Current File : //lib/python2.7/site-packages/salt/modules/ssh.pyc
�
���^c @@ s� d Z d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
Z
d d l Z d d l
Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l m Z m Z d d l m Z d d l m Z e j e � Z d Z e j r!d d l Z n d � Z d � Z! d
� Z" d � Z# d � Z$ d
d d d d � Z& d � Z' d � Z( d d d � Z) d e* e* d � Z+ d d d d � Z, d d d d � Z- d d d d � Z. d d d d � Z/ d d d � Z0 d d d d � Z1 d
d d d d d d � Z2 d � Z3 d d � Z4 e j5 j6 j7 j8 d � d d d d � � Z9 e j5 j6 j7 j8 d � d d d d! � � Z: e j5 j6 j7 j8 d" � d d e* d# d d$ � � Z; e j5 j6 j7 j8 d" � d d e* d# d d% � � Z< d d d d d d d d& � Z= d d d d d' � Z> d d d d d d d e* d# d d( �
Z? d d d d) � Z@ e j5 j6 j7 j8 d � d d d* � � ZA e d+ � ZB d, � ZC d S(- u�
Manage client ssh components
.. note::
This module requires the use of MD5 hashing. Certain security audits may
not permit the use of MD5. For those cases, this module should be disabled
or removed.
i ( t absolute_importt unicode_literalst print_functionN( t SaltInvocationErrort CommandExecutionError( t six( t rangei c C@ s# t j j j d � s t d f St S( Nu sshu# The module requires the ssh binary.( t saltt utilst patht whicht Falset True( ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt __virtual__- s
c C@ s� d d d g } d d d d g } d d d
d d g } d
d g } | | k rR d S| | k rb d S| | k r� | d k r~ d S| S| | k r� d St d j | � � � d S( u�
Return the properly formatted ssh value for the authorized encryption key
type. ecdsa defaults to 256 bits, must give full ecdsa enc schema string
if using higher enc. If the type is not found, raise CommandExecutionError.
u ru rsau ssh-rsau du dsau dssu ssh-dssu eu ecdsau ecdsa-sha2-nistp521u ecdsa-sha2-nistp384u ecdsa-sha2-nistp256u ed25519u ssh-ed25519u$ Incorrect encryption key type '{0}'.N( u eu ecdsa( R t format( t enct rsat dsst ecdsat ed25519( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt _refine_enc3 s" c C@ sH d } | r+ | d j d j | � � 7} n | d j | | | � 7} | S( u%
Properly format user input.
u u {0} u ,u {0} {1} {2}
( R t join( t keyR t commentt optionst line( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt _format_auth_lineR s
c C@ s� d } t } x� | D]� } | r� t } | d k r> | d 7} q | d k rW | | 7} q | d k rp | | 7} q d j | � } t | � � q q | d k r� t } q | | 7} q W| r� d } t | � � n | S( uQ
Expand the AuthorizedKeysFile expression. Defined in man sshd_config(5)
u u %u uu hu7 AuthorizedKeysFile path: unknown token character "%{0}"uA AuthorizedKeysFile path: Last character can't be escape character( R R R R ( R t usert homet converted_patht
had_escapet chart error( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt _expand_authorized_keys_path] s*
c C@ sx t d | � } | s. t d j | � � � n | d } t | | | � } t j j | � st t j j | | � } n | S( u3
Get absolute path to a user's ssh_config.
u user.infou User '{0}' does not existu home( t __salt__R R R! t osR t isabsR ( R t configt uinfoR ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt _get_config_filez s
u ssh-rsau u .ssh/authorized_keysc
C@ s� t | | | | p g � } g } t | | � } yAt j j j | d � �#} x� | D]� }
t j j j |
j � � }
|
d k r� qU n |
d 7}
|
j d � r� | j
|
� qU n t j d |
� } t
| � d k rt
| d � d k r| d d | k r| j
| � qU | j
|
� qU W| j � t j j j | d � �# } | j t j j j | � � Wd QXWd QXWn. t t f k
r�} t d
j | � � � n Xd S( u!
Replace an existing key
u ru u
u #uK ((.*)\s)?(ssh-[a-z0-9-]+|ecdsa-[a-z0-9-]+)\s([a-zA-Z0-9+/]+={0,2})(\s(.*))?i i u wbNu+ Problem reading or writing to key file: {0}( R R' R R t filest fopent stringutilst
to_unicodet stript
startswitht appendt ret findallt lent closet
writelinest datat encodet IOErrort OSErrorR R (
R R R R R R% t auth_linet linest fullt _fhR t compst exc( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt _replace_auth_key� s.
<
,c C@ s� i } t j d � } yht j j j | d � �J} x@| D]8} t j j j | j � � } | d k rm q: n | d 7} | j d � r� q: n t j
| | � } | s� q: n | j d � } | j d � j � } t
| � d k r� q: n | r� | j d � } n g } | d }
| d } d
j | d � } t | | � }
|
d k rLq: n i |
d 6| d 6| d
6|
d 6| | <q: WWd QXWn, t t f k
r�t d j | � � � n X| S( uD
Return a dict containing validated keys in the passed file
u$ ^(.*?)\s?((?:ssh\-|ecds)[\w-]+\s.+)$u ru u
u #i i u ,i u u encu commentu optionsu fingerprintNu Problem reading ssh key file {0}( R/ t compileR R R( R) R* R+ R, R- t searcht groupt splitR1 R t _fingerprintt NoneR6 R7 R R ( t key_filet fingerprint_hash_typet rett linereR; R R@ t optsR< R R R R t fingerprint( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt _validate_keys� sF
c C@ s� | r | j � } n d } y t t | � } Wn& t k
rV t d j | � � � n Xy4 t j ru | j d � } n t j
| d t �} Wn t j
k
r� d SX| | � j � } g t d t | � d � D] } | | | d !^ q� } d j | � S( u{
Return a public key fingerprint based on its base64-encoded representation
The fingerprint string is formatted according to RFC 4716 (ch.4), that is,
in the form "xx:xx:...:xx"
If the key is invalid (incorrect base64 string), return None
public_key
The public key to return the fingerprint for
fingerprint_hash_type
The public key fingerprint hash type that the public key fingerprint
was originally hashed with. This defaults to ``sha256`` if not specified.
.. versionadded:: 2016.11.4
.. versionchanged:: 2017.7.0: default changed from ``md5`` to ``sha256``
u sha256u/ The fingerprint_hash_type {0} is not supported.u base64t validatei i u :N( t lowert getattrt hashlibt AttributeErrorR R R t PY2t decodet base64t b64decodeR t binasciit ErrorRD t hexdigestR R1 R ( t
public_keyRF t hash_typet hash_funct raw_keyRG t it chunks( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyRC � s$
6c C@ s� | r | p d } n | p d } t j j | � r< | } ne | r� t d | � } | ss i d d 6d j | � d 6St j j | d | � } n i d d 6d d 6S| S( Nu .ssh/known_hostsu /etc/ssh/ssh_known_hostsu user.infou erroru statusu User {0} does not existu homeu' Cannot determine absolute path to file.( R# R R$ R" R R ( R% R R: R& ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt _get_known_hosts_file! s
c C@ s� | s. t d d k r d } q. t d � � n i } t j d � } x�t j | � D]x} | j | � } | rS | j d � r� | t k r� t j
d | � qS n | j d � r� | t k r� t j
d | � qS n | j d
� } | j d � r| | j d � 7} n y� t j j
j t j j | | � d � �r } t j j j | j � � | | <| | d k r�| | c t j j j | j � � 7<n | | j � | | <Wd
QXWq�t t f k
r�d | | <q�XqS qS W| S( u
Return the minion's host keys
CLI Example:
.. code-block:: bash
salt '*' ssh.host_keys
salt '*' ssh.host_keys keydir=/etc/ssh
salt '*' ssh.host_keys keydir=/etc/ssh private=False
salt '*' ssh.host_keys keydir=/etc/ssh certs=False
u kernelu Linuxu /etc/sshu& ssh.host_keys: Please specify a keydiru8 ssh_host_(?P<type>.+)_key(?P<pub>(?P<cert>-cert)?\.pub)?u pubu7 Skipping private key file %s as private is set to Falseu certu- Skipping key file %s as certs is set to Falseu typeu ru SSH PRIVATE KEY FILE FORMAT 1.1
Nu ( t
__grains__R R/ R? R# t listdirt matchRA R t logt infoR R R( R) R R R* R+ t readlinet readR, R6 R7 ( t keydirt privatet certst keyst fnret fn_t mt knameR; ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt host_keys9 s> * ( c C@ s� | s t d � } n t } t | t � s= | g } t } n i } xi | D]a } d } y t | | � } Wn t k
r| n X| rJ t j j
| � rJ t | | � | | <qJ qJ W| r� | d | k r� | | d Si Sn | S( u�
Return the authorized keys for users
CLI Example:
.. code-block:: bash
salt '*' ssh.auth_keys
salt '*' ssh.auth_keys root
salt '*' ssh.auth_keys user=root
salt '*' ssh.auth_keys user="[user1, user2]"
u user.list_usersi N( R" R t
isinstancet listR RD R' R R# R t isfileRK ( R R% RF t old_output_when_one_userRi t uR: ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt auth_keyst s(
u basec
C@ s� t d | | � } | s i St | | � } | s\ d j | � } t j | � | t d <i Si } xN | D]F } t | | | | d | | d | | d d | d | �| | <qi W| Sd S(
u�
Check a keyfile from a source destination against the local keys and
return the keys to change
CLI Example:
.. code-block:: bash
salt '*' ssh.check_key_file root salt://ssh/keyfile
u
cp.cache_fileu4 No keys detected in {0}. Is file properly formatted?u ssh_auth.erroru encu commentu optionsR% RF N( R" RK R Rb R t __context__t check_key(
R t sourceR% t saltenvRF t keyfilet s_keyst errRG R ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt check_key_file� s*
c C@ s� | d k r g } n t | � } t | d | d | �} t | | | | � } | | k r� t | | | d | | d | | d � }
|
| k r� d Sn d Sd S(
u�
Check to see if a key needs updating, returns "update", "add" or "exists"
CLI Example:
.. code-block:: bash
salt '*' ssh.check_key <user> <key> <enc> <comment> <options>
R% RF u encu commentu optionsu updateu addu existsN( RD R Rt R ( R R R R R R% t
cache_keysRF t currentt nlinet cline( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyRv � s c
C@ s� t d | | � } t j j | � s4 t d � � n t | | � } | ss d j | � } t j | � | t d <d Sd } x- | D]% } | t
| | d | d | �7} q� Wd | k r� d Sd
| k r� d
Sd Sd S(
u�
Remove an authorized key from the specified user's authorized key file,
using a file as source
CLI Example:
.. code-block:: bash
salt '*' ssh.rm_auth_key_from_file <user> salt://ssh_keys/<user>.id_rsa.pub
u
cp.cache_fileu- Failed to pull key file from salt file serveru4 No keys detected in {0}. Is file properly formatted?u ssh_auth.erroru failu R% RF u Key not removedu Key removedu Key not presentN( R" R# R Rq R RK R Rb R Ru t rm_auth_key(
R Rw R% Rx RF t lfileRz R{ t rvalR ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt rm_auth_key_from_file� s.
c C@ s� t | d | d | �} t j d � } | | k r�t | | � } t j j | � sa d j | � Sg } yMt j j
j | d � �� } x� | D]� } t j j j
| j � � } | d k r� q� n | d 7} | j d � r� | j | � q� n t j | | � }
|
s q� n |
j d � j � } t | � d k rC| j | � q� n | d
} | | k r_q� n | j | � q� WWd QXt j j
j | d � �# } | j t j j j | � � Wd QXWn* t t f k
r�}
t j d
|
� d SXd Sd S( u�
Remove an authorized key from the specified user's authorized key file
CLI Example:
.. code-block:: bash
salt '*' ssh.rm_auth_key <user> <key>
R% RF u$ ^(.*?)\s?((?:ssh\-|ecds)[\w-]+\s.+)$u$ Authorized keys file {0} not presentu ru u
u #i i Nu wbu! Could not read/write key file: %su Key not removedu Key removedu Key not present( Rt R/ R? R' R# R Rq R R R R( R) R* R+ R, R- R. R@ RA RB R1 R3 R4 R5 R6 R7 Rb t warning( R R R% RF R~ RH R: R9 R; R R@ R< t pkeyR= ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyR� , sL
& c
C@ s t d | | � } t j j | � s4 t d � � n t | | � } | ss d j | � } t j | � | t d <d Sd } xi | D]a } | t
| | d | | d d | | d
d | | d d
| d t | j � � d | �7} q� Wd | k r� d Sd | k rd Sd | k rd Sd Sd S( u�
Add a key to the authorized_keys file, using a file as the source.
CLI Example:
.. code-block:: bash
salt '*' ssh.set_auth_key_from_file <user> salt://ssh_keys/<user>.id_rsa.pub
u
cp.cache_fileu- Failed to pull key file from salt file serveru4 No keys detected in {0}. Is file properly formatted?u ssh_auth.erroru failu R u encR u commentR u optionsR% R} RF u replaceu newu no changeN(
R" R# R Rq R RK R Rb R Ru t set_auth_keyRp Ri (
R Rw R% Rx RF R� Rz R{ R� R ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt set_auth_key_from_filey s:
c C@ s� | d k r g } n t | j � � d k r1 d St | � } t d | � } | sW d St | | � d k } | sv d St | | | | | d | d | d | �}
|
d k r� t | | | | | p� g | � d
S|
d k r� d St | | | | � } t | | � } | j
d
d � }
| j |
� r;t j
j |
� r;d St j
j t j
j | � � st j
j | � } t j | � t j j j � s�t j � d k r�t j | | d | d � n t j | d � n t j j
j d � } | r| | g } t j | � qn t j
j | � s"t } n t } y� t j j j | d � �� } | t k r�| j d d � | j! � d k r�| j d d � | j" d � d k r�| j# d � q�q�n | j# t j j$ j% | � � Wd QXWn4 t& t' f k
r} d } t( | j) | � � � n X| r�t j j j � sdt j � d k rQt j | | d | d � n t j | d � n t j j
j d � } | r�| | g } t j | � q�n d Sd S( uh
Add a key to the authorized_keys file. The "key" parameter must only be the
string of text that is the encoded key. If the key begins with "ssh-rsa"
or ends with user@host, remove those from the key before passing it to this
function.
CLI Example:
.. code-block:: bash
salt '*' ssh.set_auth_key <user> '<key>' enc='dsa'
i u invalidu user.infou failu Invalid public keyR% R} RF u updateu replaceu existsu no changeu homeu i u uidu gidi� u
restoreconu ab+i i����s
Nu Could not write to key file: {0}i� u new(* RD R1 RB R R" RC Rv R> R R' t getR- R# R t isdirt dirnamet makedirsR R t platformt
is_windowst geteuidt chownt chmodR
t
subprocesst callRq R R R( R) t seekt tellRe t writeR* t to_bytesR6 R7 R R ( R R R R R R% R} RF R& t key_is_validt statusR8 t fconfigt udirt dpatht rcont cmdt new_fileR; R= t msg( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyR� � s� "
& c c@ s� | r | n d } x~ t | � D]p \ } } | d d k r t | j � j � d � } | | d j � j � d } | | k r� q n | Vq q Wd S( u�
Helper function which parses ssh-keygen -F function output and yield line
number of known_hosts entries with encryption key type matching enc,
one by one.
u rsai i i����i i����N( t enumeratet intR, RB ( R9 R R\ R t line_not line_enc( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt _get_matched_host_line_numbers s c c@ s� x� | D]� } | j � } | d k r+ q n | d 7} | j d � rJ q n y | j � \ } } } Wn t k
ry q n Xt | d | �} | s� q n i | d 6| d 6| d 6| d 6Vq Wd S(
u�
Helper function which parses ssh-keygen -F and ssh-keyscan function output
and yield dict with keys information, one by one.
u u
u #RF u hostnameu keyu encu fingerprintN( R, R- RB t
ValueErrorRC ( R9 RF R t hostnameR R RJ ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt _parse_openssh_output. s"
u
ssh-keygenc C@ s@ t j j j d d � t | | | | | � } | r< | d Sd S( ub
.. deprecated:: 2018.3.0
Use :py:func:`ssh.get_known_host_entries
<salt.modules.ssh.get_known_host_entries>` instead.
Return information about known host from the configfile, if any.
If there is no such key, return None.
CLI Example:
.. code-block:: bash
salt '*' ssh.get_known_host <user> <hostname>
u Neonuy 'get_known_host' has been deprecated in favor of 'get_known_host_entries'. 'get_known_host' will be removed in Salt Neon.i N( R R t versionst
warn_untilt get_known_host_entriesRD ( R R� R% t portRF t known_hosts( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt get_known_hostH s
c
C@ s� t d | d | � } t | t � r( | St | | � } d d | d | g } t d | d t d t �j � } t t | d | �� } | r� | Sd
S( u
.. versionadded:: 2018.3.0
Return information about known host entries from the configfile, if any.
If there are no entries for a matching hostname, return None.
CLI Example:
.. code-block:: bash
salt '*' ssh.get_known_host_entries <user> <hostname>
R% R u
ssh-keygenu -Fu -fu cmd.runt ignore_retcodet python_shellRF N( R^ Ro t dictt" _hostname_and_port_to_ssh_hostnameR" R R t
splitlinesRp R� RD (
R R� R% R� RF R: t ssh_hostnameR� R9 t known_host_entries( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyR� f s
u ssh-keyscani c C@ sC t j j j d d � t | | | | | | � } | r? | d Sd S( u�
Retrieve information about host public key from remote server
.. deprecated:: 2018.3.0
Use :py:func:`ssh.recv_known_host_entries
<salt.modules.ssh.recv_known_host_entries>` instead.
hostname
The name of the remote host (e.g. "github.com")
enc
Defines what type of key is being used, can be ed25519, ecdsa ssh-rsa
or ssh-dss
port
Optional parameter, denoting the port of the remote host on which an
SSH daemon is running. By default the port 22 is used.
hash_known_hosts : True
Hash all hostnames and addresses in the known hosts file.
timeout : int
Set the timeout for connection attempts. If ``timeout`` seconds have
elapsed since a connection was initiated to a host or since the last
time anything was read from that host, then the connection is closed
and the host in question considered unavailable. Default is 5 seconds.
.. versionadded:: 2016.3.0
fingerprint_hash_type
The fingerprint hash type that the public key fingerprints were
originally hashed with. This defaults to ``sha256`` if not specified.
.. versionadded:: 2016.11.4
.. versionchanged:: 2017.7.0: default changed from ``md5`` to ``sha256``
CLI Example:
.. code-block:: bash
salt '*' ssh.recv_known_host <hostname> enc=<enc> port=<port>
u Neonu| 'recv_known_host' has been deprecated in favor of 'recv_known_host_entries'. 'recv_known_host' will be removed in Salt Neon.i N( R R R� R� t recv_known_host_entriesRD ( R� R R� t hash_known_hostst timeoutRF R� ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt recv_known_host� s
1 c C@ s* d } d g } | r+ | j d | g � n | rG | j d | g � n | ry t j d � | k ry | j d d g � n | r� | j d � n | j d t j | � g � | j | � d } d } x= | r| d
k r| d } t d | d
t �j � } q� Wt
t | d | �� }
|
r&|
Sd S( u�
.. versionadded:: 2018.3.0
Retrieve information about host public keys from remote server
hostname
The name of the remote host (e.g. "github.com")
enc
Defines what type of key is being used, can be ed25519, ecdsa ssh-rsa
or ssh-dss
port
Optional parameter, denoting the port of the remote host on which an
SSH daemon is running. By default the port 22 is used.
hash_known_hosts : True
Hash all hostnames and addresses in the known hosts file.
timeout : int
Set the timeout for connection attempts. If ``timeout`` seconds have
elapsed since a connection was initiated to a host or since the last
time anything was read from that host, then the connection is closed
and the host in question considered unavailable. Default is 5 seconds.
fingerprint_hash_type
The fingerprint hash type that the public key fingerprints were
originally hashed with. This defaults to ``sha256`` if not specified.
.. versionadded:: 2016.11.4
.. versionchanged:: 2017.7.0: default changed from ``md5`` to ``sha256``
CLI Example:
.. code-block:: bash
salt '*' ssh.recv_known_host_entries <hostname> enc=<enc> port=<port>
u CentOS-5u ssh-keyscanu -pu -tu osfingeru rsau -Hu -Ti i i u cmd.runR� RF ( u CentOS-5N( t extendR_ R� R. R t text_typeRD R" R R� Rp R� ( R� R R� R� R� RF t need_dash_tR� R9 t attemptsR� ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyR� � s( /
c
C@ s� | s i d d 6d d 6S| s- | p' d } n | p6 d } t | | d | d | d | �} | r} g | D] } | d ^ qg n g } | r� g | D] } | d
^ q� n g }
| s� d S| r� | | k r� d Sd
S| r� | |
k r� d Sd
Sd Sd S( u8
Check the record in known_hosts file, either by its value or by fingerprint
(it's enough to set up either key or fingerprint, you don't need to set up
both).
If provided key or fingerprint doesn't match with stored value, return
"update", if no value is found for a given host, return "add", otherwise
return "exists".
If neither key, nor fingerprint is defined, then additional validation is
not performed.
CLI Example:
.. code-block:: bash
salt '*' ssh.check_known_host <user> <hostname> key='AAAA...FAaQ=='
u erroru statusu hostname argument requiredu /etc/ssh/ssh_known_hostsu .ssh/known_hostsR% R� RF u keyu fingerprintu addu existsu updateN( R� ( R R� R RJ R% R� RF R� t ht
known_keyst known_fingerprints( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt check_known_host
s*
))c C@ s | s i d d 6d d 6St d | d | � } t | t � r@ | St j j | � sm i d d 6d j | � d 6St | | � } d d | d | g } t d
| d t �} t
j j j
� st j � d k r| rt d
| � } t j | | d | d � qn i d d 6| d 6S( u�
Remove all keys belonging to hostname from a known_hosts file.
CLI Example:
.. code-block:: bash
salt '*' ssh.rm_known_host <user> <hostname>
u erroru statusu hostname argument requiredR% R u# Known hosts file {0} does not existu
ssh-keygenu -Ru -fu cmd.runR� i u user.infou uidu gidu removedu comment( R^ Ro R� R# R Rq R R� R" R R R R� R� R� R� ( R R� R% R� R: R� R� t
cmd_resultR& ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt
rm_known_host9 s"
!c
$ C@ s� | s i d d 6d d 6S| d k rH | t k rH | rH i d d 6d d 6St }
t } t | | d | d | d | �} | r� g | D] }
|
d ^ q� n g } | r� g | D] }
|
d ^ q� n g } | s� t }
nW | r� | | k r� t }
n< | r | | k r t }
n! | d k r-| d k r-t } n |
rM| rMi d
d 6| d 6S| sFt | d | d | d
| d | d | �} | r�g | D] }
|
d ^ q�n g } | r�g | D] }
|
d ^ q�n g } | s�i d d 6d d 6S| r | | k r i d d 6d d 6S| rFx/ | D]$ } | | k ri d
d 6| d 6SqWqFn t d | d | � } t | t � rn| St j
j | � r�t j | � j
} t | | � } d d | d | g } t d | d t d t �j � } t t | | � � } | r�y� t j j j | d � �� } t j j j t | � � } x% t | d t �D] } | | d =q?W| j d � | j � | j t j j j | d t �� Wd QXWq�t t f k
r�} t d j | � � � q�Xq�n d } | r�i | d 6| d 6| d 6g } n g } xn | D]f } | s3| t d g k s3d! | d k rEd" j | � } n | | d# <d$ j | � } | j! | � qWt j
j" | � } | r�t d% | � } n y! t# j$ d& | � t j% | � Wni t k
r&}! |! j& d d' k r�t# j' d( | |! j& d � q[|! j& d d) k r[t# j$ d* | � q[n5 X| r[t j( | | d+ | d, � t j) | d- � n yA t j j j | d. � �# } | j t j j j* | � � Wd QXWn. t t f k
r�} t d/ j | � � � n Xt j j+ j, � sAt j- � d k r| rt j( | | d+ | d, � n | r.t j) | | � qAt j) | d0 � n | ri| rit d1 d | d | � }" n i d2 d 6| d3 6| d4 6}# |# S(5 up
Download SSH public key from remote host "hostname", optionally validate
its fingerprint against "fingerprint" variable and save the record in the
known_hosts file.
If such a record does already exists in there, do nothing.
user
The user who owns the ssh authorized keys file to modify
hostname
The name of the remote host (e.g. "github.com")
fingerprint
The fingerprint of the key which must be present in the known_hosts
file (optional if key specified)
key
The public key which must be presented in the known_hosts file
(optional if fingerprint specified)
port
optional parameter, denoting the port of the remote host, which will be
used in case, if the public key will be requested from it. By default
the port 22 is used.
enc
Defines what type of key is being used, can be ed25519, ecdsa ssh-rsa
or ssh-dss
config
The location of the authorized keys file relative to the user's home
directory, defaults to ".ssh/known_hosts". If no user is specified,
defaults to "/etc/ssh/ssh_known_hosts". If present, must be an
absolute path when a user is not specified.
hash_known_hosts : True
Hash all hostnames and addresses in the known hosts file.
timeout : int
Set the timeout for connection attempts. If ``timeout`` seconds have
elapsed since a connection was initiated to a host or since the last
time anything was read from that host, then the connection is closed
and the host in question considered unavailable. Default is 5 seconds.
.. versionadded:: 2016.3.0
fingerprint_hash_type
The public key fingerprint hash type that the public key fingerprint
was originally hashed with. This defaults to ``sha256`` if not specified.
.. versionadded:: 2016.11.4
.. versionchanged:: 2017.7.0: default changed from ``md5`` to ``sha256``
CLI Example:
.. code-block:: bash
salt '*' ssh.set_known_host <user> fingerprint='xx:xx:..:xx' enc='ssh-rsa' config='.ssh/known_hosts'
u erroru statusu hostname argument requireduK argument port can not be used in conjunction with argument hash_known_hostsR% R� RF u keyu fingerprintu existsu keysR R� R� u" Unable to receive remote host keysu\ Remote host public keys found but none of their fingerprints match the one you have providedR u
ssh-keygenu -Fu -fu cmd.runR� R� u r+t reversei i t to_strNu; Couldn't remove old entry(ies) from known hosts file: '{0}'u hostnameu encu :u {hostname} {enc} {key}
u portu [{hostname}]:{port} {enc} {key}
u user.infou# Ensuring ssh config dir "%s" existsu Permission deniedu! Unable to create directory %s: %su File existsu' %s already exists, no need to create itu uidu gidi� u abu* Couldn't append to known hosts file: '{0}'i� u ssh.hash_known_hostsu updatedu oldu new(. RD t DEFAULT_SSH_PORTR R� R R� R^ Ro R� R# R Rq t statt st_modeR� R" R� Rp R� R R R( R) R4 RR t sortedR� t truncateR3 R6 R7 R R R. R� Rb t debugR� t argsR R� R� R5 R� R� R� ($ R R� RJ R R� R R% R� R� RF t update_requiredt check_requiredt stored_host_entriesR� t stored_keyst stored_fingerprintst remote_host_entriesR� R� R: t origmodeR� R� R9 t remove_linest ofilet known_hosts_linesR� t exceptiont entryR t ssh_dirR& R= R� R� ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt set_known_host[ s� F
)) ))
& !
(
& c C@ s | s t d � } n t | t � s1 | g } n i } x�| D]�} i | | <t d | � } d | k rp q> n g } | r� | j | � n% | t k r� | d d d d g 7} n | r� | j | � n% | t k r� | d d d
d g 7} n x� | D]� } | j d � r#t j j | � } | } n | } d
j | d | � } t j j
| � r� yW t j j
j | d � �9 }
d j t j j j |
j � � � j � | | | <Wd QXWq�t t f k
r�q�Xq� q� Wq> Wi } x) | D]! } | | r�| | | | <q�q�W| S( u�
Return the user's ssh keys on the minion
.. versionadded:: 2014.7.0
CLI Example:
.. code-block:: bash
salt '*' ssh.user_keys
salt '*' ssh.user_keys user=user1
salt '*' ssh.user_keys user=user1 pubfile=/home/user1/.ssh/id_rsa.pub prvfile=/home/user1/.ssh/id_rsa
salt '*' ssh.user_keys user=user1 prvfile=False
salt '*' ssh.user_keys user="['user1','user2'] pubfile=id_rsa.pub prvfile=id_rsa
As you can see you can tell Salt not to read from the user's private (or
public) key file by setting the file path to ``False``. This can be useful
to prevent Salt from publishing private data via Salt Mine or others.
u user.list_usersu user.infou homeu
id_rsa.pubu
id_dsa.pubu id_ecdsa.pubu id_ed25519.pubu id_rsau id_dsau id_ecdsau
id_ed25519u /u {0}/.ssh/{1}u ru N( R" Ro Rp R. R R- R# R t basenameR t existsR R R( R) R R4 RR t readlinesR, R6 R7 ( R t pubfilet prvfileRi Rs t userinfot userKeysR t keynameRk R; t _keys( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt user_keys8 sN
*
c C@ s t d | d | � } t | t � r( | St j j | � sU i d d 6d j | � d 6St j | � j } d d d | g } t d | d
t
�} t j | | � t j
j j � s� t j � d k r� | r� t d | � } t j | | d
| d � q� n i d d 6| d 6S( uI
Hash all the hostnames in the known hosts file.
.. versionadded:: 2014.7.0
user
hash known hosts of this user
config
path to known hosts file: can be absolute or relative to user's home
directory
CLI Example:
.. code-block:: bash
salt '*' ssh.hash_known_hosts
R% R u erroru statusu# Known hosts file {0} does not existu
ssh-keygenu -Hu -fu cmd.runR� i u user.infou uidu gidu updatedu comment( R^ Ro R� R# R Rq R R� R� R" R R� R R R� R� R� R� ( R R% R: R� R� R� R& ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyR� � s
!c C@ s+ | s | t k r | Sd j | | � Sd S( Nu [{0}]:{1}( R� R ( R� R� ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyR� � s c C@ s t d | � S( ui
.. versionadded:: 2015.8.7
Function to determine whether or not a private key is encrypted with a
passphrase.
Checks key for a ``Proc-Type`` header with ``ENCRYPTED`` in the value. If
found, returns ``True``, otherwise returns ``False``.
CLI Example:
.. code-block:: bash
salt '*' ssh.key_is_encrypted /root/id_rsa
u ssh.key_is_encrypted( t __utils__( R ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt key_is_encrypted� s (D t __doc__t
__future__R R R RU RO t loggingR# R/ R� t salt.utils.decorators.pathR t salt.utils.datat salt.utils.filest salt.utils.patht salt.utils.platformt salt.utils.stringutilst salt.utils.versionst salt.exceptionsR R t salt.extR t salt.ext.six.movesR t getLoggert __name__Rb R� t PY3RS R
R R R! R' RD R> RK RC R^ R Rn Rt R| Rv R� R� R� R� R� R� R t
decoratorsR R
R� R� R� R� R� R� R� R� R� R� R� ( ( ( s4 /usr/lib/python2.7/site-packages/salt/modules/ssh.pyt <module>
s� ) : 0; + ( - 2 L 9 c 5@ ." �Q)
Mini Shell