Current File : //proc/thread-self/root/proc/3522530/root/lib/python2.7/site-packages/salt/auth/file.pyc
�
���^c @@ s� d Z d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l Z e j
e � Z d Z
d � Z d � Z d � Z d � Z d � Z d
� Z i e d 6e d 6e d
6Z d � Z d S( u�
Provide authentication using local files
.. versionadded:: 2018.3.0
The `file` auth module allows simple authentication via local files. Different
filetypes are supported, including:
1. Text files, with passwords in plaintext or hashed
2. Apache-style htpasswd files
3. Apache-style htdigest files
.. note::
The ``python-passlib`` library is required when using a ``^filetype`` of
``htpasswd`` or ``htdigest``.
The simplest example is a plaintext file with usernames and passwords:
.. code-block:: yaml
external_auth:
file:
^filename: /etc/insecure-user-list.txt
gene:
- .*
dean:
- test.*
In this example the ``/etc/insecure-user-list.txt`` file would be formatted
as so:
.. code-block:: text
dean:goneFishing
gene:OceanMan
``^filename`` is the only required parameter. Any parameter that begins with
a ``^`` is passed directly to the underlying file authentication function
via ``kwargs``, with the leading ``^`` being stripped.
The text file option is configurable to work with legacy formats:
.. code-block:: yaml
external_auth:
file:
^filename: /etc/legacy_users.txt
^filetype: text
^hashtype: md5
^username_field: 2
^password_field: 3
^field_separator: '|'
trey:
- .*
This would authenticate users against a file of the following format:
.. code-block:: text
46|trey|16a0034f90b06bf3c5982ed8ac41aab4
555|mike|b6e02a4d2cb2a6ef0669e79be6fd02e4
2001|page|14fce21db306a43d3b680da1a527847a
8888|jon|c4e94ba906578ccf494d71f45795c6cb
.. note::
The :py:func:`hashutil.digest <salt.modules.hashutil.digest>` execution
function is used for comparing hashed passwords, so any algorithm
supported by that function will work.
There is also support for Apache-style ``htpasswd`` and ``htdigest`` files:
.. code-block:: yaml
external_auth:
file:
^filename: /var/www/html/.htusers
^filetype: htpasswd
cory:
- .*
When using ``htdigest`` the ``^realm`` must be set:
.. code-block:: yaml
external_auth:
file:
^filename: /var/www/html/.htdigest
^filetype: htdigest
^realm: MySecureRealm
cory:
- .*
i ( t absolute_importt print_functiont unicode_literalsNu filec C@ s t S( N( t __virtualname__( ( ( s2 /usr/lib/python2.7/site-packages/salt/auth/file.pyt __virtual__p s c C@ s� i d d 6d d 6d d 6d d 6d d
6} xB t d t D]2 } | j d � r8 t d t | | | d <q8 q8 Wd
| k r� t j d � t St j j | d
� s� t j d | d
� t St | d � | d <t | d
� | d
<| S( uL
Setup defaults and check configuration variables for auth backends
u textu filetypeu plaintextu hashtypeu :u field_separatori u username_fieldi u password_fieldu
external_authu ^u filenameuY salt.auth.file: An authentication file must be specified via external_auth:file:^filenameu` salt.auth.file: The configured external_auth:file:^filename (%s)does not exist on the filesystem(
t __opts__R t
startswitht logt errort Falset ost patht existst int( t configt opt( ( s2 /usr/lib/python2.7/site-packages/salt/auth/file.pyt _get_file_auth_configt s&
!
c
K@ sC | d } | d } | d } | d d } | d d } t j j j | d � �� } x� | j � D]� } | j � j | � }
y |
| } Wn% t k
r� t j d | | � t
SXy |
| } Wn% t k
r� t j d | | � t
SX| | k rb | d
k r| | k r1t Sn | t d | | � k r1t St
Sqb WWd QXt
S(
u�
The text file function can authenticate plaintext and digest methods
that are available in the :py:func:`hashutil.digest <salt.modules.hashutil.digest>`
function.
u filenameu hashtypeu field_separatoru username_fieldi u password_fieldu ru= salt.auth.file: username field (%s) does not exist in file %su= salt.auth.file: password field (%s) does not exist in file %su plaintextu hashutil.digestN(
t saltt utilst filest fopent readlinest stript splitt
IndexErrorR R R t Truet __salt__(
t usernamet passwordt kwargst filenamet hashtypet field_separatort username_fieldt password_fieldt pwfilet linet fieldst
this_usernamet
this_password( ( s2 /usr/lib/python2.7/site-packages/salt/auth/file.pyt _text� s8
c K@ sf d d l m } | | d � } t j j j | d d � d k rR | j | | � S| j | | � Sd S( u@
Provide authentication via Apache-style htpasswd files
i ( t HtpasswdFileu filenameu passlib_versionu 1.6N( t passlib.apacheR) R R t versionst version_cmpt verifyt check_password( R R R R) R# ( ( s2 /usr/lib/python2.7/site-packages/salt/auth/file.pyt _htpasswd� s
"c K@ s� | j d d � } | s) t j d � t Sd d l m } | | d � } t j j j
| d d � d k r~ | j | | | � S| j | | | � Sd S( u@
Provide authentication via Apache-style htdigest files
u realmuT salt.auth.file: A ^realm must be defined in external_auth:file for htdigest filetypei ( t HtdigestFileu filenameu passlib_versionu 1.6N(
t gett NoneR R R R* R0 R R R+ R, R- R. ( R R R t realmR0 R# ( ( s2 /usr/lib/python2.7/site-packages/salt/auth/file.pyt _htdigest� s
"c K@ s� | j d d � j � } y d d l } | j | d <Wn" t k
rY t j d | � t SX| d k rv t | | | � St | | | � Sd S( uK
Gate function for _htpasswd and _htdigest authentication backends
u filetypeu htpasswdi Nu passlib_versionuF salt.auth.file: The python-passlib library is required for %s filetypeu htdigest(
R1 t lowert passlibt __version__t ImportErrorR R R R4 R/ ( R R R t filetypeR6 ( ( s2 /usr/lib/python2.7/site-packages/salt/auth/file.pyt _htfile� s
u textu htpasswdu htdigestc C@ s9 t � } | s t St j | d d � } | | | | � S( u�
File based authentication
^filename
The path to the file to use for authentication.
^filetype
The type of file: ``text``, ``htpasswd``, ``htdigest``.
Default: ``text``
^realm
The realm required by htdigest authentication.
.. note::
The following parameters are only used with the ``text`` filetype.
^hashtype
The digest format of the password. Can be ``plaintext`` or any digest
available via :py:func:`hashutil.digest <salt.modules.hashutil.digest>`.
Default: ``plaintext``
^field_separator
The character to use as a delimiter between fields in a text file.
Default: ``:``
^username_field
The numbered field in the text file that contains the username, with
numbering beginning at 1 (one).
Default: ``1``
^password_field
The numbered field in the text file that contains the password, with
numbering beginning at 1 (one).
Default: ``2``
u filetypeu text( R R t FILETYPE_FUNCTION_MAPR1 ( R R R t
auth_function( ( s2 /usr/lib/python2.7/site-packages/salt/auth/file.pyt auth s
* ( t __doc__t
__future__R R R t loggingR
t salt.utils.filesR t salt.utils.versionst getLoggert __name__R R R R R( R/ R4 R: R; R= ( ( ( s2 /usr/lib/python2.7/site-packages/salt/auth/file.pyt <module>` s$ ! ,
Mini Shell