summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorStephen Hemminger <stephen.hemminger@vyatta.com>2008-06-16 10:26:59 -0700
committerStephen Hemminger <stephen.hemminger@vyatta.com>2008-06-16 10:26:59 -0700
commit2a17817654ab8c850a3f6559e847ac376f3bae8a (patch)
treed01e2dd729a8bc01c65eae1f83b37aa9fb46466b
parent41b590edb001c5eda6b71b54d1b77a79270387c5 (diff)
downloadvyatta-cfg-quagga-2a17817654ab8c850a3f6559e847ac376f3bae8a.tar.gz
vyatta-cfg-quagga-2a17817654ab8c850a3f6559e847ac376f3bae8a.zip
Add passwd sync script
New script for use in password to configuration sychronization. Part of bugfix 1856 support.
-rw-r--r--Makefile.am1
-rwxr-xr-xscripts/vyatta-passwd-sync280
2 files changed, 281 insertions, 0 deletions
diff --git a/Makefile.am b/Makefile.am
index 3ad950a8..c50c8560 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -16,6 +16,7 @@ sbin_SCRIPTS += scripts/rl-system.init
sbin_SCRIPTS += scripts/install-system
sbin_SCRIPTS += scripts/quick-install
sbin_SCRIPTS += scripts/standalone_root_pw_reset
+sbin_SCRIPTS += scripts/vyatta-passwd-sync
sbin_SCRIPTS += scripts/system/vyatta_update_login.pl
sbin_SCRIPTS += scripts/system/vyatta_update_logrotate.pl
sbin_SCRIPTS += scripts/system/vyatta_update_resolv.pl
diff --git a/scripts/vyatta-passwd-sync b/scripts/vyatta-passwd-sync
new file mode 100755
index 00000000..29748b67
--- /dev/null
+++ b/scripts/vyatta-passwd-sync
@@ -0,0 +1,280 @@
+#! /usr/bin/perl
+# **** License ****
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# General Public License for more details.
+#
+# This code was originally developed by Vyatta, Inc.
+# Portions created by Vyatta are Copyright (C) 2008 Vyatta, Inc.
+# All Rights Reserved.
+# **** End License ****
+
+use lib "/opt/vyatta/share/perl5/";
+use VyattaConfig;
+use strict;
+use Getopt::Long;
+
+my ( $resync, $verbose, $force, $check );
+
+GetOptions(
+ "verbose" => \$verbose,
+ "resync" => \$resync,
+ "force" => \$force,
+ "check" => \$check,
+);
+
+#
+# These should move to VyattaConfig.pm??
+#
+
+sub add_node {
+ my ( $config, $level ) = @_;
+ $level =~ s/\//%2F/g;
+ $level =~ s/\s+/\//g;
+
+ my $path =
+ $config->{_new_config_dir_base}
+ . $config->{_current_dir_level} . '/'
+ . $level;
+ if ( !-d $path ) {
+ mkdir $path or die "Can't make directory $path : $!\n";
+ }
+}
+
+sub set_node {
+ my ( $config, $level, $val ) = @_;
+ $level =~ s/\//%2F/g;
+ $level =~ s/\s+/\//g;
+ my $path =
+ $config->{_new_config_dir_base}
+ . $config->{_current_dir_level} . '/'
+ . $level;
+
+ if ( !-d $path ) {
+ system("mkdir -p $path");
+ }
+
+ my $fname = $path . '/node.val';
+
+ open my $output, '>', $fname
+ or die "Can't open $fname: $!\n";
+ print $output "$val\n";
+ close $output;
+}
+
+sub delete_node {
+ my ( $config, $level ) = @_;
+ $level =~ s/\//%2F/g;
+ $level =~ s/\s+/\//g;
+ my $path =
+ $config->{_new_config_dir_base}
+ . $config->{_current_dir_level} . '/'
+ . $level;
+ if ( -d $path ) {
+ system("rm -fr $path");
+ }
+}
+
+my $members;
+( undef, undef, undef, $members ) = getgrnam('operator');
+my @operators = split( / /, $members );
+
+( undef, undef, undef, $members ) = getgrnam('vyattacfg');
+my @admins = split( / /, $members );
+
+sub get_user_level {
+ my $name = shift;
+
+ return 'admin' if ( $name eq 'root' );
+
+ foreach my $id (@admins) {
+ return 'admin' if ( $id eq $name );
+ }
+
+ foreach my $id (@operators) {
+ return 'operator' if ( $id eq $name );
+ }
+
+ # If level indetermined returns undef
+}
+
+my @field_names =
+ ( 'encrypted password', 'full name', 'home directory', 'level' );
+
+sub system_vyatta_users {
+ my %users = ();
+ setpwent();
+ while (
+ my ( $name, $passwd, $uid, $gid, undef, $comment, undef, $home, $shell )
+ = getpwent() )
+ {
+ if ( $name eq 'root' || $shell eq '/bin/vbash' ) {
+ $users{$name} = [ $passwd, $comment, $home, get_user_level($name) ];
+ }
+ }
+ endpwent();
+
+ return %users;
+}
+
+sub listOrigUsers {
+ my $config = new VyattaConfig;
+ my %users = ();
+
+ foreach my $name ( $config->listOrigNodes('system login user') ) {
+ $config->setLevel("system login user $name");
+
+ my $passwd =
+ $config->returnOrigValue('authentication encrypted-password');
+ my $comment = $config->returnOrigValue('full-name');
+ my $home = $config->returnOrigValue('home-directory');
+ my $level = $config->returnOrigValue('level');
+ $level = 'admin' if ( !defined $level );
+
+ $users{$name} = [ $passwd, $comment, $home, $level ];
+ }
+
+ return %users;
+}
+
+sub check_config {
+ my %pwdusers = system_vyatta_users();
+ my %vtyusers = listOrigUsers();
+ my $exit_code = 0;
+
+ if ($verbose) {
+ printf "System users: %s\n", join( ', ', keys %pwdusers );
+ printf "Configured users: %s\n", join( ', ', keys %vtyusers );
+ }
+
+ while ( my ( $user, $fields ) = each(%vtyusers) ) {
+ my @pwd_fields = @{ $pwdusers{$user} };
+ my @cfg_fields = @$fields;
+
+ if (@pwd_fields) {
+ for ( my $i = 0 ; $i <= $#pwd_fields ; $i++ ) {
+ if ( $pwd_fields[$i] ne $cfg_fields[$i] ) {
+ printf "%s: %s mismatch: '%s' != '%s'\n", $user,
+ $field_names[$i], $pwd_fields[$i], $cfg_fields[$i];
+ $exit_code = 1;
+ }
+ }
+ delete $pwdusers{$user};
+ }
+ else {
+ print "$user: does not exist in system\n";
+ $exit_code = 1;
+ }
+ }
+
+ foreach my $user ( keys %pwdusers ) {
+ print "$user: does not exist in vyatta configuration\n";
+ $exit_code = 1;
+ }
+
+ exit $exit_code;
+}
+
+sub listUsers {
+ my $config = new VyattaConfig;
+ my %users = ();
+
+ foreach my $name ( $config->listOrigNodes('system login user') ) {
+ $config->setLevel("system login user $name");
+
+ my $passwd =
+ $config->returnOrigValue('authentication encrypted-password');
+ my $comment = $config->returnOrigValue('full-name');
+ my $home = $config->returnOrigValue('home-directory');
+ my $level = $config->returnOrigValue('level');
+ $level = 'admin' if ( !defined $level );
+
+ $users{$name} = [ $passwd, $comment, $home, $level ];
+ }
+
+ return %users;
+}
+
+sub resync_config {
+ my %system_users = system_vyatta_users();
+ my %vyatta_users = listUsers();
+ my $config = new VyattaConfig;
+
+ $config->setLevel('system login user');
+
+ foreach my $user ( keys %vyatta_users ) {
+ if ( !defined $system_users{$user} ) {
+ if ($force) {
+ print "Deleting user: $user\n" if ($verbose);
+ del_node( $config, $user );
+ }
+ else {
+ print "user: $user does not exist in passwd file\n";
+ }
+ }
+ }
+
+ foreach my $user ( keys %system_users ) {
+ my ( $passwd, $comment, $home, $level ) = @{ $system_users{$user} };
+
+ if ( !defined $level ) {
+ print "user $user: could not determine level (incorrect groups)\n";
+ next;
+ }
+
+ my $existing = $vyatta_users{$user};
+ if ( !defined $existing ) {
+ if ($force) {
+ print "Adding $user\n" if ($verbose);
+ add_node( $config, $user );
+ }
+ else {
+ print "user: $user does not exist in vyatta config\n";
+ next;
+ }
+ }
+ else {
+ my ( $opasswd, $ocomment, $ohome, $olevel ) = @{$existing};
+ if ( $opasswd eq $passwd
+ && $ocomment eq $comment
+ && $ohome eq $home
+ && $olevel eq $level ) {
+ print "$user: no change\n" if ($verbose);
+ next;
+ }
+ else {
+ print "$user: fields don't match\n" if ($verbose);
+ }
+ }
+
+ if ( $comment ne '' ) {
+ set_node( $config, "$user full-name", $comment );
+ }
+
+ set_node( $config, "$user authentication encrypted-password", $passwd );
+ set_node( $config, "$user level", $level );
+ set_node( $config, "$user home-directory", $home );
+ }
+}
+
+if ($check) {
+ check_config();
+ exit 0;
+}
+
+if ($resync) {
+ resync_config();
+ exit 0;
+}
+
+print <<EOF;
+usage: vyatta-passwd-sync.pl [--verbose ] [--force ] --resync
+ vyatta-passwd-sync.pl [--verbose ] --check
+EOF
+
+exit 1;