Current File : //lib/python2.7/site-packages/salt/beacons/btmp.pyc
�
���^c
@@ sP d Z d d l m Z m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
Z d d l Z d d l m
Z
d Z d Z d Z d d d
d d d
d d d d g
Z e j e � Z d Z e j e � Z y d d l j Z e Z Wn e k
r e Z n Xd � Z d � Z d � Z! d � Z" d � Z# d � Z$ d � Z% d S( u?
Beacon to fire events at failed login of users
.. versionadded:: 2015.5.0
Example Configuration
=====================
.. code-block:: yaml
# Fire events on all failed logins
beacons:
btmp: []
# Matching on user name, using a default time range
beacons:
btmp:
- users:
gareth:
- defaults:
time_range:
start: '8am'
end: '4pm'
# Matching on user name, overriding the default time range
beacons:
btmp:
- users:
gareth:
time_range:
start: '8am'
end: '4pm'
- defaults:
time_range:
start: '8am'
end: '4pm'
# Matching on group name, overriding the default time range
beacons:
btmp:
- groups:
users:
time_range:
start: '8am'
end: '4pm'
- defaults:
time_range:
start: '8am'
end: '4pm'
Use Case: Posting Failed Login Events to Slack
==============================================
This can be done using the following reactor SLS:
.. code-block:: jinja
report-wtmp:
runner.salt.cmd:
- args:
- fun: slack.post_message
- channel: mychannel # Slack channel
- from_name: someuser # Slack user
- message: "Failed login from `{{ data.get('user', '') or 'unknown user' }}` on `{{ data['id'] }}`"
Match the event like so in the master config file:
.. code-block:: yaml
reactor:
- 'salt/beacon/*/btmp/':
- salt://reactor/btmp.sls
.. note::
This approach uses the :py:mod:`slack execution module
<salt.modules.slack_notify>` directly on the master, and therefore requires
that the master has a slack API key in its configuration:
.. code-block:: yaml
slack:
api_key: xoxb-XXXXXXXXXXXX-XXXXXXXXXXXX-XXXXXXXXXXXXXXXXXXXXXXXX
See the :py:mod:`slack execution module <salt.modules.slack_notify>`
documentation for more information. While you can use an individual user's
API key to post to Slack, a bot user is likely better suited for this. The
:py:mod:`slack engine <salt.engines.slack>` documentation has information
on how to set up a bot user.
i ( t absolute_importt unicode_literalsN( t mapu btmpu
/var/log/btmpt hi32s4s32s256shhiii4i20xu typeu PIDu lineu inittabu useru hostnameu exit_statusu sessionu timeu addru btmp.locc C@ s t j j t � r t St S( N( t ost patht isfilet BTMPt __virtualname__t False( ( ( s5 /usr/lib/python2.7/site-packages/salt/beacons/btmp.pyt __virtual__� s c @ sc � s | | f St � t � s. t } d } n t � f d � d D� � sY t } d } n | | f S( u
Check time range
u> The time_range parameter for btmp beacon must be a dictionary.c 3@ s | ] } | � k Vq d S( N( ( t .0t k( t trange( s5 /usr/lib/python2.7/site-packages/salt/beacons/btmp.pys <genexpr>� s u startu enduJ The time_range parameter for btmp beacon must contain start & end options.( u startu end( t
isinstancet dictR t all( R
t statust msg( ( R
s5 /usr/lib/python2.7/site-packages/salt/beacons/btmp.pyt _validate_time_range� s
c C@ s` t d | � } | s* t j d | � d Sx/ | d D]# } | | k r5 | | | | <q5 q5 Wd S( u
Gather group members
u
group.infou" Group %s does not exist, ignoring.Nu members( t __salt__t logt warning( t groupt groupst userst _groupt member( ( s5 /usr/lib/python2.7/site-packages/salt/beacons/btmp.pyt _gather_group_members� s c C@ sa t rL t j | d � } t j | d � } t | | k oF | k n � St j d � t Sd S( u
Check time range
u startu endu Dateutil is required.N( t _TIME_SUPPORTEDt dateutil_parsert parset boolR t errorR ( t
time_ranget nowt _startt _end( ( s5 /usr/lib/python2.7/site-packages/salt/beacons/btmp.pyt _check_time_range� s
c C@ s t t k r t t Sd S( u)
return the active file location
N( t LOC_KEYt __context__( ( ( s5 /usr/lib/python2.7/site-packages/salt/beacons/btmp.pyt _get_loc� s c C@ s� t } d } t | t � s* t } d } n�i } t t | j | � � d | k r� t | d t � st t } d } nG xD | d D]8 } | d | j d i � } t | | | � \ } } q W| s� | | f Sn d | k rVt | d t � s� t } d } nG xD | d D]8 } | d | j d i � } t | | | � \ } } qW| sV| | f Sn d | k r�t | d t � s�t } d } n. | d j d i � } t | | | � \ } } | s�| | f Sn | | f S(
u+
Validate the beacon configuration
u Valid beacon configurationu- Configuration for btmp beacon must be a list.u usersu8 User configuration for btmp beacon must be a dictionary.u
time_rangeu groupsu9 Group configuration for btmp beacon must be a dictionary.u defaultsu< Defaults configuration for btmp beacon must be a dictionary.( t TrueR t listR R t updateR t getR ( t configt vstatust vmsgt _configt usert _time_rangeR ( ( s5 /usr/lib/python2.7/site-packages/salt/beacons/btmp.pyt validate� sP
c C@ s� g } i } i } d
} xY | D]Q } d | k r> | d } n d | k rW | d } n d | k r | d } q q Wt j j j t d � �i} t j t d � } | d k r� | j d d � | j
� t t <| S| j | � xt r�t j j
� } | j t � } t | � t k r| S| j
� t t <t j t | � }
i } x� t t � D]� \ } }
|
| | |
<t | |
t j j j � rPt | |
t � r�t j j j | |
� | |
<n | |
j d � | |
<qPqPWx | D] } t | | | � q�W| r�| d | k r�| | d } t | t � r]d | k r]t | d | � r�| j! | � q�q�| r�d | k r�t | d | � r�| j! | � q�q�| j! | � q�q� | r�d | k r�t | d | � r�| j! | � q�q� | j! | � q� WWd
QX| S( uM
Read the last btmp file and return information on the failed logins
u usersu groupsu defaultsu rbi i u u useru
time_rangeN(" t Nonet saltt utilst filest fopenR R( R- R' t seekt tellR* t datetimeR# t readt SIZEt lent structt unpackt FMTt enumeratet FIELDSR t extt sixt string_typest bytest stringutilst
to_unicodet stripR R R& t append( R. t retR R t defaultst config_itemt fp_t locR# t rawt packt eventt indt fieldR t _user( ( s5 /usr/lib/python2.7/site-packages/salt/beacons/btmp.pyt beacon
sd
(& t __doc__t
__future__R R R< t loggingR R@ t salt.utils.stringutilsR6 t salt.utils.filest salt.ext.sixt salt.ext.six.movesR R R RB RD t calcsizeR> R' t getLoggert __name__R t dateutil.parsert parserR R* R t ImportErrorR R
R R R& R) R4 RX ( ( ( s5 /usr/lib/python2.7/site-packages/salt/beacons/btmp.pyt <module>\ sJ
=
Mini Shell