D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
lib
/
python3.9
/
site-packages
/
ipaclient
/
install
/
__pycache__
/
Filename :
ipa_epn.cpython-39.pyc
back
Copy
a }�fQs � @ s� d Z ddlmZmZ ddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl mZ ddlmZmZmZ ejZddlmZmZ ddlmZ ddlmZ dd lm Z dd lm Z dd l m Z dd l!m"Z" dd l#m$Z$m%Z% ddl&m'Z' ddl(m)Z)m*Z* ddl+m,Z, ddl-m.Z.m/Z/m0Z0 dZ1ddddddddddddddddd d �Z2e �3e4�Z5d)d d �Z6G d!d"� d"�Z7G d#d$� d$e)j8�Z9G d%d&� d&�Z:G d'd(� d(�Z;dS )*zoThis tool prepares then sends email notifications to users whose passwords are expiring in the near future. � )�absolute_import�print_functionN)�deque)�datetime� timedelta�timezone)� formataddr� formatdate)� MIMEMultipart)�MIMEText)�Header)� make_msgid��error)�paths)�api�errors)�is_ipa_client_configured)� admintool�ipaldap)�DN)� Environment�FileSystemLoader�TemplateSyntaxErrorz/etc/ipa/epn.conf� localhost� �< �nonezroot@localhost�IPA-EPNz 28,14,7,3,1�utf8�plainz Your password will expire soon.)� smtp_server� smtp_port� smtp_user� smtp_password�smtp_client_cert�smtp_client_key�smtp_client_key_pass� smtp_timeout� smtp_security� smtp_admin� smtp_delay� mail_from�mail_from_name� notify_ttls� msg_charset� msg_subtype� msg_subject�daemonc C s� zht �� dkrW dS t �g � t �t�| �j� t �t� |�j � t �� dkrXt � d��t �d| |� W n4 ty� } z t �d| ||� W Y d}~n d}~0 0 dS )z0Drop privileges, defaults to daemon:daemon. r NzCannot drop privileges!z'Dropped privileges to user=%s, group=%sz'Failed to drop privileges to %s, %s: %s)�os�getuid� setgroups�setgid�pwd�getpwnam�pw_uid�setuid�grp�getgrnam�gr_gidr Z RequiresRoot�logger�debug� Exceptionr )Z new_usernameZ new_groupname�e� rB �=/usr/lib/python3.9/site-packages/ipaclient/install/ipa_epn.py�drop_privilegesN s( ��rD c @ sZ e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z dd� Z ddd�Z dd� Z dS )� EPNUserLista" Maintains a list of users whose passwords are expiring. Provides add(), check(), pop(), and json_print(). From the outside, the list is considered always sorted: * displaying the list results in a sorted JSON representation thereof * pop() returns the "most urgent" item from the list. Internal implementation notes: * Uses a deque instead of a list for efficiency reasons * all add()-style methods MUST set _sorted to False. * all print() and pop-like methods MUST call _sort() first. c C s d| _ t� | _d S )NF)�_sortedr �_expiring_password_user_dq��selfrB rB rC �__init__w s zEPNUserList.__init__c C s t | j�S )z)If it quacks like a container... )�boolrG rH rB rB rC �__bool__{ s zEPNUserList.__bool__c C s t | j�S )zReturn len(self).)�lenrG rH rB rB rC �__len__� s zEPNUserList.__len__c C s t |�|dg��d��S )z9Get a single value from a multi-valued attr in a safe way� r )�str�get�pop)rI �entry�attrrB rB rC � get_ldap_attr� s zEPNUserList.get_ldap_attrc C s� zzd| _ |�d�du r*t�d|j� W dS | j�t| �|d�| �|d�| �|d�| �|d�| �|d �t |�d��d �� W n0 t y� } zt� d |� W Y d}~n d}~0 0 dS ) z�Parses and appends an LDAP user entry with the uid, cn, givenname, sn, krbpasswordexpiration and mail attributes. F�mailNz(IPA-EPN: No mail address defined for: %s�uid�cn� givenname�sn�krbpasswordexpiration�rW rX rY rZ r[ rV z"IPA-EPN: Could not parse entry: %s) rF rQ r> r ZdnrG �append�dictrU rP � IndexError�info�rI rS rA rB rB rC �add� s& � �� zEPNUserList.addc C s. | � � z | j�� W S ty( Y dS 0 dS )zPReturns the "most urgent" user to notify. In fact: popleft() FN)�_sortrG �popleftr_ rH rB rB rC rR � s zEPNUserList.popc C s | j dd� d S )NF�� really_print)� json_printrH rB rB rC �check� s zEPNUserList.checkTc C sn z8| � � tjt| j�ddd�}|�d� |r6t|� W n0 tyh } zt� d|� W Y d}~n d}~0 0 dS )z�Dump self._expiring_password_user_dq to JSON. Check that the result can be re-rencoded to UTF-8. If really_print, print the result. � F)�indentZ ensure_asciir z IPA-EPN: unexpected error: %sN) rc �json�dumps�listrG �encode�printr@ r> r )rI rf Ztemp_strrA rB rB rC rg � s � zEPNUserList.json_printc C s4 | j s0t| jt�r0tt| jdd� d��| _d| _ d S )Nc S s | d S )Nr[ rB )�itemrB rB rC �<lambda>� � z#EPNUserList._sort.<locals>.<lambda>)�keyT)rF � isinstancerG r �sortedrH rB rB rC rc � s ��zEPNUserList._sortN)T) �__name__� __module__� __qualname__�__doc__rJ rL rN rU rb rR rh rg rc rB rB rB rC rE k s rE c s� e Zd ZdZejZdZdZ� fdd�Z e � fdd��Z � fdd �Z d/� fd d � Z � fd d�Zd0dd�Zdd� Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd1d'd(�Zd)d*� Zd+d,� Z d-d.� Z � Z S )2�EPNr z%prog [options]z%Expiring Password Notifications (EPN)c sH t t| ��||� d | _d | _t� | _g | _g | _d | _ d | _ d | _ d S �N) �superrz rJ �_conn� _ssl_contextrE � _expiring_password_user_list� _ldap_data� _date_ranges�_mailer�env�default_email_domain)rI �options�args�� __class__rB rC rJ � s z EPN.__init__c sh t t| �j|dd� |jdddd dd� |jdd dd d d� |jd d d ddd� |jddd ddd� d S )NT)Z debug_optionz --from-nbdays� from_nbdays�storezminimal number of days)�dest�action�default�helpz --to-nbdays� to_nbdayszmaximal number of daysz --dry-run�dry_run� store_trueFz Dry run mode. JSON ouput only.z --mail-test�mailtestzSend a test e-mail)r| rz � add_optionsZ add_option)�cls�parserr� rB rC r� � s: ����zEPN.add_optionsc sl t t| �jdd� | jjd ur|z t| jj�dk r8td��W n8 tyr } z | j� dj |d�� W Y d }~n d }~0 0 d| j_ | jj d ur�z t| jj �dk r�td��W n8 ty� } z | j� dj |d�� W Y d }~n d }~0 0 | jj d u�r | jjd u�r t| jj �t| jj�k�r | j� d� | jj d u�rH| jjd u �rH| j� d � | jj �rh| jj �rh| j� d � d S ) NT)Z needs_rootr zInput is negative.z/--to-nbdays must be a positive integer. {error}r z1--from-nbdays must be a positive integer. {error}z/--from-nbdays must be smaller than --to-nbdays.z4You cannot specify --from-nbdays without --to-nbdaysz5You cannot specify --mail-test and --dry-run together)r| rz �validate_optionsr� r� �int� RuntimeErrorr@ Z option_parserr �formatr� r� r� �rI rA r� rB rC r� � sN �� �� �� ���zEPN.validate_options�ac s t t| �jdd� d S )Nr� )� log_file_mode)r| rz � setup_logging)rI r� r� rB rC r� # s zEPN.setup_loggingc s t t| ��� t� s&t�d� t�� �| �� | � � | � � | � � | � � | � � | �� t� | jjrv| �� n.| jjr�| �� | jD ]}| �|� | �� q�| jjr�| �� nJttj j tj j tj j tj j tj j!tj j"| j#| j$tj j%tj j&d� | _'| �(� d S )Nz,IPA client is not configured on this system.) �security_protocol� smtp_hostnamer" r( � smtp_usernamer$ � ssl_context�x_mailerr0 r/ ))r| rz �runr r> r r � ScriptError�_get_krb5_ticket�_read_configuration�_validate_configuration�_parse_configuration�_get_connection�_read_ipa_configuration�_create_ssl_contextrD r� r� � _gentestdatar� �_build_cli_date_rangesr� �_fetch_data_from_ldap�_parse_ldap_datar� �_pretty_print_data� MailUserAgentr r� r) r! r" r( r# r$ r~ � command_namer0 r/ r� � _send_emails)rI � date_ranger� rB rC r� & sD � zEPN.runNc C sl t jtd�}t �|t j�� �}|t|d� }|durD|t|d� }n|tdd� }t�d||||� ||fS )z�Detects current time and returns a date range, given a number of days in the future. If only nbdays_end is specified, the range is 1d long. �Ztz)�daysN� z�IPA-EPN: Current date: %s IPA-EPN: Date & time, today at midnight: %s IPA-EPN: Date range start: %s IPA-EPN: Date range end: %s ) r �now�UTCZcombine�min�timer r> r? )rI � nbdays_end� nbdays_startr� Ztoday_at_midnightZ range_endZ range_startrB rB rC �_get_date_range_from_nbdaysP s � z EPN._get_date_range_from_nbdaysc C sB |� � }t|j�d�dd� |j|j|j|j|jfD �� }|d S )zgConvert datetime to LDAP_GENERALIZED_TIME_FORMAT Note: Consider moving into ipalib. rO c s s* | ]"}d dt t|�� t|� V qdS )�0� N)rM rP )�.0rp rB rB rC � <genexpr>n s �z4EPN._datetime_to_generalized_time.<locals>.<genexpr>�Z) Z timetuplerP �tm_year�join�tm_mon�tm_mday�tm_hour�tm_min�tm_sec)rI ZdtZgeneralized_time_strrB rB rC � _datetime_to_generalized_timei s �� z!EPN._datetime_to_generalized_timec C s t j�dd� dt jd< dS )z�Setup the environment to obtain a krb5 ticket for us using the system keytab. Uses CCACHE = MEMORY (limited to the current process). ZKRB5_CLIENT_KTNAMEz/etc/krb5.keytabzMEMORY:Z KRB5CCNAMEN)r3 �environ� setdefaultrH rB rB rC r� z s zEPN._get_krb5_ticketc C sH t dtjdd�}tjf i |�� tjjf i t�� t�d�sDt� � dS )z5Merge in the EPN configuration from /etc/ipa/epn.conf�epnF)�context�confdirZ in_server�finalizeN) r^ r ZETC_IPAr Z bootstrapr� Z_merge� EPN_CONFIGZisdoner� )rI Z base_configrB rB rC r� � s � zEPN._read_configurationc C s t jj�� dvrtd��t jjdur8t jjdu r8td��t jjdu rPtdt ��z dd� t t jj�� d�D � W n8 t y� } z td t jj|f ��W Y d}~n d}~0 0 t jj �rzt t jj � W n0 t y� } ztd | ��W Y d}~n d}~0 0 t t jj �d k �rtd ��dS ) z1Examine the user-provided configuration. )r �starttls�sslz3smtp_security must be one of: none, starttls or sslNz&smtp_user set and smtp_password is notz notify_ttls must be set in %sc S s g | ] }t |��qS rB �r� �r� �krB rB rC � <listcomp>� rr z/EPN._validate_configuration.<locals>.<listcomp>�,z%Failed to parse notify_ttls: '%s': %sz smtp_delay is misformatted: %sr z#smtp_delay cannot be less than zero)r r� r) �lowerr� r# r$ r. �EPN_CONFrP �split� ValueErrorr+ �floatr� rB rB rC r� � s* � � "zEPN._validate_configurationc C sn dd� t tjj��d�D �}|�� |D ] }| j�| jd|d d�� q(t t j � tjj d��}t|d�| _dS ) z c S s g | ] }t |��qS rB r� r� rB rB rC r� � rr z,EPN._parse_configuration.<locals>.<listcomp>r� Nr� �r� r� r� )�loader)rP r r� r. r� �sortr� r] r� r r3 �pathr� r� r )rI ZdaylistZdayr� rB rB rC r� � s ��zEPN._parse_configurationc C s> t jj�� t j�� d }|�ddg�d | _t jj�� dS )zGet the IPA configuration�resultZipadefaultemaildomainNr ) r ZBackendZ rpcclientZconnectZCommandZ config_showrQ r� Z disconnect)rI r� rB rB rC r� � s ��zEPN._read_ipa_configurationc C s� | j dur| j S z tj�tjj�| _ | j �� W nj ty� z tj� tjj �| _ | j � � W n6 ty� } z t � d| j j|� W Y d}~n d}~0 0 Y n0 | j S )z4Create a connection to LDAP and bind to it. Nz$Unable to bind to LDAP server %s: %s)r} r Z LDAPClientZ from_realmr r� ZrealmZ external_bindr@ Zfrom_hostname_secureZserverZ gssapi_bindr> r Zldap_urir� rB rB rC r� � s$ �� zEPN._get_connectionc C sH t jj�� dv rDt�� | _t jjrD| jjt jjt jj t t jj �d� dS )z�Create SSL context. This must be done before the dropping priviliges to allow read in the smtp client's certificate and private key if specified. )r� r� )ZcertfileZkeyfile�passwordN) r r� r) r� r� Zcreate_default_contextr~ r% Zload_cert_chainr& rP r' rH rB rB rC r� � s �zEPN._create_ssl_contextc C s� | j du rt�d� ttjjtjj�}g d�}d| �|d �| �|d �f }zTz | j j |||| j j d�| _ W n t j y� t�d� Y n0 W t�d t| j �� nt�d t| j �� 0 dS ) z�Run a LDAP query to fetch a list of user entries whose passwords would expire in the near future. Store in self._ldap_data. Nz5IPA-EPN: Connection to LDAP not established. Exiting.)rW r[ rV rX rY Zsurnamezj(&(!(nsaccountlock=TRUE)) (krbpasswordexpiration<=%s) (krbpasswordexpiration>=%s))r� r )�filter� attrs_listZscopez Empty Result.z%d entries found)r} r> r r r r� Zcontainer_userZbasednr� Z get_entriesZ SCOPE_SUBTREEr� r Z EmptyResultr? rM )rI r� Z search_baser� Z search_filterrB rB rC r� � s, � ��� � zEPN._fetch_data_from_ldapc C sx | j rt| j D ]}| j�|� q zLz| jdd� W n0 ty` } zt�d|� W Y d}~n d}~0 0 W g | _ ng | _ 0 dS )zHFill out self._expiring_password_user_list from data from ldap. Fre z"IPA-EPN: Could not create JSON: %sN)r� r rb r� r@ r> r ra rB rB rC r� s $zEPN._parse_ldap_dataTc C s | j j|d� dS )z8Dump self._expiring_password_user_list to JSON. re N)r rg )rI rf rB rB rC r� s �zEPN._pretty_print_datac C sP | j d u rt�d� d S z| j�d�}W n6 ty^ } z td|j|f ��W Y d }~n d }~0 0 tjj rrtjj }n d| j }| j �rB| j � � }|j |d |d |d |d |d d �}| j jtjj|t�|d �|tjjd � tjtd �}t�|d d�jtd�}t�d|d |d || j|� tjjr|t� t tjj�d � q|| j � � d S )Nz#IPA-EPN: mailer was not configured.zexpire_msg.templatez Parsing template %s failed: %sz noreply@%srW rY rZ rX r[ )rW �first�last�fullnameZ expirationrV �� mail_subject� mail_body� subscribersr, r- r� �%Y-%m-%d %H:%M:%S)Ztzinfoz5Notified %s (%s). Password expiring in %d days at %s.i� ) r� r> r r� Z get_templater r� �filenamer r, r� r rR Zrender� send_messager1 �astZ literal_evalr- r r� r� �strptime�replacer? r� r+ r� �sleepr� �cleanup)rI �templaterA r, rS �bodyr� �expdaterB rB rC r� sV � � � ���zEPN._send_emailsc C sF t jtd��d�}tdgdgdgdg|gtjjgd�}| j� |� dS ) z@Generate a sample user to process through the template. r� r� ZSAUSERz SAMPLE USERZSAMPLEZUSERr\ N) r r� r� �strftimer^ r r� r* r rb )rI r� rS rB rB rC r� H s �zEPN._gentestdatac C sr g | _ t�d� | jjdurD| j �| jt| jj�t| jj�d�� n*| jjdurn| j �| jdt| jj�d�� dS )z�When self.options.to_nbdays is set, override the date ranges read from the configuration file and build the date ranges from the CLI options. z,IPA-EPN: Ignoring configuration file ranges.Nr� ) r� r> r? r� r� r] r� r� r� rH rB rB rC r� V s �� ��zEPN._build_cli_date_ranges)r� )N)T) rv rw rx r� r Z IPAEPN_LOGZ log_file_name�usage� descriptionrJ � classmethodr� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� � __classcell__rB rB r� rC rz � s2 % * $ *rz c @ s< e Zd ZdZddd�Zd d � Zdd d �Zd d� Zdd� ZdS )� MTAClientz/MTA Client class. Originally done for EPN. r r r r Nc C sZ || _ || _|| _|| _|| _|| _|| _d | _| j dkrNd| jvrNt� d� | � � d S )Nr r zBIPA-EPN: using cleartext for non-localhost SMTPd is not supported.) �_security_protocol�_smtp_hostname� _smtp_port� _smtp_timeout� _username� _passwordr~ r} r> r �_connect)rI r� r� r" r( r� r$ r� rB rB rC rJ p s ���zMTAClient.__init__c C s | � � d S r{ )� _disconnectrH rB rB rC r� � s zMTAClient.cleanupc C s� d }z�z| j �tjj||�}W n0 tyN } zt�d|� W Y d }~n d }~0 0 W |r�|D ]$}t�d||| d || d � qZt�d� n:|r�|D ]$}t�d||| d || d � q�t�d� 0 d S )Nz IPA-EPN: Failed to send mail: %sz+IPA-EPN: Failed to send mail to '%s': %s %sr r� z6IPA-EPN: Failed to send mail to at least one recipient)r} Zsendmailr r� r* r@ r> r` )rI � message_strr� r� rA rs rB rB rC r� � s: �$ ��� ��zMTAClient.send_messagec C s zH| j �� dv r*tj| j| j| jd�| _n tj| j| j| j| j d�| _W nH t tj fy� } z*dj | j| j|d�}t �|��W Y d }~n d }~0 0 z| j�� W n: tj y� } z t�d| j| j|� W Y d }~n d }~0 0 | j �� dk�rJz | jj| j d� | j�� W n> tj �yH } z"td | j| j|f ��W Y d }~n d }~0 0 | j�r| j�r| j�d ��r�z,| j�| j| j� | j d k�r�t�d � W nf tj�y� td | j| jf ��Y n> tj �y� } z"td| j| j|f ��W Y d }~n d }~0 0 nd| j| jf }t�|� d S )N)r r� )�host�port�timeout)r r r r� zPIPA-EPN: Could not connect to the configured SMTP server: {host}:{port}: {error})r r r z'IPA-EPN: EHLO failed for host %s:%s: %sr� )r� z;IPA-EPN: Unable to create an encrypted session to %s:%s: %sZAUTHr z6IPA-EPN: Username and Password were sent in the clear.zTIPA-EPN: Authentication to %s:%s failed, please check your username and/or password:z IPA-EPN: SMTP Error at %s:%s:%sz9IPA-EPN: Server at %s:%s does not support authentication.)r� r� �smtplibZSMTPr r r r} ZSMTP_SSLr~ � socketerrorZ SMTPExceptionr� r r� Zehlor> r r� r� r r Zhas_extnZloginZwarningZSMTPAuthenticationError)rI rA �msgZerr_strrB rB rC r � s� � � �� � �� ������� ���zMTAClient._connectc C s | j �� d S r{ )r} �quitrH rB rB rC r � s zMTAClient._disconnect)r r r r NNN)NN) rv rw rx ry rJ r� r� r r rB rB rB rC r� l s � Mr� c @ s4 e Zd ZdZdd d �Zd d � Zdd d�Zdd� ZdS )r� zThe MUA class for EPN. r r r r Nr r c C sL || _ d | _d | _d | _| | _| | _d | _d | _t|||||||d�| _ d S )N)r� r� r" r( r� r$ r� ) � _x_mailer�_subject�_body� _subscribers�_subtype�_charset�_msg� _message_strr� � _mta_client) rI r� r� r" r( r� r$ r� r� r0 r/ rB rB rC rJ � s" �zMailUserAgent.__init__c C s | j �� d S r{ )r r� rH rB rB rC r� s zMailUserAgent.cleanupc C sJ d|||||fv r t �d� dS | j|||||d� | jj| j|d� dS )zfGiven mail_subject, mail_body, and subscribers, composes the message and sends it. Nz(IPA-EPN: Tried to send an empty message.Fr� )r r� T)r> r �_compose_messager r� r �rI r� r� r� r, r- rB rB rC r� # s � ��zMailUserAgent.send_messagec C s� || _ || _|| _t| jd�| _t||f�| jd< d�| j�| jd< tdd�| jd< t | j | j�| jd< t � | jd < d | j_ d | jvr�| j r�| j� d | j � | j�t| jd | j| jd �� | j�� | _dS )z7The composer creates a MIME multipart message. )r ZFromz, ZToT)� localtimeZDateZSubjectz Message-IdzMultipart messagezX-Mailerz )r r N)r r r r r r r r� r r r Zpreambler Z add_headerZattachr r Z as_stringr r rB rB rC r : s( ��z MailUserAgent._compose_message) r r r r NNNNr r )NNNNN)rv rw rx ry rJ r� r� r rB rB rB rC r� � s" � # � r� )r2 r2 )<ry Z __future__r r r� r; rk r3 r7 Zloggingr r� r� � collectionsr r r r Zutcr� Z email.utilsr r Zemail.mime.multipartr Zemail.mime.textr Z email.headerr r Zsocketr r Zipaplatform.pathsr Zipalibr r Z ipalib.factsr Z ipapythonr r Z ipapython.dnr Zjinja2r r r r� r� Z getLoggerrv r> rD rE Z AdminToolrz r� r� rB rB rB rC �<module> sl � a #