Current File : //lib/python2.7/site-packages/salt/states/x509.pyo
�
���^c @@ s* d Z d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l Z d d l Z
d d l m Z y d d l
m Z Wn e k
r� n Xd � Z d � Z d � Z d d e e d
� Z d d d e e e d � Z d
� Z d d d d � Z d d d d d d e d � Z e d � Z d S( um
Manage X509 Certificates
.. versionadded:: 2015.8.0
:depends: M2Crypto
This module can enable managing a complete PKI infrastructure including creating private keys, CA's,
certificates and CRLs. It includes the ability to generate a private key on a server, and have the
corresponding public key sent to a remote CA to create a CA signed certificate. This can be done in
a secure manner, where private keys are always generated locally and never moved across the network.
Here is a simple example scenario. In this example ``ca`` is the ca server,
and ``www`` is a web server that needs a certificate signed by ``ca``.
For remote signing, peers must be permitted to remotely call the
:mod:`sign_remote_certificate <salt.modules.x509.sign_remote_certificate>` function.
/etc/salt/master.d/peer.conf
.. code-block:: yaml
peer:
.*:
- x509.sign_remote_certificate
/srv/salt/top.sls
.. code-block:: yaml
base:
'*':
- cert
'ca':
- ca
'www':
- www
This state creates the CA key, certificate and signing policy. It also publishes the certificate to
the mine where it can be easily retrieved by other minions.
/srv/salt/ca.sls
.. code-block:: yaml
salt-minion:
service.running:
- enable: True
- listen:
- file: /etc/salt/minion.d/signing_policies.conf
/etc/salt/minion.d/signing_policies.conf:
file.managed:
- source: salt://signing_policies.conf
/etc/pki:
file.directory
/etc/pki/issued_certs:
file.directory
/etc/pki/ca.crt:
x509.certificate_managed:
- signing_private_key: /etc/pki/ca.key
- CN: ca.example.com
- C: US
- ST: Utah
- L: Salt Lake City
- basicConstraints: "critical CA:true"
- keyUsage: "critical cRLSign, keyCertSign"
- subjectKeyIdentifier: hash
- authorityKeyIdentifier: keyid,issuer:always
- days_valid: 3650
- days_remaining: 0
- backup: True
- managed_private_key:
name: /etc/pki/ca.key
bits: 4096
backup: True
- require:
- file: /etc/pki
mine.send:
module.run:
- func: x509.get_pem_entries
- kwargs:
glob_path: /etc/pki/ca.crt
- onchanges:
- x509: /etc/pki/ca.crt
The signing policy defines properties that override any property requested or included in a CRL. It also
can define a restricted list of minons which are allowed to remotely invoke this signing policy.
/srv/salt/signing_policies.conf
.. code-block:: yaml
x509_signing_policies:
www:
- minions: 'www'
- signing_private_key: /etc/pki/ca.key
- signing_cert: /etc/pki/ca.crt
- C: US
- ST: Utah
- L: Salt Lake City
- basicConstraints: "critical CA:false"
- keyUsage: "critical keyEncipherment"
- subjectKeyIdentifier: hash
- authorityKeyIdentifier: keyid,issuer:always
- days_valid: 90
- copypath: /etc/pki/issued_certs/
This state will instruct all minions to trust certificates signed by our new CA.
Using jinja to strip newlines from the text avoids dealing with newlines in the rendered yaml,
and the :mod:`sign_remote_certificate <salt.states.x509.sign_remote_certificate>` state will
handle properly formatting the text before writing the output.
/srv/salt/cert.sls
.. code-block:: jinja
/usr/local/share/ca-certificates:
file.directory
/usr/local/share/ca-certificates/intca.crt:
x509.pem_managed:
- text: {{ salt['mine.get']('ca', 'x509.get_pem_entries')['ca']['/etc/pki/ca.crt']|replace('\n', '') }}
This state creates a private key then requests a certificate signed by ca according to the www policy.
/srv/salt/www.sls
.. code-block:: yaml
/etc/pki/www.crt:
x509.certificate_managed:
- ca_server: ca
- signing_policy: www
- public_key: /etc/pki/www.key
- CN: www.example.com
- days_remaining: 30
- backup: True
- managed_private_key:
name: /etc/pki/www.key
bits: 4096
backup: True
i ( t absolute_importt unicode_literalst print_functionN( t six( t RSAErrorc C@ s d t k r d St d f Sd S( uO
only load this module if the corresponding execution module is loaded
u x509.get_pem_entryu x509u/ Could not load x509 state: m2crypto unavailableN( t __salt__t False( ( ( s4 /usr/lib/python2.7/site-packages/salt/states/x509.pyt __virtual__� s c C@ s� g } x� | D]� } x� t j | � D]~ \ } } i } x\ | D]T } xK t j | � D]: \ } } t | t j � r� | j d � } n | | | <qR Wq< W| j | � q# Wq
W| S( ue
Turn the mess of OrderedDicts and Lists into a list of dicts for
use in the CRL module.
u %Y-%m-%d %H:%M:%S( R t iteritemst
isinstancet datetimet strftimet append( t revst list_t revt rev_namet propst dict_t propt propnamet val( ( s4 /usr/lib/python2.7/site-packages/salt/states/x509.pyt _revoked_to_list� s
c K@ s� d d d d d d d d d g } i } i } x= | j � D]/ \ } } | | k r_ | | | <q: | | | <q: W| | d
<| | f S( Nu useru groupu modeu makedirsu dir_modeu backupu createu follow_symlinksu check_cmdu name( t items( t namet kwargst valid_file_argst file_argst
extra_argst kt v( ( s4 /usr/lib/python2.7/site-packages/salt/states/x509.pyt _get_file_args� s"
i c C@ s� d } t j j | � r} y t d d | d | � } Wq} t j j k
rN q} t k
ry | sz t j j d � � qz q} Xn | | k o� | S( Ni u x509.get_private_key_sizet private_keyt
passphraseu7 The provided passphrase cannot decrypt the private key.( t ost patht isfileR t saltt
exceptionst SaltInvocationErrorR t CommandExecutionError( R t bitsR! t newt overwritet current_bits( ( s4 /usr/lib/python2.7/site-packages/salt/states/x509.pyt _check_private_key� s
u aes_128_cbcc K@ s� t | | � \ } } t } t | d | d | d | d | �r\ t d | d d �| d <n5 t } t d d
t d | d | d | d | � | d <t j j j | d � | d <t d
| � }
|
d r� | r� i d d 6|
d <n |
S( uG
Manage a private key's existence.
name:
Path to the private key
bits:
Key length in bits. Default 2048.
passphrase:
Passphrase for encrypting the private key.
cipher:
Cipher for encrypting the private key.
new:
Always create a new key. Defaults to False.
Combining new with :mod:`prereq <salt.states.requsities.preqreq>`, or when used as part of a `managed_private_key` can allow key rotation whenever a new certificiate is generated.
overwrite:
Overwrite an existing private key if the provided passphrase cannot decrypt it.
verbose:
Provide visual feedback on stdout, dots while key is generated.
Default is True.
.. versionadded:: 2016.11.0
kwargs:
Any kwargs supported by file.managed are supported.
Example:
The jinja templating in this example ensures a private key is generated if the file doesn't exist
and that a new private key is generated whenever the certificate that uses it is to be renewed.
.. code-block:: jinja
/etc/pki/www.key:
x509.private_key_managed:
- bits: 4096
- new: True
{% if salt['file.file_exists']('/etc/pki/www.key') -%}
- prereq:
- x509: /etc/pki/www.crt
{%- endif %}
R) R! R* R+ u x509.get_pem_entryt pem_typeu RSA PRIVATE KEYu contentsu x509.create_private_keyt textt ciphert verboseu file.managedu changesu New private key generatedu new(
R R R- R t TrueR% t utilst stringutilst to_strt
__states__( R R) R! R0 R* R+ R1 R R t new_keyt ret( ( s4 /usr/lib/python2.7/site-packages/salt/states/x509.pyt private_key_managed� s 7!
% c K@ s� y t d | � } Wn& t j j k
r< d j | � } n Xt | | � \ } } t d d t | � | d <t d | � } | d r� t d | d � } | | k r� i | d 6| d 6| d <q� n | S(
u�
Manage a Certificate Signing Request
name:
Path to the CSR
properties:
The properties to be added to the certificate request, including items like subject, extensions
and public key. See above for valid properties.
kwargs:
Any arguments supported by :py:func:`file.managed <salt.states.file.managed>` are supported.
Example:
.. code-block:: yaml
/etc/pki/mycert.csr:
x509.csr_managed:
- private_key: /etc/pki/mycert.key
- CN: www.example.com
- C: US
- ST: Utah
- L: Salt Lake City
- keyUsage: 'critical dataEncipherment'
u
x509.read_csru {0} is not a valid csr.u x509.create_csrR/ u contentsu file.managedu changesu Oldu New( R R% R& R' t formatR R2 R6 ( R R t oldR R8 R* ( ( s4 /usr/lib/python2.7/site-packages/salt/states/x509.pyt csr_managedA s
iZ c K@ s> d | k r | j d � } n t | | � \ } } t } t } | rWi | d 6t d 6t d 6d d 6d> d 6d d 6t d
6} | j | � | d | d <| d r� t } t | d <n t | d d | d d
| d d | d d | d �r t d | d d d �} nA t } t d d t d | d d
| d d | d d | d
� } | | d <n d }
i } t j j
| � r�yt d d | � } t j | � } d | k r| j d � d | k ry) t
j d d | d d! � | d d! <Wq�t k
r�q�Xqn | j d" � | j d# � | j d$ � | j d% � | j d& � }
t j j |
d' � t j j � j }
| d k r�|
d( } n Wq�t j j k
r�d) j | � } q�Xn d* j | � } d+ | k r�d, | k r�t j j d- � � n t d. d/ t | � } t | t � r�t j | � } | j d0 � d | k r�| j d � d | k r�y) t
j d d | d d! � | d d! <Wq�t k
r�q�Xq�n | j d" � | j d& � | j d# � | j d$ � | j d% � | j d0 � } n | } t } | | k r8|
| k r8t d1 | | � r8t d | d d2 �} nc | r| rt } t d d t d | d d | d
� } | | d <n t } t d. d t | � } d3 | d4 <i } | r'| d | k r�| | d4 <q't j | � } t | � \ } } | j | � | | d4 <t d5 | � } | d6 s'| Sn | d4 c t j j j | � 7<| sUg } n x. | D]& } | d4 c t d | d d2 �7<q\Wt | d7 <t d5 | � } | d8 r�i | d8 d9 6| d8 <n
i | d8 <| r�| d8 r�| d8 | d8 d: <n | rd; | d8 d: <n | r:i | d< 6t d d | � d= 6| d8 d9 <n | S(? u
Manage a Certificate
name
Path to the certificate
days_remaining : 90
The minimum number of days remaining when the certificate should be
recreated. A value of 0 disables automatic renewal.
managed_private_key
Manages the private key corresponding to the certificate. All of the
arguments supported by :py:func:`x509.private_key_managed
<salt.states.x509.private_key_managed>` are supported. If `name` is not
speicified or is the same as the name of the certificate, the private
key and certificate will be written together in the same file.
append_certs:
A list of certificates to be appended to the managed file.
kwargs:
Any arguments supported by :py:func:`x509.create_certificate
<salt.modules.x509.create_certificate>` or :py:func:`file.managed
<salt.states.file.managed>` are supported.
Examples:
.. code-block:: yaml
/etc/pki/ca.crt:
x509.certificate_managed:
- signing_private_key: /etc/pki/ca.key
- CN: ca.example.com
- C: US
- ST: Utah
- L: Salt Lake City
- basicConstraints: "critical CA:true"
- keyUsage: "critical cRLSign, keyCertSign"
- subjectKeyIdentifier: hash
- authorityKeyIdentifier: keyid,issuer:always
- days_valid: 3650
- days_remaining: 0
- backup: True
.. code-block:: yaml
/etc/ssl/www.crt:
x509.certificate_managed:
- ca_server: pki
- signing_policy: www
- public_key: /etc/ssl/www.key
- CN: www.example.com
- days_valid: 90
- days_remaining: 30
- backup: True
u pathu nameu newu overwritei u bitsu
passphraseu aes_128_cbcu cipheru verboseu public_key_passphraseR) R! R* R+ u x509.get_pem_entryR. u RSA PRIVATE KEYu x509.create_private_keyR/ R0 R1 u
public_keyi u x509.read_certificatet certificateu
serial_numberu
Serial Numberu signing_certu! serial:([0-9A-F]{2}:)*[0-9A-F]{2}u serial:--u X509v3 Extensionsu authorityKeyIdentifieru
Not Beforeu MD5 Finger Printu SHA1 Finger Printu SHA-256 Finger Printu Not Afteru %Y-%m-%d %H:%M:%Si u {0} is not a valid Certificate.u {0} does not exist.u ca_serveru signing_policyu1 signing_policy must be specified if ca_server is.u x509.create_certificatet testrunu Issuer Public Keyu x509.verify_signatureu CERTIFICATEu u contentsu file.managedu resultu show_changesu changesu Certificateu Private Keyu New private key generatedu Oldu NewN( t popR R t NoneR2 t updateR- R R" R# R$ t copyt deepcopyt ret subt KeyErrorR
t strptimet nowt daysR% R& R' R: R t dictR6 R3 R4 R5 ( R t days_remainingt managed_private_keyt append_certsR R t rotate_private_keyt new_private_keyt private_key_argsR t current_days_remainingt current_compt currentt current_notafterR* t new_compt new_issuer_public_keyt new_certificateR= t private_rett private_file_argst unique_private_file_argst _t append_certR8 ( ( s4 /usr/lib/python2.7/site-packages/salt/states/x509.pyt certificate_managedn s� ?
!
"id u i c K@ s" | d k r g } n t | � } d }
i } t j j | � r� y} t d d | � } | j � } | j d � | j d � }
t j j |
d � t j j
� j }
| d k r� |
d } n Wq� t j
j k
r� d j | � } q� Xn d j | � } t d
d t d | d
| d | d | d | d | d | � } t d d | � } | j � } | j d � | j d � t | | � \ } } t } | | k r�|
| k r�t d | | � r�t d | d d �| d <n t } | | d <t d | � } | r i | d 6t d d | � d 6| d <n | S( u�
Manage a Certificate Revocation List
name
Path to the certificate
signing_private_key
The private key that will be used to sign this crl. This is
usually your CA's private key.
signing_private_key_passphrase
Passphrase to decrypt the private key.
signing_cert
The certificate of the authority that will be used to sign this crl.
This is usually your CA's certificate.
revoked
A list of certificates to revoke. Must include either a serial number or a
the certificate itself. Can optionally include the revocation date and
notAfter date from the certificate. See example below for details.
days_valid : 100
The number of days the certificate should be valid for.
digest
The digest to use for signing the CRL. This has no effect on versions
of pyOpenSSL less than 0.14.
days_remaining : 30
The crl should be automatically recreated if there are less than
``days_remaining`` days until the crl expires. Set to 0 to disable
automatic renewal.
include_expired : False
If ``True``, include expired certificates in the CRL.
kwargs
Any arguments supported by :py:func:`file.managed <salt.states.file.managed>` are supported.
Example:
.. code-block:: yaml
/etc/pki/ca.crl:
x509.crl_managed:
- signing_private_key: /etc/pki/myca.key
- signing_cert: /etc/pki/myca.crt
- revoked:
- compromized_Web_key:
- certificate: /etc/pki/certs/badweb.crt
- revocation_date: 2015-03-01 00:00:00
- reason: keyCompromise
- terminated_vpn_user:
- serial_number: D6:D2:DC:D8:4D:5C:C0:F4
- not_after: 2016-01-01 00:00:00
- revocation_date: 2015-02-25 00:00:00
- reason: cessationOfOperation
i u
x509.read_crlt crlu Last Updateu Next Updateu %Y-%m-%d %H:%M:%Si u {0} is not a valid CRL.u {0} does not exist.u x509.create_crlR/ t signing_private_keyt signing_private_key_passphraset signing_certt revokedt
days_validt digestt include_expiredu x509.verify_crlu x509.get_pem_entryR. u X509 CRLu contentsu file.managedu Oldu Newu changesN( R@ R R" R# R$ R RB R? R
RG RH RI R% R& R' R: R2 R R R6 ( R R_ R` Ra Rb Rc Rd RK Re R RQ RR RS RT t new_crlR* RU R t new_crl_createdR8 ( ( s4 /usr/lib/python2.7/site-packages/salt/states/x509.pyt crl_managedE sL E
!
c K@ s: t | | � \ } } t d d | � | d <t d | � S( uC
Manage the contents of a PEM file directly with the content in text, ensuring correct formatting.
name:
The path to the file to manage
text:
The PEM formatted text to write.
kwargs:
Any arguments supported by :py:func:`file.managed <salt.states.file.managed>` are supported.
u x509.get_pem_entryR/ u contentsu file.managed( R R R6 ( R R/ t backupR R ( ( s4 /usr/lib/python2.7/site-packages/salt/states/x509.pyt pem_managed� s ( t __doc__t
__future__R R R R
R" RD RB t salt.exceptionsR% t salt.extR t M2Crypto.RSAR t ImportErrorR R R R@ R R- R2 R9 R< R] Rh Rj ( ( ( s4 /usr/lib/python2.7/site-packages/salt/states/x509.pyt <module>� sD
F . � q
Mini Shell