File: //usr/lib/python3.9/site-packages/ipaclient/install/__pycache__/ipa_epn.cpython-39.opt-1.pyc
a
}�fQs � @ s� d Z ddlmZmZ ddlZddlZddlZddlZddlZddl Z ddl
Z
ddl Z ddl Z ddl
mZ ddlmZmZmZ ejZddlmZmZ ddlmZ ddlmZ dd lm Z dd
lm Z dd l m Z dd l!m"Z" dd
l#m$Z$m%Z% ddl&m'Z' ddl(m)Z)m*Z* ddl+m,Z, ddl-m.Z.m/Z/m0Z0 dZ1ddddddddddddddddd d �Z2e �3e4�Z5d)d d �Z6G d!d"� d"�Z7G d#d$� d$e)j8�Z9G d%d&� d&�Z:G d'd(� d(�Z;dS )*zoThis tool prepares then sends email notifications to users
whose passwords are expiring in the near future.
� )�absolute_import�print_functionN)�deque)�datetime� timedelta�timezone)�
formataddr�
formatdate)�
MIMEMultipart)�MIMEText)�Header)�
make_msgid��error)�paths)�api�errors)�is_ipa_client_configured)� admintool�ipaldap)�DN)� Environment�FileSystemLoader�TemplateSyntaxErrorz/etc/ipa/epn.conf� localhost� �< �nonezroot@localhost�IPA-EPNz 28,14,7,3,1�utf8�plainz Your password will expire soon.)� smtp_server� smtp_port� smtp_user�
smtp_password�smtp_client_cert�smtp_client_key�smtp_client_key_pass� smtp_timeout�
smtp_security�
smtp_admin�
smtp_delay� mail_from�mail_from_name� notify_ttls� msg_charset� msg_subtype� msg_subject�daemonc
C s� zht �� dkrW dS t �g � t �t�| �j� t �t� |�j
� t �� dkrXt � d��t
�d| |� W n4 ty� } z t
�d| ||� W Y d}~n
d}~0 0 dS )z0Drop privileges, defaults to daemon:daemon.
r NzCannot drop privileges!z'Dropped privileges to user=%s, group=%sz'Failed to drop privileges to %s, %s: %s)�os�getuid� setgroups�setgid�pwd�getpwnam�pw_uid�setuid�grp�getgrnam�gr_gidr Z RequiresRoot�logger�debug� Exceptionr )Z new_usernameZ
new_groupname�e� rB �=/usr/lib/python3.9/site-packages/ipaclient/install/ipa_epn.py�drop_privilegesN s(
��rD c @ sZ e Zd ZdZdd� Zdd� Zdd� Zdd � Zd
d � Zd d
� Z dd� Z
ddd�Z dd� Z dS )� EPNUserLista" Maintains a list of users whose passwords are expiring.
Provides add(), check(), pop(), and json_print().
From the outside, the list is considered always sorted:
* displaying the list results in a sorted JSON representation thereof
* pop() returns the "most urgent" item from the list.
Internal implementation notes:
* Uses a deque instead of a list for efficiency reasons
* all add()-style methods MUST set _sorted to False.
* all print() and pop-like methods MUST call _sort() first.
c C s d| _ t� | _d S )NF)�_sortedr �_expiring_password_user_dq��selfrB rB rC �__init__w s zEPNUserList.__init__c C s
t | j�S )z)If it quacks like a container...
)�boolrG rH rB rB rC �__bool__{ s zEPNUserList.__bool__c C s
t | j�S )zReturn len(self).)�lenrG rH rB rB rC �__len__� s zEPNUserList.__len__c C s t |�|dg��d��S )z9Get a single value from a multi-valued attr in a safe way� r )�str�get�pop)rI �entry�attrrB rB rC �
get_ldap_attr� s zEPNUserList.get_ldap_attrc C s� zzd| _ |�d�du r*t�d|j� W dS | j�t| �|d�| �|d�| �|d�| �|d�| �|d �t |�d��d
�� W n0 t
y� } zt� d |� W Y d}~n
d}~0 0 dS ) z�Parses and appends an LDAP user entry with the uid, cn,
givenname, sn, krbpasswordexpiration and mail attributes.
F�mailNz(IPA-EPN: No mail address defined for: %s�uid�cn� givenname�sn�krbpasswordexpiration�rW rX rY rZ r[ rV z"IPA-EPN: Could not parse entry: %s) rF rQ r> r ZdnrG �append�dictrU rP �
IndexError�info�rI rS rA rB rB rC �add� s& �
�� zEPNUserList.addc C s. | � � z | j�� W S ty( Y dS 0 dS )zPReturns the "most urgent" user to notify.
In fact: popleft()
FN)�_sortrG �popleftr_ rH rB rB rC rR � s
zEPNUserList.popc C s | j dd� d S )NF�� really_print)�
json_printrH rB rB rC �check� s zEPNUserList.checkTc
C sn z8| � � tjt| j�ddd�}|�d� |r6t|� W n0 tyh } zt� d|� W Y d}~n
d}~0 0 dS )z�Dump self._expiring_password_user_dq to JSON.
Check that the result can be re-rencoded to UTF-8.
If really_print, print the result.
� F)�indentZ ensure_asciir z IPA-EPN: unexpected error: %sN)
rc �json�dumps�listrG �encode�printr@ r> r )rI rf Ztemp_strrA rB rB rC rg � s �
zEPNUserList.json_printc C s4 | j s0t| jt�r0tt| jdd� d��| _d| _ d S )Nc S s | d S )Nr[ rB )�itemrB rB rC �<lambda>� � z#EPNUserList._sort.<locals>.<lambda>)�keyT)rF �
isinstancerG r �sortedrH rB rB rC rc � s ��zEPNUserList._sortN)T)
�__name__�
__module__� __qualname__�__doc__rJ rL rN rU rb rR rh rg rc rB rB rB rC rE k s
rE c s� e Zd ZdZejZdZdZ� fdd�Z e
� fdd��Z � fdd �Z d/� fd d � Z
� fd
d�Zd0dd�Zdd� Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd1d'd(�Zd)d*� Zd+d,� Z d-d.� Z � Z S )2�EPNr z%prog [options]z%Expiring Password Notifications (EPN)c sH t t| ��||� d | _d | _t� | _g | _g | _d | _ d | _
d | _ d S �N) �superrz rJ �_conn� _ssl_contextrE � _expiring_password_user_list�
_ldap_data� _date_ranges�_mailer�env�default_email_domain)rI �options�args�� __class__rB rC rJ � s z EPN.__init__c sh t t| �j|dd� |jdddd dd� |jdd dd d
d� |jd d d
ddd� |jddd
ddd� d S )NT)Z debug_optionz
--from-nbdays� from_nbdays�storezminimal number of days)�dest�action�default�helpz --to-nbdays� to_nbdayszmaximal number of daysz --dry-run�dry_run�
store_trueFz Dry run mode. JSON ouput only.z --mail-test�mailtestzSend a test e-mail)r| rz � add_optionsZ
add_option)�cls�parserr� rB rC r� � s: ����zEPN.add_optionsc
sl t t| �jdd� | jjd ur|z t| jj�dk r8td��W n8 tyr } z | j� dj
|d�� W Y d }~n
d }~0 0 d| j_ | jj d ur�z t| jj �dk r�td��W n8 ty� } z | j� dj
|d�� W Y d }~n
d }~0 0 | jj d u�r | jjd u�r t| jj �t| jj�k�r | j� d� | jj d u�rH| jjd u �rH| j� d � | jj
�rh| jj �rh| j� d
� d S ) NT)Z
needs_rootr zInput is negative.z/--to-nbdays must be a positive integer. {error}r z1--from-nbdays must be a positive integer. {error}z/--from-nbdays must be smaller than --to-nbdays.z4You cannot specify --from-nbdays without --to-nbdaysz5You cannot specify --mail-test and --dry-run together)r| rz �validate_optionsr� r� �int� RuntimeErrorr@ Z
option_parserr �formatr� r� r� �rI rA r� rB rC r� � sN �� ��
��
���zEPN.validate_options�ac s t t| �jdd� d S )Nr� )�
log_file_mode)r| rz �
setup_logging)rI r� r� rB rC r� # s zEPN.setup_loggingc s t t| ��� t� s&t�d� t�� �| �� | � � | �
� | � � | � � | �
� | �� t� | jjrv| �� n.| jjr�| �� | jD ]}| �|� | �� q�| jjr�| �� nJttj j tj j tj j tj j tj j!tj j"| j#| j$tj j%tj j&d�
| _'| �(� d S )Nz,IPA client is not configured on this system.)
�security_protocol�
smtp_hostnamer" r( �
smtp_usernamer$ � ssl_context�x_mailerr0 r/ ))r| rz �runr r> r r � ScriptError�_get_krb5_ticket�_read_configuration�_validate_configuration�_parse_configuration�_get_connection�_read_ipa_configuration�_create_ssl_contextrD r� r� � _gentestdatar� �_build_cli_date_rangesr� �_fetch_data_from_ldap�_parse_ldap_datar� �_pretty_print_data�
MailUserAgentr r� r) r! r" r( r# r$ r~ � command_namer0 r/ r� � _send_emails)rI �
date_ranger� rB rC r� & sD
� zEPN.runNc C sl t jtd�}t �|t j�� �}|t|d� }|durD|t|d� }n|tdd� }t�d||||� ||fS )z�Detects current time and returns a date range, given a number
of days in the future.
If only nbdays_end is specified, the range is 1d long.
�Ztz)�daysN� z�IPA-EPN: Current date: %s
IPA-EPN: Date & time, today at midnight: %s
IPA-EPN: Date range start: %s
IPA-EPN: Date range end: %s
) r �now�UTCZcombine�min�timer r> r? )rI �
nbdays_end� nbdays_startr� Ztoday_at_midnightZ range_endZ range_startrB rB rC �_get_date_range_from_nbdaysP s �
z EPN._get_date_range_from_nbdaysc C sB |� � }t|j�d�dd� |j|j|j|j|jfD �� }|d S )zgConvert datetime to LDAP_GENERALIZED_TIME_FORMAT
Note: Consider moving into ipalib.
rO c s s* | ]"}d dt t|�� t|� V qdS )�0� N)rM rP )�.0rp rB rB rC � <genexpr>n s �z4EPN._datetime_to_generalized_time.<locals>.<genexpr>�Z) Z timetuplerP �tm_year�join�tm_mon�tm_mday�tm_hour�tm_min�tm_sec)rI ZdtZgeneralized_time_strrB rB rC � _datetime_to_generalized_timei s ��
z!EPN._datetime_to_generalized_timec C s t j�dd� dt jd< dS )z�Setup the environment to obtain a krb5 ticket for us using the
system keytab.
Uses CCACHE = MEMORY (limited to the current process).
ZKRB5_CLIENT_KTNAMEz/etc/krb5.keytabzMEMORY:Z
KRB5CCNAMEN)r3 �environ�
setdefaultrH rB rB rC r� z s zEPN._get_krb5_ticketc C sH t dtjdd�}tjf i |�� tjjf i t�� t�d�sDt� � dS )z5Merge in the EPN configuration from /etc/ipa/epn.conf�epnF)�context�confdirZ in_server�finalizeN)
r^ r ZETC_IPAr Z bootstrapr� Z_merge�
EPN_CONFIGZisdoner� )rI Z base_configrB rB rC r� � s �
zEPN._read_configurationc
C s t jj�� dvrtd��t jjdur8t jjdu r8td��t jjdu rPtdt ��z dd� t t jj��
d�D � W n8 t y� } z td t jj|f ��W Y d}~n
d}~0 0 t jj �rzt
t jj � W n0 t y� } ztd
| ��W Y d}~n
d}~0 0 t
t jj �d k �rtd ��dS )
z1Examine the user-provided configuration.
)r �starttls�sslz3smtp_security must be one of: none, starttls or sslNz&smtp_user set and smtp_password is notz notify_ttls must be set in %sc S s g | ] }t |��qS rB �r� �r� �krB rB rC �
<listcomp>� rr z/EPN._validate_configuration.<locals>.<listcomp>�,z%Failed to parse notify_ttls: '%s': %sz smtp_delay is misformatted: %sr z#smtp_delay cannot be less than zero)r r� r) �lowerr� r# r$ r. �EPN_CONFrP �split�
ValueErrorr+ �floatr� rB rB rC r� � s* �
�
"zEPN._validate_configurationc C sn dd� t tjj��d�D �}|�� |D ] }| j�| jd|d d�� q(t t
j � tjj
d��}t|d�| _dS ) z
c S s g | ] }t |��qS rB r� r� rB rB rC r� � rr z,EPN._parse_configuration.<locals>.<listcomp>r� Nr� �r� r� r� )�loader)rP r r� r. r� �sortr� r] r� r r3 �pathr� r� r )rI ZdaylistZdayr� rB rB rC r� � s ��zEPN._parse_configurationc C s> t jj�� t j�� d }|�ddg�d | _t jj�� dS )zGet the IPA configuration�resultZipadefaultemaildomainNr ) r ZBackendZ rpcclientZconnectZCommandZ config_showrQ r� Z
disconnect)rI r� rB rB rC r� � s ��zEPN._read_ipa_configurationc
C s� | j dur| j S z tj�tjj�| _ | j �� W nj ty� z tj� tjj
�| _ | j � � W n6 ty� } z t �
d| j j|� W Y d}~n
d}~0 0 Y n0 | j S )z4Create a connection to LDAP and bind to it.
Nz$Unable to bind to LDAP server %s: %s)r} r Z
LDAPClientZ
from_realmr r� ZrealmZ
external_bindr@ Zfrom_hostname_secureZserverZ gssapi_bindr> r Zldap_urir� rB rB rC r� � s$
�� zEPN._get_connectionc C sH t jj�� dv rDt�� | _t jjrD| jjt jjt jj t
t jj �d� dS )z�Create SSL context.
This must be done before the dropping priviliges to allow
read in the smtp client's certificate and private key if specified.
)r� r� )ZcertfileZkeyfile�passwordN) r r� r) r� r� Zcreate_default_contextr~ r% Zload_cert_chainr& rP r' rH rB rB rC r� � s
�zEPN._create_ssl_contextc C s� | j du rt�d� ttjjtjj�}g d�}d| �|d �| �|d �f }zTz | j j |||| j j
d�| _ W n t j
y� t�d� Y n0 W t�d t| j �� nt�d t| j �� 0 dS )
z�Run a LDAP query to fetch a list of user entries whose passwords
would expire in the near future. Store in self._ldap_data.
Nz5IPA-EPN: Connection to LDAP not established. Exiting.)rW r[ rV rX rY Zsurnamezj(&(!(nsaccountlock=TRUE)) (krbpasswordexpiration<=%s) (krbpasswordexpiration>=%s))r� r )�filter�
attrs_listZscopez
Empty Result.z%d entries found)r} r> r r r r� Zcontainer_userZbasednr� Z get_entriesZ
SCOPE_SUBTREEr� r Z EmptyResultr? rM )rI r� Z search_baser� Z
search_filterrB rB rC r� � s,
� ���
� zEPN._fetch_data_from_ldapc
C sx | j rt| j D ]}| j�|� q zLz| jdd� W n0 ty` } zt�d|� W Y d}~n
d}~0 0 W g | _ ng | _ 0 dS )zHFill out self._expiring_password_user_list from data from ldap.
Fre z"IPA-EPN: Could not create JSON: %sN)r� r rb r� r@ r> r ra rB rB rC r� s
$zEPN._parse_ldap_dataTc C s | j j|d� dS )z8Dump self._expiring_password_user_list to JSON.
re N)r rg )rI rf rB rB rC r� s �zEPN._pretty_print_datac
C sP | j d u rt�d� d S z| j�d�}W n6 ty^ } z td|j|f ��W Y d }~n
d }~0 0 tjj rrtjj }n
d| j
}| j �rB| j � � }|j
|d |d |d |d |d d
�}| j jtjj|t�|d �|tjjd � tjtd
�}t�|d d�jtd�}t�d|d |d || j|� tjjr|t� t tjj�d � q|| j � � d S )Nz#IPA-EPN: mailer was not configured.zexpire_msg.templatez Parsing template %s failed: %sz
noreply@%srW rY rZ rX r[ )rW �first�last�fullnameZ
expirationrV �� mail_subject� mail_body� subscribersr, r- r� �%Y-%m-%d %H:%M:%S)Ztzinfoz5Notified %s (%s). Password expiring in %d days at %s.i� ) r� r> r r� Z get_templater r� �filenamer r, r� r rR Zrender� send_messager1 �astZ literal_evalr- r r� r� �strptime�replacer? r� r+ r� �sleepr� �cleanup)rI �templaterA r, rS �bodyr� �expdaterB rB rC r� sV
�
� � ���zEPN._send_emailsc C sF t jtd��d�}tdgdgdgdg|gtjjgd�}| j� |� dS ) z@Generate a sample user to process through the template.
r� r� ZSAUSERz SAMPLE USERZSAMPLEZUSERr\ N)
r r� r� �strftimer^ r r� r* r rb )rI r� rS rB rB rC r� H s �zEPN._gentestdatac C sr g | _ t�d� | jjdurD| j �| jt| jj�t| jj�d�� n*| jjdurn| j �| jdt| jj�d�� dS )z�When self.options.to_nbdays is set, override the date ranges read
from the configuration file and build the date ranges from the CLI
options.
z,IPA-EPN: Ignoring configuration file ranges.Nr� ) r� r> r? r� r� r] r� r� r� rH rB rB rC r� V s
�� ��zEPN._build_cli_date_ranges)r� )N)T) rv rw rx r� r Z
IPAEPN_LOGZ
log_file_name�usage� descriptionrJ � classmethodr� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� �
__classcell__rB rB r� rC rz � s2 % *
$
*rz c @ s< e Zd ZdZddd�Zd d
� Zdd d �Zd
d� Zdd� ZdS )� MTAClientz/MTA Client class. Originally done for EPN.
r r r r Nc C sZ || _ || _|| _|| _|| _|| _|| _d | _| j dkrNd| jvrNt� d� | �
� d S )Nr r zBIPA-EPN: using cleartext for non-localhost SMTPd is not supported.) �_security_protocol�_smtp_hostname�
_smtp_port�
_smtp_timeout� _username� _passwordr~ r} r> r �_connect)rI r� r� r" r( r� r$ r� rB rB rC rJ p s
���zMTAClient.__init__c C s | � � d S r{ )� _disconnectrH rB rB rC r� � s zMTAClient.cleanupc C s� d }z�z| j �tjj||�}W n0 tyN } zt�d|� W Y d }~n
d }~0 0 W |r�|D ]$}t�d||| d || d � qZt�d� n:|r�|D ]$}t�d||| d || d � q�t�d� 0 d S )Nz IPA-EPN: Failed to send mail: %sz+IPA-EPN: Failed to send mail to '%s': %s %sr r� z6IPA-EPN: Failed to send mail to at least one recipient)r} Zsendmailr r� r* r@ r> r` )rI � message_strr� r� rA rs rB rB rC r� � s:
�$
���
��zMTAClient.send_messagec
C s zH| j �� dv r*tj| j| j| jd�| _n tj| j| j| j| j d�| _W nH t
tj fy� } z*dj | j| j|d�}t
�|��W Y d }~n
d }~0 0 z| j�� W n: tj y� } z t�d| j| j|� W Y d }~n
d }~0 0 | j �� dk�rJz | jj| j d� | j�� W n> tj �yH } z"td | j| j|f ��W Y d }~n
d }~0 0 | j�r| j�r| j�d
��r�z,| j�| j| j� | j d k�r�t�d � W nf tj�y� td
| j| jf ��Y n> tj �y� } z"td| j| j|f ��W Y d }~n
d }~0 0 nd| j| jf }t�|� d S )N)r r� )�host�port�timeout)r r r
r� zPIPA-EPN: Could not connect to the configured SMTP server: {host}:{port}: {error})r r r z'IPA-EPN: EHLO failed for host %s:%s: %sr� )r� z;IPA-EPN: Unable to create an encrypted session to %s:%s: %sZAUTHr z6IPA-EPN: Username and Password were sent in the clear.zTIPA-EPN: Authentication to %s:%s failed, please check your username and/or password:z IPA-EPN: SMTP Error at %s:%s:%sz9IPA-EPN: Server at %s:%s does not support authentication.)r� r� �smtplibZSMTPr r r r} ZSMTP_SSLr~ � socketerrorZ
SMTPExceptionr� r r� Zehlor> r r� r� r r Zhas_extnZloginZwarningZSMTPAuthenticationError)rI rA �msgZerr_strrB rB rC r � s� �
� �� � �� ������� ���zMTAClient._connectc C s | j �� d S r{ )r} �quitrH rB rB rC r � s zMTAClient._disconnect)r r r r NNN)NN) rv rw rx ry rJ r� r� r r rB rB rB rC r� l s �
Mr� c
@ s4 e Zd ZdZdd d
�Zd d � Zdd
d�Zdd� ZdS )r� zThe MUA class for EPN.
r r r r Nr r c C sL || _ d | _d | _d | _| | _|
| _d | _d | _t|||||||d�| _ d S )N)r� r� r" r( r� r$ r� )
� _x_mailer�_subject�_body� _subscribers�_subtype�_charset�_msg� _message_strr� � _mta_client) rI r� r� r" r( r� r$ r� r� r0 r/ rB rB rC rJ � s" �zMailUserAgent.__init__c C s | j �� d S r{ )r r� rH rB rB rC r� s zMailUserAgent.cleanupc C sJ d|||||fv r t �d� dS | j|||||d� | jj| j|d� dS )zfGiven mail_subject, mail_body, and subscribers, composes
the message and sends it.
Nz(IPA-EPN: Tried to send an empty message.Fr� )r r� T)r> r �_compose_messager r� r �rI r� r� r� r, r- rB rB rC r� # s �
��zMailUserAgent.send_messagec C s� || _ || _|| _t| jd�| _t||f�| jd< d�| j�| jd< tdd�| jd< t | j | j�| jd< t
� | jd < d
| j_ d | jvr�| j r�| j�
d | j � | j�t| jd | j| jd
�� | j�� | _dS )z7The composer creates a MIME multipart message.
)r ZFromz, ZToT)� localtimeZDateZSubjectz
Message-IdzMultipart messagezX-Mailerz
)r r N)r r r r
r r r r� r r r
Zpreambler Z
add_headerZattachr r Z as_stringr r rB rB rC r : s( ��z MailUserAgent._compose_message)
r r r r NNNNr r )NNNNN)rv rw rx ry rJ r� r� r rB rB rB rC r� � s" �
# �
r� )r2 r2 )<ry Z
__future__r r r� r; rk r3 r7 Zloggingr r� r� � collectionsr r r r Zutcr� Z email.utilsr r Zemail.mime.multipartr
Zemail.mime.textr Z email.headerr r
Zsocketr r Zipaplatform.pathsr Zipalibr r Z ipalib.factsr Z ipapythonr r Z ipapython.dnr Zjinja2r r r r� r� Z getLoggerrv r> rD rE Z AdminToolrz r� r� rB rB rB rC �<module> sl �
a #