[ U s z+update_ssh_config_lines..r5 )startz$line %d: option %s already set to %sz#line %d: option %s updated %s -> %sr> z line %d: option %s added with %s)
setdictrb enumeraterc addrp rR rw r, r7 itemsr ) rT r foundr Zcasemapr: rG rc rp r' r' r( r K s<
r )rT c C s> | sd S t |}dd | D }tj|dj|d ddd d S )Nc s s | ]\}}| d | V qdS )r+ Nr' )rY rZ r r' r' r( } s z$append_ssh_config..r^ ZabT)Zomoder )r r r r- )rT rW r r' r' r( append_ssh_configy s r c C sp d} t tj tjddgddgd\}} W dQ R X d}x2| jd D ]$}|j|rD|t||jd
S qDW dS ) zGet the full version of the OpenSSH sshd daemon on the system.
On an ubuntu system, this would look something like:
1.2p1 Ubuntu-1ubuntu0.1
If we can't find `sshd` or parse the version number, return None.
r> Zsshdz-Vr r5 )rcsNZOpenSSH_r^ ,)r r ZProcessExecutionErrorr@ rE r7 find)err_prefixrG r' r' r( get_opensshd_version s
$
r c C s d} t }|dkr tjj| S d|kr:|d|jd } n d|krV|d|jd } n|} ytjj| } | S ttfk
r tjd| Y nX dS )zGet the upstream version of the OpenSSH sshd dameon on the system.
This will NOT include the portable number, so if the Ubuntu version looks
like `1.2p1 Ubuntu-1ubuntu0.1`, then this function would return
`1.2`
z9.0Npr+ z Could not parse sshd version: %s) r r ZVersionZfrom_strr r rA rR Zwarning)Zupstream_versionZ full_versionr' r' r( get_opensshd_upstream_version s r )r r r
r r r
r r r r r r r r r r r r r r r r )N)*ZloggingrJ re
contextlibr Ztypingr r r Z cloudinitr r Z getLoggerr0 rR r rB Z_DISABLE_USER_SSH_EXITr\ ZDISABLE_USER_OPTSr r3 rX rd rk rr r| r r r r r r r boolr r r r r r r r' r' r' r( sh
Y EO 9
.