관리-도구
편집 파일: ssh_util.cpython-39.pyc
a i*�g�X � @ sl d dl Z d dlZd dlZd dlmZ d dlmZmZmZ d dl m Z m Z m Z e � e�ZdZdZdZdee� d ZG d d � d �ZG d d � d �Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Z efdd�Z d7d d �Z G d d � d �Z ee d �d!d"�Z ee d �d#d$�Z!d%d&� Z"ee#d'�d(d)�Z$d*d+� Z%efd,d-�Z&d.d/� Z'efeeeef d0�d1d2�Z(d3d4� Z)d5d6� Z*dS )8� N)�suppress)�List�Sequence�Tuple)� lifecycle�subp�utilz/etc/ssh/sshd_config)ZrsaZecdsaZed25519z(ecdsa-sha2-nistp256-cert-v01@openssh.comzecdsa-sha2-nistp256z(ecdsa-sha2-nistp384-cert-v01@openssh.comzecdsa-sha2-nistp384z(ecdsa-sha2-nistp521-cert-v01@openssh.comzecdsa-sha2-nistp521z+sk-ecdsa-sha2-nistp256-cert-v01@openssh.comz"sk-ecdsa-sha2-nistp256@openssh.comz#sk-ssh-ed25519-cert-v01@openssh.comzsk-ssh-ed25519@openssh.comz ssh-ed25519-cert-v01@openssh.comz ssh-ed25519z ssh-rsa-cert-v01@openssh.comzssh-rsaz ssh-xmss-cert-v01@openssh.comzssh-xmss@openssh.com� z�no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="echo 'Please login as the user \"$USER\" rather than the user \"$DISABLE_USER\".';echo;sleep 10;exit �"c @ s& e Zd Zddd�Zdd� Zdd� ZdS ) � AuthKeyLineNc C s" || _ || _|| _|| _|| _d S �N)�base64�comment�options�keytype�source)�selfr r r r r � r �6/usr/lib/python3.9/site-packages/cloudinit/ssh_util.py�__init__E s zAuthKeyLine.__init__c C s | j o | jS r )r r �r r r r �validN s zAuthKeyLine.validc C sd g }| j r|�| j � | jr(|�| j� | jr:|�| j� | jrL|�| j� |sV| jS d�|�S d S �N� )r �appendr r r r �join)r �toksr r r �__str__Q s zAuthKeyLine.__str__)NNNN)�__name__� __module__� __qualname__r r r r r r r r D s � r c @ s" e Zd ZdZdd� Zddd�ZdS )�AuthKeyLineParserau AUTHORIZED_KEYS FILE FORMAT AuthorizedKeysFile specifies the file containing public keys for public key authentication; if none is specified, the default is ~/.ssh/authorized_keys. Each line of the file contains one key (empty (because of the size of the public key encoding) up to a limit of 8 kilo- bytes, which permits DSA keys up to 8 kilobits and RSA keys up to 16 kilobits. You don't want to type them in; instead, copy the identity.pub or the id_rsa.pub file and edit it. sshd enforces a minimum RSA key modulus size for protocol 1 and protocol 2 keys of 768 bits. The options (if present) consist of comma-separated option specifica- tions. No spaces are permitted, except within double quotes. The fol- lowing option specifications are supported (note that option keywords are case-insensitive): c C s� d}d}|t |�k r�|s$|| dvr�|| }|d t |�krF|d }q�||d }|dkrl|dkrl|d }n|dkrz| }|d }q|d|� }||d� �� }||fS )z� The options (if present) consist of comma-separated option specifica- tions. No spaces are permitted, except within double quotes. Note that option keywords are case-insensitive. Fr )r � � �\r N)�len�lstrip)r �entZquoted�iZcurcZnextcr �remainr r r �_extract_optionsu s z"AuthKeyLineParser._extract_optionsNc C s� |� d�}|�d�s |�� dkr(t|�S dd� }|�� }z||�\}}}W n^ ty� | �|�\} } |d u rr| }z|| �\}}}W n ty� t|� Y Y S 0 Y n0 t|||||d�S )Nz �#� c S s^ | � d d�}t|�dk r(tdt|� ��|d tvrDtd|d ��t|�dkrZ|�d� |S )N� zTo few fields: %sr zInvalid keytype %sr, )�splitr% � TypeError�VALID_KEY_TYPESr )r' r r r r � parse_ssh_key� s z.AuthKeyLineParser.parse.<locals>.parse_ssh_key)r r r r )�rstrip� startswith�stripr r/ r* ) r Zsrc_liner �liner1 r' r r r Zkeyoptsr) r r r �parse� s, �zAuthKeyLineParser.parse)N)r r r �__doc__r* r6 r r r r r! a s r! c C sz g }t � }g }| D ]b}z8tj�|�rLt�|��� }|D ]}|�|�|�� q6W q t t fyr t� t d|� Y q0 q|S )NzError reading lines from %s) r! �os�path�isfiler �load_text_file� splitlinesr r6 �IOError�OSError�logexc�LOG)�fnames�lines�parser�contents�fnamer5 r r r �parse_authorized_keys� s rF c C s� t dd� |D ��}tt| ��D ]J}| | }|�� s4q |D ]&}|j|jkr8|}||v r8|�|� q8|| |< q |D ]}| �|� qndd� | D �}|�d� d�|�S )Nc S s g | ]}|� � r|�qS r )r ��.0�kr r r � <listcomp>� � z*update_authorized_keys.<locals>.<listcomp>c S s g | ] }t |��qS r ��str)rH �br r r rJ � rK r, � )�list�ranger% r r �remover r )Z old_entries�keysZto_addr( r' rI �keyrB r r r �update_authorized_keys� s rU c C s4 t �| �}|r|js td| ��tj�|jd�|fS )Nz"Unable to get SSH info for user %rz.ssh)�pwd�getpwnam�pw_dir� RuntimeErrorr8 r9 r )�username�pw_entr r r �users_ssh_info� s r\ c C sp d|fd|fdf}| sd} | � � }g }|D ]@}|D ]\}}|�||�}q2|�d�s`tj�||�}|�|� q*|S )N�%h�%u)z%%�%�%h/.ssh/authorized_keys�/)r. �replacer3 r8 r9 r r ) �value�homedirrZ Zmacros�pathsZrenderedr9 ZmacroZfieldr r r � render_authorizedkeysfile_paths� s rf c C s� d}|r d}t �|�}|r@|| kr@|dkr@t�d||| |� dS t �|�}|| kr\|dM }n.t �|�}t �| �} || v r�|dM }n|dM }||@ d kr�t�d ||| � dS |r�|d @ d kr�t�d ||� dS d S )aV Check if the file/folder in @current_path has the right permissions. We need to check that: 1. If StrictMode is enabled, the owner is either root or the user 2. the user can access the file/folder, otherwise ssh won't use it 3. If StrictMode is enabled, no write permission is given to group and world users (022) i� i� �rootzXPath %s in %s must be own by user %s or by root, but instead is own by %s. Ignoring key.F� �8 � r zBPath %s in %s must be accessible by user %s, check its permissions� zRPath %s in %s must not give writepermission to group or world users. Ignoring key.T)r Z get_ownerr@ �debugZget_permissionsZ get_groupZget_user_groups) rZ Z current_path� full_path�is_file� strictmodesZminimal_permissions�ownerZparent_permissionZ group_ownerZ user_groupsr r r �check_permissions sJ � ��rq c C s t | �d }t d�d }�z�|�d�dd� }d}tj�|j�}|D �]}|d| 7 }tj�|�rvt�d|� W dS tj� |�r�t�d|� W dS |� |�sD||jkr�qDtj� |��s0t � |��Z d } |j} |j} |� |j�r�d } |j} |j} tj|| d d � t �|| | � W d � n1 �s&0 Y t| ||d|�} | sD W dS qDtj�|��sjtj�|��r|t�d |� W dS tj� |��s�t j|ddd d� t �||j|j� t| ||d |�} | �s�W dS W n< ttf�y } z t �tt| �� W Y d } ~ dS d } ~ 0 0 d S )Nr# rg ra ���r, z-Invalid directory. Symlink exists in path: %sFz*Invalid directory. File exists in path: %s�� rh T)�mode�exist_okz%s is not a file!� )rt Zensure_dir_exists)r\ r. r8 r9 �dirnamerX �islinkr@ rl r: r3 �existsr � SeLinuxGuard�pw_uid�pw_gid�makedirsZ chownbyidrq �isdir� write_filer= r> r? rM )rZ �filenamero Z user_pwentZ root_pwentZ directoriesZ parent_folderZ home_folderZ directoryrt �uid�gidZ permissions�er r r �check_create_pathG sn � ��� . � � r� c C s4 t | �\}}tj�|d�}|}g }tj|dd��v z2t|�}|�dd�}|�dd�} t||j | �}W n2 t t fy� ||d< t� t d t|d � Y n0 W d � n1 s�0 Y t|�� |�D ]J\} } td | v d | v | �d �|j ��g�r�t| | | dk�} | r�| } �qq�||k�r&t �d |� |t|g�fS )NZauthorized_keysT�� recursiveZauthorizedkeysfiler` ro Zyesr zhFailed extracting 'AuthorizedKeysFile' in SSH config from %r, using 'AuthorizedKeysFile' file %r insteadr^ r] z{}/zAAuthorizedKeysFile has an user-specific authorized_keys, using %s)r\ r8 r9 r r rz �parse_ssh_config_map�getrf rX r= r> r? r@ � DEF_SSHD_CFG�zipr. �anyr3 �formatr� rl rF ) rZ Z sshd_cfg_file�ssh_dirr[ Zdefault_authorizedkeys_fileZuser_authorizedkeys_fileZ auth_key_fnsZssh_cfgZ key_pathsro Zkey_path� auth_key_fnZpermissions_okr r r �extract_authorized_keys� sV � ��( �� � ��r� c C s� t � }g }| D ] }|�|jt|�|d�� qt|�\}}tj�|�}tj |dd��* t ||�} tj || dd� W d � n1 s�0 Y d S )N)r Tr� �� preserve_mode) r! r r6 rM r� r8 r9 rw r rz rU r ) rS rZ r rC Z key_entriesrI r� Zauth_key_entriesr� �contentr r r �setup_user_keys� s r� c @ s* e Zd Zddd�Zedd� �Zdd� ZdS ) �SshdConfigLineNc C s || _ || _|| _d S r )r5 �_keyrc )r r5 rI �vr r r r � s zSshdConfigLine.__init__c C s | j d u rd S | j �� S r )r� �lowerr r r r rT � s zSshdConfigLine.keyc C s> | j d u rt| j�S t| j �}| jr6|dt| j� 7 }|S d S r )r� rM r5 rc )r r� r r r r � s zSshdConfigLine.__str__)NN)r r r r �propertyrT r r r r r r� � s r� )�returnc C s" t j�| �sg S tt�| ��� �S r )r8 r9 r: �parse_ssh_config_linesr r; r< �rE r r r �parse_ssh_config� s r� c C s� g }| D ]�}|� � }|r"|�d�r2|�t|�� qz|�d d�\}}W nL ty� z|�dd�\}}W n$ ty� t�d|� Y Y qY n0 Y n0 |�t|||�� q|S )Nr+ r# �=z;sshd_config: option "%s" has no key/value pair, skipping it)r4 r3 r r� r. � ValueErrorr@ rl )rB �retr5 rT �valr r r r� � s& �r� c C s6 t | �}|si S i }|D ]}|js$q|j||j< q|S r )r� rT rc )rE rB r� r5 r r r r� s r� )rE r� c C s@ t j�| �sdS t�| ��� D ] }|�d| � d��r dS q dS )NFzInclude z .d/*.confT)r8 r9 r: r r; r< r3 )rE r5 r r r �_includes_dconf" s r� c C s^ t | �rZtj�| � d��s.tj| � d�dd� tj�| � d�d�} tj�| �sZt�| d� | S )Nz.drs )rt z50-cloud-init.confrv ) r� r8 r9 r~ r Z ensure_dirr r: Z ensure_filer� r r r �"_ensure_cloud_init_ssh_config_file+ s r� c C sP t |�}t|�}t|| d�}|rDtj|d�dd� |D ��d dd� t|�dkS )z�Read fname, and update if changes are necessary. @param updates: dictionary of desired values {Option: value} @return: boolean indicating if an update was done.)rB �updatesrO c S s g | ] }t |��qS r rL )rH r5 r r r rJ A rK z%update_ssh_config.<locals>.<listcomp>Tr� r )r� r� �update_ssh_config_linesr r r r% )r� rE rB �changedr r r �update_ssh_config6 s �r� c C s t � }g }tdd� |�� D ��}t| dd�D ]v\}}|js<q,|j|v r,||j }|| }|�|� |j|kr~t�d|||� q,|� |� t�d|||j|� ||_q,t |�t |�k�r|� � D ]B\}}||v r�q�|� |� | � t d||�� t�dt | �||� q�|S ) z�Update the SSH config lines per updates. @param lines: array of SshdConfigLine. This array is updated in place. @param updates: dictionary of desired values {Option: value} @return: A list of keys in updates that were changed.c S s g | ]}|� � |f�qS r )r� rG r r r rJ Q rK z+update_ssh_config_lines.<locals>.<listcomp>r# )�startz$line %d: option %s already set to %sz#line %d: option %s updated %s -> %sr, z line %d: option %s added with %s) �set�dictrS � enumeraterT �addrc r@ rl r r% �itemsr� ) rB r� �foundr� Zcasemapr( r5 rT rc r r r r� G sB � � �r� )rB c C s> | sd S t |�}dd� | D �}tj|d�|�d ddd� d S )Nc s s | ]\}}|� d |� �V qdS )r Nr )rH rI r� r r r � <genexpr>y rK z$append_ssh_config.<locals>.<genexpr>rO �abT)Zomoder� )r� r r r )rB rE r� r r r �append_ssh_configu s �r� c C s� d} t tj��* tjddgddgd�\}} W d � n1 s>0 Y d}| �d �D ](}|�|�rV|t|�|�d �� S qVdS ) z�Get the full version of the OpenSSH sshd daemon on the system. On an ubuntu system, this would look something like: 1.2p1 Ubuntu-1ubuntu0.1 If we can't find `sshd` or parse the version number, return None. r, Zsshdz-Vr r# )ZrcsNZOpenSSH_rO �,)r r ZProcessExecutionErrorr. r3 r% �find)�err�_�prefixr5 r r r �get_opensshd_version� s 8 r� c C s� d} t � }|du r tj�| �S d|v r:|d|�d�� } n d|v rV|d|�d�� } n|} ztj�| �} | W S ttfy� t�d| � Y n0 dS )z�Get the upstream version of the OpenSSH sshd daemon on the system. This will NOT include the portable number, so if the Ubuntu version looks like `1.2p1 Ubuntu-1ubuntu0.1`, then this function would return `1.2` z9.0N�pr z Could not parse sshd version: %s) r� r ZVersionZfrom_strr� r� r/ r@ Zwarning)Zupstream_versionZ full_versionr r r � get_opensshd_upstream_version� s r� )N)+Zloggingr8 rV � contextlibr �typingr r r Z cloudinitr r r Z getLoggerr r@ r� r0 Z_DISABLE_USER_SSH_EXITrM ZDISABLE_USER_OPTSr r! rF rU r\ rf rq r� r� r� r� r� r� r� �boolr� r� r� r� r� r� r� r r r r �<module> sH ��� Y EO 9 .