File: //proc/self/root/lib/python3.6/site-packages/ipaclient/install/__pycache__/ipa_epn.cpython-36.pyc
3
�d[er � @ s� d Z ddlmZmZ ddlZddlZddlZddlZddlZddl Z ddl
Z
ddl Z ddl Z ddl
mZ ddlmZmZ ddlmZmZ ddlmZ ddlmZ dd lmZ dd
lmZ dd lm Z dd l m Z dd
l m!Z!m"Z" ddl#m$Z$ ddl%m&Z&m'Z' ddl(m)Z) ddl*m+Z+m,Z,m-Z- dZ.ddddddddddddddddd �Z/e j0e1�Z2d(d d �Z3G d d!� d!�Z4G d"d#� d#e&j5�Z6G d$d%� d%�Z7G d&d'� d'�Z8dS ))zoThis tool prepares then sends email notifications to users
whose passwords are expiring in the near future.
� )�absolute_import�print_functionN)�deque)�datetime� timedelta)�
formataddr�
formatdate)�
MIMEMultipart)�MIMEText)�Header)�
make_msgid)�error)�paths)�api�errors)�is_ipa_client_configured)� admintool�ipaldap)�DN)� Environment�FileSystemLoader�TemplateSyntaxErrorz/etc/ipa/epn.conf� localhost� �< �nonezroot@localhostz 28,14,7,3,1�utf8�plainz Your password will expire soon.)� smtp_server� smtp_port� smtp_user�
smtp_password�smtp_client_cert�smtp_client_key�smtp_client_key_pass� smtp_timeout�
smtp_security�
smtp_admin�
smtp_delay� mail_from� notify_ttls� msg_charset� msg_subtype� msg_subject�daemonc C s� ybt j� dkrdS t jg � t jtj| �j� t jtj |�j
� t j� dkrRt � �t j
d| |� W n2 t k
r� } zt jd| ||� W Y dd}~X nX dS )z0Drop privileges, defaults to daemon:daemon.
r Nz'Dropped privileges to user=%s, group=%sz'Failed to drop privileges to %s, %s: %s)�os�getuid� setgroups�setgid�pwd�getpwnamZpw_uid�setuid�grpZgetgrnamZgr_gid� Exception�logger�debugr
)Z new_usernameZ
new_groupname�e� r; � /usr/lib/python3.6/ipa_epn.py�drop_privilegesL s$
r= c @ sZ e Zd ZdZdd� Zdd� Zdd� Zdd � Zd
d � Zd d
� Z dd� Z
ddd�Z dd� Z dS )� EPNUserLista" Maintains a list of users whose passwords are expiring.
Provides add(), check(), pop(), and json_print().
From the outside, the list is considered always sorted:
* displaying the list results in a sorted JSON representation thereof
* pop() returns the "most urgent" item from the list.
Internal implementation notes:
* Uses a deque instead of a list for efficiency reasons
* all add()-style methods MUST set _sorted to False.
* all print() and pop-like methods MUST call _sort() first.
c C s d| _ t� | _d S )NF)�_sortedr �_expiring_password_user_dq)�selfr; r; r< �__init__u s zEPNUserList.__init__c C s
t | j�S )z)If it quacks like a container...
)�boolr@ )rA r; r; r< �__bool__y s zEPNUserList.__bool__c C s
t | j�S )zReturn len(self).)�lenr@ )rA r; r; r< �__len__~ s zEPNUserList.__len__c C s t |j|dg�jd��S )z9Get a single value from a multi-valued attr in a safe way� r )�str�get�pop)rA �entry�attrr; r; r< �
get_ldap_attr� s zEPNUserList.get_ldap_attrc C s� yxd| _ |jd�dkr(tjd|j� dS | jjt| j|d�| j|d�| j|d�| j|d�| j|d �t |jd��d
�� W n. t
k
r� } ztj d |� W Y dd}~X nX dS ) z�Parses and appends an LDAP user entry with the uid, cn,
givenname, sn, krbpasswordexpiration and mail attributes.
F�mailNz(IPA-EPN: No mail address defined for: %s�uid�cn� givenname�sn�krbpasswordexpiration)rO rP rQ rR rS rN z"IPA-EPN: Could not parse entry: %s) r? rI r8 r
Zdnr@ �append�dictrM rH �
IndexError�info)rA rK r: r; r; r< �add� s
zEPNUserList.addc C s, | j � y
| jj� S tk
r& dS X dS )zPReturns the "most urgent" user to notify.
In fact: popleft()
FN)�_sortr@ �popleftrV )rA r; r; r< rJ � s
zEPNUserList.popc C s | j dd� d S )NF)� really_print)�
json_print)rA r; r; r< �check� s zEPNUserList.checkTc C sl y8| j � tjt| j�ddd�}|jd� |r6t|� W n. tk
rf } ztj d|� W Y dd}~X nX dS )z�Dump self._expiring_password_user_dq to JSON.
Check that the result can be re-rencoded to UTF-8.
If really_print, print the result.
� F)�indentZ ensure_asciir z IPA-EPN: unexpected error: %sN)
rY �json�dumps�listr@ �encode�printr7 r8 r
)rA r[ Ztemp_strr: r; r; r< r\ � s
zEPNUserList.json_printc C s4 | j s0t| jt�r0tt| jdd� d��| _d| _ d S )Nc S s | d S )NrS r; )�itemr; r; r< �<lambda>� s z#EPNUserList._sort.<locals>.<lambda>)�keyT)r? �
isinstancer@ r �sorted)rA r; r; r< rY � s zEPNUserList._sortN)T)
�__name__�
__module__� __qualname__�__doc__rB rD rF rM rX rJ r] r\ rY r; r; r; r< r> i s
r> c s� e Zd ZdZejZdZdZ� fdd�Z e
� fdd��Z � fdd �Z d/� fd d � Z
� fd
d�Zd0dd�Zdd� Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd1d'd(�Zd)d*� Zd+d,� Z d-d.� Z � Z S )2�EPNzIPA-EPNz%prog [options]z%Expiring Password Notifications (EPN)c sH t t| �j||� d | _d | _t� | _g | _g | _d | _ d | _
d | _ d S )N) �superrn rB �_conn� _ssl_contextr> � _expiring_password_user_list�
_ldap_data� _date_ranges�_mailer�env�default_email_domain)rA �options�args)� __class__r; r< rB � s z EPN.__init__c sh t t| �j|dd� |jdddd dd� |jdd dd d
d� |jd d d
ddd� |jddd
ddd� d S )NT)Z debug_optionz
--from-nbdays� from_nbdaysZstorezminimal number of days)�dest�action�default�helpz --to-nbdays� to_nbdayszmaximal number of daysz --dry-run�dry_run�
store_trueFz Dry run mode. JSON ouput only.z --mail-test�mailtestzSend a test e-mail)ro rn � add_optionsZ
add_option)�cls�parser)rz r; r< r� � s2 zEPN.add_optionsc sf t t| �jdd� | jjd k rzy t| jj�dk r8td��W n6 tk
rp } z| jj dj
|d�� W Y d d }~X nX d| j_ | jj d k r�y t| jj �dk r�td��W n6 tk
r� } z| jj dj
|d�� W Y d d }~X nX | jj d k o�| jjd k �rt| jj �t| jj�k�r| jj d� | jj d k �rB| jjd k�rB| jj d � | jj
�rb| jj �rb| jj d
� d S ) NT)Z
needs_rootr zInput is negative.z/--to-nbdays must be a positive integer. {error})r
z1--from-nbdays must be a positive integer. {error}z/--from-nbdays must be smaller than --to-nbdays.z4You cannot specify --from-nbdays without --to-nbdaysz5You cannot specify --mail-test and --dry-run together)ro rn �validate_optionsrx r� �int� RuntimeErrorr7 Z
option_parserr
�formatr� r{ r� )rA r: )rz r; r< r� � s< zEPN.validate_options�ac s t t| �jdd� d S )Nr� )�
log_file_mode)ro rn �
setup_logging)rA r� )rz r; r< r� ! s zEPN.setup_loggingc s t t| �j� t� s&tjd� tj� �| j� | j � | j
� | j � | j � | j
� | j� t� | jjrv| j� n2| jjr�| j� x | jD ]}| j|� | j� q�W | jjr�| j� nJttj j tj j tj j tj j tj j!tj j"| j#| j$tj j%tj j&d�
| _'| j(� d S )Nz,IPA client is not configured on this system.)
�security_protocol�
smtp_hostnamer r% �
smtp_usernamer! � ssl_context�x_mailerr, r+ ))ro rn �runr r8 r
r � ScriptError�_get_krb5_ticket�_read_configuration�_validate_configuration�_parse_configuration�_get_connection�_read_ipa_configuration�_create_ssl_contextr= rx r� � _gentestdatar� �_build_cli_date_rangesrt �_fetch_data_from_ldap�_parse_ldap_datar� �_pretty_print_data�
MailUserAgentr rv r& r r r% r r! rq � command_namer, r+ ru � _send_emails)rA �
date_range)rz r; r< r� $ sB
zEPN.runNc C sh t j� }t j|t jj� �}|t|d� }|dk r@|t|d� }n|tdd� }tjd||||� ||fS )z�Detects current time and returns a date range, given a number
of days in the future.
If only nbdays_end is specified, the range is 1d long.
)�daysN� z�IPA-EPN: Current date: %s
IPA-EPN: Date & time, today at midnight: %s
IPA-EPN: Date range start: %s
IPA-EPN: Date range end: %s
)r �utcnowZcombine�min�timer r8 r9 )rA �
nbdays_end� nbdays_start�nowZtoday_at_midnightZ range_endZ range_startr; r; r< �_get_date_range_from_nbdaysN s z EPN._get_date_range_from_nbdaysc C sB |j � }t|j�djdd� |j|j|j|j|jfD �� }|d S )zgConvert datetime to LDAP_GENERALIZED_TIME_FORMAT
Note: Consider moving into ipalib.
rG c s s* | ]"}d dt t|�� t|� V qdS )�0� N)rE rH )�.0re r; r; r< � <genexpr>m s z4EPN._datetime_to_generalized_time.<locals>.<genexpr>�Z) Z timetuplerH Ztm_year�joinZtm_monZtm_mdayZtm_hourZtm_minZtm_sec)rA ZdtZgeneralized_time_strr; r; r< � _datetime_to_generalized_timeg s z!EPN._datetime_to_generalized_timec C s t jjdd� dt jd< dS )z�Setup the environment to obtain a krb5 ticket for us using the
system keytab.
Uses CCACHE = MEMORY (limited to the current process).
ZKRB5_CLIENT_KTNAMEz/etc/krb5.keytabzMEMORY:Z
KRB5CCNAMEN)r/ �environ�
setdefault)rA r; r; r< r� x s zEPN._get_krb5_ticketc C s@ t dtjdd�}tjf |� tjjf t� tjd�s<tj � dS )z5Merge in the EPN configuration from /etc/ipa/epn.conf�epnF)�context�confdirZ in_server�finalizeN)
rU r ZETC_IPAr Z bootstraprv Z_merge�
EPN_CONFIGZisdoner� )rA Z base_configr; r; r< r� � s
zEPN._read_configurationc C s t jjj� dkrtd��t jjdk r8t jjdkr8td��t jjdkrPtdt ��y dd � t t jj�j
d
�D � W n6 t k
r� } ztd t jj|f ��W Y dd}~X nX t jj �r yt
t jj � W n. t k
r� } ztd | ��W Y dd}~X nX t
t jj �d
k �r td��dS )z1Examine the user-provided configuration.
r �starttls�sslz3smtp_security must be one of: none, starttls or sslNz&smtp_user set and smtp_password is notz notify_ttls must be set in %sc S s g | ] }t |��qS r; )r� )r� �kr; r; r< �
<listcomp>� s z/EPN._validate_configuration.<locals>.<listcomp>�,z%Failed to parse notify_ttls: '%s': %sz smtp_delay is misformatted: %sr z#smtp_delay cannot be less than zero)r r� r� )r rv r& �lowerr� r r! r* �EPN_CONFrH �split�
ValueErrorr( �float)rA r: r; r; r< r� � s& "
zEPN._validate_configurationc C sr dd� t tjj�jd�D �}|j� x&|D ] }| jj| jd|d d�� q*W t t
j j tjj
d��}t|d�| _dS ) z
c S s g | ] }t |��qS r; )r� )r� r� r; r; r< r� � s z,EPN._parse_configuration.<locals>.<listcomp>r� Nr� )r� r� r� )�loader)rH r rv r* r� �sortrt rT r� r r/ �pathr� r� r )rA ZdaylistZdayr� r; r; r< r� � s
zEPN._parse_configurationc C s> t jjj� t jj� d }|jddg�d | _t jjj� dS )zGet the IPA configuration�resultZipadefaultemaildomainNr ) r ZBackendZ rpcclientZconnectZCommandZ config_showrI rw Z
disconnect)rA r� r; r; r< r� � s
zEPN._read_ipa_configurationc C s� | j dk r| j S y tjjtjj�| _ | j j� W nj tk
r� y tjj tjj
�| _ | j j � W n4 tk
r� } zt j
d| j j|� W Y dd}~X nX Y nX | j S )z4Create a connection to LDAP and bind to it.
Nz$Unable to bind to LDAP server %s: %s)rp r Z
LDAPClientZ
from_realmr rv ZrealmZ
external_bindr7 Zfrom_hostname_secureZserverZ gssapi_bindr8 r
Zldap_uri)rA r: r; r; r< r� � s
zEPN._get_connectionc C sH t jjj� dkrDtj� | _t jjrD| jjt jjt jj t
t jj �d� dS )z�Create SSL context.
This must be done before the dropping priviliges to allow
read in the smtp client's certificate and private key if specified.
r� r� )ZcertfileZkeyfileZpasswordN)r� r� ) r rv r& r� r� Zcreate_default_contextrq r" Zload_cert_chainr# rH r$ )rA r; r; r< r� � s
zEPN._create_ssl_contextc C s� | j dkrtjd� ttjjtjj�}ddddddg}d | j|d
�| j|d �f }zDy | j j |||| j j
d �| _ W n t j
k
r� tjd
� Y nX W dtjdt| j �� X dS )z�Run a LDAP query to fetch a list of user entries whose passwords
would expire in the near future. Store in self._ldap_data.
Nz5IPA-EPN: Connection to LDAP not established. Exiting.rO rS rN rP rQ Zsurnamezj(&(!(nsaccountlock=TRUE)) (krbpasswordexpiration<=%s) (krbpasswordexpiration>=%s))r� r )�filter�
attrs_listZscopez
Empty Result.z%d entries found)rp r8 r
r r rv Zcontainer_userZbasednr� Z get_entriesZ
SCOPE_SUBTREErs r Z EmptyResultr9 rE )rA r� Z search_baser� Z
search_filterr; r; r< r� � s$
zEPN._fetch_data_from_ldapc C st | j rpx| j D ]}| jj|� qW zDy| jdd� W n. tk
rb } ztjd|� W Y dd}~X nX W dg | _ X dS )zHFill out self._expiring_password_user_list from data from ldap.
F)r[ z"IPA-EPN: Could not create JSON: %sN)rs rr rX r� r7 r8 r
)rA rK r: r; r; r< r� s "zEPN._parse_ldap_dataTc C s | j j|d� dS )z8Dump self._expiring_password_user_list to JSON.
)r[ N)rr r\ )rA r[ r; r; r< r� s zEPN._pretty_print_datac C s@ | j d krtjd� d S y| jjd�}W n4 tk
r\ } ztd|j|f ��W Y d d }~X nX tjj rptjj }n
d| j
}x�| j �r0| j j � }|j
|d |d |d |d |d d
�}| j jtjj|tj|d �|d � tj� }tj|d d
�}tjd|d |d || j|� tjjr|tjttjj�d � q|W | j j� d S )Nz#IPA-EPN: mailer was not configured.zexpire_msg.templatez Parsing template %s failed: %sz
noreply@%srO rQ rR rP rS )rO �firstZlast�fullnameZ
expirationrN )� mail_subject� mail_body� subscribersr) z%Y-%m-%d %H:%M:%Sz5Notified %s (%s). Password expiring in %d days at %s.i� ) ru r8 r
rv Z get_templater r� �filenamer r) rw rr rJ Zrender� send_messager- �astZ literal_evalr r� Zstrptimer9 r� r( r� Zsleepr� �cleanup)rA �templater: r) rK Zbodyr� �expdater; r; r< r� sF
zEPN._send_emailsc C sB t j� jd�}tdgdgdgdg|gtjjgd�}| jj|� dS )z@Generate a sample user to process through the template.
z%Y-%m-%d %H:%M:%SZSAUSERz SAMPLE USERZSAMPLEZUSER)rO rP rQ rR rS rN N) r r� ZstrftimerU r rv r' rr rX )rA r� rK r; r; r< r� E s zEPN._gentestdatac C sr g | _ tjd� | jjdk rD| j j| jt| jj�t| jj�d�� n*| jjdk rn| j j| jdt| jj�d�� dS )z�When self.options.to_nbdays is set, override the date ranges read
from the configuration file and build the date ranges from the CLI
options.
z,IPA-EPN: Ignoring configuration file ranges.N)r� r� ) rt r8 r9 rx r{ rT r� r� r� )rA r; r; r< r� S s
zEPN._build_cli_date_ranges)r� )N)T) rj rk rl r� r Z
IPAEPN_LOGZ
log_file_nameZusage� descriptionrB � classmethodr� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� �
__classcell__r; r; )rz r< rn � s0 % *
$
)rn c @ s< e Zd ZdZddd�Zd d
� Zdd d �Zd
d� Zdd� ZdS )� MTAClientz/MTA Client class. Originally done for EPN.
r r r r Nc C sZ || _ || _|| _|| _|| _|| _|| _d | _| j dkrNd| jkrNtj d� | j
� d S )Nr r zBIPA-EPN: using cleartext for non-localhost SMTPd is not supported.) �_security_protocol�_smtp_hostname�
_smtp_port�
_smtp_timeout� _username� _passwordrq rp r8 r
�_connect)rA r� r� r r% r� r! r� r; r; r< rB m s
zMTAClient.__init__c C s | j � d S )N)� _disconnect)rA r; r; r< r� � s zMTAClient.cleanupc C s� d }zLy| j jtjj||�}W n. tk
rL } ztjd|� W Y d d }~X nX W d |r�x,|D ]$}tjd||| d || d � q\W tjd� X d S )Nz IPA-EPN: Failed to send mail: %sz+IPA-EPN: Failed to send mail to '%s': %s %sr r� z6IPA-EPN: Failed to send mail to at least one recipient)rp Zsendmailr rv r' r7 r8 rW )rA � message_strr� r� r: rg r; r; r< r� � s "
zMTAClient.send_messagec ; C s yH| j j� dkr*tj| j| j| jd�| _n tj| j| j| j| j d�| _W nF t
tj fk
r� } z$dj | j| j|d�}t
j|��W Y d d }~X nX y| jj� W n8 tj k
r� } ztjd| j| j|� W Y d d }~X nX | j j� dk�rDy | jj| j d� | jj� W n< tj k
�rB } z td | j| j|f ��W Y d d }~X nX | j�r| j�r| jjd
��r�y,| jj| j| j� | j dk�r�tjd � W nf tjk
�r� td | j| jf ��Y n< tj k
�r� } z td
| j| j|f ��W Y d d }~X nX nd| j| jf }tj|� d S )Nr r� )�host�port�timeout)r� r� r� r� zPIPA-EPN: Could not connect to the configured SMTP server: {host}:{port}: {error})r� r� r
z'IPA-EPN: EHLO failed for host %s:%s: %s)r� z;IPA-EPN: Unable to create an encrypted session to %s:%s: %sZAUTHz6IPA-EPN: Username and Password were sent in the clear.zTIPA-EPN: Authentication to %s:%s failed, please check your username and/or password:z IPA-EPN: SMTP Error at %s:%s:%sz9IPA-EPN: Server at %s:%s does not support authentication.)r r� )r� r� �smtplibZSMTPr� r� r� rp ZSMTP_SSLrq � socketerrorZ
SMTPExceptionr� r r� Zehlor8 r
r� r� r� r� Zhas_extnZloginZwarningZSMTPAuthenticationError)rA r: �msgZerr_strr; r; r< r� � sn $
zMTAClient._connectc C s | j j� d S )N)rp �quit)rA r; r; r< r� � s zMTAClient._disconnect)r r r r NNN)NN) rj rk rl rm rB r� r� r� r� r; r; r; r< r� i s
Mr� c
@ s4 e Zd ZdZdd d
�Zd d � Zdd
d�Zdd� ZdS )r� zThe MUA class for EPN.
r r r r Nr r c C sL || _ d | _d | _d | _| | _|
| _d | _d | _t|||||||d�| _ d S )N)r� r� r r% r� r! r� )
� _x_mailer�_subject�_body� _subscribers�_subtype�_charset�_msg� _message_strr� � _mta_client) rA r� r� r r% r� r! r� r� r, r+ r; r; r< rB � s zMailUserAgent.__init__c C s | j j� d S )N)r� r� )rA r; r; r< r� s zMailUserAgent.cleanupc C sF d||||gkr t jd� dS | j||||d� | jj| j|d� dS )zfGiven mail_subject, mail_body, and subscribers, composes
the message and sends it.
Nz(IPA-EPN: Tried to send an empty message.F)r� r� r� r) )r� r� T)r8 r
�_compose_messager� r� r� )rA r� r� r� r) r; r; r< r� s
zMailUserAgent.send_messagec C s� || _ || _|| _t| jd�| _td|f�| jd< dj| j�| jd< tdd�| jd< t | j | j�| jd < t
� | jd
< d | j_ d | jkr�| j r�| jj
d | j � | jjt| jd
| j| jd�� | jj� | _dS )z7The composer creates a MIME multipart message.
)r� zIPA-EPNZFromz, ZToT)Z localtimeZDateZSubjectz
Message-IdzMultipart messagezX-Mailerz
)r� r� N)r� r� r� r r� r� r r� r r r Zpreambler� Z
add_headerZattachr
r� Z as_stringr� )rA r� r� r� r) r; r; r< r� 5 s$ z MailUserAgent._compose_message)
r r r r NNNNr r )NNNN)rj rk rl rm rB r� r� r� r; r; r; r< r� � s
r� )r. r. )9rm Z
__future__r r r� r6 r` r/ r3 Zloggingr� r� r� � collectionsr r r Z email.utilsr r Zemail.mime.multipartr Zemail.mime.textr
Z email.headerr r Zsocketr
r� Zipaplatform.pathsr Zipalibr r Z ipalib.factsr Z ipapythonr r Z ipapython.dnr Zjinja2r r r r� r� Z getLoggerrj r8 r= r> Z AdminToolrn r� r� r; r; r; r< �<module> sf
a "