[Da-tools-commits] ./da-tools/userdir-ldap-sshkeys r365: merge with -common
Mark Hymers
mhy at debian.org
Wed May 14 18:18:49 UTC 2008
------------------------------------------------------------
revno: 365
committer: Mark Hymers <mhy at debian.org>
branch nick: userdir-ldap-sshkeys
timestamp: Wed 2008-05-14 19:18:49 +0100
message:
merge with -common
added:
templates/admin-info
modified:
debian/changelog
ud-generate
ud-info
ud-mailgate
ud-replicate
userdir-ldap.conf
userdir-ldap.schema
------------------------------------------------------------
revno: 353.1.29
committer: Martin Zobel-Helas <zobel at debian.org>
branch nick: userdir-ldap-common
timestamp: Sat 2008-05-10 14:19:22 +0200
message:
add VoIP
modified:
ud-info
ud-mailgate
userdir-ldap.schema
------------------------------------------------------------
revno: 353.1.30
committer: Andreas Barth <aba at alioth>
branch nick: userdir-ldap-common
timestamp: Sat 2008-05-10 21:49:42 +0000
message:
Add IPv6-Adresses (and IPv4 in both ways) into ssh_known_hosts
modified:
ud-generate
------------------------------------------------------------
revno: 353.1.31
committer: Andreas Barth <aba at alioth>
branch nick: userdir-ldap-common
timestamp: Sat 2008-05-10 21:52:42 +0000
message:
more sanitizing for IP adresses
modified:
ud-generate
------------------------------------------------------------
revno: 353.1.32
committer: Joerg Jaspert <joerg at debian.org>
branch nick: userdir-ldap-common
timestamp: Tue 2008-05-13 00:12:56 +0200
message:
First version of a check for ssh keys
modified:
ud-mailgate
userdir-ldap.conf
------------------------------------------------------------
revno: 353.1.33
committer: Joerg Jaspert <joerg at ganneff.de>
branch nick: userdir-ldap-common
timestamp: Wed 2008-05-14 16:56:04 +0200
message:
Merge sshkeys check with the alioth userdir-ldap-common
modified:
debian/changelog
ud-mailgate
ud-replicate
------------------------------------------------------------
revno: 349.4.42
committer: Peter Palfrader <peter at palfrader.org>
branch nick: userdir-ldap
timestamp: Tue 2008-05-13 22:09:02 +0200
message:
* ud-replicate: use the host key to sync stuff from the db server,
that is, call ssh with ii /etc/ssh/ssh_host_rsa_key.
* ud-replicate: Call ssh with -o PreferredAuthentications=publickey
so that it does not even try password authentication.
modified:
debian/changelog
ud-replicate
------------------------------------------------------------
revno: 349.4.43
committer: Joerg Jaspert <joerg at ganneff.de>
branch nick: ud-ldap-sshkey
timestamp: Wed 2008-05-14 16:43:40 +0200
message:
Check ssh keys:
- reject all DSA keys, similar to RSA1 keys.
- reject and mail the admins for broken keys, ie keys
- of size below 1024 or
- known to be bad (fingerprintlist)
modified:
ud-mailgate
userdir-ldap.conf
------------------------------------------------------------
revno: 353.1.34
committer: Joerg Jaspert <joerg at ganneff.de>
branch nick: userdir-ldap-common
timestamp: Wed 2008-05-14 17:34:01 +0200
message:
Add missing admin info template
added:
templates/admin-info
-------------- next part --------------
=== modified file 'debian/changelog'
--- a/debian/changelog 2008-04-21 11:31:04 +0000
+++ b/debian/changelog 2008-05-13 20:09:02 +0000
@@ -1,3 +1,12 @@
+userdir-ldap (0.3.21) unstable; urgency=low
+
+ * ud-replicate: use the host key to sync stuff from the db server,
+ that is, call ssh with ii /etc/ssh/ssh_host_rsa_key.
+ * ud-replicate: Call ssh with -o PreferredAuthentications=publickey
+ so that it does not even try password authentication.
+
+ -- Peter Palfrader <weasel at debian.org> Tue, 13 May 2008 22:06:23 +0200
+
userdir-ldap (0.3.20) unstable; urgency=low
* Teach ud-mailgate about ipv6 addresses (RT#193).
=== added file 'templates/admin-info'
--- a/templates/admin-info 1970-01-01 00:00:00 +0000
+++ b/templates/admin-info 2008-05-14 15:34:01 +0000
@@ -0,0 +1,17 @@
+To: __ADMIN__
+MIME-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 8bit
+Subject: User trying to add a bad or too small key to LDAP
+
+Hello admins!
+
+I (__USER__) just tried to add a known bad or too small SSH key
+to LDAP:
+
+__ERROR__
+
+Please lart me, thanks.
+
+--
+Thanks, __USER__
\ No newline at end of file
=== modified file 'ud-generate'
--- a/ud-generate 2008-04-26 11:49:21 +0000
+++ b/ud-generate 2008-05-14 18:18:49 +0000
@@ -177,20 +177,14 @@
Done(File,None,F);
# Generate the shadow list
-def GenSSHShadow(l,masterFileName):
+def GenSSHShadow(l,File):
+ F = None;
+ try:
+ OldMask = os.umask(0077);
+ F = open(File + ".tmp","w",0600);
+ os.umask(OldMask);
+
# Fetch all the users
- files = []
- # Depending on config, we write out either a single file,
- # multiple files, or both
- if SingleSSHFile:
- try:
- OldMask = os.umask(0077);
- masterFile = open(masterFileName + ".tmp","w",0600);
- os.umask(OldMask);
- except IOError:
- Die(masterFileName,masterFile,None)
- raise
-
global PasswdAttrs;
if PasswdAttrs == None:
raise "No Users";
@@ -206,41 +200,16 @@
if x[1].has_key("uidNumber") == 0 or \
x[1].has_key("sshRSAAuthKey") == 0:
continue;
- User = GetAttr(x,"uid");
- F = None;
-
- try:
- if MultipleSSHFiles:
- OldMask = os.umask(0077);
- File = masterFileName + "-" + User
- F = open(File + ".tmp","w",0600);
- os.umask(OldMask);
-
- for I in x[1]["sshRSAAuthKey"]:
- if MultipleSSHFiles:
- MultipleLine = "%s" % I
- MultipleLine = Sanitize(MultipleLine) + "\n"
- F.write(MultipleLine)
- if SingleSSHFile:
- SingleLine = "%s: %s" % (User, I)
- SingleLine = Sanitize(SingleLine) + "\n"
- masterFile.write(SingleLine)
-
- if MultipleSSHFiles:
- Done(File,F,None);
- files.append(os.path.basename(File))
-
- # Oops, something unspeakable happened.
- except IOError:
- Die(File,F,None)
- Die(masterFileName,masterFile,None)
- raise;
-
- if SingleSSHFile:
- Done(masterFileName,masterFile,None)
- files.append(os.path.basename(masterFileName))
-
- return files
+ for I in x[1]["sshRSAAuthKey"]:
+ User = GetAttr(x,"uid");
+ Line = "%s: %s" %(User,I);
+ Line = Sanitize(Line) + "\n";
+ F.write(Line);
+ # Oops, something unspeakable happened.
+ except:
+ Die(File,F,None);
+ raise;
+ Done(File,F,None);
# Generate the group list
def GenGroup(l,File):
@@ -749,12 +718,23 @@
x[1].has_key("sshRSAHostKey") == 0:
continue;
Host = GetAttr(x,"hostname");
+ HostNames = [ Host ]
SHost = Host.find(".")
+ if SHost != None: HostNames += [Host[0:SHost]]
+
+ IPAdressesT = None
+ IPAdresses = []
+ # get IP adresses back as "proto adress" to distinguish between v4 and v6
+ try:
+ IPAdressesT = set([ (a[0],a[4][0]) for a in socket.getaddrinfo(Host, None)])
+ except:
+ if code[0] != -2: raise
+ for addr in IPAdressesT:
+ if addr[0] == socket.AF_INET: IPAdresses += [addr[1], "::ffff:"+addr[1]]
+ else: IPAdresses += [addr[1]]
+
for I in x[1]["sshRSAHostKey"]:
- if SHost == None:
- Line = "%s,%s %s" %(Host,socket.gethostbyname(Host),I);
- else:
- Line = "%s,%s,%s %s" %(Host,Host[0:SHost],socket.gethostbyname(Host),I);
+ Line = "%s,%s %s" %(",".join(HostNames + IPAdresses), I);
Line = Sanitize(Line) + "\n";
F.write(Line);
# Oops, something unspeakable happened.
@@ -837,7 +817,7 @@
# Generate global things
GlobalDir = GenerateDir+"/";
-SSHFiles = GenSSHShadow(l,GlobalDir+"ssh-rsa-shadow");
+GenSSHShadow(l,GlobalDir+"ssh-rsa-shadow");
GenAllForward(l,GlobalDir+"mail-forward.cdb");
GenMarkers(l,GlobalDir+"markers");
GenPrivate(l,GlobalDir+"debian-private");
@@ -886,8 +866,7 @@
Allowed = None
CurrentHost = Split[0];
- for file in SSHFiles:
- DoLink(GlobalDir,OutDir,file);
+ DoLink(GlobalDir,OutDir,"ssh-rsa-shadow");
DoLink(GlobalDir,OutDir,"debianhosts");
DoLink(GlobalDir,OutDir,"ssh_known_hosts");
DoLink(GlobalDir,OutDir,"disabled-accounts")
=== modified file 'ud-info'
--- a/ud-info 2007-12-26 20:49:42 +0000
+++ b/ud-info 2008-05-10 12:19:22 +0000
@@ -55,7 +55,8 @@
"mailWhitelist": ["Mail Whitelist",24],
"comment": ["Comment",116],
"userPassword": ["Crypted Password",117],
- "dnsZoneEntry": ["d.net Entry",118]};
+ "dnsZoneEntry": ["d.net Entry",118],
+ "VoIP": ["VoIP Address",119]};
AttrPrompt = {"cn": ["Common name or first name"],
"mn": ["Middle name (or initial if it ends in a dot)"],
@@ -89,7 +90,8 @@
"dnsZoneEntry": ["DNS Zone fragment associated this this user"],
"labeledURI": ["Web home page"],
"jabberJID": ["Jabber ID"],
- "icqUin": ["ICQ UIN Number"]};
+ "icqUin": ["ICQ UIN Number"],
+ "VoIP": ["VoIP Address"]};
# Create a map of IDs to desc,value,attr
OrderedIndex = {};
=== modified file 'ud-mailgate'
--- a/ud-mailgate 2008-04-21 22:18:09 +0000
+++ b/ud-mailgate 2008-05-14 14:56:04 +0000
@@ -3,11 +3,12 @@
# Prior copyright probably rmurray, troup, joey, jgg -- weasel 2008
# Copyright (c) 2008 Peter Palfrader <peter at palfrader.org>
+# Copyright (c) 2008 Joerg Jaspert <joerg at debian.org>
-import userdir_gpg, userdir_ldap, sys, traceback, time, ldap, os;
-import pwd
-from userdir_gpg import *;
-from userdir_ldap import *;
+import userdir_gpg, userdir_ldap, sys, traceback, time, ldap, os, commands
+import pwd, tempfile
+from userdir_gpg import *
+from userdir_ldap import *
# Error codes from /usr/include/sysexits.h
ReplyTo = ConfModule.replyto;
@@ -15,6 +16,7 @@
ChPassFrom = ConfModule.chpassfrom;
ChangeFrom = ConfModule.changefrom;
ReplayCacheFile = ConfModule.replaycachefile;
+SSHFingerprintFile = ConfModule.fingerprintfile
EX_TEMPFAIL = 75;
EX_PERMFAIL = 65; # EX_DATAERR
@@ -27,6 +29,8 @@
SeenList = {}
DNS = {}
+SSHFingerprint = re.compile('^(\d+) ([0-9a-f\:]{47}) (.+)$')
+
ArbChanges = {"c": "..",
"l": ".*",
"facsimileTelephoneNumber": ".*",
@@ -44,6 +48,7 @@
"mailDisableMessage": ".*",
"mailGreylisting": "^(TRUE|FALSE)$",
"mailCallout": "^(TRUE|FALSE)$",
+ "VoIP": ".*",
};
DelItems = {"c": None,
@@ -71,6 +76,7 @@
"mailRHSBL": None,
"mailWhitelist": None,
"mailDisableMessage": None,
+ "VoIP": None,
};
# Decode a GPS location from some common forms
@@ -216,16 +222,87 @@
Attrs.append((ldap.MOD_REPLACE,"longitude",sLong));
return "Position set to %s/%s (%s/%s decimal degrees)"%(sLat,sLong,Lat,Long);
+# Load bad ssh fingerprints
+def LoadBadSSH():
+ f = open(SSHFingerprintFile, "r")
+ bad = []
+ FingerprintLine = re.compile('^([0-9a-f\:]{47}).*$')
+ for line in f.readlines():
+ Match = FingerprintLine.match(line)
+ if Match is not None:
+ g = Match.groups()
+ bad.append(g[0])
+ return bad
+
# Handle an SSH authentication key, the line format is:
# [options] 1024 35 13188913666680[..] [comment]
-def DoSSH(Str,Attrs):
+def DoSSH(Str, Attrs, badkeys, uid):
Match = SSH2AuthSplit.match(Str);
+ g = Match.groups()
+ typekey = g[1]
if Match == None:
Match = re.compile('^1024 (\d+) ').match(Str)
if Match is not None:
return "SSH1 keys not supported anymore"
return None;
-
+
+ (fd, path) = tempfile.mkstemp(".pub", "sshkeytry", "/tmp")
+ f = open(path, "w")
+ f.write("%s\n" % (Str))
+ f.close()
+ cmd = "/usr/bin/ssh-keygen -l -f %s < /dev/null" % (path)
+ (result, output) = commands.getstatusoutput(cmd)
+ os.remove(path)
+ if (result != 0):
+ raise Error, "ssh-keygen -l invocation failed!\n%s\n" % (output)
+
+
+ # Head
+ Date = time.strftime("%a, %d %b %Y %H:%M:%S +0000",time.gmtime(time.time()))
+ ErrReplyHead = "From: %s\nCc: %s\nReply-To: %s\nDate: %s\n" % (os.environ['SENDER'],os.environ['SENDER'],ReplyTo,Date)
+ Subst = {}
+ Subst["__ADMIN__"] = ReplyTo
+ Subst["__USER__"] = uid
+
+ Match = SSHFingerprint.match(output)
+ g = Match.groups()
+
+ if int(g[0]) < 1024:
+ try:
+ # Body
+ Subst["__ERROR__"] = "SSH keysize %s is below limit 1024" % (g[0])
+ ErrReply = TemplateSubst(Subst,open(TemplatesDir+"admin-info","r").read())
+
+ Child = os.popen("/usr/sbin/sendmail -t","w")
+ Child.write(ErrReplyHead)
+ Child.write(ErrReply)
+ if Child.close() != None:
+ raise Error, "Sendmail gave a non-zero return code"
+ except:
+ sys.exit(EX_TEMPFAIL)
+
+ # And now break and stop processing input, which sends a reply to the user.
+ raise Error, "SSH keys must have at least 1024 bits, processing halted, NOTHING MODIFIED AT ALL"
+ elif g[1] in badkeys:
+ try:
+ # Body
+ Subst["__ERROR__"] = "SSH key with fingerprint %s known as bad key" % (g[1])
+ ErrReply = TemplateSubst(Subst,open(TemplatesDir+"admin-info","r").read())
+
+ Child = os.popen("/usr/sbin/sendmail -t","w")
+ Child.write(ErrReplyHead)
+ Child.write(ErrReply)
+ if Child.close() != None:
+ raise Error, "Sendmail gave a non-zero return code"
+ except:
+ sys.exit(EX_TEMPFAIL)
+
+ # And now break and stop processing input, which sends a reply to the user.
+ raise Error, "Submitted SSH Key known to be bad and insecure, processing halted, NOTHING MODIFIED AT ALL"
+
+ if (typekey == "dss"):
+ return "DSA keys not accepted anymore"
+
global SeenKey;
if SeenKey:
Attrs.append((ldap.MOD_ADD,"sshRSAAuthKey",Str));
@@ -368,12 +445,13 @@
Result = Result + "> "+Line+"\n";
try:
if Line == "show":
- Show = 1;
- Res = "OK";
+ Show = 1;
+ Res = "OK";
else:
- Res = DoPosition(Line,Attrs) or DoDNS(Line,Attrs,DnRecord) or \
- DoArbChange(Line,Attrs) or DoSSH(Line,Attrs) or \
- DoDel(Line,Attrs) or DoRBL(Line,Attrs);
+ badkeys = LoadBadSSH()
+ Res = DoPosition(Line,Attrs) or DoDNS(Line,Attrs,DnRecord) or \
+ DoArbChange(Line,Attrs) or DoSSH(Line,Attrs,badkeys,GetAttr(DnRecord,"uid")) or \
+ DoDel(Line,Attrs) or DoRBL(Line,Attrs)
except:
Res = None;
Result = Result + "==> %s: %s\n" %(sys.exc_type,sys.exc_value);
=== modified file 'ud-replicate'
--- a/ud-replicate 2008-04-26 11:49:21 +0000
+++ b/ud-replicate 2008-05-14 18:18:49 +0000
@@ -49,7 +49,7 @@
;;
esac
-rsync ${verbose} -e ssh -rp "${udhost}/var/cache/userdir-ldap/hosts/$HOST" .
+rsync ${verbose} -e 'ssh -i /etc/ssh/ssh_host_rsa_key -o PreferredAuthentications=publickey' -rp "${udhost}/var/cache/userdir-ldap/hosts/$HOST" .
makedb "$HOST/passwd.tdb" -o passwd.db.t
if [ -s "$HOST/shadow.tdb" ]
@@ -68,15 +68,6 @@
ln -sf `pwd -P`/ssh-rsa-shadow /etc/ssh
ln -sf `pwd -P`/ssh_known_hosts /etc/ssh
-find $HOST -name "ssh-rsa-shadow-*" -type f | while read f
-do
- user=$(echo $f | sed s at .*-@@)
- id ${user} 2>/dev/null >/dev/null
- if [ $? -eq 0 ]; then
- chown $user $f
- fi
-done
-
if [ -x /usr/bin/dchroot ]; then
CHROOTS=`dchroot --listpaths`
for c in $CHROOTS; do
=== modified file 'userdir-ldap.conf'
--- a/userdir-ldap.conf 2008-04-26 11:49:21 +0000
+++ b/userdir-ldap.conf 2008-05-14 18:18:49 +0000
@@ -24,6 +24,7 @@
templatesdir = "/etc/userdir-ldap/templates/";
replaycachefile = "/var/cache/userdir-ldap/mail/replay";
#replaycachefile = "/tmp/replay";
+fingerprintfile = "/etc/userdir-ldap/badfingerprints"
# Echelon
ech_errorlog = "/org/db.debian.org/mail/Log/ech-errors.log"
@@ -35,8 +36,6 @@
# For the output generator
generateconf = "/etc/userdir-ldap/generate.conf"
generatedir = "/var/cache/userdir-ldap/hosts/";
-singlesshfile = True
-multiplesshfiles = False
passdir = "/etc/userdir-ldap/";
# GPG Things
=== modified file 'userdir-ldap.schema'
--- a/userdir-ldap.schema 2007-12-25 14:37:29 +0000
+++ b/userdir-ldap.schema 2008-05-10 12:19:22 +0000
@@ -3,6 +3,7 @@
# XXX
# - [PP] Now version controlled in db.d.o bzr repository - 2007-12-25
# - [HE] Add 'purpose', 'physicalHost' to debianServer - 2007-12-25
+# - [zobel] Add 'VoIP' - 2008-05-10
#
# 0.7 [RM]
# - Add 'gender' and 'birthDate' to debianDeveloper
@@ -96,6 +97,7 @@
# .32 - mailDisableMessage
# .33 - purpose
# .34 - physicalHost
+# .35 - VoIP
#
# .3 - experimental LDAP objectClasses
# .1 - debianDeveloper
@@ -350,6 +352,13 @@
SINGLE-VALUE
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
+attributetype ( 1.3.6.1.4.1.9586.100.4.2.35
+ NAME 'VoIP'
+ DESC 'VoIP URL to communicate with that person'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+
# Public object classes
objectclass ( 1.3.6.1.4.1.9586.100.4.1.1
More information about the Da-tools-commits
mailing list