404

[ Avaa Bypassed ]




Upload:

Command:

botdev@3.129.206.232: ~ $
# Copyright (C) 2009-2010 Canonical Ltd.
# Copyright (C) 2012, 2013 Hewlett-Packard Development Company, L.P.
#
# Author: Scott Moser <scott.moser@canonical.com>
# Author: Juerg Haefliger <juerg.haefliger@hp.com>
#
# This file is part of cloud-init. See LICENSE file for license information.
"""Set Passwords: Set user passwords and enable/disable SSH password auth"""

import re
from logging import Logger
from string import ascii_letters, digits
from textwrap import dedent
from typing import List

from cloudinit import features
from cloudinit import log as logging
from cloudinit import subp, util
from cloudinit.cloud import Cloud
from cloudinit.config import Config
from cloudinit.config.schema import MetaSchema, get_meta_doc
from cloudinit.distros import ALL_DISTROS, Distro, ug_util
from cloudinit.settings import PER_INSTANCE
from cloudinit.ssh_util import update_ssh_config

MODULE_DESCRIPTION = """\
This module consumes three top-level config keys: ``ssh_pwauth``, ``chpasswd``
and ``password``.

The ``ssh_pwauth`` config key determines whether or not sshd will be configured
to accept password authentication.

The ``chpasswd`` config key accepts a dictionary containing either or both of
``users`` and ``expire``. The ``users`` key is used to assign a password to a
corresponding pre-existing user. The ``expire`` key is used to set
whether to expire all user passwords specified by this module,
such that a password will need to be reset on the user's next login.

.. note::
    Prior to cloud-init 22.3, the ``expire`` key only applies to plain text
    (including ``RANDOM``) passwords. Post 22.3, the ``expire`` key applies to
    both plain text and hashed passwords.

``password`` config key is used to set the default user's password. It is
ignored if the ``chpasswd`` ``users`` is used. Note: the ``list`` keyword is
deprecated in favor of ``users``.
"""

meta: MetaSchema = {
    "id": "cc_set_passwords",
    "name": "Set Passwords",
    "title": "Set user passwords and enable/disable SSH password auth",
    "description": MODULE_DESCRIPTION,
    "distros": [ALL_DISTROS],
    "frequency": PER_INSTANCE,
    "examples": [
        dedent(
            """\
            # Set a default password that would need to be changed
            # at first login
            ssh_pwauth: true
            password: password1
            """
        ),
        dedent(
            """\
            # Disable ssh password authentication
            # Don't require users to change their passwords on next login
            # Set the password for user1 to be 'password1' (OS does hashing)
            # Set the password for user2 to a pre-hashed password
            # Set the password for user3 to be a randomly generated password,
            #   which will be written to the system console
            ssh_pwauth: false
            chpasswd:
              expire: false
              users:
                - name: user1
                  password: password1
                  type: text
                - name: user2
                  password: $6$rounds=4096$5DJ8a9WMTEzIo5J4$Yms6imfeBvf3Yfu84mQBerh18l7OR1Wm1BJXZqFSpJ6BVas0AYJqIjP7czkOaAZHZi1kxQ5Y1IhgWN8K9NgxR1
                - name: user3
                  type: RANDOM
            """  # noqa
        ),
    ],
    "activate_by_schema_keys": [],
}

__doc__ = get_meta_doc(meta)

LOG = logging.getLogger(__name__)

# We are removing certain 'painful' letters/numbers
PW_SET = "".join([x for x in ascii_letters + digits if x not in "loLOI01"])


def get_users_by_type(users_list: list, pw_type: str) -> list:
    """either password or type: RANDOM is required, user is always required"""
    return (
        []
        if not users_list
        else [
            (item["name"], item.get("password", "RANDOM"))
            for item in users_list
            if item.get("type", "hash") == pw_type
        ]
    )


def _restart_ssh_daemon(distro, service):
    try:
        distro.manage_service("restart", service)
        LOG.debug("Restarted the SSH daemon.")
    except subp.ProcessExecutionError as e:
        LOG.warning(
            "'ssh_pwauth' configuration may not be applied. Cloud-init was "
            "unable to restart SSH daemon due to error: '%s'",
            e,
        )


def handle_ssh_pwauth(pw_auth, distro: Distro):
    """Apply sshd PasswordAuthentication changes.

    @param pw_auth: config setting from 'pw_auth'.
                    Best given as True, False, or "unchanged".
    @param distro: an instance of the distro class for the target distribution

    @return: None"""
    service = distro.get_option("ssh_svcname", "ssh")

    cfg_name = "PasswordAuthentication"

    if isinstance(pw_auth, str):
        LOG.warning(
            "DEPRECATION: The 'ssh_pwauth' config key should be set to "
            "a boolean value. The string format is deprecated and will be "
            "removed in a future version of cloud-init."
        )
    if util.is_true(pw_auth):
        cfg_val = "yes"
    elif util.is_false(pw_auth):
        cfg_val = "no"
    else:
        bmsg = f"Leaving SSH config '{cfg_name}' unchanged."
        if pw_auth is None or pw_auth.lower() == "unchanged":
            LOG.debug("%s ssh_pwauth=%s", bmsg, pw_auth)
        else:
            LOG.warning("%s Unrecognized value: ssh_pwauth=%s", bmsg, pw_auth)
        return

    updated = update_ssh_config({cfg_name: cfg_val})
    if not updated:
        LOG.debug("No need to restart SSH service, %s not updated.", cfg_name)
        return

    if distro.uses_systemd():
        state = subp.subp(
            [
                "systemctl",
                "show",
                "--property",
                "ActiveState",
                "--value",
                service,
            ]
        ).stdout.strip()
        if state.lower() in ["active", "activating", "reloading"]:
            _restart_ssh_daemon(distro, service)
    else:
        _restart_ssh_daemon(distro, service)


def handle(
    name: str, cfg: Config, cloud: Cloud, log: Logger, args: list
) -> None:
    distro: Distro = cloud.distro
    if args:
        # if run from command line, and give args, wipe the chpasswd['list']
        password = args[0]
        if "chpasswd" in cfg and "list" in cfg["chpasswd"]:
            del cfg["chpasswd"]["list"]
    else:
        password = util.get_cfg_option_str(cfg, "password", None)

    expire = True
    plist: List = []
    users_list: List = []

    if "chpasswd" in cfg:
        chfg = cfg["chpasswd"]
        users_list = util.get_cfg_option_list(chfg, "users", default=[])
        if "list" in chfg and chfg["list"]:
            log.warning(
                "DEPRECATION: key 'lists' is now deprecated. Use 'users'."
            )
            if isinstance(chfg["list"], list):
                log.debug("Handling input for chpasswd as list.")
                plist = util.get_cfg_option_list(chfg, "list", plist)
            else:
                log.warning(
                    "DEPRECATION: The chpasswd multiline string format is "
                    "deprecated and will be removed from a future version of "
                    "cloud-init. Use the list format instead."
                )
                log.debug("Handling input for chpasswd as multiline string.")
                multiline = util.get_cfg_option_str(chfg, "list")
                if multiline:
                    plist = multiline.splitlines()

        expire = util.get_cfg_option_bool(chfg, "expire", expire)

    if not (users_list or plist) and password:
        (users, _groups) = ug_util.normalize_users_groups(cfg, distro)
        (user, _user_config) = ug_util.extract_default(users)
        if user:
            plist = ["%s:%s" % (user, password)]
        else:
            log.warning("No default or defined user to change password for.")

    errors = []
    if plist or users_list:
        # This section is for parsing the data that arrives in the form of
        #   chpasswd:
        #     users:
        plist_in = get_users_by_type(users_list, "text")
        users = [user for user, _ in plist_in]
        hashed_plist_in = get_users_by_type(users_list, "hash")
        hashed_users = [user for user, _ in hashed_plist_in]
        randlist = []
        for user, _ in get_users_by_type(users_list, "RANDOM"):
            password = rand_user_password()
            users.append(user)
            plist_in.append((user, password))
            randlist.append(f"{user}:{password}")

        # This for loop is for parsing the data that arrives in the deprecated
        # form of
        #   chpasswd:
        #     list:
        # N.B. This regex is included in the documentation (i.e. the schema
        # docstring), so any changes to it should be reflected there.
        prog = re.compile(r"\$(1|2a|2y|5|6)(\$.+){2}")
        for line in plist:
            u, p = line.split(":", 1)
            if prog.match(p) is not None and ":" not in p:
                hashed_plist_in.append((u, p))
                hashed_users.append(u)
            else:
                # in this else branch, we potentially change the password
                # hence, a deviation from .append(line)
                if p == "R" or p == "RANDOM":
                    p = rand_user_password()
                    randlist.append("%s:%s" % (u, p))
                plist_in.append((u, p))
                users.append(u)
        if users:
            try:
                log.debug("Changing password for %s:", users)
                distro.chpasswd(plist_in, hashed=False)
            except Exception as e:
                errors.append(e)
                util.logexc(
                    log, "Failed to set passwords with chpasswd for %s", users
                )

        if hashed_users:
            try:
                log.debug("Setting hashed password for %s:", hashed_users)
                distro.chpasswd(hashed_plist_in, hashed=True)
            except Exception as e:
                errors.append(e)
                util.logexc(
                    log,
                    "Failed to set hashed passwords with chpasswd for %s",
                    hashed_users,
                )

        if len(randlist):
            blurb = (
                "Set the following 'random' passwords\n",
                "\n".join(randlist),
            )
            util.multi_log(
                "%s\n%s\n" % blurb, stderr=False, fallback_to_stdout=False
            )

        if expire:
            users_to_expire = users
            if features.EXPIRE_APPLIES_TO_HASHED_USERS:
                users_to_expire += hashed_users
            expired_users = []
            for u in users_to_expire:
                try:
                    distro.expire_passwd(u)
                    expired_users.append(u)
                except Exception as e:
                    errors.append(e)
                    util.logexc(log, "Failed to set 'expire' for %s", u)
            if expired_users:
                log.debug("Expired passwords for: %s users", expired_users)

    handle_ssh_pwauth(cfg.get("ssh_pwauth"), distro)

    if len(errors):
        log.debug("%s errors occurred, re-raising the last one", len(errors))
        raise errors[-1]


def rand_user_password(pwlen=20):
    return util.rand_str(pwlen, select_from=PW_SET)

Filemanager

Name Type Size Permission Actions
__pycache__ Folder 0755
schemas Folder 0755
__init__.py File 14 B 0644
cc_ansible.py File 8.37 KB 0644
cc_apk_configure.py File 5.75 KB 0644
cc_apt_configure.py File 32.46 KB 0644
cc_apt_pipelining.py File 2.82 KB 0644
cc_bootcmd.py File 2.87 KB 0644
cc_byobu.py File 3.67 KB 0644
cc_ca_certs.py File 8.06 KB 0644
cc_chef.py File 13.79 KB 0644
cc_disable_ec2_metadata.py File 2.04 KB 0644
cc_disk_setup.py File 32.34 KB 0644
cc_fan.py File 3.11 KB 0644
cc_final_message.py File 3.41 KB 0644
cc_growpart.py File 19.42 KB 0644
cc_grub_dpkg.py File 5.49 KB 0644
cc_install_hotplug.py File 3.81 KB 0644
cc_keyboard.py File 2.08 KB 0644
cc_keys_to_console.py File 3.63 KB 0644
cc_landscape.py File 4.86 KB 0644
cc_locale.py File 1.88 KB 0644
cc_lxd.py File 17.96 KB 0644
cc_mcollective.py File 6.2 KB 0644
cc_migrator.py File 3.51 KB 0644
cc_mounts.py File 19.03 KB 0644
cc_ntp.py File 19.7 KB 0644
cc_package_update_upgrade_install.py File 4.42 KB 0644
cc_phone_home.py File 5.5 KB 0644
cc_power_state_change.py File 7.65 KB 0644
cc_puppet.py File 13.74 KB 0644
cc_refresh_rmc_and_interface.py File 5.48 KB 0644
cc_reset_rmc.py File 4.53 KB 0644
cc_resizefs.py File 10.56 KB 0644
cc_resolv_conf.py File 5.01 KB 0644
cc_rh_subscription.py File 17.05 KB 0644
cc_rightscale_userdata.py File 4.3 KB 0644
cc_rsyslog.py File 9.77 KB 0644
cc_runcmd.py File 2.92 KB 0644
cc_salt_minion.py File 5.54 KB 0644
cc_scripts_per_boot.py File 1.68 KB 0644
cc_scripts_per_instance.py File 1.83 KB 0644
cc_scripts_per_once.py File 1.78 KB 0644
cc_scripts_user.py File 1.87 KB 0644
cc_scripts_vendor.py File 2.31 KB 0644
cc_seed_random.py File 4.81 KB 0644
cc_set_hostname.py File 4.89 KB 0644
cc_set_passwords.py File 11.05 KB 0644
cc_snap.py File 6.39 KB 0644
cc_spacewalk.py File 3.52 KB 0644
cc_ssh.py File 14.03 KB 0644
cc_ssh_authkey_fingerprints.py File 4.24 KB 0644
cc_ssh_import_id.py File 5.82 KB 0644
cc_timezone.py File 1.44 KB 0644
cc_ubuntu_advantage.py File 16.88 KB 0644
cc_ubuntu_autoinstall.py File 4.56 KB 0644
cc_ubuntu_drivers.py File 4.63 KB 0644
cc_update_etc_hosts.py File 5.11 KB 0644
cc_update_hostname.py File 3.63 KB 0644
cc_users_groups.py File 7.6 KB 0644
cc_wireguard.py File 9.28 KB 0644
cc_write_files.py File 6.75 KB 0644
cc_write_files_deferred.py File 1.68 KB 0644
cc_yum_add_repo.py File 7.47 KB 0644
cc_zypper_add_repo.py File 6.68 KB 0644
modules.py File 11.43 KB 0644
schema.py File 43.14 KB 0644