Current File : //usr/lib/python2.7/site-packages/salt/renderers/gpg.pyc
�
���^c @@ s. d Z d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l m Z m
Z
d d l Z d d l
Z d d l Z d d l Z d d l m Z d d l m Z e j e � Z e j e j j j d � e j � Z d � Z d � Z d
� Z e d d � Z" e d d � Z# d
d d d � Z$ d S( ut
Renderer that will decrypt GPG ciphers
Any key in the SLS file can be a GPG cipher, and this renderer will decrypt it
before passing it off to Salt. This allows you to safely store secrets in
source control, in such a way that only your Salt master can decrypt them and
distribute them only to the minions that need them.
The typical use-case would be to use ciphers in your pillar data, and keep a
secret key on your master. You can put the public key in source control so that
developers can add new secrets quickly and easily.
This renderer requires the gpg_ binary. No python libraries are required as of
the 2015.8.0 release.
.. _gpg: https://gnupg.org
Setup
-----
To set things up, first generate a keypair. On the master, run the following:
.. code-block:: bash
# mkdir -p /etc/salt/gpgkeys
# chmod 0700 /etc/salt/gpgkeys
# gpg --gen-key --homedir /etc/salt/gpgkeys
Do not supply a password for the keypair, and use a name that makes sense for
your application. Be sure to back up the ``gpgkeys`` directory someplace safe!
.. note::
Unfortunately, there are some scenarios - for example, on virtual machines
which don’t have real hardware - where insufficient entropy causes key
generation to be extremely slow. In these cases, there are usually means of
increasing the system entropy. On virtualised Linux systems, this can often
be achieved by installing the ``rng-tools`` package.
Export the Public Key
---------------------
.. code-block:: bash
# gpg --homedir /etc/salt/gpgkeys --armor --export <KEY-NAME> > exported_pubkey.gpg
Import the Public Key
---------------------
To encrypt secrets, copy the public key to your local machine and run:
.. code-block:: bash
$ gpg --import exported_pubkey.gpg
To generate a cipher from a secret:
.. code-block:: bash
$ echo -n "supersecret" | gpg --armor --batch --trust-model always --encrypt -r <KEY-name>
To apply the renderer on a file-by-file basis add the following line to the
top of any pillar with gpg data in it:
.. code-block:: yaml
#!yaml|gpg
Now with your renderer configured, you can include your ciphers in your pillar
data like so:
.. code-block:: yaml
#!yaml|gpg
a-secret: |
-----BEGIN PGP MESSAGE-----
Version: GnuPG v1
hQEMAweRHKaPCfNeAQf9GLTN16hCfXAbPwU6BbBK0unOc7i9/etGuVc5CyU9Q6um
QuetdvQVLFO/HkrC4lgeNQdM6D9E8PKonMlgJPyUvC8ggxhj0/IPFEKmrsnv2k6+
cnEfmVexS7o/U1VOVjoyUeliMCJlAz/30RXaME49Cpi6No2+vKD8a4q4nZN1UZcG
RhkhC0S22zNxOXQ38TBkmtJcqxnqT6YWKTUsjVubW3bVC+u2HGqJHu79wmwuN8tz
m4wBkfCAd8Eyo2jEnWQcM4TcXiF01XPL4z4g1/9AAxh+Q4d8RIRP4fbw7ct4nCJv
Gr9v2DTF7HNigIMl4ivMIn9fp+EZurJNiQskLgNbktJGAeEKYkqX5iCuB1b693hJ
FKlwHiJt5yA8X2dDtfk8/Ph1Jx2TwGS+lGjlZaNqp3R1xuAZzXzZMLyZDe5+i3RJ
skqmFTbOiA===Eqsm
-----END PGP MESSAGE-----
.. _encrypted-cli-pillar-data:
Encrypted CLI Pillar Data
-------------------------
.. versionadded:: 2016.3.0
Functions like :py:func:`state.highstate <salt.modules.state.highstate>` and
:py:func:`state.sls <salt.modules.state.sls>` allow for pillar data to be
passed on the CLI.
.. code-block:: bash
salt myminion state.highstate pillar="{'mypillar': 'foo'}"
Starting with the 2016.3.0 release of Salt, it is now possible for this pillar
data to be GPG-encrypted, and to use the GPG renderer to decrypt it.
Replacing Newlines
******************
To pass encrypted pillar data on the CLI, the ciphertext must have its newlines
replaced with a literal backslash-n (``\n``), as newlines are not supported
within Salt CLI arguments. There are a number of ways to do this:
With awk or Perl:
.. code-block:: bash
# awk
ciphertext=`echo -n "supersecret" | gpg --armor --batch --trust-model always --encrypt -r user@domain.com | awk '{printf "%s\\n",$0} END {print ""}'`
# Perl
ciphertext=`echo -n "supersecret" | gpg --armor --batch --trust-model always --encrypt -r user@domain.com | perl -pe 's/\n/\\n/g'`
With Python:
.. code-block:: python
import subprocess
secret, stderr = subprocess.Popen(
['gpg', '--armor', '--batch', '--trust-model', 'always', '--encrypt',
'-r', 'user@domain.com'],
stdin=subprocess.PIPE,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE).communicate(input='supersecret')
if secret:
print(secret.replace('\n', r'\n'))
else:
raise ValueError('No ciphertext found: {0}'.format(stderr))
.. code-block:: bash
ciphertext=`python /path/to/script.py`
The ciphertext can be included in the CLI pillar data like so:
.. code-block:: bash
salt myminion state.sls secretstuff pillar_enc=gpg pillar="{secret_pillar: '$ciphertext'}"
The ``pillar_enc=gpg`` argument tells Salt that there is GPG-encrypted pillar
data, so that the CLI pillar data is passed through the GPG renderer, which
will iterate recursively though the CLI pillar dictionary to decrypt any
encrypted values.
Encrypting the Entire CLI Pillar Dictionary
*******************************************
If several values need to be encrypted, it may be more convenient to encrypt
the entire CLI pillar dictionary. Again, this can be done in several ways:
With awk or Perl:
.. code-block:: bash
# awk
ciphertext=`echo -n "{'secret_a': 'CorrectHorseBatteryStaple', 'secret_b': 'GPG is fun!'}" | gpg --armor --batch --trust-model always --encrypt -r user@domain.com | awk '{printf "%s\\n",$0} END {print ""}'`
# Perl
ciphertext=`echo -n "{'secret_a': 'CorrectHorseBatteryStaple', 'secret_b': 'GPG is fun!'}" | gpg --armor --batch --trust-model always --encrypt -r user@domain.com | perl -pe 's/\n/\\n/g'`
With Python:
.. code-block:: python
import subprocess
pillar_data = {'secret_a': 'CorrectHorseBatteryStaple',
'secret_b': 'GPG is fun!'}
secret, stderr = subprocess.Popen(
['gpg', '--armor', '--batch', '--trust-model', 'always', '--encrypt',
'-r', 'user@domain.com'],
stdin=subprocess.PIPE,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE).communicate(input=repr(pillar_data))
if secret:
print(secret.replace('\n', r'\n'))
else:
raise ValueError('No ciphertext found: {0}'.format(stderr))
.. code-block:: bash
ciphertext=`python /path/to/script.py`
With the entire pillar dictionary now encrypted, it can be included in the CLI
pillar data like so:
.. code-block:: bash
salt myminion state.sls secretstuff pillar_enc=gpg pillar="$ciphertext"
i ( t absolute_importt print_functiont unicode_literalsN( t Popent PIPE( t SaltRenderError( t sixu7 -----BEGIN PGP MESSAGE-----.*?-----END PGP MESSAGE-----c C@ s/ t j j j d � } | r | St d � � d S( u5
return the GPG executable or raise an error
u gpgu GPG unavailableN( t saltt utilst patht whichR ( t gpg_exec( ( s6 /usr/lib/python2.7/site-packages/salt/renderers/gpg.pyt
_get_gpg_exec� s c C@ so d } d t k r% t d d � } n | sk t j d t j j t j d t j j t d � � d � � } n | S( u6
return the location of the GPG key directory
u
config.getu
gpg_keydiru
config_diru conf_fileu gpgkeysN( t Nonet __salt__t __opts__t gett osR t joint dirname( t
gpg_keydir( ( s6 /usr/lib/python2.7/site-packages/salt/renderers/gpg.pyt _get_key_dir� s c
C@ s� y% t j j j | � j d d � } Wn t k
r8 n Xt j j j | � } t � d t � d d d d g } t | d t
d t
d
t
d t �} | j d | � \ } } | s� t
j d
| | � | S| Sd S( u�
Given a block of ciphertext as a string, and a gpg object, try to decrypt
the cipher and return the decrypted string. If the cipher cannot be
decrypted, log the error, and return the ciphertext back out.
u \nu
u --homediru --status-fdu 2u --no-ttyu -dt stdint stdoutt stderrt shellt inputu) Could not decrypt cipher %r, received: %rN( R R t stringutilst
to_unicodet replacet UnicodeDecodeErrort to_bytesR R R R t Falset communicatet logt warning( t ciphert cmdt proct decrypted_datat
decrypt_error( ( s6 /usr/lib/python2.7/site-packages/salt/renderers/gpg.pyt _decrypt_ciphertext s %
$c @ s� t j j j � � | � } | rB | j � d � � d � � } n � f d � } t j | � | � � \ } } | d k r� | j d � } n | } y t j j j | d | �} Wn t k
r� n X| S( Nu \nu
c @ s � t | j � � � } | S( N( R) t group( t matcht result( R ( s6 /usr/lib/python2.7/site-packages/salt/renderers/gpg.pyR 0 s i s
t encoding(
R R R R R t GPG_CIPHERTEXTt subnt rstripR R ( R$ t translate_newlinesR- R t rett num( ( R s6 /usr/lib/python2.7/site-packages/salt/renderers/gpg.pyt _decrypt_ciphertexts* s !
c C@ s� t j j j | � r( t | j � | � St | t j � rP t | d | d | �St | t
� r� x3 t j | � D]" \ } } t | d | �| | <qo W| St | t � r� x0 t
| � D]" \ } } t | d | �| | <q� W| S| Sd S( u�
Recursively try to decrypt any object. If the object is a six.string_types
(string or unicode), and it contains a valid GPG header, decrypt it,
otherwise keep going until a string is found.
R1 R- N( R R t stringiot is_readablet _decrypt_objectt getvaluet
isinstanceR t string_typesR4 t dictt iteritemst listt enumerate( t objR1 R- t keyt value( ( s6 /usr/lib/python2.7/site-packages/salt/renderers/gpg.pyR7 D s u baseu c K@ s_ t � s t d � � n t j d t � � | j d t � } t | d | d | j d d � �S( up
Create a gpg object given a gpg_keydir, and then use it to try to decrypt
the data to be rendered.
u GPG unavailableu Reading GPG keys from: %su translate_newlinesR1 R- u encodingN( R R R" t debugR R R R7 R
( t gpg_datat saltenvt slst arglinet kwargsR1 ( ( s6 /usr/lib/python2.7/site-packages/salt/renderers/gpg.pyt render\ s
(% t __doc__t
__future__R R R R t ret loggingt
subprocessR R t salt.utils.pathR t salt.utils.stringiot salt.utils.stringutilst
salt.syspathst salt.exceptionsR t salt.extR t getLoggert __name__R" t compileR R R t DOTALLR. R R R) R R
R4 R7 RH ( ( ( s6 /usr/lib/python2.7/site-packages/salt/renderers/gpg.pyt <module>� s,
Mini Shell