관리-도구
편집 파일: known_hosts.cpython-39.pyc
a �)g�5 � @ s� d dl mZmZmZ eZdZdZd dlZd dl Z d dl Z d dl Z d dl Z d dl Z d dlZd dlZd dlmZ d dlmZmZ dd� Zd d � Zd d � Zd d� Zdd� Zdd� Zdd� Ze dkr�e� dS )� )�absolute_import�division�print_functiona� --- module: known_hosts short_description: Add or remove a host from the C(known_hosts) file description: - The C(known_hosts) module lets you add or remove a host keys from the C(known_hosts) file. - Starting at Ansible 2.2, multiple entries per host are allowed, but only one for each key type supported by ssh. This is useful if you're going to want to use the M(ansible.builtin.git) module over ssh, for example. - If you have a very large number of host keys to manage, you will find the M(ansible.builtin.template) module more useful. version_added: "1.9" options: name: aliases: [ 'host' ] description: - The host to add or remove (must match a host specified in key). It will be converted to lowercase so that ssh-keygen can find it. - Must match with <hostname> or <ip> present in key attribute. - For custom SSH port, C(name) needs to specify port as well. See example section. type: str required: true key: description: - The SSH public host key, as a string. - Required if C(state=present), optional when C(state=absent), in which case all keys for the host are removed. - The key must be in the right format for SSH (see sshd(8), section "SSH_KNOWN_HOSTS FILE FORMAT"). - Specifically, the key should not match the format that is found in an SSH pubkey file, but should rather have the hostname prepended to a line that includes the pubkey, the same way that it would appear in the known_hosts file. The value prepended to the line must also match the value of the name parameter. - Should be of format C(<hostname[,IP]> ssh-rsa <pubkey>). - For custom SSH port, C(key) needs to specify port as well. See example section. type: str path: description: - The known_hosts file to edit. - The known_hosts file will be created if needed. The rest of the path must exist prior to running the module. default: "~/.ssh/known_hosts" type: path hash_host: description: - Hash the hostname in the known_hosts file. type: bool default: "no" version_added: "2.3" state: description: - I(present) to add the host key. - I(absent) to remove it. choices: [ "absent", "present" ] default: "present" type: str attributes: check_mode: support: full diff_mode: support: full platform: platforms: posix extends_documentation_fragment: - action_common_attributes author: - Matthew Vernon (@mcv21) a� - name: Tell the host about our servers it might want to ssh to ansible.builtin.known_hosts: path: /etc/ssh/ssh_known_hosts name: foo.com.invalid key: "{{ lookup('ansible.builtin.file', 'pubkeys/foo.com.invalid') }}" - name: Another way to call known_hosts ansible.builtin.known_hosts: name: host1.example.com # or 10.9.8.77 key: host1.example.com,10.9.8.77 ssh-rsa ASDeararAIUHI324324 # some key gibberish path: /etc/ssh/ssh_known_hosts state: present - name: Add host with custom SSH port ansible.builtin.known_hosts: name: '[host1.example.com]:2222' key: '[host1.example.com]:2222 ssh-rsa ASDeararAIUHI324324' # some key gibberish path: /etc/ssh/ssh_known_hosts state: present N)� AnsibleModule)�to_bytes� to_nativec C s� |d � � }|�dd�}|�d�}|�d�}|�d�}| �dd�}|sZ|d krZ| jd d � |rl|rlt||�}|r�|�d �s�|d 7 }t| |||� t| ||||�\}} } t|| | ||�|d < |d kr�| s�|r�d|d< |S | j r�| j | p�|dk|k|d d� |�r0|�s0|d k�r0| j |d|d|gdd� d|d< | �sD||dkk�r�zt |d�} W nR t �y� } z8| jtjk�rxd} n| jd|t| �f d � W Y d} ~ n d} ~ 0 0 z�tjdtj�|�dd��v} | du�rt| �D ]6\}}| |d k�r�| �s�|d k�r��q�| �|� �q�| �� |dk�r(| �|� W d � n1 �s>0 Y W nB t tf�y� } z$| jd|t| �f d � W Y d} ~ nd} ~ 0 0 | �| j |� d|d< |S )z Add or remove key. �name�keyN�path� hash_host�statez ssh-keygenT�absentz#No key specified when adding a host��msg� �diffF�changed�present)r r z-R�-f�Zcheck_rc�rzFailed to read %s: %s�w+)�mode�dir�delete� z Failed to write to file %s: %s) �lower�getZ get_bin_path� fail_json� hash_host_key�endswith� sanity_check�search_for_host_key� compute_diffZ check_mode� exit_json� run_command�open�IOError�errno�ENOENT�str�tempfile�NamedTemporaryFile�osr �dirname� enumerate�write�close�OSErrorr Z atomic_mover )�module�params�hostr r r r � sshkeygen�found�replace_or_add� found_line�inf�e�outfZ line_number�line� r> �?/usr/lib/python3.9/site-packages/ansible/modules/known_hosts.py� enforce_stateu s^ �. ..r@ c C s� |sdS t �d|�r | jdd� tjdd���}z|�|� |�� W n> ty� } z&| jd|jt |�f d� W Y d}~n d}~0 0 |d|d |jg}| � |�\}}} W d � n1 s�0 Y |d kr�| jd d� dS ) a! Check supplied key is sensible host and key are parameters provided by the user; If the host provided is inconsistent with the key supplied, then this function quits, providing an error to the user. sshkeygen is the path to ssh-keygen, found earlier with get_bin_path Nz\S+(\s+)?,(\s+)?zlComma separated list of names is not supported. Please pass a single name to lookup in the known_hosts file.r r )r z(Failed to write to temporary file %s: %s�-Fr � z?Host parameter does not match hashed host field in supplied key) �re�searchr r+ r, r0 �flushr' r r r% ) r3 r5 r r6 r< r; �sshkeygen_command�rc�stdout�stderrr> r> r? r! � s � .r! c C sv t j�|�du rdS |d|d|g}| j|dd�\}}}|dkrZ|dkrZ|dksV|dkrZdS |dkrx| jd |||f d � |s�d S |�d �} t|�} t| �D ]�\} } | dkr�q�q�| d d kr�ztt � d| �� d��} W n" t y� | jd| d � Y n0 q�t| �}| d dd� dk�r:|d dd� dk�r:|d | d< | |k�rRdd| f S | d |d kr�dd| f S q�dS )a2 search_for_host_key(module,host,key,path,sshkeygen) -> (found,replace_or_add,found_line) Looks up host and keytype in the known_hosts file path; if it's there, looks to see if one of those entries matches key. Returns: found (Boolean): is host found in path? replace_or_add (Boolean): is the key in path different to that supplied by user? found_line (int or None): the line where a key of the same type was found if found=False, then replace is always False. sshkeygen is the path to ssh-keygen, found earlier with get_bin_path F)FFNrA r r rB r r z2ssh-keygen failed (rc=%d, stdout='%s',stderr='%s')r )TFNr �#zfound: line (\d+)z:failed to parse output of ssh-keygen for line number: '%s'r5 N� z|1|T�type)TTN) r- r �existsr% r �split�normalize_known_hosts_keyr/ �intrC rD �group� IndexError)r3 r5 r r r6 rF rG rH rI �linesZnew_key�lnum�lr9 Z found_keyr> r> r? r" � s8 , r" c C st t �d�}t�|t| �tj��� }|�� � � }|d d dkrBdnd}dt t � |��t t � |��f ||< d� |�S )N� r �@r z|1|%s|%s� )r- �urandom�hmac�newr �hashlibZsha1Zdigest�striprN r �base64Z b64encode�join)r5 r Zhmac_keyZ hashed_host�parts�ir> r> r? r s $r c C s� | � � } | �� }t� }|d d dkrX|d |d< |d |d< |d |d< |d |d < n$|d |d< |d |d< |d |d < |S ) a~ Transform a key, either taken from a known_host file or provided by the user, into a normalized form. The host part (which might include multiple hostnames or be hashed) gets replaced by the provided host. Also, any spurious information gets removed from the end (like the username@host tag usually present in hostkeys, but absent in known_hosts files) r rW �optionsr r5 � rL rK r )r] rN �dict)r �k�dr> r> r? rO * s rO c C s� | | ddd�}zt | d�}W n8 tyT } z |jtjkr@d|d< W Y d }~n d }~0 0 |�� |d< |�� |d �d�}|s�|dkr�|d ur�d| kr�t|�kr�n n ||d = |d kr�|s�|d u r�|�|� d� |�|d < |S ) NrB )� before_headerZ after_header�before�afterr z /dev/nullrg rh r r r ri ) r& r' r( r) �readr1 � splitlines�len�appendr_ ) r r9 r8 r r r r: r; rS r> r> r? r# C s& � 0 r# c C sn t ttdddgd�tdddd�tddd �tdd dd �td d d gd�d�dd�} t| | j�}| jf i |�� d S )NTr* r5 )�requiredrL �aliasesF)rn rL Zno_logz~/.ssh/known_hostsr )�defaultrL �bool)rn rL rp r r )rp �choices)r r r r r )Z argument_specZsupports_check_mode)r rd r@ r4 r$ )r3 �resultsr> r> r? �main[ s �� rt �__main__) Z __future__r r r rL Z __metaclass__Z DOCUMENTATIONZEXAMPLESr^ r( r\ rZ r- Zos.pathrC r+ Zansible.module_utils.basicr Zansible.module_utils._textr r r@ r! r" r rO r# rt �__name__r> r> r> r? �<module> s, >! P%6