mirror of
https://github.com/kevingruesser/bootstrap-vz.git
synced 2025-08-24 15:36:27 +00:00
[admin_user]: Update per comments
As requested, this commit converts to tab indentation. Signed-off-by: Manoj Srivastava <srivasta@golden-gryphon.com>
This commit is contained in:
Manoj Srivastava
parent
a56f20657b
commit
efeddc43a8
2 changed files with 120 additions and 113 deletions
|
|
@ -1,36 +1,36 @@
|
||||||
|
|
||||||
|
|
||||||
def validate_manifest(data, validator, error):
|
def validate_manifest(data, validator, error):
|
||||||
import os.path
|
import os.path
|
||||||
schema_path = os.path.normpath(os.path.join(os.path.dirname(__file__), 'manifest-schema.yml'))
|
schema_path = os.path.normpath(os.path.join(os.path.dirname(__file__), 'manifest-schema.yml'))
|
||||||
validator(data, schema_path)
|
validator(data, schema_path)
|
||||||
if ('password' in data['plugins']['admin_user'] and 'pubkey' in data['plugins']['admin_user']):
|
if ('password' in data['plugins']['admin_user'] and 'pubkey' in data['plugins']['admin_user']):
|
||||||
msg = 'passwd and pubkey are mutually exclusive.'
|
msg = 'passwd and pubkey are mutually exclusive.'
|
||||||
error(msg, ['plugins', 'admin_user'])
|
error(msg, ['plugins', 'admin_user'])
|
||||||
full_path = data['plugins']['admin_user']['pubkey']
|
full_path = data['plugins']['admin_user']['pubkey']
|
||||||
if not os.path.exists(full_path):
|
if not os.path.exists(full_path):
|
||||||
msg = 'Could not find public key at %s' % full_path
|
msg = 'Could not find public key at %s' % full_path
|
||||||
error(msg, ['plugins', 'admin_user'])
|
error(msg, ['plugins', 'admin_user'])
|
||||||
|
|
||||||
|
|
||||||
def resolve_tasks(taskset, manifest):
|
def resolve_tasks(taskset, manifest):
|
||||||
import tasks
|
import tasks
|
||||||
from bootstrapvz.common.tasks import ssh
|
from bootstrapvz.common.tasks import ssh
|
||||||
|
|
||||||
from bootstrapvz.common.releases import jessie
|
from bootstrapvz.common.releases import jessie
|
||||||
if manifest.release < jessie:
|
if manifest.release < jessie:
|
||||||
taskset.update([ssh.DisableRootLogin])
|
taskset.update([ssh.DisableRootLogin])
|
||||||
|
|
||||||
if 'password' in manifest.plugins['admin_user']:
|
if 'password' in manifest.plugins['admin_user']:
|
||||||
taskset.discard(ssh.DisableSSHPasswordAuthentication)
|
taskset.discard(ssh.DisableSSHPasswordAuthentication)
|
||||||
taskset.add(tasks.AdminUserCredentialsPassword)
|
taskset.add(tasks.AdminUserCredentialsPassword)
|
||||||
else:
|
else:
|
||||||
if 'pubkey' in manifest.plugins['admin_user']:
|
if 'pubkey' in manifest.plugins['admin_user']:
|
||||||
taskset.add(tasks.AdminUserCredentialsPublicKey)
|
taskset.add(tasks.AdminUserCredentialsPublicKey)
|
||||||
else:
|
else:
|
||||||
taskset.add(tasks.AdminUserCredentialsEc2)
|
taskset.add(tasks.AdminUserCredentialsEc2)
|
||||||
|
|
||||||
taskset.update([tasks.AddSudoPackage,
|
taskset.update([tasks.AddSudoPackage,
|
||||||
tasks.CreateAdminUser,
|
tasks.CreateAdminUser,
|
||||||
tasks.PasswordlessSudo,
|
tasks.PasswordlessSudo,
|
||||||
])
|
])
|
||||||
|
|
|
||||||
|
|
@ -8,118 +8,125 @@ import os
|
||||||
|
|
||||||
|
|
||||||
class AddSudoPackage(Task):
|
class AddSudoPackage(Task):
|
||||||
description = 'Adding `sudo\' to the image packages'
|
description = 'Adding `sudo\' to the image packages'
|
||||||
phase = phases.preparation
|
phase = phases.preparation
|
||||||
|
|
||||||
@classmethod
|
@classmethod
|
||||||
def run(cls, info):
|
def run(cls, info):
|
||||||
info.packages.add('sudo')
|
info.packages.add('sudo')
|
||||||
|
|
||||||
|
|
||||||
class CreateAdminUser(Task):
|
class CreateAdminUser(Task):
|
||||||
description = 'Creating the admin user'
|
description = 'Creating the admin user'
|
||||||
phase = phases.system_modification
|
phase = phases.system_modification
|
||||||
|
|
||||||
@classmethod
|
@classmethod
|
||||||
def run(cls, info):
|
def run(cls, info):
|
||||||
from bootstrapvz.common.tools import log_check_call
|
from bootstrapvz.common.tools import log_check_call
|
||||||
log_check_call(['chroot', info.root,
|
log_check_call(['chroot', info.root,
|
||||||
'useradd',
|
'useradd',
|
||||||
'--create-home', '--shell', '/bin/bash',
|
'--create-home', '--shell', '/bin/bash',
|
||||||
info.manifest.plugins['admin_user']['username']])
|
info.manifest.plugins['admin_user']['username']])
|
||||||
|
|
||||||
|
|
||||||
class PasswordlessSudo(Task):
|
class PasswordlessSudo(Task):
|
||||||
description = 'Allowing the admin user to use sudo without a password'
|
description = 'Allowing the admin user to use sudo without a password'
|
||||||
phase = phases.system_modification
|
phase = phases.system_modification
|
||||||
|
|
||||||
@classmethod
|
@classmethod
|
||||||
def run(cls, info):
|
def run(cls, info):
|
||||||
sudo_admin_path = os.path.join(info.root, 'etc/sudoers.d/99_admin')
|
sudo_admin_path = os.path.join(info.root, 'etc/sudoers.d/99_admin')
|
||||||
username = info.manifest.plugins['admin_user']['username']
|
username = info.manifest.plugins['admin_user']['username']
|
||||||
with open(sudo_admin_path, 'w') as sudo_admin:
|
with open(sudo_admin_path, 'w') as sudo_admin:
|
||||||
sudo_admin.write('{username} ALL=(ALL) NOPASSWD:ALL'.format(username=username))
|
sudo_admin.write('{username} ALL=(ALL) NOPASSWD:ALL'.format(username=username))
|
||||||
import stat
|
import stat
|
||||||
ug_read_only = (stat.S_IRUSR | stat.S_IRGRP)
|
ug_read_only = (stat.S_IRUSR | stat.S_IRGRP)
|
||||||
os.chmod(sudo_admin_path, ug_read_only)
|
os.chmod(sudo_admin_path, ug_read_only)
|
||||||
|
|
||||||
|
|
||||||
class AdminUserCredentialsPassword(Task):
|
class AdminUserCredentialsPassword(Task):
|
||||||
description = 'Set up access credentials for the admin user with a given password'
|
description = 'Set up access credentials for the admin user with a given password'
|
||||||
phase = phases.system_modification
|
phase = phases.system_modification
|
||||||
predecessors = [InstallInitScripts, CreateAdminUser]
|
predecessors = [InstallInitScripts, CreateAdminUser]
|
||||||
|
|
||||||
@classmethod
|
@classmethod
|
||||||
def run(cls, info):
|
def run(cls, info):
|
||||||
from bootstrapvz.common.tools import log_check_call
|
from bootstrapvz.common.tools import log_check_call
|
||||||
log = logging.getLogger(__name__)
|
log = logging.getLogger(__name__)
|
||||||
|
|
||||||
log.debug('Setting the password for the admin user.')
|
log.debug('Setting the password for the admin user.')
|
||||||
log_check_call(['chroot', info.root, 'chpasswd'],
|
log_check_call(
|
||||||
info.manifest.plugins['admin_user']['username'] +
|
['chroot', info.root, 'chpasswd'],
|
||||||
':' + info.manifest.plugins['admin_user']['password'])
|
info.manifest.plugins['admin_user']['username'] +
|
||||||
return
|
':' + info.manifest.plugins['admin_user']['password']
|
||||||
|
)
|
||||||
|
return
|
||||||
|
|
||||||
|
|
||||||
class AdminUserCredentialsPublicKey(Task):
|
class AdminUserCredentialsPublicKey(Task):
|
||||||
description = 'Set up access credentials for the admin user with a given public key'
|
description = 'Set up access credentials for the admin user with a given public key'
|
||||||
phase = phases.system_modification
|
phase = phases.system_modification
|
||||||
predecessors = [AddEC2InitScripts, CreateAdminUser]
|
predecessors = [AddEC2InitScripts, CreateAdminUser]
|
||||||
successors = [InstallInitScripts]
|
successors = [InstallInitScripts]
|
||||||
|
|
||||||
@classmethod
|
@classmethod
|
||||||
def run(cls, info):
|
def run(cls, info):
|
||||||
from bootstrapvz.common.tools import log_check_call
|
from bootstrapvz.common.tools import log_check_call
|
||||||
|
|
||||||
log = logging.getLogger(__name__)
|
log = logging.getLogger(__name__)
|
||||||
|
|
||||||
import stat
|
import stat
|
||||||
from shutil import copy
|
from shutil import copy
|
||||||
full_path = info.manifest.plugins['admin_user']['pubkey']
|
full_path = info.manifest.plugins['admin_user']['pubkey']
|
||||||
log.debug('Copying public key from {path}'.format(path=full_path))
|
log.debug('Copying public key from {path}'.format(path=full_path))
|
||||||
|
|
||||||
if 'ec2-get-credentials' in info.initd['install']:
|
if 'ec2-get-credentials' in info.initd['install']:
|
||||||
log.warn('You are using a static public key for the admin account.'
|
log.warn(
|
||||||
' This will conflict with the ec2 public key injection mechanisn.'
|
'You are using a static public key for the admin account.'
|
||||||
' The ec2-get-credentials startup script has therefore been disabled.')
|
' This will conflict with the ec2 public key injection mechanisn.'
|
||||||
del info.initd['install']['ec2-get-credentials']
|
' The ec2-get-credentials startup script has therefore been disabled.')
|
||||||
|
del info.initd['install']['ec2-get-credentials']
|
||||||
|
|
||||||
username = info.manifest.plugins['admin_user']['username']
|
username = info.manifest.plugins['admin_user']['username']
|
||||||
|
|
||||||
ssh_file = os.path.join('/home/', username, '/.ssh/authorized_keys')
|
ssh_file = os.path.join('/home/', username, '.ssh/authorized_keys')
|
||||||
rel_ssh_file = os.path.realpath(info.root + '/%s' % ssh_file)
|
rel_ssh_file = os.path.realpath(info.root + '/%s' % ssh_file)
|
||||||
|
|
||||||
ssh_dir = os.path.dirname(ssh_file)
|
ssh_dir = os.path.dirname(ssh_file)
|
||||||
rel_ssh_dir = os.path.realpath(info.root + '/%s' % ssh_dir)
|
rel_ssh_dir = os.path.realpath(info.root + '/%s' % ssh_dir)
|
||||||
if not os.path.exists(rel_ssh_dir):
|
if not os.path.exists(rel_ssh_dir):
|
||||||
log.debug('Creating %s mode 700' % rel_ssh_dir)
|
log.debug('Creating %s.' % rel_ssh_dir)
|
||||||
os.mkdir(rel_ssh_dir, 0700)
|
os.mkdir(rel_ssh_dir)
|
||||||
else:
|
|
||||||
log.debug('setting %s mode 700' % rel_ssh_dir)
|
log.debug('setting %s mode 700' % rel_ssh_dir)
|
||||||
os.chmod(rel_ssh_dir, 0700)
|
mode = (stat.S_IRUSR | stat.S_IWUSR | stat.S_IXUSR)
|
||||||
copy(full_path, rel_ssh_file)
|
os.chmod(rel_ssh_dir, mode)
|
||||||
mode = (stat.S_IRUSR | stat.S_IWUSR)
|
|
||||||
os.chmod(rel_ssh_file, mode)
|
copy(full_path, rel_ssh_file)
|
||||||
log_check_call(['chroot', info.root, 'chown', '-R', username, ssh_dir])
|
|
||||||
return
|
mode = (stat.S_IRUSR | stat.S_IWUSR)
|
||||||
|
os.chmod(rel_ssh_file, mode)
|
||||||
|
|
||||||
|
log_check_call(['chroot', info.root, 'chown', '-R', username, ssh_dir])
|
||||||
|
return
|
||||||
|
|
||||||
|
|
||||||
class AdminUserCredentialsEC2(Task):
|
class AdminUserCredentialsEC2(Task):
|
||||||
description = 'Set up access credentials for the admin user using the EC2 credentials'
|
description = 'Set up access credentials for the admin user using the EC2 credentials'
|
||||||
phase = phases.system_modification
|
phase = phases.system_modification
|
||||||
predecessors = [InstallInitScripts, CreateAdminUser]
|
predecessors = [InstallInitScripts, CreateAdminUser]
|
||||||
|
|
||||||
@classmethod
|
@classmethod
|
||||||
def run(cls, info):
|
def run(cls, info):
|
||||||
from bootstrapvz.common.exceptions import TaskError
|
from bootstrapvz.common.exceptions import TaskError
|
||||||
from bootstrapvz.common.tools import sed_i
|
from bootstrapvz.common.tools import sed_i
|
||||||
log = logging.getLogger(__name__)
|
log = logging.getLogger(__name__)
|
||||||
|
|
||||||
getcreds_path = os.path.join(info.root, 'etc/init.d/ec2-get-credentials')
|
getcreds_path = os.path.join(info.root, 'etc/init.d/ec2-get-credentials')
|
||||||
if os.path.exists(getcreds_path):
|
if os.path.exists(getcreds_path):
|
||||||
log.debug('Updating EC2 get credentials script.')
|
log.debug('Updating EC2 get credentials script.')
|
||||||
username = info.manifest.plugins['admin_user']['username']
|
username = info.manifest.plugins['admin_user']['username']
|
||||||
sed_i(getcreds_path, "username='root'",
|
sed_i(getcreds_path, "username='root'",
|
||||||
"username='{username}'".format(username=username))
|
"username='{username}'".format(username=username))
|
||||||
else:
|
else:
|
||||||
raise TaskError('Could not find EC2 get credentials script.')
|
raise TaskError('Could not find EC2 get credentials script.')
|
||||||
|
|
|
||||||
Loading…
Add table
Reference in a new issue