aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Scherer <misc@mageia.org>2010-11-17 14:17:29 +0000
committerMichael Scherer <misc@mageia.org>2010-11-17 14:17:29 +0000
commit1bd9a3ad4a149551f3b4359f766c12bee8e41053 (patch)
treef509a9aeabff01053461c4dfded77e1b8365ff25
parent3166c4ac7a09197d43b3ffcec275fe81ef99e3c4 (diff)
downloadpuppet-1bd9a3ad4a149551f3b4359f766c12bee8e41053.tar
puppet-1bd9a3ad4a149551f3b4359f766c12bee8e41053.tar.gz
puppet-1bd9a3ad4a149551f3b4359f766c12bee8e41053.tar.bz2
puppet-1bd9a3ad4a149551f3b4359f766c12bee8e41053.tar.xz
puppet-1bd9a3ad4a149551f3b4359f766c12bee8e41053.zip
- import mandriva script to export ssh keys ( need some cleaning )
-rw-r--r--modules/restrictshell/manifests/init.pp17
-rwxr-xr-xmodules/restrictshell/templates/ldap-sshkey2file.py92
2 files changed, 109 insertions, 0 deletions
diff --git a/modules/restrictshell/manifests/init.pp b/modules/restrictshell/manifests/init.pp
index b10c7915..2618f401 100644
--- a/modules/restrictshell/manifests/init.pp
+++ b/modules/restrictshell/manifests/init.pp
@@ -26,4 +26,21 @@ class restrictshell {
mode => 755,
content => template("restrictshell/membersh-conf.pl"),
}
+
+ package { 'python-ldap':
+ ensure => installed,
+ }
+
+ file { '/usr/local/bin/ldap-sshkey2file.py':
+ ensure => present,
+ owner => root,
+ group => root,
+ mode => 755,
+ content => template("restrictshell/ldap-sshkey2file.py"),
+ requires => Package['python-ldap']
+ }
+
+
+
+
}
diff --git a/modules/restrictshell/templates/ldap-sshkey2file.py b/modules/restrictshell/templates/ldap-sshkey2file.py
new file mode 100755
index 00000000..3925176f
--- /dev/null
+++ b/modules/restrictshell/templates/ldap-sshkey2file.py
@@ -0,0 +1,92 @@
+#!/usr/bin/python
+
+import sys
+import os
+import random
+
+try:
+ import ldap
+except ImportError, e:
+ print "Please install python-ldap before running this program"
+ sys.exit(1)
+
+basedn="dc=mandriva,dc=com"
+peopledn="ou=people,%s" % basedn
+uris=['ldap://kenobi.mandriva.com','ldap://svn.mandriva.com']
+random.shuffle(uris)
+uri = " ".join(uris)
+timeout=5
+binddn="uid=sshkeyreader,ou=System Accounts,%s" % basedn
+pwfile="/etc/sshkeyreader.pw"
+# filter out disabled accounts also
+# too bad uidNumber doesn't support >= filters
+filter="(&(objectClass=inetOrgPerson)(objectClass=ldapPublicKey)(objectClass=posixAccount)(sshPublicKey=*)(!(shadowExpire=*)))"
+keypathprefix="/var/lib/config/pubkeys"
+
+def usage():
+ print "%s" % sys.argv[0]
+ print
+ print "Will fetch all enabled user accounts under %s" % peopledn
+ print "with ssh keys in them and write each one to"
+ print "%s/<login>/authorized_keys" % keypathprefix
+ print
+ print "This script is intented to be run from cron as root"
+ print
+
+def get_pw(pwfile):
+ try:
+ f = open(pwfile, 'r')
+ except IOError, e:
+ print "Error while reading password file, aborting"
+ print e
+ sys.exit(1)
+ pw = f.readline().strip()
+ f.close()
+ return pw
+
+def write_keys(keys, user, uid, gid):
+ try:
+ os.makedirs("%s/%s" % (keypathprefix,user), 0700)
+ except:
+ pass
+ keyfile = "%s/%s/authorized_keys" % (keypathprefix,user)
+ f = open(keyfile, 'w')
+ for key in keys:
+ f.write(key.strip() + "\n")
+ f.close()
+ os.chmod(keyfile, 0600)
+ os.chown(keyfile, uid, gid)
+ os.chmod("%s/%s" % (keypathprefix,user), 0700)
+ os.chown("%s/%s" % (keypathprefix,user), uid, gid)
+
+if len(sys.argv) != 1:
+ usage()
+ sys.exit(1)
+
+bindpw = get_pw(pwfile)
+
+try:
+ ld = ldap.initialize(uri)
+ ld.set_option(ldap.OPT_NETWORK_TIMEOUT, timeout)
+ ld.start_tls_s()
+ ld.bind_s(binddn, bindpw)
+ res = ld.search_s(peopledn, ldap.SCOPE_ONELEVEL, filter, ['uid','sshPublicKey','uidNumber','gidNumber'])
+ try:
+ os.makedirs(keypathprefix, 0701)
+ except:
+ pass
+ for result in res:
+ dn, entry = result
+ # skip possible system users
+ if int(entry['uidNumber'][0]) < 500:
+ continue
+ write_keys(entry['sshPublicKey'], entry['uid'][0], int(entry['uidNumber'][0]), int(entry['gidNumber'][0]))
+ ld.unbind_s()
+except Exception, e:
+ print "Error"
+ raise
+
+sys.exit(0)
+
+
+# vim:ts=4:sw=4:et:ai:si