CasperSecurity
o
쑛h�Y � @ sn d dl Z d dlZd dlZd dlmZ d dlmZmZmZ d dl m
Z
m Z m Z e �
e�ZdZdZdZdee� d ZG d
d � d �ZG d d
� d
�Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Z efdd�Z d7d d �Z G d d � d �Z d ee fd!d"�Z d ee fd#d$�Z!d%d&� Z"d'ed e#fd(d)�Z$d*d+� Z%efd,d-�Z&d.d/� Z'efd0eeeef fd1d2�Z(d3d4� Z)d5d6� Z*dS )8� N)�suppress)�List�Sequence�Tuple)� lifecycle�subp�utilz/etc/ssh/sshd_config)�rsa�ecdsa�ed25519z(ecdsa-sha2-nistp256-cert-v01@openssh.comzecdsa-sha2-nistp256z(ecdsa-sha2-nistp384-cert-v01@openssh.comzecdsa-sha2-nistp384z(ecdsa-sha2-nistp521-cert-v01@openssh.comzecdsa-sha2-nistp521z+sk-ecdsa-sha2-nistp256-cert-v01@openssh.comz"sk-ecdsa-sha2-nistp256@openssh.comz#sk-ssh-ed25519-cert-v01@openssh.comzsk-ssh-ed25519@openssh.comz ssh-ed25519-cert-v01@openssh.comz ssh-ed25519z ssh-rsa-cert-v01@openssh.comzssh-rsaz ssh-xmss-cert-v01@openssh.comzssh-xmss@openssh.com� z�no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="echo 'Please login as the user \"$USER\" rather than the user \"$DISABLE_USER\".';echo;sleep 10;exit �"c @ s( e Zd Z ddd�Zdd� Zdd� ZdS ) � AuthKeyLineNc C s" || _ || _|| _|| _|| _d S �N)�base64�comment�options�keytype�source)�selfr r r r r � r �4/usr/lib/python3/dist-packages/cloudinit/ssh_util.py�__init__E s
zAuthKeyLine.__init__c C s | j o| jS r )r r �r r r r �validN s zAuthKeyLine.validc C s` g }| j r |�| j � | jr|�| j� | jr |�| j� | jr&|�| j� |s+| jS d�|�S �N� )r �appendr r r r �join)r �toksr r r �__str__Q s
zAuthKeyLine.__str__)NNNN)�__name__�
__module__� __qualname__r r r r r r r r D s
� r c @ s" e Zd ZdZdd� Zddd�ZdS )�AuthKeyLineParserau
AUTHORIZED_KEYS FILE FORMAT
AuthorizedKeysFile specifies the file containing public keys for public
key authentication; if none is specified, the default is
~/.ssh/authorized_keys. Each line of the file contains one key (empty
(because of the size of the public key encoding) up to a limit of 8 kilo-
bytes, which permits DSA keys up to 8 kilobits and RSA keys up to 16
kilobits. You don't want to type them in; instead, copy the
identity.pub or the id_rsa.pub file and edit it.
sshd enforces a minimum RSA key modulus size for protocol 1 and protocol
2 keys of 768 bits.
The options (if present) consist of comma-separated option specifica-
tions. No spaces are permitted, except within double quotes. The fol-
lowing option specifications are supported (note that option keywords are
case-insensitive):
c C s� d}d}|t |�k rO|s|| dvrO|| }|d t |�kr#|d }n,||d }|dkr6|dkr6|d }n|dkr=| }|d }|t |�k rO|s|| dvs|d|� }||d� �� }||fS )z�
The options (if present) consist of comma-separated option specifica-
tions. No spaces are permitted, except within double quotes.
Note that option keywords are case-insensitive.
Fr )r � � �\r
N)�len�lstrip)r �ent�quoted�i�curc�nextcr �remainr r r �_extract_optionsu s"
� z"AuthKeyLineParser._extract_optionsNc C s� |� d�}|�d�s|�� dkrt|�S dd� }|�� }z ||�\}}}W n/ tyT | �|�\} }
|d u r9| }z ||
�\}}}W n tyQ t|� Y Y S w Y nw t|||||d�S )Nz
�#� c S s^ | � d d�}t|�dk rtdt|� ��|d tvr"td|d ��t|�dkr-|�d� |S )N� zTo few fields: %sr zInvalid keytype %sr2 )�splitr( � TypeError�VALID_KEY_TYPESr )r* r r r r �
parse_ssh_key� s
z.AuthKeyLineParser.parse.<locals>.parse_ssh_key)r r r r )�rstrip�
startswith�stripr r5 r0 ) r �src_liner �liner7 r* r r r �keyoptsr/ r r r �parse� s2
���
�zAuthKeyLineParser.parser )r! r" r# �__doc__r0 r> r r r r r$ a s r$ c
C sx g }t � }g }| D ]0}z tj�|�r&t�|��� }|D ]
}|�|�|�� qW q t t
fy9 t� t d|� Y q w |S )NzError reading lines from %s)
r$ �os�path�isfiler �load_text_file�
splitlinesr r> �IOError�OSError�logexc�LOG)�fnames�lines�parser�contents�fnamer< r r r �parse_authorized_keys� s ��rN c C s� t dd� |D ��}tt| ��D ]%}| | }|�� sq|D ]}|j|jkr/|}||v r/|�|� q || |< q|D ]}| �|� q7dd� | D �}|�d� d�|�S )Nc S s g | ]}|� � r|�qS r )r ��.0�kr r r �
<listcomp>� � z*update_authorized_keys.<locals>.<listcomp>c S � g | ]}t |��qS r ��str)rP �br r r rR � � r2 �
)�list�ranger( r r �remover r )� old_entries�keys�to_addr, r* rQ �keyrJ r r r �update_authorized_keys� s"
�
ra c C s4 t �| �}|r
|jstd| ��tj�|jd�|fS )Nz"Unable to get SSH info for user %rz.ssh)�pwd�getpwnam�pw_dir� RuntimeErrorr@ rA r )�username�pw_entr r r �users_ssh_info� s
rh c C sp d|fd|fdf}| s
d} | � � }g }|D ] }|D ]
\}}|�||�}q|�d�s0tj�||�}|�|� q|S )N�%h�%u)z%%�%�%h/.ssh/authorized_keys�/)r4 �replacer9 r@ rA r r ) �value�homedirrf �macros�paths�renderedrA �macro�fieldr r r � render_authorizedkeysfile_paths� s
rv c
C s� d}|rd}t �|�}|r || kr |dkr t�d||| |� dS t �|�}|| kr.|dM }nt �|�}t �| �} || v rA|dM }n|dM }||@ d krUt�d
||| � dS |rd|d @ rdt�d ||� dS d
S )aV Check if the file/folder in @current_path has the right permissions.
We need to check that:
1. If StrictMode is enabled, the owner is either root or the user
2. the user can access the file/folder, otherwise ssh won't use it
3. If StrictMode is enabled, no write permission is given to group
and world users (022)
i� i� �rootzXPath %s in %s must be own by user %s or by root, but instead is own by %s. Ignoring key.F� �8 � r zBPath %s in %s must be accessible by user %s, check its permissions� zRPath %s in %s must not give writepermission to group or world users. Ignoring key.T)r � get_ownerrH �debug�get_permissions� get_group�get_user_groups)
rf � current_path� full_path�is_file� strictmodes�minimal_permissions�owner�parent_permission� group_owner� user_groupsr r r �check_permissions sJ
�
� �r� c
C s� t | �d }t d�d }z�|�d�dd� }d}tj�|j�}|D ]�}|d| 7 }tj�|�r9t�d|� W dS tj� |�rIt�d|� W dS |�
|�sS||jkrTq!tj� |�s�t �
|��- d } |j}
|j} |�
|j�rvd
} |j}
|j} tj|| d d � t �||
| � W d � n1 s�w Y t| ||d|�} | s� W dS q!tj�|�s�tj�|�r�t�d
|� W dS tj� |�s�t j|ddd d� t �||j|j� t| ||d |�} | s�W dS W d S ttfy� }
zt �tt|
�� W Y d }
~
dS d }
~
ww )Nr& rw rm ���r2 z-Invalid directory. Symlink exists in path: %sFz*Invalid directory. File exists in path: %s�� rx T)�mode�exist_okz%s is not a file!� )r� �ensure_dir_exists)rh r4 r@ rA �dirnamerd �islinkrH r} rB r9 �existsr � SeLinuxGuard�pw_uid�pw_gid�makedirs� chownbyidr� �isdir�
write_filerE rF rG rV )rf �filenamer� �
user_pwent�
root_pwent� directories�
parent_folder� home_folder� directoryr� �uid�gid� permissions�er r r �check_create_pathG sv � ��
�
��
�����r� c
C s0 t | �\}}tj�|d�}|}g }tj|dd��; zt|�}|�dd�}|�dd�} t||j | �}W n t
t fyK ||d< t� t
d t|d � Y nw W d � n1 sVw Y t|�� |�D ]$\}
} td
|
v d |
v | �d �|j ��g�r�t| | | dk�} | r�| } nqb||kr�t
�d
|� |t|g�fS )N�authorized_keysT�� recursive�authorizedkeysfilerl r� �yesr zhFailed extracting 'AuthorizedKeysFile' in SSH config from %r, using 'AuthorizedKeysFile' file %r insteadrj ri z{}/zAAuthorizedKeysFile has an user-specific authorized_keys, using %s)rh r@ rA r r r� �parse_ssh_config_map�getrv rd rE rF rG rH � DEF_SSHD_CFG�zipr4 �anyr9 �formatr� r} rN )
rf �
sshd_cfg_file�ssh_dirrg �default_authorizedkeys_file�user_authorizedkeys_file� auth_key_fns�ssh_cfg� key_pathsr� �key_path� auth_key_fn�permissions_okr r r �extract_authorized_keys� s^ � ���� ���
����r� c
C s� t � }g }| D ]}|�|jt|�|d�� qt|�\}}tj�|�}tj |dd�� t
||�} tj || dd� W d � d S 1 sBw Y d S )N)r Tr� ��
preserve_mode) r$ r r> rV r� r@ rA r� r r� ra r� )
r^ rf r rK � key_entriesrQ r� �auth_key_entriesr� �contentr r r �setup_user_keys� s
"�r� c @ s* e Zd Zddd�Zedd� �Zdd� ZdS ) �SshdConfigLineNc C s || _ || _|| _d S r )r< �_keyro )r r< rQ �vr r r r � s
zSshdConfigLine.__init__c C s | j d u rd S | j �� S r )r� �lowerr r r r r` � s
zSshdConfigLine.keyc C s: | j d u r
t| j�S t| j �}| jr|dt| j� 7 }|S r )r� rV r< ro )r r� r r r r � s
zSshdConfigLine.__str__)NN)r! r" r# r �propertyr` r r r r r r� � s
r� �returnc C s" t j�| �sg S tt�| ��� �S r )r@ rA rB �parse_ssh_config_linesr rC rD �rM r r r �parse_ssh_config� s r� c C s� g }| D ]M}|� � }|r|�d�r|�t|�� qz
|�d d�\}}W n$ tyG z
|�dd�\}}W n tyD t�d|� Y Y qw Y nw |�t|||�� q|S )Nr1 r& �=z;sshd_config: option "%s" has no key/value pair, skipping it)r: r9 r r� r4 �
ValueErrorrH r} )rJ �retr< r` �valr r r r� � s, ����
r� c C s6 t | �}|si S i }|D ] }|jsq |j||j< q |S r )r� r` ro )rM rJ r� r< r r r r� s r� rM c C sb t j�| �st j�| � d��rdS t j�| �sdS t�| ��� D ]}|�d| � d��r. dS q dS )N�.dTFzInclude z .d/*.conf)r@ rA r� rB r rC rD r9 )rM r< r r r �_includes_dconf" s �r� c C s^ t | �r-tj�| � d��stj| � d�dd� tj�| � d�d�} tj�| �s-t�| d� | S )Nr� r� )r� z50-cloud-init.confr� ) r� r@ rA r� r �
ensure_dirr rB � ensure_filer� r r r �"_ensure_cloud_init_ssh_config_file/ s r� c C sP t |�}t|�}t|| d�}|r"tj|d�dd� |D ��d dd� t|�dkS )z�Read fname, and update if changes are necessary.
@param updates: dictionary of desired values {Option: value}
@return: boolean indicating if an update was done.)rJ �updatesrY c S rT r rU )rP r< r r r rR E rX z%update_ssh_config.<locals>.<listcomp>Tr� r )r� r� �update_ssh_config_linesr r� r r( )r� rM rJ �changedr r r �update_ssh_config: s � r� c C s t � }g }tdd� |�� D ��}t| dd�D ];\}}|js q|j|v rQ||j }|| }|�|� |j|kr?t�d|||� q|� |� t�d|||j|� ||_qt
|�t
|�kr�|� � D ]!\}}||v rgq^|� |� | � t d||�� t�dt
| �||� q^|S ) z�Update the SSH config lines per updates.
@param lines: array of SshdConfigLine. This array is updated in place.
@param updates: dictionary of desired values {Option: value}
@return: A list of keys in updates that were changed.c S s g | ]}|� � |f�qS r )r� rO r r r rR U rS z+update_ssh_config_lines.<locals>.<listcomp>r& )�startz$line %d: option %s already set to %sz#line %d: option %s updated %s -> %sr2 z line %d: option %s added with %s)
�set�dictr^ � enumerater` �addro rH r} r r( �itemsr� ) rJ r� �foundr� �casemapr, r< r` ro r r r r� K sD
�
��
�r� rJ c C s> | sd S t |�}dd� | D �}tj|d�|�d ddd� d S )Nc s s" � | ] \}}|� d |� �V qdS )r Nr )rP rQ r� r r r � <genexpr>} s � z$append_ssh_config.<locals>.<genexpr>rY �abT)�omoder� )r� r r� r )rJ rM r� r r r �append_ssh_configy s
�r� c C s� d} t tj�� tjddgddgd�\}} W d � n1 s w Y d}| �d �D ]}|�|�r?|t|�|�d
�� S q+dS ) z�Get the full version of the OpenSSH sshd daemon on the system.
On an ubuntu system, this would look something like:
1.2p1 Ubuntu-1ubuntu0.1
If we can't find `sshd` or parse the version number, return None.
r2 �sshdz-Vr r& )�rcsN�OpenSSH_rY �,)r r �ProcessExecutionErrorr4 r9 r( �find)�err�_�prefixr< r r r �get_opensshd_version� s
�
�r� c C s� d} t � }|du rtj�| �S d|v r |d|�d�� } nd|v r+|d|�d�� } n|} z tj�| �} | W S ttfyH t�d| � Y dS w )z�Get the upstream version of the OpenSSH sshd daemon on the system.
This will NOT include the portable number, so if the Ubuntu version looks
like `1.2p1 Ubuntu-1ubuntu0.1`, then this function would return
`1.2`
z9.0N�pr z Could not parse sshd version: %s) r� r �Version�from_strr� r� r5 rH �warning)�upstream_version� full_versionr r r � get_opensshd_upstream_version� s �r� r )+�loggingr@ rb �
contextlibr �typingr r r � cloudinitr r r � getLoggerr! rH r� r6 �_DISABLE_USER_SSH_EXITrV �DISABLE_USER_OPTSr r$ rN ra rh rv r� r� r� r� r� r� r� r� �boolr� r� r� r� r� r� r� r r r r �<module> sJ
��� Y E O
9
.